virouter 0.2.4 → 0.2.6

package/README.md

@@ -17,16 +17,15 @@ $env:VIROUTER_API_ORIGIN="http://127.0.0.1:8787"
 npx virouter@latest
 ```
 
-On the first install, the installer displays the API key while you type it, asks for the operating
-system and default model, and configures:
-
-- `1` = Windows
-- `2` = macOS
-- `3` = Linux
+On the first install, the installer detects the machine (Windows, macOS, Linux or WSL — it no
+longer asks), checks the key against the gateway and shows it masked with its plan, credit and
+expiry, asks for the default model, and configures:
 
 - `ANTHROPIC_BASE_URL=https://virouter.click`
 - `ANTHROPIC_AUTH_TOKEN`
 - `model` in `~/.claude/settings.json` — `claude-fable-5-1` on a first install
+- `env.ANTHROPIC_DEFAULT_MODEL` in the same file, so the `/model` picker's "Default" row resolves
+  to a VIROUTER model instead of Claude Code's own default (a choice saved with `/model` still wins)
 - `ANTHROPIC_SMALL_FAST_MODEL=claude-haiku-4-5`
 - `VIROUTER_API_KEY` for OpenCode
 - `~/.config/opencode/opencode.json` with VIROUTER as the default provider
@@ -43,18 +42,56 @@ back to the install-time model. An install that pinned it is migrated — that m
 `settings.json`. Only if `settings.json` is not valid JSON does the installer leave it untouched
 and fall back to pinning `ANTHROPIC_MODEL`.
 
-The installer uses visible input and prints the received key for confirmation. Do not record or
-share that terminal output.
+The key is visible while you type it; afterwards the installer only ever prints it masked
+(`viro_AbCd…UvWx`). Do not record or share the terminal while typing it.
 
 When an OpenCode configuration already exists, its enabled providers and credentials are
 preserved; VIROUTER is appended and selected as the default provider. A new configuration
 enables only VIROUTER. This allows existing ClaudeKit/ECC/OpenCode workflows to continue
 without losing their provider setup.
 
-The installer never replaces `.claude/` skills, rules, agents, or hooks. In `~/.claude/settings.json`
-it sets only the `model` key (and drops an `env.ANTHROPIC_MODEL` pin); every other setting is
-kept. If it detects ClaudeKit or ECC, it reports that configuration and otherwise only writes
-gateway environment variables plus the OpenCode provider entry.
+The installer never replaces `.claude/` skills, rules, agents, or hooks.
+
+### Taking over a machine that already ran Claude Code elsewhere
+
+An `env` block in `~/.claude/settings.json` beats the shell — Claude Code writes each entry into
+its own environment, replacing what `~/.zshrc` or the installer's launch passed in. A machine that
+another tool once pointed at its own proxy or gateway therefore kept going there (a dead
+`127.0.0.1` port shows up as `ECONNREFUSED`) however often the shell profile was rewritten.
+
+Since 0.2.6 the installer writes the route where it wins, in `~/.claude/settings.json`:
+
+- `env.ANTHROPIC_BASE_URL` and `env.ANTHROPIC_AUTH_TOKEN` — replacing whatever was there, and
+  reported (`Thay địa chỉ cũ …`). This is also what the VS Code extension and other GUI launches
+  read, since they never source a shell profile.
+- removes `env.ANTHROPIC_API_KEY`, `env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` and the
+  cloud-provider switches `CLAUDE_CODE_USE_BEDROCK` / `_VERTEX` / `_FOUNDRY`, which outrank the
+  token outright; one the shell exports is pinned to `0`, since a settings file cannot unset it.
+- copies the old file to `settings.json.bak-virouter-<timestamp>` first. Every other key is kept.
+
+### VS Code, Cursor, Windsurf
+
+The Claude Code extension reads the route from `~/.claude/settings.json`, but opens on its
+Anthropic sign-in screen unless `claudeCode.disableLoginPrompt` is on. The installer sets it in
+the user `settings.json` of every installed editor (VS Code, Insiders, Cursor, Windsurf,
+VSCodium), with a backup. A file with comments is not rewritten — the installer says so and the
+setting has to be ticked by hand. `--doctor` reports it per editor.
+
+macOS also gets the block in `~/.bash_profile`, the file a bash login shell actually reads.
+
+What the installer cannot change it reports before launching: an organisation's managed settings
+(`/Library/Application Support/ClaudeCode/managed-settings.json`, `/etc/claude-code/…`,
+`C:\Program Files\ClaudeCode\…`), a project's own `.claude/settings*.json` that sets a URL or key,
+stale exports elsewhere in shell profiles, and a proxy variable (`HTTPS_PROXY`, …) pointing at
+nothing — Node's `fetch` ignores those, so the key check passes while Claude Code is refused.
+
+To see what decides the URL and key on a machine, without changing anything:
+
+```bash
+npx virouter@latest --doctor
+```
+
+If it detects ClaudeKit or ECC, it reports that configuration and leaves it in place.
 
 The customer key is never stored in this package or repository. Obtain it from the one-time
 claim/recovery flow documented in `docs/claude-code-setup.md`; do not use an upstream

package/bin/virouter.mjs

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 
 import { execFileSync } from 'node:child_process';
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
+import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { connect } from 'node:net';
+import { arch, homedir, hostname, release } from 'node:os';
 import { join } from 'node:path';
 import { createInterface } from 'node:readline/promises';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath } from 'node:url';
 
 const API_ORIGIN = (process.env.VIROUTER_API_ORIGIN || 'https://virouter.click').replace(/\/$/, '');
 const MARKER_START = '# >>> VIROUTER CLAUDE CODE CONFIG >>>';
@@ -28,6 +29,17 @@ const VIROUTER_MODELS = [
   'claude-haiku-4-5-alt',
 ];
 
+/**
+ * Variables that take Claude Code away from VIROUTER when another tool left them behind. The
+ * cloud-provider switches outrank ANTHROPIC_AUTH_TOKEN outright (Claude Code's authentication
+ * precedence), so with one of them set our base URL and key are never used at all.
+ */
+const CLOUD_PROVIDER_SWITCHES = ['CLAUDE_CODE_USE_BEDROCK', 'CLAUDE_CODE_USE_VERTEX', 'CLAUDE_CODE_USE_FOUNDRY'];
+const STALE_ENV = ['ANTHROPIC_API_KEY', 'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC', ...CLOUD_PROVIDER_SWITCHES];
+/** What Claude Code reads to decide where requests go and how they authenticate. */
+const ROUTING_ENV = ['ANTHROPIC_BASE_URL', 'ANTHROPIC_AUTH_TOKEN', 'ANTHROPIC_API_KEY', ...CLOUD_PROVIDER_SWITCHES];
+const PROXY_ENV = ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'ALL_PROXY', 'all_proxy'];
+
 function printHelp() {
 console.log(`VIROUTER Claude Code + OpenCode installer
 
@@ -36,36 +48,66 @@ Usage:
   npx virouter@latest --help
   npx virouter@latest --no-launch
   npx virouter@latest --reuse-key
+  npx virouter@latest --doctor     # what decides Claude Code's URL and key on this machine
 
   The installer configures Claude Code and OpenCode to use ${API_ORIGIN}.
 For local testing, set VIROUTER_API_ORIGIN=http://127.0.0.1:8787.
   It does not install a server or store a local model.`);
 }
 
+// Colour only on a real terminal, and never when NO_COLOR is set (https://no-color.org).
+const USE_COLOR = Boolean(process.stdout.isTTY) && !process.env.NO_COLOR;
+const paint = (code) => (text) => (USE_COLOR ? `\x1b[${code}m${text}\x1b[0m` : String(text));
+const style = {
+  bold: paint('1'),
+  dim: paint('2'),
+  red: paint('31'),
+  green: paint('32'),
+  yellow: paint('33'),
+  cyan: paint('36'),
+};
+
+/** Enough of the key to recognise it, never enough to use it. */
+export function maskKey(key) {
+  return key.length > 16 ? `${key.slice(0, 9)}…${key.slice(-4)}` : `${key.slice(0, 5)}…`;
+}
+
+/**
+ * The machine the installer is configuring. Detected rather than asked: picking the wrong
+ * number wrote a shell profile on Windows or `setx` on Linux, and neither failed loudly.
+ */
+export function detectMachine(platform = process.platform) {
+  if (platform === 'win32') return { os: '1', name: 'Windows' };
+  if (platform === 'darwin') return { os: '2', name: 'macOS' };
+  let wsl = false;
+  try {
+    wsl = /microsoft/i.test(readFileSync('/proc/version', 'utf8'));
+  } catch {
+    // Not Linux proper, or /proc is unavailable; plain Linux it is.
+  }
+  return { os: '3', name: wsl ? 'Linux (WSL)' : 'Linux' };
+}
+
+function step(label, detail = '') {
+  console.log(`${style.green('✓')} ${label}${detail ? ` ${style.dim(detail)}` : ''}`);
+}
+
 async function readVisibleInput(prompt) {
   const line = createInterface({ input: process.stdin, output: process.stdout, terminal: true });
   const answer = await line.question(prompt);
   line.close();
-  const value = answer.trim();
-  console.log(`\nĐã nhận customer key: ${value}`);
-  return value;
-}
-
-async function chooseOs(input) {
-  console.log('Hệ điều hành:');
-  console.log('  ● 1 = Windows');
-  console.log('  ● 2 = macOS');
-  console.log('  ● 3 = Linux');
-  const answer = (await input.question('Chọn số (1/2/3): ')).trim();
-  if (!['1', '2', '3'].includes(answer)) throw new Error('Chọn 1, 2 hoặc 3.');
-  return answer;
+  return answer.trim();
 }
 
 async function chooseModel(input, currentModel) {
-  console.log('\nModel mặc định cho Claude Code:');
-  VIROUTER_MODELS.forEach((model, index) => console.log(`  ${index + 1} = ${model}`));
+  console.log(`\n${style.bold('Model mặc định cho Claude Code')} ${style.dim('(đổi lại bất cứ lúc nào bằng /model)')}`);
   const defaultIndex = Math.max(0, VIROUTER_MODELS.indexOf(currentModel));
-  const answer = (await input.question(`Chọn số [${defaultIndex + 1}]: `)).trim() || String(defaultIndex + 1);
+  VIROUTER_MODELS.forEach((model, index) => {
+    const isDefault = index === defaultIndex;
+    const number = style.cyan(String(index + 1).padStart(2));
+    console.log(`  ${number}  ${isDefault ? style.bold(model) : model}${isDefault ? style.green('  ← mặc định') : ''}`);
+  });
+  const answer = (await input.question(`Chọn số ${style.dim(`[${defaultIndex + 1}]`)}: `)).trim() || String(defaultIndex + 1);
   const selected = VIROUTER_MODELS[Number(answer) - 1];
   if (!selected) throw new Error('Lựa chọn model không hợp lệ.');
   return selected;
@@ -75,8 +117,8 @@ function existingConfig() {
   const candidates = process.platform === 'win32'
     ? []
     : process.platform === 'darwin'
-      ? [join(homedir(), '.zshrc'), join(homedir(), '.bashrc')]
-      : [join(homedir(), '.bashrc'), join(homedir(), '.zshrc')];
+      ? profilePaths('2')
+      : profilePaths('3');
   const sources = candidates
     .filter((path) => existsSync(path))
     .map((path) => readFileSync(path, 'utf8'));
@@ -125,21 +167,134 @@ export function resolveStartingModel(settingsModel, legacyModel) {
   return null;
 }
 
-/** Returns new settings with `model` set and any ANTHROPIC_MODEL pin removed from `env`. */
+/**
+ * Returns new settings with `model` set, any ANTHROPIC_MODEL pin removed from `env`, and the
+ * picker's "Default" row pointed at VIROUTER's default.
+ *
+ * `/model` always lists a "Default (recommended)" row that resolves to Claude Code's own
+ * runtime default — a model name this gateway may not serve. ANTHROPIC_DEFAULT_MODEL makes
+ * that row resolve to ours instead ("Set by ANTHROPIC_DEFAULT_MODEL"), and unlike
+ * ANTHROPIC_MODEL it does not override a choice the customer saved with /model.
+ */
 export function withRememberedModel(settings, model) {
-  const next = { ...settings, model };
-  if (next.env && typeof next.env === 'object' && 'ANTHROPIC_MODEL' in next.env) {
-    const { ANTHROPIC_MODEL: _pinned, ...env } = next.env;
-    next.env = env;
-  }
-  return next;
+  const currentEnv = settings.env && typeof settings.env === 'object' ? settings.env : {};
+  const { ANTHROPIC_MODEL: _pinned, ...env } = currentEnv;
+  if (!VIROUTER_MODELS.includes(env.ANTHROPIC_DEFAULT_MODEL)) env.ANTHROPIC_DEFAULT_MODEL = DEFAULT_MODEL;
+  return { ...settings, model, env };
+}
+
+/**
+ * Settings that route Claude Code to VIROUTER on any machine, whatever was there before.
+ *
+ * An `env` block in a settings file beats the shell: Claude Code writes each entry into its
+ * process environment, replacing what the shell (or this installer's launch) passed in. So a
+ * machine that once pointed ~/.claude/settings.json at another proxy or gateway kept going
+ * there — or to a dead localhost port, ECONNREFUSED — however many times the installer
+ * rewrote ~/.zshrc. The URL and key therefore live here, where they win, and where the VS Code
+ * extension and other GUI launches, which never read a shell profile, can see them too.
+ *
+ * Returns the new settings, the stale variables it dropped, the cloud-provider switches it
+ * pinned off (one exported by the shell cannot be removed from here) and the URL it replaced.
+ */
+export function withVirouterSettings(settings, { apiKey, model, origin = API_ORIGIN, shellEnv = process.env }) {
+  const remembered = withRememberedModel(settings, model);
+  const env = { ...remembered.env };
+  const previousBaseUrl = typeof env.ANTHROPIC_BASE_URL === 'string' && env.ANTHROPIC_BASE_URL !== origin
+    ? env.ANTHROPIC_BASE_URL
+    : null;
+  const removed = STALE_ENV.filter((name) => name in env);
+  for (const name of removed) delete env[name];
+  const disabled = CLOUD_PROVIDER_SWITCHES.filter((name) => isTruthy(shellEnv[name]));
+  for (const name of disabled) env[name] = '0';
+  Object.assign(env, {
+    ANTHROPIC_BASE_URL: origin,
+    ANTHROPIC_AUTH_TOKEN: apiKey,
+    ANTHROPIC_SMALL_FAST_MODEL: 'claude-haiku-4-5',
+    CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY: '1',
+  });
+  return { settings: { ...remembered, env }, removed, disabled, previousBaseUrl };
+}
+
+function isTruthy(value) {
+  return typeof value === 'string' && /^(1|true|yes|on)$/i.test(value.trim());
 }
 
 function writeClaudeSettings(path, settings) {
   mkdirSync(join(path, '..'), { recursive: true });
+  if (existsSync(path)) {
+    // The customer's own settings are worth a copy before we rewrite them.
+    const stamp = new Date().toISOString().replace(/[-:]/g, '').replace(/\..*/, '');
+    copyFileSync(path, `${path}.bak-virouter-${stamp}`);
+  }
   writeFileSync(path, `${JSON.stringify(settings, null, 2)}\n`, { mode: 0o600 });
 }
 
+/** VS Code and its forks that host the Claude Code extension, by user-data folder name. */
+const EDITORS = ['Code', 'Code - Insiders', 'Cursor', 'Windsurf', 'VSCodium'];
+const LOGIN_PROMPT_SETTING = 'claudeCode.disableLoginPrompt';
+
+/**
+ * Where each editor keeps its user settings.json. Only editors whose user-data folder already
+ * exists are returned — the installer never creates an editor's folder.
+ */
+export function editorSettingsPaths({ platform = process.platform, home = homedir(), env = process.env } = {}) {
+  const base = platform === 'win32'
+    ? env.APPDATA || join(home, 'AppData', 'Roaming')
+    : platform === 'darwin'
+      ? join(home, 'Library', 'Application Support')
+      : env.XDG_CONFIG_HOME || join(home, '.config');
+  return EDITORS
+    .filter((name) => existsSync(join(base, name)))
+    .map((name) => ({ name, path: join(base, name, 'User', 'settings.json') }));
+}
+
+/**
+ * The editor setting the Claude Code extension needs to talk to a gateway at all.
+ *
+ * Without it the extension opens on its Anthropic sign-in screen and never starts a session,
+ * however correct the URL and key in ~/.claude/settings.json are — the CLI in the same
+ * editor's terminal works, the panel does not. Returns null when the file is not plain JSON
+ * (VS Code allows comments): rewriting it would drop them, so that case is left to the user.
+ */
+export function withLoginPromptDisabled(text) {
+  if (!text.trim()) return { [LOGIN_PROMPT_SETTING]: true };
+  let settings;
+  try {
+    settings = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (!settings || typeof settings !== 'object' || Array.isArray(settings)) return null;
+  return { ...settings, [LOGIN_PROMPT_SETTING]: true };
+}
+
+/** Sets the login-prompt switch in every installed editor. Returns what happened per editor. */
+function configureEditors() {
+  return editorSettingsPaths().map(({ name, path }) => {
+    const text = existsSync(path) ? readFileSync(path, 'utf8') : '';
+    const next = withLoginPromptDisabled(text);
+    if (!next) return { name, path, outcome: 'manual' };
+    if (text.trim() && JSON.parse(text)[LOGIN_PROMPT_SETTING] === true) return { name, path, outcome: 'already' };
+    try {
+      writeClaudeSettings(path, next);
+      return { name, path, outcome: 'set' };
+    } catch {
+      return { name, path, outcome: 'manual' };
+    }
+  });
+}
+
+function reportEditors(results) {
+  for (const { name, path, outcome } of results) {
+    if (outcome === 'manual') {
+      console.log(`${style.yellow('!')} ${name}: không tự sửa được ${path} (có comment hoặc không ghi được).`);
+      console.log(style.dim('  Mở Settings, tìm "Disable Login Prompt" (Claude Code) và tích chọn — nếu không, extension sẽ đòi đăng nhập Anthropic.'));
+    } else {
+      step(`${name} extension`, `${LOGIN_PROMPT_SETTING} = true${outcome === 'set' ? ' — tải lại cửa sổ (Developer: Reload Window)' : ''}`);
+    }
+  }
+}
+
 function detectAgentToolkit() {
   const candidates = [
     join(process.cwd(), '.claude', '.ck.json'),
@@ -199,6 +354,7 @@ function configLines(apiKey, pinnedModel) {
     // traffic must stay enabled or discovery is skipped.
     'export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY="1"',
     'unset CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC',
+    `unset ${CLOUD_PROVIDER_SWITCHES.join(' ')}`,
   ];
 }
 
@@ -211,16 +367,19 @@ function updateProfile(path, lines) {
   return path;
 }
 
-function configureWindows(apiKey, pinnedModel) {
-  if (!pinnedModel) {
-    // An empty `setx` value is still a variable; delete the old pin outright so `/model` in
-    // ~/.claude/settings.json decides. Absent already is fine.
-    try {
-      execFileSync('reg', ['delete', 'HKCU\\Environment', '/v', 'ANTHROPIC_MODEL', '/f'], { stdio: 'ignore' });
-    } catch {
-      // Nothing to delete.
-    }
+function deleteWindowsUserVariable(name) {
+  // An empty `setx` value is still a variable; delete it outright. Absent already is fine.
+  try {
+    execFileSync('reg', ['delete', 'HKCU\\Environment', '/v', name, '/f'], { stdio: 'ignore' });
+  } catch {
+    // Nothing to delete.
   }
+}
+
+function configureWindows(apiKey, pinnedModel) {
+  // Without the pin, `/model` in ~/.claude/settings.json decides.
+  if (!pinnedModel) deleteWindowsUserVariable('ANTHROPIC_MODEL');
+  for (const name of CLOUD_PROVIDER_SWITCHES) deleteWindowsUserVariable(name);
   const values = {
     ANTHROPIC_BASE_URL: API_ORIGIN,
     ANTHROPIC_AUTH_TOKEN: apiKey,
@@ -291,16 +450,172 @@ function configureOpenCode(apiKey, model) {
   return path;
 }
 
+/**
+ * Shell files the config block goes into. macOS Terminal starts bash as a login shell, which
+ * reads ~/.bash_profile and never ~/.bashrc — a bash user on a Mac got no configuration.
+ */
+export function profilePaths(os, home = homedir()) {
+  return os === '2'
+    ? [join(home, '.zshrc'), join(home, '.bash_profile'), join(home, '.bashrc')]
+    : [join(home, '.bashrc'), join(home, '.zshrc')];
+}
+
 function configureUnix(os, apiKey, pinnedModel) {
   const lines = configLines(apiKey, pinnedModel);
-  const profiles = os === '2'
-    ? [join(homedir(), '.zshrc'), join(homedir(), '.bashrc')]
-    : [join(homedir(), '.bashrc'), join(homedir(), '.zshrc')];
-
+  const profiles = profilePaths(os);
   for (const profile of profiles) updateProfile(profile, lines);
-  return profiles.join(' and ');
+  return profiles.map((path) => path.replace(homedir(), '~')).join(', ');
+}
+
+/** Where an organisation's policy file lives. Nothing a user writes can override it. */
+export function managedSettingsPath(platform = process.platform) {
+  if (platform === 'darwin') return '/Library/Application Support/ClaudeCode/managed-settings.json';
+  if (platform === 'win32') return 'C:\\Program Files\\ClaudeCode\\managed-settings.json';
+  return '/etc/claude-code/managed-settings.json';
+}
+
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
 }
 
+/**
+ * Everything on this machine that can still decide Claude Code's URL or key after we have
+ * written ours, highest precedence first. `block` cannot be fixed by the installer (an
+ * organisation's managed settings); `warn` wins over ~/.claude/settings.json in some sessions
+ * (a project's own settings); `info` is shadowed by our settings but worth knowing about.
+ */
+export function findOverrides({ cwd = process.cwd(), home = homedir(), platform = process.platform, managedPath } = {}) {
+  const found = [];
+  const routingKeys = (env) => (env && typeof env === 'object' ? ROUTING_ENV.filter((name) => name in env) : []);
+
+  const managedFile = managedPath ?? managedSettingsPath(platform);
+  const managed = existsSync(managedFile) ? readJson(managedFile) : null;
+  if (managed) {
+    const keys = routingKeys(managed.env);
+    if (keys.length) found.push({ level: 'block', where: managedFile, detail: `đặt ${keys.join(', ')}` });
+    if (managed.forceLoginMethod) found.push({ level: 'block', where: managedFile, detail: `forceLoginMethod=${managed.forceLoginMethod}` });
+    if (Array.isArray(managed.allowedProviders) && !managed.allowedProviders.includes('customEndpoint')) {
+      found.push({ level: 'block', where: managedFile, detail: 'allowedProviders không cho phép gateway riêng' });
+    }
+  }
+
+  for (const name of ['settings.local.json', 'settings.json']) {
+    const path = join(cwd, '.claude', name);
+    if (path === join(home, '.claude', name) || !existsSync(path)) continue;
+    const keys = routingKeys(readJson(path)?.env);
+    if (keys.length) found.push({ level: 'warn', where: path, detail: `đặt ${keys.join(', ')} cho riêng dự án này` });
+  }
+
+  if (platform !== 'win32') {
+    const exported = new RegExp(`^\\s*(?:export\\s+|set\\s+-gx\\s+)?(${ROUTING_ENV.join('|')})[=\\s]`);
+    for (const file of ['.zshenv', '.zprofile', '.zshrc', '.zlogin', '.bash_profile', '.bashrc', '.profile', join('.config', 'fish', 'config.fish')]) {
+      const path = join(home, file);
+      if (!existsSync(path)) continue;
+      let inside = false;
+      readFileSync(path, 'utf8').split('\n').forEach((line, index) => {
+        if (line.includes(MARKER_START)) inside = true;
+        const name = !inside && exported.exec(line)?.[1];
+        if (name) found.push({ level: 'info', where: `${path}:${index + 1}`, detail: `${name} ngoài khối VIROUTER` });
+        if (line.includes(MARKER_END)) inside = false;
+      });
+    }
+  }
+  return found;
+}
+
+/** Proxy variables Claude Code will use, from the shell or a settings `env` block. */
+export function proxySettings(env = process.env, settingsEnv = {}) {
+  const merged = { ...env, ...(settingsEnv && typeof settingsEnv === 'object' ? settingsEnv : {}) };
+  return PROXY_ENV.filter((name) => merged[name]).map((name) => ({ name, url: merged[name] }));
+}
+
+/**
+ * Whether anything is listening at a proxy URL. Node's fetch ignores HTTPS_PROXY, so the key
+ * check below succeeds even when the proxy is dead — while Claude Code, which honours it, gets
+ * ECONNREFUSED on every request ("a firewall or proxy may be blocking it").
+ */
+export function probeProxy(url, timeoutMs = 1500) {
+  let target;
+  try {
+    target = new URL(url.includes('://') ? url : `http://${url}`);
+  } catch {
+    return Promise.resolve('invalid');
+  }
+  const port = Number(target.port) || (target.protocol === 'https:' ? 443 : 80);
+  return new Promise((resolve) => {
+    const socket = connect({ host: target.hostname, port });
+    const done = (verdict) => {
+      socket.destroy();
+      resolve(verdict);
+    };
+    socket.setTimeout(timeoutMs, () => done('timeout'));
+    socket.once('connect', () => done('ok'));
+    socket.once('error', (error) => done(error.code === 'ECONNREFUSED' ? 'refused' : 'error'));
+  });
+}
+
+async function reportOverrides(settingsEnv) {
+  const found = findOverrides();
+  const proxies = proxySettings(process.env, settingsEnv);
+  const dead = [];
+  for (const proxy of proxies) {
+    const verdict = await probeProxy(proxy.url);
+    if (verdict !== 'ok') dead.push({ ...proxy, verdict });
+  }
+  for (const item of found) {
+    const mark = item.level === 'info' ? style.dim('·') : style.yellow('!');
+    console.log(`${mark} ${item.detail} ${style.dim(`— ${item.where}`)}`);
+  }
+  if (found.some((item) => item.level === 'block')) {
+    console.log(style.yellow('  Cấu hình do tổ chức quản lý (managed settings) luôn thắng — cần IT gỡ hoặc cho phép gateway riêng.'));
+  }
+  if (found.some((item) => item.level === 'warn')) {
+    console.log(style.dim('  File .claude/settings*.json của dự án thắng cấu hình chung — xóa các biến đó trong file nếu dự án không cần.'));
+  }
+  for (const proxy of dead) {
+    console.log(`${style.yellow('!')} Proxy ${proxy.name}=${proxy.url} không phản hồi (${proxy.verdict}) — Claude Code sẽ báo ECONNREFUSED.`);
+  }
+  if (dead.length) {
+    console.log(style.dim(`  Bật lại phần mềm proxy, hoặc xóa ${dead.map((proxy) => proxy.name).join(', ')} khỏi shell profile / settings.json.`));
+  }
+  return { found, dead };
+}
+
+async function doctor() {
+  console.log(`\n${style.bold(style.cyan('VIROUTER'))} ${style.bold('· doctor')}`);
+  console.log(style.dim(`Gateway  ${API_ORIGIN}`));
+  const { path, settings, writable } = readClaudeSettings();
+  const env = settings.env && typeof settings.env === 'object' ? settings.env : {};
+  if (!writable) console.log(`${style.yellow('!')} ${path} không phải JSON hợp lệ — Claude Code sẽ báo lỗi và bỏ qua nó.`);
+  const baseUrl = env.ANTHROPIC_BASE_URL ?? process.env.ANTHROPIC_BASE_URL ?? '(chưa đặt)';
+  const token = env.ANTHROPIC_AUTH_TOKEN ?? process.env.ANTHROPIC_AUTH_TOKEN;
+  const mark = baseUrl === API_ORIGIN ? style.green('✓') : style.yellow('!');
+  console.log(`${mark} ANTHROPIC_BASE_URL ${baseUrl} ${style.dim(env.ANTHROPIC_BASE_URL ? `(${path})` : '(shell)')}`);
+  console.log(`${token ? style.green('✓') : style.yellow('!')} ANTHROPIC_AUTH_TOKEN ${token ? maskKey(token) : '(chưa đặt)'}`);
+  for (const name of CLOUD_PROVIDER_SWITCHES) {
+    const value = env[name] ?? process.env[name];
+    if (isTruthy(value)) console.log(`${style.yellow('!')} ${name}=${value} — Claude Code sẽ dùng cloud provider thay vì VIROUTER.`);
+  }
+  for (const { name, path } of editorSettingsPaths()) {
+    const enabled = existsSync(path) && readJson(path)?.[LOGIN_PROMPT_SETTING] === true;
+    console.log(enabled
+      ? `${style.green('✓')} ${name}: ${LOGIN_PROMPT_SETTING} = true`
+      : `${style.yellow('!')} ${name}: chưa bật ${LOGIN_PROMPT_SETTING} — extension sẽ đòi đăng nhập Anthropic ${style.dim(`(${path})`)}`);
+  }
+  await reportOverrides(env);
+  try {
+    const response = await fetch(`${API_ORIGIN}/v1/models`, { signal: AbortSignal.timeout(5000) });
+    console.log(`${style.green('✓')} Kết nối tới gateway ${style.dim(`(HTTP ${response.status})`)}`);
+  } catch (error) {
+    console.log(`${style.red('✗')} Không kết nối được ${API_ORIGIN}: ${error instanceof Error ? error.message : error}`);
+  }
+}
+
+/** `{ ok: true, me }`, `{ ok: false }` when the gateway rejects the key, or null if unreachable. */
 async function validateKey(apiKey) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), 5000);
@@ -309,7 +624,8 @@ async function validateKey(apiKey) {
       headers: { authorization: `Bearer ${apiKey}` },
       signal: controller.signal,
     });
-    return response.ok;
+    if (!response.ok) return { ok: false };
+    return { ok: true, me: await response.json().catch(() => null) };
   } catch {
     return null;
   } finally {
@@ -317,6 +633,19 @@ async function validateKey(apiKey) {
   }
 }
 
+function describeKey(me) {
+  if (!me || typeof me !== 'object') return '';
+  const parts = [];
+  if (me.planCode) parts.push(`gói ${me.planCode}`);
+  if (typeof me.creditsRemaining === 'number') {
+    parts.push(`còn ${me.creditsRemaining.toLocaleString('vi-VN')} credit`);
+  }
+  if (typeof me.expiresAt === 'number') {
+    parts.push(`hết hạn ${new Date(me.expiresAt * 1000).toLocaleDateString('vi-VN')}`);
+  }
+  return parts.join(' · ');
+}
+
 function launchClaude(apiKey, pinnedModel) {
   const env = {
     ...process.env,
@@ -326,6 +655,7 @@ function launchClaude(apiKey, pinnedModel) {
     CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY: '1',
   };
   delete env.ANTHROPIC_API_KEY;
+  for (const name of CLOUD_PROVIDER_SWITCHES) delete env[name];
   // Inherited from an older install's shell, this would override settings.json for this run.
   if (pinnedModel) env.ANTHROPIC_MODEL = pinnedModel;
   else delete env.ANTHROPIC_MODEL;
@@ -345,12 +675,18 @@ async function main() {
     printHelp();
     return;
   }
+  if (process.argv.includes('--doctor')) {
+    await doctor();
+    return;
+  }
 
-  console.log(`\nVIROUTER Claude Code installer\nTarget: ${API_ORIGIN}\n`);
+  const machine = detectMachine();
+  console.log(`\n${style.bold(style.cyan('VIROUTER'))} ${style.bold('· Claude Code installer')}`);
+  console.log(style.dim(`Gateway  ${API_ORIGIN}`));
+  console.log(style.dim(`Máy      ${machine.name} ${release()} · ${arch()} · ${hostname()}`));
+  console.log('');
   const agentToolkit = detectAgentToolkit();
-  if (agentToolkit) {
-    console.log(`Phát hiện ${agentToolkit}. Giữ nguyên skills, rules và hooks hiện có.`);
-  }
+  if (agentToolkit) step(`Phát hiện ${agentToolkit}`, '— giữ nguyên skills, rules và hooks hiện có');
   let input;
 
   try {
@@ -358,13 +694,20 @@ async function main() {
     const reuseEnvironmentKey = process.argv.includes('--reuse-key') || !process.stdin.isTTY;
     const apiKey = reuseEnvironmentKey && process.env.VIROUTER_API_KEY
       ? process.env.VIROUTER_API_KEY
-      : await readVisibleInput('Auth Token / API Key (sẽ hiển thị khi nhập): ');
+      : await readVisibleInput(`${style.bold('API key')} ${style.dim('(viro_…, hiển thị khi nhập)')}: `);
     if (!/^viro_[A-Za-z0-9_-]{20,}$/.test(apiKey)) {
       throw new Error('API key không hợp lệ. Key phải bắt đầu bằng viro_.');
     }
 
+    const checked = await validateKey(apiKey);
+    if (checked && !checked.ok) {
+      throw new Error(`API key bị từ chối bởi ${API_ORIGIN}. Kiểm tra key hoặc VIROUTER_API_ORIGIN.`);
+    }
+    if (checked) step(`Key ${style.bold(maskKey(apiKey))} hợp lệ`, describeKey(checked.me));
+    else console.log(`${style.yellow('!')} Key ${maskKey(apiKey)} — không kiểm tra được lúc này, vẫn lưu cấu hình.`);
+
     input = createInterface({ input: process.stdin, output: process.stdout });
-    const os = await chooseOs(input);
+    const { os } = machine;
     const keyChanged = previous.key !== null && previous.key !== apiKey;
     const claudeSettings = readClaudeSettings();
     // Re-running the installer keeps whatever the customer last picked with /model.
@@ -374,44 +717,64 @@ async function main() {
       : await chooseModel(input, remembered ?? DEFAULT_MODEL);
     input.close();
     input = undefined;
-
-    const valid = await validateKey(apiKey);
-    if (valid === false) {
-      throw new Error(`API key bị từ chối bởi ${API_ORIGIN}. Kiểm tra key hoặc VIROUTER_API_ORIGIN.`);
-    }
-    if (valid === null) console.log('Không kiểm tra được API lúc này. Vẫn tiếp tục lưu cấu hình.');
+    console.log('');
 
     // Remember the model in settings.json; pin it in the environment only if that file is not
     // ours to rewrite (unparseable), since a session with no model at all would be worse.
     let pinnedModel = null;
+    let settingsEnv = {};
     if (claudeSettings.writable) {
-      writeClaudeSettings(claudeSettings.path, withRememberedModel(claudeSettings.settings, model));
+      const next = withVirouterSettings(claudeSettings.settings, { apiKey, model });
+      writeClaudeSettings(claudeSettings.path, next.settings);
+      settingsEnv = next.settings.env;
+      if (next.previousBaseUrl) step('Thay địa chỉ cũ', `${next.previousBaseUrl} → ${API_ORIGIN}`);
+      if (next.removed.length) step('Gỡ biến cũ trong settings.json', next.removed.join(', '));
+      if (next.disabled.length) step('Tắt cloud provider đang bật trong shell', next.disabled.join(', '));
     } else {
       pinnedModel = model;
-      console.log(`Không đọc được ${claudeSettings.path} (không phải JSON hợp lệ).`);
-      console.log('Model sẽ cố định qua biến môi trường; /model sẽ không được ghi nhớ giữa các phiên.');
+      console.log(`${style.yellow('!')} Không đọc được ${claudeSettings.path} (không phải JSON hợp lệ).`);
+      console.log(style.yellow('  Nếu file đó đặt ANTHROPIC_BASE_URL, Claude Code sẽ không dùng VIROUTER — sửa JSON rồi chạy lại.'));
+      console.log(style.dim('  Model sẽ cố định qua biến môi trường; /model sẽ không được ghi nhớ giữa các phiên.'));
     }
 
     const location = os === '1'
       ? configureWindows(apiKey, pinnedModel)
       : configureUnix(os, apiKey, pinnedModel);
     const openCodeConfig = configureOpenCode(apiKey, model);
-    console.log(`\nĐã cấu hình Claude Code trong ${location}.`);
-    console.log(`Model: ${model}. Đổi bằng /model trong Claude Code — lần mở sau sẽ giữ model đã chọn.`);
-    if (openCodeConfig) console.log(`Đã cấu hình OpenCode chỉ dùng alias VIROUTER trong ${openCodeConfig}.`);
+    step('Claude Code', location);
+    step(`Model ${style.bold(model)}`, '— đổi bằng /model, lần mở sau giữ model đã chọn');
+    if (openCodeConfig) step('OpenCode', openCodeConfig);
+    reportEditors(configureEditors());
+    await reportOverrides(settingsEnv);
     if (process.argv.includes('--no-launch')) {
-      console.log('Chạy `claude` trong terminal mới để dùng cấu hình vừa tạo.\n');
+      console.log(`\nMở terminal mới rồi chạy ${style.cyan('claude')}.\n`);
     } else {
-      console.log('\nKhởi chạy Claude Code với VIROUTER...\n');
+      console.log(`\n${style.cyan('→')} Khởi chạy Claude Code với VIROUTER…\n`);
       launchClaude(apiKey, pinnedModel);
     }
   } catch (error) {
     input?.close();
-    console.error(`\nLỗi: ${error instanceof Error ? error.message : String(error)}`);
+    console.error(`\n${style.red('Lỗi:')} ${error instanceof Error ? error.message : String(error)}`);
     process.exitCode = 1;
   }
 }
 
-if (process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url) {
+/**
+ * True when this file is the program being run, not a module imported by a test.
+ *
+ * `npx` runs the package through a symlink (`node_modules/.bin/virouter`). Node reports that
+ * link in `argv[1]` but loads the real file, so comparing the two raw paths never matched on
+ * macOS and Linux: `npx virouter@latest` installed, printed nothing and exited.
+ */
+export function isMainModule(argv1 = process.argv[1], moduleUrl = import.meta.url) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
+if (isMainModule()) {
   await main();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "virouter",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Configure Claude Code to use the VIROUTER API gateway",
   "keywords": ["claude-code", "anthropic", "openai", "api-gateway", "cli"],
   "license": "MIT",