All articles
case study·intermediate··Updated

One company gateway, any coding harness

HarnezPad routes Claude Code, Codex, ChatGPT, and OpenCode through one company LLM gateway without putting the management key on disk.

claude-codeclicodexcoding-agentsdeveloper-experiencetooling
Resources
Resource Link
Repo ravikanchikare/launchpad

Standardize the route, not the harness

A company can standardize the LLM path without standardizing the coding agent. The expensive part is not which TUI someone likes. It is every engineer hand-wiring ANTHROPIC_BASE_URL, Codex profiles, and leftover AWS variables that silently bypass the gateway.

HarnezPad is the macOS app for that job. One Full Access management key stays in macOS Keychain. The harness remains Claude Code, Codex CLI, ChatGPT desktop, or OpenCode.

What HarnezPad owns
  1. One gateway and one management key, never in git or settings JSON
  2. Developer-chosen harness: Claude, Codex, ChatGPT, or OpenCode
  3. Gateway model IDs passed through unchanged

One app owns four routing adapters

On first launch — or whenever the stored key is missing, expired, or invalid — onboarding asks for a Full Access key. Settings → Gateway can paste the same key later. The app validates it against the gateway, then stores it in Keychain as slug management-key under service com.harnezai.launchpad.keys.

HarnezPad cycling through ChatGPT, Claude Code, and Codex launch commands

The packaged app is three pieces: a Native SDK window host, a Go CLI/helper, and a bundled React UI.

One app, three owners
Piece Owns
Zig Native SDK host Window, menus, tray, and the allowlisted helper bridge
Go harnezpad binary Keychain, gateway HTTP, launch, updates, and the CLI
Bundled React UI Settings, Keys, Models, and copyable launch commands

The CLI is the same binary the app installs to ~/.local/bin/harnezpad on first launch.

terminalbash
$ harnezpad help
HarnezPad

Commands:
  harnezpad launch claude [--key KEY] [--model MODEL]
  harnezpad launch codex [--key KEY] [--model MODEL] [--restore]
  harnezpad launch chatgpt [--key KEY] [--model MODEL] [--restore]
  harnezpad launch opencode [--key KEY] [--model MODEL]

$ harnezpad launch claude --model kimi-k3
$ harnezpad launch codex --model gpt-5.5
$ harnezpad launch chatgpt --model glm-5.2
$ harnezpad launch opencode --model claude-sonnet-5

Omit --model and the CLI opens an interactive picker from the gateway catalog. --key selects a named Keychain slug; the default is management-key.

Each harness gets a different routing path because each agent stores credentials differently:

  • Claude gets process-scoped Anthropic env and stripped AWS/Bedrock/Vertex inheritance.
  • Codex CLI gets a throwaway HarnezPad-owned $CODEX_HOME profile.
  • ChatGPT writes routing into ~/.codex/config.toml and can --restore.
  • OpenCode receives an OpenAI-compatible provider through OPENCODE_CONFIG_CONTENT.

Takeaways

Keep harness choice separate from gateway policy

Developers keep Claude Code, Codex, ChatGPT, or OpenCode. Billing, model access, and keys stay on the company gateway.

Install one routing command

HarnezPad points the installed harness at a shared endpoint and a Keychain-backed management key without replacing the harness.

Pass gateway model IDs through

Alias rewriting makes a launcher disagree with the gateway catalog. HarnezPad forwards --model unchanged.