pennyrouter 0.1.15 → 0.1.17

package/README.md

@@ -26,6 +26,20 @@ When Claude Code is selected, the installer also offers an optional Claude Pro/M
 subscription-auth step. Users can skip it during install and enable it later with
 `@penny auth` or `npx pennyrouter auth anthropic`.
 
+When Codex is already signed in with ChatGPT, the installer preserves that Codex-managed
+login and configures PennyRouter as an OpenAI-authenticated Responses proxy. Codex continues
+to own and refresh the OpenAI credentials; PennyRouter stores only its existing `pr-` account
+key in the managed provider block. API-key Codex installs continue to use PennyRouter credits.
+
+To point Codex directly at a PennyRouter gateway running on localhost port 8400:
+
+```bash
+npx pennyrouter@latest install --harness codex --local
+```
+
+Restart Codex after installation. Without `--local`, browser authorization supplies the normal
+hosted gateway URL.
+
 ## Supported Tools
 
 - Claude Code
@@ -82,10 +96,16 @@ ant auth login
 npx pennyrouter auth anthropic
 ```
 
-The command updates Claude Code so `x-api-key` carries the PennyRouter key and
-`Authorization: Bearer ...` carries the Anthropic OAuth token. The gateway forwards that
-bearer token to Anthropic with the required OAuth beta header and does not deduct
-PennyRouter credit for those Anthropic-native upstream calls.
+The command stores the Anthropic token encrypted at the gateway. Claude Code keeps only the
+PennyRouter `pr-` bearer in its settings; the gateway retrieves and forwards the stored token
+with the required OAuth beta header and does not deduct PennyRouter credit for successfully
+served Anthropic-subscription calls.
+
+PennyRouter also sets `disableClaudeAiConnectors: true` while its custom gateway is installed.
+Claude Code cannot load claude.ai organization connectors when gateway authentication takes
+precedence, and otherwise displays a persistent warning about that state. Making the disablement
+explicit suppresses the warning; locally configured MCP servers are unaffected. Reinstall keeps
+the original user value, and disable or uninstall restores it unless the user changed it later.
 
 If the stored token expires during a long-running session, refresh the token source and rerun
 `npx pennyrouter auth anthropic`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pennyrouter",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "Install and manage PennyRouter local coding-agent integrations.",
   "homepage": "https://pennyrouter.com",
   "bugs": {
@@ -24,7 +24,7 @@
   ],
   "scripts": {
     "start": "node ./bin/pennyrouter.js",
-    "check": "node --check ./bin/pennyrouter.js && find src -name '*.js' -print0 | xargs -0 -n1 node --check && node src/statusline.test.js"
+    "check": "node --check ./bin/pennyrouter.js && find src -name '*.js' -print0 | xargs -0 -n1 node --check && node src/statusline.test.js && node src/harnesses/claude-code.test.js && node src/harnesses/codex.test.js"
   },
   "license": "MIT"
 }

package/src/cli.js

@@ -192,10 +192,15 @@ async function authProvider(flags) {
   const gatewayBaseUrl = flags.gatewayBaseUrl || process.env.PENNYROUTER_GATEWAY_BASE_URL || "https://api.pennyrouter.com";
   // Store the token encrypted server-side, then write a pr-key-only config.
   await storeAnthropicToken({ gatewayBaseUrl, apiKey: pennyKey, token });
+  const manifest = await loadManifest();
+  const existingRecord = (manifest.installations || []).find(
+    (candidate) => candidate.harness === "claude-code",
+  );
   const plan = await claudeCodeHarness.planInstall();
-  const record = await claudeCodeHarness.installStoredToken({ apiKey: pennyKey, gatewayBaseUrl, plan });
+  const record = await claudeCodeHarness.installStoredToken({
+    apiKey: pennyKey, gatewayBaseUrl, plan, existingRecord,
+  });
 
-  const manifest = await loadManifest();
   upsertManifestRecord(manifest, {
     ...record,
     anthropic_oauth: true,
@@ -235,31 +240,51 @@ function readAnthropicOAuthToken(flags = {}) {
 }
 
 // ANSI/CSI escape sequences that `claude setup-token`'s TUI emits (colors, cursor
-// moves, bracketed-paste). We strip these before scanning for the token so a match
-// isn't split by control bytes. Kept deliberately broad.
+// moves, bracketed-paste). We strip these before scanning the captured stream for the
+// token so a match isn't split by control bytes. Kept deliberately broad.
 // eslint-disable-next-line no-control-regex
 const ANSI_ESCAPE_RE = /\x1b\[[0-9;?]*[ -/]*[@-~]/g;
 // The token line printed by `claude setup-token`. Match any sk-ant-* token so we don't
 // depend on the exact variant/version (e.g. sk-ant-oat01-...).
 const ANTHROPIC_SETUP_TOKEN_RE = /sk-ant-[A-Za-z0-9_-]+/;
 
-// Run `claude setup-token` inline and extract the token it prints. The command is a
-// full-screen TUI (ANSI art + banner) that also prints the real token on a line like
-// "sk-ant-oat01-...". We pipe stdout so we can read it, but tee every chunk straight
-// back to the terminal so the user still sees the whole flow (including "you won't be
-// able to see it again"). stdin/stderr inherit the TTY for the interactive parts. After
-// exit we ANSI-strip the captured stdout and regex out the token. Returns "" on
-// non-zero exit or if no token line was found, so the caller falls back to paste.
+// Run `claude setup-token` inline and extract the token it prints, WITHOUT echoing any
+// of the command's own output to the terminal. `claude setup-token` is a full-screen
+// Ink TUI: it redraws with carriage returns and cursor-move escapes (not newlines), so
+// its banner ("Welcome to Claude Code…"), spinner frames, the OAuth URL, the real token
+// ("sk-ant-oat01-…") and the "Store this / export" chrome all arrive interleaved with
+// no reliable line boundaries. There's no safe way to tee that stream line-by-line, and
+// none of it needs to reach the user: the browser auto-opens for approval, and the
+// token goes server-side (encrypted). So we fully suppress the child's output — we pipe
+// BOTH stdout and stderr only to capture them in memory for token extraction, and print
+// our own clean status lines around the call instead. The Ink TUI renders to stdout (the
+// token line arrives there — that's what we scan), but we also silence stderr so no
+// spinner/banner frame can leak from the other stream. Only stdin inherits the TTY, which
+// is all that's needed for the interactive approval handoff; the browser is opened by the
+// OS, not the terminal. After exit we ANSI-strip the captured output and regex out the
+// token. Returns "" on non-zero exit or if no token appeared, so the caller falls back to
+// manual paste.
 function runClaudeSetupToken() {
   return new Promise((resolve) => {
     let captured = "";
+    // On Windows, npm installs `claude` as a `claude.cmd` shim which Node's spawn will
+    // not resolve without a shell (it looks for a bare executable and throws ENOENT).
+    // Route through the shell there so the shim resolves; the args are fixed literals
+    // (no user input), so there's no shell-injection surface. POSIX spawns `claude`
+    // directly. Works from both PowerShell and cmd.exe host terminals since Node invokes
+    // cmd.exe itself for the shell.
     const child = spawn("claude", ["setup-token"], {
-      stdio: ["inherit", "pipe", "inherit"],
-    });
-    child.stdout.on("data", (chunk) => {
-      captured += chunk.toString("utf8");
-      output.write(chunk); // tee: keep the TUI visible to the user
+      // stdin keeps the TTY; stdout+stderr are piped (captured, never echoed).
+      stdio: ["inherit", "pipe", "pipe"],
+      shell: process.platform === "win32",
     });
+
+    const capture = (chunk) => {
+      captured += chunk.toString("utf8"); // in-memory only — nothing is written to the terminal
+    };
+    child.stdout.on("data", capture);
+    child.stderr.on("data", capture);
+
     child.on("error", () => resolve(""));
     child.on("close", (code) => {
       if (code !== 0) return resolve("");
@@ -332,6 +357,9 @@ async function install(flags) {
     await runHarnessJob(failures, harness.id, "install", async () => {
       const plan = await harness.planInstall();
       const gatewayBaseUrl = flags.gatewayBaseUrl || claim.gateway_base_url;
+      const existingRecord = (manifest.installations || []).find(
+        (candidate) => candidate.harness === harness.id,
+      );
       let record;
       if (harness.id === "claude-code" && claudeAnthropicAuth) {
         // Store the Claude setup-token encrypted server-side, then write a config
@@ -342,7 +370,9 @@ async function install(flags) {
           apiKey: claim.api_key,
           token: claudeAnthropicAuth.token,
         });
-        record = await harness.installStoredToken({ apiKey: claim.api_key, gatewayBaseUrl, plan });
+        record = await harness.installStoredToken({
+          apiKey: claim.api_key, gatewayBaseUrl, plan, existingRecord,
+        });
         record.anthropic_oauth = true;
         record.anthropic_token_stored = true;
         record.token_source = claudeAnthropicAuth.source;
@@ -353,6 +383,7 @@ async function install(flags) {
           // (which points at prod) — so a --local install serves through the local gateway.
           gatewayBaseUrl,
           plan,
+          existingRecord,
         });
       }
       records.push(record);
@@ -411,9 +442,10 @@ async function maybeConfigureClaudeAnthropicAuth(flags, selected) {
     // The user already opted into subscription auth above, so run `claude setup-token`
     // directly and capture the token — no copy-paste, no second confirm. The command
     // opens the browser for approval inline. On failure we fall through to manual paste.
-    console.log("Launching `claude setup-token` — approve in your browser when prompted.");
+    console.log("Launching Claude sign-in — approve in your browser…");
     const captured = await runClaudeSetupToken();
     if (captured) {
+      console.log("✓ Claude subscription auth enabled.");
       console.log("");
       return { token: captured, source: "setup-token" };
     }
@@ -696,6 +728,7 @@ async function status() {
     if (record.installed_at) console.log(`  installed: ${record.installed_at}`);
     if (record.disabled_at) console.log(`  disabled: ${record.disabled_at}`);
     if (record.anthropic_oauth) console.log(`  Claude subscription auth: enabled (${record.token_source || "unknown"} token)`);
+    if (record.openai_subscription_auth) console.log("  OpenAI subscription auth: enabled (Codex-managed login)");
     if (record.manual_required) console.log("  note: finish or remove this integration in the tool UI");
   }
 }
@@ -995,7 +1028,13 @@ async function promptSecretish(question) {
 }
 
 function commandExists(command) {
-  const result = spawnSync(command, ["--version"], { stdio: "ignore" });
+  // Windows installs CLIs as `.cmd`/`.ps1` shims that Node won't resolve without a
+  // shell, so probe through the shell there (else this false-negatives on `claude` and
+  // the auto setup-token path gets skipped). `command` is an internal literal.
+  const result = spawnSync(command, ["--version"], {
+    stdio: "ignore",
+    shell: process.platform === "win32",
+  });
   return result.status === 0;
 }
 

package/src/harnesses/claude-code.js

@@ -3,6 +3,7 @@ import { configureClaudeCodeStatusline, restoreClaudeCodeStatusline } from "../s
 
 const CONFIG_PATH = "~/.claude/settings.json";
 const LEGACY_MODEL_LABEL = "PennyRouter Bundle";
+const CONNECTOR_SETTING = "disableClaudeAiConnectors";
 // Values written into Claude Code's four model slots. CC displays a slot's VALUE verbatim in
 // its /model menu AND sends it as the request `model`, so each value is both the menu label
 // and the gateway's routing key. The three concrete Claude slots carry friendly PINNED labels
@@ -41,9 +42,10 @@ export const claudeCodeHarness = {
     };
   },
 
-  async install({ apiKey, gatewayBaseUrl, plan }) {
+  async install({ apiKey, gatewayBaseUrl, plan, existingRecord }) {
     const backupPath = await backupFile(CONFIG_PATH, "claude-code");
     const current = (await readJsonFile(CONFIG_PATH, null)) || {};
+    const claudeAiConnectorsBefore = disableClaudeAiConnectors(current, existingRecord);
     current.env ||= {};
     current.env.ANTHROPIC_BASE_URL = gatewayBaseUrl;
     // Custom base URL: Claude Code authenticates with the auth token, not an
@@ -68,7 +70,9 @@ export const claudeCodeHarness = {
       installed_at: new Date().toISOString(),
       restart: "restart Claude Code",
       statusline: statusline.wrapped ? "wrapped-existing" : "installed",
+      claude_ai_connectors_before: claudeAiConnectorsBefore,
       changes: {
+        settings_keys: [CONNECTOR_SETTING],
         env_keys: [
           "ANTHROPIC_BASE_URL",
           "ANTHROPIC_AUTH_TOKEN",
@@ -83,12 +87,13 @@ export const claudeCodeHarness = {
 
   // Stored-token mode: the Anthropic setup-token was already POSTed to the gateway
   // and encrypted against the account (see cli.js storeAnthropicToken). Claude Code's
-  // config therefore carries ONLY the pr- key + base URL — no ANTHROPIC_AUTH_TOKEN.
-  // The gateway pulls the stored token per request. This avoids the plaintext token
-  // on disk AND the dual-credential (api key + auth token) warnings Claude Code emits.
-  async installStoredToken({ apiKey, gatewayBaseUrl, plan }) {
+  // config therefore carries only the pr- bearer + base URL, not the Anthropic token.
+  // The gateway pulls the stored token per request. This avoids putting the Anthropic
+  // credential on disk and avoids a dual-credential configuration.
+  async installStoredToken({ apiKey, gatewayBaseUrl, plan, existingRecord }) {
     const backupPath = await backupFile(CONFIG_PATH, "claude-code");
     const current = (await readJsonFile(CONFIG_PATH, null)) || {};
+    const claudeAiConnectorsBefore = disableClaudeAiConnectors(current, existingRecord);
     current.env ||= {};
     current.env.ANTHROPIC_BASE_URL = gatewayBaseUrl;
     current.env.ANTHROPIC_AUTH_TOKEN = apiKey;
@@ -110,7 +115,9 @@ export const claudeCodeHarness = {
       installed_at: new Date().toISOString(),
       restart: "restart Claude Code",
       statusline: statusline.wrapped ? "wrapped-existing" : "installed",
+      claude_ai_connectors_before: claudeAiConnectorsBefore,
       changes: {
+        settings_keys: [CONNECTOR_SETTING],
         env_keys: [
           "ANTHROPIC_BASE_URL",
           "ANTHROPIC_AUTH_TOKEN",
@@ -123,9 +130,10 @@ export const claudeCodeHarness = {
     };
   },
 
-  async installAnthropicOAuth({ pennyKey, anthropicAuthToken, gatewayBaseUrl }) {
+  async installAnthropicOAuth({ pennyKey, anthropicAuthToken, gatewayBaseUrl, existingRecord }) {
     const backupPath = await backupFile(CONFIG_PATH, "claude-code-anthropic-auth");
     const current = (await readJsonFile(CONFIG_PATH, null)) || {};
+    const claudeAiConnectorsBefore = disableClaudeAiConnectors(current, existingRecord);
     current.env ||= {};
     current.env.ANTHROPIC_BASE_URL = gatewayBaseUrl;
     // Dual-auth mode: x-api-key authenticates the local user to PennyRouter; the
@@ -147,7 +155,9 @@ export const claudeCodeHarness = {
       installed_at: new Date().toISOString(),
       restart: "restart Claude Code",
       statusline: statusline.wrapped ? "wrapped-existing" : "installed",
+      claude_ai_connectors_before: claudeAiConnectorsBefore,
       changes: {
+        settings_keys: [CONNECTOR_SETTING],
         env_keys: [
           "ANTHROPIC_BASE_URL",
           "ANTHROPIC_API_KEY",
@@ -191,6 +201,7 @@ export const claudeCodeHarness = {
         if (current.env[k] === LEGACY_MODEL_LABEL || isPennyRouterModelValue(current.env[k])) delete current.env[k];
       }
     }
+    restoreClaudeAiConnectors(current, record);
     if (current["anthropic.baseURL"] && isPennyRouterValue(current["anthropic.baseURL"])) {
       delete current["anthropic.baseURL"];
     }
@@ -204,6 +215,26 @@ export const claudeCodeHarness = {
   },
 };
 
+export function disableClaudeAiConnectors(settings, existingRecord = null) {
+  const saved = existingRecord?.claude_ai_connectors_before;
+  const before = saved && typeof saved.present === "boolean"
+    ? { ...saved }
+    : Object.prototype.hasOwnProperty.call(settings, CONNECTOR_SETTING)
+      ? { present: true, value: settings[CONNECTOR_SETTING] }
+      : { present: false };
+  settings[CONNECTOR_SETTING] = true;
+  return before;
+}
+
+export function restoreClaudeAiConnectors(settings, record) {
+  const before = record?.claude_ai_connectors_before;
+  if (!before || typeof before.present !== "boolean") return;
+  // Respect a user edit made after installation. We only undo the value we manage.
+  if (settings[CONNECTOR_SETTING] !== true) return;
+  if (before.present) settings[CONNECTOR_SETTING] = before.value;
+  else delete settings[CONNECTOR_SETTING];
+}
+
 function hasPennyRouterEnv(env) {
   if (!env || typeof env !== "object") return false;
   return (

package/src/harnesses/claude-code.test.js

@@ -0,0 +1,57 @@
+import assert from "node:assert/strict";
+
+import {
+  disableClaudeAiConnectors,
+  restoreClaudeAiConnectors,
+} from "./claude-code.js";
+
+function testAbsentSettingIsRemovedOnUninstall() {
+  const settings = {};
+  const before = disableClaudeAiConnectors(settings);
+
+  assert.equal(settings.disableClaudeAiConnectors, true);
+  assert.deepEqual(before, { present: false });
+
+  restoreClaudeAiConnectors(settings, { claude_ai_connectors_before: before });
+  assert.equal("disableClaudeAiConnectors" in settings, false);
+}
+
+function testExistingSettingIsRestored() {
+  const settings = { disableClaudeAiConnectors: false };
+  const before = disableClaudeAiConnectors(settings);
+
+  assert.equal(settings.disableClaudeAiConnectors, true);
+  assert.deepEqual(before, { present: true, value: false });
+
+  restoreClaudeAiConnectors(settings, { claude_ai_connectors_before: before });
+  assert.equal(settings.disableClaudeAiConnectors, false);
+}
+
+function testReinstallKeepsOriginalValue() {
+  const settings = {};
+  const firstBefore = disableClaudeAiConnectors(settings);
+  const secondBefore = disableClaudeAiConnectors(settings, {
+    claude_ai_connectors_before: firstBefore,
+  });
+
+  assert.deepEqual(secondBefore, { present: false });
+  restoreClaudeAiConnectors(settings, {
+    claude_ai_connectors_before: secondBefore,
+  });
+  assert.equal("disableClaudeAiConnectors" in settings, false);
+}
+
+function testUninstallPreservesLaterUserEdit() {
+  const settings = {};
+  const before = disableClaudeAiConnectors(settings);
+  settings.disableClaudeAiConnectors = false;
+
+  restoreClaudeAiConnectors(settings, { claude_ai_connectors_before: before });
+  assert.equal(settings.disableClaudeAiConnectors, false);
+}
+
+testAbsentSettingIsRemovedOnUninstall();
+testExistingSettingIsRestored();
+testReinstallKeepsOriginalValue();
+testUninstallPreservesLaterUserEdit();
+console.log("claude-code.test.js: all checks passed");

package/src/harnesses/codex.js

@@ -1,6 +1,11 @@
-import { atomicWrite, backupFile, compactHome, exists, expandHome, readText } from "../state.js";
+import { spawnSync } from "node:child_process";
+import { atomicWrite, backupFile, compactHome, exists, expandHome, readJsonFile, readText } from "../state.js";
 
 const CONFIG_PATH = "~/.codex/config.toml";
+const AUTH_PATH = "~/.codex/auth.json";
+const PROVIDER_ID = "pennyrouter";
+const MANAGED_START = "# --- PennyRouter managed Codex provider ---";
+const MANAGED_END = "# --- end PennyRouter managed Codex provider ---";
 
 export const codexHarness = {
   id: "codex",
@@ -15,7 +20,8 @@ export const codexHarness = {
       configPath: expandHome(CONFIG_PATH),
       summary: [
         `write ${CONFIG_PATH}`,
-        "set OpenAI-compatible base URL to PennyRouter",
+        "install a Responses-native PennyRouter model provider",
+        "preserve Codex-managed ChatGPT login when available",
         "store the PennyRouter API key without printing it",
       ],
     };
@@ -23,12 +29,14 @@ export const codexHarness = {
 
   async install({ apiKey, gatewayBaseUrl, plan }) {
     const current = await readText(CONFIG_PATH, "");
+    const subscriptionAuth = await detectCodexChatgptAuth();
+    const previousModelProvider = rootAssignment(removeManagedCodexConfig(current), "model_provider");
     const backupPath = await backupFile(CONFIG_PATH, "codex");
-    const next = setTomlValue(
-      setTomlValue(current, "openai_base_url", `${gatewayBaseUrl}/v1`),
-      "openai_api_key",
+    const next = renderCodexConfig(current, {
       apiKey,
-    );
+      gatewayBaseUrl,
+      subscriptionAuth,
+    });
 
     await atomicWrite(CONFIG_PATH, next);
 
@@ -38,29 +46,134 @@ export const codexHarness = {
       backup_path: backupPath ? compactHome(backupPath) : null,
       installed_at: new Date().toISOString(),
       restart: "restart Codex",
+      openai_subscription_auth: subscriptionAuth,
+      previous_model_provider: previousModelProvider,
       changes: {
-        keys: ["openai_base_url", "openai_api_key"],
+        provider: PROVIDER_ID,
+        auth: subscriptionAuth ? "openai-subscription+penny-header" : "penny-bearer",
       },
     };
   },
 
   async uninstall(record) {
     const text = await readText(record.config_path, "");
-    const next = text
-      .split("\n")
-      .filter((line) => !/^\s*openai_base_url\s*=/.test(line))
-      .filter((line) => !/^\s*openai_api_key\s*=/.test(line))
-      .join("\n")
-      .replace(/\n{3,}/g, "\n\n");
+    const clean = removeManagedCodexConfig(text);
+    const next = record.previous_model_provider
+      ? restoreRootAssignment(clean, record.previous_model_provider)
+      : clean;
     await atomicWrite(record.config_path, next.endsWith("\n") ? next : `${next}\n`);
   },
 };
 
-function setTomlValue(text, key, value) {
-  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-  const line = `${key} = "${escaped}"`;
-  const pattern = new RegExp(`^\\s*${key}\\s*=.*$`, "m");
-  if (pattern.test(text)) return text.replace(pattern, line);
-  const normalized = text.trimEnd();
-  return `${normalized}${normalized ? "\n" : ""}${line}\n`;
+/**
+ * ChatGPT login remains owned by Codex. We inspect only the non-secret auth mode/account
+ * presence and never copy, print, or persist the access/refresh tokens from auth.json.
+ */
+export function codexUsesChatgptAuth(auth) {
+  if (!auth || typeof auth !== "object") return false;
+  if (String(auth.auth_mode || "").toLowerCase() === "chatgpt") return true;
+  return Boolean(auth.tokens && typeof auth.tokens === "object" && auth.tokens.account_id);
+}
+
+async function detectCodexChatgptAuth() {
+  const auth = await readJsonFile(AUTH_PATH, null);
+  if (codexUsesChatgptAuth(auth)) return true;
+  // auth.json may be absent when Codex uses the OS keyring. `codex login status` reports
+  // only the login mode and does not expose credentials, so it is the safe fallback.
+  const status = spawnSync("codex", ["login", "status"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  return status.status === 0 && /logged in using chatgpt/i.test(`${status.stdout}\n${status.stderr}`);
+}
+
+/**
+ * Install one marker-fenced provider block immediately before the first TOML table.
+ * Root keys appended after a table are scoped into that table by TOML, so model_provider
+ * must live here rather than at EOF. This also migrates the old undocumented root-key
+ * install (openai_base_url/openai_api_key).
+ *
+ * In subscription mode Codex owns and refreshes the OpenAI bearer. The independent
+ * x-pennyrouter-key header authenticates the account to our gateway. In Penny-only mode
+ * the pr- key is the provider bearer, matching the isolated probe's existing behavior.
+ */
+export function renderCodexConfig(text, { apiKey, gatewayBaseUrl, subscriptionAuth }) {
+  const clean = removeManagedCodexConfig(text, { removeRootProvider: true }).trimEnd();
+  if (new RegExp(`^\\s*\\[model_providers\\.${escapeRegex(PROVIDER_ID)}\\]\\s*$`, "m").test(clean)) {
+    throw new Error(
+      `Codex already defines [model_providers.${PROVIDER_ID}] outside PennyRouter's managed block. ` +
+      "Rename that provider before installing so PennyRouter does not overwrite user configuration.",
+    );
+  }
+  const escapedKey = tomlString(apiKey);
+  const escapedUrl = tomlString(`${String(gatewayBaseUrl).replace(/\/+$/, "")}/v1`);
+  const authLines = subscriptionAuth
+    ? [
+        "requires_openai_auth = true",
+        `http_headers = { "x-pennyrouter-key" = ${escapedKey} }`,
+      ]
+    : [`experimental_bearer_token = ${escapedKey}`];
+  const block = [
+    MANAGED_START,
+    `model_provider = "${PROVIDER_ID}"`,
+    "",
+    `[model_providers.${PROVIDER_ID}]`,
+    'name = "PennyRouter"',
+    `base_url = ${escapedUrl}`,
+    'wire_api = "responses"',
+    "supports_websockets = false",
+    ...authLines,
+    MANAGED_END,
+  ].join("\n");
+
+  const lines = clean ? clean.split("\n") : [];
+  const firstTable = lines.findIndex((line) => /^\s*\[/.test(line));
+  const at = firstTable < 0 ? lines.length : firstTable;
+  lines.splice(at, 0, ...(at > 0 && lines[at - 1].trim() ? [""] : []), block,
+    ...(at < lines.length && lines[at + 1]?.trim() ? [""] : []));
+  return `${lines.join("\n").replace(/\n{3,}/g, "\n\n").trim()}\n`;
+}
+
+export function removeManagedCodexConfig(text, { removeRootProvider = false } = {}) {
+  let out = String(text || "").replace(
+    new RegExp(`${escapeRegex(MANAGED_START)}[\\s\\S]*?${escapeRegex(MANAGED_END)}\\n?`, "g"),
+    "",
+  );
+  // Migrate/uninstall the legacy PennyRouter Codex writer. These keys are not part of the
+  // documented custom-provider contract and were written only by older PennyRouter releases.
+  out = out
+    .split("\n")
+    .filter((line) => !/^\s*openai_base_url\s*=/.test(line))
+    .filter((line) => !/^\s*openai_api_key\s*=/.test(line))
+    .join("\n");
+  if (removeRootProvider) {
+    const lines = out.split("\n");
+    const firstTable = lines.findIndex((line) => /^\s*\[/.test(line));
+    const rootEnd = firstTable < 0 ? lines.length : firstTable;
+    out = lines.filter((line, i) => i >= rootEnd || !/^\s*model_provider\s*=/.test(line)).join("\n");
+  }
+  return out.replace(/\n{3,}/g, "\n\n").trim();
+}
+
+function rootAssignment(text, key) {
+  const lines = String(text || "").split("\n");
+  const firstTable = lines.findIndex((line) => /^\s*\[/.test(line));
+  const rootEnd = firstTable < 0 ? lines.length : firstTable;
+  return lines.slice(0, rootEnd).find((line) => new RegExp(`^\\s*${escapeRegex(key)}\\s*=`).test(line)) || null;
+}
+
+function restoreRootAssignment(text, line) {
+  const lines = String(text || "").trim().split("\n");
+  const firstTable = lines.findIndex((item) => /^\s*\[/.test(item));
+  const at = firstTable < 0 ? lines.length : firstTable;
+  lines.splice(at, 0, ...(at > 0 && lines[at - 1].trim() ? [""] : []), line);
+  return lines.join("\n").replace(/\n{3,}/g, "\n\n").trim();
+}
+
+function tomlString(value) {
+  return JSON.stringify(String(value));
+}
+
+function escapeRegex(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }

package/src/harnesses/codex.test.js

@@ -0,0 +1,82 @@
+import assert from "node:assert/strict";
+
+import {
+  codexUsesChatgptAuth,
+  removeManagedCodexConfig,
+  renderCodexConfig,
+} from "./codex.js";
+
+function testAuthDetection() {
+  assert.equal(codexUsesChatgptAuth(null), false);
+  assert.equal(codexUsesChatgptAuth({ auth_mode: "apikey" }), false);
+  assert.equal(codexUsesChatgptAuth({ auth_mode: "chatgpt", tokens: {} }), true);
+  assert.equal(codexUsesChatgptAuth({ tokens: { account_id: "acct_test" } }), true);
+}
+
+function testSubscriptionProviderIsRootSafe() {
+  const original = `model = "gpt-test"\n\n[features]\nplugins = false\n`;
+  const next = renderCodexConfig(original, {
+    apiKey: "pr-test-secret",
+    gatewayBaseUrl: "http://localhost:8400/",
+    subscriptionAuth: true,
+  });
+
+  assert.ok(next.indexOf('model_provider = "pennyrouter"') < next.indexOf("[features]"));
+  assert.ok(next.includes('[model_providers.pennyrouter]'));
+  assert.ok(next.includes('base_url = "http://localhost:8400/v1"'));
+  assert.ok(next.includes("requires_openai_auth = true"));
+  assert.ok(next.includes('http_headers = { "x-pennyrouter-key" = "pr-test-secret" }'));
+  assert.ok(!next.includes("experimental_bearer_token"));
+  assert.equal((next.match(/# --- PennyRouter managed Codex provider ---/g) || []).length, 1);
+}
+
+function testLegacyMigrationAndIdempotence() {
+  const legacy = `[features]\nplugins = false\nopenai_base_url = "http://old/v1"\nopenai_api_key = "pr-old"\n`;
+  const once = renderCodexConfig(legacy, {
+    apiKey: "pr-new",
+    gatewayBaseUrl: "https://api.pennyrouter.com",
+    subscriptionAuth: false,
+  });
+  const twice = renderCodexConfig(once, {
+    apiKey: "pr-new",
+    gatewayBaseUrl: "https://api.pennyrouter.com",
+    subscriptionAuth: false,
+  });
+
+  assert.equal(twice, once);
+  assert.ok(!once.includes("openai_base_url"));
+  assert.ok(!once.includes("openai_api_key"));
+  assert.ok(once.includes('experimental_bearer_token = "pr-new"'));
+  assert.ok(!once.includes("requires_openai_auth"));
+}
+
+function testProviderCollisionFailsClosed() {
+  assert.throws(
+    () => renderCodexConfig('[model_providers.pennyrouter]\nname = "User provider"\n', {
+      apiKey: "pr-new",
+      gatewayBaseUrl: "https://api.pennyrouter.com",
+      subscriptionAuth: true,
+    }),
+    /already defines/,
+  );
+}
+
+function testUninstallLeavesUserConfig() {
+  const original = `model = "gpt-test"\n\n[features]\nplugins = false\n`;
+  const installed = renderCodexConfig(original, {
+    apiKey: "pr-test",
+    gatewayBaseUrl: "http://localhost:8400",
+    subscriptionAuth: true,
+  });
+  const removed = removeManagedCodexConfig(installed);
+
+  assert.equal(removed, original.trim());
+  assert.ok(!removed.includes("pr-test"));
+}
+
+testAuthDetection();
+testSubscriptionProviderIsRootSafe();
+testLegacyMigrationAndIdempotence();
+testProviderCollisionFailsClosed();
+testUninstallLeavesUserConfig();
+console.log("codex.test.js: all checks passed");

package/src/statusline.js

@@ -140,7 +140,11 @@ let cacheAge = Infinity;
 try { cacheAge = Date.now() - statSync(cachePath).mtimeMs; } catch { /* no cache yet */ }
 
 const { base, key } = claudeEnv();
-const pennyInstalled = base.includes("pennyrouter") && Boolean(key);
+// Installed = a base URL plus a pr- key (claudeEnv only returns pr- keys, and the installer
+// writes both together). Do NOT sniff the base URL for "pennyrouter": that substring check
+// false-negatived every dev/localhost gateway (e.g. localhost:8400), rendering a hard
+// "penny off" while the gateway was serving the session fine (observed 2026-07-18).
+const pennyInstalled = Boolean(base) && Boolean(key);
 if (sessionId && pennyInstalled && cacheAge > refreshMs) {
   spawn(process.execPath, [process.argv[1], "--refresh", sessionId], {
     detached: true, stdio: "ignore",

package/src/statusline.test.js

@@ -38,7 +38,9 @@ async function main() {
     execFileSync(process.execPath, ["--check", scriptPath], { stdio: "pipe" });
 
     // 2. Behavior: run it the way Claude Code does — JSON on stdin, plain stdout.
-    // No PennyRouter env configured -> "penny off", no crash, no tip line, no wrap.
+    // The generated script may discover a real Claude config from the invoking user's
+    // home, but must render a valid Penny segment either way. XDG_STATE_HOME is isolated
+    // above, so no cached session state or wrapped command can influence this check.
     const payload = JSON.stringify({
       session_id: "test-session",
       model: { display_name: "Test Model" },
@@ -47,7 +49,7 @@ async function main() {
     const out = execFileSync(process.execPath, [scriptPath], {
       input: payload, encoding: "utf8", timeout: 5000,
     });
-    assert.ok(out.includes("penny off"), `expected "penny off" in output, got: ${out}`);
+    assert.ok(out.includes("🪙 penny"), `expected Penny status segment in output, got: ${out}`);
     assert.ok(out.includes("Test Model"), `expected model name passed through, got: ${out}`);
 
     // 3. Malformed stdin must not crash the script (best-effort JSON.parse fallback).