pennyrouter 0.2.7 → 0.2.8

package/src/cli.js

@@ -1,1733 +1,1727 @@
-import { spawn, spawnSync } from "node:child_process";
-import { emitKeypressEvents } from "node:readline";
-import { createInterface } from "node:readline/promises";
-import { stdin as input, stdout as output } from "node:process";
-import { aiderHarness } from "./harnesses/aider.js";
-import {
-  CLAUDE_CODE_MODELS,
-  claudeCodeHarness,
-  readClaudeCodeGatewayAuth,
-  readClaudeCodePennyRouterKey,
-} from "./harnesses/claude-code.js";
-import { clineHarness } from "./harnesses/cline.js";
-import { codeGptHarness } from "./harnesses/codegpt.js";
-import { codexHarness, detectCodexChatgptAuth } from "./harnesses/codex.js";
-import { opencodeHarness } from "./harnesses/opencode.js";
-import { windsurfHarness } from "./harnesses/windsurf.js";
-import { zedHarness } from "./harnesses/zed.js";
-import {
-  APP_URL,
-  createCliSession,
-  forgetAnthropicToken,
-  maskKey,
-  pollForKey,
-  probeClaudeCodeGateway,
-  sleep,
-  storeAnthropicToken,
-  storeUpstreamCredential,
-} from "./session.js";
-import {
-  backupFile,
-  compactHome,
-  loadManifest,
-  restoreFile,
-  saveManifest,
-  statePath,
-} from "./state.js";
-import {
-  claudeLaunchSettingsPath,
-  codexLaunchProfilePath,
-  configurePennyHarness,
-  hasConfiguredPennyHarnesses,
-  installPennyRuntime,
-  loadPennyConfig,
-  pennyConfigPath,
-  removePennyHarness,
-  removePennyRuntime,
-  savePennyConfig,
-  setPennyHarnessEnabled,
-} from "./launch.js";
-
-const HARNESS_BY_ID = {
-  "claude-code": claudeCodeHarness,
-  cline: clineHarness,
-  opencode: opencodeHarness,
-  codex: codexHarness,
-  windsurf: windsurfHarness,
-  zed: zedHarness,
-  codegpt: codeGptHarness,
-  aider: aiderHarness,
-};
-
-const SUPPORTED_HARNESS_IDS = Object.keys(HARNESS_BY_ID).join(",");
-const DEFAULT_INSTALL_HARNESS_IDS = ["claude-code", "codex"];
-const CLAUDE_PROVIDER_OPTIONS = [
-  { id: "subscription", name: "Claude subscription" },
-  { id: "anthropic-api", name: "Anthropic API key" },
-  { id: "openrouter", name: "OpenRouter API key" },
-];
-const CODEX_PROVIDER_OPTIONS = [
-  { id: "subscription", name: "ChatGPT subscription" },
-  { id: "openai-api", name: "OpenAI API key" },
-  { id: "openrouter", name: "OpenRouter API key" },
-];
-
-export async function main(argv = process.argv.slice(2)) {
-  const { command, flags } = parseArgs(argv);
-
-  if (flags.help || command === "help") {
-    printHelp();
-    return;
-  }
-
-  if (command === "install") {
-    await install(flags);
-    return;
-  }
-
-  if (command === "update") {
-    await update(flags);
-    return;
-  }
-
-  if (command === "auth") {
-    await authProvider(flags);
-    return;
-  }
-
-  if (command === "uninstall") {
-    await uninstall(flags);
-    return;
-  }
-
-  if (command === "disable") {
-    await disable(flags);
-    return;
-  }
-
-  if (command === "enable") {
-    await enable(flags);
-    return;
-  }
-
-  if (command === "status") {
-    await status();
-    return;
-  }
-
-  throw new Error(`Unknown command "${command}". Run "pennyrouter help".`);
-}
-
-function parseArgs(argv) {
-  const command = argv[0] && !argv[0].startsWith("-") ? argv[0] : "install";
-  const rest = command === argv[0] ? argv.slice(1) : argv;
-  const flags = {};
-  flags.args = [];
-
-  for (let i = 0; i < rest.length; i += 1) {
-    const arg = rest[i];
-    if (arg === "--help" || arg === "-h") flags.help = true;
-    else if (arg === "--yes" || arg === "-y") flags.yes = true;
-    else if (arg === "--all") flags.all = true;
-    else if (arg === "--dry-run") flags.dryRun = true;
-    else if (arg === "--allow-running-claude") flags.allowRunningClaude = true;
-    else if (arg === "--allow-running-harnesses") flags.allowRunningHarnesses = true;
-    else if (arg === "--make-default") flags.makeDefault = true;
-    else if (arg === "--penny-only") flags.pennyOnly = true;
-    else if (arg === "--no-path-update") flags.noPathUpdate = true;
-    else if (arg === "--no-browser") flags.noBrowser = true;
-    else if (arg === "--existing-account") flags.existingAccount = true;
-    else if (arg === "--anthropic-auth") flags.anthropicAuth = true;
-    else if (arg === "--no-anthropic-auth") flags.noAnthropicAuth = true;
-    else if (arg === "--penny-key") flags.pennyKey = rest[++i] || "";
-    else if (arg.startsWith("--penny-key=")) flags.pennyKey = arg.slice("--penny-key=".length);
-    else if (arg === "--token") flags.token = rest[++i] || "";
-    else if (arg.startsWith("--token=")) flags.token = arg.slice("--token=".length);
-    else if (arg === "--token-command") flags.tokenCommand = rest[++i] || "";
-    else if (arg.startsWith("--token-command=")) flags.tokenCommand = arg.slice("--token-command=".length);
-    else if (arg === "--anthropic-api-key") flags.anthropicApiKey = rest[++i] || "";
-    else if (arg.startsWith("--anthropic-api-key=")) flags.anthropicApiKey = arg.slice("--anthropic-api-key=".length);
-    else if (arg === "--openai-api-key") flags.openaiApiKey = rest[++i] || "";
-    else if (arg.startsWith("--openai-api-key=")) flags.openaiApiKey = arg.slice("--openai-api-key=".length);
-    else if (arg === "--openrouter-api-key") flags.openrouterApiKey = rest[++i] || "";
-    else if (arg.startsWith("--openrouter-api-key=")) flags.openrouterApiKey = arg.slice("--openrouter-api-key=".length);
-    else if (arg === "--harness") flags.harness = rest[++i] || "";
-    else if (arg.startsWith("--harness=")) flags.harness = arg.slice("--harness=".length);
-    else if (arg === "--app-url") flags.appUrl = rest[++i] || "";
-    else if (arg.startsWith("--app-url=")) flags.appUrl = arg.slice("--app-url=".length);
-    else if (arg === "--gateway-base-url") flags.gatewayBaseUrl = rest[++i] || "";
-    else if (arg.startsWith("--gateway-base-url=")) flags.gatewayBaseUrl = arg.slice("--gateway-base-url=".length);
-    // --local: point the installed harness at a locally-running gateway (default
-    // http://localhost:8400), for developing/testing against your own gateway. Auth still goes
-    // to prod (pennyrouter.com) so you get a real key; only the harness's serving URL is local.
-    // `--local=<url>` overrides the port/host.
-    else if (arg === "--local") flags.gatewayBaseUrl = "http://localhost:8400";
-    else if (arg.startsWith("--local=")) flags.gatewayBaseUrl = arg.slice("--local=".length);
-    else if (arg === "--forget") flags.forget = true;
-    else if (arg === "--forget-token") flags.forgetToken = true;
-    else if (!arg.startsWith("-")) flags.args.push(arg);
-    else throw new Error(`Unknown option "${arg}". Run "pennyrouter help".`);
-  }
-
-  return { command, flags };
-}
-
-async function authProvider(flags) {
-  const provider = (flags.args[0] || "anthropic").toLowerCase();
-  if (provider !== "anthropic" && provider !== "claude") {
-    throw new Error(`Unknown auth provider "${provider}". Try "pennyrouter auth anthropic".`);
-  }
-
-  if (flags.forget) {
-    const launchConfig = await loadPennyConfig();
-    const pennyKey = flags.pennyKey || launchConfig.api_key || await readClaudeCodePennyRouterKey();
-    if (!pennyKey) {
-      throw new Error(
-        "No PennyRouter key found in Claude Code settings. Pass `--penny-key pr-...`.",
-      );
-    }
-    const gatewayBaseUrl = flags.gatewayBaseUrl || process.env.PENNYROUTER_GATEWAY_BASE_URL || "https://api.pennyrouter.com";
-    if (flags.dryRun) {
-      console.log(`Will delete stored Anthropic token from gateway: ${gatewayBaseUrl}`);
-      return;
-    }
-    const ok = await forgetAnthropicToken({ gatewayBaseUrl, apiKey: pennyKey });
-    if (ok) {
-      console.log("Successfully forgot stored Anthropic token on server.");
-    } else {
-      console.log("Failed to forget stored Anthropic token on server.");
-    }
-    const manifest = await loadManifest();
-    let updated = false;
-    for (const record of (manifest.installations || [])) {
-      if (record.harness === "claude-code" && record.anthropic_token_stored) {
-        record.anthropic_token_stored = false;
-        record.anthropic_oauth = false;
-        updated = true;
-      }
-    }
-    if (updated) {
-      await saveManifest(manifest);
-    }
-    if (launchConfig.harnesses?.claude) {
-      launchConfig.harnesses.claude.subscription_auth = false;
-      await savePennyConfig(launchConfig);
-    }
-    return;
-  }
-
-  if (flags.dryRun) {
-    console.log("Will configure Claude Code for PennyRouter + Anthropic OAuth dual auth.");
-    console.log("Dry run only. No files changed.");
-    return;
-  }
-
-  const launchConfig = await loadPennyConfig();
-  const pennyKey = flags.pennyKey || launchConfig.api_key || await readClaudeCodePennyRouterKey();
-  if (!pennyKey) {
-    throw new Error(
-      "No PennyRouter key found in Claude Code settings. Run `pennyrouter install --harness claude-code` first, or pass `--penny-key pr-...`.",
-    );
-  }
-
-  const tokenResult = readAnthropicOAuthToken(flags);
-  const token = tokenResult.token;
-  if (!token) {
-    throw new Error(
-      "No Anthropic OAuth token found. Run `claude setup-token` and pass it with `--token`, set ANTHROPIC_AUTH_TOKEN, or pass `--token-command <cmd>`.",
-    );
-  }
-
-  const gatewayBaseUrl = flags.gatewayBaseUrl || process.env.PENNYROUTER_GATEWAY_BASE_URL || "https://api.pennyrouter.com";
-  const manifest = await loadManifest();
-  const existingRecord = (manifest.installations || []).find(
-    (candidate) => candidate.harness === "claude-code",
-  );
-  const ownsGlobalRouting = existingRecord
-    ? existingRecord.default_routing !== false
-    : Boolean(await readClaudeCodePennyRouterKey());
-  if (ownsGlobalRouting) assertNoRunningHarness("claude-code", flags);
-  await storeAnthropicToken({ gatewayBaseUrl, apiKey: pennyKey, token });
-  await probeClaudeCodeGateway({ gatewayBaseUrl, apiKey: pennyKey });
-  if (process.platform !== "win32") {
-    await installPennyRuntime({ updatePath: !flags.noPathUpdate });
-  }
-  await configurePennyHarness("claude-code", {
-    apiKey: pennyKey,
-    gatewayBaseUrl,
-    subscriptionAuth: true,
-    models: CLAUDE_CODE_MODELS,
-  });
-  let record = existingRecord || {
-    harness: "claude-code",
-    config_path: compactHome((await claudeCodeHarness.planInstall()).configPath),
-    installed_at: new Date().toISOString(),
-    launch_available: true,
-    launch_config_path: compactHome(claudeLaunchSettingsPath()),
-    default_routing: ownsGlobalRouting,
-  };
-  if (ownsGlobalRouting) {
-    const plan = await claudeCodeHarness.planInstall();
-    record = {
-      ...record,
-      ...(await claudeCodeHarness.installStoredToken({
-        apiKey: pennyKey, gatewayBaseUrl, plan, existingRecord,
-      })),
-    };
-  }
-
-  upsertManifestRecord(manifest, {
-    ...record,
-    launch_available: true,
-    launch_config_path: compactHome(claudeLaunchSettingsPath()),
-    default_routing: ownsGlobalRouting,
-    anthropic_oauth: true,
-    anthropic_token_stored: true,
-    token_source: tokenResult.source,
-  });
-  await saveManifest(manifest);
-
-  console.log("Configured `penny claude` for PennyRouter + your Claude subscription.");
-  console.log("Your Claude token is stored encrypted; Claude Code holds only your PennyRouter key.");
-  console.log("If Claude auth expires, refresh the token source and run `pennyrouter auth anthropic` again.");
-  console.log(`Penny config: ${pennyConfigPath()}`);
-}
-
-function readAnthropicOAuthToken(flags = {}) {
-  if (flags.token) return { token: normalizeAnthropicToken(flags.token), source: "flag" };
-  if (flags.tokenCommand) {
-    const result = spawnSync(flags.tokenCommand, {
-      encoding: "utf8",
-      shell: true,
-      stdio: ["ignore", "pipe", "pipe"],
-    });
-    if (result.status === 0) {
-      return { token: normalizeAnthropicToken(result.stdout), source: "token-command" };
-    }
-    return { token: "", source: "token-command" };
-  }
-  if (process.env.ANTHROPIC_AUTH_TOKEN) {
-    return { token: normalizeAnthropicToken(process.env.ANTHROPIC_AUTH_TOKEN), source: "env" };
-  }
-  const result = spawnSync("ant", ["auth", "print-credentials", "--access-token"], {
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"],
-  });
-  if (result.status !== 0) return { token: "", source: "none" };
-  return { token: normalizeAnthropicToken(result.stdout), source: "ant" };
-}
-
-// ANSI/CSI escape sequences that `claude setup-token`'s TUI emits (colors, cursor
-// moves, bracketed-paste). We strip these before scanning the captured stream for the
-// token so a match isn't split by control bytes. Kept deliberately broad.
-// eslint-disable-next-line no-control-regex
-const ANSI_ESCAPE_RE = /\x1b\[[0-9;?]*[ -/]*[@-~]/g;
-// The token line printed by `claude setup-token`. Match any sk-ant-* token so we don't
-// depend on the exact variant/version (e.g. sk-ant-oat01-...).
-const ANTHROPIC_SETUP_TOKEN_RE = /sk-ant-[A-Za-z0-9_-]+/;
-
-// Run `claude setup-token` inline and extract the token it prints, WITHOUT echoing any
-// of the command's own output to the terminal. `claude setup-token` is a full-screen
-// Ink TUI: it redraws with carriage returns and cursor-move escapes (not newlines), so
-// its banner ("Welcome to Claude Code…"), spinner frames, the OAuth URL, the real token
-// ("sk-ant-oat01-…") and the "Store this / export" chrome all arrive interleaved with
-// no reliable line boundaries. There's no safe way to tee that stream line-by-line, and
-// none of it needs to reach the user: the browser auto-opens for approval, and the
-// token goes server-side (encrypted). So we fully suppress the child's output — we pipe
-// BOTH stdout and stderr only to capture them in memory for token extraction, and print
-// our own clean status lines around the call instead. The Ink TUI renders to stdout (the
-// token line arrives there — that's what we scan), but we also silence stderr so no
-// spinner/banner frame can leak from the other stream. Only stdin inherits the TTY, which
-// is all that's needed for the interactive approval handoff; the browser is opened by the
-// OS, not the terminal. After exit we ANSI-strip the captured output and regex out the
-// token. Returns "" on non-zero exit or if no token appeared, so the caller falls back to
-// manual paste.
-function runClaudeSetupToken() {
-  return new Promise((resolve) => {
-    let captured = "";
-    // On Windows, npm installs `claude` as a `claude.cmd` shim which Node's spawn will
-    // not resolve without a shell (it looks for a bare executable and throws ENOENT).
-    // Route through the shell there so the shim resolves; the args are fixed literals
-    // (no user input), so there's no shell-injection surface. POSIX spawns `claude`
-    // directly. Works from both PowerShell and cmd.exe host terminals since Node invokes
-    // cmd.exe itself for the shell.
-    const child = spawn("claude", ["setup-token"], {
-      // stdin keeps the TTY; stdout+stderr are piped (captured, never echoed).
-      stdio: ["inherit", "pipe", "pipe"],
-      shell: process.platform === "win32",
-    });
-
-    const capture = (chunk) => {
-      captured += chunk.toString("utf8"); // in-memory only — nothing is written to the terminal
-    };
-    child.stdout.on("data", capture);
-    child.stderr.on("data", capture);
-
-    child.on("error", () => resolve(""));
-    child.on("close", (code) => {
-      if (code !== 0) return resolve("");
-      const match = captured.replace(ANSI_ESCAPE_RE, "").match(ANTHROPIC_SETUP_TOKEN_RE);
-      resolve(match ? match[0] : "");
-    });
-  });
-}
-
-function normalizeAnthropicToken(value) {
-  let text = String(value || "").trim();
-  if (!text) return "";
-  text = text.replace(/^export\s+/, "");
-  const match = text.match(/^ANTHROPIC_AUTH_TOKEN=(.*)$/);
-  if (match) text = match[1].trim();
-  if ((text.startsWith('"') && text.endsWith('"')) || (text.startsWith("'") && text.endsWith("'"))) {
-    text = text.slice(1, -1);
-  }
-  return text.replace(/\s+/g, "").trim();
-}
-
-async function install(flags) {
-  if (flags.makeDefault && flags.pennyOnly) {
-    throw new Error("--make-default and --penny-only cannot be used together.");
-  }
-  const selected = await selectHarnesses(flags);
-  if (selected.length === 0) {
-    console.log("No supported harnesses selected.");
-    return;
-  }
-
-  console.log("PennyRouter install");
-  console.log("");
-
-  const manifest = await loadManifest();
-
-  if (flags.dryRun) {
-    const defaultRouting = await chooseDefaultRouting(flags, selected, manifest);
-    for (const harness of selected) {
-      const explicit = ["claude-code", "codex"].includes(harness.id) && process.platform !== "win32";
-      const command = harness.id === "claude-code" ? "penny claude" : "penny codex";
-      console.log(`Will install on ${harness.name}${explicit ? ` via ${command}` : installNoteForHarness(harness.id)}.`);
-      if (defaultRouting.get(harness.id)) {
-        console.log(`Will also route bare ${harness.id === "claude-code" ? "claude" : harness.id} through PennyRouter.`);
-      }
-    }
-    if (flags.gatewayBaseUrl) console.log(`Serving gateway: ${flags.gatewayBaseUrl}`);
-    if (selected.some((harness) => harness.id === "claude-code")) {
-      console.log("Claude Code provider picker would be shown unless providers were supplied by flags or environment.");
-    }
-    console.log("Dry run only. No files changed.");
-    return;
-  }
-
-  const session = await createCliSession({
-    appUrl: flags.appUrl || APP_URL,
-    harnesses: selected.map((harness) => harness.id),
-    accountMode: "existing",
-  });
-
-  console.log("Opening your browser to log in and authorize this machine with your PennyRouter account...");
-  console.log(`If your browser did not open, visit:\n${session.authorize_url}`);
-  if (!flags.noBrowser) openBrowser(session.authorize_url);
-  console.log("");
-  console.log("Waiting for approval...");
-
-  const claim = await pollForKey(session);
-  console.log(`Authorized. Received key ${maskKey(claim.api_key)}.`);
-  console.log("");
-
-  const claudeProviders = await selectClaudeFundingProviders(flags, selected);
-  const codexProviders = await selectCodexFundingProviders(flags, selected);
-  const claudeAnthropicAuth = await maybeConfigureClaudeAnthropicAuth(
-    flags, selected, claudeProviders.has("subscription"));
-  const funding = await configureUserFunding(
-    flags, selected, claudeAnthropicAuth, claudeProviders, codexProviders);
-  const gatewayBaseUrl = flags.gatewayBaseUrl || claim.gateway_base_url;
-
-  for (const credential of funding.credentials) {
-    await storeUpstreamCredential({
-      gatewayBaseUrl,
-      apiKey: claim.api_key,
-      provider: credential.provider,
-      token: credential.token,
-    });
-  }
-
-  if (selected.some((harness) => harness.id === "claude-code")) {
-    console.log("Verifying modern Claude Code compatibility before changing local settings...");
-    await probeClaudeCodeGateway({ gatewayBaseUrl, apiKey: claim.api_key });
-    console.log("");
-  }
-
-  // Keep this as the final interactive choice: users first authorize their account,
-  // optionally connect their subscription, and pass compatibility checks. Then they
-  // choose the visible command behavior with all relevant context in front of them.
-  const defaultRouting = await chooseDefaultRouting(flags, selected, manifest);
-
-  const launchable = selected.filter((harness) => ["claude-code", "codex"].includes(harness.id));
-  let runtimeResult = null;
-  if (launchable.length > 0 && process.platform !== "win32") {
-    runtimeResult = await installPennyRuntime({ updatePath: !flags.noPathUpdate });
-  }
-
-  const records = [];
-  const failures = [];
-  for (const harness of selected) {
-    await runHarnessJob(failures, harness.id, "install", async () => {
-      const plan = await harness.planInstall();
-      const existingRecord = (manifest.installations || []).find(
-        (candidate) => candidate.harness === harness.id,
-      );
-      const supportsPennyCommand = ["claude-code", "codex"].includes(harness.id)
-        && process.platform !== "win32";
-      const makeDefault = defaultRouting.get(harness.id) ?? true;
-      const hadGlobalRouting = Boolean(existingRecord && existingRecord.default_routing !== false);
-      if (["claude-code", "codex"].includes(harness.id) && (makeDefault || hadGlobalRouting)) {
-        assertNoRunningHarness(harness.id, flags);
-      }
-
-      const codexSubscriptionAuth = harness.id === "codex"
-        ? funding.codexSubscriptionAuth
-        : false;
-      const claudeSubscriptionAuth = harness.id === "claude-code"
-        && Boolean(claudeAnthropicAuth || existingRecord?.anthropic_token_stored);
-
-      if (supportsPennyCommand) {
-        await configurePennyHarness(harness.id, {
-          apiKey: claim.api_key,
-          gatewayBaseUrl,
-          subscriptionAuth: harness.id === "claude-code"
-            ? claudeSubscriptionAuth
-            : codexSubscriptionAuth,
-          models: harness.id === "claude-code" ? CLAUDE_CODE_MODELS : null,
-        });
-      }
-
-      let record;
-      if (!supportsPennyCommand || makeDefault) {
-        record = harness.id === "claude-code" && claudeSubscriptionAuth
-          ? await harness.installStoredToken({
-              apiKey: claim.api_key, gatewayBaseUrl, plan, existingRecord,
-            })
-          : await harness.install({
-              apiKey: claim.api_key, gatewayBaseUrl, plan, existingRecord,
-            });
-      } else {
-        if (hadGlobalRouting) {
-          await harness.uninstall(existingRecord);
-        }
-        record = {
-          harness: harness.id,
-          config_path: compactHome(plan.configPath),
-          backup_path: existingRecord?.backup_path || null,
-          installed_at: new Date().toISOString(),
-        };
-      }
-      if (supportsPennyCommand) {
-        record.launch_available = true;
-        record.launch_config_path = compactHome(
-          harness.id === "claude-code" ? claudeLaunchSettingsPath() : codexLaunchProfilePath(),
-        );
-        record.default_routing = Boolean(makeDefault);
-      }
-      if (harness.id === "claude-code" && claudeSubscriptionAuth) {
-        record.anthropic_oauth = true;
-        record.anthropic_token_stored = true;
-        record.token_source = claudeAnthropicAuth?.source || existingRecord?.token_source || "stored";
-      }
-      if (harness.id === "claude-code" && funding.claudeCredentialProvider) {
-        record.user_funded_provider = funding.claudeCredentialProvider;
-      }
-      if (harness.id === "codex" && funding.codexCredentialProvider) {
-        record.user_funded_provider = funding.codexCredentialProvider;
-      }
-      if (harness.id === "codex") record.openai_subscription_auth = codexSubscriptionAuth;
-      records.push(record);
-      upsertManifestRecord(manifest, record);
-      await saveManifest(manifest);
-    });
-  }
-
-  await saveManifest(manifest);
-  console.log("");
-  console.log(records.length > 0
-    ? "PennyRouter installation complete."
-    : "PennyRouter was not installed on any selected tool.");
-  console.log(`Manifest: ${statePath("installations.json")}`);
-  for (const record of records) {
-    const harness = HARNESS_BY_ID[record.harness];
-    if (record.launch_available) {
-      const command = record.harness === "claude-code" ? "penny claude" : "penny codex";
-      const native = record.harness === "claude-code" ? "claude" : "codex";
-      const harnessName = record.harness === "claude-code" ? "Claude Code" : "Codex";
-      const commandWidth = Math.max(command.length, native.length) + 2;
-      console.log("");
-      console.log(color(`How to Run ${harnessName}`, "bold"));
-      console.log("");
-      console.log(`  ${color(command.padEnd(commandWidth), "bold")}→ ${harnessName} with PennyRouter`);
-      console.log(`  ${color(native.padEnd(commandWidth), "bold")}→ ${record.default_routing ? `${harnessName} with PennyRouter (default routing enabled)` : `${harnessName} native`}`);
-    } else {
-      console.log(`Installed on ${harness?.name || record.harness}${installNoteForRecord(record)}.`);
-    }
-  }
-  if (runtimeResult && !runtimeResult.available) {
-    console.log("Add ~/.local/bin to PATH before using the `penny` command.");
-  } else if (runtimeResult?.changed) {
-    console.log("Open a new terminal (or reload your shell) before using the `penny` command.");
-  }
-  console.log("");
-  reportFailures(failures);
-}
-
-// Refresh the managed local files to this package version WITHOUT re-running any of the
-// account/credential flow. Everything an update needs is already on disk: the pr- key and
-// gateway URL live in the penny config (and, for older installs, in the harness config the
-// installer wrote), and the upstream provider tokens live server-side, encrypted against the
-// account. So no browser claim, no provider checkboxes, no token prompts — this command is
-// non-interactive by construction and never touches a credential.
-//
-// What it DOES rewrite is everything regenerated from code constants, which is exactly what
-// goes stale on a version bump: the copied runtime + `penny` shim, the /penny skill, the
-// Claude launch settings overlay, the Codex provider profile, and the model labels +
-// context-window env in the harness configs.
-//
-// Per-user choices are read back from the manifest, never re-asked: `default_routing` decides
-// whether the bare `claude`/`codex` command keeps pointing at the gateway, and
-// `anthropic_token_stored`/`openai_subscription_auth` decide which auth shape gets rewritten.
-// Re-deriving either from prompt defaults would silently flip a --penny-only user into
-// default routing, or drop subscription auth from a working install.
-async function update(flags) {
-  const manifest = await loadManifest();
-  if (pruneUnsupportedManifestRecords(manifest).length > 0) await saveManifest(manifest);
-  const records = manifest.installations || [];
-
-  const requested = parseHarnessList(flags.harness);
-  const targets = records.filter((record) => {
-    if (record.disabled) return false;
-    if (flags.all || requested.length === 0) return true;
-    return requested.includes(record.harness);
-  });
-
-  if (records.length === 0) {
-    throw new Error("No PennyRouter installation found. Run `npx pennyrouter install` first.");
-  }
-  if (targets.length === 0) {
-    console.log("No enabled PennyRouter installations matched. Nothing to update.");
-    return;
-  }
-
-  const launchConfig = await loadPennyConfig();
-  const globalAuth = await readClaudeCodeGatewayAuth();
-  const apiKey = flags.pennyKey || launchConfig.api_key || globalAuth.apiKey;
-  const gatewayBaseUrl = flags.gatewayBaseUrl
-    || launchConfig.gateway_base_url
-    || globalAuth.gatewayBaseUrl
-    || process.env.PENNYROUTER_GATEWAY_BASE_URL
-    || "https://api.pennyrouter.com";
-
-  if (!apiKey) {
-    throw new Error(
-      "Could not find your PennyRouter key in the local config. Pass `--penny-key pr-...`, "
-      + "or run `npx pennyrouter install` to re-authorize.",
-    );
-  }
-
-  console.log("PennyRouter update");
-  console.log("");
-  console.log(`Key ${maskKey(apiKey)} · gateway ${gatewayBaseUrl}`);
-  console.log("Subscription and API keys are left untouched.");
-  console.log("");
-
-  if (flags.dryRun) {
-    for (const record of targets) {
-      const routing = record.default_routing === false ? "penny command only" : "default routing";
-      console.log(`Will refresh ${record.harness} (${routing}).`);
-    }
-    console.log("Will refresh the penny runtime and shim.");
-    console.log("Dry run only. No files changed.");
-    return;
-  }
-
-  const failures = [];
-  let runtimeResult = null;
-  if (targets.some((record) => ["claude-code", "codex"].includes(record.harness))
-      && process.platform !== "win32") {
-    runtimeResult = await installPennyRuntime({ updatePath: !flags.noPathUpdate });
-  }
-
-  for (const record of targets) {
-    const harness = HARNESS_BY_ID[record.harness];
-    if (!harness) continue;
-
-    await runHarnessJob(failures, record.harness, "update", async () => {
-      const supportsPennyCommand = ["claude-code", "codex"].includes(record.harness)
-        && process.platform !== "win32";
-      // An update rewrites the harness's own config only when that config is ours to
-      // rewrite — i.e. the bare command still routes through the gateway. In penny-only
-      // mode the harness config belongs to the user and we touch just the launch profile.
-      const ownsGlobalRouting = !record.launch_available || record.default_routing !== false;
-      if (ownsGlobalRouting) assertNoRunningHarness(record.harness, flags);
-
-      const claudeSubscriptionAuth = record.harness === "claude-code"
-        && Boolean(record.anthropic_token_stored);
-      const codexSubscriptionAuth = record.harness === "codex"
-        ? await detectCodexChatgptAuth()
-        : false;
-
-      if (supportsPennyCommand) {
-        await configurePennyHarness(record.harness, {
-          apiKey,
-          gatewayBaseUrl,
-          subscriptionAuth: record.harness === "claude-code"
-            ? claudeSubscriptionAuth
-            : codexSubscriptionAuth,
-          models: record.harness === "claude-code" ? CLAUDE_CODE_MODELS : null,
-        });
-      }
-
-      let next = record;
-      if (ownsGlobalRouting) {
-        const plan = await harness.planInstall();
-        // Pass the existing record through so install-time state the harness stashed
-        // (previous_model_provider, claude_ai_connectors_before) survives the rewrite
-        // and a later uninstall still restores the user's original values.
-        const installed = record.harness === "claude-code" && claudeSubscriptionAuth
-          ? await harness.installStoredToken({ apiKey, gatewayBaseUrl, plan, existingRecord: record })
-          : await harness.install({ apiKey, gatewayBaseUrl, plan, existingRecord: record });
-        next = { ...record, ...installed, installed_at: record.installed_at };
-      }
-
-      next.updated_at = new Date().toISOString();
-      if (record.harness === "codex") next.openai_subscription_auth = codexSubscriptionAuth;
-      upsertManifestRecord(manifest, next);
-      await saveManifest(manifest);
-      console.log(`Updated ${record.harness}.`);
-    });
-  }
-
-  await saveManifest(manifest);
-  console.log("");
-  if (runtimeResult && !runtimeResult.available) {
-    console.log("Add ~/.local/bin to PATH before using the `penny` command.");
-  } else if (runtimeResult?.changed) {
-    console.log("Open a new terminal (or reload your shell) before using the `penny` command.");
-  }
-  console.log("Restart any running Claude Code or Codex sessions to pick up the update.");
-  reportFailures(failures);
-}
-
-async function chooseDefaultRouting(flags, selected, manifest) {
-  const out = new Map();
-  const launchable = selected.filter((harness) => ["claude-code", "codex"].includes(harness.id));
-  if (process.platform === "win32") {
-    for (const harness of launchable) out.set(harness.id, true);
-    return out;
-  }
-  let newInstallChoice = null;
-  for (const harness of launchable) {
-    if (flags.makeDefault) {
-      out.set(harness.id, true);
-      continue;
-    }
-    if (flags.pennyOnly) {
-      out.set(harness.id, false);
-      continue;
-    }
-    const existing = (manifest.installations || []).find((item) => item.harness === harness.id);
-    if (existing) {
-      const currentlyDefault = existing.default_routing !== false;
-      if (flags.dryRun || !currentlyDefault || flags.yes || !input.isTTY || !output.isTTY) {
-        out.set(harness.id, currentlyDefault);
-        continue;
-      }
-      const native = harness.id === "claude-code" ? "claude" : "codex";
-      const change = await confirm(
-        `PennyRouter currently runs when you type ${color(native, "bold")}. Change it to run only with ${color(`penny ${native}`, "bold")}?`,
-      );
-      out.set(harness.id, !change);
-      continue;
-    }
-    if (newInstallChoice === null) {
-      if (flags.dryRun || flags.yes || !input.isTTY || !output.isTTY) {
-        newInstallChoice = false;
-      } else {
-        for (const item of launchable) {
-          const native = item.id === "claude-code" ? "claude" : "codex";
-          const harnessName = item.id === "claude-code" ? "Claude Code" : "Codex";
-          const command = `penny ${native}`;
-          const commandWidth = Math.max(command.length, native.length) + 2;
-          console.log("");
-          console.log(color(`How to Run ${harnessName}`, "bold"));
-          console.log("");
-          console.log(`  ${color(command.padEnd(commandWidth), "bold")}→ ${harnessName} with PennyRouter`);
-          console.log(`  ${color(native.padEnd(commandWidth), "bold")}→ ${harnessName} native (recommended)`);
-        }
-        console.log("");
-        const bare = launchable.map((item) => item.id === "claude-code" ? "claude" : "codex");
-        const quoted = bare.map((command) => `'${command}'`);
-        const label = quoted.length === 1
-          ? quoted[0]
-          : `${quoted.slice(0, -1).join(", ")} and ${quoted.at(-1)}`;
-        newInstallChoice = await confirm(
-          `Set ${label} to automatically load PennyRouter with every session?`,
-        );
-      }
-    }
-    out.set(harness.id, newInstallChoice);
-  }
-  return out;
-}
-
-async function selectClaudeFundingProviders(flags, selected) {
-  if (!selected.some((harness) => harness.id === "claude-code")) return new Set();
-
-  const supplied = new Set();
-  if (!flags.noAnthropicAuth && (flags.anthropicAuth || flags.token || flags.tokenCommand
-      || process.env.ANTHROPIC_AUTH_TOKEN)) supplied.add("subscription");
-  if (flags.anthropicApiKey || process.env.ANTHROPIC_API_KEY) supplied.add("anthropic-api");
-  if (flags.openrouterApiKey || process.env.OPENROUTER_API_KEY) supplied.add("openrouter");
-
-  // Explicit flags are the automation selector. Interactive installs always default to the
-  // subscription alone; environment keys are used if the user checks their provider.
-  const explicit = flags.anthropicAuth || flags.noAnthropicAuth || flags.token
-    || flags.tokenCommand || flags.anthropicApiKey || flags.openrouterApiKey;
-  if (explicit || flags.yes || !input.isTTY || !output.isTTY) return supplied;
-
-  console.log("PennyRouter can use your Claude subscription, an Anthropic API key, or an OpenRouter API key to run Claude Code.");
-  console.log("Choose one or more providers. PennyRouter will try them in order when available.");
-  return promptFundingProviderCheckboxes(
-    CLAUDE_PROVIDER_OPTIONS,
-    "Which providers should PennyRouter use for Claude Code?",
-    new Set(["subscription"]),
-  );
-}
-
-async function selectCodexFundingProviders(flags, selected) {
-  if (!selected.some((harness) => harness.id === "codex")) return new Set();
-
-  const supplied = new Set();
-  if (flags.openaiApiKey || process.env.OPENAI_API_KEY) supplied.add("openai-api");
-  if (flags.openrouterApiKey || process.env.OPENROUTER_API_KEY) supplied.add("openrouter");
-  const hasChatgptLogin = await detectCodexChatgptAuth();
-  if (hasChatgptLogin) supplied.add("subscription");
-
-  const explicit = flags.openaiApiKey || flags.openrouterApiKey;
-  if (explicit || flags.yes || !input.isTTY || !output.isTTY) return supplied;
-
-  console.log("PennyRouter can use your ChatGPT subscription, an OpenAI API key, or an OpenRouter API key to run Codex.");
-  console.log("Choose one or more providers. PennyRouter will try them in order when available.");
-  return promptFundingProviderCheckboxes(
-    CODEX_PROVIDER_OPTIONS,
-    "Which providers should PennyRouter use for Codex?",
-    new Set(["subscription"]),
-  );
-}
-
-async function maybeConfigureClaudeAnthropicAuth(flags, selected, enabled = true) {
-  if (!selected.some((harness) => harness.id === "claude-code")) return null;
-  if (!enabled || flags.noAnthropicAuth) return null;
-
-  if (flags.token || flags.tokenCommand || process.env.ANTHROPIC_AUTH_TOKEN) {
-    const tokenResult = readAnthropicOAuthToken(flags);
-    if (tokenResult.token) return tokenResult;
-  }
-
-  if (flags.yes || !input.isTTY || !output.isTTY) {
-    if (flags.anthropicAuth) {
-      throw new Error(
-        "Claude subscription auth was requested, but no Anthropic bearer token was found. Pass --token, --token-command, or ANTHROPIC_AUTH_TOKEN.",
-      );
-    }
-    return null;
-  }
-
-  const tokenResult = readAnthropicOAuthToken({ tokenCommand: flags.tokenCommand });
-  if (tokenResult.token) return tokenResult;
-
-  console.log("");
-  if (commandExists("claude")) {
-    // The user already opted into subscription auth above, so run `claude setup-token`
-    // directly and capture the token — no copy-paste, no second confirm. The command
-    // opens the browser for approval inline. On failure we fall through to manual paste.
-    console.log("Launching Claude sign-in — approve in your browser…");
-    const captured = await runClaudeSetupToken();
-    if (captured) {
-      console.log("✓ Claude subscription auth enabled.");
-      console.log("");
-      return { token: captured, source: "setup-token" };
-    }
-    console.log("");
-    console.log("Couldn't capture a token automatically. Paste it below, or leave blank to skip.");
-  } else {
-    console.log("Claude Code was not found on PATH. Paste an Anthropic bearer token, or leave blank to skip.");
-  }
-  const token = normalizeAnthropicToken(await promptSecretish("Anthropic token (blank to skip): "));
-  if (!token) {
-    console.log("Skipped Claude subscription auth. Enable later with `@penny auth` or `pennyrouter auth anthropic`.");
-    console.log("");
-    return null;
-  }
-  console.log("");
-  return { token, source: "prompt" };
-}
-
-async function configureUserFunding(flags, selected, claudeAnthropicAuth,
-                                    claudeProviders = new Set(), codexProviders = new Set()) {
-  const wantsClaude = selected.some((harness) => harness.id === "claude-code");
-  const wantsCodex = selected.some((harness) => harness.id === "codex");
-  const interactive = !flags.yes && input.isTTY && output.isTTY;
-  const credentials = [];
-
-  let anthropicApiKey = String(
-    flags.anthropicApiKey || process.env.ANTHROPIC_API_KEY || "",
-  ).trim();
-  let openaiApiKey = String(
-    flags.openaiApiKey || process.env.OPENAI_API_KEY || "",
-  ).trim();
-  let openrouterApiKey = String(
-    flags.openrouterApiKey || process.env.OPENROUTER_API_KEY || "",
-  ).trim();
-  const codexSubscriptionAuth = wantsCodex && codexProviders.has("subscription")
-    ? await detectCodexChatgptAuth()
-    : false;
-
-  if (wantsClaude && claudeProviders.has("anthropic-api") && !anthropicApiKey) {
-    if (!interactive) throw new Error("Anthropic API was selected, but no key was provided.");
-    anthropicApiKey = (await promptSecretish("Anthropic API key: ")).trim();
-  }
-  if (wantsClaude && claudeProviders.has("openrouter") && !openrouterApiKey) {
-    if (!interactive) throw new Error("OpenRouter was selected, but no key was provided.");
-    openrouterApiKey = (await promptSecretish("OpenRouter API key: ")).trim();
-  }
-  if (wantsCodex && codexProviders.has("subscription") && !codexSubscriptionAuth) {
-    throw new Error(
-      "ChatGPT subscription was selected, but Codex is not logged in. Run `codex login`, or select an API-key provider.",
-    );
-  }
-  if (wantsCodex && codexProviders.has("openai-api") && !openaiApiKey) {
-    if (!interactive) throw new Error("OpenAI API was selected, but no key was provided.");
-    openaiApiKey = (await promptSecretish("OpenAI API key: ")).trim();
-  }
-  if (wantsCodex && codexProviders.has("openrouter") && !openrouterApiKey) {
-    if (!interactive) throw new Error("OpenRouter was selected, but no key was provided.");
-    openrouterApiKey = (await promptSecretish("OpenRouter API key: ")).trim();
-  }
-
-  if (wantsClaude && !claudeAnthropicAuth && !anthropicApiKey && !openrouterApiKey) {
-    if (!interactive) {
-      throw new Error(
-        "Claude Code requires a Claude subscription, --anthropic-api-key (or ANTHROPIC_API_KEY), "
-        + "or --openrouter-api-key (or OPENROUTER_API_KEY). Nothing was installed.",
-      );
-    }
-    console.log("Claude Code needs a user-funded provider. PennyRouter will never fall back to its own API keys.");
-    anthropicApiKey = (await promptSecretish(
-      "Anthropic API key (leave blank to use OpenRouter): ",
-    )).trim();
-    if (!anthropicApiKey) {
-      openrouterApiKey = (await promptSecretish("OpenRouter API key: ")).trim();
-    }
-    if (!anthropicApiKey && !openrouterApiKey) {
-      throw new Error("Claude Code installation cancelled: no subscription or API key was provided.");
-    }
-    console.log("");
-  }
-
-  if (wantsCodex && !codexSubscriptionAuth && !openaiApiKey && !openrouterApiKey) {
-    if (!interactive) {
-      throw new Error(
-        "Codex requires ChatGPT login, --openai-api-key (or OPENAI_API_KEY), "
-        + "or --openrouter-api-key (or OPENROUTER_API_KEY). Nothing was installed.",
-      );
-    }
-    console.log("Codex is not logged into ChatGPT and needs a user-funded provider.");
-    console.log("PennyRouter will never fall back to its own API keys.");
-    openaiApiKey = (await promptSecretish(
-      "OpenAI API key (leave blank to use OpenRouter): ",
-    )).trim();
-    if (!openaiApiKey) {
-      openrouterApiKey = (await promptSecretish("OpenRouter API key: ")).trim();
-    }
-    if (!openaiApiKey && !openrouterApiKey) {
-      throw new Error("Codex installation cancelled: no subscription or API key was provided.");
-    }
-    console.log("");
-  }
-
-  if (claudeAnthropicAuth) {
-    credentials.push({ provider: "anthropic_oauth", token: claudeAnthropicAuth.token });
-  }
-  if (wantsClaude && anthropicApiKey) {
-    credentials.push({ provider: "anthropic_api", token: anthropicApiKey });
-  }
-  if (wantsCodex && openaiApiKey) {
-    credentials.push({ provider: "openai_api", token: openaiApiKey });
-  }
-  if ((wantsClaude || wantsCodex) && openrouterApiKey) {
-    credentials.push({ provider: "openrouter", token: openrouterApiKey });
-  }
-
-  return {
-    credentials,
-    codexSubscriptionAuth,
-    claudeCredentialProvider: claudeAnthropicAuth
-      ? "claude-subscription"
-      : anthropicApiKey ? "anthropic-api" : openrouterApiKey ? "openrouter" : null,
-    codexCredentialProvider: codexSubscriptionAuth
-      ? "chatgpt-subscription"
-      : openaiApiKey ? "openai-api" : openrouterApiKey ? "openrouter" : null,
-  };
-}
-
-async function disable(flags) {
-  const manifest = await loadManifest();
-  if (pruneUnsupportedManifestRecords(manifest).length > 0) await saveManifest(manifest);
-  const records = manifest.installations || [];
-  const { selectedIds, selectedRecords } = await resolveLifecycleTargets(flags, records);
-
-  if (selectedRecords.length === 0) {
-    console.log("No matching PennyRouter installations found.");
-    return;
-  }
-
-  console.log("PennyRouter disable");
-  console.log("");
-  for (const record of selectedRecords) {
-    console.log(`  - ${record.harness}: ${record.config_path || "manual setup"}`);
-  }
-  console.log("");
-
-  if (!flags.yes) {
-    const ok = await confirm("Temporarily turn off these PennyRouter local integrations?");
-    if (!ok) return;
-  }
-
-  const failures = [];
-  for (const record of selectedRecords) {
-    if (record.disabled) {
-      console.log(`${record.harness} is already disabled.`);
-      continue;
-    }
-
-    const harness = HARNESS_BY_ID[record.harness];
-    if (!harness) {
-      console.log(`Skipping ${record.harness}: this CLI no longer knows how to disable it.`);
-      continue;
-    }
-
-    await runHarnessJob(failures, record.harness, "disable", async () => {
-      const ownsGlobalRouting = !record.launch_available || record.default_routing;
-      if (record.config_path && ownsGlobalRouting) {
-        const snapshotPath = await backupFile(record.config_path, `${record.harness}-disabled`);
-        record.disabled_snapshot_path = snapshotPath;
-      }
-
-      if (record.launch_available) await setPennyHarnessEnabled(record.harness, false);
-      if (ownsGlobalRouting) {
-        if (typeof harness.disable === "function") await harness.disable(record);
-        else await harness.uninstall(record);
-      }
-
-      record.disabled = true;
-      record.disabled_at = new Date().toISOString();
-      upsertManifestRecord(manifest, record);
-      await saveManifest(manifest);
-      console.log(`Disabled ${record.harness}.`);
-    });
-  }
-
-  await saveManifest(manifest);
-  reportFailures(failures);
-}
-
-async function enable(flags) {
-  const manifest = await loadManifest();
-  if (pruneUnsupportedManifestRecords(manifest).length > 0) await saveManifest(manifest);
-  const records = manifest.installations || [];
-  const selectedIds = resolveRequestedHarnessIds(flags, records.map((record) => record.harness));
-  const selectedRecords = records.filter((record) => selectedIds.includes(record.harness));
-
-  if (selectedRecords.length === 0) {
-    console.log("No matching PennyRouter installations found.");
-    return;
-  }
-
-  console.log("PennyRouter enable");
-  console.log("");
-  for (const record of selectedRecords) {
-    console.log(`  - ${record.harness}: ${record.config_path || "manual setup"}`);
-  }
-  console.log("");
-
-  if (!flags.yes) {
-    const ok = await confirm("Turn these PennyRouter local integrations back on?");
-    if (!ok) return;
-  }
-
-  const failures = [];
-  for (const record of selectedRecords) {
-    if (!record.disabled) {
-      console.log(`${record.harness} is already enabled.`);
-      continue;
-    }
-
-    const harness = HARNESS_BY_ID[record.harness];
-    if (!harness) {
-      console.log(`Skipping ${record.harness}: this CLI no longer knows how to enable it.`);
-      continue;
-    }
-
-    await runHarnessJob(failures, record.harness, "enable", async () => {
-      const ownsGlobalRouting = !record.launch_available || record.default_routing;
-      if (record.launch_available) await setPennyHarnessEnabled(record.harness, true);
-      if (ownsGlobalRouting) {
-        if (typeof harness.enable === "function") await harness.enable(record);
-        else if (record.config_path && record.disabled_snapshot_path) {
-          await restoreFile(record.disabled_snapshot_path, record.config_path);
-        } else if (record.manual_required) {
-          console.log(`${record.harness}: re-enable manually in the tool UI using the status details.`);
-        } else {
-          throw new Error("no disabled snapshot found; run install again");
-        }
-      }
-
-      delete record.disabled;
-      delete record.disabled_at;
-      upsertManifestRecord(manifest, record);
-      await saveManifest(manifest);
-      console.log(`Enabled ${record.harness}.`);
-    });
-  }
-
-  await saveManifest(manifest);
-  reportFailures(failures);
-}
-
-async function uninstall(flags) {
-  const manifest = await loadManifest();
-  if (pruneUnsupportedManifestRecords(manifest).length > 0) await saveManifest(manifest);
-  const records = manifest.installations || [];
-  const { selectedIds, selectedRecords } = await resolveLifecycleTargets(flags, records);
-
-  if (selectedRecords.length === 0) {
-    console.log("No matching PennyRouter installations found.");
-    return;
-  }
-
-  console.log("PennyRouter uninstall");
-  console.log("");
-  for (const record of selectedRecords) {
-    console.log(`  - ${record.harness}: ${record.config_path}`);
-  }
-  console.log("");
-
-  if (!flags.yes) {
-    const ok = await confirm("Remove these PennyRouter local integrations?");
-    if (!ok) return;
-  }
-
-  const kept = [];
-  const failures = [];
-  let anthropicTokenNotice = false;
-  for (const record of records) {
-    if (!selectedIds.includes(record.harness)) {
-      kept.push(record);
-      continue;
-    }
-
-    const harness = HARNESS_BY_ID[record.harness];
-    if (!harness) {
-      console.log(`Skipping ${record.harness}: this CLI no longer knows how to uninstall it.`);
-      kept.push(record);
-      continue;
-    }
-
-    const ok = await runHarnessJob(failures, record.harness, "uninstall", async () => {
-      if (flags.forgetToken) {
-        await forgetStoredAnthropicToken(record);
-      } else if (record.anthropic_token_stored) {
-        anthropicTokenNotice = true;
-      }
-      if (record.launch_available) await removePennyHarness(record.harness);
-      if (!record.launch_available || record.default_routing) await harness.uninstall(record);
-      console.log(`Removed ${record.harness}.`);
-    });
-    if (!ok) kept.push(record);
-  }
-
-  for (const record of selectedRecords) {
-    if (records.some((existing) => existing.harness === record.harness)) continue;
-    const harness = HARNESS_BY_ID[record.harness];
-    if (!harness) {
-      console.log(`Skipping ${record.harness}: this CLI does not know how to uninstall it.`);
-      continue;
-    }
-    await runHarnessJob(failures, record.harness, "uninstall", async () => {
-      if (flags.forgetToken) {
-        await forgetStoredAnthropicToken(record);
-      } else if (record.anthropic_token_stored) {
-        anthropicTokenNotice = true;
-      }
-      if (record.launch_available) await removePennyHarness(record.harness);
-      if (!record.launch_available || record.default_routing) await harness.uninstall(record);
-      console.log(`Removed ${record.harness}.`);
-    });
-  }
-
-  if (anthropicTokenNotice) {
-    console.log("");
-    console.log("Note: Your stored Anthropic token remains on the server for other machines.");
-    console.log("To delete it from the server, run: pennyrouter auth anthropic --forget");
-  }
-
-  manifest.installations = kept;
-  await saveManifest(manifest);
-  if (!(await hasConfiguredPennyHarnesses())) await removePennyRuntime();
-  reportFailures(failures);
-}
-
-async function resolveLifecycleTargets(flags, records) {
-  const requested = parseHarnessList(flags.harness);
-  const ids = flags.all
-    ? Object.keys(HARNESS_BY_ID)
-    : requested.length > 0
-      ? requested
-      : records.length > 0
-        ? records.map((record) => record.harness)
-        : await detectHarnessIds();
-
-  const selectedIds = [...new Set(ids)];
-  const selectedRecords = records.filter((record) => selectedIds.includes(record.harness));
-  const manifestIds = new Set(selectedRecords.map((record) => record.harness));
-
-  for (const id of selectedIds) {
-    if (manifestIds.has(id)) continue;
-    const harness = HARNESS_BY_ID[id];
-    if (!harness) continue;
-    if (!(await safeDetect(harness))) continue;
-    let plan;
-    try {
-      plan = await harness.planInstall();
-    } catch (error) {
-      console.log(`Skipping ${id}: ${formatError(error)}`);
-      continue;
-    }
-    selectedRecords.push({
-      harness: id,
-      config_path: plan.configPath ? compactHome(plan.configPath) : null,
-      backup_path: null,
-      installed_at: null,
-      recovered_from_detected_config: true,
-    });
-  }
-
-  return { selectedIds, selectedRecords };
-}
-
-async function detectHarnessIds() {
-  const ids = [];
-  for (const harness of Object.values(HARNESS_BY_ID)) {
-    if (await safeDetect(harness)) ids.push(harness.id);
-  }
-  return ids;
-}
-
-async function status() {
-  const manifest = await loadManifest();
-  const pruned = pruneUnsupportedManifestRecords(manifest);
-  if (pruned.length > 0) await saveManifest(manifest);
-  const records = manifest.installations || [];
-  console.log("PennyRouter local setup");
-  console.log("");
-
-  if (records.length === 0) {
-    console.log("No local PennyRouter integrations recorded.");
-    return;
-  }
-
-  for (const record of records) {
-    const state = record.disabled ? "disabled" : record.manual_required ? "manual setup shown" : "installed";
-    console.log(`${record.harness}: ${state}`);
-    if (record.config_path) console.log(`  config: ${record.config_path}`);
-    if (record.backup_path) console.log(`  backup: ${record.backup_path}`);
-    if (record.disabled_snapshot_path) console.log(`  disabled snapshot: ${record.disabled_snapshot_path}`);
-    if (record.installed_at) console.log(`  installed: ${record.installed_at}`);
-    if (record.disabled_at) console.log(`  disabled: ${record.disabled_at}`);
-    if (record.anthropic_oauth) console.log(`  Claude subscription auth: enabled (${record.token_source || "unknown"} token)`);
-    if (record.openai_subscription_auth) console.log("  OpenAI subscription auth: enabled (Codex-managed login)");
-    if (record.launch_available) {
-      const command = record.harness === "claude-code" ? "penny claude" : "penny codex";
-      console.log(`  command: ${command}`);
-      console.log(`  bare command: ${record.default_routing ? "PennyRouter" : "native"}`);
-    }
-    if (record.manual_required) console.log("  note: finish or remove this integration in the tool UI");
-  }
-}
-
-async function selectHarnesses(flags) {
-  const requested = flags.all ? Object.keys(HARNESS_BY_ID) : parseHarnessList(flags.harness);
-  if (requested.length > 0) {
-    return requested.map((id) => HARNESS_BY_ID[id]).filter(Boolean);
-  }
-
-  const detected = [];
-  for (const id of DEFAULT_INSTALL_HARNESS_IDS) {
-    const harness = HARNESS_BY_ID[id];
-    if (await safeDetect(harness)) detected.push(harness);
-  }
-
-  if (flags.yes) return detected;
-
-  return promptHarnessCheckboxes(detected);
-}
-
-async function promptHarnessCheckboxes(detected) {
-  const detectedIds = new Set(detected.map((harness) => harness.id));
-  const selectedIds = new Set(detectedIds);
-  const harnesses = orderedHarnessesForPrompt(detectedIds);
-  if (!input.isTTY || !output.isTTY) return promptHarnessCheckboxesByText(harnesses, selectedIds);
-
-  return promptHarnessCheckboxesByKeys(harnesses, selectedIds);
-}
-
-async function promptHarnessCheckboxesByKeys(harnesses, selectedIds) {
-  let cursor = 0;
-  const previousRawMode = input.isRaw;
-
-  emitKeypressEvents(input);
-  input.setRawMode(true);
-  input.resume();
-  output.write("\x1b[?25l");
-
-  const render = () => {
-    output.write("\x1b[2J\x1b[H");
-    output.write("\n\n");
-    output.write(`${color("Where should PennyRouter be installed?", "bold")}\n\n\n`);
-    harnesses.forEach((harness, index) => {
-      const pointer = index === cursor ? color(">", "cyan") : " ";
-      const checked = selectedIds.has(harness.id) ? color("x", "green") : " ";
-      const name = index === cursor ? color(harness.name, "cyan") : harness.name;
-      output.write(` ${pointer} [${checked}] ${name}\n`);
-    });
-    output.write("\nEnter to continue.\n");
-  };
-
-  render();
-
-  return new Promise((resolve, reject) => {
-    const cleanup = () => {
-      input.off("keypress", onKeypress);
-      input.setRawMode(Boolean(previousRawMode));
-      input.pause();
-      output.write("\x1b[?25h");
-      output.write("\n");
-    };
-
-    const onKeypress = (_str, key = {}) => {
-      if (key.ctrl && key.name === "c") {
-        cleanup();
-        reject(new Error("Cancelled."));
-        return;
-      }
-
-      if (key.name === "up" || key.name === "k") {
-        cursor = (cursor - 1 + harnesses.length) % harnesses.length;
-        render();
-        return;
-      }
-
-      if (key.name === "down" || key.name === "j") {
-        cursor = (cursor + 1) % harnesses.length;
-        render();
-        return;
-      }
-
-      if (key.name === "space") {
-        const id = harnesses[cursor].id;
-        if (selectedIds.has(id)) selectedIds.delete(id);
-        else selectedIds.add(id);
-        render();
-        return;
-      }
-
-      if (key.name === "return" || key.name === "enter") {
-        cleanup();
-        resolve(harnesses.filter((harness) => selectedIds.has(harness.id)));
-      }
-    };
-
-    input.on("keypress", onKeypress);
-  });
-}
-
-async function promptHarnessCheckboxesByText(harnesses, selectedIds) {
-  const rl = createInterface({ input, output });
-
-  try {
-    while (true) {
-      console.log("");
-      console.log("");
-      console.log(color("Where should PennyRouter be installed?", "bold"));
-      for (const harness of harnesses) {
-        const checked = selectedIds.has(harness.id) ? color("x", "green") : " ";
-        console.log(`  [${checked}] ${harness.name}`);
-      }
-      console.log("");
-      const answer = await rl.question(
-        "Press Enter to continue, or type names to toggle (comma-separated, 'all', or 'none'): ",
-      );
-      const value = answer.trim().toLowerCase();
-      if (!value) return harnesses.filter((harness) => selectedIds.has(harness.id));
-      if (value === "all") {
-        for (const harness of harnesses) selectedIds.add(harness.id);
-      } else if (value === "none") {
-        selectedIds.clear();
-      } else {
-        for (const token of parseHarnessList(value)) {
-          const id = resolveHarnessToken(token);
-          if (!HARNESS_BY_ID[id]) {
-            console.log(`Unknown tool "${token}".`);
-            continue;
-          }
-          if (selectedIds.has(id)) selectedIds.delete(id);
-          else selectedIds.add(id);
-        }
-      }
-      console.log("");
-    }
-  } finally {
-    rl.close();
-  }
-}
-
-async function promptFundingProviderCheckboxes(providerOptions, title,
-                                                initialIds = new Set(["subscription"])) {
-  const selectedIds = new Set(initialIds);
-  if (!input.isTTY || !output.isTTY) return selectedIds;
-
-  let cursor = 0;
-  let validation = "";
-  const previousRawMode = input.isRaw;
-  emitKeypressEvents(input);
-  input.setRawMode(true);
-  input.resume();
-  output.write("\x1b[?25l");
-
-  const render = () => {
-    output.write("\x1b[2J\x1b[H");
-    output.write("\n\n");
-    output.write(`${color(title, "bold")}\n\n`);
-    providerOptions.forEach((provider, index) => {
-      const pointer = index === cursor ? color(">", "cyan") : " ";
-      const checked = selectedIds.has(provider.id) ? color("x", "green") : " ";
-      const name = index === cursor ? color(provider.name, "cyan") : provider.name;
-      output.write(` ${pointer} [${checked}] ${name}\n`);
-    });
-    output.write("\nSpace to toggle · Enter to continue.\n");
-    if (validation) output.write(`${validation}\n`);
-  };
-  render();
-
-  return new Promise((resolve, reject) => {
-    const cleanup = () => {
-      input.off("keypress", onKeypress);
-      input.setRawMode(Boolean(previousRawMode));
-      input.pause();
-      output.write("\x1b[?25h\n");
-    };
-    const onKeypress = (_str, key = {}) => {
-      if (key.ctrl && key.name === "c") {
-        cleanup();
-        reject(new Error("Cancelled."));
-      } else if (key.name === "up" || key.name === "k") {
-        cursor = (cursor - 1 + providerOptions.length) % providerOptions.length;
-        validation = "";
-        render();
-      } else if (key.name === "down" || key.name === "j") {
-        cursor = (cursor + 1) % providerOptions.length;
-        validation = "";
-        render();
-      } else if (key.name === "space") {
-        const id = providerOptions[cursor].id;
-        if (selectedIds.has(id)) selectedIds.delete(id); else selectedIds.add(id);
-        validation = "";
-        render();
-      } else if (key.name === "return" || key.name === "enter") {
-        if (!selectedIds.size) {
-          validation = "Select at least one provider.";
-          render();
-          return;
-        }
-        cleanup();
-        resolve(selectedIds);
-      }
-    };
-    input.on("keypress", onKeypress);
-  });
-}
-
-function orderedHarnessesForPrompt(detectedIds) {
-  return DEFAULT_INSTALL_HARNESS_IDS.map((id) => HARNESS_BY_ID[id]).sort((left, right) => {
-    const leftDetected = detectedIds.has(left.id);
-    const rightDetected = detectedIds.has(right.id);
-    if (leftDetected !== rightDetected) return leftDetected ? -1 : 1;
-    return left.name.localeCompare(right.name);
-  });
-}
-
-function resolveHarnessToken(token) {
-  const normalized = normalizeHarnessToken(token);
-  for (const harness of Object.values(HARNESS_BY_ID)) {
-    if (normalizeHarnessToken(harness.id) === normalized) return harness.id;
-    if (normalizeHarnessToken(harness.name) === normalized) return harness.id;
-  }
-  return token;
-}
-
-function normalizeHarnessToken(value) {
-  return String(value).toLowerCase().replace(/[^a-z0-9]/g, "");
-}
-
-function color(text, style) {
-  if (!output.isTTY || process.env.NO_COLOR) return text;
-  const codes = {
-    bold: ["\x1b[1m", "\x1b[22m"],
-    cyan: ["\x1b[36m", "\x1b[39m"],
-    green: ["\x1b[32m", "\x1b[39m"],
-  };
-  const pair = codes[style];
-  return pair ? `${pair[0]}${text}${pair[1]}` : text;
-}
-
-function parseHarnessList(value = "") {
-  return value
-    .split(",")
-    .map((part) => part.trim())
-    .filter(Boolean);
-}
-
-function resolveRequestedHarnessIds(flags, defaults) {
-  if (flags.all) return defaults;
-  const requested = parseHarnessList(flags.harness);
-  return requested.length > 0 ? requested : defaults;
-}
-
-function upsertManifestRecord(manifest, record) {
-  manifest.installations ||= [];
-  manifest.installations = manifest.installations.filter((existing) => existing.harness !== record.harness);
-  manifest.installations.push(record);
-}
-
-function pruneUnsupportedManifestRecords(manifest) {
-  manifest.installations ||= [];
-  const kept = manifest.installations.filter((record) => HARNESS_BY_ID[record.harness]);
-  const pruned = manifest.installations.filter((record) => !HARNESS_BY_ID[record.harness]);
-  manifest.installations = kept;
-  return pruned;
-}
-
-async function safeDetect(harness) {
-  try {
-    return await harness.detect();
-  } catch (error) {
-    console.log(`Skipping ${harness.id}: detect failed: ${formatError(error)}`);
-    return false;
-  }
-}
-
-async function runHarnessJob(failures, harnessId, action, job) {
-  try {
-    await job();
-    return true;
-  } catch (error) {
-    failures.push({ harness: harnessId, action, error });
-    console.error(`${harnessId} ${action} failed: ${formatError(error)}`);
-    return false;
-  }
-}
-
-function reportFailures(failures) {
-  if (failures.length === 0) return;
-  console.error("");
-  console.error("Some PennyRouter integrations failed:");
-  for (const failure of failures) {
-    console.error(`  - ${failure.harness} ${failure.action}: ${formatError(failure.error)}`);
-  }
-  process.exitCode = 1;
-}
-
-function formatError(error) {
-  return error?.message || String(error);
-}
-
-// Best-effort: tell the gateway to forget a stored Claude token when uninstalling a
-// claude-code integration that stored one. Reads the gateway URL + pr- key from the
-// live config BEFORE harness.uninstall strips them. Never throws — a local uninstall
-// must not be blocked by a network hiccup; the record is going away regardless.
-async function forgetStoredAnthropicToken(record) {
-  if (record.harness !== "claude-code" || !record.anthropic_token_stored) return;
-  try {
-    const launchConfig = await loadPennyConfig();
-    const globalAuth = await readClaudeCodeGatewayAuth();
-    const gatewayBaseUrl = launchConfig.gateway_base_url || globalAuth.gatewayBaseUrl;
-    const apiKey = launchConfig.api_key || globalAuth.apiKey;
-    if (!gatewayBaseUrl || !apiKey) return;
-    await forgetAnthropicToken({ gatewayBaseUrl, apiKey });
-  } catch {
-    // swallow — see note above
-  }
-}
-
-async function confirm(question) {
-  const rl = createInterface({ input, output });
-  const answer = await rl.question(`${question} [y/N] `);
-  rl.close();
-  return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
-}
-
-async function promptSecretish(question) {
-  if (!input.isTTY || !output.isTTY) {
-    const rl = createInterface({ input, output });
-    const answer = await rl.question(question);
-    rl.close();
-    return answer.trim();
-  }
-
-  const previousRawMode = input.isRaw;
-  emitKeypressEvents(input);
-  input.setRawMode(true);
-  input.resume();
-  output.write(question);
-
-  return new Promise((resolve, reject) => {
-    let value = "";
-    const cleanup = () => {
-      input.off("keypress", onKeypress);
-      input.setRawMode(Boolean(previousRawMode));
-      input.pause();
-      output.write("\n");
-    };
-    const onKeypress = (str, key = {}) => {
-      if (key.ctrl && key.name === "c") {
-        cleanup();
-        reject(new Error("Cancelled."));
-        return;
-      }
-      if (key.name === "return" || key.name === "enter") {
-        cleanup();
-        resolve(value.trim());
-        return;
-      }
-      if (key.name === "backspace") {
-        value = value.slice(0, -1);
-        return;
-      }
-      if (str) value += str;
-    };
-    input.on("keypress", onKeypress);
-  });
-}
-
-function commandExists(command) {
-  // Windows installs CLIs as `.cmd`/`.ps1` shims that Node won't resolve without a
-  // shell, so probe through the shell there (else this false-negatives on `claude` and
-  // the auto setup-token path gets skipped). `command` is an internal literal.
-  const result = spawnSync(command, ["--version"], {
-    stdio: "ignore",
-    shell: process.platform === "win32",
-  });
-  return result.status === 0;
-}
-
-function installNoteForRecord(record) {
-  if (record.manual_required) return " (manual setup shown)";
-  if (record.anthropic_oauth) return " (Claude subscription auth)";
-  return installNoteForHarness(record.harness);
-}
-
-function installNoteForHarness(harnessId) {
-  if (harnessId === "cline" || harnessId === "codegpt") return " (manual setup)";
-  if (harnessId === "opencode") return " (select a Penny model from /model)";
-  return " (auto-selected)";
-}
-
-function openBrowser(url) {
-  const platform = process.platform;
-  const command =
-    platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
-  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
-  spawnSync(command, args, { stdio: "ignore", detached: true });
-}
-
-function runningClaudeCodeProcesses() {
-  if (process.platform === "win32") {
-    const result = spawnSync("tasklist", ["/FO", "CSV", "/NH"], { encoding: "utf8" });
-    if (result.status !== 0) return [];
-    return String(result.stdout || "").split(/\r?\n/)
-      .filter((line) => /^"claude(?:\.exe)?"/i.test(line.trim()));
-  }
-  const result = spawnSync("ps", ["-ax", "-o", "pid=,command="], { encoding: "utf8" });
-  if (result.status !== 0) return [];
-  return String(result.stdout || "").split(/\r?\n/)
-    .map((line) => line.trim())
-    // Case-sensitive on purpose: match the Claude Code executable, not Claude.app.
-    .filter((line) => /(^|[\/\s])claude(?:\s|$)/.test(line));
-}
-
-function runningCodexProcesses() {
-  if (process.platform === "win32") return [];
-  const result = spawnSync("ps", ["-ax", "-o", "pid=,command="], { encoding: "utf8" });
-  if (result.status !== 0) return [];
-  return String(result.stdout || "").split(/\r?\n/)
-    .map((line) => line.trim())
-    .filter((line) => /(^|[\/\s])codex(?:\s|$)/.test(line));
-}
-
-function assertNoRunningHarness(harnessId, flags) {
-  if (flags.allowRunningHarnesses || (harnessId === "claude-code" && flags.allowRunningClaude)) {
-    return;
-  }
-  const running = harnessId === "claude-code"
-    ? runningClaudeCodeProcesses()
-    : runningCodexProcesses();
-  if (running.length === 0) return;
-  const name = harnessId === "claude-code" ? "Claude Code" : "Codex";
-  throw new Error(
-    `${name} is currently running. Close all ${name} sessions before changing its global routing. `
-    + "Installing only the explicit `penny` command does not require this. If you intentionally "
-    + "accept the risk, pass --allow-running-harnesses.\nDetected:\n  "
-    + running.slice(0, 5).join("\n  "),
-  );
-}
-
-function printHelp() {
-  console.log(`PennyRouter CLI
-
-Usage:
-  pennyrouter install [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes] [--dry-run] [--make-default|--penny-only] [--no-path-update] [--anthropic-auth|--no-anthropic-auth] [--anthropic-api-key KEY] [--openai-api-key KEY] [--openrouter-api-key KEY] [--local[=URL]] [--allow-running-harnesses]
-  pennyrouter update [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--dry-run] [--penny-key pr-...] [--gateway-base-url URL] [--allow-running-harnesses]
-  pennyrouter auth anthropic [--penny-key pr-...] [--token oauth-token] [--token-command CMD] [--gateway-base-url URL] [--forget]
-  pennyrouter disable [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes]
-  pennyrouter enable [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes]
-  pennyrouter uninstall [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes] [--forget-token]
-  pennyrouter status
-
-Update refreshes the managed local config and the penny runtime to this package version.
-It reuses your existing key and never re-asks for subscription or API credentials.
-
-Examples:
-  npx pennyrouter update
-  npx pennyrouter update --dry-run
-  npx pennyrouter update --harness claude-code
-  npx pennyrouter install
-  npx pennyrouter install --make-default
-  npx pennyrouter install --penny-only
-  npx pennyrouter install --harness claude-code --anthropic-auth --token <token>
-  npx pennyrouter install --harness claude-code --anthropic-api-key <key>
-  npx pennyrouter install --harness codex --openai-api-key <key>
-  npx pennyrouter install --openrouter-api-key <key>
-  npx pennyrouter auth anthropic
-  npx pennyrouter install --all
-  npx pennyrouter install --harness windsurf,zed,codegpt,aider --yes
-  npx pennyrouter disable
-  npx pennyrouter enable
-  npx pennyrouter uninstall
-`);
-}
+import { spawn, spawnSync } from "node:child_process";
+import { emitKeypressEvents } from "node:readline";
+import { createInterface } from "node:readline/promises";
+import { stdin as input, stdout as output } from "node:process";
+import { aiderHarness } from "./harnesses/aider.js";
+import {
+  CLAUDE_CODE_MODELS,
+  claudeCodeHarness,
+  readClaudeCodeGatewayAuth,
+  readClaudeCodePennyRouterKey,
+} from "./harnesses/claude-code.js";
+import { clineHarness } from "./harnesses/cline.js";
+import { codeGptHarness } from "./harnesses/codegpt.js";
+import { codexHarness, detectCodexChatgptAuth } from "./harnesses/codex.js";
+import { opencodeHarness } from "./harnesses/opencode.js";
+import { windsurfHarness } from "./harnesses/windsurf.js";
+import { zedHarness } from "./harnesses/zed.js";
+import {
+  APP_URL,
+  createCliSession,
+  forgetAnthropicToken,
+  maskKey,
+  pollForKey,
+  probeClaudeCodeGateway,
+  sleep,
+  storeAnthropicToken,
+  storeUpstreamCredential,
+} from "./session.js";
+import {
+  backupFile,
+  compactHome,
+  loadManifest,
+  restoreFile,
+  saveManifest,
+  statePath,
+} from "./state.js";
+import {
+  claudeLaunchSettingsPath,
+  codexLaunchProfilePath,
+  configurePennyHarness,
+  hasConfiguredPennyHarnesses,
+  installPennyRuntime,
+  loadPennyConfig,
+  pennyConfigPath,
+  removePennyHarness,
+  removePennyRuntime,
+  savePennyConfig,
+  setPennyHarnessEnabled,
+} from "./launch.js";
+
+const HARNESS_BY_ID = {
+  "claude-code": claudeCodeHarness,
+  cline: clineHarness,
+  opencode: opencodeHarness,
+  codex: codexHarness,
+  windsurf: windsurfHarness,
+  zed: zedHarness,
+  codegpt: codeGptHarness,
+  aider: aiderHarness,
+};
+
+const SUPPORTED_HARNESS_IDS = Object.keys(HARNESS_BY_ID).join(",");
+const DEFAULT_INSTALL_HARNESS_IDS = ["claude-code", "codex"];
+const CLAUDE_PROVIDER_OPTIONS = [
+  { id: "subscription", name: "Claude subscription" },
+  { id: "anthropic-api", name: "Anthropic API key" },
+  { id: "openrouter", name: "OpenRouter API key" },
+];
+const CODEX_PROVIDER_OPTIONS = [
+  { id: "subscription", name: "ChatGPT subscription" },
+  { id: "openai-api", name: "OpenAI API key" },
+  { id: "openrouter", name: "OpenRouter API key" },
+];
+
+export async function main(argv = process.argv.slice(2)) {
+  const { command, flags } = parseArgs(argv);
+
+  if (flags.help || command === "help") {
+    printHelp();
+    return;
+  }
+
+  if (command === "install") {
+    await install(flags);
+    return;
+  }
+
+  if (command === "update") {
+    await update(flags);
+    return;
+  }
+
+  if (command === "auth") {
+    await authProvider(flags);
+    return;
+  }
+
+  if (command === "uninstall") {
+    await uninstall(flags);
+    return;
+  }
+
+  if (command === "disable") {
+    await disable(flags);
+    return;
+  }
+
+  if (command === "enable") {
+    await enable(flags);
+    return;
+  }
+
+  if (command === "status") {
+    await status();
+    return;
+  }
+
+  throw new Error(`Unknown command "${command}". Run "pennyrouter help".`);
+}
+
+function parseArgs(argv) {
+  const command = argv[0] && !argv[0].startsWith("-") ? argv[0] : "install";
+  const rest = command === argv[0] ? argv.slice(1) : argv;
+  const flags = {};
+  flags.args = [];
+
+  for (let i = 0; i < rest.length; i += 1) {
+    const arg = rest[i];
+    if (arg === "--help" || arg === "-h") flags.help = true;
+    else if (arg === "--yes" || arg === "-y") flags.yes = true;
+    else if (arg === "--all") flags.all = true;
+    else if (arg === "--dry-run") flags.dryRun = true;
+    else if (arg === "--allow-running-claude") flags.allowRunningClaude = true;
+    else if (arg === "--allow-running-harnesses") flags.allowRunningHarnesses = true;
+    else if (arg === "--make-default") flags.makeDefault = true;
+    else if (arg === "--penny-only") flags.pennyOnly = true;
+    else if (arg === "--no-path-update") flags.noPathUpdate = true;
+    else if (arg === "--no-browser") flags.noBrowser = true;
+    else if (arg === "--existing-account") flags.existingAccount = true;
+    else if (arg === "--anthropic-auth") flags.anthropicAuth = true;
+    else if (arg === "--no-anthropic-auth") flags.noAnthropicAuth = true;
+    else if (arg === "--penny-key") flags.pennyKey = rest[++i] || "";
+    else if (arg.startsWith("--penny-key=")) flags.pennyKey = arg.slice("--penny-key=".length);
+    else if (arg === "--token") flags.token = rest[++i] || "";
+    else if (arg.startsWith("--token=")) flags.token = arg.slice("--token=".length);
+    else if (arg === "--token-command") flags.tokenCommand = rest[++i] || "";
+    else if (arg.startsWith("--token-command=")) flags.tokenCommand = arg.slice("--token-command=".length);
+    else if (arg === "--anthropic-api-key") flags.anthropicApiKey = rest[++i] || "";
+    else if (arg.startsWith("--anthropic-api-key=")) flags.anthropicApiKey = arg.slice("--anthropic-api-key=".length);
+    else if (arg === "--openai-api-key") flags.openaiApiKey = rest[++i] || "";
+    else if (arg.startsWith("--openai-api-key=")) flags.openaiApiKey = arg.slice("--openai-api-key=".length);
+    else if (arg === "--openrouter-api-key") flags.openrouterApiKey = rest[++i] || "";
+    else if (arg.startsWith("--openrouter-api-key=")) flags.openrouterApiKey = arg.slice("--openrouter-api-key=".length);
+    else if (arg === "--harness") flags.harness = rest[++i] || "";
+    else if (arg.startsWith("--harness=")) flags.harness = arg.slice("--harness=".length);
+    else if (arg === "--app-url") flags.appUrl = rest[++i] || "";
+    else if (arg.startsWith("--app-url=")) flags.appUrl = arg.slice("--app-url=".length);
+    else if (arg === "--gateway-base-url") flags.gatewayBaseUrl = rest[++i] || "";
+    else if (arg.startsWith("--gateway-base-url=")) flags.gatewayBaseUrl = arg.slice("--gateway-base-url=".length);
+    // --local: point the installed harness at a locally-running gateway (default
+    // http://localhost:8400), for developing/testing against your own gateway. Auth still goes
+    // to prod (pennyrouter.com) so you get a real key; only the harness's serving URL is local.
+    // `--local=<url>` overrides the port/host.
+    else if (arg === "--local") flags.gatewayBaseUrl = "http://localhost:8400";
+    else if (arg.startsWith("--local=")) flags.gatewayBaseUrl = arg.slice("--local=".length);
+    else if (arg === "--forget") flags.forget = true;
+    else if (arg === "--forget-token") flags.forgetToken = true;
+    else if (!arg.startsWith("-")) flags.args.push(arg);
+    else throw new Error(`Unknown option "${arg}". Run "pennyrouter help".`);
+  }
+
+  return { command, flags };
+}
+
+async function authProvider(flags) {
+  const provider = (flags.args[0] || "anthropic").toLowerCase();
+  if (provider !== "anthropic" && provider !== "claude") {
+    throw new Error(`Unknown auth provider "${provider}". Try "pennyrouter auth anthropic".`);
+  }
+
+  if (flags.forget) {
+    const launchConfig = await loadPennyConfig();
+    const pennyKey = flags.pennyKey || launchConfig.api_key || await readClaudeCodePennyRouterKey();
+    if (!pennyKey) {
+      throw new Error(
+        "No PennyRouter key found in Claude Code settings. Pass `--penny-key pr-...`.",
+      );
+    }
+    const gatewayBaseUrl = flags.gatewayBaseUrl || process.env.PENNYROUTER_GATEWAY_BASE_URL || "https://api.pennyrouter.com";
+    if (flags.dryRun) {
+      console.log(`Will delete stored Anthropic token from gateway: ${gatewayBaseUrl}`);
+      return;
+    }
+    const ok = await forgetAnthropicToken({ gatewayBaseUrl, apiKey: pennyKey });
+    if (ok) {
+      console.log("Successfully forgot stored Anthropic token on server.");
+    } else {
+      console.log("Failed to forget stored Anthropic token on server.");
+    }
+    const manifest = await loadManifest();
+    let updated = false;
+    for (const record of (manifest.installations || [])) {
+      if (record.harness === "claude-code" && record.anthropic_token_stored) {
+        record.anthropic_token_stored = false;
+        record.anthropic_oauth = false;
+        updated = true;
+      }
+    }
+    if (updated) {
+      await saveManifest(manifest);
+    }
+    if (launchConfig.harnesses?.claude) {
+      launchConfig.harnesses.claude.subscription_auth = false;
+      await savePennyConfig(launchConfig);
+    }
+    return;
+  }
+
+  if (flags.dryRun) {
+    console.log("Will configure Claude Code for PennyRouter + Anthropic OAuth dual auth.");
+    console.log("Dry run only. No files changed.");
+    return;
+  }
+
+  const launchConfig = await loadPennyConfig();
+  const pennyKey = flags.pennyKey || launchConfig.api_key || await readClaudeCodePennyRouterKey();
+  if (!pennyKey) {
+    throw new Error(
+      "No PennyRouter key found in Claude Code settings. Run `pennyrouter install --harness claude-code` first, or pass `--penny-key pr-...`.",
+    );
+  }
+
+  const tokenResult = readAnthropicOAuthToken(flags);
+  const token = tokenResult.token;
+  if (!token) {
+    throw new Error(
+      "No Anthropic OAuth token found. Run `claude setup-token` and pass it with `--token`, set ANTHROPIC_AUTH_TOKEN, or pass `--token-command <cmd>`.",
+    );
+  }
+
+  const gatewayBaseUrl = flags.gatewayBaseUrl || process.env.PENNYROUTER_GATEWAY_BASE_URL || "https://api.pennyrouter.com";
+  const manifest = await loadManifest();
+  const existingRecord = (manifest.installations || []).find(
+    (candidate) => candidate.harness === "claude-code",
+  );
+  const ownsGlobalRouting = existingRecord
+    ? existingRecord.default_routing !== false
+    : Boolean(await readClaudeCodePennyRouterKey());
+  if (ownsGlobalRouting) assertNoRunningHarness("claude-code", flags);
+  await storeAnthropicToken({ gatewayBaseUrl, apiKey: pennyKey, token });
+  await probeClaudeCodeGateway({ gatewayBaseUrl, apiKey: pennyKey });
+  await installPennyRuntime({ updatePath: !flags.noPathUpdate });
+  await configurePennyHarness("claude-code", {
+    apiKey: pennyKey,
+    gatewayBaseUrl,
+    subscriptionAuth: true,
+    models: CLAUDE_CODE_MODELS,
+  });
+  let record = existingRecord || {
+    harness: "claude-code",
+    config_path: compactHome((await claudeCodeHarness.planInstall()).configPath),
+    installed_at: new Date().toISOString(),
+    launch_available: true,
+    launch_config_path: compactHome(claudeLaunchSettingsPath()),
+    default_routing: ownsGlobalRouting,
+  };
+  if (ownsGlobalRouting) {
+    const plan = await claudeCodeHarness.planInstall();
+    record = {
+      ...record,
+      ...(await claudeCodeHarness.installStoredToken({
+        apiKey: pennyKey, gatewayBaseUrl, plan, existingRecord,
+      })),
+    };
+  }
+
+  upsertManifestRecord(manifest, {
+    ...record,
+    launch_available: true,
+    launch_config_path: compactHome(claudeLaunchSettingsPath()),
+    default_routing: ownsGlobalRouting,
+    anthropic_oauth: true,
+    anthropic_token_stored: true,
+    token_source: tokenResult.source,
+  });
+  await saveManifest(manifest);
+
+  console.log("Configured `penny claude` for PennyRouter + your Claude subscription.");
+  console.log("Your Claude token is stored encrypted; Claude Code holds only your PennyRouter key.");
+  console.log("If Claude auth expires, refresh the token source and run `pennyrouter auth anthropic` again.");
+  console.log(`Penny config: ${pennyConfigPath()}`);
+}
+
+function readAnthropicOAuthToken(flags = {}) {
+  if (flags.token) return { token: normalizeAnthropicToken(flags.token), source: "flag" };
+  if (flags.tokenCommand) {
+    const result = spawnSync(flags.tokenCommand, {
+      encoding: "utf8",
+      shell: true,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    if (result.status === 0) {
+      return { token: normalizeAnthropicToken(result.stdout), source: "token-command" };
+    }
+    return { token: "", source: "token-command" };
+  }
+  if (process.env.ANTHROPIC_AUTH_TOKEN) {
+    return { token: normalizeAnthropicToken(process.env.ANTHROPIC_AUTH_TOKEN), source: "env" };
+  }
+  const result = spawnSync("ant", ["auth", "print-credentials", "--access-token"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  if (result.status !== 0) return { token: "", source: "none" };
+  return { token: normalizeAnthropicToken(result.stdout), source: "ant" };
+}
+
+// ANSI/CSI escape sequences that `claude setup-token`'s TUI emits (colors, cursor
+// moves, bracketed-paste). We strip these before scanning the captured stream for the
+// token so a match isn't split by control bytes. Kept deliberately broad.
+// eslint-disable-next-line no-control-regex
+const ANSI_ESCAPE_RE = /\x1b\[[0-9;?]*[ -/]*[@-~]/g;
+// The token line printed by `claude setup-token`. Match any sk-ant-* token so we don't
+// depend on the exact variant/version (e.g. sk-ant-oat01-...).
+const ANTHROPIC_SETUP_TOKEN_RE = /sk-ant-[A-Za-z0-9_-]+/;
+
+// Run `claude setup-token` inline and extract the token it prints, WITHOUT echoing any
+// of the command's own output to the terminal. `claude setup-token` is a full-screen
+// Ink TUI: it redraws with carriage returns and cursor-move escapes (not newlines), so
+// its banner ("Welcome to Claude Code…"), spinner frames, the OAuth URL, the real token
+// ("sk-ant-oat01-…") and the "Store this / export" chrome all arrive interleaved with
+// no reliable line boundaries. There's no safe way to tee that stream line-by-line, and
+// none of it needs to reach the user: the browser auto-opens for approval, and the
+// token goes server-side (encrypted). So we fully suppress the child's output — we pipe
+// BOTH stdout and stderr only to capture them in memory for token extraction, and print
+// our own clean status lines around the call instead. The Ink TUI renders to stdout (the
+// token line arrives there — that's what we scan), but we also silence stderr so no
+// spinner/banner frame can leak from the other stream. Only stdin inherits the TTY, which
+// is all that's needed for the interactive approval handoff; the browser is opened by the
+// OS, not the terminal. After exit we ANSI-strip the captured output and regex out the
+// token. Returns "" on non-zero exit or if no token appeared, so the caller falls back to
+// manual paste.
+function runClaudeSetupToken() {
+  return new Promise((resolve) => {
+    let captured = "";
+    // On Windows, npm installs `claude` as a `claude.cmd` shim which Node's spawn will
+    // not resolve without a shell (it looks for a bare executable and throws ENOENT).
+    // Route through the shell there so the shim resolves; the args are fixed literals
+    // (no user input), so there's no shell-injection surface. POSIX spawns `claude`
+    // directly. Works from both PowerShell and cmd.exe host terminals since Node invokes
+    // cmd.exe itself for the shell.
+    const child = spawn("claude", ["setup-token"], {
+      // stdin keeps the TTY; stdout+stderr are piped (captured, never echoed).
+      stdio: ["inherit", "pipe", "pipe"],
+      shell: process.platform === "win32",
+    });
+
+    const capture = (chunk) => {
+      captured += chunk.toString("utf8"); // in-memory only — nothing is written to the terminal
+    };
+    child.stdout.on("data", capture);
+    child.stderr.on("data", capture);
+
+    child.on("error", () => resolve(""));
+    child.on("close", (code) => {
+      if (code !== 0) return resolve("");
+      const match = captured.replace(ANSI_ESCAPE_RE, "").match(ANTHROPIC_SETUP_TOKEN_RE);
+      resolve(match ? match[0] : "");
+    });
+  });
+}
+
+function normalizeAnthropicToken(value) {
+  let text = String(value || "").trim();
+  if (!text) return "";
+  text = text.replace(/^export\s+/, "");
+  const match = text.match(/^ANTHROPIC_AUTH_TOKEN=(.*)$/);
+  if (match) text = match[1].trim();
+  if ((text.startsWith('"') && text.endsWith('"')) || (text.startsWith("'") && text.endsWith("'"))) {
+    text = text.slice(1, -1);
+  }
+  return text.replace(/\s+/g, "").trim();
+}
+
+async function install(flags) {
+  if (flags.makeDefault && flags.pennyOnly) {
+    throw new Error("--make-default and --penny-only cannot be used together.");
+  }
+  const selected = await selectHarnesses(flags);
+  if (selected.length === 0) {
+    console.log("No supported harnesses selected.");
+    return;
+  }
+
+  console.log("PennyRouter install");
+  console.log("");
+
+  const manifest = await loadManifest();
+
+  if (flags.dryRun) {
+    const defaultRouting = await chooseDefaultRouting(flags, selected, manifest);
+    for (const harness of selected) {
+      const explicit = ["claude-code", "codex"].includes(harness.id);
+      const command = harness.id === "claude-code" ? "penny claude" : "penny codex";
+      console.log(`Will install on ${harness.name}${explicit ? ` via ${command}` : installNoteForHarness(harness.id)}.`);
+      if (defaultRouting.get(harness.id)) {
+        console.log(`Will also route bare ${harness.id === "claude-code" ? "claude" : harness.id} through PennyRouter.`);
+      }
+    }
+    if (flags.gatewayBaseUrl) console.log(`Serving gateway: ${flags.gatewayBaseUrl}`);
+    if (selected.some((harness) => harness.id === "claude-code")) {
+      console.log("Claude Code provider picker would be shown unless providers were supplied by flags or environment.");
+    }
+    console.log("Dry run only. No files changed.");
+    return;
+  }
+
+  const session = await createCliSession({
+    appUrl: flags.appUrl || APP_URL,
+    harnesses: selected.map((harness) => harness.id),
+    accountMode: "existing",
+  });
+
+  console.log("Opening your browser to log in and authorize this machine with your PennyRouter account...");
+  console.log(`If your browser did not open, visit:\n${session.authorize_url}`);
+  if (!flags.noBrowser) openBrowser(session.authorize_url);
+  console.log("");
+  console.log("Waiting for approval...");
+
+  const claim = await pollForKey(session);
+  console.log(`Authorized. Received key ${maskKey(claim.api_key)}.`);
+  console.log("");
+
+  const claudeProviders = await selectClaudeFundingProviders(flags, selected);
+  const codexProviders = await selectCodexFundingProviders(flags, selected);
+  const claudeAnthropicAuth = await maybeConfigureClaudeAnthropicAuth(
+    flags, selected, claudeProviders.has("subscription"));
+  const funding = await configureUserFunding(
+    flags, selected, claudeAnthropicAuth, claudeProviders, codexProviders);
+  const gatewayBaseUrl = flags.gatewayBaseUrl || claim.gateway_base_url;
+
+  for (const credential of funding.credentials) {
+    await storeUpstreamCredential({
+      gatewayBaseUrl,
+      apiKey: claim.api_key,
+      provider: credential.provider,
+      token: credential.token,
+    });
+  }
+
+  if (selected.some((harness) => harness.id === "claude-code")) {
+    console.log("Verifying modern Claude Code compatibility before changing local settings...");
+    await probeClaudeCodeGateway({ gatewayBaseUrl, apiKey: claim.api_key });
+    console.log("");
+  }
+
+  // Keep this as the final interactive choice: users first authorize their account,
+  // optionally connect their subscription, and pass compatibility checks. Then they
+  // choose the visible command behavior with all relevant context in front of them.
+  const defaultRouting = await chooseDefaultRouting(flags, selected, manifest);
+
+  const launchable = selected.filter((harness) => ["claude-code", "codex"].includes(harness.id));
+  let runtimeResult = null;
+  if (launchable.length > 0) {
+    runtimeResult = await installPennyRuntime({ updatePath: !flags.noPathUpdate });
+  }
+
+  const records = [];
+  const failures = [];
+  for (const harness of selected) {
+    await runHarnessJob(failures, harness.id, "install", async () => {
+      const plan = await harness.planInstall();
+      const existingRecord = (manifest.installations || []).find(
+        (candidate) => candidate.harness === harness.id,
+      );
+      const supportsPennyCommand = ["claude-code", "codex"].includes(harness.id);
+      const makeDefault = defaultRouting.get(harness.id) ?? true;
+      const hadGlobalRouting = Boolean(existingRecord && existingRecord.default_routing !== false);
+      if (["claude-code", "codex"].includes(harness.id) && (makeDefault || hadGlobalRouting)) {
+        assertNoRunningHarness(harness.id, flags);
+      }
+
+      const codexSubscriptionAuth = harness.id === "codex"
+        ? funding.codexSubscriptionAuth
+        : false;
+      const claudeSubscriptionAuth = harness.id === "claude-code"
+        && Boolean(claudeAnthropicAuth || existingRecord?.anthropic_token_stored);
+
+      if (supportsPennyCommand) {
+        await configurePennyHarness(harness.id, {
+          apiKey: claim.api_key,
+          gatewayBaseUrl,
+          subscriptionAuth: harness.id === "claude-code"
+            ? claudeSubscriptionAuth
+            : codexSubscriptionAuth,
+          models: harness.id === "claude-code" ? CLAUDE_CODE_MODELS : null,
+        });
+      }
+
+      let record;
+      if (!supportsPennyCommand || makeDefault) {
+        record = harness.id === "claude-code" && claudeSubscriptionAuth
+          ? await harness.installStoredToken({
+              apiKey: claim.api_key, gatewayBaseUrl, plan, existingRecord,
+            })
+          : await harness.install({
+              apiKey: claim.api_key, gatewayBaseUrl, plan, existingRecord,
+            });
+      } else {
+        if (hadGlobalRouting) {
+          await harness.uninstall(existingRecord);
+        }
+        record = {
+          harness: harness.id,
+          config_path: compactHome(plan.configPath),
+          backup_path: existingRecord?.backup_path || null,
+          installed_at: new Date().toISOString(),
+        };
+      }
+      if (supportsPennyCommand) {
+        record.launch_available = true;
+        record.launch_config_path = compactHome(
+          harness.id === "claude-code" ? claudeLaunchSettingsPath() : codexLaunchProfilePath(),
+        );
+        record.default_routing = Boolean(makeDefault);
+      }
+      if (harness.id === "claude-code" && claudeSubscriptionAuth) {
+        record.anthropic_oauth = true;
+        record.anthropic_token_stored = true;
+        record.token_source = claudeAnthropicAuth?.source || existingRecord?.token_source || "stored";
+      }
+      if (harness.id === "claude-code" && funding.claudeCredentialProvider) {
+        record.user_funded_provider = funding.claudeCredentialProvider;
+      }
+      if (harness.id === "codex" && funding.codexCredentialProvider) {
+        record.user_funded_provider = funding.codexCredentialProvider;
+      }
+      if (harness.id === "codex") record.openai_subscription_auth = codexSubscriptionAuth;
+      records.push(record);
+      upsertManifestRecord(manifest, record);
+      await saveManifest(manifest);
+    });
+  }
+
+  await saveManifest(manifest);
+  console.log("");
+  console.log(records.length > 0
+    ? "PennyRouter installation complete."
+    : "PennyRouter was not installed on any selected tool.");
+  console.log(`Manifest: ${statePath("installations.json")}`);
+  for (const record of records) {
+    const harness = HARNESS_BY_ID[record.harness];
+    if (record.launch_available) {
+      const command = record.harness === "claude-code" ? "penny claude" : "penny codex";
+      const native = record.harness === "claude-code" ? "claude" : "codex";
+      const harnessName = record.harness === "claude-code" ? "Claude Code" : "Codex";
+      const commandWidth = Math.max(command.length, native.length) + 2;
+      console.log("");
+      console.log(color(`How to Run ${harnessName}`, "bold"));
+      console.log("");
+      console.log(`  ${color(command.padEnd(commandWidth), "bold")}→ ${harnessName} with PennyRouter`);
+      console.log(`  ${color(native.padEnd(commandWidth), "bold")}→ ${record.default_routing ? `${harnessName} with PennyRouter (default routing enabled)` : `${harnessName} native`}`);
+    } else {
+      console.log(`Installed on ${harness?.name || record.harness}${installNoteForRecord(record)}.`);
+    }
+  }
+  if (runtimeResult && !runtimeResult.available) {
+    console.log("Add the PennyRouter launcher directory to PATH before using the `penny` command.");
+  } else if (runtimeResult?.changed) {
+    console.log("Open a new terminal (or reload your shell) before using the `penny` command.");
+  }
+  console.log("");
+  reportFailures(failures);
+}
+
+// Refresh the managed local files to this package version WITHOUT re-running any of the
+// account/credential flow. Everything an update needs is already on disk: the pr- key and
+// gateway URL live in the penny config (and, for older installs, in the harness config the
+// installer wrote), and the upstream provider tokens live server-side, encrypted against the
+// account. So no browser claim, no provider checkboxes, no token prompts — this command is
+// non-interactive by construction and never touches a credential.
+//
+// What it DOES rewrite is everything regenerated from code constants, which is exactly what
+// goes stale on a version bump: the copied runtime + `penny` shim, the /penny skill, the
+// Claude launch settings overlay, the Codex provider profile, and the model labels +
+// context-window env in the harness configs.
+//
+// Per-user choices are read back from the manifest, never re-asked: `default_routing` decides
+// whether the bare `claude`/`codex` command keeps pointing at the gateway, and
+// `anthropic_token_stored`/`openai_subscription_auth` decide which auth shape gets rewritten.
+// Re-deriving either from prompt defaults would silently flip a --penny-only user into
+// default routing, or drop subscription auth from a working install.
+async function update(flags) {
+  const manifest = await loadManifest();
+  if (pruneUnsupportedManifestRecords(manifest).length > 0) await saveManifest(manifest);
+  const records = manifest.installations || [];
+
+  const requested = parseHarnessList(flags.harness);
+  const targets = records.filter((record) => {
+    if (record.disabled) return false;
+    if (flags.all || requested.length === 0) return true;
+    return requested.includes(record.harness);
+  });
+
+  if (records.length === 0) {
+    throw new Error("No PennyRouter installation found. Run `npx pennyrouter install` first.");
+  }
+  if (targets.length === 0) {
+    console.log("No enabled PennyRouter installations matched. Nothing to update.");
+    return;
+  }
+
+  const launchConfig = await loadPennyConfig();
+  const globalAuth = await readClaudeCodeGatewayAuth();
+  const apiKey = flags.pennyKey || launchConfig.api_key || globalAuth.apiKey;
+  const gatewayBaseUrl = flags.gatewayBaseUrl
+    || launchConfig.gateway_base_url
+    || globalAuth.gatewayBaseUrl
+    || process.env.PENNYROUTER_GATEWAY_BASE_URL
+    || "https://api.pennyrouter.com";
+
+  if (!apiKey) {
+    throw new Error(
+      "Could not find your PennyRouter key in the local config. Pass `--penny-key pr-...`, "
+      + "or run `npx pennyrouter install` to re-authorize.",
+    );
+  }
+
+  console.log("PennyRouter update");
+  console.log("");
+  console.log(`Key ${maskKey(apiKey)} · gateway ${gatewayBaseUrl}`);
+  console.log("Subscription and API keys are left untouched.");
+  console.log("");
+
+  if (flags.dryRun) {
+    for (const record of targets) {
+      const routing = record.default_routing === false ? "penny command only" : "default routing";
+      console.log(`Will refresh ${record.harness} (${routing}).`);
+    }
+    console.log("Will refresh the penny runtime and shim.");
+    console.log("Dry run only. No files changed.");
+    return;
+  }
+
+  const failures = [];
+  let runtimeResult = null;
+  if (targets.some((record) => ["claude-code", "codex"].includes(record.harness))) {
+    runtimeResult = await installPennyRuntime({ updatePath: !flags.noPathUpdate });
+  }
+
+  for (const record of targets) {
+    const harness = HARNESS_BY_ID[record.harness];
+    if (!harness) continue;
+
+    await runHarnessJob(failures, record.harness, "update", async () => {
+      const supportsPennyCommand = ["claude-code", "codex"].includes(record.harness);
+      // An update rewrites the harness's own config only when that config is ours to
+      // rewrite — i.e. the bare command still routes through the gateway. In penny-only
+      // mode the harness config belongs to the user and we touch just the launch profile.
+      const ownsGlobalRouting = !record.launch_available || record.default_routing !== false;
+      if (ownsGlobalRouting) assertNoRunningHarness(record.harness, flags);
+
+      const claudeSubscriptionAuth = record.harness === "claude-code"
+        && Boolean(record.anthropic_token_stored);
+      const codexSubscriptionAuth = record.harness === "codex"
+        ? await detectCodexChatgptAuth()
+        : false;
+
+      if (supportsPennyCommand) {
+        await configurePennyHarness(record.harness, {
+          apiKey,
+          gatewayBaseUrl,
+          subscriptionAuth: record.harness === "claude-code"
+            ? claudeSubscriptionAuth
+            : codexSubscriptionAuth,
+          models: record.harness === "claude-code" ? CLAUDE_CODE_MODELS : null,
+        });
+      }
+
+      let next = record;
+      if (ownsGlobalRouting) {
+        const plan = await harness.planInstall();
+        // Pass the existing record through so install-time state the harness stashed
+        // (previous_model_provider, claude_ai_connectors_before) survives the rewrite
+        // and a later uninstall still restores the user's original values.
+        const installed = record.harness === "claude-code" && claudeSubscriptionAuth
+          ? await harness.installStoredToken({ apiKey, gatewayBaseUrl, plan, existingRecord: record })
+          : await harness.install({ apiKey, gatewayBaseUrl, plan, existingRecord: record });
+        next = { ...record, ...installed, installed_at: record.installed_at };
+      }
+
+      next.updated_at = new Date().toISOString();
+      if (record.harness === "codex") next.openai_subscription_auth = codexSubscriptionAuth;
+      upsertManifestRecord(manifest, next);
+      await saveManifest(manifest);
+      console.log(`Updated ${record.harness}.`);
+    });
+  }
+
+  await saveManifest(manifest);
+  console.log("");
+  if (runtimeResult && !runtimeResult.available) {
+    console.log("Add the PennyRouter launcher directory to PATH before using the `penny` command.");
+  } else if (runtimeResult?.changed) {
+    console.log("Open a new terminal (or reload your shell) before using the `penny` command.");
+  }
+  console.log("Restart any running Claude Code or Codex sessions to pick up the update.");
+  reportFailures(failures);
+}
+
+async function chooseDefaultRouting(flags, selected, manifest) {
+  const out = new Map();
+  const launchable = selected.filter((harness) => ["claude-code", "codex"].includes(harness.id));
+  let newInstallChoice = null;
+  for (const harness of launchable) {
+    if (flags.makeDefault) {
+      out.set(harness.id, true);
+      continue;
+    }
+    if (flags.pennyOnly) {
+      out.set(harness.id, false);
+      continue;
+    }
+    const existing = (manifest.installations || []).find((item) => item.harness === harness.id);
+    if (existing) {
+      const currentlyDefault = existing.default_routing !== false;
+      if (flags.dryRun || !currentlyDefault || flags.yes || !input.isTTY || !output.isTTY) {
+        out.set(harness.id, currentlyDefault);
+        continue;
+      }
+      const native = harness.id === "claude-code" ? "claude" : "codex";
+      const change = await confirm(
+        `PennyRouter currently runs when you type ${color(native, "bold")}. Change it to run only with ${color(`penny ${native}`, "bold")}?`,
+      );
+      out.set(harness.id, !change);
+      continue;
+    }
+    if (newInstallChoice === null) {
+      // Auto-load-by-default prompt is disabled for now — always install as `penny <native>`
+      // only. Flip ENABLE_AUTOLOAD_PROMPT to true to restore asking the user.
+      const ENABLE_AUTOLOAD_PROMPT = false;
+      if (!ENABLE_AUTOLOAD_PROMPT || flags.dryRun || flags.yes || !input.isTTY || !output.isTTY) {
+        newInstallChoice = false;
+      } else {
+        for (const item of launchable) {
+          const native = item.id === "claude-code" ? "claude" : "codex";
+          const harnessName = item.id === "claude-code" ? "Claude Code" : "Codex";
+          const command = `penny ${native}`;
+          const commandWidth = Math.max(command.length, native.length) + 2;
+          console.log("");
+          console.log(color(`How to Run ${harnessName}`, "bold"));
+          console.log("");
+          console.log(`  ${color(command.padEnd(commandWidth), "bold")}→ ${harnessName} with PennyRouter`);
+          console.log(`  ${color(native.padEnd(commandWidth), "bold")}→ ${harnessName} native (recommended)`);
+        }
+        console.log("");
+        const bare = launchable.map((item) => item.id === "claude-code" ? "claude" : "codex");
+        const quoted = bare.map((command) => `'${command}'`);
+        const label = quoted.length === 1
+          ? quoted[0]
+          : `${quoted.slice(0, -1).join(", ")} and ${quoted.at(-1)}`;
+        newInstallChoice = await confirm(
+          `Set ${label} to automatically load PennyRouter with every session?`,
+        );
+      }
+    }
+    out.set(harness.id, newInstallChoice);
+  }
+  return out;
+}
+
+async function selectClaudeFundingProviders(flags, selected) {
+  if (!selected.some((harness) => harness.id === "claude-code")) return new Set();
+
+  const supplied = new Set();
+  if (!flags.noAnthropicAuth && (flags.anthropicAuth || flags.token || flags.tokenCommand
+      || process.env.ANTHROPIC_AUTH_TOKEN)) supplied.add("subscription");
+  if (flags.anthropicApiKey || process.env.ANTHROPIC_API_KEY) supplied.add("anthropic-api");
+  if (flags.openrouterApiKey || process.env.OPENROUTER_API_KEY) supplied.add("openrouter");
+
+  // Explicit flags are the automation selector. Interactive installs always default to the
+  // subscription alone; environment keys are used if the user checks their provider.
+  const explicit = flags.anthropicAuth || flags.noAnthropicAuth || flags.token
+    || flags.tokenCommand || flags.anthropicApiKey || flags.openrouterApiKey;
+  if (explicit || flags.yes || !input.isTTY || !output.isTTY) return supplied;
+
+  console.log("PennyRouter can use your Claude subscription, an Anthropic API key, or an OpenRouter API key to run Claude Code.");
+  console.log("Choose one or more providers. PennyRouter will try them in order when available.");
+  return promptFundingProviderCheckboxes(
+    CLAUDE_PROVIDER_OPTIONS,
+    "Which providers should PennyRouter use for Claude Code?",
+    new Set(["subscription"]),
+  );
+}
+
+async function selectCodexFundingProviders(flags, selected) {
+  if (!selected.some((harness) => harness.id === "codex")) return new Set();
+
+  const supplied = new Set();
+  if (flags.openaiApiKey || process.env.OPENAI_API_KEY) supplied.add("openai-api");
+  if (flags.openrouterApiKey || process.env.OPENROUTER_API_KEY) supplied.add("openrouter");
+  const hasChatgptLogin = await detectCodexChatgptAuth();
+  if (hasChatgptLogin) supplied.add("subscription");
+
+  const explicit = flags.openaiApiKey || flags.openrouterApiKey;
+  if (explicit || flags.yes || !input.isTTY || !output.isTTY) return supplied;
+
+  console.log("PennyRouter can use your ChatGPT subscription, an OpenAI API key, or an OpenRouter API key to run Codex.");
+  console.log("Choose one or more providers. PennyRouter will try them in order when available.");
+  return promptFundingProviderCheckboxes(
+    CODEX_PROVIDER_OPTIONS,
+    "Which providers should PennyRouter use for Codex?",
+    new Set(["subscription"]),
+  );
+}
+
+async function maybeConfigureClaudeAnthropicAuth(flags, selected, enabled = true) {
+  if (!selected.some((harness) => harness.id === "claude-code")) return null;
+  if (!enabled || flags.noAnthropicAuth) return null;
+
+  if (flags.token || flags.tokenCommand || process.env.ANTHROPIC_AUTH_TOKEN) {
+    const tokenResult = readAnthropicOAuthToken(flags);
+    if (tokenResult.token) return tokenResult;
+  }
+
+  if (flags.yes || !input.isTTY || !output.isTTY) {
+    if (flags.anthropicAuth) {
+      throw new Error(
+        "Claude subscription auth was requested, but no Anthropic bearer token was found. Pass --token, --token-command, or ANTHROPIC_AUTH_TOKEN.",
+      );
+    }
+    return null;
+  }
+
+  const tokenResult = readAnthropicOAuthToken({ tokenCommand: flags.tokenCommand });
+  if (tokenResult.token) return tokenResult;
+
+  console.log("");
+  if (commandExists("claude")) {
+    // The user already opted into subscription auth above, so run `claude setup-token`
+    // directly and capture the token — no copy-paste, no second confirm. The command
+    // opens the browser for approval inline. On failure we fall through to manual paste.
+    console.log("Launching Claude sign-in — approve in your browser…");
+    const captured = await runClaudeSetupToken();
+    if (captured) {
+      console.log("✓ Claude subscription auth enabled.");
+      console.log("");
+      return { token: captured, source: "setup-token" };
+    }
+    console.log("");
+    console.log("Couldn't capture a token automatically. Paste it below, or leave blank to skip.");
+  } else {
+    console.log("Claude Code was not found on PATH. Paste an Anthropic bearer token, or leave blank to skip.");
+  }
+  const token = normalizeAnthropicToken(await promptSecretish("Anthropic token (blank to skip): "));
+  if (!token) {
+    console.log("Skipped Claude subscription auth. Enable later with `@penny auth` or `pennyrouter auth anthropic`.");
+    console.log("");
+    return null;
+  }
+  console.log("");
+  return { token, source: "prompt" };
+}
+
+async function configureUserFunding(flags, selected, claudeAnthropicAuth,
+                                    claudeProviders = new Set(), codexProviders = new Set()) {
+  const wantsClaude = selected.some((harness) => harness.id === "claude-code");
+  const wantsCodex = selected.some((harness) => harness.id === "codex");
+  const interactive = !flags.yes && input.isTTY && output.isTTY;
+  const credentials = [];
+
+  let anthropicApiKey = String(
+    flags.anthropicApiKey || process.env.ANTHROPIC_API_KEY || "",
+  ).trim();
+  let openaiApiKey = String(
+    flags.openaiApiKey || process.env.OPENAI_API_KEY || "",
+  ).trim();
+  let openrouterApiKey = String(
+    flags.openrouterApiKey || process.env.OPENROUTER_API_KEY || "",
+  ).trim();
+  const codexSubscriptionAuth = wantsCodex && codexProviders.has("subscription")
+    ? await detectCodexChatgptAuth()
+    : false;
+
+  if (wantsClaude && claudeProviders.has("anthropic-api") && !anthropicApiKey) {
+    if (!interactive) throw new Error("Anthropic API was selected, but no key was provided.");
+    anthropicApiKey = (await promptSecretish("Anthropic API key: ")).trim();
+  }
+  if (wantsClaude && claudeProviders.has("openrouter") && !openrouterApiKey) {
+    if (!interactive) throw new Error("OpenRouter was selected, but no key was provided.");
+    openrouterApiKey = (await promptSecretish("OpenRouter API key: ")).trim();
+  }
+  if (wantsCodex && codexProviders.has("subscription") && !codexSubscriptionAuth) {
+    throw new Error(
+      "ChatGPT subscription was selected, but Codex is not logged in. Run `codex login`, or select an API-key provider.",
+    );
+  }
+  if (wantsCodex && codexProviders.has("openai-api") && !openaiApiKey) {
+    if (!interactive) throw new Error("OpenAI API was selected, but no key was provided.");
+    openaiApiKey = (await promptSecretish("OpenAI API key: ")).trim();
+  }
+  if (wantsCodex && codexProviders.has("openrouter") && !openrouterApiKey) {
+    if (!interactive) throw new Error("OpenRouter was selected, but no key was provided.");
+    openrouterApiKey = (await promptSecretish("OpenRouter API key: ")).trim();
+  }
+
+  if (wantsClaude && !claudeAnthropicAuth && !anthropicApiKey && !openrouterApiKey) {
+    if (!interactive) {
+      throw new Error(
+        "Claude Code requires a Claude subscription, --anthropic-api-key (or ANTHROPIC_API_KEY), "
+        + "or --openrouter-api-key (or OPENROUTER_API_KEY). Nothing was installed.",
+      );
+    }
+    console.log("Claude Code needs a user-funded provider. PennyRouter will never fall back to its own API keys.");
+    anthropicApiKey = (await promptSecretish(
+      "Anthropic API key (leave blank to use OpenRouter): ",
+    )).trim();
+    if (!anthropicApiKey) {
+      openrouterApiKey = (await promptSecretish("OpenRouter API key: ")).trim();
+    }
+    if (!anthropicApiKey && !openrouterApiKey) {
+      throw new Error("Claude Code installation cancelled: no subscription or API key was provided.");
+    }
+    console.log("");
+  }
+
+  if (wantsCodex && !codexSubscriptionAuth && !openaiApiKey && !openrouterApiKey) {
+    if (!interactive) {
+      throw new Error(
+        "Codex requires ChatGPT login, --openai-api-key (or OPENAI_API_KEY), "
+        + "or --openrouter-api-key (or OPENROUTER_API_KEY). Nothing was installed.",
+      );
+    }
+    console.log("Codex is not logged into ChatGPT and needs a user-funded provider.");
+    console.log("PennyRouter will never fall back to its own API keys.");
+    openaiApiKey = (await promptSecretish(
+      "OpenAI API key (leave blank to use OpenRouter): ",
+    )).trim();
+    if (!openaiApiKey) {
+      openrouterApiKey = (await promptSecretish("OpenRouter API key: ")).trim();
+    }
+    if (!openaiApiKey && !openrouterApiKey) {
+      throw new Error("Codex installation cancelled: no subscription or API key was provided.");
+    }
+    console.log("");
+  }
+
+  if (claudeAnthropicAuth) {
+    credentials.push({ provider: "anthropic_oauth", token: claudeAnthropicAuth.token });
+  }
+  if (wantsClaude && anthropicApiKey) {
+    credentials.push({ provider: "anthropic_api", token: anthropicApiKey });
+  }
+  if (wantsCodex && openaiApiKey) {
+    credentials.push({ provider: "openai_api", token: openaiApiKey });
+  }
+  if ((wantsClaude || wantsCodex) && openrouterApiKey) {
+    credentials.push({ provider: "openrouter", token: openrouterApiKey });
+  }
+
+  return {
+    credentials,
+    codexSubscriptionAuth,
+    claudeCredentialProvider: claudeAnthropicAuth
+      ? "claude-subscription"
+      : anthropicApiKey ? "anthropic-api" : openrouterApiKey ? "openrouter" : null,
+    codexCredentialProvider: codexSubscriptionAuth
+      ? "chatgpt-subscription"
+      : openaiApiKey ? "openai-api" : openrouterApiKey ? "openrouter" : null,
+  };
+}
+
+async function disable(flags) {
+  const manifest = await loadManifest();
+  if (pruneUnsupportedManifestRecords(manifest).length > 0) await saveManifest(manifest);
+  const records = manifest.installations || [];
+  const { selectedIds, selectedRecords } = await resolveLifecycleTargets(flags, records);
+
+  if (selectedRecords.length === 0) {
+    console.log("No matching PennyRouter installations found.");
+    return;
+  }
+
+  console.log("PennyRouter disable");
+  console.log("");
+  for (const record of selectedRecords) {
+    console.log(`  - ${record.harness}: ${record.config_path || "manual setup"}`);
+  }
+  console.log("");
+
+  if (!flags.yes) {
+    const ok = await confirm("Temporarily turn off these PennyRouter local integrations?");
+    if (!ok) return;
+  }
+
+  const failures = [];
+  for (const record of selectedRecords) {
+    if (record.disabled) {
+      console.log(`${record.harness} is already disabled.`);
+      continue;
+    }
+
+    const harness = HARNESS_BY_ID[record.harness];
+    if (!harness) {
+      console.log(`Skipping ${record.harness}: this CLI no longer knows how to disable it.`);
+      continue;
+    }
+
+    await runHarnessJob(failures, record.harness, "disable", async () => {
+      const ownsGlobalRouting = !record.launch_available || record.default_routing;
+      if (record.config_path && ownsGlobalRouting) {
+        const snapshotPath = await backupFile(record.config_path, `${record.harness}-disabled`);
+        record.disabled_snapshot_path = snapshotPath;
+      }
+
+      if (record.launch_available) await setPennyHarnessEnabled(record.harness, false);
+      if (ownsGlobalRouting) {
+        if (typeof harness.disable === "function") await harness.disable(record);
+        else await harness.uninstall(record);
+      }
+
+      record.disabled = true;
+      record.disabled_at = new Date().toISOString();
+      upsertManifestRecord(manifest, record);
+      await saveManifest(manifest);
+      console.log(`Disabled ${record.harness}.`);
+    });
+  }
+
+  await saveManifest(manifest);
+  reportFailures(failures);
+}
+
+async function enable(flags) {
+  const manifest = await loadManifest();
+  if (pruneUnsupportedManifestRecords(manifest).length > 0) await saveManifest(manifest);
+  const records = manifest.installations || [];
+  const selectedIds = resolveRequestedHarnessIds(flags, records.map((record) => record.harness));
+  const selectedRecords = records.filter((record) => selectedIds.includes(record.harness));
+
+  if (selectedRecords.length === 0) {
+    console.log("No matching PennyRouter installations found.");
+    return;
+  }
+
+  console.log("PennyRouter enable");
+  console.log("");
+  for (const record of selectedRecords) {
+    console.log(`  - ${record.harness}: ${record.config_path || "manual setup"}`);
+  }
+  console.log("");
+
+  if (!flags.yes) {
+    const ok = await confirm("Turn these PennyRouter local integrations back on?");
+    if (!ok) return;
+  }
+
+  const failures = [];
+  for (const record of selectedRecords) {
+    if (!record.disabled) {
+      console.log(`${record.harness} is already enabled.`);
+      continue;
+    }
+
+    const harness = HARNESS_BY_ID[record.harness];
+    if (!harness) {
+      console.log(`Skipping ${record.harness}: this CLI no longer knows how to enable it.`);
+      continue;
+    }
+
+    await runHarnessJob(failures, record.harness, "enable", async () => {
+      const ownsGlobalRouting = !record.launch_available || record.default_routing;
+      if (record.launch_available) await setPennyHarnessEnabled(record.harness, true);
+      if (ownsGlobalRouting) {
+        if (typeof harness.enable === "function") await harness.enable(record);
+        else if (record.config_path && record.disabled_snapshot_path) {
+          await restoreFile(record.disabled_snapshot_path, record.config_path);
+        } else if (record.manual_required) {
+          console.log(`${record.harness}: re-enable manually in the tool UI using the status details.`);
+        } else {
+          throw new Error("no disabled snapshot found; run install again");
+        }
+      }
+
+      delete record.disabled;
+      delete record.disabled_at;
+      upsertManifestRecord(manifest, record);
+      await saveManifest(manifest);
+      console.log(`Enabled ${record.harness}.`);
+    });
+  }
+
+  await saveManifest(manifest);
+  reportFailures(failures);
+}
+
+async function uninstall(flags) {
+  const manifest = await loadManifest();
+  if (pruneUnsupportedManifestRecords(manifest).length > 0) await saveManifest(manifest);
+  const records = manifest.installations || [];
+  const { selectedIds, selectedRecords } = await resolveLifecycleTargets(flags, records);
+
+  if (selectedRecords.length === 0) {
+    console.log("No matching PennyRouter installations found.");
+    return;
+  }
+
+  console.log("PennyRouter uninstall");
+  console.log("");
+  for (const record of selectedRecords) {
+    console.log(`  - ${record.harness}: ${record.config_path}`);
+  }
+  console.log("");
+
+  if (!flags.yes) {
+    const ok = await confirm("Remove these PennyRouter local integrations?");
+    if (!ok) return;
+  }
+
+  const kept = [];
+  const failures = [];
+  let anthropicTokenNotice = false;
+  for (const record of records) {
+    if (!selectedIds.includes(record.harness)) {
+      kept.push(record);
+      continue;
+    }
+
+    const harness = HARNESS_BY_ID[record.harness];
+    if (!harness) {
+      console.log(`Skipping ${record.harness}: this CLI no longer knows how to uninstall it.`);
+      kept.push(record);
+      continue;
+    }
+
+    const ok = await runHarnessJob(failures, record.harness, "uninstall", async () => {
+      if (flags.forgetToken) {
+        await forgetStoredAnthropicToken(record);
+      } else if (record.anthropic_token_stored) {
+        anthropicTokenNotice = true;
+      }
+      if (record.launch_available) await removePennyHarness(record.harness);
+      if (!record.launch_available || record.default_routing) await harness.uninstall(record);
+      console.log(`Removed ${record.harness}.`);
+    });
+    if (!ok) kept.push(record);
+  }
+
+  for (const record of selectedRecords) {
+    if (records.some((existing) => existing.harness === record.harness)) continue;
+    const harness = HARNESS_BY_ID[record.harness];
+    if (!harness) {
+      console.log(`Skipping ${record.harness}: this CLI does not know how to uninstall it.`);
+      continue;
+    }
+    await runHarnessJob(failures, record.harness, "uninstall", async () => {
+      if (flags.forgetToken) {
+        await forgetStoredAnthropicToken(record);
+      } else if (record.anthropic_token_stored) {
+        anthropicTokenNotice = true;
+      }
+      if (record.launch_available) await removePennyHarness(record.harness);
+      if (!record.launch_available || record.default_routing) await harness.uninstall(record);
+      console.log(`Removed ${record.harness}.`);
+    });
+  }
+
+  if (anthropicTokenNotice) {
+    console.log("");
+    console.log("Note: Your stored Anthropic token remains on the server for other machines.");
+    console.log("To delete it from the server, run: pennyrouter auth anthropic --forget");
+  }
+
+  manifest.installations = kept;
+  await saveManifest(manifest);
+  if (!(await hasConfiguredPennyHarnesses())) await removePennyRuntime();
+  reportFailures(failures);
+}
+
+async function resolveLifecycleTargets(flags, records) {
+  const requested = parseHarnessList(flags.harness);
+  const ids = flags.all
+    ? Object.keys(HARNESS_BY_ID)
+    : requested.length > 0
+      ? requested
+      : records.length > 0
+        ? records.map((record) => record.harness)
+        : await detectHarnessIds();
+
+  const selectedIds = [...new Set(ids)];
+  const selectedRecords = records.filter((record) => selectedIds.includes(record.harness));
+  const manifestIds = new Set(selectedRecords.map((record) => record.harness));
+
+  for (const id of selectedIds) {
+    if (manifestIds.has(id)) continue;
+    const harness = HARNESS_BY_ID[id];
+    if (!harness) continue;
+    if (!(await safeDetect(harness))) continue;
+    let plan;
+    try {
+      plan = await harness.planInstall();
+    } catch (error) {
+      console.log(`Skipping ${id}: ${formatError(error)}`);
+      continue;
+    }
+    selectedRecords.push({
+      harness: id,
+      config_path: plan.configPath ? compactHome(plan.configPath) : null,
+      backup_path: null,
+      installed_at: null,
+      recovered_from_detected_config: true,
+    });
+  }
+
+  return { selectedIds, selectedRecords };
+}
+
+async function detectHarnessIds() {
+  const ids = [];
+  for (const harness of Object.values(HARNESS_BY_ID)) {
+    if (await safeDetect(harness)) ids.push(harness.id);
+  }
+  return ids;
+}
+
+async function status() {
+  const manifest = await loadManifest();
+  const pruned = pruneUnsupportedManifestRecords(manifest);
+  if (pruned.length > 0) await saveManifest(manifest);
+  const records = manifest.installations || [];
+  console.log("PennyRouter local setup");
+  console.log("");
+
+  if (records.length === 0) {
+    console.log("No local PennyRouter integrations recorded.");
+    return;
+  }
+
+  for (const record of records) {
+    const state = record.disabled ? "disabled" : record.manual_required ? "manual setup shown" : "installed";
+    console.log(`${record.harness}: ${state}`);
+    if (record.config_path) console.log(`  config: ${record.config_path}`);
+    if (record.backup_path) console.log(`  backup: ${record.backup_path}`);
+    if (record.disabled_snapshot_path) console.log(`  disabled snapshot: ${record.disabled_snapshot_path}`);
+    if (record.installed_at) console.log(`  installed: ${record.installed_at}`);
+    if (record.disabled_at) console.log(`  disabled: ${record.disabled_at}`);
+    if (record.anthropic_oauth) console.log(`  Claude subscription auth: enabled (${record.token_source || "unknown"} token)`);
+    if (record.openai_subscription_auth) console.log("  OpenAI subscription auth: enabled (Codex-managed login)");
+    if (record.launch_available) {
+      const command = record.harness === "claude-code" ? "penny claude" : "penny codex";
+      console.log(`  command: ${command}`);
+      console.log(`  bare command: ${record.default_routing ? "PennyRouter" : "native"}`);
+    }
+    if (record.manual_required) console.log("  note: finish or remove this integration in the tool UI");
+  }
+}
+
+async function selectHarnesses(flags) {
+  const requested = flags.all ? Object.keys(HARNESS_BY_ID) : parseHarnessList(flags.harness);
+  if (requested.length > 0) {
+    return requested.map((id) => HARNESS_BY_ID[id]).filter(Boolean);
+  }
+
+  const detected = [];
+  for (const id of DEFAULT_INSTALL_HARNESS_IDS) {
+    const harness = HARNESS_BY_ID[id];
+    if (await safeDetect(harness)) detected.push(harness);
+  }
+
+  if (flags.yes) return detected;
+
+  return promptHarnessCheckboxes(detected);
+}
+
+async function promptHarnessCheckboxes(detected) {
+  const detectedIds = new Set(detected.map((harness) => harness.id));
+  const selectedIds = new Set(detectedIds);
+  const harnesses = orderedHarnessesForPrompt(detectedIds);
+  if (!input.isTTY || !output.isTTY) return promptHarnessCheckboxesByText(harnesses, selectedIds);
+
+  return promptHarnessCheckboxesByKeys(harnesses, selectedIds);
+}
+
+async function promptHarnessCheckboxesByKeys(harnesses, selectedIds) {
+  let cursor = 0;
+  const previousRawMode = input.isRaw;
+
+  emitKeypressEvents(input);
+  input.setRawMode(true);
+  input.resume();
+  output.write("\x1b[?25l");
+
+  const render = () => {
+    output.write("\x1b[2J\x1b[H");
+    output.write("\n\n");
+    output.write(`${color("Where should PennyRouter be installed?", "bold")}\n\n\n`);
+    harnesses.forEach((harness, index) => {
+      const pointer = index === cursor ? color(">", "cyan") : " ";
+      const checked = selectedIds.has(harness.id) ? color("x", "green") : " ";
+      const name = index === cursor ? color(harness.name, "cyan") : harness.name;
+      output.write(` ${pointer} [${checked}] ${name}\n`);
+    });
+    output.write("\nEnter to continue.\n");
+  };
+
+  render();
+
+  return new Promise((resolve, reject) => {
+    const cleanup = () => {
+      input.off("keypress", onKeypress);
+      input.setRawMode(Boolean(previousRawMode));
+      input.pause();
+      output.write("\x1b[?25h");
+      output.write("\n");
+    };
+
+    const onKeypress = (_str, key = {}) => {
+      if (key.ctrl && key.name === "c") {
+        cleanup();
+        reject(new Error("Cancelled."));
+        return;
+      }
+
+      if (key.name === "up" || key.name === "k") {
+        cursor = (cursor - 1 + harnesses.length) % harnesses.length;
+        render();
+        return;
+      }
+
+      if (key.name === "down" || key.name === "j") {
+        cursor = (cursor + 1) % harnesses.length;
+        render();
+        return;
+      }
+
+      if (key.name === "space") {
+        const id = harnesses[cursor].id;
+        if (selectedIds.has(id)) selectedIds.delete(id);
+        else selectedIds.add(id);
+        render();
+        return;
+      }
+
+      if (key.name === "return" || key.name === "enter") {
+        cleanup();
+        resolve(harnesses.filter((harness) => selectedIds.has(harness.id)));
+      }
+    };
+
+    input.on("keypress", onKeypress);
+  });
+}
+
+async function promptHarnessCheckboxesByText(harnesses, selectedIds) {
+  const rl = createInterface({ input, output });
+
+  try {
+    while (true) {
+      console.log("");
+      console.log("");
+      console.log(color("Where should PennyRouter be installed?", "bold"));
+      for (const harness of harnesses) {
+        const checked = selectedIds.has(harness.id) ? color("x", "green") : " ";
+        console.log(`  [${checked}] ${harness.name}`);
+      }
+      console.log("");
+      const answer = await rl.question(
+        "Press Enter to continue, or type names to toggle (comma-separated, 'all', or 'none'): ",
+      );
+      const value = answer.trim().toLowerCase();
+      if (!value) return harnesses.filter((harness) => selectedIds.has(harness.id));
+      if (value === "all") {
+        for (const harness of harnesses) selectedIds.add(harness.id);
+      } else if (value === "none") {
+        selectedIds.clear();
+      } else {
+        for (const token of parseHarnessList(value)) {
+          const id = resolveHarnessToken(token);
+          if (!HARNESS_BY_ID[id]) {
+            console.log(`Unknown tool "${token}".`);
+            continue;
+          }
+          if (selectedIds.has(id)) selectedIds.delete(id);
+          else selectedIds.add(id);
+        }
+      }
+      console.log("");
+    }
+  } finally {
+    rl.close();
+  }
+}
+
+async function promptFundingProviderCheckboxes(providerOptions, title,
+                                                initialIds = new Set(["subscription"])) {
+  const selectedIds = new Set(initialIds);
+  if (!input.isTTY || !output.isTTY) return selectedIds;
+
+  let cursor = 0;
+  let validation = "";
+  const previousRawMode = input.isRaw;
+  emitKeypressEvents(input);
+  input.setRawMode(true);
+  input.resume();
+  output.write("\x1b[?25l");
+
+  const render = () => {
+    output.write("\x1b[2J\x1b[H");
+    output.write("\n\n");
+    output.write(`${color(title, "bold")}\n\n`);
+    providerOptions.forEach((provider, index) => {
+      const pointer = index === cursor ? color(">", "cyan") : " ";
+      const checked = selectedIds.has(provider.id) ? color("x", "green") : " ";
+      const name = index === cursor ? color(provider.name, "cyan") : provider.name;
+      output.write(` ${pointer} [${checked}] ${name}\n`);
+    });
+    output.write("\nSpace to toggle · Enter to continue.\n");
+    if (validation) output.write(`${validation}\n`);
+  };
+  render();
+
+  return new Promise((resolve, reject) => {
+    const cleanup = () => {
+      input.off("keypress", onKeypress);
+      input.setRawMode(Boolean(previousRawMode));
+      input.pause();
+      output.write("\x1b[?25h\n");
+    };
+    const onKeypress = (_str, key = {}) => {
+      if (key.ctrl && key.name === "c") {
+        cleanup();
+        reject(new Error("Cancelled."));
+      } else if (key.name === "up" || key.name === "k") {
+        cursor = (cursor - 1 + providerOptions.length) % providerOptions.length;
+        validation = "";
+        render();
+      } else if (key.name === "down" || key.name === "j") {
+        cursor = (cursor + 1) % providerOptions.length;
+        validation = "";
+        render();
+      } else if (key.name === "space") {
+        const id = providerOptions[cursor].id;
+        if (selectedIds.has(id)) selectedIds.delete(id); else selectedIds.add(id);
+        validation = "";
+        render();
+      } else if (key.name === "return" || key.name === "enter") {
+        if (!selectedIds.size) {
+          validation = "Select at least one provider.";
+          render();
+          return;
+        }
+        cleanup();
+        resolve(selectedIds);
+      }
+    };
+    input.on("keypress", onKeypress);
+  });
+}
+
+function orderedHarnessesForPrompt(detectedIds) {
+  return DEFAULT_INSTALL_HARNESS_IDS.map((id) => HARNESS_BY_ID[id]).sort((left, right) => {
+    const leftDetected = detectedIds.has(left.id);
+    const rightDetected = detectedIds.has(right.id);
+    if (leftDetected !== rightDetected) return leftDetected ? -1 : 1;
+    return left.name.localeCompare(right.name);
+  });
+}
+
+function resolveHarnessToken(token) {
+  const normalized = normalizeHarnessToken(token);
+  for (const harness of Object.values(HARNESS_BY_ID)) {
+    if (normalizeHarnessToken(harness.id) === normalized) return harness.id;
+    if (normalizeHarnessToken(harness.name) === normalized) return harness.id;
+  }
+  return token;
+}
+
+function normalizeHarnessToken(value) {
+  return String(value).toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+
+function color(text, style) {
+  if (!output.isTTY || process.env.NO_COLOR) return text;
+  const codes = {
+    bold: ["\x1b[1m", "\x1b[22m"],
+    cyan: ["\x1b[36m", "\x1b[39m"],
+    green: ["\x1b[32m", "\x1b[39m"],
+  };
+  const pair = codes[style];
+  return pair ? `${pair[0]}${text}${pair[1]}` : text;
+}
+
+function parseHarnessList(value = "") {
+  return value
+    .split(",")
+    .map((part) => part.trim())
+    .filter(Boolean);
+}
+
+function resolveRequestedHarnessIds(flags, defaults) {
+  if (flags.all) return defaults;
+  const requested = parseHarnessList(flags.harness);
+  return requested.length > 0 ? requested : defaults;
+}
+
+function upsertManifestRecord(manifest, record) {
+  manifest.installations ||= [];
+  manifest.installations = manifest.installations.filter((existing) => existing.harness !== record.harness);
+  manifest.installations.push(record);
+}
+
+function pruneUnsupportedManifestRecords(manifest) {
+  manifest.installations ||= [];
+  const kept = manifest.installations.filter((record) => HARNESS_BY_ID[record.harness]);
+  const pruned = manifest.installations.filter((record) => !HARNESS_BY_ID[record.harness]);
+  manifest.installations = kept;
+  return pruned;
+}
+
+async function safeDetect(harness) {
+  try {
+    return await harness.detect();
+  } catch (error) {
+    console.log(`Skipping ${harness.id}: detect failed: ${formatError(error)}`);
+    return false;
+  }
+}
+
+async function runHarnessJob(failures, harnessId, action, job) {
+  try {
+    await job();
+    return true;
+  } catch (error) {
+    failures.push({ harness: harnessId, action, error });
+    console.error(`${harnessId} ${action} failed: ${formatError(error)}`);
+    return false;
+  }
+}
+
+function reportFailures(failures) {
+  if (failures.length === 0) return;
+  console.error("");
+  console.error("Some PennyRouter integrations failed:");
+  for (const failure of failures) {
+    console.error(`  - ${failure.harness} ${failure.action}: ${formatError(failure.error)}`);
+  }
+  process.exitCode = 1;
+}
+
+function formatError(error) {
+  return error?.message || String(error);
+}
+
+// Best-effort: tell the gateway to forget a stored Claude token when uninstalling a
+// claude-code integration that stored one. Reads the gateway URL + pr- key from the
+// live config BEFORE harness.uninstall strips them. Never throws — a local uninstall
+// must not be blocked by a network hiccup; the record is going away regardless.
+async function forgetStoredAnthropicToken(record) {
+  if (record.harness !== "claude-code" || !record.anthropic_token_stored) return;
+  try {
+    const launchConfig = await loadPennyConfig();
+    const globalAuth = await readClaudeCodeGatewayAuth();
+    const gatewayBaseUrl = launchConfig.gateway_base_url || globalAuth.gatewayBaseUrl;
+    const apiKey = launchConfig.api_key || globalAuth.apiKey;
+    if (!gatewayBaseUrl || !apiKey) return;
+    await forgetAnthropicToken({ gatewayBaseUrl, apiKey });
+  } catch {
+    // swallow — see note above
+  }
+}
+
+async function confirm(question) {
+  const rl = createInterface({ input, output });
+  const answer = await rl.question(`${question} [y/N] `);
+  rl.close();
+  return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
+}
+
+async function promptSecretish(question) {
+  if (!input.isTTY || !output.isTTY) {
+    const rl = createInterface({ input, output });
+    const answer = await rl.question(question);
+    rl.close();
+    return answer.trim();
+  }
+
+  const previousRawMode = input.isRaw;
+  emitKeypressEvents(input);
+  input.setRawMode(true);
+  input.resume();
+  output.write(question);
+
+  return new Promise((resolve, reject) => {
+    let value = "";
+    const cleanup = () => {
+      input.off("keypress", onKeypress);
+      input.setRawMode(Boolean(previousRawMode));
+      input.pause();
+      output.write("\n");
+    };
+    const onKeypress = (str, key = {}) => {
+      if (key.ctrl && key.name === "c") {
+        cleanup();
+        reject(new Error("Cancelled."));
+        return;
+      }
+      if (key.name === "return" || key.name === "enter") {
+        cleanup();
+        resolve(value.trim());
+        return;
+      }
+      if (key.name === "backspace") {
+        value = value.slice(0, -1);
+        return;
+      }
+      if (str) value += str;
+    };
+    input.on("keypress", onKeypress);
+  });
+}
+
+function commandExists(command) {
+  // Windows installs CLIs as `.cmd`/`.ps1` shims that Node won't resolve without a
+  // shell, so probe through the shell there (else this false-negatives on `claude` and
+  // the auto setup-token path gets skipped). `command` is an internal literal.
+  const result = spawnSync(command, ["--version"], {
+    stdio: "ignore",
+    shell: process.platform === "win32",
+  });
+  return result.status === 0;
+}
+
+function installNoteForRecord(record) {
+  if (record.manual_required) return " (manual setup shown)";
+  if (record.anthropic_oauth) return " (Claude subscription auth)";
+  return installNoteForHarness(record.harness);
+}
+
+function installNoteForHarness(harnessId) {
+  if (harnessId === "cline" || harnessId === "codegpt") return " (manual setup)";
+  if (harnessId === "opencode") return " (select a Penny model from /model)";
+  return " (auto-selected)";
+}
+
+function openBrowser(url) {
+  const platform = process.platform;
+  const command =
+    platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+  spawnSync(command, args, { stdio: "ignore", detached: true });
+}
+
+function runningClaudeCodeProcesses() {
+  if (process.platform === "win32") {
+    const result = spawnSync("tasklist", ["/FO", "CSV", "/NH"], { encoding: "utf8" });
+    if (result.status !== 0) return [];
+    return String(result.stdout || "").split(/\r?\n/)
+      .filter((line) => /^"claude(?:\.exe)?"/i.test(line.trim()));
+  }
+  const result = spawnSync("ps", ["-ax", "-o", "pid=,command="], { encoding: "utf8" });
+  if (result.status !== 0) return [];
+  return String(result.stdout || "").split(/\r?\n/)
+    .map((line) => line.trim())
+    // Case-sensitive on purpose: match the Claude Code executable, not Claude.app.
+    .filter((line) => /(^|[\/\s])claude(?:\s|$)/.test(line));
+}
+
+function runningCodexProcesses() {
+  if (process.platform === "win32") return [];
+  const result = spawnSync("ps", ["-ax", "-o", "pid=,command="], { encoding: "utf8" });
+  if (result.status !== 0) return [];
+  return String(result.stdout || "").split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter((line) => /(^|[\/\s])codex(?:\s|$)/.test(line));
+}
+
+function assertNoRunningHarness(harnessId, flags) {
+  if (flags.allowRunningHarnesses || (harnessId === "claude-code" && flags.allowRunningClaude)) {
+    return;
+  }
+  const running = harnessId === "claude-code"
+    ? runningClaudeCodeProcesses()
+    : runningCodexProcesses();
+  if (running.length === 0) return;
+  const name = harnessId === "claude-code" ? "Claude Code" : "Codex";
+  throw new Error(
+    `${name} is currently running. Close all ${name} sessions before changing its global routing. `
+    + "Installing only the explicit `penny` command does not require this. If you intentionally "
+    + "accept the risk, pass --allow-running-harnesses.\nDetected:\n  "
+    + running.slice(0, 5).join("\n  "),
+  );
+}
+
+function printHelp() {
+  console.log(`PennyRouter CLI
+
+Usage:
+  pennyrouter install [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes] [--dry-run] [--make-default|--penny-only] [--no-path-update] [--anthropic-auth|--no-anthropic-auth] [--anthropic-api-key KEY] [--openai-api-key KEY] [--openrouter-api-key KEY] [--local[=URL]] [--allow-running-harnesses]
+  pennyrouter update [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--dry-run] [--penny-key pr-...] [--gateway-base-url URL] [--allow-running-harnesses]
+  pennyrouter auth anthropic [--penny-key pr-...] [--token oauth-token] [--token-command CMD] [--gateway-base-url URL] [--forget]
+  pennyrouter disable [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes]
+  pennyrouter enable [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes]
+  pennyrouter uninstall [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes] [--forget-token]
+  pennyrouter status
+
+Update refreshes the managed local config and the penny runtime to this package version.
+It reuses your existing key and never re-asks for subscription or API credentials.
+
+Examples:
+  npx pennyrouter update
+  npx pennyrouter update --dry-run
+  npx pennyrouter update --harness claude-code
+  npx pennyrouter install
+  npx pennyrouter install --make-default
+  npx pennyrouter install --penny-only
+  npx pennyrouter install --harness claude-code --anthropic-auth --token <token>
+  npx pennyrouter install --harness claude-code --anthropic-api-key <key>
+  npx pennyrouter install --harness codex --openai-api-key <key>
+  npx pennyrouter install --openrouter-api-key <key>
+  npx pennyrouter auth anthropic
+  npx pennyrouter install --all
+  npx pennyrouter install --harness windsurf,zed,codegpt,aider --yes
+  npx pennyrouter disable
+  npx pennyrouter enable
+  npx pennyrouter uninstall
+`);
+}