pennyrouter 0.3.0 → 0.3.2

package/src/cli.js

@@ -1,8 +1,15 @@
 import { spawn, spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
 import { emitKeypressEvents } from "node:readline";
 import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { aiderHarness } from "./harnesses/aider.js";
+import { runMcpServer } from "./mcp.js";
+import { mcpStatus, registerMcp } from "./mcp-register.js";
+
+/** The harnesses that can run an MCP server. The other supported harnesses cannot. */
+const MCP_HARNESS_IDS = ["claude-code", "codex"];
+const DEFAULT_GATEWAY_BASE_URL = "https://api.pennyrouter.com";
 import {
   CLAUDE_CODE_MODELS,
   claudeCodeHarness,
@@ -19,6 +26,7 @@ import {
   APP_URL,
   createCliSession,
   forgetAnthropicToken,
+  forgetUpstreamCredential,
   maskKey,
   pollForKey,
   probeClaudeCodeGateway,
@@ -60,15 +68,17 @@ const HARNESS_BY_ID = {
 };
 
 const SUPPORTED_HARNESS_IDS = Object.keys(HARNESS_BY_ID).join(",");
-const DEFAULT_INSTALL_HARNESS_IDS = ["claude-code", "codex"];
+const DEFAULT_INSTALL_HARNESS_IDS = ["claude-code", "codex", "opencode"];
 const CLAUDE_PROVIDER_OPTIONS = [
   { id: "subscription", name: "Claude subscription" },
   { id: "anthropic-api", name: "Anthropic API key" },
   { id: "openrouter", name: "OpenRouter API key" },
+  { id: "anthropic-proxy", name: "Other proxy (custom base URL)" },
 ];
 const CODEX_PROVIDER_OPTIONS = [
   { id: "subscription", name: "ChatGPT subscription" },
   { id: "openai-api", name: "OpenAI API key" },
+  { id: "openai-proxy", name: "Other OpenAI-compatible proxy" },
   { id: "openrouter", name: "OpenRouter API key" },
 ];
 
@@ -115,6 +125,17 @@ export async function main(argv = process.argv.slice(2)) {
     return;
   }
 
+  if (command === "mcp") {
+    // Bare `mcp` is the server itself, started by a harness over stdio. The subcommands are for
+    // a person: registering after --no-mcp, retrying after a name conflict, or checking state.
+    const sub = (flags.args[0] || "").toLowerCase();
+    if (sub === "install" || sub === "add") await installMcp(flags);
+    else if (sub === "uninstall" || sub === "remove") await uninstallMcp(flags);
+    else if (sub === "status" || sub === "list") await statusMcp();
+    else await serveMcp(flags);
+    return;
+  }
+
   throw new Error(`Unknown command "${command}". Run "pennyrouter help".`);
 }
 
@@ -135,6 +156,7 @@ function parseArgs(argv) {
     else if (arg === "--make-default") flags.makeDefault = true;
     else if (arg === "--penny-only") flags.pennyOnly = true;
     else if (arg === "--no-path-update") flags.noPathUpdate = true;
+    else if (arg === "--no-mcp") flags.noMcp = true;
     else if (arg === "--no-browser") flags.noBrowser = true;
     else if (arg === "--existing-account") flags.existingAccount = true;
     else if (arg === "--anthropic-auth") flags.anthropicAuth = true;
@@ -150,28 +172,129 @@ function parseArgs(argv) {
     else if (arg === "--openai-api-key") flags.openaiApiKey = rest[++i] || "";
     else if (arg.startsWith("--openai-api-key=")) flags.openaiApiKey = arg.slice("--openai-api-key=".length);
     else if (arg === "--openrouter-api-key") flags.openrouterApiKey = rest[++i] || "";
+    else if (arg === "--openai-proxy-base-url") flags.openaiProxyBaseUrl = rest[++i] || "";
+    else if (arg.startsWith("--openai-proxy-base-url=")) flags.openaiProxyBaseUrl = arg.slice("--openai-proxy-base-url=".length);
+    else if (arg === "--openai-proxy-api-key") flags.openaiProxyApiKey = rest[++i] || "";
+    else if (arg.startsWith("--openai-proxy-api-key=")) flags.openaiProxyApiKey = arg.slice("--openai-proxy-api-key=".length);
+    else if (arg === "--proxy-base-url") flags.proxyBaseUrl = rest[++i] || "";
+    else if (arg.startsWith("--proxy-base-url=")) flags.proxyBaseUrl = arg.slice("--proxy-base-url=".length);
+    else if (arg === "--proxy-api-key") flags.proxyApiKey = rest[++i] || "";
+    else if (arg.startsWith("--proxy-api-key=")) flags.proxyApiKey = arg.slice("--proxy-api-key=".length);
     else if (arg.startsWith("--openrouter-api-key=")) flags.openrouterApiKey = arg.slice("--openrouter-api-key=".length);
     else if (arg === "--harness") flags.harness = rest[++i] || "";
     else if (arg.startsWith("--harness=")) flags.harness = arg.slice("--harness=".length);
     else if (arg === "--app-url") flags.appUrl = rest[++i] || "";
     else if (arg.startsWith("--app-url=")) flags.appUrl = arg.slice("--app-url=".length);
-    else if (arg === "--gateway-base-url") flags.gatewayBaseUrl = rest[++i] || "";
-    else if (arg.startsWith("--gateway-base-url=")) flags.gatewayBaseUrl = arg.slice("--gateway-base-url=".length);
+    // A --gateway-base-url is a *private* gateway: an admin-run deployment that issues its own
+    // keys. Flag it so install can require the matching admin-issued key. --local/--prod are
+    // developer shortcuts against gateways that honor prod keys, so they do not set this.
+    else if (arg === "--gateway-base-url") { flags.gatewayBaseUrl = rest[++i] || ""; flags.privateGateway = true; }
+    else if (arg.startsWith("--gateway-base-url=")) {
+      flags.gatewayBaseUrl = arg.slice("--gateway-base-url=".length);
+      flags.privateGateway = true;
+    }
+    // Admin-issued key for a private gateway (see scripts/provision_local_key.py). Overrides the
+    // key returned by the browser claim, which is only valid against the hosted gateway.
+    else if (arg === "--private-key") flags.privateKey = rest[++i] || "";
+    else if (arg.startsWith("--private-key=")) flags.privateKey = arg.slice("--private-key=".length);
     // --local: point the installed harness at a locally-running gateway (default
     // http://localhost:8400), for developing/testing against your own gateway. Auth still goes
     // to prod (pennyrouter.com) so you get a real key; only the harness's serving URL is local.
     // `--local=<url>` overrides the port/host.
     else if (arg === "--local") flags.gatewayBaseUrl = "http://localhost:8400";
     else if (arg.startsWith("--local=")) flags.gatewayBaseUrl = arg.slice("--local=".length);
+    // --prod: point the installed harness back at the default production gateway
+    // (https://api.pennyrouter.com). Undoes --local.
+    else if (arg === "--prod") flags.gatewayBaseUrl = DEFAULT_GATEWAY_BASE_URL;
     else if (arg === "--forget") flags.forget = true;
     else if (arg === "--forget-token") flags.forgetToken = true;
+    else if (arg === "--config") flags.configPath = rest[++i] || "";
+    else if (arg.startsWith("--config=")) flags.configPath = arg.slice("--config=".length);
     else if (!arg.startsWith("-")) flags.args.push(arg);
     else throw new Error(`Unknown option "${arg}". Run "pennyrouter help".`);
   }
 
+  if (flags.configPath) applyConfigFile(flags);
+
   return { command, flags };
 }
 
+// Lets a GUI installer (e.g. the macOS DMG) answer the install questions up front instead of
+// over a TTY: pick harnesses, pick funding per harness, optionally supply keys. Populates the
+// same `flags` fields the equivalent CLI flags set, so it flows through the existing
+// non-interactive paths unchanged. CLI flags win over the config file where both are given.
+// Funding choices imply --yes (skip remaining prompts) but, unlike bare --yes, do NOT suppress
+// the Claude subscription browser sign-in — see maybeConfigureClaudeAnthropicAuth.
+function applyConfigFile(flags) {
+  let config;
+  try {
+    config = JSON.parse(readFileSync(flags.configPath, "utf8"));
+  } catch (error) {
+    throw new Error(`Could not read --config file "${flags.configPath}": ${error.message}`);
+  }
+
+  if (config.harnesses && flags.harness === undefined) {
+    flags.harness = config.harnesses.join(",");
+  }
+  const claudeFunding = new Set(config.claudeFunding || []);
+  const codexFunding = new Set(config.codexFunding || []);
+  if (claudeFunding.has("subscription") && flags.anthropicAuth === undefined) {
+    flags.anthropicAuth = true;
+  }
+  if (claudeFunding.has("anthropic-api") && flags.anthropicApiKey === undefined) {
+    flags.anthropicApiKey = config.anthropicApiKey || "";
+  }
+  if ((claudeFunding.has("openrouter") || codexFunding.has("openrouter"))
+      && flags.openrouterApiKey === undefined) {
+    flags.openrouterApiKey = config.openrouterApiKey || "";
+  }
+  if (codexFunding.has("openai-api") && flags.openaiApiKey === undefined) {
+    flags.openaiApiKey = config.openaiApiKey || "";
+  }
+  if (claudeFunding.has("anthropic-proxy")) {
+    if (flags.proxyBaseUrl === undefined) flags.proxyBaseUrl = config.proxyBaseUrl || "";
+    if (flags.proxyApiKey === undefined) flags.proxyApiKey = config.proxyApiKey || "";
+  }
+
+  flags.yes = true;
+  flags.fromConfig = true;
+  flags.configClaudeFunding = claudeFunding;
+  flags.configCodexFunding = codexFunding;
+}
+
+// A harness needs the account-claim/funding flow only if it's new, or if the funding the
+// config asked for differs from what's already stored on it — an unchanged re-run of
+// --config should behave like `update`, not force a fresh Claude/PennyRouter sign-in.
+// Plain (non--config) installs call every selected harness "changed" by always passing an
+// empty requested set here, so this only takes effect on the --config path (see `needsAuth`
+// in install()).
+export function harnessFundingChanged(flags, harness, manifest) {
+  const existingRecord = (manifest.installations || []).find(
+    (candidate) => candidate.harness === harness.id,
+  );
+  if (!existingRecord) return true;
+
+  if (harness.id === "claude-code") {
+    const requested = flags.configClaudeFunding || new Set();
+    if (requested.size === 0) return false;
+    const current = existingRecord.user_funded_provider === "claude-subscription"
+      ? "subscription"
+      : existingRecord.user_funded_provider;
+    return requested.size !== 1 || !requested.has(current);
+  }
+
+  if (harness.id === "codex") {
+    const requested = flags.configCodexFunding || new Set();
+    if (requested.size === 0) return false;
+    const current = existingRecord.openai_subscription_auth
+      ? "subscription"
+      : existingRecord.user_funded_provider;
+    return requested.size !== 1 || !requested.has(current);
+  }
+
+  return false;
+}
+
 async function authProvider(flags) {
   const provider = (flags.args[0] || "anthropic").toLowerCase();
   if (provider !== "anthropic" && provider !== "claude") {
@@ -186,11 +309,21 @@ async function authProvider(flags) {
         "No PennyRouter key found in Claude Code settings. Pass `--penny-key pr-...`.",
       );
     }
-    const gatewayBaseUrl = flags.gatewayBaseUrl || process.env.PENNYROUTER_GATEWAY_BASE_URL || "https://api.pennyrouter.com";
+    // Resolve against the INSTALLED config before falling back to the prod default.
+    // This is a destructive call against whichever gateway it reaches, so defaulting to
+    // production while the user is working against a local gateway would silently delete
+    // the wrong account's token (and leave the local one in place, looking like a no-op).
+    const globalAuth = await readClaudeCodeGatewayAuth();
+    const gatewayBaseUrl = flags.gatewayBaseUrl
+      || process.env.PENNYROUTER_GATEWAY_BASE_URL
+      || launchConfig.gateway_base_url
+      || globalAuth.gatewayBaseUrl
+      || DEFAULT_GATEWAY_BASE_URL;
     if (flags.dryRun) {
       console.log(`Will delete stored Anthropic token from gateway: ${gatewayBaseUrl}`);
       return;
     }
+    console.log(`Gateway: ${gatewayBaseUrl}`);
     const ok = await forgetAnthropicToken({ gatewayBaseUrl, apiKey: pennyKey });
     if (ok) {
       console.log("Successfully forgot stored Anthropic token on server.");
@@ -238,7 +371,7 @@ async function authProvider(flags) {
     );
   }
 
-  const gatewayBaseUrl = flags.gatewayBaseUrl || process.env.PENNYROUTER_GATEWAY_BASE_URL || "https://api.pennyrouter.com";
+  const gatewayBaseUrl = flags.gatewayBaseUrl || process.env.PENNYROUTER_GATEWAY_BASE_URL || DEFAULT_GATEWAY_BASE_URL;
   const manifest = await loadManifest();
   const existingRecord = (manifest.installations || []).find(
     (candidate) => candidate.harness === "claude-code",
@@ -246,12 +379,9 @@ async function authProvider(flags) {
   const ownsGlobalRouting = existingRecord
     ? existingRecord.default_routing !== false
     : Boolean(await readClaudeCodePennyRouterKey());
-  if (ownsGlobalRouting) assertNoRunningHarness("claude-code", flags);
   await storeAnthropicToken({ gatewayBaseUrl, apiKey: pennyKey, token });
   await probeClaudeCodeGateway({ gatewayBaseUrl, apiKey: pennyKey });
-  if (process.platform !== "win32") {
-    await installPennyRuntime({ updatePath: !flags.noPathUpdate });
-  }
+  await installPennyRuntime({ updatePath: !flags.noPathUpdate });
   await configurePennyHarness("claude-code", {
     apiKey: pennyKey,
     gatewayBaseUrl,
@@ -384,7 +514,10 @@ function normalizeAnthropicToken(value) {
   return text.replace(/\s+/g, "").trim();
 }
 
-async function install(flags) {
+// Public programmatic entry point used by the signed desktop setup app. Keeping this
+// here means every installer surface shares the same authorization, backup, config,
+// update, and uninstall implementation.
+export async function install(flags = {}) {
   if (flags.makeDefault && flags.pennyOnly) {
     throw new Error("--make-default and --penny-only cannot be used together.");
   }
@@ -402,8 +535,9 @@ async function install(flags) {
   if (flags.dryRun) {
     const defaultRouting = await chooseDefaultRouting(flags, selected, manifest);
     for (const harness of selected) {
-      const explicit = ["claude-code", "codex"].includes(harness.id) && process.platform !== "win32";
-      const command = harness.id === "claude-code" ? "penny claude" : "penny codex";
+      const explicit = ["claude-code", "codex", "opencode"].includes(harness.id);
+      const command = harness.id === "claude-code"
+        ? "penny claude" : harness.id === "codex" ? "penny codex" : "penny opencode";
       console.log(`Will install on ${harness.name}${explicit ? ` via ${command}` : installNoteForHarness(harness.id)}.`);
       if (defaultRouting.get(harness.id)) {
         console.log(`Will also route bare ${harness.id === "claude-code" ? "claude" : harness.id} through PennyRouter.`);
@@ -417,42 +551,140 @@ async function install(flags) {
     return;
   }
 
-  const session = await createCliSession({
-    appUrl: flags.appUrl || APP_URL,
-    harnesses: selected.map((harness) => harness.id),
-    accountMode: "existing",
-  });
+  // A --config re-run against an existing install only needs a fresh account claim and
+  // funding popups for harnesses that are actually new or whose requested funding differs
+  // from what's already stored — an unchanged harness should behave like `update`, not
+  // trigger the Claude/PennyRouter sign-in windows again. Plain (non-config) installs always
+  // treat everything selected as needing auth, matching the original behavior.
+  const needsAuth = flags.fromConfig
+    ? selected.filter((harness) => harnessFundingChanged(flags, harness, manifest))
+    : selected;
 
-  console.log("Opening your browser to log in and authorize this machine with your PennyRouter account...");
-  console.log(`If your browser did not open, visit:\n${session.authorize_url}`);
-  if (!flags.noBrowser) openBrowser(session.authorize_url);
-  console.log("");
-  console.log("Waiting for approval...");
+  let claim;
+  let claudeAnthropicAuth = null;
+  let funding = { credentials: [], codexSubscriptionAuth: false, claudeCredentialProvider: null, codexCredentialProvider: null };
+  let gatewayBaseUrl;
 
-  const claim = await pollForKey(session);
-  console.log(`Authorized. Received key ${maskKey(claim.api_key)}.`);
-  console.log("");
-
-  const claudeProviders = await selectClaudeFundingProviders(flags, selected);
-  const codexProviders = await selectCodexFundingProviders(flags, selected);
-  const claudeAnthropicAuth = await maybeConfigureClaudeAnthropicAuth(
-    flags, selected, claudeProviders.has("subscription"));
-  const funding = await configureUserFunding(
-    flags, selected, claudeAnthropicAuth, claudeProviders, codexProviders);
-  const gatewayBaseUrl = flags.gatewayBaseUrl || claim.gateway_base_url;
-
-  for (const credential of funding.credentials) {
-    await storeUpstreamCredential({
-      gatewayBaseUrl,
-      apiKey: claim.api_key,
-      provider: credential.provider,
-      token: credential.token,
+  if (needsAuth.length === 0) {
+    const launchConfig = await loadPennyConfig();
+    const globalAuth = await readClaudeCodeGatewayAuth();
+    const apiKey = flags.pennyKey || launchConfig.api_key || globalAuth.apiKey;
+    if (!apiKey) {
+      throw new Error(
+        "Could not find your PennyRouter key in the local config. Pass `--penny-key pr-...`, "
+        + "or remove --config to re-authorize.",
+      );
+    }
+    console.log("No new tools or funding requested — refreshing your existing setup.");
+    console.log("");
+    claim = { api_key: apiKey, gateway_base_url: null };
+    gatewayBaseUrl = flags.gatewayBaseUrl
+      || launchConfig.gateway_base_url
+      || globalAuth.gatewayBaseUrl
+      || process.env.PENNYROUTER_GATEWAY_BASE_URL
+      || DEFAULT_GATEWAY_BASE_URL;
+  } else {
+    const session = await createCliSession({
+      appUrl: flags.appUrl || APP_URL,
+      harnesses: selected.map((harness) => harness.id),
+      accountMode: "existing",
     });
+
+    console.log("Opening your browser to log in and authorize this machine with your PennyRouter account...");
+    console.log(`If your browser did not open, visit:\n${session.authorize_url}`);
+    if (!flags.noBrowser) openBrowser(session.authorize_url);
+    console.log("");
+    console.log("Waiting for approval...");
+
+    claim = await pollForKey(session);
+    console.log(`Authorized. Received key ${maskKey(claim.api_key)}.`);
+    console.log("");
+
+    const claudeProviders = await selectClaudeFundingProviders(flags, needsAuth);
+    const codexProviders = await selectCodexFundingProviders(flags, needsAuth);
+    claudeAnthropicAuth = await maybeConfigureClaudeAnthropicAuth(
+      flags, needsAuth, claudeProviders.has("subscription"));
+    funding = await configureUserFunding(
+      flags, needsAuth, claudeAnthropicAuth, claudeProviders, codexProviders);
+    gatewayBaseUrl = flags.gatewayBaseUrl || claim.gateway_base_url;
+    if (flags.gatewayBaseUrl) {
+      const normalized = normalizeGatewayBaseUrl(flags.gatewayBaseUrl);
+      if (!normalized) {
+        throw new Error(
+          `--gateway-base-url "${flags.gatewayBaseUrl}" is not a usable URL. Use a host like `
+          + "localhost:8400 or https://gateway.example.com.",
+        );
+      }
+      gatewayBaseUrl = normalized;
+    }
+
+    // A user-supplied proxy may live on a private network that the hosted gateway cannot
+    // reach. Let interactive installs choose the gateway after they choose the proxy: blank
+    // keeps the hosted default, while a supplied URL is used for credential storage,
+    // validation, probing, and the installed harness configuration. `--local` remains the
+    // explicit localhost:8400 developer shortcut and skips this prompt.
+    if ((claudeProviders.has("anthropic-proxy") || codexProviders.has("openai-proxy")) && !flags.gatewayBaseUrl
+        && !flags.yes && input.isTTY && output.isTTY) {
+      const answer = (await promptText(
+        "PennyRouter gateway URL for this proxy (blank for hosted gateway): ",
+      )).trim();
+      if (answer) {
+        const privateGateway = normalizeGatewayBaseUrl(answer);
+        if (!privateGateway) {
+          throw new Error(
+            `"${answer}" is not a usable gateway URL. Use a host like `
+            + "localhost:8400 or https://gateway.example.com.",
+          );
+        }
+        // Show the normalized form: the user typed "localhost:8000" and everything from here on
+        // uses "http://localhost:8000", so any later error names a URL they recognize.
+        if (privateGateway !== answer) console.log(`Using gateway ${privateGateway}.`);
+        gatewayBaseUrl = privateGateway;
+        flags.privateGateway = true;
+      }
+    }
+
+    // A private gateway has its own key store, so the hosted key from the browser claim is
+    // meaningless there. Require the admin-issued key and use it for every subsequent gateway
+    // call (credential storage, probing, harness config).
+    if (flags.privateGateway) {
+      let privateKey = (flags.privateKey || "").trim();
+      if (!privateKey && !flags.yes && input.isTTY && output.isTTY) {
+        console.log("");
+        console.log(`Private gateway: ${gatewayBaseUrl}`);
+        console.log("Your PennyRouter administrator issues keys for this gateway.");
+        // No echo: this is an issued credential, and a visible paste lingers in scrollback.
+        privateKey = (await promptSecretish("Paste your private gateway key (pr-...): ")).trim();
+      }
+      if (!privateKey) {
+        throw new Error(
+          `A private gateway (${gatewayBaseUrl}) needs its own key. `
+          + "Ask your PennyRouter administrator for one and pass `--private-key pr-...`.",
+        );
+      }
+      if (!privateKey.startsWith("pr-")) {
+        throw new Error(`That does not look like a PennyRouter key — expected it to start with "pr-".`);
+      }
+      claim.api_key = privateKey;
+      console.log(`Using private gateway key ${maskKey(privateKey)}.`);
+      console.log("");
+    }
+
+    for (const credential of funding.credentials) {
+      await withGatewayContext(gatewayBaseUrl, () => storeUpstreamCredential({
+        gatewayBaseUrl,
+        apiKey: claim.api_key,
+        provider: credential.provider,
+        token: credential.token,
+        metadata: credential.metadata,
+      }));
+    }
   }
 
-  if (selected.some((harness) => harness.id === "claude-code")) {
+  if (needsAuth.some((harness) => harness.id === "claude-code")) {
     console.log("Verifying modern Claude Code compatibility before changing local settings...");
-    await probeClaudeCodeGateway({ gatewayBaseUrl, apiKey: claim.api_key });
+    await withGatewayContext(
+      gatewayBaseUrl, () => probeClaudeCodeGateway({ gatewayBaseUrl, apiKey: claim.api_key }));
     console.log("");
   }
 
@@ -461,9 +693,9 @@ async function install(flags) {
   // choose the visible command behavior with all relevant context in front of them.
   const defaultRouting = await chooseDefaultRouting(flags, selected, manifest);
 
-  const launchable = selected.filter((harness) => ["claude-code", "codex"].includes(harness.id));
+  const launchable = selected.filter((harness) => ["claude-code", "codex", "opencode"].includes(harness.id));
   let runtimeResult = null;
-  if (launchable.length > 0 && process.platform !== "win32") {
+  if (launchable.length > 0) {
     runtimeResult = await installPennyRuntime({ updatePath: !flags.noPathUpdate });
   }
 
@@ -475,16 +707,13 @@ async function install(flags) {
       const existingRecord = (manifest.installations || []).find(
         (candidate) => candidate.harness === harness.id,
       );
-      const supportsPennyCommand = ["claude-code", "codex"].includes(harness.id)
-        && process.platform !== "win32";
+      const supportsPennyCommand = ["claude-code", "codex", "opencode"].includes(harness.id);
       const makeDefault = defaultRouting.get(harness.id) ?? true;
       const hadGlobalRouting = Boolean(existingRecord && existingRecord.default_routing !== false);
-      if (["claude-code", "codex"].includes(harness.id) && (makeDefault || hadGlobalRouting)) {
-        assertNoRunningHarness(harness.id, flags);
-      }
 
+      const harnessNeededAuth = needsAuth.includes(harness);
       const codexSubscriptionAuth = harness.id === "codex"
-        ? funding.codexSubscriptionAuth
+        ? (harnessNeededAuth ? funding.codexSubscriptionAuth : Boolean(existingRecord?.openai_subscription_auth))
         : false;
       const claudeSubscriptionAuth = harness.id === "claude-code"
         && Boolean(claudeAnthropicAuth || existingRecord?.anthropic_token_stored);
@@ -522,9 +751,10 @@ async function install(flags) {
       }
       if (supportsPennyCommand) {
         record.launch_available = true;
-        record.launch_config_path = compactHome(
-          harness.id === "claude-code" ? claudeLaunchSettingsPath() : codexLaunchProfilePath(),
-        );
+        const launchConfigPath = harness.id === "claude-code"
+          ? claudeLaunchSettingsPath()
+          : harness.id === "codex" ? codexLaunchProfilePath() : null;
+        record.launch_config_path = launchConfigPath ? compactHome(launchConfigPath) : null;
         record.default_routing = Boolean(makeDefault);
       }
       if (harness.id === "claude-code" && claudeSubscriptionAuth) {
@@ -532,11 +762,20 @@ async function install(flags) {
         record.anthropic_token_stored = true;
         record.token_source = claudeAnthropicAuth?.source || existingRecord?.token_source || "stored";
       }
-      if (harness.id === "claude-code" && funding.claudeCredentialProvider) {
-        record.user_funded_provider = funding.claudeCredentialProvider;
+      if (harness.id === "claude-code") {
+        record.user_funded_provider = harnessNeededAuth
+          ? (funding.claudeCredentialProvider || existingRecord?.user_funded_provider)
+          : existingRecord?.user_funded_provider;
+        // Host only, never the key — the key lives encrypted on the gateway.
+        const proxyBaseUrl = harnessNeededAuth
+          ? (funding.claudeProxyBaseUrl ?? existingRecord?.proxy_base_url ?? null)
+          : (existingRecord?.proxy_base_url ?? null);
+        if (proxyBaseUrl) record.proxy_base_url = proxyBaseUrl;
       }
-      if (harness.id === "codex" && funding.codexCredentialProvider) {
-        record.user_funded_provider = funding.codexCredentialProvider;
+      if (harness.id === "codex") {
+        record.user_funded_provider = harnessNeededAuth
+          ? (funding.codexCredentialProvider || existingRecord?.user_funded_provider)
+          : existingRecord?.user_funded_provider;
       }
       if (harness.id === "codex") record.openai_subscription_auth = codexSubscriptionAuth;
       records.push(record);
@@ -554,28 +793,189 @@ async function install(flags) {
   for (const record of records) {
     const harness = HARNESS_BY_ID[record.harness];
     if (record.launch_available) {
-      const command = record.harness === "claude-code" ? "penny claude" : "penny codex";
-      const native = record.harness === "claude-code" ? "claude" : "codex";
-      const harnessName = record.harness === "claude-code" ? "Claude Code" : "Codex";
+      const command = record.harness === "claude-code"
+        ? "penny claude" : record.harness === "codex" ? "penny codex" : "penny opencode";
+      const native = record.harness === "claude-code" ? "claude"
+        : record.harness === "codex" ? "codex" : "opencode";
+      const harnessName = record.harness === "claude-code" ? "Claude Code"
+        : record.harness === "codex" ? "Codex" : "OpenCode";
       const commandWidth = Math.max(command.length, native.length) + 2;
       console.log("");
       console.log(color(`How to Run ${harnessName}`, "bold"));
       console.log("");
       console.log(`  ${color(command.padEnd(commandWidth), "bold")}→ ${harnessName} with PennyRouter`);
-      console.log(`  ${color(native.padEnd(commandWidth), "bold")}→ ${record.default_routing ? `${harnessName} with PennyRouter (default routing enabled)` : `${harnessName} native`}`);
+      console.log(`  ${color(native.padEnd(commandWidth), "bold")}→ ${record.default_routing ? `${harnessName}` : `${harnessName} native`}`);
     } else {
       console.log(`Installed on ${harness?.name || record.harness}${installNoteForRecord(record)}.`);
     }
   }
   if (runtimeResult && !runtimeResult.available) {
-    console.log("Add ~/.local/bin to PATH before using the `penny` command.");
+    console.log("Add the PennyRouter launcher directory to PATH before using the `penny` command.");
   } else if (runtimeResult?.changed) {
     console.log("Open a new terminal (or reload your shell) before using the `penny` command.");
   }
+
+  // Registered after routing, which is the primary job: a naming conflict here reports itself
+  // and leaves a working install rather than failing the whole run.
+  if (!flags.noMcp && !flags.dryRun) {
+    const mcp = await registerMcp(records.map((r) => r.harness), {
+      gatewayBaseUrl: customGatewayBaseUrl(gatewayBaseUrl),
+    });
+    const registered = mcp.filter((r) => r.changed).map((r) => HARNESS_BY_ID[r.harness]?.name);
+    if (registered.length) {
+      console.log("");
+      console.log(color("Threads MCP", "bold"));
+      console.log(`  Registered on ${registered.join(" and ")}.`);
+      console.log("  Ask your agent to read or resume an AI share link:");
+      console.log('    "code based on this chat: <paste a ChatGPT/Claude/Gemini/Perplexity link>"');
+    }
+    for (const result of mcp.filter((r) => r.error)) {
+      console.log(`  MCP registration skipped for ${result.harness}: ${result.error}`);
+    }
+  }
+
   console.log("");
   reportFailures(failures);
 }
 
+// Deliberately small, secret-free preflight for graphical installers. Do not add
+// tokens or config contents here: the renderer only needs to know which setup
+// choices are likely to work on this machine.
+export async function getSetupPreflight() {
+  const harnesses = await Promise.all(DEFAULT_INSTALL_HARNESS_IDS.map(async (id) => {
+    const harness = HARNESS_BY_ID[id];
+    return { id, name: harness.name, detected: await safeDetect(harness) };
+  }));
+  return {
+    harnesses,
+    codex_chatgpt_logged_in: await detectCodexChatgptAuth(),
+  };
+}
+
+/* The `mcp install|uninstall|status` subcommands.
+
+   Install already registers the server, so these exist for the states install cannot reach:
+   someone who passed --no-mcp and changed their mind, someone who hit a name conflict and has
+   now renamed the other server, and anyone who just wants to know whether it is wired up. */
+
+function mcpTargets(flags) {
+  const requested = parseHarnessList(flags.harness).filter((id) => MCP_HARNESS_IDS.includes(id));
+  return requested.length ? requested : MCP_HARNESS_IDS;
+}
+
+/** The gateway URL worth pinning into the MCP entry, or "" for the default.
+    The MCP server already falls back to production on its own, so writing that value would only
+    freeze today's default into every user's config. */
+/* Users type gateways the way they say them out loud — "localhost:8000",
+   "gateway.example.com". Those are not absolute URLs, so fetch() rejects them with a bare
+   "fetch failed" long after the prompt, where the cause is invisible. Supply the obvious scheme
+   (plain http for loopback, https elsewhere) and prove the result parses, so a typo fails here
+   instead. Returns null when the value cannot be salvaged. */
+function normalizeGatewayBaseUrl(raw) {
+  const value = String(raw || "").trim().replace(/\/+$/, "");
+  if (!value) return null;
+  const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(value)
+    ? value
+    : `${/^(localhost|127\.0\.0\.1|\[::1\])(:|$)/i.test(value) ? "http" : "https"}://${value}`;
+  let parsed;
+  try {
+    parsed = new URL(withScheme);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+  if (!parsed.hostname) return null;
+  return withScheme.replace(/\/+$/, "");
+}
+
+/* A gateway that is unreachable (wrong host, wrong port, not running) surfaces from fetch() as
+   an opaque "fetch failed" with no status. Name the gateway we could not reach so the user knows
+   which URL to fix. Real HTTP errors carry their own message and pass through untouched. */
+async function withGatewayContext(gatewayBaseUrl, action) {
+  try {
+    return await action();
+  } catch (error) {
+    const message = String(error?.message || error);
+    if (/fetch failed|ECONNREFUSED|ENOTFOUND|EAI_AGAIN|ECONNRESET|network/i.test(message)) {
+      throw new Error(
+        `Could not reach the PennyRouter gateway at ${gatewayBaseUrl} (${message}). `
+        + "Check that the URL is correct and that the gateway is running.",
+      );
+    }
+    throw error;
+  }
+}
+
+function customGatewayBaseUrl(url) {
+  const value = String(url || "").trim().replace(/\/+$/, "");
+  return !value || value === DEFAULT_GATEWAY_BASE_URL ? "" : value;
+}
+
+async function installMcp(flags) {
+  const results = await registerMcp(mcpTargets(flags), {
+    gatewayBaseUrl: customGatewayBaseUrl(
+      flags.gatewayBaseUrl || process.env.PENNYROUTER_GATEWAY_BASE_URL,
+    ),
+  });
+  console.log("PennyRouter Threads MCP");
+  console.log("");
+  for (const result of results) {
+    const name = HARNESS_BY_ID[result.harness]?.name || result.harness;
+    if (result.error) console.log(`  ${name}: ${result.error}`);
+    else if (result.changed) console.log(`  ${name}: registered`);
+    else if (result.reason) console.log(`  ${name}: skipped — ${result.reason}`);
+    else console.log(`  ${name}: already registered`);
+  }
+  console.log("");
+  console.log("Restart any running session, then ask your agent to read or resume a share link.");
+}
+
+async function uninstallMcp(flags) {
+  const results = await registerMcp(mcpTargets(flags), { remove: true });
+  console.log("PennyRouter Threads MCP");
+  console.log("");
+  for (const result of results) {
+    const name = HARNESS_BY_ID[result.harness]?.name || result.harness;
+    console.log(`  ${name}: ${result.changed ? "removed" : "nothing to remove"}`);
+  }
+}
+
+async function statusMcp() {
+  const rows = await mcpStatus(MCP_HARNESS_IDS);
+  console.log("PennyRouter Threads MCP");
+  console.log("");
+  for (const row of rows) {
+    const name = HARNESS_BY_ID[row.harness]?.name || row.harness;
+    if (!row.configFound) console.log(`  ${name}: not installed on this machine`);
+    else if (row.conflict) {
+      console.log(`  ${name}: a different server is already named "pennyrouter"`);
+    } else console.log(`  ${name}: ${row.registered ? "registered" : "not registered"}`);
+  }
+  if (rows.some((row) => row.configFound && !row.registered)) {
+    console.log("");
+    console.log("Register with: pennyrouter mcp install");
+  }
+}
+
+/* Serve the Threads MCP tools over stdio. Started by the harness, not by a person: stdout is the
+   JSON-RPC channel, so nothing may be printed to it. Diagnostics go to stderr. */
+async function serveMcp(flags) {
+  const launchConfig = await loadPennyConfig();
+  const globalAuth = await readClaudeCodeGatewayAuth();
+  const apiKey = flags.pennyKey || launchConfig.api_key || globalAuth.apiKey;
+  const gatewayBaseUrl = flags.gatewayBaseUrl
+    || launchConfig.gateway_base_url
+    || globalAuth.gatewayBaseUrl
+    || process.env.PENNYROUTER_GATEWAY_BASE_URL
+    || DEFAULT_GATEWAY_BASE_URL;
+
+  await runMcpServer({
+    gatewayBaseUrl,
+    apiKey,
+    harness: process.env.PENNYROUTER_MCP_HARNESS,
+  });
+}
+
 // Refresh the managed local files to this package version WITHOUT re-running any of the
 // account/credential flow. Everything an update needs is already on disk: the pr- key and
 // gateway URL live in the penny config (and, for older installs, in the harness config the
@@ -620,7 +1020,7 @@ async function update(flags) {
     || launchConfig.gateway_base_url
     || globalAuth.gatewayBaseUrl
     || process.env.PENNYROUTER_GATEWAY_BASE_URL
-    || "https://api.pennyrouter.com";
+    || DEFAULT_GATEWAY_BASE_URL;
 
   if (!apiKey) {
     throw new Error(
@@ -647,8 +1047,7 @@ async function update(flags) {
 
   const failures = [];
   let runtimeResult = null;
-  if (targets.some((record) => ["claude-code", "codex"].includes(record.harness))
-      && process.platform !== "win32") {
+  if (targets.some((record) => ["claude-code", "codex", "opencode"].includes(record.harness))) {
     runtimeResult = await installPennyRuntime({ updatePath: !flags.noPathUpdate });
   }
 
@@ -657,13 +1056,11 @@ async function update(flags) {
     if (!harness) continue;
 
     await runHarnessJob(failures, record.harness, "update", async () => {
-      const supportsPennyCommand = ["claude-code", "codex"].includes(record.harness)
-        && process.platform !== "win32";
+      const supportsPennyCommand = ["claude-code", "codex", "opencode"].includes(record.harness);
       // An update rewrites the harness's own config only when that config is ours to
       // rewrite — i.e. the bare command still routes through the gateway. In penny-only
       // mode the harness config belongs to the user and we touch just the launch profile.
       const ownsGlobalRouting = !record.launch_available || record.default_routing !== false;
-      if (ownsGlobalRouting) assertNoRunningHarness(record.harness, flags);
 
       const claudeSubscriptionAuth = record.harness === "claude-code"
         && Boolean(record.anthropic_token_stored);
@@ -703,9 +1100,29 @@ async function update(flags) {
   }
 
   await saveManifest(manifest);
+
+  // Pick up MCP registration for installs that predate it, which is every existing user: the
+  // server ships with the package but nothing registers it retroactively.
+  //
+  // Update always registers rather than honoring a stored opt-out. Registration is what makes
+  // the Threads tools exist at all, and a preference remembered across version bumps would
+  // mostly serve to leave people silently without them. `--no-mcp` still skips a single run,
+  // and `pennyrouter mcp uninstall` removes it for good.
+  if (!flags.dryRun && !flags.noMcp) {
+    const wanted = targets.filter((record) => MCP_HARNESS_IDS.includes(record.harness));
+    const results = await registerMcp(wanted.map((record) => record.harness), {
+      gatewayBaseUrl: customGatewayBaseUrl(gatewayBaseUrl),
+    });
+    const added = results.filter((r) => r.changed).map((r) => HARNESS_BY_ID[r.harness]?.name);
+    if (added.length) console.log(`Registered the Threads MCP server on ${added.join(" and ")}.`);
+    for (const result of results.filter((r) => r.error)) {
+      console.log(`MCP registration skipped for ${result.harness}: ${result.error}`);
+    }
+  }
+
   console.log("");
   if (runtimeResult && !runtimeResult.available) {
-    console.log("Add ~/.local/bin to PATH before using the `penny` command.");
+    console.log("Add the PennyRouter launcher directory to PATH before using the `penny` command.");
   } else if (runtimeResult?.changed) {
     console.log("Open a new terminal (or reload your shell) before using the `penny` command.");
   }
@@ -716,10 +1133,6 @@ async function update(flags) {
 async function chooseDefaultRouting(flags, selected, manifest) {
   const out = new Map();
   const launchable = selected.filter((harness) => ["claude-code", "codex"].includes(harness.id));
-  if (process.platform === "win32") {
-    for (const harness of launchable) out.set(harness.id, true);
-    return out;
-  }
   let newInstallChoice = null;
   for (const harness of launchable) {
     if (flags.makeDefault) {
@@ -745,7 +1158,10 @@ async function chooseDefaultRouting(flags, selected, manifest) {
       continue;
     }
     if (newInstallChoice === null) {
-      if (flags.dryRun || flags.yes || !input.isTTY || !output.isTTY) {
+      // Auto-load-by-default prompt is disabled for now — always install as `penny <native>`
+      // only. Flip ENABLE_AUTOLOAD_PROMPT to true to restore asking the user.
+      const ENABLE_AUTOLOAD_PROMPT = false;
+      if (!ENABLE_AUTOLOAD_PROMPT || flags.dryRun || flags.yes || !input.isTTY || !output.isTTY) {
         newInstallChoice = false;
       } else {
         for (const item of launchable) {
@@ -783,14 +1199,19 @@ async function selectClaudeFundingProviders(flags, selected) {
       || process.env.ANTHROPIC_AUTH_TOKEN)) supplied.add("subscription");
   if (flags.anthropicApiKey || process.env.ANTHROPIC_API_KEY) supplied.add("anthropic-api");
   if (flags.openrouterApiKey || process.env.OPENROUTER_API_KEY) supplied.add("openrouter");
+  if ((flags.proxyBaseUrl || process.env.PENNYROUTER_PROXY_BASE_URL)
+      && (flags.proxyApiKey || process.env.PENNYROUTER_PROXY_API_KEY)) {
+    supplied.add("anthropic-proxy");
+  }
 
   // Explicit flags are the automation selector. Interactive installs always default to the
   // subscription alone; environment keys are used if the user checks their provider.
   const explicit = flags.anthropicAuth || flags.noAnthropicAuth || flags.token
-    || flags.tokenCommand || flags.anthropicApiKey || flags.openrouterApiKey;
+    || flags.tokenCommand || flags.anthropicApiKey || flags.openrouterApiKey
+    || flags.proxyBaseUrl || flags.proxyApiKey;
   if (explicit || flags.yes || !input.isTTY || !output.isTTY) return supplied;
 
-  console.log("PennyRouter can use your Claude subscription, an Anthropic API key, or an OpenRouter API key to run Claude Code.");
+  console.log("PennyRouter can use your Claude subscription, an Anthropic API key, an OpenRouter API key, or your own Anthropic-compatible proxy to run Claude Code.");
   console.log("Choose one or more providers. PennyRouter will try them in order when available.");
   return promptFundingProviderCheckboxes(
     CLAUDE_PROVIDER_OPTIONS,
@@ -804,14 +1225,16 @@ async function selectCodexFundingProviders(flags, selected) {
 
   const supplied = new Set();
   if (flags.openaiApiKey || process.env.OPENAI_API_KEY) supplied.add("openai-api");
+  if ((flags.openaiProxyBaseUrl || process.env.PENNYROUTER_OPENAI_PROXY_BASE_URL)
+      && (flags.openaiProxyApiKey || process.env.PENNYROUTER_OPENAI_PROXY_API_KEY)) supplied.add("openai-proxy");
   if (flags.openrouterApiKey || process.env.OPENROUTER_API_KEY) supplied.add("openrouter");
   const hasChatgptLogin = await detectCodexChatgptAuth();
   if (hasChatgptLogin) supplied.add("subscription");
 
-  const explicit = flags.openaiApiKey || flags.openrouterApiKey;
+  const explicit = flags.openaiApiKey || flags.openaiProxyBaseUrl || flags.openaiProxyApiKey || flags.openrouterApiKey;
   if (explicit || flags.yes || !input.isTTY || !output.isTTY) return supplied;
 
-  console.log("PennyRouter can use your ChatGPT subscription, an OpenAI API key, or an OpenRouter API key to run Codex.");
+  console.log("PennyRouter can use your ChatGPT subscription, an OpenAI API key, an OpenAI-compatible proxy, or an OpenRouter API key to run Codex.");
   console.log("Choose one or more providers. PennyRouter will try them in order when available.");
   return promptFundingProviderCheckboxes(
     CODEX_PROVIDER_OPTIONS,
@@ -829,7 +1252,10 @@ async function maybeConfigureClaudeAnthropicAuth(flags, selected, enabled = true
     if (tokenResult.token) return tokenResult;
   }
 
-  if (flags.yes || !input.isTTY || !output.isTTY) {
+  // --config drives --yes to skip prompts, but it still expects the subscription browser
+  // sign-in to run — the caller (e.g. the macOS installer) attaches a pty for exactly this,
+  // so treat it like the interactive path rather than the plain --yes/non-TTY automation path.
+  if ((flags.yes && !flags.fromConfig) || !input.isTTY || !output.isTTY) {
     if (flags.anthropicAuth) {
       throw new Error(
         "Claude subscription auth was requested, but no Anthropic bearer token was found. Pass --token, --token-command, or ANTHROPIC_AUTH_TOKEN.",
@@ -845,7 +1271,8 @@ async function maybeConfigureClaudeAnthropicAuth(flags, selected, enabled = true
   if (commandExists("claude")) {
     // The user already opted into subscription auth above, so run `claude setup-token`
     // directly and capture the token — no copy-paste, no second confirm. The command
-    // opens the browser for approval inline. On failure we fall through to manual paste.
+    // opens the browser for approval inline. On failure we fall through to manual paste,
+    // unless we came from --config, where there's no terminal to paste into.
     console.log("Launching Claude sign-in — approve in your browser…");
     const captured = await runClaudeSetupToken();
     if (captured) {
@@ -853,8 +1280,13 @@ async function maybeConfigureClaudeAnthropicAuth(flags, selected, enabled = true
       console.log("");
       return { token: captured, source: "setup-token" };
     }
+    if (flags.fromConfig) {
+      throw new Error("Claude sign-in did not complete. Run the installer again.");
+    }
     console.log("");
     console.log("Couldn't capture a token automatically. Paste it below, or leave blank to skip.");
+  } else if (flags.fromConfig) {
+    throw new Error("Claude Code was not found on PATH, so subscription sign-in could not run.");
   } else {
     console.log("Claude Code was not found on PATH. Paste an Anthropic bearer token, or leave blank to skip.");
   }
@@ -884,6 +1316,18 @@ async function configureUserFunding(flags, selected, claudeAnthropicAuth,
   let openrouterApiKey = String(
     flags.openrouterApiKey || process.env.OPENROUTER_API_KEY || "",
   ).trim();
+  let openaiProxyBaseUrl = String(
+    flags.openaiProxyBaseUrl || process.env.PENNYROUTER_OPENAI_PROXY_BASE_URL || "",
+  ).trim();
+  let openaiProxyApiKey = String(
+    flags.openaiProxyApiKey || process.env.PENNYROUTER_OPENAI_PROXY_API_KEY || "",
+  ).trim();
+  let proxyBaseUrl = String(
+    flags.proxyBaseUrl || process.env.PENNYROUTER_PROXY_BASE_URL || "",
+  ).trim();
+  let proxyApiKey = String(
+    flags.proxyApiKey || process.env.PENNYROUTER_PROXY_API_KEY || "",
+  ).trim();
   const codexSubscriptionAuth = wantsCodex && codexProviders.has("subscription")
     ? await detectCodexChatgptAuth()
     : false;
@@ -896,6 +1340,19 @@ async function configureUserFunding(flags, selected, claudeAnthropicAuth,
     if (!interactive) throw new Error("OpenRouter was selected, but no key was provided.");
     openrouterApiKey = (await promptSecretish("OpenRouter API key: ")).trim();
   }
+  if (wantsClaude && claudeProviders.has("anthropic-proxy") && !(proxyBaseUrl && proxyApiKey)) {
+    if (!interactive) {
+      throw new Error(
+        "Other proxy was selected, but --proxy-base-url and --proxy-api-key were not both provided.",
+      );
+    }
+    // The URL is not a secret and is easy to mistype, so it echoes; the key does not.
+    if (!proxyBaseUrl) proxyBaseUrl = await promptText("Proxy base URL (e.g. https://proxy.example.com): ");
+    if (!proxyApiKey) proxyApiKey = (await promptSecretish("Proxy API key: ")).trim();
+    if (!proxyBaseUrl || !proxyApiKey) {
+      throw new Error("Other proxy requires both a base URL and an API key.");
+    }
+  }
   if (wantsCodex && codexProviders.has("subscription") && !codexSubscriptionAuth) {
     throw new Error(
       "ChatGPT subscription was selected, but Codex is not logged in. Run `codex login`, or select an API-key provider.",
@@ -905,12 +1362,20 @@ async function configureUserFunding(flags, selected, claudeAnthropicAuth,
     if (!interactive) throw new Error("OpenAI API was selected, but no key was provided.");
     openaiApiKey = (await promptSecretish("OpenAI API key: ")).trim();
   }
+  if (wantsCodex && codexProviders.has("openai-proxy") && !(openaiProxyBaseUrl && openaiProxyApiKey)) {
+    if (!interactive) throw new Error("OpenAI-compatible proxy was selected, but --openai-proxy-base-url and --openai-proxy-api-key were not both provided.");
+    if (!openaiProxyBaseUrl) openaiProxyBaseUrl = await promptText("OpenAI proxy base URL (e.g. https://proxy.example.com/v1): ");
+    if (!openaiProxyApiKey) openaiProxyApiKey = (await promptSecretish("OpenAI proxy API key: ")).trim();
+    if (!openaiProxyBaseUrl || !openaiProxyApiKey) throw new Error("OpenAI-compatible proxy requires both a base URL and an API key.");
+  }
   if (wantsCodex && codexProviders.has("openrouter") && !openrouterApiKey) {
     if (!interactive) throw new Error("OpenRouter was selected, but no key was provided.");
     openrouterApiKey = (await promptSecretish("OpenRouter API key: ")).trim();
   }
 
-  if (wantsClaude && !claudeAnthropicAuth && !anthropicApiKey && !openrouterApiKey) {
+  const claudeProxyConfigured = Boolean(proxyBaseUrl && proxyApiKey);
+  if (wantsClaude && !claudeAnthropicAuth && !anthropicApiKey && !openrouterApiKey
+      && !claudeProxyConfigured) {
     if (!interactive) {
       throw new Error(
         "Claude Code requires a Claude subscription, --anthropic-api-key (or ANTHROPIC_API_KEY), "
@@ -930,11 +1395,11 @@ async function configureUserFunding(flags, selected, claudeAnthropicAuth,
     console.log("");
   }
 
-  if (wantsCodex && !codexSubscriptionAuth && !openaiApiKey && !openrouterApiKey) {
+  if (wantsCodex && !codexSubscriptionAuth && !openaiApiKey && !openaiProxyApiKey && !openrouterApiKey) {
     if (!interactive) {
       throw new Error(
         "Codex requires ChatGPT login, --openai-api-key (or OPENAI_API_KEY), "
-        + "or --openrouter-api-key (or OPENROUTER_API_KEY). Nothing was installed.",
+        + "--openai-proxy-api-key (with --openai-proxy-base-url), or --openrouter-api-key (or OPENROUTER_API_KEY). Nothing was installed.",
       );
     }
     console.log("Codex is not logged into ChatGPT and needs a user-funded provider.");
@@ -960,19 +1425,33 @@ async function configureUserFunding(flags, selected, claudeAnthropicAuth,
   if (wantsCodex && openaiApiKey) {
     credentials.push({ provider: "openai_api", token: openaiApiKey });
   }
+  if (wantsCodex && openaiProxyBaseUrl && openaiProxyApiKey) {
+    credentials.push({ provider: "openai_proxy", token: openaiProxyApiKey,
+      metadata: { base_url: openaiProxyBaseUrl } });
+  }
   if ((wantsClaude || wantsCodex) && openrouterApiKey) {
     credentials.push({ provider: "openrouter", token: openrouterApiKey });
   }
+  if (wantsClaude && claudeProxyConfigured) {
+    credentials.push({
+      provider: "anthropic_proxy",
+      token: proxyApiKey,
+      metadata: { base_url: proxyBaseUrl },
+    });
+  }
 
   return {
     credentials,
     codexSubscriptionAuth,
     claudeCredentialProvider: claudeAnthropicAuth
       ? "claude-subscription"
-      : anthropicApiKey ? "anthropic-api" : openrouterApiKey ? "openrouter" : null,
+      : anthropicApiKey ? "anthropic-api"
+      : claudeProxyConfigured ? "anthropic-proxy"
+      : openrouterApiKey ? "openrouter" : null,
+    claudeProxyBaseUrl: claudeProxyConfigured ? proxyBaseUrl : null,
     codexCredentialProvider: codexSubscriptionAuth
       ? "chatgpt-subscription"
-      : openaiApiKey ? "openai-api" : openrouterApiKey ? "openrouter" : null,
+      : openaiApiKey ? "openai-api" : openaiProxyBaseUrl ? "openai-proxy" : openrouterApiKey ? "openrouter" : null,
   };
 }
 
@@ -1142,7 +1621,7 @@ async function uninstall(flags) {
     const ok = await runHarnessJob(failures, record.harness, "uninstall", async () => {
       if (flags.forgetToken) {
         await forgetStoredAnthropicToken(record);
-      } else if (record.anthropic_token_stored) {
+      } else if (record.anthropic_token_stored || record.proxy_base_url) {
         anthropicTokenNotice = true;
       }
       if (record.launch_available) await removePennyHarness(record.harness);
@@ -1162,7 +1641,7 @@ async function uninstall(flags) {
     await runHarnessJob(failures, record.harness, "uninstall", async () => {
       if (flags.forgetToken) {
         await forgetStoredAnthropicToken(record);
-      } else if (record.anthropic_token_stored) {
+      } else if (record.anthropic_token_stored || record.proxy_base_url) {
         anthropicTokenNotice = true;
       }
       if (record.launch_available) await removePennyHarness(record.harness);
@@ -1171,6 +1650,10 @@ async function uninstall(flags) {
     });
   }
 
+  // Only entries PennyRouter wrote are removed, so a server the user re-pointed at their own
+  // build survives an uninstall.
+  await registerMcp(selectedRecords.map((record) => record.harness), { remove: true });
+
   if (anthropicTokenNotice) {
     console.log("");
     console.log("Note: Your stored Anthropic token remains on the server for other machines.");
@@ -1252,8 +1735,13 @@ async function status() {
     if (record.disabled_at) console.log(`  disabled: ${record.disabled_at}`);
     if (record.anthropic_oauth) console.log(`  Claude subscription auth: enabled (${record.token_source || "unknown"} token)`);
     if (record.openai_subscription_auth) console.log("  OpenAI subscription auth: enabled (Codex-managed login)");
+    if (record.proxy_base_url) {
+      const note = record.anthropic_oauth ? " (subscription takes precedence)" : "";
+      console.log(`  Upstream proxy: ${record.proxy_base_url}${note}`);
+    }
     if (record.launch_available) {
-      const command = record.harness === "claude-code" ? "penny claude" : "penny codex";
+      const command = record.harness === "claude-code"
+        ? "penny claude" : record.harness === "codex" ? "penny codex" : "penny opencode";
       console.log(`  command: ${command}`);
       console.log(`  bare command: ${record.default_routing ? "PennyRouter" : "native"}`);
     }
@@ -1562,14 +2050,24 @@ function formatError(error) {
 // live config BEFORE harness.uninstall strips them. Never throws — a local uninstall
 // must not be blocked by a network hiccup; the record is going away regardless.
 async function forgetStoredAnthropicToken(record) {
-  if (record.harness !== "claude-code" || !record.anthropic_token_stored) return;
+  if (record.harness !== "claude-code") return;
+  if (!record.anthropic_token_stored && !record.proxy_base_url) return;
   try {
     const launchConfig = await loadPennyConfig();
     const globalAuth = await readClaudeCodeGatewayAuth();
     const gatewayBaseUrl = launchConfig.gateway_base_url || globalAuth.gatewayBaseUrl;
     const apiKey = launchConfig.api_key || globalAuth.apiKey;
     if (!gatewayBaseUrl || !apiKey) return;
-    await forgetAnthropicToken({ gatewayBaseUrl, apiKey });
+    if (record.anthropic_token_stored) {
+      await forgetAnthropicToken({ gatewayBaseUrl, apiKey });
+    }
+    // The proxy key is stored server-side exactly like the subscription token, so the
+    // same "forget my credentials" gesture has to clear it too.
+    if (record.proxy_base_url) {
+      await forgetUpstreamCredential({
+        gatewayBaseUrl, apiKey, provider: "anthropic_proxy",
+      });
+    }
   } catch {
     // swallow — see note above
   }
@@ -1582,6 +2080,15 @@ async function confirm(question) {
   return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
 }
 
+// Visible-echo input, for values that are not secrets. A mistyped proxy URL is a
+// confusing failure much later, so the user gets to see what they typed.
+async function promptText(question) {
+  const rl = createInterface({ input, output });
+  const answer = await rl.question(question);
+  rl.close();
+  return answer.trim();
+}
+
 async function promptSecretish(question) {
   if (!input.isTTY || !output.isTTY) {
     const rl = createInterface({ input, output });
@@ -1656,58 +2163,38 @@ function openBrowser(url) {
   spawnSync(command, args, { stdio: "ignore", detached: true });
 }
 
-function runningClaudeCodeProcesses() {
-  if (process.platform === "win32") {
-    const result = spawnSync("tasklist", ["/FO", "CSV", "/NH"], { encoding: "utf8" });
-    if (result.status !== 0) return [];
-    return String(result.stdout || "").split(/\r?\n/)
-      .filter((line) => /^"claude(?:\.exe)?"/i.test(line.trim()));
-  }
-  const result = spawnSync("ps", ["-ax", "-o", "pid=,command="], { encoding: "utf8" });
-  if (result.status !== 0) return [];
-  return String(result.stdout || "").split(/\r?\n/)
-    .map((line) => line.trim())
-    // Case-sensitive on purpose: match the Claude Code executable, not Claude.app.
-    .filter((line) => /(^|[\/\s])claude(?:\s|$)/.test(line));
-}
-
-function runningCodexProcesses() {
-  if (process.platform === "win32") return [];
-  const result = spawnSync("ps", ["-ax", "-o", "pid=,command="], { encoding: "utf8" });
-  if (result.status !== 0) return [];
-  return String(result.stdout || "").split(/\r?\n/)
-    .map((line) => line.trim())
-    .filter((line) => /(^|[\/\s])codex(?:\s|$)/.test(line));
-}
-
-function assertNoRunningHarness(harnessId, flags) {
-  if (flags.allowRunningHarnesses || (harnessId === "claude-code" && flags.allowRunningClaude)) {
-    return;
-  }
-  const running = harnessId === "claude-code"
-    ? runningClaudeCodeProcesses()
-    : runningCodexProcesses();
-  if (running.length === 0) return;
-  const name = harnessId === "claude-code" ? "Claude Code" : "Codex";
-  throw new Error(
-    `${name} is currently running. Close all ${name} sessions before changing its global routing. `
-    + "Installing only the explicit `penny` command does not require this. If you intentionally "
-    + "accept the risk, pass --allow-running-harnesses.\nDetected:\n  "
-    + running.slice(0, 5).join("\n  "),
-  );
-}
-
 function printHelp() {
   console.log(`PennyRouter CLI
 
 Usage:
-  pennyrouter install [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes] [--dry-run] [--make-default|--penny-only] [--no-path-update] [--anthropic-auth|--no-anthropic-auth] [--anthropic-api-key KEY] [--openai-api-key KEY] [--openrouter-api-key KEY] [--local[=URL]] [--allow-running-harnesses]
-  pennyrouter update [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--dry-run] [--penny-key pr-...] [--gateway-base-url URL] [--allow-running-harnesses]
+  pennyrouter install [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes] [--dry-run] [--make-default|--penny-only] [--no-path-update] [--no-mcp] [--anthropic-auth|--no-anthropic-auth] [--anthropic-api-key KEY] [--openai-api-key KEY] [--openai-proxy-base-url URL --openai-proxy-api-key KEY] [--openrouter-api-key KEY] [--proxy-base-url URL --proxy-api-key KEY] [--gateway-base-url URL --private-key pr-...] [--local[=URL]|--prod] [--config PATH]
+  pennyrouter update [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--dry-run] [--penny-key pr-...] [--gateway-base-url URL|--local[=URL]|--prod] [--no-mcp]
   pennyrouter auth anthropic [--penny-key pr-...] [--token oauth-token] [--token-command CMD] [--gateway-base-url URL] [--forget]
   pennyrouter disable [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes]
   pennyrouter enable [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes]
   pennyrouter uninstall [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes] [--forget-token]
   pennyrouter status
+  pennyrouter mcp install|uninstall|status [--harness claude-code,codex]
+
+When an interactive install selects an Anthropic or OpenAI-compatible proxy, it asks for the PennyRouter gateway
+that can reach that proxy. Leave it blank for the hosted gateway, or enter a private/self-hosted
+gateway URL. Use --gateway-base-url (or --local for localhost:8400 development) for non-interactive installs.
+
+A private gateway keeps its own keys, so the key from the browser login does not work there. Whenever
+you point install at one — with --gateway-base-url or by entering a URL at that prompt — you must also
+supply the key your PennyRouter administrator issued you: paste it when asked, or pass --private-key pr-...
+
+Install and update both register the Threads MCP server with Claude Code and Codex (--no-mcp to
+skip a run). Run "pennyrouter mcp install" if you skipped it or had to rename a conflicting
+server, "pennyrouter mcp status" to see whether it is wired up, and "pennyrouter mcp uninstall"
+to remove it. Bare "pennyrouter mcp" is the server itself, run by those harnesses over stdio —
+you never invoke it by hand.
+
+Once registered, ask your agent to read or resume an AI share link:
+
+  thread_read <url>    pull a ChatGPT/Claude/Gemini/Perplexity conversation into the chat
+  thread_resume <url>  write it as a resumable session and print the resume command
+                       (harness: claude-code by default, or codex)
 
 Update refreshes the managed local config and the penny runtime to this package version.
 It reuses your existing key and never re-asks for subscription or API credentials.
@@ -1716,16 +2203,22 @@ Examples:
   npx pennyrouter update
   npx pennyrouter update --dry-run
   npx pennyrouter update --harness claude-code
+  npx pennyrouter update --harness codex --local
+  npx pennyrouter update --all --local
+  npx pennyrouter update --all --prod
   npx pennyrouter install
   npx pennyrouter install --make-default
   npx pennyrouter install --penny-only
   npx pennyrouter install --harness claude-code --anthropic-auth --token <token>
   npx pennyrouter install --harness claude-code --anthropic-api-key <key>
   npx pennyrouter install --harness codex --openai-api-key <key>
+  npx pennyrouter install --harness claude-code --proxy-base-url https://proxy.example.com --proxy-api-key <key>
   npx pennyrouter install --openrouter-api-key <key>
+  npx pennyrouter install --gateway-base-url https://gateway.internal.example.com --private-key pr-...
   npx pennyrouter auth anthropic
   npx pennyrouter install --all
   npx pennyrouter install --harness windsurf,zed,codegpt,aider --yes
+  npx pennyrouter install --config ./penny_install.json
   npx pennyrouter disable
   npx pennyrouter enable
   npx pennyrouter uninstall