pennyrouter 0.1.14 → 0.1.16

package/README.md

@@ -26,6 +26,11 @@ When Claude Code is selected, the installer also offers an optional Claude Pro/M
 subscription-auth step. Users can skip it during install and enable it later with
 `@penny auth` or `npx pennyrouter auth anthropic`.
 
+When Codex is already signed in with ChatGPT, the installer preserves that Codex-managed
+login and configures PennyRouter as an OpenAI-authenticated Responses proxy. Codex continues
+to own and refresh the OpenAI credentials; PennyRouter stores only its existing `pr-` account
+key in the managed provider block. API-key Codex installs continue to use PennyRouter credits.
+
 ## Supported Tools
 
 - Claude Code

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pennyrouter",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "description": "Install and manage PennyRouter local coding-agent integrations.",
   "homepage": "https://pennyrouter.com",
   "bugs": {
@@ -24,7 +24,7 @@
   ],
   "scripts": {
     "start": "node ./bin/pennyrouter.js",
-    "check": "node --check ./bin/pennyrouter.js && find src -name '*.js' -print0 | xargs -0 -n1 node --check"
+    "check": "node --check ./bin/pennyrouter.js && find src -name '*.js' -print0 | xargs -0 -n1 node --check && node src/statusline.test.js && node src/harnesses/codex.test.js"
   },
   "license": "MIT"
 }

package/src/cli.js

@@ -235,31 +235,51 @@ function readAnthropicOAuthToken(flags = {}) {
 }
 
 // ANSI/CSI escape sequences that `claude setup-token`'s TUI emits (colors, cursor
-// moves, bracketed-paste). We strip these before scanning for the token so a match
-// isn't split by control bytes. Kept deliberately broad.
+// moves, bracketed-paste). We strip these before scanning the captured stream for the
+// token so a match isn't split by control bytes. Kept deliberately broad.
 // eslint-disable-next-line no-control-regex
 const ANSI_ESCAPE_RE = /\x1b\[[0-9;?]*[ -/]*[@-~]/g;
 // The token line printed by `claude setup-token`. Match any sk-ant-* token so we don't
 // depend on the exact variant/version (e.g. sk-ant-oat01-...).
 const ANTHROPIC_SETUP_TOKEN_RE = /sk-ant-[A-Za-z0-9_-]+/;
 
-// Run `claude setup-token` inline and extract the token it prints. The command is a
-// full-screen TUI (ANSI art + banner) that also prints the real token on a line like
-// "sk-ant-oat01-...". We pipe stdout so we can read it, but tee every chunk straight
-// back to the terminal so the user still sees the whole flow (including "you won't be
-// able to see it again"). stdin/stderr inherit the TTY for the interactive parts. After
-// exit we ANSI-strip the captured stdout and regex out the token. Returns "" on
-// non-zero exit or if no token line was found, so the caller falls back to paste.
+// Run `claude setup-token` inline and extract the token it prints, WITHOUT echoing any
+// of the command's own output to the terminal. `claude setup-token` is a full-screen
+// Ink TUI: it redraws with carriage returns and cursor-move escapes (not newlines), so
+// its banner ("Welcome to Claude Code…"), spinner frames, the OAuth URL, the real token
+// ("sk-ant-oat01-…") and the "Store this / export" chrome all arrive interleaved with
+// no reliable line boundaries. There's no safe way to tee that stream line-by-line, and
+// none of it needs to reach the user: the browser auto-opens for approval, and the
+// token goes server-side (encrypted). So we fully suppress the child's output — we pipe
+// BOTH stdout and stderr only to capture them in memory for token extraction, and print
+// our own clean status lines around the call instead. The Ink TUI renders to stdout (the
+// token line arrives there — that's what we scan), but we also silence stderr so no
+// spinner/banner frame can leak from the other stream. Only stdin inherits the TTY, which
+// is all that's needed for the interactive approval handoff; the browser is opened by the
+// OS, not the terminal. After exit we ANSI-strip the captured output and regex out the
+// token. Returns "" on non-zero exit or if no token appeared, so the caller falls back to
+// manual paste.
 function runClaudeSetupToken() {
   return new Promise((resolve) => {
     let captured = "";
+    // On Windows, npm installs `claude` as a `claude.cmd` shim which Node's spawn will
+    // not resolve without a shell (it looks for a bare executable and throws ENOENT).
+    // Route through the shell there so the shim resolves; the args are fixed literals
+    // (no user input), so there's no shell-injection surface. POSIX spawns `claude`
+    // directly. Works from both PowerShell and cmd.exe host terminals since Node invokes
+    // cmd.exe itself for the shell.
     const child = spawn("claude", ["setup-token"], {
-      stdio: ["inherit", "pipe", "inherit"],
-    });
-    child.stdout.on("data", (chunk) => {
-      captured += chunk.toString("utf8");
-      output.write(chunk); // tee: keep the TUI visible to the user
+      // stdin keeps the TTY; stdout+stderr are piped (captured, never echoed).
+      stdio: ["inherit", "pipe", "pipe"],
+      shell: process.platform === "win32",
     });
+
+    const capture = (chunk) => {
+      captured += chunk.toString("utf8"); // in-memory only — nothing is written to the terminal
+    };
+    child.stdout.on("data", capture);
+    child.stderr.on("data", capture);
+
     child.on("error", () => resolve(""));
     child.on("close", (code) => {
       if (code !== 0) return resolve("");
@@ -411,9 +431,10 @@ async function maybeConfigureClaudeAnthropicAuth(flags, selected) {
     // The user already opted into subscription auth above, so run `claude setup-token`
     // directly and capture the token — no copy-paste, no second confirm. The command
     // opens the browser for approval inline. On failure we fall through to manual paste.
-    console.log("Launching `claude setup-token` — approve in your browser when prompted.");
+    console.log("Launching Claude sign-in — approve in your browser…");
     const captured = await runClaudeSetupToken();
     if (captured) {
+      console.log("✓ Claude subscription auth enabled.");
       console.log("");
       return { token: captured, source: "setup-token" };
     }
@@ -696,6 +717,7 @@ async function status() {
     if (record.installed_at) console.log(`  installed: ${record.installed_at}`);
     if (record.disabled_at) console.log(`  disabled: ${record.disabled_at}`);
     if (record.anthropic_oauth) console.log(`  Claude subscription auth: enabled (${record.token_source || "unknown"} token)`);
+    if (record.openai_subscription_auth) console.log("  OpenAI subscription auth: enabled (Codex-managed login)");
     if (record.manual_required) console.log("  note: finish or remove this integration in the tool UI");
   }
 }
@@ -995,7 +1017,13 @@ async function promptSecretish(question) {
 }
 
 function commandExists(command) {
-  const result = spawnSync(command, ["--version"], { stdio: "ignore" });
+  // Windows installs CLIs as `.cmd`/`.ps1` shims that Node won't resolve without a
+  // shell, so probe through the shell there (else this false-negatives on `claude` and
+  // the auto setup-token path gets skipped). `command` is an internal literal.
+  const result = spawnSync(command, ["--version"], {
+    stdio: "ignore",
+    shell: process.platform === "win32",
+  });
   return result.status === 0;
 }
 

package/src/harnesses/codex.js

@@ -1,6 +1,11 @@
-import { atomicWrite, backupFile, compactHome, exists, expandHome, readText } from "../state.js";
+import { spawnSync } from "node:child_process";
+import { atomicWrite, backupFile, compactHome, exists, expandHome, readJsonFile, readText } from "../state.js";
 
 const CONFIG_PATH = "~/.codex/config.toml";
+const AUTH_PATH = "~/.codex/auth.json";
+const PROVIDER_ID = "pennyrouter";
+const MANAGED_START = "# --- PennyRouter managed Codex provider ---";
+const MANAGED_END = "# --- end PennyRouter managed Codex provider ---";
 
 export const codexHarness = {
   id: "codex",
@@ -15,7 +20,8 @@ export const codexHarness = {
       configPath: expandHome(CONFIG_PATH),
       summary: [
         `write ${CONFIG_PATH}`,
-        "set OpenAI-compatible base URL to PennyRouter",
+        "install a Responses-native PennyRouter model provider",
+        "preserve Codex-managed ChatGPT login when available",
         "store the PennyRouter API key without printing it",
       ],
     };
@@ -23,12 +29,14 @@ export const codexHarness = {
 
   async install({ apiKey, gatewayBaseUrl, plan }) {
     const current = await readText(CONFIG_PATH, "");
+    const subscriptionAuth = await detectCodexChatgptAuth();
+    const previousModelProvider = rootAssignment(removeManagedCodexConfig(current), "model_provider");
     const backupPath = await backupFile(CONFIG_PATH, "codex");
-    const next = setTomlValue(
-      setTomlValue(current, "openai_base_url", `${gatewayBaseUrl}/v1`),
-      "openai_api_key",
+    const next = renderCodexConfig(current, {
       apiKey,
-    );
+      gatewayBaseUrl,
+      subscriptionAuth,
+    });
 
     await atomicWrite(CONFIG_PATH, next);
 
@@ -38,29 +46,134 @@ export const codexHarness = {
       backup_path: backupPath ? compactHome(backupPath) : null,
       installed_at: new Date().toISOString(),
       restart: "restart Codex",
+      openai_subscription_auth: subscriptionAuth,
+      previous_model_provider: previousModelProvider,
       changes: {
-        keys: ["openai_base_url", "openai_api_key"],
+        provider: PROVIDER_ID,
+        auth: subscriptionAuth ? "openai-subscription+penny-header" : "penny-bearer",
       },
     };
   },
 
   async uninstall(record) {
     const text = await readText(record.config_path, "");
-    const next = text
-      .split("\n")
-      .filter((line) => !/^\s*openai_base_url\s*=/.test(line))
-      .filter((line) => !/^\s*openai_api_key\s*=/.test(line))
-      .join("\n")
-      .replace(/\n{3,}/g, "\n\n");
+    const clean = removeManagedCodexConfig(text);
+    const next = record.previous_model_provider
+      ? restoreRootAssignment(clean, record.previous_model_provider)
+      : clean;
     await atomicWrite(record.config_path, next.endsWith("\n") ? next : `${next}\n`);
   },
 };
 
-function setTomlValue(text, key, value) {
-  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-  const line = `${key} = "${escaped}"`;
-  const pattern = new RegExp(`^\\s*${key}\\s*=.*$`, "m");
-  if (pattern.test(text)) return text.replace(pattern, line);
-  const normalized = text.trimEnd();
-  return `${normalized}${normalized ? "\n" : ""}${line}\n`;
+/**
+ * ChatGPT login remains owned by Codex. We inspect only the non-secret auth mode/account
+ * presence and never copy, print, or persist the access/refresh tokens from auth.json.
+ */
+export function codexUsesChatgptAuth(auth) {
+  if (!auth || typeof auth !== "object") return false;
+  if (String(auth.auth_mode || "").toLowerCase() === "chatgpt") return true;
+  return Boolean(auth.tokens && typeof auth.tokens === "object" && auth.tokens.account_id);
+}
+
+async function detectCodexChatgptAuth() {
+  const auth = await readJsonFile(AUTH_PATH, null);
+  if (codexUsesChatgptAuth(auth)) return true;
+  // auth.json may be absent when Codex uses the OS keyring. `codex login status` reports
+  // only the login mode and does not expose credentials, so it is the safe fallback.
+  const status = spawnSync("codex", ["login", "status"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  return status.status === 0 && /logged in using chatgpt/i.test(`${status.stdout}\n${status.stderr}`);
+}
+
+/**
+ * Install one marker-fenced provider block immediately before the first TOML table.
+ * Root keys appended after a table are scoped into that table by TOML, so model_provider
+ * must live here rather than at EOF. This also migrates the old undocumented root-key
+ * install (openai_base_url/openai_api_key).
+ *
+ * In subscription mode Codex owns and refreshes the OpenAI bearer. The independent
+ * x-pennyrouter-key header authenticates the account to our gateway. In Penny-only mode
+ * the pr- key is the provider bearer, matching the isolated probe's existing behavior.
+ */
+export function renderCodexConfig(text, { apiKey, gatewayBaseUrl, subscriptionAuth }) {
+  const clean = removeManagedCodexConfig(text, { removeRootProvider: true }).trimEnd();
+  if (new RegExp(`^\\s*\\[model_providers\\.${escapeRegex(PROVIDER_ID)}\\]\\s*$`, "m").test(clean)) {
+    throw new Error(
+      `Codex already defines [model_providers.${PROVIDER_ID}] outside PennyRouter's managed block. ` +
+      "Rename that provider before installing so PennyRouter does not overwrite user configuration.",
+    );
+  }
+  const escapedKey = tomlString(apiKey);
+  const escapedUrl = tomlString(`${String(gatewayBaseUrl).replace(/\/+$/, "")}/v1`);
+  const authLines = subscriptionAuth
+    ? [
+        "requires_openai_auth = true",
+        `http_headers = { "x-pennyrouter-key" = ${escapedKey} }`,
+      ]
+    : [`experimental_bearer_token = ${escapedKey}`];
+  const block = [
+    MANAGED_START,
+    `model_provider = "${PROVIDER_ID}"`,
+    "",
+    `[model_providers.${PROVIDER_ID}]`,
+    'name = "PennyRouter"',
+    `base_url = ${escapedUrl}`,
+    'wire_api = "responses"',
+    "supports_websockets = false",
+    ...authLines,
+    MANAGED_END,
+  ].join("\n");
+
+  const lines = clean ? clean.split("\n") : [];
+  const firstTable = lines.findIndex((line) => /^\s*\[/.test(line));
+  const at = firstTable < 0 ? lines.length : firstTable;
+  lines.splice(at, 0, ...(at > 0 && lines[at - 1].trim() ? [""] : []), block,
+    ...(at < lines.length && lines[at + 1]?.trim() ? [""] : []));
+  return `${lines.join("\n").replace(/\n{3,}/g, "\n\n").trim()}\n`;
+}
+
+export function removeManagedCodexConfig(text, { removeRootProvider = false } = {}) {
+  let out = String(text || "").replace(
+    new RegExp(`${escapeRegex(MANAGED_START)}[\\s\\S]*?${escapeRegex(MANAGED_END)}\\n?`, "g"),
+    "",
+  );
+  // Migrate/uninstall the legacy PennyRouter Codex writer. These keys are not part of the
+  // documented custom-provider contract and were written only by older PennyRouter releases.
+  out = out
+    .split("\n")
+    .filter((line) => !/^\s*openai_base_url\s*=/.test(line))
+    .filter((line) => !/^\s*openai_api_key\s*=/.test(line))
+    .join("\n");
+  if (removeRootProvider) {
+    const lines = out.split("\n");
+    const firstTable = lines.findIndex((line) => /^\s*\[/.test(line));
+    const rootEnd = firstTable < 0 ? lines.length : firstTable;
+    out = lines.filter((line, i) => i >= rootEnd || !/^\s*model_provider\s*=/.test(line)).join("\n");
+  }
+  return out.replace(/\n{3,}/g, "\n\n").trim();
+}
+
+function rootAssignment(text, key) {
+  const lines = String(text || "").split("\n");
+  const firstTable = lines.findIndex((line) => /^\s*\[/.test(line));
+  const rootEnd = firstTable < 0 ? lines.length : firstTable;
+  return lines.slice(0, rootEnd).find((line) => new RegExp(`^\\s*${escapeRegex(key)}\\s*=`).test(line)) || null;
+}
+
+function restoreRootAssignment(text, line) {
+  const lines = String(text || "").trim().split("\n");
+  const firstTable = lines.findIndex((item) => /^\s*\[/.test(item));
+  const at = firstTable < 0 ? lines.length : firstTable;
+  lines.splice(at, 0, ...(at > 0 && lines[at - 1].trim() ? [""] : []), line);
+  return lines.join("\n").replace(/\n{3,}/g, "\n\n").trim();
+}
+
+function tomlString(value) {
+  return JSON.stringify(String(value));
+}
+
+function escapeRegex(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }

package/src/harnesses/codex.test.js

@@ -0,0 +1,82 @@
+import assert from "node:assert/strict";
+
+import {
+  codexUsesChatgptAuth,
+  removeManagedCodexConfig,
+  renderCodexConfig,
+} from "./codex.js";
+
+function testAuthDetection() {
+  assert.equal(codexUsesChatgptAuth(null), false);
+  assert.equal(codexUsesChatgptAuth({ auth_mode: "apikey" }), false);
+  assert.equal(codexUsesChatgptAuth({ auth_mode: "chatgpt", tokens: {} }), true);
+  assert.equal(codexUsesChatgptAuth({ tokens: { account_id: "acct_test" } }), true);
+}
+
+function testSubscriptionProviderIsRootSafe() {
+  const original = `model = "gpt-test"\n\n[features]\nplugins = false\n`;
+  const next = renderCodexConfig(original, {
+    apiKey: "pr-test-secret",
+    gatewayBaseUrl: "http://localhost:8400/",
+    subscriptionAuth: true,
+  });
+
+  assert.ok(next.indexOf('model_provider = "pennyrouter"') < next.indexOf("[features]"));
+  assert.ok(next.includes('[model_providers.pennyrouter]'));
+  assert.ok(next.includes('base_url = "http://localhost:8400/v1"'));
+  assert.ok(next.includes("requires_openai_auth = true"));
+  assert.ok(next.includes('http_headers = { "x-pennyrouter-key" = "pr-test-secret" }'));
+  assert.ok(!next.includes("experimental_bearer_token"));
+  assert.equal((next.match(/# --- PennyRouter managed Codex provider ---/g) || []).length, 1);
+}
+
+function testLegacyMigrationAndIdempotence() {
+  const legacy = `[features]\nplugins = false\nopenai_base_url = "http://old/v1"\nopenai_api_key = "pr-old"\n`;
+  const once = renderCodexConfig(legacy, {
+    apiKey: "pr-new",
+    gatewayBaseUrl: "https://api.pennyrouter.com",
+    subscriptionAuth: false,
+  });
+  const twice = renderCodexConfig(once, {
+    apiKey: "pr-new",
+    gatewayBaseUrl: "https://api.pennyrouter.com",
+    subscriptionAuth: false,
+  });
+
+  assert.equal(twice, once);
+  assert.ok(!once.includes("openai_base_url"));
+  assert.ok(!once.includes("openai_api_key"));
+  assert.ok(once.includes('experimental_bearer_token = "pr-new"'));
+  assert.ok(!once.includes("requires_openai_auth"));
+}
+
+function testProviderCollisionFailsClosed() {
+  assert.throws(
+    () => renderCodexConfig('[model_providers.pennyrouter]\nname = "User provider"\n', {
+      apiKey: "pr-new",
+      gatewayBaseUrl: "https://api.pennyrouter.com",
+      subscriptionAuth: true,
+    }),
+    /already defines/,
+  );
+}
+
+function testUninstallLeavesUserConfig() {
+  const original = `model = "gpt-test"\n\n[features]\nplugins = false\n`;
+  const installed = renderCodexConfig(original, {
+    apiKey: "pr-test",
+    gatewayBaseUrl: "http://localhost:8400",
+    subscriptionAuth: true,
+  });
+  const removed = removeManagedCodexConfig(installed);
+
+  assert.equal(removed, original.trim());
+  assert.ok(!removed.includes("pr-test"));
+}
+
+testAuthDetection();
+testSubscriptionProviderIsRootSafe();
+testLegacyMigrationAndIdempotence();
+testProviderCollisionFailsClosed();
+testUninstallLeavesUserConfig();
+console.log("codex.test.js: all checks passed");

package/src/statusline.js

@@ -96,7 +96,7 @@ function claudeEnv() {
   const env = settings.env || {};
   // A normal install writes base + pr- key into settings.json's env block. Fall back to the
   // process environment so an out-of-band launch that supplies them there instead — e.g. the
-  // interactive probe, which passes creds via `--settings <file>` + child env rather than the
+  // interactive probe, which passes creds via --settings <file> + child env rather than the
   // user's settings.json — still resolves Penny. Real installs never set these as env vars, so
   // this fallback is inert for them.
   const base = env.ANTHROPIC_BASE_URL || process.env.ANTHROPIC_BASE_URL || "";
@@ -140,7 +140,11 @@ let cacheAge = Infinity;
 try { cacheAge = Date.now() - statSync(cachePath).mtimeMs; } catch { /* no cache yet */ }
 
 const { base, key } = claudeEnv();
-const pennyInstalled = base.includes("pennyrouter") && Boolean(key);
+// Installed = a base URL plus a pr- key (claudeEnv only returns pr- keys, and the installer
+// writes both together). Do NOT sniff the base URL for "pennyrouter": that substring check
+// false-negatived every dev/localhost gateway (e.g. localhost:8400), rendering a hard
+// "penny off" while the gateway was serving the session fine (observed 2026-07-18).
+const pennyInstalled = Boolean(base) && Boolean(key);
 if (sessionId && pennyInstalled && cacheAge > refreshMs) {
   spawn(process.execPath, [process.argv[1], "--refresh", sessionId], {
     detached: true, stdio: "ignore",

package/src/statusline.test.js

@@ -0,0 +1,72 @@
+// Guards against the class of bug found 2026-07-18: an unescaped backtick inside a
+// comment on line 99 of statusline.js terminated the STATUSLINE_SCRIPT template
+// literal early, so every `pennyrouter install` since shipped a syntactically broken
+// generated script — installs succeeded silently, the crash only surfaced later, at
+// Claude Code's next statusline render, in a completely different process.
+//
+// `npm run check` (node --check on every source file) happened to catch this ONE
+// instance because the break also broke the OUTER file's parse — but that's
+// incidental: a subtler bug (backticks that still balance, or valid-looking JS that's
+// semantically wrong) would pass --check on the outer file yet still crash at
+// runtime, because --check never looks at the STRING CONTENT of a template literal.
+// This test extracts the ACTUAL constant (not a source-text regex) and validates the
+// real generated script: syntax-checks it, then executes it end-to-end with a fake
+// stdin payload the way Claude Code actually invokes it, so a broken script fails
+// `npm run check` locally instead of a user's install.
+//
+// No test framework in this package yet — plain assert + a process exit code, run via
+// `node src/statusline.test.js` (wired into `npm run check`).
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { configureClaudeCodeStatusline, statuslineScriptPath } from "./statusline.js";
+
+async function main() {
+  const tmpState = fs.mkdtempSync(path.join(os.tmpdir(), "pr-statusline-test-"));
+  const prevXdg = process.env.XDG_STATE_HOME;
+  process.env.XDG_STATE_HOME = tmpState;
+  try {
+    const current = {};
+    await configureClaudeCodeStatusline(current);
+    const scriptPath = statuslineScriptPath();
+    assert.ok(fs.existsSync(scriptPath), "script file was written");
+
+    // 1. Syntax: node --check on the ACTUAL written file (not a regex-extracted copy).
+    execFileSync(process.execPath, ["--check", scriptPath], { stdio: "pipe" });
+
+    // 2. Behavior: run it the way Claude Code does — JSON on stdin, plain stdout.
+    // The generated script may discover a real Claude config from the invoking user's
+    // home, but must render a valid Penny segment either way. XDG_STATE_HOME is isolated
+    // above, so no cached session state or wrapped command can influence this check.
+    const payload = JSON.stringify({
+      session_id: "test-session",
+      model: { display_name: "Test Model" },
+      workspace: { current_dir: "/tmp" },
+    });
+    const out = execFileSync(process.execPath, [scriptPath], {
+      input: payload, encoding: "utf8", timeout: 5000,
+    });
+    assert.ok(out.includes("🪙 penny"), `expected Penny status segment in output, got: ${out}`);
+    assert.ok(out.includes("Test Model"), `expected model name passed through, got: ${out}`);
+
+    // 3. Malformed stdin must not crash the script (best-effort JSON.parse fallback).
+    const outBadInput = execFileSync(process.execPath, [scriptPath], {
+      input: "not json", encoding: "utf8", timeout: 5000,
+    });
+    assert.ok(outBadInput.length > 0, "script still prints something on bad stdin");
+  } finally {
+    if (prevXdg === undefined) delete process.env.XDG_STATE_HOME;
+    else process.env.XDG_STATE_HOME = prevXdg;
+    fs.rmSync(tmpState, { recursive: true, force: true });
+  }
+
+  console.log("statusline.test.js: all checks passed");
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});