pennyrouter 0.3.12 → 0.3.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pennyrouter",
-  "version": "0.3.12",
+  "version": "0.3.15",
   "description": "Install and manage PennyRouter local coding-agent integrations.",
   "homepage": "https://pennyrouter.com",
   "bugs": {

package/src/cli.js

@@ -174,7 +174,7 @@ async function profiles(flags) {
   }
   if (requested) {
     // Resolve before saving so an unknown name fails without changing anything.
-    const selected = resolvePennyProfile(config, requested);
+    const selected = resolvePennyProfile(config, requested, { requireExisting: true });
     await savePennyConfig({ ...selected, active_profile: requested });
     console.log(`Active profile is now "${requested}" (${selected.gateway_base_url}).`);
     return;

package/src/harnesses/codex.js

@@ -51,8 +51,8 @@ export const codexHarness = {
       openai_subscription_auth: subscriptionAuth,
       previous_model_provider: previousModelProvider,
       changes: {
-        provider: PROVIDER_ID,
-        auth: subscriptionAuth ? "openai-subscription+penny-header" : "penny-bearer",
+        provider: subscriptionAuth ? "openai" : PROVIDER_ID,
+        auth: subscriptionAuth ? "openai-subscription+penny-metadata" : "penny-bearer",
       },
     };
   },
@@ -95,9 +95,10 @@ export async function detectCodexChatgptAuth() {
  * must live here rather than at EOF. This also migrates the old undocumented root-key
  * install (openai_base_url/openai_api_key).
  *
- * In subscription mode Codex owns and refreshes the OpenAI bearer. The independent
- * x-pennyrouter-key header authenticates the account to our gateway. In Penny-only mode
- * the pr- key is the provider bearer, matching the isolated probe's existing behavior.
+ * In subscription mode keep Codex's reserved built-in OpenAI provider selected. That is what
+ * installs its native base instructions, additional_tools packet, and local `exec` dispatcher.
+ * Penny authentication travels in bounded Responses metadata, leaving Codex's OAuth bearer
+ * untouched. In Penny-only mode the custom provider contract remains unchanged.
  */
 export function renderCodexConfig(
   text,
@@ -112,11 +113,23 @@ export function renderCodexConfig(
   }
   const escapedKey = tomlString(apiKey);
   const escapedUrl = tomlString(`${String(gatewayBaseUrl).replace(/\/+$/, "")}/v1`);
+  if (subscriptionAuth) {
+    const block = [
+      MANAGED_START,
+      'model_provider = "openai"',
+      `openai_base_url = ${escapedUrl}`,
+      `responses_api_metadata = { pennyrouter_key = ${escapedKey}, pennyrouter_harness = "codex", pennyrouter_surface = ${tomlString(surface)} }`,
+      MANAGED_END,
+    ].join("\n");
+    const lines = clean ? clean.split("\n") : [];
+    const firstTable = lines.findIndex((line) => /^\s*\[/.test(line));
+    const at = firstTable < 0 ? lines.length : firstTable;
+    lines.splice(at, 0, ...(at > 0 && lines[at - 1].trim() ? [""] : []), block,
+      ...(at < lines.length && lines[at + 1]?.trim() ? [""] : []));
+    return `${lines.join("\n").replace(/\n{3,}/g, "\n\n").trim()}\n`;
+  }
   const authLines = subscriptionAuth
-    ? [
-        "requires_openai_auth = true",
-        `http_headers = { "x-pennyrouter-key" = ${escapedKey}, "x-pennyrouter-harness" = "codex", "x-pennyrouter-surface" = ${tomlString(surface)} }`,
-      ]
+    ? []
     : [
         `experimental_bearer_token = ${escapedKey}`,
         `http_headers = { "x-pennyrouter-harness" = "codex", "x-pennyrouter-surface" = ${tomlString(surface)} }`,

package/src/harnesses/codex.test.js

@@ -25,13 +25,13 @@ function testSubscriptionProviderIsRootSafe() {
     subscriptionAuth: true,
   });
 
-  assert.ok(next.indexOf('model_provider = "pennyrouter"') < next.indexOf("[features]"));
-  assert.ok(next.includes('[model_providers.pennyrouter]'));
-  assert.ok(next.includes('base_url = "http://localhost:8400/v1"'));
-  assert.ok(next.includes("requires_openai_auth = true"));
-  assert.ok(next.includes('"x-pennyrouter-key" = "pr-test-secret"'));
-  assert.ok(next.includes('"x-pennyrouter-harness" = "codex"'));
-  assert.ok(next.includes('"x-pennyrouter-surface" = "codex-terminal"'));
+  assert.ok(next.indexOf('model_provider = "openai"') < next.indexOf("[features]"));
+  assert.ok(!next.includes('[model_providers.pennyrouter]'));
+  assert.ok(next.includes('openai_base_url = "http://localhost:8400/v1"'));
+  assert.ok(next.includes('pennyrouter_key = "pr-test-secret"'));
+  assert.ok(next.includes('pennyrouter_harness = "codex"'));
+  assert.ok(next.includes('pennyrouter_surface = "codex-terminal"'));
+  assert.ok(!next.includes("requires_openai_auth"));
   assert.ok(!next.includes("experimental_bearer_token"));
   assert.equal((next.match(/# --- PennyRouter managed Codex provider ---/g) || []).length, 1);
 }

package/src/launch.js

@@ -29,7 +29,8 @@ import { atomicWrite, homeDir, readJsonFile, readText } from "./state.js";
 const CONFIG_VERSION = 1;
 const PATH_START = "# >>> pennyrouter PATH >>>";
 const PATH_END = "# <<< pennyrouter PATH <<<";
-const CODEX_PROFILE_MARKER = "# PennyRouter per-command profile (managed; no secrets)";
+const CODEX_PROFILE_MARKER = "# PennyRouter per-command profile (managed)";
+const LEGACY_CODEX_PROFILE_MARKER = "# PennyRouter per-command profile (managed; no secrets)";
 const CLAUDE_COMMAND_MARKER = "<!-- PennyRouter managed Claude command -->";
 // A stable UUID keeps upgrades idempotent and avoids creating a new visible profile on
 // every launch. It is deliberately not the user's hand-authored profile id.
@@ -151,16 +152,19 @@ export function activePennyProfile(config) {
  * `gateway_base_url`. Every consumer reads those two fields, so resolving here keeps the
  * profile lookup in one place rather than threading a profile through each caller.
  *
- * An unconfigured machine resolves to a profile with no credentials rather than throwing:
- * `install` has to run against a config that does not exist yet.
+ * A name that does not exist yet resolves to a profile with no credentials rather than
+ * throwing, because `install --profile private` has to read the profile it is about to
+ * create. Only an explicit `requireExisting` lookup — selecting a profile to launch or
+ * switch to — treats an unknown name as an error.
  */
-export function resolvePennyProfile(config, name = null) {
+export function resolvePennyProfile(config, name = null, { requireExisting = false } = {}) {
   const requested = name || activePennyProfile(config);
   const profiles = config.profiles || {};
   const entry = profiles[requested];
   if (!entry) {
-    if (Object.keys(profiles).length === 0) return { ...config, profile: requested };
-    const known = Object.keys(profiles).join(", ");
+    if (!requireExisting) return { ...config, profile: requested };
+    const names = Object.keys(profiles);
+    const known = names.length ? names.join(", ") : "none configured";
     throw new Error(`Unknown PennyRouter profile "${requested}". Available: ${known}.`);
   }
   return {
@@ -183,13 +187,13 @@ export function setPennyProfile(config, name, { apiKey, gatewayBaseUrl }) {
   };
 }
 
-export async function loadPennyConfig({ profile = null } = {}) {
+export async function loadPennyConfig({ profile = null, requireExisting = false } = {}) {
   const config = (await readJsonFile(pennyConfigPath(), null)) || {
     version: CONFIG_VERSION,
     profiles: {},
     harnesses: {},
   };
-  return resolvePennyProfile(config, profile);
+  return resolvePennyProfile(config, profile, { requireExisting });
 }
 
 /**
@@ -362,16 +366,24 @@ export async function installPennyRuntime({ updatePath = true } = {}) {
   return { supported: true, ...path, shim_path: pennyShimPath() };
 }
 
-export function renderCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth }) {
-  const authLines = subscriptionAuth
-    ? [
-        "requires_openai_auth = true",
-        'env_http_headers = { "x-pennyrouter-key" = "PENNYROUTER_API_KEY", "x-pennyrouter-title-session" = "PENNYROUTER_TITLE_SESSION_ID", "x-pennyrouter-harness" = "codex", "x-pennyrouter-surface" = "codex-terminal" }',
-      ]
-    : [
-        'env_key = "PENNYROUTER_API_KEY"',
-        'http_headers = { "x-pennyrouter-title-session" = "PENNYROUTER_TITLE_SESSION_ID", "x-pennyrouter-harness" = "codex", "x-pennyrouter-surface" = "codex-terminal" }',
-      ];
+export function renderCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth, apiKey }) {
+  if (subscriptionAuth) {
+    if (!apiKey) throw new Error("PennyRouter credential is required for Codex subscription mode.");
+    return [
+      CODEX_PROFILE_MARKER,
+      'model_provider = "openai"',
+      `openai_base_url = ${JSON.stringify(`${String(gatewayBaseUrl).replace(/\/+$/, "")}/v1`)}`,
+      `responses_api_metadata = { pennyrouter_key = ${JSON.stringify(apiKey)}, pennyrouter_harness = "codex", pennyrouter_surface = "codex-terminal" }`,
+      "",
+      "[tui]",
+      "terminal_title = []",
+      "",
+    ].join("\n");
+  }
+  const authLines = [
+    'env_key = "PENNYROUTER_API_KEY"',
+    'http_headers = { "x-pennyrouter-title-session" = "PENNYROUTER_TITLE_SESSION_ID", "x-pennyrouter-harness" = "codex", "x-pennyrouter-surface" = "codex-terminal" }',
+  ];
   return [
     CODEX_PROFILE_MARKER,
     'model_provider = "pennyrouter"',
@@ -612,12 +624,12 @@ export async function createCodexDesktopHome({ config, realHome }) {
     if (!config.api_key) throw new Error("No PennyRouter key found. Run `npx pennyrouter install` first.");
     if (!config.gateway_base_url) throw new Error("No PennyRouter gateway configured. Run `npx pennyrouter install` first.");
     const nativeConfig = await readText(join(realHome, "config.toml"), "");
-    const desktopConfig = setCodexDesktopDefault(renderCodexConfig(removeCodexPennyProvider(nativeConfig), {
+    const desktopConfig = renderCodexConfig(removeCodexPennyProvider(nativeConfig), {
       apiKey: config.api_key,
       gatewayBaseUrl: config.gateway_base_url,
       subscriptionAuth: Boolean(config.harnesses?.codex?.subscription_auth),
       surface: "codex-desktop",
-    }));
+    });
     await privateWrite(join(overlay, "config.toml"), desktopConfig);
     return overlay;
   } catch (error) {
@@ -626,15 +638,6 @@ export async function createCodexDesktopHome({ config, realHome }) {
   }
 }
 
-function setCodexDesktopDefault(text) {
-  const lines = String(text).split("\n");
-  const firstTable = lines.findIndex((line) => /^\s*\[/.test(line));
-  const rootEnd = firstTable < 0 ? lines.length : firstTable;
-  const root = lines.slice(0, rootEnd).filter((line) => !/^\s*model_provider\s*=/.test(line));
-  root.unshift('model_provider = "pennyrouter"');
-  return [...root, ...lines.slice(rootEnd)].join("\n");
-}
-
 function removeCodexPennyProvider(text) {
   const lines = String(text).split("\n");
   const start = lines.findIndex((line) => /^\s*\[model_providers\.pennyrouter\]\s*$/.test(line));
@@ -770,15 +773,19 @@ async function writeClaudeUserSkill() {
   }
 }
 
-async function writeCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth, profile }) {
+async function writeCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth, apiKey, profile }) {
   const path = codexLaunchProfilePath(profile);
   const existing = await readText(path, "");
-  if (existing.trim() && !existing.startsWith(CODEX_PROFILE_MARKER)) {
+  if (existing.trim() && !isManagedCodexLaunchProfile(existing)) {
     throw new Error(
       `${path} already exists and is not managed by PennyRouter. Rename it before installing.`,
     );
   }
-  await privateWrite(path, renderCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth }));
+  await privateWrite(path, renderCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth, apiKey }));
+}
+
+function isManagedCodexLaunchProfile(text) {
+  return text.startsWith(CODEX_PROFILE_MARKER) || text.startsWith(LEGACY_CODEX_PROFILE_MARKER);
 }
 
 export async function configurePennyHarness(harness, {
@@ -810,6 +817,7 @@ export async function configurePennyHarness(harness, {
     await writeCodexLaunchProfile({
       gatewayBaseUrl,
       subscriptionAuth,
+      apiKey,
       profile: config.active_profile,
     });
     config.harnesses.codex = {
@@ -856,7 +864,7 @@ export async function removePennyHarness(harness) {
     for (const name of listPennyProfiles(config)) {
       const path = codexLaunchProfilePath(name);
       const existing = await readText(path, "");
-      if (!existing.startsWith(CODEX_PROFILE_MARKER)) continue;
+      if (!isManagedCodexLaunchProfile(existing)) continue;
       await unlink(path).catch((error) => {
         if (error.code !== "ENOENT") throw error;
       });
@@ -1039,7 +1047,10 @@ export async function runPenny(argv = process.argv.slice(2)) {
   }
   const selection = extractProfileArgs(argv.slice(1));
   argv = [harness, ...selection.args];
-  const config = await loadPennyConfig({ profile: selection.profile });
+  const config = await loadPennyConfig({
+    profile: selection.profile,
+    requireExisting: Boolean(selection.profile),
+  });
   if (harness === "claude" && argv[1]?.toLowerCase() === "desktop") {
     const option = argv[2]?.toLowerCase();
     if (option === "--restore" || option === "restore") {

package/src/launch.test.js

@@ -183,19 +183,19 @@ async function main() {
       realHome: path.join(home, ".codex"),
     });
     const desktopConfig = fs.readFileSync(path.join(desktopHome, "config.toml"), "utf8");
-    assert.match(desktopConfig, /^model_provider = "pennyrouter"/);
-    assert.match(desktopConfig, /\[model_providers\.pennyrouter\]/);
-    assert.match(desktopConfig, /"x-pennyrouter-key" = "pr-super-secret"/);
-    assert.match(desktopConfig, /"x-pennyrouter-surface" = "codex-desktop"/);
+    assert.match(desktopConfig, /^model_provider = "openai"/m);
+    assert.doesNotMatch(desktopConfig, /\[model_providers\.pennyrouter\]/);
+    assert.match(desktopConfig, /pennyrouter_key = "pr-super-secret"/);
+    assert.match(desktopConfig, /pennyrouter_surface = "codex-desktop"/);
     assert.equal(fs.readFileSync(path.join(home, ".codex", "config.toml"), "utf8"), nativeCodex);
     fs.rmSync(desktopHome, { recursive: true, force: true });
     const codexProfile = fs.readFileSync(codexLaunchProfilePath(), "utf8");
-    assert.ok(codexProfile.includes('"x-pennyrouter-key" = "PENNYROUTER_API_KEY"'));
+    assert.match(codexProfile, /^# PennyRouter per-command profile \(managed\)\nmodel_provider = "openai"/);
+    assert.match(codexProfile, /openai_base_url = "https:\/\/gateway\.example\/v1"/);
+    assert.match(codexProfile, /pennyrouter_key = "pr-super-secret"/);
     assert.ok(codexProfile.includes("[tui]\nterminal_title = []"));
-    assert.ok(codexProfile.includes('"x-pennyrouter-title-session" = "PENNYROUTER_TITLE_SESSION_ID"'));
-    assert.ok(codexProfile.includes('"x-pennyrouter-harness" = "codex"'));
-    assert.ok(codexProfile.includes('"x-pennyrouter-surface" = "codex-terminal"'));
-    assert.ok(!codexProfile.includes("pr-super-secret"));
+    assert.ok(codexProfile.includes('pennyrouter_harness = "codex"'));
+    assert.ok(codexProfile.includes('pennyrouter_surface = "codex-terminal"'));
     assert.ok(!rc.includes("pr-super-secret"));
 
     const claude = buildPennyInvocation("claude", ["--resume", "abc"], config);
@@ -284,6 +284,10 @@ async function main() {
     });
     assert.ok(paid.includes('env_key = "PENNYROUTER_API_KEY"'));
     assert.ok(!paid.includes("requires_openai_auth"));
+
+    // Inside the fixture: testProfiles persists a config, which must land in the
+    // temporary HOME and never in the developer's real ~/.config/pennyrouter.
+    await testProfiles();
   } finally {
     for (const key of ENV_KEYS) {
       if (previous[key] === undefined) delete process.env[key];
@@ -292,7 +296,6 @@ async function main() {
     fs.rmSync(root, { recursive: true, force: true });
   }
 
-  await testProfiles();
   console.log("launch.test.js: all checks passed");
 }
 
@@ -333,7 +336,21 @@ async function testProfiles() {
     resolvePennyProfile(config, "cloud").gateway_base_url,
     "https://api.pennyrouter.com",
   );
-  assert.throws(() => resolvePennyProfile(config, "nope"), /Unknown PennyRouter profile/);
+  // A not-yet-created profile resolves empty: `install --profile private` must be able to
+  // read the profile it is about to write, even when other profiles already exist.
+  const pending = resolvePennyProfile(config, "brand-new");
+  assert.equal(pending.profile, "brand-new");
+  assert.equal(pending.api_key, undefined);
+  // Selecting one to launch or switch to is the opposite: an unknown name must fail loudly
+  // rather than silently launching with no credentials.
+  assert.throws(
+    () => resolvePennyProfile(config, "nope", { requireExisting: true }),
+    /Unknown PennyRouter profile "nope"\. Available: cloud, private\./,
+  );
+  await assert.rejects(
+    loadPennyConfig({ profile: "nope", requireExisting: true }),
+    /Unknown PennyRouter profile/,
+  );
 
   // A resolved config must not persist one profile's credentials at the top level,
   // where they would shadow whichever profile is selected on the next load.