pennyrouter 0.2.35 → 0.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pennyrouter",
-  "version": "0.2.35",
+  "version": "0.3.1",
   "description": "Install and manage PennyRouter local coding-agent integrations.",
   "homepage": "https://pennyrouter.com",
   "bugs": {

package/src/cli.js

@@ -185,8 +185,18 @@ function parseArgs(argv) {
     else if (arg.startsWith("--harness=")) flags.harness = arg.slice("--harness=".length);
     else if (arg === "--app-url") flags.appUrl = rest[++i] || "";
     else if (arg.startsWith("--app-url=")) flags.appUrl = arg.slice("--app-url=".length);
-    else if (arg === "--gateway-base-url") flags.gatewayBaseUrl = rest[++i] || "";
-    else if (arg.startsWith("--gateway-base-url=")) flags.gatewayBaseUrl = arg.slice("--gateway-base-url=".length);
+    // A --gateway-base-url is a *private* gateway: an admin-run deployment that issues its own
+    // keys. Flag it so install can require the matching admin-issued key. --local/--prod are
+    // developer shortcuts against gateways that honor prod keys, so they do not set this.
+    else if (arg === "--gateway-base-url") { flags.gatewayBaseUrl = rest[++i] || ""; flags.privateGateway = true; }
+    else if (arg.startsWith("--gateway-base-url=")) {
+      flags.gatewayBaseUrl = arg.slice("--gateway-base-url=".length);
+      flags.privateGateway = true;
+    }
+    // Admin-issued key for a private gateway (see scripts/provision_local_key.py). Overrides the
+    // key returned by the browser claim, which is only valid against the hosted gateway.
+    else if (arg === "--private-key") flags.privateKey = rest[++i] || "";
+    else if (arg.startsWith("--private-key=")) flags.privateKey = arg.slice("--private-key=".length);
     // --local: point the installed harness at a locally-running gateway (default
     // http://localhost:8400), for developing/testing against your own gateway. Auth still goes
     // to prod (pennyrouter.com) so you get a real key; only the harness's serving URL is local.
@@ -608,7 +618,35 @@ export async function install(flags = {}) {
       const privateGateway = (await promptText(
         "PennyRouter gateway URL for this proxy (blank for hosted gateway): ",
       )).trim();
-      if (privateGateway) gatewayBaseUrl = privateGateway;
+      if (privateGateway) {
+        gatewayBaseUrl = privateGateway;
+        flags.privateGateway = true;
+      }
+    }
+
+    // A private gateway has its own key store, so the hosted key from the browser claim is
+    // meaningless there. Require the admin-issued key and use it for every subsequent gateway
+    // call (credential storage, probing, harness config).
+    if (flags.privateGateway) {
+      let privateKey = (flags.privateKey || "").trim();
+      if (!privateKey && !flags.yes && input.isTTY && output.isTTY) {
+        console.log("");
+        console.log(`Private gateway: ${gatewayBaseUrl}`);
+        console.log("Your PennyRouter administrator issues keys for this gateway.");
+        privateKey = (await promptText("Paste your private gateway key (pr-...): ")).trim();
+      }
+      if (!privateKey) {
+        throw new Error(
+          `A private gateway (${gatewayBaseUrl}) needs its own key. `
+          + "Ask your PennyRouter administrator for one and pass `--private-key pr-...`.",
+        );
+      }
+      if (!privateKey.startsWith("pr-")) {
+        throw new Error(`That does not look like a PennyRouter key — expected it to start with "pr-".`);
+      }
+      claim.api_key = privateKey;
+      console.log(`Using private gateway key ${maskKey(privateKey)}.`);
+      console.log("");
     }
 
     for (const credential of funding.credentials) {
@@ -2067,7 +2105,7 @@ function printHelp() {
   console.log(`PennyRouter CLI
 
 Usage:
-  pennyrouter install [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes] [--dry-run] [--make-default|--penny-only] [--no-path-update] [--no-mcp] [--anthropic-auth|--no-anthropic-auth] [--anthropic-api-key KEY] [--openai-api-key KEY] [--openai-proxy-base-url URL --openai-proxy-api-key KEY] [--openrouter-api-key KEY] [--proxy-base-url URL --proxy-api-key KEY] [--local[=URL]|--prod] [--config PATH]
+  pennyrouter install [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes] [--dry-run] [--make-default|--penny-only] [--no-path-update] [--no-mcp] [--anthropic-auth|--no-anthropic-auth] [--anthropic-api-key KEY] [--openai-api-key KEY] [--openai-proxy-base-url URL --openai-proxy-api-key KEY] [--openrouter-api-key KEY] [--proxy-base-url URL --proxy-api-key KEY] [--gateway-base-url URL --private-key pr-...] [--local[=URL]|--prod] [--config PATH]
   pennyrouter update [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--dry-run] [--penny-key pr-...] [--gateway-base-url URL|--local[=URL]|--prod] [--no-mcp]
   pennyrouter auth anthropic [--penny-key pr-...] [--token oauth-token] [--token-command CMD] [--gateway-base-url URL] [--forget]
   pennyrouter disable [--harness ${SUPPORTED_HARNESS_IDS}] [--all] [--yes]
@@ -2080,6 +2118,10 @@ When an interactive install selects an Anthropic or OpenAI-compatible proxy, it
 that can reach that proxy. Leave it blank for the hosted gateway, or enter a private/self-hosted
 gateway URL. Use --gateway-base-url (or --local for localhost:8400 development) for non-interactive installs.
 
+A private gateway keeps its own keys, so the key from the browser login does not work there. Whenever
+you point install at one — with --gateway-base-url or by entering a URL at that prompt — you must also
+supply the key your PennyRouter administrator issued you: paste it when asked, or pass --private-key pr-...
+
 Install and update both register the Threads MCP server with Claude Code and Codex (--no-mcp to
 skip a run). Run "pennyrouter mcp install" if you skipped it or had to rename a conflicting
 server, "pennyrouter mcp status" to see whether it is wired up, and "pennyrouter mcp uninstall"
@@ -2110,6 +2152,7 @@ Examples:
   npx pennyrouter install --harness codex --openai-api-key <key>
   npx pennyrouter install --harness claude-code --proxy-base-url https://proxy.example.com --proxy-api-key <key>
   npx pennyrouter install --openrouter-api-key <key>
+  npx pennyrouter install --gateway-base-url https://gateway.internal.example.com --private-key pr-...
   npx pennyrouter auth anthropic
   npx pennyrouter install --all
   npx pennyrouter install --harness windsurf,zed,codegpt,aider --yes