pennyrouter 0.3.15 → 0.3.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pennyrouter",
-  "version": "0.3.15",
+  "version": "0.3.17",
   "description": "Install and manage PennyRouter local coding-agent integrations.",
   "homepage": "https://pennyrouter.com",
   "bugs": {

package/src/harnesses/codex.js

@@ -51,8 +51,8 @@ export const codexHarness = {
       openai_subscription_auth: subscriptionAuth,
       previous_model_provider: previousModelProvider,
       changes: {
-        provider: subscriptionAuth ? "openai" : PROVIDER_ID,
-        auth: subscriptionAuth ? "openai-subscription+penny-metadata" : "penny-bearer",
+        provider: PROVIDER_ID,
+        auth: subscriptionAuth ? "openai-subscription+penny-header" : "penny-bearer",
       },
     };
   },
@@ -95,10 +95,9 @@ export async function detectCodexChatgptAuth() {
  * must live here rather than at EOF. This also migrates the old undocumented root-key
  * install (openai_base_url/openai_api_key).
  *
- * In subscription mode keep Codex's reserved built-in OpenAI provider selected. That is what
- * installs its native base instructions, additional_tools packet, and local `exec` dispatcher.
- * Penny authentication travels in bounded Responses metadata, leaving Codex's OAuth bearer
- * untouched. In Penny-only mode the custom provider contract remains unchanged.
+ * In subscription mode Codex owns and refreshes the OpenAI bearer. The independent
+ * x-pennyrouter-key header authenticates the account to our gateway. In Penny-only mode
+ * the pr- key is the provider bearer, matching the isolated probe's existing behavior.
  */
 export function renderCodexConfig(
   text,
@@ -113,23 +112,11 @@ export function renderCodexConfig(
   }
   const escapedKey = tomlString(apiKey);
   const escapedUrl = tomlString(`${String(gatewayBaseUrl).replace(/\/+$/, "")}/v1`);
-  if (subscriptionAuth) {
-    const block = [
-      MANAGED_START,
-      'model_provider = "openai"',
-      `openai_base_url = ${escapedUrl}`,
-      `responses_api_metadata = { pennyrouter_key = ${escapedKey}, pennyrouter_harness = "codex", pennyrouter_surface = ${tomlString(surface)} }`,
-      MANAGED_END,
-    ].join("\n");
-    const lines = clean ? clean.split("\n") : [];
-    const firstTable = lines.findIndex((line) => /^\s*\[/.test(line));
-    const at = firstTable < 0 ? lines.length : firstTable;
-    lines.splice(at, 0, ...(at > 0 && lines[at - 1].trim() ? [""] : []), block,
-      ...(at < lines.length && lines[at + 1]?.trim() ? [""] : []));
-    return `${lines.join("\n").replace(/\n{3,}/g, "\n\n").trim()}\n`;
-  }
   const authLines = subscriptionAuth
-    ? []
+    ? [
+        "requires_openai_auth = true",
+        `http_headers = { "x-pennyrouter-key" = ${escapedKey}, "x-pennyrouter-harness" = "codex", "x-pennyrouter-surface" = ${tomlString(surface)} }`,
+      ]
     : [
         `experimental_bearer_token = ${escapedKey}`,
         `http_headers = { "x-pennyrouter-harness" = "codex", "x-pennyrouter-surface" = ${tomlString(surface)} }`,

package/src/harnesses/codex.test.js

@@ -25,13 +25,13 @@ function testSubscriptionProviderIsRootSafe() {
     subscriptionAuth: true,
   });
 
-  assert.ok(next.indexOf('model_provider = "openai"') < next.indexOf("[features]"));
-  assert.ok(!next.includes('[model_providers.pennyrouter]'));
-  assert.ok(next.includes('openai_base_url = "http://localhost:8400/v1"'));
-  assert.ok(next.includes('pennyrouter_key = "pr-test-secret"'));
-  assert.ok(next.includes('pennyrouter_harness = "codex"'));
-  assert.ok(next.includes('pennyrouter_surface = "codex-terminal"'));
-  assert.ok(!next.includes("requires_openai_auth"));
+  assert.ok(next.indexOf('model_provider = "pennyrouter"') < next.indexOf("[features]"));
+  assert.ok(next.includes('[model_providers.pennyrouter]'));
+  assert.ok(next.includes('base_url = "http://localhost:8400/v1"'));
+  assert.ok(next.includes("requires_openai_auth = true"));
+  assert.ok(next.includes('"x-pennyrouter-key" = "pr-test-secret"'));
+  assert.ok(next.includes('"x-pennyrouter-harness" = "codex"'));
+  assert.ok(next.includes('"x-pennyrouter-surface" = "codex-terminal"'));
   assert.ok(!next.includes("experimental_bearer_token"));
   assert.equal((next.match(/# --- PennyRouter managed Codex provider ---/g) || []).length, 1);
 }

package/src/harnesses/opencode.js

@@ -146,6 +146,36 @@ export const opencodeHarness = {
   },
 };
 
+/**
+ * Drop the persistent PennyRouter provider block from OpenCode's config.
+ *
+ * `penny opencode` supplies the provider per launch instead. OpenCode deep-merges the
+ * launch config over this file rather than replacing it, so a block left here would
+ * union its retired models into the picker and pin every session to whichever gateway
+ * was installed last. It also holds an API key in plaintext that the launch path keeps
+ * in the process environment instead.
+ */
+export async function stripPersistentOpenCodeProvider() {
+  const configPath = (await exists(JSONC_PATH)) ? JSONC_PATH : JSON_PATH;
+  if (!(await exists(configPath))) return false;
+  const current = await readConfig(configPath);
+  const hadProvider = Boolean(current.provider?.pennyrouter);
+  const hadEnabled = Array.isArray(current.enabled_providers)
+    && current.enabled_providers.includes("pennyrouter");
+  if (!hadProvider && !hadEnabled) return false;
+
+  if (hadProvider) delete current.provider.pennyrouter;
+  if (current.provider && Object.keys(current.provider).length === 0) delete current.provider;
+  if (hadEnabled) {
+    // Installing wrote this to surface the Penny models. Left behind it would hide every
+    // other provider the user configured from a plain `opencode`.
+    current.enabled_providers = current.enabled_providers.filter((p) => p !== "pennyrouter");
+    if (current.enabled_providers.length === 0) delete current.enabled_providers;
+  }
+  await atomicWrite(configPath, `${JSON.stringify(current, null, 2)}\n`);
+  return true;
+}
+
 async function removeGeneratedModelCache() {
   try {
     await unlink(expandHome(MODEL_CACHE_PATH));
@@ -210,9 +240,11 @@ export function opencodeModelId(modelId) {
 
 export async function fetchOpenCodeModels(gatewayBaseUrl, apiKey, { requireFresh = false } = {}) {
   try {
+    // The harness header selects the gateway's OpenAI-wire catalog: it relays the
+    // upstream proxy's real allowlist rather than PennyRouter's discovery-only entries.
     const headers = apiKey
-      ? { Authorization: `Bearer ${apiKey}`, "x-api-key": apiKey }
-      : undefined;
+      ? { Authorization: `Bearer ${apiKey}`, "x-api-key": apiKey, "x-pennyrouter-harness": "opencode" }
+      : { "x-pennyrouter-harness": "opencode" };
     const response = await fetch(`${String(gatewayBaseUrl).replace(/\/+$/, "")}/v1/models`, { headers });
     if (!response.ok) throw new Error(`model catalog returned ${response.status}`);
     const payload = await response.json();

package/src/harnesses/opencode.test.js

@@ -66,6 +66,7 @@ async function main() {
     assert.deepEqual(request.options.headers, {
       Authorization: "Bearer pr-test",
       "x-api-key": "pr-test",
+      "x-pennyrouter-harness": "opencode",
     });
 
     const plan = await opencodeHarness.planInstall();

package/src/launch.js

@@ -24,13 +24,17 @@ import {
   writeClaudeCodeModelPresentation,
 } from "./harnesses/claude-code.js";
 import { renderCodexConfig } from "./harnesses/codex.js";
-import { atomicWrite, homeDir, readJsonFile, readText } from "./state.js";
+import {
+  OPENCODE_MODEL_CHOICES,
+  fetchOpenCodeModels,
+  stripPersistentOpenCodeProvider,
+} from "./harnesses/opencode.js";
+import { atomicWrite, homeDir, readJsonFile, readText, writeJsonFile } from "./state.js";
 
 const CONFIG_VERSION = 1;
 const PATH_START = "# >>> pennyrouter PATH >>>";
 const PATH_END = "# <<< pennyrouter PATH <<<";
-const CODEX_PROFILE_MARKER = "# PennyRouter per-command profile (managed)";
-const LEGACY_CODEX_PROFILE_MARKER = "# PennyRouter per-command profile (managed; no secrets)";
+const CODEX_PROFILE_MARKER = "# PennyRouter per-command profile (managed; no secrets)";
 const CLAUDE_COMMAND_MARKER = "<!-- PennyRouter managed Claude command -->";
 // A stable UUID keeps upgrades idempotent and avoids creating a new visible profile on
 // every launch. It is deliberately not the user's hand-authored profile id.
@@ -172,21 +176,40 @@ export function resolvePennyProfile(config, name = null, { requireExisting = fal
     profile: requested,
     api_key: entry.api_key,
     gateway_base_url: entry.gateway_base_url,
+    subscription_auth: entry.subscription_auth,
   };
 }
 
-/** Write credentials into a named profile and make it active. */
-export function setPennyProfile(config, name, { apiKey, gatewayBaseUrl }) {
+/**
+ * Write credentials into a named profile and make it active. Existing keys on the profile
+ * are preserved: `subscription_auth` is profile-scoped and outlives a credential refresh.
+ */
+export function setPennyProfile(config, name, { apiKey, gatewayBaseUrl, subscriptionAuth }) {
+  const existing = (config.profiles || {})[name] || {};
+  const next = { ...existing, api_key: apiKey, gateway_base_url: gatewayBaseUrl };
+  if (subscriptionAuth !== undefined) next.subscription_auth = Boolean(subscriptionAuth);
   return {
     ...config,
-    profiles: {
-      ...(config.profiles || {}),
-      [name]: { api_key: apiKey, gateway_base_url: gatewayBaseUrl },
-    },
+    profiles: { ...(config.profiles || {}), [name]: next },
     active_profile: name,
   };
 }
 
+/**
+ * Resolve whether a harness may use subscription-backed upstream auth.
+ *
+ * Subscription auth is a property of the gateway, not the harness: a private/proxy gateway
+ * (Bedrock, corporate egress) has no subscription lane to route to, and asking a harness to
+ * attach a ChatGPT/Anthropic token there produces upstream calls it cannot complete. The
+ * profile value therefore wins; the harness-level value is the pre-profile fallback for
+ * installs written before the flag moved. Absent both, it is off.
+ */
+export function resolveSubscriptionAuth(config, harness) {
+  const profileValue = config?.subscription_auth;
+  if (profileValue !== undefined) return Boolean(profileValue);
+  return Boolean(config?.harnesses?.[harness]?.subscription_auth);
+}
+
 export async function loadPennyConfig({ profile = null, requireExisting = false } = {}) {
   const config = (await readJsonFile(pennyConfigPath(), null)) || {
     version: CONFIG_VERSION,
@@ -366,14 +389,12 @@ export async function installPennyRuntime({ updatePath = true } = {}) {
   return { supported: true, ...path, shim_path: pennyShimPath() };
 }
 
-export function renderCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth, apiKey }) {
+export function renderCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth }) {
   if (subscriptionAuth) {
-    if (!apiKey) throw new Error("PennyRouter credential is required for Codex subscription mode.");
     return [
       CODEX_PROFILE_MARKER,
       'model_provider = "openai"',
-      `openai_base_url = ${JSON.stringify(`${String(gatewayBaseUrl).replace(/\/+$/, "")}/v1`)}`,
-      `responses_api_metadata = { pennyrouter_key = ${JSON.stringify(apiKey)}, pennyrouter_harness = "codex", pennyrouter_surface = "codex-terminal" }`,
+      `openai_base_url = ${JSON.stringify(String(gatewayBaseUrl).replace(/\/+$/, ""))}`,
       "",
       "[tui]",
       "terminal_title = []",
@@ -624,12 +645,12 @@ export async function createCodexDesktopHome({ config, realHome }) {
     if (!config.api_key) throw new Error("No PennyRouter key found. Run `npx pennyrouter install` first.");
     if (!config.gateway_base_url) throw new Error("No PennyRouter gateway configured. Run `npx pennyrouter install` first.");
     const nativeConfig = await readText(join(realHome, "config.toml"), "");
-    const desktopConfig = renderCodexConfig(removeCodexPennyProvider(nativeConfig), {
+    const desktopConfig = setCodexDesktopDefault(renderCodexConfig(removeCodexPennyProvider(nativeConfig), {
       apiKey: config.api_key,
       gatewayBaseUrl: config.gateway_base_url,
-      subscriptionAuth: Boolean(config.harnesses?.codex?.subscription_auth),
+      subscriptionAuth: resolveSubscriptionAuth(config, "codex"),
       surface: "codex-desktop",
-    });
+    }));
     await privateWrite(join(overlay, "config.toml"), desktopConfig);
     return overlay;
   } catch (error) {
@@ -638,6 +659,15 @@ export async function createCodexDesktopHome({ config, realHome }) {
   }
 }
 
+function setCodexDesktopDefault(text) {
+  const lines = String(text).split("\n");
+  const firstTable = lines.findIndex((line) => /^\s*\[/.test(line));
+  const rootEnd = firstTable < 0 ? lines.length : firstTable;
+  const root = lines.slice(0, rootEnd).filter((line) => !/^\s*model_provider\s*=/.test(line));
+  root.unshift('model_provider = "pennyrouter"');
+  return [...root, ...lines.slice(rootEnd)].join("\n");
+}
+
 function removeCodexPennyProvider(text) {
   const lines = String(text).split("\n");
   const start = lines.findIndex((line) => /^\s*\[model_providers\.pennyrouter\]\s*$/.test(line));
@@ -773,19 +803,15 @@ async function writeClaudeUserSkill() {
   }
 }
 
-async function writeCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth, apiKey, profile }) {
+async function writeCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth, profile }) {
   const path = codexLaunchProfilePath(profile);
   const existing = await readText(path, "");
-  if (existing.trim() && !isManagedCodexLaunchProfile(existing)) {
+  if (existing.trim() && !existing.startsWith(CODEX_PROFILE_MARKER)) {
     throw new Error(
       `${path} already exists and is not managed by PennyRouter. Rename it before installing.`,
     );
   }
-  await privateWrite(path, renderCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth, apiKey }));
-}
-
-function isManagedCodexLaunchProfile(text) {
-  return text.startsWith(CODEX_PROFILE_MARKER) || text.startsWith(LEGACY_CODEX_PROFILE_MARKER);
+  await privateWrite(path, renderCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth }));
 }
 
 export async function configurePennyHarness(harness, {
@@ -817,7 +843,6 @@ export async function configurePennyHarness(harness, {
     await writeCodexLaunchProfile({
       gatewayBaseUrl,
       subscriptionAuth,
-      apiKey,
       profile: config.active_profile,
     });
     config.harnesses.codex = {
@@ -864,7 +889,7 @@ export async function removePennyHarness(harness) {
     for (const name of listPennyProfiles(config)) {
       const path = codexLaunchProfilePath(name);
       const existing = await readText(path, "");
-      if (!isManagedCodexLaunchProfile(existing)) continue;
+      if (!existing.startsWith(CODEX_PROFILE_MARKER)) continue;
       await unlink(path).catch((error) => {
         if (error.code !== "ENOENT") throw error;
       });
@@ -977,7 +1002,87 @@ function rewriteClaudeAuthStartup(args) {
   return args;
 }
 
-export function buildPennyInvocation(harness, args, config) {
+function openCodeModelCachePath(profile) {
+  return join(pennyDataDir(), `opencode-models-${profile || DEFAULT_PROFILE}.json`);
+}
+
+/**
+ * Model catalog for one OpenCode launch.
+ *
+ * The gateway is the authority, but it is not always reachable: a private gateway sits
+ * behind a VPN the user is not always on. Fall back to the last catalog seen for this
+ * profile, which is why the cache is per profile rather than global -- a cloud catalog
+ * must never stand in for a private one.
+ *
+ * Discovery never blocks the launch. A stale or built-in list still lets the user work,
+ * whereas refusing to start leaves them with no OpenCode at all over a model menu.
+ */
+export async function resolveOpenCodeLaunchModels(config) {
+  // One-time migration off the install-time provider block. Harmless once it is gone.
+  if (await stripPersistentOpenCodeProvider()) {
+    console.error(
+      "PennyRouter: removed the stored OpenCode provider block; "
+      + "`penny opencode` now configures the provider per launch.",
+    );
+  }
+  const cachePath = openCodeModelCachePath(config.profile);
+  try {
+    const models = await fetchOpenCodeModels(config.gateway_base_url, config.api_key, {
+      requireFresh: true,
+    });
+    await writeJsonFile(cachePath, { models, fetched_at: new Date().toISOString() });
+    return models;
+  } catch (error) {
+    const cached = await readJsonFile(cachePath, null);
+    if (cached?.models?.length) {
+      console.error(
+        `PennyRouter: could not reach ${config.gateway_base_url} (${error.message}). `
+        + `Using the model list cached ${cached.fetched_at}.`,
+      );
+      return cached.models;
+    }
+    console.error(
+      `PennyRouter: could not reach ${config.gateway_base_url} (${error.message}) and no `
+      + `catalog is cached for the "${config.profile}" profile. Falling back to the built-in `
+      + "model list; some entries may not be available on this gateway.",
+    );
+    return OPENCODE_MODEL_CHOICES;
+  }
+}
+
+/**
+ * OpenCode config declaring the PennyRouter provider for one launch.
+ *
+ * OpenCode deep-merges this over the on-disk config rather than replacing it, so the
+ * models map here unions with any `provider.pennyrouter.models` left in opencode.json:
+ * `penny opencode` removes that block so a retired model cannot survive in the picker.
+ */
+export function buildOpenCodeSessionConfig(config, models) {
+  return {
+    provider: {
+      pennyrouter: {
+        npm: "@ai-sdk/openai-compatible",
+        name: "PennyRouter",
+        options: {
+          baseURL: `${String(config.gateway_base_url).replace(/\/+$/, "")}/v1`,
+          apiKey: config.api_key,
+          headers: {
+            "x-pennyrouter-title-session": "{env:PENNYROUTER_TITLE_SESSION_ID}",
+            "x-pennyrouter-harness": "opencode",
+          },
+        },
+        models: Object.fromEntries(
+          models.map((model) => [
+            model.id,
+            { name: model.name, ...(model.description ? { description: model.description } : {}) },
+          ]),
+        ),
+      },
+    },
+  };
+}
+
+export function buildPennyInvocation(harness, args, config, models = null) {
   const item = config.harnesses?.[harness];
   if (!item || !item.enabled) {
     throw new Error(`PennyRouter is not enabled for ${harness}. Run npx pennyrouter install.`);
@@ -1015,6 +1120,12 @@ export function buildPennyInvocation(harness, args, config) {
     // identity. Give both sides a launch-local join token so title warmth cannot bleed between
     // two Codex TUIs using the same Penny key.
     env.PENNYROUTER_TITLE_SESSION_ID = randomUUID();
+    if (resolveSubscriptionAuth(config, "codex")) {
+      // The built-in OpenAI provider must retain Authorization for Codex's native OAuth.
+      // OpenAI-Project is a standard built-in-provider header and carries the existing Penny
+      // credential only as far as our gateway, which removes it before relaying upstream.
+      env.OPENAI_PROJECT = config.api_key;
+    }
     return {
       command: "codex",
       args: ["--profile", codexProfileName(config.profile), ...args],
@@ -1023,6 +1134,11 @@ export function buildPennyInvocation(harness, args, config) {
   }
   if (harness === "opencode") {
     env.PENNYROUTER_TITLE_SESSION_ID = randomUUID();
+    // Bind this launch to the resolved profile through OpenCode's session-scoped config
+    // channel. A persistent provider block cannot express "this profile for this window":
+    // it is one file shared by every OpenCode process, so two profiles cannot run at once
+    // and a plain `opencode` would inherit whichever gateway was installed last.
+    if (models) env.OPENCODE_CONFIG_CONTENT = JSON.stringify(buildOpenCodeSessionConfig(config, models));
     return { command: "opencode", args, env };
   }
   throw new Error(`Unknown Penny harness "${harness}". Try penny claude, penny codex, or penny opencode.`);
@@ -1101,7 +1217,18 @@ export async function runPenny(argv = process.argv.slice(2)) {
     }
     return runCodexDesktop(config, { logs, mode });
   }
-  const invocation = buildPennyInvocation(harness, argv.slice(1), config);
+  if (harness === "codex") {
+    // Re-render on every launch so an upgraded Penny command moves existing subscription
+    // profiles onto Codex's built-in OpenAI provider without requiring a reinstall. Profiles
+    // using API/proxy/OpenRouter funding retain the custom HTTP provider for now.
+    await writeCodexLaunchProfile({
+      gatewayBaseUrl: config.gateway_base_url,
+      subscriptionAuth: resolveSubscriptionAuth(config, "codex"),
+      profile: config.profile,
+    });
+  }
+  const models = harness === "opencode" ? await resolveOpenCodeLaunchModels(config) : null;
+  const invocation = buildPennyInvocation(harness, argv.slice(1), config, models);
   const child = spawn(invocation.command, invocation.args, {
     cwd: process.cwd(),
     env: invocation.env,

package/src/launch.test.js

@@ -30,6 +30,8 @@ import {
   selectClaudeDesktopNativeMode,
   renderCodexLaunchProfile,
   extractProfileArgs,
+  resolveOpenCodeLaunchModels,
+  buildOpenCodeSessionConfig,
   resolvePennyProfile,
   setPennyProfile,
   savePennyConfig,
@@ -183,19 +185,18 @@ async function main() {
       realHome: path.join(home, ".codex"),
     });
     const desktopConfig = fs.readFileSync(path.join(desktopHome, "config.toml"), "utf8");
-    assert.match(desktopConfig, /^model_provider = "openai"/m);
-    assert.doesNotMatch(desktopConfig, /\[model_providers\.pennyrouter\]/);
-    assert.match(desktopConfig, /pennyrouter_key = "pr-super-secret"/);
-    assert.match(desktopConfig, /pennyrouter_surface = "codex-desktop"/);
+    assert.match(desktopConfig, /^model_provider = "pennyrouter"/);
+    assert.match(desktopConfig, /\[model_providers\.pennyrouter\]/);
+    assert.match(desktopConfig, /"x-pennyrouter-key" = "pr-super-secret"/);
+    assert.match(desktopConfig, /"x-pennyrouter-surface" = "codex-desktop"/);
     assert.equal(fs.readFileSync(path.join(home, ".codex", "config.toml"), "utf8"), nativeCodex);
     fs.rmSync(desktopHome, { recursive: true, force: true });
     const codexProfile = fs.readFileSync(codexLaunchProfilePath(), "utf8");
-    assert.match(codexProfile, /^# PennyRouter per-command profile \(managed\)\nmodel_provider = "openai"/);
-    assert.match(codexProfile, /openai_base_url = "https:\/\/gateway\.example\/v1"/);
-    assert.match(codexProfile, /pennyrouter_key = "pr-super-secret"/);
+    assert.match(codexProfile, /model_provider = "openai"/);
+    assert.match(codexProfile, /openai_base_url = "https:\/\/gateway\.example"/);
+    assert.ok(!codexProfile.includes("[model_providers.pennyrouter]"));
     assert.ok(codexProfile.includes("[tui]\nterminal_title = []"));
-    assert.ok(codexProfile.includes('pennyrouter_harness = "codex"'));
-    assert.ok(codexProfile.includes('pennyrouter_surface = "codex-terminal"'));
+    assert.ok(!codexProfile.includes("pr-super-secret"));
     assert.ok(!rc.includes("pr-super-secret"));
 
     const claude = buildPennyInvocation("claude", ["--resume", "abc"], config);
@@ -224,6 +225,7 @@ async function main() {
     const codex = buildPennyInvocation("codex", ["resume", "--last"], config);
     assert.deepEqual(codex.args, ["--profile", "pennyrouter-cloud", "resume", "--last"]);
     assert.equal(codex.env.PENNYROUTER_API_KEY, "pr-super-secret");
+    assert.equal(codex.env.OPENAI_PROJECT, "pr-super-secret");
     const opencode = buildPennyInvocation("opencode", ["--continue"], config);
     assert.equal(opencode.env.PENNYROUTER_API_KEY, "pr-super-secret");
     assert.deepEqual(opencode, {
@@ -368,6 +370,31 @@ async function testProfiles() {
   assert.deepEqual(invocation.args, ["--profile", "pennyrouter-private"]);
   assert.ok(codexLaunchProfilePath("private").endsWith("pennyrouter-private.config.toml"));
   assert.notEqual(codexLaunchProfilePath("private"), codexLaunchProfilePath("cloud"));
+
+  // An unreachable gateway must not prevent OpenCode from starting: a built-in model
+  // list is worse than a fresh one, but far better than no editor.
+  const offline = { gateway_base_url: "http://127.0.0.1:1", api_key: "pr-x", profile: "cloud" };
+  const fallback = await resolveOpenCodeLaunchModels(offline);
+  assert.ok(fallback.length > 0);
+
+  // The launch config carries this profile's gateway and key, so two profiles can run
+  // side by side without either writing to OpenCode's shared config file.
+  const session = buildOpenCodeSessionConfig(
+    { gateway_base_url: "https://gw.example/", api_key: "pr-private" },
+    [{ id: "gpt-4o", name: "gpt-4o" }],
+  );
+  assert.equal(session.provider.pennyrouter.options.baseURL, "https://gw.example/v1");
+  assert.equal(session.provider.pennyrouter.options.apiKey, "pr-private");
+  assert.deepEqual(Object.keys(session.provider.pennyrouter.models), ["gpt-4o"]);
+
+  const opencodeInvocation = buildPennyInvocation(
+    "opencode", [], { ...resolvePennyProfile(config, "private"), harnesses: { opencode: { enabled: true } } },
+    [{ id: "gpt-4o", name: "gpt-4o" }],
+  );
+  assert.equal(
+    JSON.parse(opencodeInvocation.env.OPENCODE_CONFIG_CONTENT).provider.pennyrouter.options.apiKey,
+    "pr-private",
+  );
 }
 
 main().catch((error) => {