virouter 0.2.5 → 0.2.6

package/README.md

@@ -50,10 +50,48 @@ preserved; VIROUTER is appended and selected as the default provider. A new conf
 enables only VIROUTER. This allows existing ClaudeKit/ECC/OpenCode workflows to continue
 without losing their provider setup.
 
-The installer never replaces `.claude/` skills, rules, agents, or hooks. In `~/.claude/settings.json`
-it sets only the `model` key (and drops an `env.ANTHROPIC_MODEL` pin); every other setting is
-kept. If it detects ClaudeKit or ECC, it reports that configuration and otherwise only writes
-gateway environment variables plus the OpenCode provider entry.
+The installer never replaces `.claude/` skills, rules, agents, or hooks.
+
+### Taking over a machine that already ran Claude Code elsewhere
+
+An `env` block in `~/.claude/settings.json` beats the shell — Claude Code writes each entry into
+its own environment, replacing what `~/.zshrc` or the installer's launch passed in. A machine that
+another tool once pointed at its own proxy or gateway therefore kept going there (a dead
+`127.0.0.1` port shows up as `ECONNREFUSED`) however often the shell profile was rewritten.
+
+Since 0.2.6 the installer writes the route where it wins, in `~/.claude/settings.json`:
+
+- `env.ANTHROPIC_BASE_URL` and `env.ANTHROPIC_AUTH_TOKEN` — replacing whatever was there, and
+  reported (`Thay địa chỉ cũ …`). This is also what the VS Code extension and other GUI launches
+  read, since they never source a shell profile.
+- removes `env.ANTHROPIC_API_KEY`, `env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` and the
+  cloud-provider switches `CLAUDE_CODE_USE_BEDROCK` / `_VERTEX` / `_FOUNDRY`, which outrank the
+  token outright; one the shell exports is pinned to `0`, since a settings file cannot unset it.
+- copies the old file to `settings.json.bak-virouter-<timestamp>` first. Every other key is kept.
+
+### VS Code, Cursor, Windsurf
+
+The Claude Code extension reads the route from `~/.claude/settings.json`, but opens on its
+Anthropic sign-in screen unless `claudeCode.disableLoginPrompt` is on. The installer sets it in
+the user `settings.json` of every installed editor (VS Code, Insiders, Cursor, Windsurf,
+VSCodium), with a backup. A file with comments is not rewritten — the installer says so and the
+setting has to be ticked by hand. `--doctor` reports it per editor.
+
+macOS also gets the block in `~/.bash_profile`, the file a bash login shell actually reads.
+
+What the installer cannot change it reports before launching: an organisation's managed settings
+(`/Library/Application Support/ClaudeCode/managed-settings.json`, `/etc/claude-code/…`,
+`C:\Program Files\ClaudeCode\…`), a project's own `.claude/settings*.json` that sets a URL or key,
+stale exports elsewhere in shell profiles, and a proxy variable (`HTTPS_PROXY`, …) pointing at
+nothing — Node's `fetch` ignores those, so the key check passes while Claude Code is refused.
+
+To see what decides the URL and key on a machine, without changing anything:
+
+```bash
+npx virouter@latest --doctor
+```
+
+If it detects ClaudeKit or ECC, it reports that configuration and leaves it in place.
 
 The customer key is never stored in this package or repository. Obtain it from the one-time
 claim/recovery flow documented in `docs/claude-code-setup.md`; do not use an upstream

package/bin/virouter.mjs

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 
 import { execFileSync } from 'node:child_process';
-import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { connect } from 'node:net';
 import { arch, homedir, hostname, release } from 'node:os';
 import { join } from 'node:path';
 import { createInterface } from 'node:readline/promises';
@@ -28,6 +29,17 @@ const VIROUTER_MODELS = [
   'claude-haiku-4-5-alt',
 ];
 
+/**
+ * Variables that take Claude Code away from VIROUTER when another tool left them behind. The
+ * cloud-provider switches outrank ANTHROPIC_AUTH_TOKEN outright (Claude Code's authentication
+ * precedence), so with one of them set our base URL and key are never used at all.
+ */
+const CLOUD_PROVIDER_SWITCHES = ['CLAUDE_CODE_USE_BEDROCK', 'CLAUDE_CODE_USE_VERTEX', 'CLAUDE_CODE_USE_FOUNDRY'];
+const STALE_ENV = ['ANTHROPIC_API_KEY', 'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC', ...CLOUD_PROVIDER_SWITCHES];
+/** What Claude Code reads to decide where requests go and how they authenticate. */
+const ROUTING_ENV = ['ANTHROPIC_BASE_URL', 'ANTHROPIC_AUTH_TOKEN', 'ANTHROPIC_API_KEY', ...CLOUD_PROVIDER_SWITCHES];
+const PROXY_ENV = ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'ALL_PROXY', 'all_proxy'];
+
 function printHelp() {
 console.log(`VIROUTER Claude Code + OpenCode installer
 
@@ -36,6 +48,7 @@ Usage:
   npx virouter@latest --help
   npx virouter@latest --no-launch
   npx virouter@latest --reuse-key
+  npx virouter@latest --doctor     # what decides Claude Code's URL and key on this machine
 
   The installer configures Claude Code and OpenCode to use ${API_ORIGIN}.
 For local testing, set VIROUTER_API_ORIGIN=http://127.0.0.1:8787.
@@ -104,8 +117,8 @@ function existingConfig() {
   const candidates = process.platform === 'win32'
     ? []
     : process.platform === 'darwin'
-      ? [join(homedir(), '.zshrc'), join(homedir(), '.bashrc')]
-      : [join(homedir(), '.bashrc'), join(homedir(), '.zshrc')];
+      ? profilePaths('2')
+      : profilePaths('3');
   const sources = candidates
     .filter((path) => existsSync(path))
     .map((path) => readFileSync(path, 'utf8'));
@@ -170,11 +183,118 @@ export function withRememberedModel(settings, model) {
   return { ...settings, model, env };
 }
 
+/**
+ * Settings that route Claude Code to VIROUTER on any machine, whatever was there before.
+ *
+ * An `env` block in a settings file beats the shell: Claude Code writes each entry into its
+ * process environment, replacing what the shell (or this installer's launch) passed in. So a
+ * machine that once pointed ~/.claude/settings.json at another proxy or gateway kept going
+ * there — or to a dead localhost port, ECONNREFUSED — however many times the installer
+ * rewrote ~/.zshrc. The URL and key therefore live here, where they win, and where the VS Code
+ * extension and other GUI launches, which never read a shell profile, can see them too.
+ *
+ * Returns the new settings, the stale variables it dropped, the cloud-provider switches it
+ * pinned off (one exported by the shell cannot be removed from here) and the URL it replaced.
+ */
+export function withVirouterSettings(settings, { apiKey, model, origin = API_ORIGIN, shellEnv = process.env }) {
+  const remembered = withRememberedModel(settings, model);
+  const env = { ...remembered.env };
+  const previousBaseUrl = typeof env.ANTHROPIC_BASE_URL === 'string' && env.ANTHROPIC_BASE_URL !== origin
+    ? env.ANTHROPIC_BASE_URL
+    : null;
+  const removed = STALE_ENV.filter((name) => name in env);
+  for (const name of removed) delete env[name];
+  const disabled = CLOUD_PROVIDER_SWITCHES.filter((name) => isTruthy(shellEnv[name]));
+  for (const name of disabled) env[name] = '0';
+  Object.assign(env, {
+    ANTHROPIC_BASE_URL: origin,
+    ANTHROPIC_AUTH_TOKEN: apiKey,
+    ANTHROPIC_SMALL_FAST_MODEL: 'claude-haiku-4-5',
+    CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY: '1',
+  });
+  return { settings: { ...remembered, env }, removed, disabled, previousBaseUrl };
+}
+
+function isTruthy(value) {
+  return typeof value === 'string' && /^(1|true|yes|on)$/i.test(value.trim());
+}
+
 function writeClaudeSettings(path, settings) {
   mkdirSync(join(path, '..'), { recursive: true });
+  if (existsSync(path)) {
+    // The customer's own settings are worth a copy before we rewrite them.
+    const stamp = new Date().toISOString().replace(/[-:]/g, '').replace(/\..*/, '');
+    copyFileSync(path, `${path}.bak-virouter-${stamp}`);
+  }
   writeFileSync(path, `${JSON.stringify(settings, null, 2)}\n`, { mode: 0o600 });
 }
 
+/** VS Code and its forks that host the Claude Code extension, by user-data folder name. */
+const EDITORS = ['Code', 'Code - Insiders', 'Cursor', 'Windsurf', 'VSCodium'];
+const LOGIN_PROMPT_SETTING = 'claudeCode.disableLoginPrompt';
+
+/**
+ * Where each editor keeps its user settings.json. Only editors whose user-data folder already
+ * exists are returned — the installer never creates an editor's folder.
+ */
+export function editorSettingsPaths({ platform = process.platform, home = homedir(), env = process.env } = {}) {
+  const base = platform === 'win32'
+    ? env.APPDATA || join(home, 'AppData', 'Roaming')
+    : platform === 'darwin'
+      ? join(home, 'Library', 'Application Support')
+      : env.XDG_CONFIG_HOME || join(home, '.config');
+  return EDITORS
+    .filter((name) => existsSync(join(base, name)))
+    .map((name) => ({ name, path: join(base, name, 'User', 'settings.json') }));
+}
+
+/**
+ * The editor setting the Claude Code extension needs to talk to a gateway at all.
+ *
+ * Without it the extension opens on its Anthropic sign-in screen and never starts a session,
+ * however correct the URL and key in ~/.claude/settings.json are — the CLI in the same
+ * editor's terminal works, the panel does not. Returns null when the file is not plain JSON
+ * (VS Code allows comments): rewriting it would drop them, so that case is left to the user.
+ */
+export function withLoginPromptDisabled(text) {
+  if (!text.trim()) return { [LOGIN_PROMPT_SETTING]: true };
+  let settings;
+  try {
+    settings = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (!settings || typeof settings !== 'object' || Array.isArray(settings)) return null;
+  return { ...settings, [LOGIN_PROMPT_SETTING]: true };
+}
+
+/** Sets the login-prompt switch in every installed editor. Returns what happened per editor. */
+function configureEditors() {
+  return editorSettingsPaths().map(({ name, path }) => {
+    const text = existsSync(path) ? readFileSync(path, 'utf8') : '';
+    const next = withLoginPromptDisabled(text);
+    if (!next) return { name, path, outcome: 'manual' };
+    if (text.trim() && JSON.parse(text)[LOGIN_PROMPT_SETTING] === true) return { name, path, outcome: 'already' };
+    try {
+      writeClaudeSettings(path, next);
+      return { name, path, outcome: 'set' };
+    } catch {
+      return { name, path, outcome: 'manual' };
+    }
+  });
+}
+
+function reportEditors(results) {
+  for (const { name, path, outcome } of results) {
+    if (outcome === 'manual') {
+      console.log(`${style.yellow('!')} ${name}: không tự sửa được ${path} (có comment hoặc không ghi được).`);
+      console.log(style.dim('  Mở Settings, tìm "Disable Login Prompt" (Claude Code) và tích chọn — nếu không, extension sẽ đòi đăng nhập Anthropic.'));
+    } else {
+      step(`${name} extension`, `${LOGIN_PROMPT_SETTING} = true${outcome === 'set' ? ' — tải lại cửa sổ (Developer: Reload Window)' : ''}`);
+    }
+  }
+}
+
 function detectAgentToolkit() {
   const candidates = [
     join(process.cwd(), '.claude', '.ck.json'),
@@ -234,6 +354,7 @@ function configLines(apiKey, pinnedModel) {
     // traffic must stay enabled or discovery is skipped.
     'export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY="1"',
     'unset CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC',
+    `unset ${CLOUD_PROVIDER_SWITCHES.join(' ')}`,
   ];
 }
 
@@ -246,16 +367,19 @@ function updateProfile(path, lines) {
   return path;
 }
 
-function configureWindows(apiKey, pinnedModel) {
-  if (!pinnedModel) {
-    // An empty `setx` value is still a variable; delete the old pin outright so `/model` in
-    // ~/.claude/settings.json decides. Absent already is fine.
-    try {
-      execFileSync('reg', ['delete', 'HKCU\\Environment', '/v', 'ANTHROPIC_MODEL', '/f'], { stdio: 'ignore' });
-    } catch {
-      // Nothing to delete.
-    }
+function deleteWindowsUserVariable(name) {
+  // An empty `setx` value is still a variable; delete it outright. Absent already is fine.
+  try {
+    execFileSync('reg', ['delete', 'HKCU\\Environment', '/v', name, '/f'], { stdio: 'ignore' });
+  } catch {
+    // Nothing to delete.
   }
+}
+
+function configureWindows(apiKey, pinnedModel) {
+  // Without the pin, `/model` in ~/.claude/settings.json decides.
+  if (!pinnedModel) deleteWindowsUserVariable('ANTHROPIC_MODEL');
+  for (const name of CLOUD_PROVIDER_SWITCHES) deleteWindowsUserVariable(name);
   const values = {
     ANTHROPIC_BASE_URL: API_ORIGIN,
     ANTHROPIC_AUTH_TOKEN: apiKey,
@@ -326,14 +450,169 @@ function configureOpenCode(apiKey, model) {
   return path;
 }
 
+/**
+ * Shell files the config block goes into. macOS Terminal starts bash as a login shell, which
+ * reads ~/.bash_profile and never ~/.bashrc — a bash user on a Mac got no configuration.
+ */
+export function profilePaths(os, home = homedir()) {
+  return os === '2'
+    ? [join(home, '.zshrc'), join(home, '.bash_profile'), join(home, '.bashrc')]
+    : [join(home, '.bashrc'), join(home, '.zshrc')];
+}
+
 function configureUnix(os, apiKey, pinnedModel) {
   const lines = configLines(apiKey, pinnedModel);
-  const profiles = os === '2'
-    ? [join(homedir(), '.zshrc'), join(homedir(), '.bashrc')]
-    : [join(homedir(), '.bashrc'), join(homedir(), '.zshrc')];
-
+  const profiles = profilePaths(os);
   for (const profile of profiles) updateProfile(profile, lines);
-  return profiles.join(' and ');
+  return profiles.map((path) => path.replace(homedir(), '~')).join(', ');
+}
+
+/** Where an organisation's policy file lives. Nothing a user writes can override it. */
+export function managedSettingsPath(platform = process.platform) {
+  if (platform === 'darwin') return '/Library/Application Support/ClaudeCode/managed-settings.json';
+  if (platform === 'win32') return 'C:\\Program Files\\ClaudeCode\\managed-settings.json';
+  return '/etc/claude-code/managed-settings.json';
+}
+
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Everything on this machine that can still decide Claude Code's URL or key after we have
+ * written ours, highest precedence first. `block` cannot be fixed by the installer (an
+ * organisation's managed settings); `warn` wins over ~/.claude/settings.json in some sessions
+ * (a project's own settings); `info` is shadowed by our settings but worth knowing about.
+ */
+export function findOverrides({ cwd = process.cwd(), home = homedir(), platform = process.platform, managedPath } = {}) {
+  const found = [];
+  const routingKeys = (env) => (env && typeof env === 'object' ? ROUTING_ENV.filter((name) => name in env) : []);
+
+  const managedFile = managedPath ?? managedSettingsPath(platform);
+  const managed = existsSync(managedFile) ? readJson(managedFile) : null;
+  if (managed) {
+    const keys = routingKeys(managed.env);
+    if (keys.length) found.push({ level: 'block', where: managedFile, detail: `đặt ${keys.join(', ')}` });
+    if (managed.forceLoginMethod) found.push({ level: 'block', where: managedFile, detail: `forceLoginMethod=${managed.forceLoginMethod}` });
+    if (Array.isArray(managed.allowedProviders) && !managed.allowedProviders.includes('customEndpoint')) {
+      found.push({ level: 'block', where: managedFile, detail: 'allowedProviders không cho phép gateway riêng' });
+    }
+  }
+
+  for (const name of ['settings.local.json', 'settings.json']) {
+    const path = join(cwd, '.claude', name);
+    if (path === join(home, '.claude', name) || !existsSync(path)) continue;
+    const keys = routingKeys(readJson(path)?.env);
+    if (keys.length) found.push({ level: 'warn', where: path, detail: `đặt ${keys.join(', ')} cho riêng dự án này` });
+  }
+
+  if (platform !== 'win32') {
+    const exported = new RegExp(`^\\s*(?:export\\s+|set\\s+-gx\\s+)?(${ROUTING_ENV.join('|')})[=\\s]`);
+    for (const file of ['.zshenv', '.zprofile', '.zshrc', '.zlogin', '.bash_profile', '.bashrc', '.profile', join('.config', 'fish', 'config.fish')]) {
+      const path = join(home, file);
+      if (!existsSync(path)) continue;
+      let inside = false;
+      readFileSync(path, 'utf8').split('\n').forEach((line, index) => {
+        if (line.includes(MARKER_START)) inside = true;
+        const name = !inside && exported.exec(line)?.[1];
+        if (name) found.push({ level: 'info', where: `${path}:${index + 1}`, detail: `${name} ngoài khối VIROUTER` });
+        if (line.includes(MARKER_END)) inside = false;
+      });
+    }
+  }
+  return found;
+}
+
+/** Proxy variables Claude Code will use, from the shell or a settings `env` block. */
+export function proxySettings(env = process.env, settingsEnv = {}) {
+  const merged = { ...env, ...(settingsEnv && typeof settingsEnv === 'object' ? settingsEnv : {}) };
+  return PROXY_ENV.filter((name) => merged[name]).map((name) => ({ name, url: merged[name] }));
+}
+
+/**
+ * Whether anything is listening at a proxy URL. Node's fetch ignores HTTPS_PROXY, so the key
+ * check below succeeds even when the proxy is dead — while Claude Code, which honours it, gets
+ * ECONNREFUSED on every request ("a firewall or proxy may be blocking it").
+ */
+export function probeProxy(url, timeoutMs = 1500) {
+  let target;
+  try {
+    target = new URL(url.includes('://') ? url : `http://${url}`);
+  } catch {
+    return Promise.resolve('invalid');
+  }
+  const port = Number(target.port) || (target.protocol === 'https:' ? 443 : 80);
+  return new Promise((resolve) => {
+    const socket = connect({ host: target.hostname, port });
+    const done = (verdict) => {
+      socket.destroy();
+      resolve(verdict);
+    };
+    socket.setTimeout(timeoutMs, () => done('timeout'));
+    socket.once('connect', () => done('ok'));
+    socket.once('error', (error) => done(error.code === 'ECONNREFUSED' ? 'refused' : 'error'));
+  });
+}
+
+async function reportOverrides(settingsEnv) {
+  const found = findOverrides();
+  const proxies = proxySettings(process.env, settingsEnv);
+  const dead = [];
+  for (const proxy of proxies) {
+    const verdict = await probeProxy(proxy.url);
+    if (verdict !== 'ok') dead.push({ ...proxy, verdict });
+  }
+  for (const item of found) {
+    const mark = item.level === 'info' ? style.dim('·') : style.yellow('!');
+    console.log(`${mark} ${item.detail} ${style.dim(`— ${item.where}`)}`);
+  }
+  if (found.some((item) => item.level === 'block')) {
+    console.log(style.yellow('  Cấu hình do tổ chức quản lý (managed settings) luôn thắng — cần IT gỡ hoặc cho phép gateway riêng.'));
+  }
+  if (found.some((item) => item.level === 'warn')) {
+    console.log(style.dim('  File .claude/settings*.json của dự án thắng cấu hình chung — xóa các biến đó trong file nếu dự án không cần.'));
+  }
+  for (const proxy of dead) {
+    console.log(`${style.yellow('!')} Proxy ${proxy.name}=${proxy.url} không phản hồi (${proxy.verdict}) — Claude Code sẽ báo ECONNREFUSED.`);
+  }
+  if (dead.length) {
+    console.log(style.dim(`  Bật lại phần mềm proxy, hoặc xóa ${dead.map((proxy) => proxy.name).join(', ')} khỏi shell profile / settings.json.`));
+  }
+  return { found, dead };
+}
+
+async function doctor() {
+  console.log(`\n${style.bold(style.cyan('VIROUTER'))} ${style.bold('· doctor')}`);
+  console.log(style.dim(`Gateway  ${API_ORIGIN}`));
+  const { path, settings, writable } = readClaudeSettings();
+  const env = settings.env && typeof settings.env === 'object' ? settings.env : {};
+  if (!writable) console.log(`${style.yellow('!')} ${path} không phải JSON hợp lệ — Claude Code sẽ báo lỗi và bỏ qua nó.`);
+  const baseUrl = env.ANTHROPIC_BASE_URL ?? process.env.ANTHROPIC_BASE_URL ?? '(chưa đặt)';
+  const token = env.ANTHROPIC_AUTH_TOKEN ?? process.env.ANTHROPIC_AUTH_TOKEN;
+  const mark = baseUrl === API_ORIGIN ? style.green('✓') : style.yellow('!');
+  console.log(`${mark} ANTHROPIC_BASE_URL ${baseUrl} ${style.dim(env.ANTHROPIC_BASE_URL ? `(${path})` : '(shell)')}`);
+  console.log(`${token ? style.green('✓') : style.yellow('!')} ANTHROPIC_AUTH_TOKEN ${token ? maskKey(token) : '(chưa đặt)'}`);
+  for (const name of CLOUD_PROVIDER_SWITCHES) {
+    const value = env[name] ?? process.env[name];
+    if (isTruthy(value)) console.log(`${style.yellow('!')} ${name}=${value} — Claude Code sẽ dùng cloud provider thay vì VIROUTER.`);
+  }
+  for (const { name, path } of editorSettingsPaths()) {
+    const enabled = existsSync(path) && readJson(path)?.[LOGIN_PROMPT_SETTING] === true;
+    console.log(enabled
+      ? `${style.green('✓')} ${name}: ${LOGIN_PROMPT_SETTING} = true`
+      : `${style.yellow('!')} ${name}: chưa bật ${LOGIN_PROMPT_SETTING} — extension sẽ đòi đăng nhập Anthropic ${style.dim(`(${path})`)}`);
+  }
+  await reportOverrides(env);
+  try {
+    const response = await fetch(`${API_ORIGIN}/v1/models`, { signal: AbortSignal.timeout(5000) });
+    console.log(`${style.green('✓')} Kết nối tới gateway ${style.dim(`(HTTP ${response.status})`)}`);
+  } catch (error) {
+    console.log(`${style.red('✗')} Không kết nối được ${API_ORIGIN}: ${error instanceof Error ? error.message : error}`);
+  }
 }
 
 /** `{ ok: true, me }`, `{ ok: false }` when the gateway rejects the key, or null if unreachable. */
@@ -376,6 +655,7 @@ function launchClaude(apiKey, pinnedModel) {
     CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY: '1',
   };
   delete env.ANTHROPIC_API_KEY;
+  for (const name of CLOUD_PROVIDER_SWITCHES) delete env[name];
   // Inherited from an older install's shell, this would override settings.json for this run.
   if (pinnedModel) env.ANTHROPIC_MODEL = pinnedModel;
   else delete env.ANTHROPIC_MODEL;
@@ -395,6 +675,10 @@ async function main() {
     printHelp();
     return;
   }
+  if (process.argv.includes('--doctor')) {
+    await doctor();
+    return;
+  }
 
   const machine = detectMachine();
   console.log(`\n${style.bold(style.cyan('VIROUTER'))} ${style.bold('· Claude Code installer')}`);
@@ -438,11 +722,18 @@ async function main() {
     // Remember the model in settings.json; pin it in the environment only if that file is not
     // ours to rewrite (unparseable), since a session with no model at all would be worse.
     let pinnedModel = null;
+    let settingsEnv = {};
     if (claudeSettings.writable) {
-      writeClaudeSettings(claudeSettings.path, withRememberedModel(claudeSettings.settings, model));
+      const next = withVirouterSettings(claudeSettings.settings, { apiKey, model });
+      writeClaudeSettings(claudeSettings.path, next.settings);
+      settingsEnv = next.settings.env;
+      if (next.previousBaseUrl) step('Thay địa chỉ cũ', `${next.previousBaseUrl} → ${API_ORIGIN}`);
+      if (next.removed.length) step('Gỡ biến cũ trong settings.json', next.removed.join(', '));
+      if (next.disabled.length) step('Tắt cloud provider đang bật trong shell', next.disabled.join(', '));
     } else {
       pinnedModel = model;
       console.log(`${style.yellow('!')} Không đọc được ${claudeSettings.path} (không phải JSON hợp lệ).`);
+      console.log(style.yellow('  Nếu file đó đặt ANTHROPIC_BASE_URL, Claude Code sẽ không dùng VIROUTER — sửa JSON rồi chạy lại.'));
       console.log(style.dim('  Model sẽ cố định qua biến môi trường; /model sẽ không được ghi nhớ giữa các phiên.'));
     }
 
@@ -453,6 +744,8 @@ async function main() {
     step('Claude Code', location);
     step(`Model ${style.bold(model)}`, '— đổi bằng /model, lần mở sau giữ model đã chọn');
     if (openCodeConfig) step('OpenCode', openCodeConfig);
+    reportEditors(configureEditors());
+    await reportOverrides(settingsEnv);
     if (process.argv.includes('--no-launch')) {
       console.log(`\nMở terminal mới rồi chạy ${style.cyan('claude')}.\n`);
     } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "virouter",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "Configure Claude Code to use the VIROUTER API gateway",
   "keywords": ["claude-code", "anthropic", "openai", "api-gateway", "cli"],
   "license": "MIT",