pennyrouter 0.1.13 → 0.1.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pennyrouter",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "Install and manage PennyRouter local coding-agent integrations.",
   "homepage": "https://pennyrouter.com",
   "bugs": {
@@ -24,7 +24,7 @@
   ],
   "scripts": {
     "start": "node ./bin/pennyrouter.js",
-    "check": "node --check ./bin/pennyrouter.js && find src -name '*.js' -print0 | xargs -0 -n1 node --check"
+    "check": "node --check ./bin/pennyrouter.js && find src -name '*.js' -print0 | xargs -0 -n1 node --check && node src/statusline.test.js"
   },
   "license": "MIT"
 }

package/src/statusline.js

@@ -94,8 +94,16 @@ function readJson(path) {
 function claudeEnv() {
   const settings = readJson(join(os.homedir(), ".claude", "settings.json")) || {};
   const env = settings.env || {};
-  const base = env.ANTHROPIC_BASE_URL || "";
-  const keyCandidates = [env.ANTHROPIC_API_KEY, env.ANTHROPIC_AUTH_TOKEN];
+  // A normal install writes base + pr- key into settings.json's env block. Fall back to the
+  // process environment so an out-of-band launch that supplies them there instead — e.g. the
+  // interactive probe, which passes creds via --settings <file> + child env rather than the
+  // user's settings.json — still resolves Penny. Real installs never set these as env vars, so
+  // this fallback is inert for them.
+  const base = env.ANTHROPIC_BASE_URL || process.env.ANTHROPIC_BASE_URL || "";
+  const keyCandidates = [
+    env.ANTHROPIC_API_KEY, env.ANTHROPIC_AUTH_TOKEN,
+    process.env.ANTHROPIC_API_KEY, process.env.ANTHROPIC_AUTH_TOKEN,
+  ];
   const key = keyCandidates.find((v) => typeof v === "string" && v.startsWith("pr-")) || "";
   return { base, key };
 }
@@ -170,9 +178,15 @@ if (config.wrap_command) {
 }
 
 if (lines.length === 0) {
-  console.log(penny);
+  lines = [penny];
 } else {
   lines[0] = lines[0].trimEnd() + " | " + penny;
-  console.log(lines.join("\\n"));
 }
+// Ambient tip: the gateway rotates cache.tip on a slow clock (see tips.statusline_tip).
+// Rendered as its own dim line so it never crowds the cost/model segments; absent field
+// (tips off, old gateway, bypass) renders nothing.
+if (pennyInstalled && cache && cache.tip && !cache.bypass) {
+  lines.push("\\x1b[2m" + cache.tip + "\\x1b[0m");
+}
+console.log(lines.join("\\n"));
 `;

package/src/statusline.test.js

@@ -0,0 +1,70 @@
+// Guards against the class of bug found 2026-07-18: an unescaped backtick inside a
+// comment on line 99 of statusline.js terminated the STATUSLINE_SCRIPT template
+// literal early, so every `pennyrouter install` since shipped a syntactically broken
+// generated script — installs succeeded silently, the crash only surfaced later, at
+// Claude Code's next statusline render, in a completely different process.
+//
+// `npm run check` (node --check on every source file) happened to catch this ONE
+// instance because the break also broke the OUTER file's parse — but that's
+// incidental: a subtler bug (backticks that still balance, or valid-looking JS that's
+// semantically wrong) would pass --check on the outer file yet still crash at
+// runtime, because --check never looks at the STRING CONTENT of a template literal.
+// This test extracts the ACTUAL constant (not a source-text regex) and validates the
+// real generated script: syntax-checks it, then executes it end-to-end with a fake
+// stdin payload the way Claude Code actually invokes it, so a broken script fails
+// `npm run check` locally instead of a user's install.
+//
+// No test framework in this package yet — plain assert + a process exit code, run via
+// `node src/statusline.test.js` (wired into `npm run check`).
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { configureClaudeCodeStatusline, statuslineScriptPath } from "./statusline.js";
+
+async function main() {
+  const tmpState = fs.mkdtempSync(path.join(os.tmpdir(), "pr-statusline-test-"));
+  const prevXdg = process.env.XDG_STATE_HOME;
+  process.env.XDG_STATE_HOME = tmpState;
+  try {
+    const current = {};
+    await configureClaudeCodeStatusline(current);
+    const scriptPath = statuslineScriptPath();
+    assert.ok(fs.existsSync(scriptPath), "script file was written");
+
+    // 1. Syntax: node --check on the ACTUAL written file (not a regex-extracted copy).
+    execFileSync(process.execPath, ["--check", scriptPath], { stdio: "pipe" });
+
+    // 2. Behavior: run it the way Claude Code does — JSON on stdin, plain stdout.
+    // No PennyRouter env configured -> "penny off", no crash, no tip line, no wrap.
+    const payload = JSON.stringify({
+      session_id: "test-session",
+      model: { display_name: "Test Model" },
+      workspace: { current_dir: "/tmp" },
+    });
+    const out = execFileSync(process.execPath, [scriptPath], {
+      input: payload, encoding: "utf8", timeout: 5000,
+    });
+    assert.ok(out.includes("penny off"), `expected "penny off" in output, got: ${out}`);
+    assert.ok(out.includes("Test Model"), `expected model name passed through, got: ${out}`);
+
+    // 3. Malformed stdin must not crash the script (best-effort JSON.parse fallback).
+    const outBadInput = execFileSync(process.execPath, [scriptPath], {
+      input: "not json", encoding: "utf8", timeout: 5000,
+    });
+    assert.ok(outBadInput.length > 0, "script still prints something on bad stdin");
+  } finally {
+    if (prevXdg === undefined) delete process.env.XDG_STATE_HOME;
+    else process.env.XDG_STATE_HOME = prevXdg;
+    fs.rmSync(tmpState, { recursive: true, force: true });
+  }
+
+  console.log("statusline.test.js: all checks passed");
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});