pennyrouter 0.2.24 → 0.2.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pennyrouter",
-  "version": "0.2.24",
+  "version": "0.2.26",
   "description": "Install and manage PennyRouter local coding-agent integrations.",
   "homepage": "https://pennyrouter.com",
   "bugs": {

package/src/cli.js

@@ -1,4 +1,5 @@
 import { spawn, spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
 import { emitKeypressEvents } from "node:readline";
 import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
@@ -25,6 +26,7 @@ import {
   APP_URL,
   createCliSession,
   forgetAnthropicToken,
+  forgetUpstreamCredential,
   maskKey,
   pollForKey,
   probeClaudeCodeGateway,
@@ -71,6 +73,7 @@ const CLAUDE_PROVIDER_OPTIONS = [
   { id: "subscription", name: "Claude subscription" },
   { id: "anthropic-api", name: "Anthropic API key" },
   { id: "openrouter", name: "OpenRouter API key" },
+  { id: "anthropic-proxy", name: "Other proxy (custom base URL)" },
 ];
 const CODEX_PROVIDER_OPTIONS = [
   { id: "subscription", name: "ChatGPT subscription" },
@@ -168,6 +171,10 @@ function parseArgs(argv) {
     else if (arg === "--openai-api-key") flags.openaiApiKey = rest[++i] || "";
     else if (arg.startsWith("--openai-api-key=")) flags.openaiApiKey = arg.slice("--openai-api-key=".length);
     else if (arg === "--openrouter-api-key") flags.openrouterApiKey = rest[++i] || "";
+    else if (arg === "--proxy-base-url") flags.proxyBaseUrl = rest[++i] || "";
+    else if (arg.startsWith("--proxy-base-url=")) flags.proxyBaseUrl = arg.slice("--proxy-base-url=".length);
+    else if (arg === "--proxy-api-key") flags.proxyApiKey = rest[++i] || "";
+    else if (arg.startsWith("--proxy-api-key=")) flags.proxyApiKey = arg.slice("--proxy-api-key=".length);
     else if (arg.startsWith("--openrouter-api-key=")) flags.openrouterApiKey = arg.slice("--openrouter-api-key=".length);
     else if (arg === "--harness") flags.harness = rest[++i] || "";
     else if (arg.startsWith("--harness=")) flags.harness = arg.slice("--harness=".length);
@@ -181,15 +188,98 @@ function parseArgs(argv) {
     // `--local=<url>` overrides the port/host.
     else if (arg === "--local") flags.gatewayBaseUrl = "http://localhost:8400";
     else if (arg.startsWith("--local=")) flags.gatewayBaseUrl = arg.slice("--local=".length);
+    // --prod: point the installed harness back at the default production gateway
+    // (https://api.pennyrouter.com). Undoes --local.
+    else if (arg === "--prod") flags.gatewayBaseUrl = DEFAULT_GATEWAY_BASE_URL;
     else if (arg === "--forget") flags.forget = true;
     else if (arg === "--forget-token") flags.forgetToken = true;
+    else if (arg === "--config") flags.configPath = rest[++i] || "";
+    else if (arg.startsWith("--config=")) flags.configPath = arg.slice("--config=".length);
     else if (!arg.startsWith("-")) flags.args.push(arg);
     else throw new Error(`Unknown option "${arg}". Run "pennyrouter help".`);
   }
 
+  if (flags.configPath) applyConfigFile(flags);
+
   return { command, flags };
 }
 
+// Lets a GUI installer (e.g. the macOS DMG) answer the install questions up front instead of
+// over a TTY: pick harnesses, pick funding per harness, optionally supply keys. Populates the
+// same `flags` fields the equivalent CLI flags set, so it flows through the existing
+// non-interactive paths unchanged. CLI flags win over the config file where both are given.
+// Funding choices imply --yes (skip remaining prompts) but, unlike bare --yes, do NOT suppress
+// the Claude subscription browser sign-in — see maybeConfigureClaudeAnthropicAuth.
+function applyConfigFile(flags) {
+  let config;
+  try {
+    config = JSON.parse(readFileSync(flags.configPath, "utf8"));
+  } catch (error) {
+    throw new Error(`Could not read --config file "${flags.configPath}": ${error.message}`);
+  }
+
+  if (config.harnesses && flags.harness === undefined) {
+    flags.harness = config.harnesses.join(",");
+  }
+  const claudeFunding = new Set(config.claudeFunding || []);
+  const codexFunding = new Set(config.codexFunding || []);
+  if (claudeFunding.has("subscription") && flags.anthropicAuth === undefined) {
+    flags.anthropicAuth = true;
+  }
+  if (claudeFunding.has("anthropic-api") && flags.anthropicApiKey === undefined) {
+    flags.anthropicApiKey = config.anthropicApiKey || "";
+  }
+  if ((claudeFunding.has("openrouter") || codexFunding.has("openrouter"))
+      && flags.openrouterApiKey === undefined) {
+    flags.openrouterApiKey = config.openrouterApiKey || "";
+  }
+  if (codexFunding.has("openai-api") && flags.openaiApiKey === undefined) {
+    flags.openaiApiKey = config.openaiApiKey || "";
+  }
+  if (claudeFunding.has("anthropic-proxy")) {
+    if (flags.proxyBaseUrl === undefined) flags.proxyBaseUrl = config.proxyBaseUrl || "";
+    if (flags.proxyApiKey === undefined) flags.proxyApiKey = config.proxyApiKey || "";
+  }
+
+  flags.yes = true;
+  flags.fromConfig = true;
+  flags.configClaudeFunding = claudeFunding;
+  flags.configCodexFunding = codexFunding;
+}
+
+// A harness needs the account-claim/funding flow only if it's new, or if the funding the
+// config asked for differs from what's already stored on it — an unchanged re-run of
+// --config should behave like `update`, not force a fresh Claude/PennyRouter sign-in.
+// Plain (non--config) installs call every selected harness "changed" by always passing an
+// empty requested set here, so this only takes effect on the --config path (see `needsAuth`
+// in install()).
+export function harnessFundingChanged(flags, harness, manifest) {
+  const existingRecord = (manifest.installations || []).find(
+    (candidate) => candidate.harness === harness.id,
+  );
+  if (!existingRecord) return true;
+
+  if (harness.id === "claude-code") {
+    const requested = flags.configClaudeFunding || new Set();
+    if (requested.size === 0) return false;
+    const current = existingRecord.user_funded_provider === "claude-subscription"
+      ? "subscription"
+      : existingRecord.user_funded_provider;
+    return requested.size !== 1 || !requested.has(current);
+  }
+
+  if (harness.id === "codex") {
+    const requested = flags.configCodexFunding || new Set();
+    if (requested.size === 0) return false;
+    const current = existingRecord.openai_subscription_auth
+      ? "subscription"
+      : existingRecord.user_funded_provider;
+    return requested.size !== 1 || !requested.has(current);
+  }
+
+  return false;
+}
+
 async function authProvider(flags) {
   const provider = (flags.args[0] || "anthropic").toLowerCase();
   if (provider !== "anthropic" && provider !== "claude") {
@@ -204,11 +294,21 @@ async function authProvider(flags) {
         "No PennyRouter key found in Claude Code settings. Pass `--penny-key pr-...`.",
       );
     }
-    const gatewayBaseUrl = flags.gatewayBaseUrl || process.env.PENNYROUTER_GATEWAY_BASE_URL || DEFAULT_GATEWAY_BASE_URL;
+    // Resolve against the INSTALLED config before falling back to the prod default.
+    // This is a destructive call against whichever gateway it reaches, so defaulting to
+    // production while the user is working against a local gateway would silently delete
+    // the wrong account's token (and leave the local one in place, looking like a no-op).
+    const globalAuth = await readClaudeCodeGatewayAuth();
+    const gatewayBaseUrl = flags.gatewayBaseUrl
+      || process.env.PENNYROUTER_GATEWAY_BASE_URL
+      || launchConfig.gateway_base_url
+      || globalAuth.gatewayBaseUrl
+      || DEFAULT_GATEWAY_BASE_URL;
     if (flags.dryRun) {
       console.log(`Will delete stored Anthropic token from gateway: ${gatewayBaseUrl}`);
       return;
     }
+    console.log(`Gateway: ${gatewayBaseUrl}`);
     const ok = await forgetAnthropicToken({ gatewayBaseUrl, apiKey: pennyKey });
     if (ok) {
       console.log("Successfully forgot stored Anthropic token on server.");
@@ -436,40 +536,75 @@ export async function install(flags = {}) {
     return;
   }
 
-  const session = await createCliSession({
-    appUrl: flags.appUrl || APP_URL,
-    harnesses: selected.map((harness) => harness.id),
-    accountMode: "existing",
-  });
+  // A --config re-run against an existing install only needs a fresh account claim and
+  // funding popups for harnesses that are actually new or whose requested funding differs
+  // from what's already stored — an unchanged harness should behave like `update`, not
+  // trigger the Claude/PennyRouter sign-in windows again. Plain (non-config) installs always
+  // treat everything selected as needing auth, matching the original behavior.
+  const needsAuth = flags.fromConfig
+    ? selected.filter((harness) => harnessFundingChanged(flags, harness, manifest))
+    : selected;
 
-  console.log("Opening your browser to log in and authorize this machine with your PennyRouter account...");
-  console.log(`If your browser did not open, visit:\n${session.authorize_url}`);
-  if (!flags.noBrowser) openBrowser(session.authorize_url);
-  console.log("");
-  console.log("Waiting for approval...");
+  let claim;
+  let claudeAnthropicAuth = null;
+  let funding = { credentials: [], codexSubscriptionAuth: false, claudeCredentialProvider: null, codexCredentialProvider: null };
+  let gatewayBaseUrl;
 
-  const claim = await pollForKey(session);
-  console.log(`Authorized. Received key ${maskKey(claim.api_key)}.`);
-  console.log("");
-
-  const claudeProviders = await selectClaudeFundingProviders(flags, selected);
-  const codexProviders = await selectCodexFundingProviders(flags, selected);
-  const claudeAnthropicAuth = await maybeConfigureClaudeAnthropicAuth(
-    flags, selected, claudeProviders.has("subscription"));
-  const funding = await configureUserFunding(
-    flags, selected, claudeAnthropicAuth, claudeProviders, codexProviders);
-  const gatewayBaseUrl = flags.gatewayBaseUrl || claim.gateway_base_url;
-
-  for (const credential of funding.credentials) {
-    await storeUpstreamCredential({
-      gatewayBaseUrl,
-      apiKey: claim.api_key,
-      provider: credential.provider,
-      token: credential.token,
+  if (needsAuth.length === 0) {
+    const launchConfig = await loadPennyConfig();
+    const globalAuth = await readClaudeCodeGatewayAuth();
+    const apiKey = flags.pennyKey || launchConfig.api_key || globalAuth.apiKey;
+    if (!apiKey) {
+      throw new Error(
+        "Could not find your PennyRouter key in the local config. Pass `--penny-key pr-...`, "
+        + "or remove --config to re-authorize.",
+      );
+    }
+    console.log("No new tools or funding requested — refreshing your existing setup.");
+    console.log("");
+    claim = { api_key: apiKey, gateway_base_url: null };
+    gatewayBaseUrl = flags.gatewayBaseUrl
+      || launchConfig.gateway_base_url
+      || globalAuth.gatewayBaseUrl
+      || process.env.PENNYROUTER_GATEWAY_BASE_URL
+      || DEFAULT_GATEWAY_BASE_URL;
+  } else {
+    const session = await createCliSession({
+      appUrl: flags.appUrl || APP_URL,
+      harnesses: selected.map((harness) => harness.id),
+      accountMode: "existing",
     });
+
+    console.log("Opening your browser to log in and authorize this machine with your PennyRouter account...");
+    console.log(`If your browser did not open, visit:\n${session.authorize_url}`);
+    if (!flags.noBrowser) openBrowser(session.authorize_url);
+    console.log("");
+    console.log("Waiting for approval...");
+
+    claim = await pollForKey(session);
+    console.log(`Authorized. Received key ${maskKey(claim.api_key)}.`);
+    console.log("");
+
+    const claudeProviders = await selectClaudeFundingProviders(flags, needsAuth);
+    const codexProviders = await selectCodexFundingProviders(flags, needsAuth);
+    claudeAnthropicAuth = await maybeConfigureClaudeAnthropicAuth(
+      flags, needsAuth, claudeProviders.has("subscription"));
+    funding = await configureUserFunding(
+      flags, needsAuth, claudeAnthropicAuth, claudeProviders, codexProviders);
+    gatewayBaseUrl = flags.gatewayBaseUrl || claim.gateway_base_url;
+
+    for (const credential of funding.credentials) {
+      await storeUpstreamCredential({
+        gatewayBaseUrl,
+        apiKey: claim.api_key,
+        provider: credential.provider,
+        token: credential.token,
+        metadata: credential.metadata,
+      });
+    }
   }
 
-  if (selected.some((harness) => harness.id === "claude-code")) {
+  if (needsAuth.some((harness) => harness.id === "claude-code")) {
     console.log("Verifying modern Claude Code compatibility before changing local settings...");
     await probeClaudeCodeGateway({ gatewayBaseUrl, apiKey: claim.api_key });
     console.log("");
@@ -501,8 +636,9 @@ export async function install(flags = {}) {
         assertNoRunningHarness(harness.id, flags);
       }
 
+      const harnessNeededAuth = needsAuth.includes(harness);
       const codexSubscriptionAuth = harness.id === "codex"
-        ? funding.codexSubscriptionAuth
+        ? (harnessNeededAuth ? funding.codexSubscriptionAuth : Boolean(existingRecord?.openai_subscription_auth))
         : false;
       const claudeSubscriptionAuth = harness.id === "claude-code"
         && Boolean(claudeAnthropicAuth || existingRecord?.anthropic_token_stored);
@@ -550,11 +686,20 @@ export async function install(flags = {}) {
         record.anthropic_token_stored = true;
         record.token_source = claudeAnthropicAuth?.source || existingRecord?.token_source || "stored";
       }
-      if (harness.id === "claude-code" && funding.claudeCredentialProvider) {
-        record.user_funded_provider = funding.claudeCredentialProvider;
+      if (harness.id === "claude-code") {
+        record.user_funded_provider = harnessNeededAuth
+          ? (funding.claudeCredentialProvider || existingRecord?.user_funded_provider)
+          : existingRecord?.user_funded_provider;
+        // Host only, never the key — the key lives encrypted on the gateway.
+        const proxyBaseUrl = harnessNeededAuth
+          ? (funding.claudeProxyBaseUrl ?? existingRecord?.proxy_base_url ?? null)
+          : (existingRecord?.proxy_base_url ?? null);
+        if (proxyBaseUrl) record.proxy_base_url = proxyBaseUrl;
       }
-      if (harness.id === "codex" && funding.codexCredentialProvider) {
-        record.user_funded_provider = funding.codexCredentialProvider;
+      if (harness.id === "codex") {
+        record.user_funded_provider = harnessNeededAuth
+          ? (funding.codexCredentialProvider || existingRecord?.user_funded_provider)
+          : existingRecord?.user_funded_provider;
       }
       if (harness.id === "codex") record.openai_subscription_auth = codexSubscriptionAuth;
       records.push(record);
@@ -936,14 +1081,19 @@ async function selectClaudeFundingProviders(flags, selected) {
       || process.env.ANTHROPIC_AUTH_TOKEN)) supplied.add("subscription");
   if (flags.anthropicApiKey || process.env.ANTHROPIC_API_KEY) supplied.add("anthropic-api");
   if (flags.openrouterApiKey || process.env.OPENROUTER_API_KEY) supplied.add("openrouter");
+  if ((flags.proxyBaseUrl || process.env.PENNYROUTER_PROXY_BASE_URL)
+      && (flags.proxyApiKey || process.env.PENNYROUTER_PROXY_API_KEY)) {
+    supplied.add("anthropic-proxy");
+  }
 
   // Explicit flags are the automation selector. Interactive installs always default to the
   // subscription alone; environment keys are used if the user checks their provider.
   const explicit = flags.anthropicAuth || flags.noAnthropicAuth || flags.token
-    || flags.tokenCommand || flags.anthropicApiKey || flags.openrouterApiKey;
+    || flags.tokenCommand || flags.anthropicApiKey || flags.openrouterApiKey
+    || flags.proxyBaseUrl || flags.proxyApiKey;
   if (explicit || flags.yes || !input.isTTY || !output.isTTY) return supplied;
 
-  console.log("PennyRouter can use your Claude subscription, an Anthropic API key, or an OpenRouter API key to run Claude Code.");
+  console.log("PennyRouter can use your Claude subscription, an Anthropic API key, an OpenRouter API key, or your own Anthropic-compatible proxy to run Claude Code.");
   console.log("Choose one or more providers. PennyRouter will try them in order when available.");
   return promptFundingProviderCheckboxes(
     CLAUDE_PROVIDER_OPTIONS,
@@ -982,7 +1132,10 @@ async function maybeConfigureClaudeAnthropicAuth(flags, selected, enabled = true
     if (tokenResult.token) return tokenResult;
   }
 
-  if (flags.yes || !input.isTTY || !output.isTTY) {
+  // --config drives --yes to skip prompts, but it still expects the subscription browser
+  // sign-in to run — the caller (e.g. the macOS installer) attaches a pty for exactly this,
+  // so treat it like the interactive path rather than the plain --yes/non-TTY automation path.
+  if ((flags.yes && !flags.fromConfig) || !input.isTTY || !output.isTTY) {
     if (flags.anthropicAuth) {
       throw new Error(
         "Claude subscription auth was requested, but no Anthropic bearer token was found. Pass --token, --token-command, or ANTHROPIC_AUTH_TOKEN.",
@@ -998,7 +1151,8 @@ async function maybeConfigureClaudeAnthropicAuth(flags, selected, enabled = true
   if (commandExists("claude")) {
     // The user already opted into subscription auth above, so run `claude setup-token`
     // directly and capture the token — no copy-paste, no second confirm. The command
-    // opens the browser for approval inline. On failure we fall through to manual paste.
+    // opens the browser for approval inline. On failure we fall through to manual paste,
+    // unless we came from --config, where there's no terminal to paste into.
     console.log("Launching Claude sign-in — approve in your browser…");
     const captured = await runClaudeSetupToken();
     if (captured) {
@@ -1006,8 +1160,13 @@ async function maybeConfigureClaudeAnthropicAuth(flags, selected, enabled = true
       console.log("");
       return { token: captured, source: "setup-token" };
     }
+    if (flags.fromConfig) {
+      throw new Error("Claude sign-in did not complete. Run the installer again.");
+    }
     console.log("");
     console.log("Couldn't capture a token automatically. Paste it below, or leave blank to skip.");
+  } else if (flags.fromConfig) {
+    throw new Error("Claude Code was not found on PATH, so subscription sign-in could not run.");
   } else {
     console.log("Claude Code was not found on PATH. Paste an Anthropic bearer token, or leave blank to skip.");
   }
@@ -1037,6 +1196,12 @@ async function configureUserFunding(flags, selected, claudeAnthropicAuth,
   let openrouterApiKey = String(
     flags.openrouterApiKey || process.env.OPENROUTER_API_KEY || "",
   ).trim();
+  let proxyBaseUrl = String(
+    flags.proxyBaseUrl || process.env.PENNYROUTER_PROXY_BASE_URL || "",
+  ).trim();
+  let proxyApiKey = String(
+    flags.proxyApiKey || process.env.PENNYROUTER_PROXY_API_KEY || "",
+  ).trim();
   const codexSubscriptionAuth = wantsCodex && codexProviders.has("subscription")
     ? await detectCodexChatgptAuth()
     : false;
@@ -1049,6 +1214,19 @@ async function configureUserFunding(flags, selected, claudeAnthropicAuth,
     if (!interactive) throw new Error("OpenRouter was selected, but no key was provided.");
     openrouterApiKey = (await promptSecretish("OpenRouter API key: ")).trim();
   }
+  if (wantsClaude && claudeProviders.has("anthropic-proxy") && !(proxyBaseUrl && proxyApiKey)) {
+    if (!interactive) {
+      throw new Error(
+        "Other proxy was selected, but --proxy-base-url and --proxy-api-key were not both provided.",
+      );
+    }
+    // The URL is not a secret and is easy to mistype, so it echoes; the key does not.
+    if (!proxyBaseUrl) proxyBaseUrl = await promptText("Proxy base URL (e.g. https://proxy.example.com): ");
+    if (!proxyApiKey) proxyApiKey = (await promptSecretish("Proxy API key: ")).trim();
+    if (!proxyBaseUrl || !proxyApiKey) {
+      throw new Error("Other proxy requires both a base URL and an API key.");
+    }
+  }
   if (wantsCodex && codexProviders.has("subscription") && !codexSubscriptionAuth) {
     throw new Error(
       "ChatGPT subscription was selected, but Codex is not logged in. Run `codex login`, or select an API-key provider.",
@@ -1063,7 +1241,9 @@ async function configureUserFunding(flags, selected, claudeAnthropicAuth,
     openrouterApiKey = (await promptSecretish("OpenRouter API key: ")).trim();
   }
 
-  if (wantsClaude && !claudeAnthropicAuth && !anthropicApiKey && !openrouterApiKey) {
+  const claudeProxyConfigured = Boolean(proxyBaseUrl && proxyApiKey);
+  if (wantsClaude && !claudeAnthropicAuth && !anthropicApiKey && !openrouterApiKey
+      && !claudeProxyConfigured) {
     if (!interactive) {
       throw new Error(
         "Claude Code requires a Claude subscription, --anthropic-api-key (or ANTHROPIC_API_KEY), "
@@ -1116,13 +1296,23 @@ async function configureUserFunding(flags, selected, claudeAnthropicAuth,
   if ((wantsClaude || wantsCodex) && openrouterApiKey) {
     credentials.push({ provider: "openrouter", token: openrouterApiKey });
   }
+  if (wantsClaude && claudeProxyConfigured) {
+    credentials.push({
+      provider: "anthropic_proxy",
+      token: proxyApiKey,
+      metadata: { base_url: proxyBaseUrl },
+    });
+  }
 
   return {
     credentials,
     codexSubscriptionAuth,
     claudeCredentialProvider: claudeAnthropicAuth
       ? "claude-subscription"
-      : anthropicApiKey ? "anthropic-api" : openrouterApiKey ? "openrouter" : null,
+      : anthropicApiKey ? "anthropic-api"
+      : claudeProxyConfigured ? "anthropic-proxy"
+      : openrouterApiKey ? "openrouter" : null,
+    claudeProxyBaseUrl: claudeProxyConfigured ? proxyBaseUrl : null,
     codexCredentialProvider: codexSubscriptionAuth
       ? "chatgpt-subscription"
       : openaiApiKey ? "openai-api" : openrouterApiKey ? "openrouter" : null,
@@ -1295,7 +1485,7 @@ async function uninstall(flags) {
     const ok = await runHarnessJob(failures, record.harness, "uninstall", async () => {
       if (flags.forgetToken) {
         await forgetStoredAnthropicToken(record);
-      } else if (record.anthropic_token_stored) {
+      } else if (record.anthropic_token_stored || record.proxy_base_url) {
         anthropicTokenNotice = true;
       }
       if (record.launch_available) await removePennyHarness(record.harness);
@@ -1315,7 +1505,7 @@ async function uninstall(flags) {
     await runHarnessJob(failures, record.harness, "uninstall", async () => {
       if (flags.forgetToken) {
         await forgetStoredAnthropicToken(record);
-      } else if (record.anthropic_token_stored) {
+      } else if (record.anthropic_token_stored || record.proxy_base_url) {
         anthropicTokenNotice = true;
       }
       if (record.launch_available) await removePennyHarness(record.harness);
@@ -1409,6 +1599,10 @@ async function status() {
     if (record.disabled_at) console.log(`  disabled: ${record.disabled_at}`);
     if (record.anthropic_oauth) console.log(`  Claude subscription auth: enabled (${record.token_source || "unknown"} token)`);
     if (record.openai_subscription_auth) console.log("  OpenAI subscription auth: enabled (Codex-managed login)");
+    if (record.proxy_base_url) {
+      const note = record.anthropic_oauth ? " (subscription takes precedence)" : "";
+      console.log(`  Upstream proxy: ${record.proxy_base_url}${note}`);
+    }
     if (record.launch_available) {
       const command = record.harness === "claude-code" ? "penny claude" : "penny codex";
       console.log(`  command: ${command}`);
@@ -1719,14 +1913,24 @@ function formatError(error) {
 // live config BEFORE harness.uninstall strips them. Never throws — a local uninstall
 // must not be blocked by a network hiccup; the record is going away regardless.
 async function forgetStoredAnthropicToken(record) {
-  if (record.harness !== "claude-code" || !record.anthropic_token_stored) return;
+  if (record.harness !== "claude-code") return;
+  if (!record.anthropic_token_stored && !record.proxy_base_url) return;
   try {
     const launchConfig = await loadPennyConfig();
     const globalAuth = await readClaudeCodeGatewayAuth();
     const gatewayBaseUrl = launchConfig.gateway_base_url || globalAuth.gatewayBaseUrl;
     const apiKey = launchConfig.api_key || globalAuth.apiKey;
     if (!gatewayBaseUrl || !apiKey) return;
-    await forgetAnthropicToken({ gatewayBaseUrl, apiKey });
+    if (record.anthropic_token_stored) {
+      await forgetAnthropicToken({ gatewayBaseUrl, apiKey });
+    }
+    // The proxy key is stored server-side exactly like the subscription token, so the
+    // same "forget my credentials" gesture has to clear it too.
+    if (record.proxy_base_url) {
+      await forgetUpstreamCredential({
+        gatewayBaseUrl, apiKey, provider: "anthropic_proxy",
+      });
+    }
   } catch {
     // swallow — see note above
   }
@@ -1739,6 +1943,15 @@ async function confirm(question) {
   return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
 }
 
+// Visible-echo input, for values that are not secrets. A mistyped proxy URL is a
+// confusing failure much later, so the user gets to see what they typed.
+async function promptText(question) {
+  const rl = createInterface({ input, output });
+  const answer = await rl.question(question);
+  rl.close();
+  return answer.trim();
+}
+
 async function promptSecretish(question) {
   if (!input.isTTY || !output.isTTY) {
     const rl = createInterface({ input, output });
@@ -1858,8 +2071,8 @@ function printHelp() {
   console.log(`PennyRouter CLI
 
 Usage:
-  pennyrouter install [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes] [--dry-run] [--make-default|--penny-only] [--no-path-update] [--no-mcp] [--anthropic-auth|--no-anthropic-auth] [--anthropic-api-key KEY] [--openai-api-key KEY] [--openrouter-api-key KEY] [--local[=URL]] [--allow-running-harnesses]
-  pennyrouter update [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--dry-run] [--penny-key pr-...] [--gateway-base-url URL|--local[=URL]] [--no-mcp] [--allow-running-harnesses]
+  pennyrouter install [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes] [--dry-run] [--make-default|--penny-only] [--no-path-update] [--no-mcp] [--anthropic-auth|--no-anthropic-auth] [--anthropic-api-key KEY] [--openai-api-key KEY] [--openrouter-api-key KEY] [--proxy-base-url URL --proxy-api-key KEY] [--local[=URL]|--prod] [--config PATH] [--allow-running-harnesses]
+  pennyrouter update [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--dry-run] [--penny-key pr-...] [--gateway-base-url URL|--local[=URL]|--prod] [--no-mcp] [--allow-running-harnesses]
   pennyrouter auth anthropic [--penny-key pr-...] [--token oauth-token] [--token-command CMD] [--gateway-base-url URL] [--forget]
   pennyrouter disable [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes]
   pennyrouter enable [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes]
@@ -1888,16 +2101,19 @@ Examples:
   npx pennyrouter update --harness claude-code
   npx pennyrouter update --harness codex --local
   npx pennyrouter update --all --local
+  npx pennyrouter update --all --prod
   npx pennyrouter install
   npx pennyrouter install --make-default
   npx pennyrouter install --penny-only
   npx pennyrouter install --harness claude-code --anthropic-auth --token <token>
   npx pennyrouter install --harness claude-code --anthropic-api-key <key>
   npx pennyrouter install --harness codex --openai-api-key <key>
+  npx pennyrouter install --harness claude-code --proxy-base-url https://proxy.example.com --proxy-api-key <key>
   npx pennyrouter install --openrouter-api-key <key>
   npx pennyrouter auth anthropic
   npx pennyrouter install --all
   npx pennyrouter install --harness windsurf,zed,codegpt,aider --yes
+  npx pennyrouter install --config ./penny_install.json
   npx pennyrouter disable
   npx pennyrouter enable
   npx pennyrouter uninstall

package/src/cli.test.js

@@ -0,0 +1,196 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { harnessFundingChanged, main } from "./cli.js";
+
+// --config lets a GUI installer (the macOS DMG) answer install questions up front instead of
+// over a TTY. These tests drive it through `main()` in --dry-run, which prints its plan and
+// returns before any network call or filesystem write, so no mocking is needed.
+
+function withConfigFile(config, run) {
+  const dir = mkdtempSync(join(tmpdir(), "pennyrouter-config-"));
+  const path = join(dir, "penny_install.json");
+  writeFileSync(path, JSON.stringify(config));
+  try {
+    return run(path);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+function captureLogs(run) {
+  const original = console.log;
+  const lines = [];
+  console.log = (...args) => lines.push(args.join(" "));
+  return run().finally(() => { console.log = original; }).then(() => lines);
+}
+
+test("--config selects harnesses without prompting", async () => {
+  await withConfigFile({ harnesses: ["claude-code"] }, async (path) => {
+    const lines = await captureLogs(() => main(["install", "--config", path, "--dry-run"]));
+    assert.ok(lines.some((line) => line.includes("Claude Code")));
+    assert.ok(!lines.some((line) => line.includes("Codex")));
+  });
+});
+
+test("--config with claudeFunding subscription sets --anthropic-auth", async () => {
+  await withConfigFile(
+    { harnesses: ["claude-code"], claudeFunding: ["subscription"] },
+    async (path) => {
+      const lines = await captureLogs(() => main(["install", "--config", path, "--dry-run"]));
+      assert.ok(lines.some((line) => line.includes("Claude Code provider picker")));
+    },
+  );
+});
+
+test("--config rejects an unreadable file", async () => {
+  await assert.rejects(
+    () => main(["install", "--config", "/nonexistent/penny_install.json", "--dry-run"]),
+    /Could not read --config file/,
+  );
+});
+
+test("explicit --harness overrides --config harnesses", async () => {
+  await withConfigFile({ harnesses: ["codex"] }, async (path) => {
+    const lines = await captureLogs(
+      () => main(["install", "--harness", "claude-code", "--config", path, "--dry-run"]),
+    );
+    assert.ok(lines.some((line) => line.includes("Claude Code")));
+    assert.ok(!lines.some((line) => line.includes("Codex")));
+  });
+});
+
+// harnessFundingChanged decides whether a --config re-run needs to re-open the account-claim
+// and subscription-auth popups for a harness, or can treat it like `update` (skip both). This
+// only kicks in on --config re-runs against an existing manifest; a live end-to-end run against
+// a real account confirmed the same three cases these unit tests cover.
+
+const claudeHarness = { id: "claude-code" };
+const codexHarness = { id: "codex" };
+
+test("harnessFundingChanged: brand new harness always needs auth", () => {
+  const manifest = { installations: [] };
+  assert.equal(harnessFundingChanged({}, claudeHarness, manifest), true);
+});
+
+test("harnessFundingChanged: claude subscription unchanged", () => {
+  const manifest = {
+    installations: [{ harness: "claude-code", user_funded_provider: "claude-subscription" }],
+  };
+  const flags = { configClaudeFunding: new Set(["subscription"]) };
+  assert.equal(harnessFundingChanged(flags, claudeHarness, manifest), false);
+});
+
+test("harnessFundingChanged: claude subscription to anthropic-api is a change", () => {
+  const manifest = {
+    installations: [{ harness: "claude-code", user_funded_provider: "claude-subscription" }],
+  };
+  const flags = { configClaudeFunding: new Set(["anthropic-api"]) };
+  assert.equal(harnessFundingChanged(flags, claudeHarness, manifest), true);
+});
+
+test("harnessFundingChanged: codex subscription unchanged (openai_subscription_auth flag)", () => {
+  const manifest = {
+    installations: [{
+      harness: "codex",
+      user_funded_provider: "chatgpt-subscription",
+      openai_subscription_auth: true,
+    }],
+  };
+  const flags = { configCodexFunding: new Set(["subscription"]) };
+  assert.equal(harnessFundingChanged(flags, codexHarness, manifest), false);
+});
+
+test("harnessFundingChanged: codex openrouter unchanged", () => {
+  const manifest = {
+    installations: [{
+      harness: "codex",
+      user_funded_provider: "openrouter",
+      openai_subscription_auth: false,
+    }],
+  };
+  const flags = { configCodexFunding: new Set(["openrouter"]) };
+  assert.equal(harnessFundingChanged(flags, codexHarness, manifest), false);
+});
+
+test("harnessFundingChanged: no requested funding for an existing harness is not a change", () => {
+  const manifest = {
+    installations: [{ harness: "claude-code", user_funded_provider: "claude-subscription" }],
+  };
+  assert.equal(harnessFundingChanged({}, claudeHarness, manifest), false);
+});
+
+// --- Other proxy (user-supplied Anthropic-compatible base URL) ----------------
+
+test("--proxy-base-url and --proxy-api-key parse in both forms", async () => {
+  for (const args of [
+    ["--proxy-base-url", "https://proxy.example.com", "--proxy-api-key", "k"],
+    ["--proxy-base-url=https://proxy.example.com", "--proxy-api-key=k"],
+  ]) {
+    const lines = await captureLogs(() => main([
+      "install", "--harness", "claude-code", "--dry-run", ...args,
+    ]));
+    assert.ok(lines.length > 0);
+  }
+});
+
+test("--config maps anthropic-proxy funding to the proxy flags", async () => {
+  await withConfigFile(
+    {
+      harnesses: ["claude-code"],
+      claudeFunding: ["anthropic-proxy"],
+      proxyBaseUrl: "https://proxy.example.com",
+      proxyApiKey: "secret-key",
+    },
+    async (path) => {
+      const lines = await captureLogs(() => main(["install", "--config", path, "--dry-run"]));
+      assert.ok(lines.some((line) => line.includes("Claude Code")));
+      // The key must never be echoed to the terminal.
+      assert.ok(!lines.some((line) => line.includes("secret-key")));
+    },
+  );
+});
+
+test("harnessFundingChanged sees a switch to the proxy as a change", () => {
+  const manifest = {
+    installations: [{ harness: "claude-code", user_funded_provider: "claude-subscription" }],
+  };
+  const changed = harnessFundingChanged(
+    { configClaudeFunding: new Set(["anthropic-proxy"]) },
+    { id: "claude-code" },
+    manifest,
+  );
+  assert.equal(changed, true);
+});
+
+test("harnessFundingChanged sees an unchanged proxy install as unchanged", () => {
+  const manifest = {
+    installations: [{ harness: "claude-code", user_funded_provider: "anthropic-proxy" }],
+  };
+  const changed = harnessFundingChanged(
+    { configClaudeFunding: new Set(["anthropic-proxy"]) },
+    { id: "claude-code" },
+    manifest,
+  );
+  assert.equal(changed, false);
+});
+
+test("auth anthropic --forget targets the installed gateway, not prod", async () => {
+  // Regression: this defaulted to https://api.pennyrouter.com even when the machine was
+  // installed against a local gateway, silently deleting the wrong account's token.
+  const lines = await captureLogs(() => main([
+    "auth", "anthropic", "--forget", "--dry-run",
+    "--penny-key", "pr-test", "--gateway-base-url", "http://localhost:8400",
+  ]));
+  assert.ok(lines.some((line) => line.includes("http://localhost:8400")));
+  assert.ok(!lines.some((line) => line.includes("api.pennyrouter.com")));
+});
+
+test("auth anthropic --forget honors --local", async () => {
+  const lines = await captureLogs(() => main([
+    "auth", "anthropic", "--forget", "--dry-run", "--local", "--penny-key", "pr-test",
+  ]));
+  assert.ok(lines.some((line) => line.includes("localhost:8400")));
+});

package/src/launch.js

@@ -438,6 +438,11 @@ export function buildPennyInvocation(harness, args, config) {
     if (models.sonnet) env.ANTHROPIC_DEFAULT_SONNET_MODEL = upgradeClaudeCodeModelValue(models.sonnet);
     if (models.opus) env.ANTHROPIC_DEFAULT_OPUS_MODEL = upgradeClaudeCodeModelValue(models.opus);
     if (models.fable) env.ANTHROPIC_DEFAULT_FABLE_MODEL = upgradeClaudeCodeModelValue(models.fable);
+    if (models.custom) {
+      env.ANTHROPIC_CUSTOM_MODEL_OPTION = upgradeClaudeCodeModelValue(models.custom);
+      if (models.custom_name) env.ANTHROPIC_CUSTOM_MODEL_OPTION_NAME = models.custom_name;
+      if (models.custom_description) env.ANTHROPIC_CUSTOM_MODEL_OPTION_DESCRIPTION = models.custom_description;
+    }
     writeClaudeCodeModelPresentation(env);
     // Per-model limits must come from Claude Code's recognized native model ids. This
     // global override would incorrectly give Haiku the 1M window.

package/src/session.js

@@ -49,7 +49,7 @@ export function sleep(ms) {
 // Encrypt and store a user-owned upstream credential against the account server-side,
 // so the pr- key alone unlocks the selected harness and the provider secret is never
 // written to harness configuration.
-export async function storeUpstreamCredential({ gatewayBaseUrl, apiKey, provider, token }) {
+export async function storeUpstreamCredential({ gatewayBaseUrl, apiKey, provider, token, metadata }) {
   const url = `${gatewayBaseUrl.replace(/\/+$/, "")}/v1/upstream-credentials`;
   const response = await fetch(url, {
     method: "POST",
@@ -57,7 +57,7 @@ export async function storeUpstreamCredential({ gatewayBaseUrl, apiKey, provider
       "content-type": "application/json",
       authorization: `Bearer ${apiKey}`,
     },
-    body: JSON.stringify({ provider, token }),
+    body: JSON.stringify({ provider, token, ...(metadata ? { metadata } : {}) }),
   });
   if (!response.ok) {
     let detail = "";
@@ -135,10 +135,10 @@ export async function probeClaudeCodeGateway({ gatewayBaseUrl, apiKey }) {
 
 // Best-effort "forget my Claude token" on uninstall. Never throws — a cleanup that
 // can't reach the network shouldn't block removing the local integration.
-export async function forgetAnthropicToken({ gatewayBaseUrl, apiKey }) {
+export async function forgetUpstreamCredential({ gatewayBaseUrl, apiKey, provider }) {
   if (!gatewayBaseUrl || !apiKey) return false;
   try {
-    const url = `${gatewayBaseUrl.replace(/\/+$/, "")}/v1/upstream-credentials/anthropic`;
+    const url = `${gatewayBaseUrl.replace(/\/+$/, "")}/v1/upstream-credentials/${encodeURIComponent(provider)}`;
     const response = await fetch(url, {
       method: "DELETE",
       headers: { authorization: `Bearer ${apiKey}` },
@@ -149,6 +149,10 @@ export async function forgetAnthropicToken({ gatewayBaseUrl, apiKey }) {
   }
 }
 
+export async function forgetAnthropicToken({ gatewayBaseUrl, apiKey }) {
+  return forgetUpstreamCredential({ gatewayBaseUrl, apiKey, provider: "anthropic" });
+}
+
 function platformName() {
   if (process.platform === "darwin") return "Mac";
   if (process.platform === "win32") return "Windows";

package/src/statusline.js

@@ -11,6 +11,10 @@
 // authed with the pr- key already in Claude Code's settings). The gateway keys that
 // endpoint on the CC session uuid it sees in every request's metadata.user_id — the
 // same uuid Claude Code hands the statusline script on stdin.
+//
+// A wrapped user statusline command is cached the same way: it can be slow to spawn
+// (npx especially, and especially on Windows — see WRAP_REFRESH_MS below), so it's never
+// run inline on Claude Code's ~1s render loop.
 
 import { statePath, atomicWrite, readJsonFile, writeJsonFile } from "./state.js";
 
@@ -87,6 +91,14 @@ const stateDir = join(
   "pennyrouter",
 );
 const cacheDir = join(stateDir, "statusline-cache");
+// A wrapped user statusline command can be slow to spawn (npx especially: on Windows
+// it goes through an extra cmd.exe/npx.cmd hop and can take 2-4s per invocation, vs
+// well under 1s on macOS/Linux). Claude Code re-invokes this script every ~1s
+// (refreshInterval), so running the wrap command inline on every render blocked past
+// that interval on Windows, renders piled up, and the statusline never finished in
+// time to display at all. Cache its output and refresh it out-of-band instead, same
+// as the Penny gateway segment below.
+const WRAP_REFRESH_MS = 2000;
 
 function readJson(path) {
   try { return JSON.parse(readFileSync(path, "utf8")); } catch { return null; }
@@ -109,6 +121,8 @@ function claudeEnv() {
   return { base, key };
 }
 
+const config = readJson(join(stateDir, "claude-statusline.json")) || {};
+
 // --refresh <sessionId>: fetch gateway status into the cache file, then exit.
 if (process.argv[2] === "--refresh") {
   const sessionId = process.argv[3];
@@ -131,11 +145,28 @@ if (process.argv[2] === "--refresh") {
   process.exit(0);
 }
 
+// --refresh-wrap <sessionId>: run the (possibly slow) wrapped statusline command out of
+// band and cache its output. Reads the stdin JSON the main render last saw, persisted to
+// a per-session file since a detached child has no stdin of its own to read.
+if (process.argv[2] === "--refresh-wrap") {
+  const sessionId = process.argv[3];
+  if (!sessionId || !config.wrap_command) process.exit(0);
+  let wrapInput = "{}";
+  try { wrapInput = readFileSync(join(cacheDir, sessionId + ".wrap-input.json"), "utf8"); } catch { /* none yet */ }
+  const run = spawnSync(config.wrap_command, {
+    shell: true, input: wrapInput, encoding: "utf8", timeout: 20000, windowsHide: true,
+  });
+  let wrapLines = (run.stdout || "").replace(/\\n$/, "").split("\\n");
+  if (wrapLines.length === 1 && wrapLines[0] === "") wrapLines = [];
+  mkdirSync(cacheDir, { recursive: true });
+  writeFileSync(join(cacheDir, sessionId + ".wrap.json"), JSON.stringify({ lines: wrapLines, at: Date.now() }));
+  process.exit(0);
+}
+
 const raw = readFileSync(0, "utf8");
 let input = {};
 try { input = JSON.parse(raw); } catch { /* keep {} */ }
 const sessionId = input.session_id || "";
-const config = readJson(join(stateDir, "claude-statusline.json")) || {};
 const refreshMs = (config.refresh_seconds ?? 15) * 1000;
 
 const cachePath = join(cacheDir, sessionId + ".json");
@@ -148,7 +179,7 @@ const { base, key } = claudeEnv();
 const pennyInstalled = Boolean(base) && Boolean(key);
 if (sessionId && pennyInstalled && cacheAge > refreshMs) {
   spawn(process.execPath, [process.argv[1], "--refresh", sessionId], {
-    detached: true, stdio: "ignore",
+    detached: true, stdio: "ignore", windowsHide: true,
   }).unref();
 }
 
@@ -193,9 +224,27 @@ if (!pennyInstalled) {
 }
 
 let lines;
-if (config.wrap_command) {
+if (config.wrap_command && sessionId) {
+  const wrapCachePath = join(cacheDir, sessionId + ".wrap.json");
+  const wrapCache = readJson(wrapCachePath);
+  const wrapAge = wrapCache && typeof wrapCache.at === "number" ? Date.now() - wrapCache.at : Infinity;
+  if (wrapAge > WRAP_REFRESH_MS) {
+    mkdirSync(cacheDir, { recursive: true });
+    writeFileSync(join(cacheDir, sessionId + ".wrap-input.json"), raw);
+    // Bump the cache timestamp before spawning: Claude Code polls every ~1s, so
+    // without this every render in the next couple seconds would see a still-stale
+    // cache and fire its own overlapping refresh while the first one is still running.
+    writeFileSync(wrapCachePath, JSON.stringify({ lines: (wrapCache && wrapCache.lines) || [], at: Date.now() }));
+    spawn(process.execPath, [process.argv[1], "--refresh-wrap", sessionId], {
+      detached: true, stdio: "ignore", windowsHide: true,
+    }).unref();
+  }
+  lines = (wrapCache && wrapCache.lines) || [];
+} else if (config.wrap_command) {
+  // No session id (e.g. a manual/interactive invocation outside Claude Code): there's
+  // no cache key to keep state under, so run inline like before caching existed.
   const run = spawnSync(config.wrap_command, {
-    shell: true, input: raw, encoding: "utf8", timeout: 5000,
+    shell: true, input: raw, encoding: "utf8", timeout: 5000, windowsHide: true,
   });
   lines = (run.stdout || "").replace(/\\n$/, "").split("\\n");
   if (lines.length === 1 && lines[0] === "") lines = [];