pennyrouter 0.2.9 → 0.2.11

package/src/harnesses/claude-code.js

@@ -1,318 +1,346 @@
-import { atomicWrite, backupFile, compactHome, exists, expandHome, readJsonFile } from "../state.js";
-import { configureClaudeCodeStatusline, restoreClaudeCodeStatusline } from "../statusline.js";
-
-const CONFIG_PATH = "~/.claude/settings.json";
-const LEGACY_MODEL_LABEL = "PennyRouter Bundle";
-const CONNECTOR_SETTING = "disableClaudeAiConnectors";
-// Values written into Claude Code's four model slots. CC displays a slot's VALUE verbatim in
-// its /model menu AND sends it as the request `model`, so each value is both the menu label
-// and the gateway's routing key. The three concrete Claude slots carry friendly PINNED labels
-// ("Opus 5/Sonnet 5/Haiku 4.5/Fable 5 (PennyRouter)") that the gateway maps to that exact
-// model — the user's pick runs on the model they chose, no dynamic tier switching on the
-// trunk (background/utility calls still route cheap, which is where the savings come from).
-// Named "<Model> (PennyRouter)" rather than "Penny <Model>" so CC's own generated "Custom ...
-// model" subtext still reads as a real Claude model routed through Penny, not a distinct
-// custom model. The separate Fable slot is pinned to Fable; the DYNAMIC "Penny Custom" option
-// lets PennyRouter cost-route. Legacy "Penny Speed/Core/Power/Opus/Sonnet/Haiku/Fable"
-// installs (dynamic bundles, or the pre-rename pinned labels) are still recognized for
-// uninstall (see isPennyRouterModelValue).
-export const CLAUDE_CODE_MODELS = {
-  haiku: "Haiku 4.5 (PennyRouter)",   // -> pinned anthropic/claude-haiku-4-5-20251001
-  sonnet: "Sonnet 5 (PennyRouter)",   // -> pinned anthropic/claude-sonnet-5
-  opus: "Opus 5 (PennyRouter)",       // -> pinned anthropic/claude-opus-5
-  fable: "Fable 5 (PennyRouter)",     // -> pinned anthropic/claude-fable-5
-  custom: "Penny Custom",             // -> dynamic (PennyRouter cost-routing)
-};
-// Retired dynamic-bundle labels (pre-pinned-trunk) and the pre-rename pinned labels. Not
-// written by a fresh install; matched only so uninstall/detect still recognize and clean up
-// an older install.
-const LEGACY_PENNY_LABELS = [
-  "Penny Speed", "Penny Core", "Penny Power",
-  "Penny Opus", "Penny Sonnet", "Penny Haiku", "Penny Fable",
-];
-
-export const claudeCodeHarness = {
-  id: "claude-code",
-  name: "Claude Code",
-
-  async detect() {
-    return exists(CONFIG_PATH);
-  },
-
-  async planInstall() {
-    return {
-      configPath: expandHome(CONFIG_PATH),
-      summary: [
-        `write ${CONFIG_PATH}`,
-        "set Anthropic-compatible base URL to PennyRouter",
-        "store the PennyRouter API key without printing it",
-        "map Claude Code models to Penny model choices",
-      ],
-    };
-  },
-
-  async install({ apiKey, gatewayBaseUrl, plan, existingRecord }) {
-    const backupPath = await backupFile(CONFIG_PATH, "claude-code");
-    const current = (await readJsonFile(CONFIG_PATH, null)) || {};
-    const claudeAiConnectorsBefore = disableClaudeAiConnectors(current, existingRecord);
-    current.env ||= {};
-    current.env.ANTHROPIC_BASE_URL = gatewayBaseUrl;
-    // Custom base URL: Claude Code authenticates with the auth token, not an
-    // Anthropic API key. Clear any stale key so it doesn't take precedence.
-    current.env.ANTHROPIC_AUTH_TOKEN = apiKey;
-    delete current.env.ANTHROPIC_API_KEY;
-    // Claude Code displays these env values directly in its model picker; the
-    // gateway decodes the friendly labels into bundle/profile overrides.
-    current.env.ANTHROPIC_DEFAULT_OPUS_MODEL = CLAUDE_CODE_MODELS.opus;
-    current.env.ANTHROPIC_DEFAULT_SONNET_MODEL = CLAUDE_CODE_MODELS.sonnet;
-    current.env.ANTHROPIC_DEFAULT_HAIKU_MODEL = CLAUDE_CODE_MODELS.haiku;
-    current.env.ANTHROPIC_DEFAULT_FABLE_MODEL = CLAUDE_CODE_MODELS.fable;
-    // The pinned labels above aren't real Anthropic model ids, so CC can't infer their
-    // context window from the name and falls back to a conservative 200K default. Tell it
-    // directly: every pinned slot is a Claude model with the 1M-context beta enabled upstream.
-    current.env.CLAUDE_CODE_MAX_CONTEXT_TOKENS = "1000000";
-
-    const statusline = await configureClaudeCodeStatusline(current);
-
-    await atomicWrite(CONFIG_PATH, `${JSON.stringify(current, null, 2)}\n`);
-
-    return {
-      harness: "claude-code",
-      config_path: compactHome(plan.configPath),
-      backup_path: backupPath ? compactHome(backupPath) : null,
-      installed_at: new Date().toISOString(),
-      restart: "restart Claude Code",
-      statusline: statusline.wrapped ? "wrapped-existing" : "installed",
-      claude_ai_connectors_before: claudeAiConnectorsBefore,
-      changes: {
-        settings_keys: [CONNECTOR_SETTING],
-        env_keys: [
-          "ANTHROPIC_BASE_URL",
-          "ANTHROPIC_AUTH_TOKEN",
-          "ANTHROPIC_DEFAULT_OPUS_MODEL",
-          "ANTHROPIC_DEFAULT_SONNET_MODEL",
-          "ANTHROPIC_DEFAULT_HAIKU_MODEL",
-          "ANTHROPIC_DEFAULT_FABLE_MODEL",
-          "CLAUDE_CODE_MAX_CONTEXT_TOKENS",
-        ],
-      },
-    };
-  },
-
-  // Stored-token mode: the Anthropic setup-token was already POSTed to the gateway
-  // and encrypted against the account (see cli.js storeAnthropicToken). Claude Code's
-  // config therefore carries only the pr- bearer + base URL, not the Anthropic token.
-  // The gateway pulls the stored token per request. This avoids putting the Anthropic
-  // credential on disk and avoids a dual-credential configuration.
-  async installStoredToken({ apiKey, gatewayBaseUrl, plan, existingRecord }) {
-    const backupPath = await backupFile(CONFIG_PATH, "claude-code");
-    const current = (await readJsonFile(CONFIG_PATH, null)) || {};
-    const claudeAiConnectorsBefore = disableClaudeAiConnectors(current, existingRecord);
-    current.env ||= {};
-    current.env.ANTHROPIC_BASE_URL = gatewayBaseUrl;
-    current.env.ANTHROPIC_AUTH_TOKEN = apiKey;
-    // Single credential only: no stale api key, no separate Anthropic bearer.
-    delete current.env.ANTHROPIC_API_KEY;
-    current.env.ANTHROPIC_DEFAULT_OPUS_MODEL = CLAUDE_CODE_MODELS.opus;
-    current.env.ANTHROPIC_DEFAULT_SONNET_MODEL = CLAUDE_CODE_MODELS.sonnet;
-    current.env.ANTHROPIC_DEFAULT_HAIKU_MODEL = CLAUDE_CODE_MODELS.haiku;
-    current.env.ANTHROPIC_DEFAULT_FABLE_MODEL = CLAUDE_CODE_MODELS.fable;
-    // The pinned labels above aren't real Anthropic model ids, so CC can't infer their
-    // context window from the name and falls back to a conservative 200K default. Tell it
-    // directly: every pinned slot is a Claude model with the 1M-context beta enabled upstream.
-    current.env.CLAUDE_CODE_MAX_CONTEXT_TOKENS = "1000000";
-
-    const statusline = await configureClaudeCodeStatusline(current);
-
-    await atomicWrite(CONFIG_PATH, `${JSON.stringify(current, null, 2)}\n`);
-
-    return {
-      harness: "claude-code",
-      config_path: compactHome(plan.configPath),
-      backup_path: backupPath ? compactHome(backupPath) : null,
-      installed_at: new Date().toISOString(),
-      restart: "restart Claude Code",
-      statusline: statusline.wrapped ? "wrapped-existing" : "installed",
-      claude_ai_connectors_before: claudeAiConnectorsBefore,
-      changes: {
-        settings_keys: [CONNECTOR_SETTING],
-        env_keys: [
-          "ANTHROPIC_BASE_URL",
-          "ANTHROPIC_AUTH_TOKEN",
-          "ANTHROPIC_DEFAULT_OPUS_MODEL",
-          "ANTHROPIC_DEFAULT_SONNET_MODEL",
-          "ANTHROPIC_DEFAULT_HAIKU_MODEL",
-          "ANTHROPIC_DEFAULT_FABLE_MODEL",
-          "CLAUDE_CODE_MAX_CONTEXT_TOKENS",
-        ],
-      },
-    };
-  },
-
-  async installAnthropicOAuth({ pennyKey, anthropicAuthToken, gatewayBaseUrl, existingRecord }) {
-    const backupPath = await backupFile(CONFIG_PATH, "claude-code-anthropic-auth");
-    const current = (await readJsonFile(CONFIG_PATH, null)) || {};
-    const claudeAiConnectorsBefore = disableClaudeAiConnectors(current, existingRecord);
-    current.env ||= {};
-    current.env.ANTHROPIC_BASE_URL = gatewayBaseUrl;
-    // Dual-auth mode: x-api-key authenticates the local user to PennyRouter; the
-    // Authorization bearer token is forwarded by the gateway to Anthropic.
-    current.env.ANTHROPIC_API_KEY = pennyKey;
-    current.env.ANTHROPIC_AUTH_TOKEN = anthropicAuthToken;
-    current.env.ANTHROPIC_DEFAULT_OPUS_MODEL = CLAUDE_CODE_MODELS.opus;
-    current.env.ANTHROPIC_DEFAULT_SONNET_MODEL = CLAUDE_CODE_MODELS.sonnet;
-    current.env.ANTHROPIC_DEFAULT_HAIKU_MODEL = CLAUDE_CODE_MODELS.haiku;
-    current.env.ANTHROPIC_DEFAULT_FABLE_MODEL = CLAUDE_CODE_MODELS.fable;
-    // The pinned labels above aren't real Anthropic model ids, so CC can't infer their
-    // context window from the name and falls back to a conservative 200K default. Tell it
-    // directly: every pinned slot is a Claude model with the 1M-context beta enabled upstream.
-    current.env.CLAUDE_CODE_MAX_CONTEXT_TOKENS = "1000000";
-
-    const statusline = await configureClaudeCodeStatusline(current);
-
-    await atomicWrite(CONFIG_PATH, `${JSON.stringify(current, null, 2)}\n`);
-    return {
-      harness: "claude-code",
-      config_path: compactHome(expandHome(CONFIG_PATH)),
-      backup_path: backupPath ? compactHome(backupPath) : null,
-      installed_at: new Date().toISOString(),
-      restart: "restart Claude Code",
-      statusline: statusline.wrapped ? "wrapped-existing" : "installed",
-      claude_ai_connectors_before: claudeAiConnectorsBefore,
-      changes: {
-        settings_keys: [CONNECTOR_SETTING],
-        env_keys: [
-          "ANTHROPIC_BASE_URL",
-          "ANTHROPIC_API_KEY",
-          "ANTHROPIC_AUTH_TOKEN",
-          "ANTHROPIC_DEFAULT_OPUS_MODEL",
-          "ANTHROPIC_DEFAULT_SONNET_MODEL",
-          "ANTHROPIC_DEFAULT_HAIKU_MODEL",
-          "ANTHROPIC_DEFAULT_FABLE_MODEL",
-          "CLAUDE_CODE_MAX_CONTEXT_TOKENS",
-        ],
-      },
-    };
-  },
-
-  async uninstall(record) {
-    const current = (await readJsonFile(record.config_path, null)) || {};
-    if (hasPennyRouterEnv(current.env)) {
-      // If the base URL points at PennyRouter, every auth value in env was written
-      // by us for our gateway (a Penny pr- key and/or an Anthropic OAuth bearer we
-      // forward upstream) — clear them all. We can't rely on the token's prefix:
-      // in OAuth mode ANTHROPIC_AUTH_TOKEN holds an Anthropic sk-ant-oat... token,
-      // not a pr- value, and the manifest's anthropic_oauth flag may be absent on a
-      // record synthesized from a detected config. Keying off our base URL is what
-      // makes cleanup reliable regardless of which auth mode was installed.
-      const ourGateway = isPennyRouterBaseUrl(current.env.ANTHROPIC_BASE_URL);
-      delete current.env.ANTHROPIC_BASE_URL;
-      const tok = current.env.ANTHROPIC_AUTH_TOKEN;
-      if (typeof tok === "string" && (ourGateway || tok.startsWith("pr-") || record.anthropic_oauth)) {
-        delete current.env.ANTHROPIC_AUTH_TOKEN;
-      }
-      // ANTHROPIC_API_KEY carries the Penny key in OAuth dual-auth mode, or a pr-
-      // key in legacy installs. Clear it when it's ours by base URL or by prefix.
-      if (typeof current.env.ANTHROPIC_API_KEY === "string" && (ourGateway || current.env.ANTHROPIC_API_KEY.startsWith("pr-"))) {
-        delete current.env.ANTHROPIC_API_KEY;
-      }
-      for (const k of [
-        "ANTHROPIC_DEFAULT_OPUS_MODEL",
-        "ANTHROPIC_DEFAULT_SONNET_MODEL",
-        "ANTHROPIC_DEFAULT_HAIKU_MODEL",
-        "ANTHROPIC_DEFAULT_FABLE_MODEL",
-      ]) {
-        if (current.env[k] === LEGACY_MODEL_LABEL || isPennyRouterModelValue(current.env[k])) delete current.env[k];
-      }
-      delete current.env.CLAUDE_CODE_MAX_CONTEXT_TOKENS;
-    }
-    restoreClaudeAiConnectors(current, record);
-    if (current["anthropic.baseURL"] && isPennyRouterValue(current["anthropic.baseURL"])) {
-      delete current["anthropic.baseURL"];
-    }
-    if (typeof current["anthropic.apiKey"] === "string" && current["anthropic.apiKey"].startsWith("pr-")) {
-      delete current["anthropic.apiKey"];
-    }
-    if (current.env && Object.keys(current.env).length === 0) delete current.env;
-    // Statusline: restore the user's original command if we wrapped one, else remove ours.
-    await restoreClaudeCodeStatusline(current);
-    await atomicWrite(record.config_path, `${JSON.stringify(current, null, 2)}\n`);
-  },
-};
-
-export function disableClaudeAiConnectors(settings, existingRecord = null) {
-  const saved = existingRecord?.claude_ai_connectors_before;
-  const before = saved && typeof saved.present === "boolean"
-    ? { ...saved }
-    : Object.prototype.hasOwnProperty.call(settings, CONNECTOR_SETTING)
-      ? { present: true, value: settings[CONNECTOR_SETTING] }
-      : { present: false };
-  settings[CONNECTOR_SETTING] = true;
-  return before;
-}
-
-export function restoreClaudeAiConnectors(settings, record) {
-  const before = record?.claude_ai_connectors_before;
-  if (!before || typeof before.present !== "boolean") return;
-  // Respect a user edit made after installation. We only undo the value we manage.
-  if (settings[CONNECTOR_SETTING] !== true) return;
-  if (before.present) settings[CONNECTOR_SETTING] = before.value;
-  else delete settings[CONNECTOR_SETTING];
-}
-
-function hasPennyRouterEnv(env) {
-  if (!env || typeof env !== "object") return false;
-  return (
-    isPennyRouterBaseUrl(env.ANTHROPIC_BASE_URL) ||
-    isPennyRouterValue(env.ANTHROPIC_AUTH_TOKEN) ||
-    isPennyRouterValue(env.ANTHROPIC_API_KEY) ||
-    env.ANTHROPIC_DEFAULT_OPUS_MODEL === LEGACY_MODEL_LABEL ||
-    env.ANTHROPIC_DEFAULT_SONNET_MODEL === LEGACY_MODEL_LABEL ||
-    env.ANTHROPIC_DEFAULT_HAIKU_MODEL === LEGACY_MODEL_LABEL ||
-    env.ANTHROPIC_DEFAULT_FABLE_MODEL === LEGACY_MODEL_LABEL ||
-    isPennyRouterModelValue(env.ANTHROPIC_DEFAULT_OPUS_MODEL) ||
-    isPennyRouterModelValue(env.ANTHROPIC_DEFAULT_SONNET_MODEL) ||
-    isPennyRouterModelValue(env.ANTHROPIC_DEFAULT_HAIKU_MODEL) ||
-    isPennyRouterModelValue(env.ANTHROPIC_DEFAULT_FABLE_MODEL)
-  );
-}
-
-function isPennyRouterValue(value) {
-  return typeof value === "string" && (value.startsWith("pr-") || value.includes("pennyrouter"));
-}
-
-function isPennyRouterBaseUrl(value) {
-  return typeof value === "string" && value.includes("pennyrouter");
-}
-
-function isPennyRouterModelValue(value) {
-  return (
-    isPennyRouterValue(value) ||
-    value === CLAUDE_CODE_MODELS.haiku ||
-    value === CLAUDE_CODE_MODELS.sonnet ||
-    value === CLAUDE_CODE_MODELS.opus ||
-    value === CLAUDE_CODE_MODELS.fable ||
-    value === CLAUDE_CODE_MODELS.custom ||
-    LEGACY_PENNY_LABELS.includes(value)
-  );
-}
-
-export async function readClaudeCodePennyRouterKey() {
-  const current = (await readJsonFile(CONFIG_PATH, null)) || {};
-  const env = current.env || {};
-  for (const value of [env.ANTHROPIC_API_KEY, env.ANTHROPIC_AUTH_TOKEN, current["anthropic.apiKey"]]) {
-    if (typeof value === "string" && value.startsWith("pr-")) return value;
-  }
-  return null;
-}
-
-// The PennyRouter gateway URL + pr- key currently in Claude Code's config, used to
-// call the gateway's "forget my Claude token" endpoint on uninstall. Read before
-// uninstall strips these keys. Either field may be null if not present.
-export async function readClaudeCodeGatewayAuth() {
-  const current = (await readJsonFile(CONFIG_PATH, null)) || {};
-  const env = current.env || {};
-  const gatewayBaseUrl = isPennyRouterBaseUrl(env.ANTHROPIC_BASE_URL) ? env.ANTHROPIC_BASE_URL : null;
-  const apiKey = await readClaudeCodePennyRouterKey();
-  return { gatewayBaseUrl, apiKey };
-}
+import { atomicWrite, backupFile, compactHome, exists, expandHome, readJsonFile } from "../state.js";
+import { configureClaudeCodeStatusline, restoreClaudeCodeStatusline } from "../statusline.js";
+
+const CONFIG_PATH = "~/.claude/settings.json";
+const LEGACY_MODEL_LABEL = "PennyRouter Bundle";
+const CONNECTOR_SETTING = "disableClaudeAiConnectors";
+// The slot values remain genuine Anthropic ids so Claude Code recognizes their actual context
+// windows (Haiku 200K; the 1M-capable models 1M) and sends the native id on the wire. Claude
+// Code separately supports *_MODEL_NAME and *_MODEL_DESCRIPTION for the picker, so Penny can
+// present a friendly alias without sacrificing model recognition.
+export const CLAUDE_CODE_MODELS = {
+  haiku: "claude-haiku-4-5-20251001",
+  sonnet: "claude-sonnet-5",
+  opus: "claude-opus-5",
+  fable: "claude-fable-5",
+  custom: "Penny Custom",             // -> dynamic (PennyRouter cost-routing)
+};
+const CLAUDE_CODE_MODEL_PRESENTATION = {
+  haiku: { name: "Haiku 4.5 (PennyRouter)", description: "Fast, economical Claude model · 200K context" },
+  sonnet: { name: "Sonnet 5 (PennyRouter)", description: "Balanced Claude model · 1M context" },
+  opus: { name: "Opus 5 (PennyRouter)", description: "Most capable Claude model · 1M context" },
+  fable: { name: "Fable 5 (PennyRouter)", description: "Claude model · 1M context" },
+};
+const LEGACY_PINNED_MODEL_IDS = {
+  "Haiku 4.5 (PennyRouter)": CLAUDE_CODE_MODELS.haiku,
+  "Sonnet 5 (PennyRouter)": CLAUDE_CODE_MODELS.sonnet,
+  "Opus 5 (PennyRouter)": CLAUDE_CODE_MODELS.opus,
+  "Fable 5 (PennyRouter)": CLAUDE_CODE_MODELS.fable,
+};
+const LEGACY_PINNED_MODEL_LABELS = Object.keys(LEGACY_PINNED_MODEL_IDS);
+// Retired dynamic-bundle labels (pre-pinned-trunk) and the pre-rename pinned labels. Not
+// written by a fresh install; matched only so uninstall/detect still recognize and clean up
+// an older install.
+const LEGACY_PENNY_LABELS = [
+  "Penny Speed", "Penny Core", "Penny Power",
+  "Penny Opus", "Penny Sonnet", "Penny Haiku", "Penny Fable",
+];
+
+function writeClaudeCodeModelPresentation(env) {
+  for (const [slot, { name, description }] of Object.entries(CLAUDE_CODE_MODEL_PRESENTATION)) {
+    const prefix = `ANTHROPIC_DEFAULT_${slot.toUpperCase()}_MODEL`;
+    env[`${prefix}_NAME`] = name;
+    env[`${prefix}_DESCRIPTION`] = description;
+  }
+}
+
+const CLAUDE_CODE_MODEL_PRESENTATION_KEYS = Object.keys(CLAUDE_CODE_MODEL_PRESENTATION)
+  .flatMap((slot) => {
+    const prefix = `ANTHROPIC_DEFAULT_${slot.toUpperCase()}_MODEL`;
+    return [`${prefix}_NAME`, `${prefix}_DESCRIPTION`];
+  });
+
+export const claudeCodeHarness = {
+  id: "claude-code",
+  name: "Claude Code",
+
+  async detect() {
+    return exists(CONFIG_PATH);
+  },
+
+  async planInstall() {
+    return {
+      configPath: expandHome(CONFIG_PATH),
+      summary: [
+        `write ${CONFIG_PATH}`,
+        "set Anthropic-compatible base URL to PennyRouter",
+        "store the PennyRouter API key without printing it",
+        "map Claude Code models to Penny model choices",
+      ],
+    };
+  },
+
+  async install({ apiKey, gatewayBaseUrl, plan, existingRecord }) {
+    const backupPath = await backupFile(CONFIG_PATH, "claude-code");
+    const current = (await readJsonFile(CONFIG_PATH, null)) || {};
+    const claudeAiConnectorsBefore = disableClaudeAiConnectors(current, existingRecord);
+    current.env ||= {};
+    current.env.ANTHROPIC_BASE_URL = gatewayBaseUrl;
+    // Custom base URL: Claude Code authenticates with the auth token, not an
+    // Anthropic API key. Clear any stale key so it doesn't take precedence.
+    current.env.ANTHROPIC_AUTH_TOKEN = apiKey;
+    delete current.env.ANTHROPIC_API_KEY;
+    // Claude Code displays these env values directly in its model picker; the
+    // gateway decodes the friendly labels into bundle/profile overrides.
+    current.env.ANTHROPIC_DEFAULT_OPUS_MODEL = CLAUDE_CODE_MODELS.opus;
+    current.env.ANTHROPIC_DEFAULT_SONNET_MODEL = CLAUDE_CODE_MODELS.sonnet;
+    current.env.ANTHROPIC_DEFAULT_HAIKU_MODEL = CLAUDE_CODE_MODELS.haiku;
+    current.env.ANTHROPIC_DEFAULT_FABLE_MODEL = CLAUDE_CODE_MODELS.fable;
+    writeClaudeCodeModelPresentation(current.env);
+    // This is global, not per-model. Leave it unset so Claude Code uses each native id's
+    // real context limit instead of incorrectly giving Haiku a 1M window.
+    delete current.env.CLAUDE_CODE_MAX_CONTEXT_TOKENS;
+
+    const statusline = await configureClaudeCodeStatusline(current);
+
+    await atomicWrite(CONFIG_PATH, `${JSON.stringify(current, null, 2)}\n`);
+
+    return {
+      harness: "claude-code",
+      config_path: compactHome(plan.configPath),
+      backup_path: backupPath ? compactHome(backupPath) : null,
+      installed_at: new Date().toISOString(),
+      restart: "restart Claude Code",
+      statusline: statusline.wrapped ? "wrapped-existing" : "installed",
+      claude_ai_connectors_before: claudeAiConnectorsBefore,
+      changes: {
+        settings_keys: [CONNECTOR_SETTING],
+        env_keys: [
+          "ANTHROPIC_BASE_URL",
+          "ANTHROPIC_AUTH_TOKEN",
+          "ANTHROPIC_DEFAULT_OPUS_MODEL",
+          "ANTHROPIC_DEFAULT_SONNET_MODEL",
+          "ANTHROPIC_DEFAULT_HAIKU_MODEL",
+          "ANTHROPIC_DEFAULT_FABLE_MODEL",
+          ...CLAUDE_CODE_MODEL_PRESENTATION_KEYS,
+        ],
+      },
+    };
+  },
+
+  // Stored-token mode: the Anthropic setup-token was already POSTed to the gateway
+  // and encrypted against the account (see cli.js storeAnthropicToken). Claude Code's
+  // config therefore carries only the pr- bearer + base URL, not the Anthropic token.
+  // The gateway pulls the stored token per request. This avoids putting the Anthropic
+  // credential on disk and avoids a dual-credential configuration.
+  async installStoredToken({ apiKey, gatewayBaseUrl, plan, existingRecord }) {
+    const backupPath = await backupFile(CONFIG_PATH, "claude-code");
+    const current = (await readJsonFile(CONFIG_PATH, null)) || {};
+    const claudeAiConnectorsBefore = disableClaudeAiConnectors(current, existingRecord);
+    current.env ||= {};
+    current.env.ANTHROPIC_BASE_URL = gatewayBaseUrl;
+    current.env.ANTHROPIC_AUTH_TOKEN = apiKey;
+    // Single credential only: no stale api key, no separate Anthropic bearer.
+    delete current.env.ANTHROPIC_API_KEY;
+    current.env.ANTHROPIC_DEFAULT_OPUS_MODEL = CLAUDE_CODE_MODELS.opus;
+    current.env.ANTHROPIC_DEFAULT_SONNET_MODEL = CLAUDE_CODE_MODELS.sonnet;
+    current.env.ANTHROPIC_DEFAULT_HAIKU_MODEL = CLAUDE_CODE_MODELS.haiku;
+    current.env.ANTHROPIC_DEFAULT_FABLE_MODEL = CLAUDE_CODE_MODELS.fable;
+    writeClaudeCodeModelPresentation(current.env);
+    // This is global, not per-model. Leave it unset so Claude Code uses each native id's
+    // real context limit instead of incorrectly giving Haiku a 1M window.
+    delete current.env.CLAUDE_CODE_MAX_CONTEXT_TOKENS;
+
+    const statusline = await configureClaudeCodeStatusline(current);
+
+    await atomicWrite(CONFIG_PATH, `${JSON.stringify(current, null, 2)}\n`);
+
+    return {
+      harness: "claude-code",
+      config_path: compactHome(plan.configPath),
+      backup_path: backupPath ? compactHome(backupPath) : null,
+      installed_at: new Date().toISOString(),
+      restart: "restart Claude Code",
+      statusline: statusline.wrapped ? "wrapped-existing" : "installed",
+      claude_ai_connectors_before: claudeAiConnectorsBefore,
+      changes: {
+        settings_keys: [CONNECTOR_SETTING],
+        env_keys: [
+          "ANTHROPIC_BASE_URL",
+          "ANTHROPIC_AUTH_TOKEN",
+          "ANTHROPIC_DEFAULT_OPUS_MODEL",
+          "ANTHROPIC_DEFAULT_SONNET_MODEL",
+          "ANTHROPIC_DEFAULT_HAIKU_MODEL",
+          "ANTHROPIC_DEFAULT_FABLE_MODEL",
+          ...CLAUDE_CODE_MODEL_PRESENTATION_KEYS,
+        ],
+      },
+    };
+  },
+
+  async installAnthropicOAuth({ pennyKey, anthropicAuthToken, gatewayBaseUrl, existingRecord }) {
+    const backupPath = await backupFile(CONFIG_PATH, "claude-code-anthropic-auth");
+    const current = (await readJsonFile(CONFIG_PATH, null)) || {};
+    const claudeAiConnectorsBefore = disableClaudeAiConnectors(current, existingRecord);
+    current.env ||= {};
+    current.env.ANTHROPIC_BASE_URL = gatewayBaseUrl;
+    // Dual-auth mode: x-api-key authenticates the local user to PennyRouter; the
+    // Authorization bearer token is forwarded by the gateway to Anthropic.
+    current.env.ANTHROPIC_API_KEY = pennyKey;
+    current.env.ANTHROPIC_AUTH_TOKEN = anthropicAuthToken;
+    current.env.ANTHROPIC_DEFAULT_OPUS_MODEL = CLAUDE_CODE_MODELS.opus;
+    current.env.ANTHROPIC_DEFAULT_SONNET_MODEL = CLAUDE_CODE_MODELS.sonnet;
+    current.env.ANTHROPIC_DEFAULT_HAIKU_MODEL = CLAUDE_CODE_MODELS.haiku;
+    current.env.ANTHROPIC_DEFAULT_FABLE_MODEL = CLAUDE_CODE_MODELS.fable;
+    writeClaudeCodeModelPresentation(current.env);
+    // This is global, not per-model. Leave it unset so Claude Code uses each native id's
+    // real context limit instead of incorrectly giving Haiku a 1M window.
+    delete current.env.CLAUDE_CODE_MAX_CONTEXT_TOKENS;
+
+    const statusline = await configureClaudeCodeStatusline(current);
+
+    await atomicWrite(CONFIG_PATH, `${JSON.stringify(current, null, 2)}\n`);
+    return {
+      harness: "claude-code",
+      config_path: compactHome(expandHome(CONFIG_PATH)),
+      backup_path: backupPath ? compactHome(backupPath) : null,
+      installed_at: new Date().toISOString(),
+      restart: "restart Claude Code",
+      statusline: statusline.wrapped ? "wrapped-existing" : "installed",
+      claude_ai_connectors_before: claudeAiConnectorsBefore,
+      changes: {
+        settings_keys: [CONNECTOR_SETTING],
+        env_keys: [
+          "ANTHROPIC_BASE_URL",
+          "ANTHROPIC_API_KEY",
+          "ANTHROPIC_AUTH_TOKEN",
+          "ANTHROPIC_DEFAULT_OPUS_MODEL",
+          "ANTHROPIC_DEFAULT_SONNET_MODEL",
+          "ANTHROPIC_DEFAULT_HAIKU_MODEL",
+          "ANTHROPIC_DEFAULT_FABLE_MODEL",
+          ...CLAUDE_CODE_MODEL_PRESENTATION_KEYS,
+        ],
+      },
+    };
+  },
+
+  async uninstall(record) {
+    const current = (await readJsonFile(record.config_path, null)) || {};
+    if (hasPennyRouterEnv(current.env)) {
+      // If the base URL points at PennyRouter, every auth value in env was written
+      // by us for our gateway (a Penny pr- key and/or an Anthropic OAuth bearer we
+      // forward upstream) — clear them all. We can't rely on the token's prefix:
+      // in OAuth mode ANTHROPIC_AUTH_TOKEN holds an Anthropic sk-ant-oat... token,
+      // not a pr- value, and the manifest's anthropic_oauth flag may be absent on a
+      // record synthesized from a detected config. Keying off our base URL is what
+      // makes cleanup reliable regardless of which auth mode was installed.
+      const ourGateway = isPennyRouterBaseUrl(current.env.ANTHROPIC_BASE_URL);
+      delete current.env.ANTHROPIC_BASE_URL;
+      const tok = current.env.ANTHROPIC_AUTH_TOKEN;
+      if (typeof tok === "string" && (ourGateway || tok.startsWith("pr-") || record.anthropic_oauth)) {
+        delete current.env.ANTHROPIC_AUTH_TOKEN;
+      }
+      // ANTHROPIC_API_KEY carries the Penny key in OAuth dual-auth mode, or a pr-
+      // key in legacy installs. Clear it when it's ours by base URL or by prefix.
+      if (typeof current.env.ANTHROPIC_API_KEY === "string" && (ourGateway || current.env.ANTHROPIC_API_KEY.startsWith("pr-"))) {
+        delete current.env.ANTHROPIC_API_KEY;
+      }
+      for (const k of [
+        "ANTHROPIC_DEFAULT_OPUS_MODEL",
+        "ANTHROPIC_DEFAULT_SONNET_MODEL",
+        "ANTHROPIC_DEFAULT_HAIKU_MODEL",
+        "ANTHROPIC_DEFAULT_FABLE_MODEL",
+      ]) {
+        if (current.env[k] === LEGACY_MODEL_LABEL || isPennyRouterModelValue(current.env[k])) delete current.env[k];
+      }
+      for (const k of CLAUDE_CODE_MODEL_PRESENTATION_KEYS) delete current.env[k];
+      delete current.env.CLAUDE_CODE_MAX_CONTEXT_TOKENS;
+    }
+    restoreClaudeAiConnectors(current, record);
+    if (current["anthropic.baseURL"] && isPennyRouterValue(current["anthropic.baseURL"])) {
+      delete current["anthropic.baseURL"];
+    }
+    if (typeof current["anthropic.apiKey"] === "string" && current["anthropic.apiKey"].startsWith("pr-")) {
+      delete current["anthropic.apiKey"];
+    }
+    if (current.env && Object.keys(current.env).length === 0) delete current.env;
+    // Statusline: restore the user's original command if we wrapped one, else remove ours.
+    await restoreClaudeCodeStatusline(current);
+    await atomicWrite(record.config_path, `${JSON.stringify(current, null, 2)}\n`);
+  },
+};
+
+export function disableClaudeAiConnectors(settings, existingRecord = null) {
+  const saved = existingRecord?.claude_ai_connectors_before;
+  const before = saved && typeof saved.present === "boolean"
+    ? { ...saved }
+    : Object.prototype.hasOwnProperty.call(settings, CONNECTOR_SETTING)
+      ? { present: true, value: settings[CONNECTOR_SETTING] }
+      : { present: false };
+  settings[CONNECTOR_SETTING] = true;
+  return before;
+}
+
+export function restoreClaudeAiConnectors(settings, record) {
+  const before = record?.claude_ai_connectors_before;
+  if (!before || typeof before.present !== "boolean") return;
+  // Respect a user edit made after installation. We only undo the value we manage.
+  if (settings[CONNECTOR_SETTING] !== true) return;
+  if (before.present) settings[CONNECTOR_SETTING] = before.value;
+  else delete settings[CONNECTOR_SETTING];
+}
+
+function hasPennyRouterEnv(env) {
+  if (!env || typeof env !== "object") return false;
+  return (
+    isPennyRouterBaseUrl(env.ANTHROPIC_BASE_URL) ||
+    isPennyRouterValue(env.ANTHROPIC_AUTH_TOKEN) ||
+    isPennyRouterValue(env.ANTHROPIC_API_KEY) ||
+    env.ANTHROPIC_DEFAULT_OPUS_MODEL === LEGACY_MODEL_LABEL ||
+    env.ANTHROPIC_DEFAULT_SONNET_MODEL === LEGACY_MODEL_LABEL ||
+    env.ANTHROPIC_DEFAULT_HAIKU_MODEL === LEGACY_MODEL_LABEL ||
+    env.ANTHROPIC_DEFAULT_FABLE_MODEL === LEGACY_MODEL_LABEL ||
+    isPennyRouterModelValue(env.ANTHROPIC_DEFAULT_OPUS_MODEL) ||
+    isPennyRouterModelValue(env.ANTHROPIC_DEFAULT_SONNET_MODEL) ||
+    isPennyRouterModelValue(env.ANTHROPIC_DEFAULT_HAIKU_MODEL) ||
+    isPennyRouterModelValue(env.ANTHROPIC_DEFAULT_FABLE_MODEL)
+  );
+}
+
+function isPennyRouterValue(value) {
+  return typeof value === "string" && (value.startsWith("pr-") || value.includes("pennyrouter"));
+}
+
+function isPennyRouterBaseUrl(value) {
+  return typeof value === "string" && value.includes("pennyrouter");
+}
+
+function isPennyRouterModelValue(value) {
+  return (
+    isPennyRouterValue(value) ||
+    value === CLAUDE_CODE_MODELS.haiku ||
+    value === CLAUDE_CODE_MODELS.sonnet ||
+    value === CLAUDE_CODE_MODELS.opus ||
+    value === CLAUDE_CODE_MODELS.fable ||
+    value === CLAUDE_CODE_MODELS.custom ||
+    LEGACY_PINNED_MODEL_LABELS.includes(value) ||
+    LEGACY_PENNY_LABELS.includes(value)
+  );
+}
+
+// `penny claude` can launch using a local Penny config written by an earlier CLI
+// version. Translate only our previous friendly labels; a user-supplied model id
+// remains untouched.
+export function upgradeClaudeCodeModelValue(value) {
+  return LEGACY_PINNED_MODEL_IDS[value] || value;
+}
+
+export async function readClaudeCodePennyRouterKey() {
+  const current = (await readJsonFile(CONFIG_PATH, null)) || {};
+  const env = current.env || {};
+  for (const value of [env.ANTHROPIC_API_KEY, env.ANTHROPIC_AUTH_TOKEN, current["anthropic.apiKey"]]) {
+    if (typeof value === "string" && value.startsWith("pr-")) return value;
+  }
+  return null;
+}
+
+// The PennyRouter gateway URL + pr- key currently in Claude Code's config, used to
+// call the gateway's "forget my Claude token" endpoint on uninstall. Read before
+// uninstall strips these keys. Either field may be null if not present.
+export async function readClaudeCodeGatewayAuth() {
+  const current = (await readJsonFile(CONFIG_PATH, null)) || {};
+  const env = current.env || {};
+  const gatewayBaseUrl = isPennyRouterBaseUrl(env.ANTHROPIC_BASE_URL) ? env.ANTHROPIC_BASE_URL : null;
+  const apiKey = await readClaudeCodePennyRouterKey();
+  return { gatewayBaseUrl, apiKey };
+}