pennyrouter 0.3.16 → 0.3.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pennyrouter",
-  "version": "0.3.16",
+  "version": "0.3.18",
   "description": "Install and manage PennyRouter local coding-agent integrations.",
   "homepage": "https://pennyrouter.com",
   "bugs": {

package/src/cli.js

@@ -19,13 +19,14 @@ import {
 } from "./harnesses/claude-code.js";
 import { clineHarness } from "./harnesses/cline.js";
 import { codeGptHarness } from "./harnesses/codegpt.js";
-import { codexHarness, detectCodexChatgptAuth } from "./harnesses/codex.js";
+import { codexHarness, detectCodexChatgptAuth, isHostedPennyRouterGateway } from "./harnesses/codex.js";
 import { fetchOpenCodeModels, opencodeHarness } from "./harnesses/opencode.js";
 import { windsurfHarness } from "./harnesses/windsurf.js";
 import { zedHarness } from "./harnesses/zed.js";
 import {
   APP_URL,
   createCliSession,
+  fetchGatewayCapabilities,
   forgetAnthropicToken,
   forgetUpstreamCredential,
   maskKey,
@@ -36,6 +37,14 @@ import {
   storeAnthropicToken,
   storeUpstreamCredential,
 } from "./session.js";
+
+async function codexNativeAuthAvailable({ gatewayBaseUrl, apiKey, localAuth }) {
+  if (!isHostedPennyRouterGateway(gatewayBaseUrl)) return false;
+  const capabilities = await fetchGatewayCapabilities({ gatewayBaseUrl, apiKey });
+  const hasOpenAiCredential = Array.isArray(capabilities?.upstream_credentials)
+    && capabilities.upstream_credentials.includes("openai_api");
+  return Boolean(localAuth || hasOpenAiCredential);
+}
 import {
   backupFile,
   compactHome,
@@ -832,7 +841,13 @@ export async function install(flags = {}) {
 
       const harnessNeededAuth = needsAuth.includes(harness);
       const codexSubscriptionAuth = harness.id === "codex"
-        ? (harnessNeededAuth ? funding.codexSubscriptionAuth : Boolean(existingRecord?.openai_subscription_auth))
+        ? await codexNativeAuthAvailable({
+            gatewayBaseUrl: gatewayBaseUrl,
+            apiKey: claim.api_key,
+            localAuth: harnessNeededAuth
+              ? funding.codexSubscriptionAuth
+              : Boolean(existingRecord?.openai_subscription_auth),
+          })
         : false;
       const claudeSubscriptionAuth = harness.id === "claude-code"
         && Boolean(claudeAnthropicAuth || existingRecord?.anthropic_token_stored);
@@ -1269,7 +1284,11 @@ async function update(flags) {
       const claudeSubscriptionAuth = record.harness === "claude-code"
         && Boolean(record.anthropic_token_stored);
       const codexSubscriptionAuth = record.harness === "codex"
-        ? await detectCodexChatgptAuth()
+        ? await codexNativeAuthAvailable({
+            gatewayBaseUrl,
+            apiKey,
+            localAuth: await detectCodexChatgptAuth(),
+          })
         : false;
 
       if (supportsPennyCommand) {

package/src/harnesses/codex.js

@@ -103,6 +103,12 @@ export function renderCodexConfig(
   text,
   { apiKey, gatewayBaseUrl, subscriptionAuth, surface = "codex-terminal" },
 ) {
+  // Native Codex subscription/WebSocket auth is valid only through PennyRouter's hosted
+  // cloud gateway. Local, private, proxy, and other custom gateways must always use the
+  // ordinary PennyRouter bearer provider, even when Codex itself is logged into ChatGPT.
+  // Keep this guard at the final renderer so every install/update/desktop path gets the
+  // same safety rule regardless of which profile selected it.
+  subscriptionAuth = Boolean(subscriptionAuth && isHostedPennyRouterGateway(gatewayBaseUrl));
   const clean = removeManagedCodexConfig(text, { removeRootProvider: true }).trimEnd();
   if (new RegExp(`^\\s*\\[model_providers\\.${escapeRegex(PROVIDER_ID)}\\]\\s*$`, "m").test(clean)) {
     throw new Error(
@@ -142,6 +148,14 @@ export function renderCodexConfig(
   return `${lines.join("\n").replace(/\n{3,}/g, "\n\n").trim()}\n`;
 }
 
+export function isHostedPennyRouterGateway(gatewayBaseUrl) {
+  try {
+    return new URL(String(gatewayBaseUrl)).hostname.toLowerCase() === "api.pennyrouter.com";
+  } catch {
+    return false;
+  }
+}
+
 export function removeManagedCodexConfig(text, { removeRootProvider = false } = {}) {
   let out = String(text || "").replace(
     new RegExp(`${escapeRegex(MANAGED_START)}[\\s\\S]*?${escapeRegex(MANAGED_END)}\\n?`, "g"),

package/src/harnesses/codex.test.js

@@ -8,6 +8,7 @@ import {
   codexUsesChatgptAuth,
   removeManagedCodexConfig,
   renderCodexConfig,
+  isHostedPennyRouterGateway,
 } from "./codex.js";
 
 function testAuthDetection() {
@@ -21,13 +22,13 @@ function testSubscriptionProviderIsRootSafe() {
   const original = `model = "gpt-test"\n\n[features]\nplugins = false\n`;
   const next = renderCodexConfig(original, {
     apiKey: "pr-test-secret",
-    gatewayBaseUrl: "http://localhost:8400/",
+    gatewayBaseUrl: "https://api.pennyrouter.com/",
     subscriptionAuth: true,
   });
 
   assert.ok(next.indexOf('model_provider = "pennyrouter"') < next.indexOf("[features]"));
   assert.ok(next.includes('[model_providers.pennyrouter]'));
-  assert.ok(next.includes('base_url = "http://localhost:8400/v1"'));
+  assert.ok(next.includes('base_url = "https://api.pennyrouter.com/v1"'));
   assert.ok(next.includes("requires_openai_auth = true"));
   assert.ok(next.includes('"x-pennyrouter-key" = "pr-test-secret"'));
   assert.ok(next.includes('"x-pennyrouter-harness" = "codex"'));
@@ -36,6 +37,26 @@ function testSubscriptionProviderIsRootSafe() {
   assert.equal((next.match(/# --- PennyRouter managed Codex provider ---/g) || []).length, 1);
 }
 
+function testPrivateAndProxyGatewaysNeverEnableNativeSubscription() {
+  assert.equal(isHostedPennyRouterGateway("https://api.pennyrouter.com"), true);
+  for (const gateway of [
+    "http://localhost:8400",
+    "https://private.example.test",
+    "https://openrouter.example.test",
+  ]) {
+    assert.equal(isHostedPennyRouterGateway(gateway), false);
+    const next = renderCodexConfig("", {
+      apiKey: "pr-private",
+      gatewayBaseUrl: gateway,
+      subscriptionAuth: true,
+    });
+    assert.ok(next.includes('model_provider = "pennyrouter"'));
+    assert.ok(next.includes('experimental_bearer_token = "pr-private"'));
+    assert.ok(!next.includes("requires_openai_auth"));
+    assert.ok(next.includes('supports_websockets = false'));
+  }
+}
+
 function testLegacyMigrationAndIdempotence() {
   const legacy = `[features]\nplugins = false\nopenai_base_url = "http://old/v1"\nopenai_api_key = "pr-old"\n`;
   const once = renderCodexConfig(legacy, {
@@ -115,6 +136,7 @@ async function testReinstallPreservesRecordedProvider() {
 
 testAuthDetection();
 testSubscriptionProviderIsRootSafe();
+testPrivateAndProxyGatewaysNeverEnableNativeSubscription();
 testLegacyMigrationAndIdempotence();
 testProviderCollisionFailsClosed();
 testUninstallLeavesUserConfig();

package/src/launch.js

@@ -24,7 +24,11 @@ import {
   writeClaudeCodeModelPresentation,
 } from "./harnesses/claude-code.js";
 import { renderCodexConfig } from "./harnesses/codex.js";
-import { fetchOpenCodeModels, stripPersistentOpenCodeProvider } from "./harnesses/opencode.js";
+import {
+  OPENCODE_MODEL_CHOICES,
+  fetchOpenCodeModels,
+  stripPersistentOpenCodeProvider,
+} from "./harnesses/opencode.js";
 import { atomicWrite, homeDir, readJsonFile, readText, writeJsonFile } from "./state.js";
 
 const CONFIG_VERSION = 1;
@@ -386,16 +390,31 @@ export async function installPennyRuntime({ updatePath = true } = {}) {
 }
 
 export function renderCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth }) {
-  const authLines = subscriptionAuth
-    ? [
-        "requires_openai_auth = true",
-        'env_http_headers = { "x-pennyrouter-key" = "PENNYROUTER_API_KEY", "x-pennyrouter-title-session" = "PENNYROUTER_TITLE_SESSION_ID" }',
-        'http_headers = { "x-pennyrouter-harness" = "codex", "x-pennyrouter-surface" = "codex-terminal" }',
-      ]
-    : [
-        'env_key = "PENNYROUTER_API_KEY"',
-        'http_headers = { "x-pennyrouter-title-session" = "PENNYROUTER_TITLE_SESSION_ID", "x-pennyrouter-harness" = "codex", "x-pennyrouter-surface" = "codex-terminal" }',
-      ];
+  // Private/proxy/custom gateways never use Codex's native subscription/WebSocket lane.
+  // Apply the same hosted-only rule as the Codex config renderer at this launch-profile
+  // boundary, since this path is what bare `penny codex` selects at runtime.
+  try {
+    subscriptionAuth = Boolean(
+      subscriptionAuth && new URL(String(gatewayBaseUrl)).hostname.toLowerCase() === "api.pennyrouter.com",
+    );
+  } catch {
+    subscriptionAuth = false;
+  }
+  if (subscriptionAuth) {
+    return [
+      CODEX_PROFILE_MARKER,
+      'model_provider = "openai"',
+      `openai_base_url = ${JSON.stringify(String(gatewayBaseUrl).replace(/\/+$/, ""))}`,
+      "",
+      "[tui]",
+      "terminal_title = []",
+      "",
+    ].join("\n");
+  }
+  const authLines = [
+    'env_key = "PENNYROUTER_API_KEY"',
+    'http_headers = { "x-pennyrouter-title-session" = "PENNYROUTER_TITLE_SESSION_ID", "x-pennyrouter-harness" = "codex", "x-pennyrouter-surface" = "codex-terminal" }',
+  ];
   return [
     CODEX_PROFILE_MARKER,
     'model_provider = "pennyrouter"',
@@ -998,12 +1017,15 @@ function openCodeModelCachePath(profile) {
 }
 
 /**
- * Model catalog for one OpenCode launch, newest first.
+ * Model catalog for one OpenCode launch.
  *
  * The gateway is the authority, but it is not always reachable: a private gateway sits
- * behind a VPN the user is not always on. Falling back to the last catalog seen for this
- * profile keeps OpenCode launchable offline, and is why the catalog is cached per profile
- * rather than globally -- a cloud catalog must never stand in for a private one.
+ * behind a VPN the user is not always on. Fall back to the last catalog seen for this
+ * profile, which is why the cache is per profile rather than global -- a cloud catalog
+ * must never stand in for a private one.
+ *
+ * Discovery never blocks the launch. A stale or built-in list still lets the user work,
+ * whereas refusing to start leaves them with no OpenCode at all over a model menu.
  */
 export async function resolveOpenCodeLaunchModels(config) {
   // One-time migration off the install-time provider block. Harmless once it is gone.
@@ -1029,10 +1051,12 @@ export async function resolveOpenCodeLaunchModels(config) {
       );
       return cached.models;
     }
-    throw new Error(
-      `PennyRouter could not fetch the model catalog from ${config.gateway_base_url} `
-      + `(${error.message}), and no cached catalog exists for the "${config.profile}" profile.`,
+    console.error(
+      `PennyRouter: could not reach ${config.gateway_base_url} (${error.message}) and no `
+      + `catalog is cached for the "${config.profile}" profile. Falling back to the built-in `
+      + "model list; some entries may not be available on this gateway.",
     );
+    return OPENCODE_MODEL_CHOICES;
   }
 }
 
@@ -1106,6 +1130,12 @@ export function buildPennyInvocation(harness, args, config, models = null) {
     // identity. Give both sides a launch-local join token so title warmth cannot bleed between
     // two Codex TUIs using the same Penny key.
     env.PENNYROUTER_TITLE_SESSION_ID = randomUUID();
+    if (resolveSubscriptionAuth(config, "codex")) {
+      // The built-in OpenAI provider must retain Authorization for Codex's native OAuth.
+      // OpenAI-Project is a standard built-in-provider header and carries the existing Penny
+      // credential only as far as our gateway, which removes it before relaying upstream.
+      env.OPENAI_PROJECT = config.api_key;
+    }
     return {
       command: "codex",
       args: ["--profile", codexProfileName(config.profile), ...args],
@@ -1197,6 +1227,16 @@ export async function runPenny(argv = process.argv.slice(2)) {
     }
     return runCodexDesktop(config, { logs, mode });
   }
+  if (harness === "codex") {
+    // Re-render on every launch so an upgraded Penny command moves existing subscription
+    // profiles onto Codex's built-in OpenAI provider without requiring a reinstall. Profiles
+    // using API/proxy/OpenRouter funding retain the custom HTTP provider for now.
+    await writeCodexLaunchProfile({
+      gatewayBaseUrl: config.gateway_base_url,
+      subscriptionAuth: resolveSubscriptionAuth(config, "codex"),
+      profile: config.profile,
+    });
+  }
   const models = harness === "opencode" ? await resolveOpenCodeLaunchModels(config) : null;
   const invocation = buildPennyInvocation(harness, argv.slice(1), config, models);
   const child = spawn(invocation.command, invocation.args, {

package/src/launch.test.js

@@ -30,6 +30,8 @@ import {
   selectClaudeDesktopNativeMode,
   renderCodexLaunchProfile,
   extractProfileArgs,
+  resolveOpenCodeLaunchModels,
+  buildOpenCodeSessionConfig,
   resolvePennyProfile,
   setPennyProfile,
   savePennyConfig,
@@ -185,20 +187,15 @@ async function main() {
     const desktopConfig = fs.readFileSync(path.join(desktopHome, "config.toml"), "utf8");
     assert.match(desktopConfig, /^model_provider = "pennyrouter"/);
     assert.match(desktopConfig, /\[model_providers\.pennyrouter\]/);
-    assert.match(desktopConfig, /"x-pennyrouter-key" = "pr-super-secret"/);
+    assert.match(desktopConfig, /experimental_bearer_token = "pr-super-secret"/);
     assert.match(desktopConfig, /"x-pennyrouter-surface" = "codex-desktop"/);
     assert.equal(fs.readFileSync(path.join(home, ".codex", "config.toml"), "utf8"), nativeCodex);
     fs.rmSync(desktopHome, { recursive: true, force: true });
     const codexProfile = fs.readFileSync(codexLaunchProfilePath(), "utf8");
-    assert.ok(codexProfile.includes('"x-pennyrouter-key" = "PENNYROUTER_API_KEY"'));
-    assert.match(codexProfile,
-      /env_http_headers = \{ "x-pennyrouter-key" = "PENNYROUTER_API_KEY", "x-pennyrouter-title-session" = "PENNYROUTER_TITLE_SESSION_ID" \}/);
-    assert.match(codexProfile,
-      /http_headers = \{ "x-pennyrouter-harness" = "codex", "x-pennyrouter-surface" = "codex-terminal" \}/);
+    assert.match(codexProfile, /model_provider = "pennyrouter"/);
+    assert.match(codexProfile, /base_url = "https:\/\/gateway\.example\/v1"/);
+    assert.ok(codexProfile.includes("[model_providers.pennyrouter]"));
     assert.ok(codexProfile.includes("[tui]\nterminal_title = []"));
-    assert.ok(codexProfile.includes('"x-pennyrouter-title-session" = "PENNYROUTER_TITLE_SESSION_ID"'));
-    assert.ok(codexProfile.includes('"x-pennyrouter-harness" = "codex"'));
-    assert.ok(codexProfile.includes('"x-pennyrouter-surface" = "codex-terminal"'));
     assert.ok(!codexProfile.includes("pr-super-secret"));
     assert.ok(!rc.includes("pr-super-secret"));
 
@@ -228,6 +225,7 @@ async function main() {
     const codex = buildPennyInvocation("codex", ["resume", "--last"], config);
     assert.deepEqual(codex.args, ["--profile", "pennyrouter-cloud", "resume", "--last"]);
     assert.equal(codex.env.PENNYROUTER_API_KEY, "pr-super-secret");
+    assert.equal(codex.env.OPENAI_PROJECT, "pr-super-secret");
     const opencode = buildPennyInvocation("opencode", ["--continue"], config);
     assert.equal(opencode.env.PENNYROUTER_API_KEY, "pr-super-secret");
     assert.deepEqual(opencode, {
@@ -372,6 +370,31 @@ async function testProfiles() {
   assert.deepEqual(invocation.args, ["--profile", "pennyrouter-private"]);
   assert.ok(codexLaunchProfilePath("private").endsWith("pennyrouter-private.config.toml"));
   assert.notEqual(codexLaunchProfilePath("private"), codexLaunchProfilePath("cloud"));
+
+  // An unreachable gateway must not prevent OpenCode from starting: a built-in model
+  // list is worse than a fresh one, but far better than no editor.
+  const offline = { gateway_base_url: "http://127.0.0.1:1", api_key: "pr-x", profile: "cloud" };
+  const fallback = await resolveOpenCodeLaunchModels(offline);
+  assert.ok(fallback.length > 0);
+
+  // The launch config carries this profile's gateway and key, so two profiles can run
+  // side by side without either writing to OpenCode's shared config file.
+  const session = buildOpenCodeSessionConfig(
+    { gateway_base_url: "https://gw.example/", api_key: "pr-private" },
+    [{ id: "gpt-4o", name: "gpt-4o" }],
+  );
+  assert.equal(session.provider.pennyrouter.options.baseURL, "https://gw.example/v1");
+  assert.equal(session.provider.pennyrouter.options.apiKey, "pr-private");
+  assert.deepEqual(Object.keys(session.provider.pennyrouter.models), ["gpt-4o"]);
+
+  const opencodeInvocation = buildPennyInvocation(
+    "opencode", [], { ...resolvePennyProfile(config, "private"), harnesses: { opencode: { enabled: true } } },
+    [{ id: "gpt-4o", name: "gpt-4o" }],
+  );
+  assert.equal(
+    JSON.parse(opencodeInvocation.env.OPENCODE_CONFIG_CONTENT).provider.pennyrouter.options.apiKey,
+    "pr-private",
+  );
 }
 
 main().catch((error) => {

package/src/session.js

@@ -71,6 +71,17 @@ export async function storeUpstreamCredential({ gatewayBaseUrl, apiKey, provider
   return response.json();
 }
 
+export async function fetchGatewayCapabilities({ gatewayBaseUrl, apiKey }) {
+  const url = `${gatewayBaseUrl.replace(/\/+$/, "")}/v1/auth/capabilities`;
+  try {
+    const response = await fetch(url, { headers: { authorization: `Bearer ${apiKey}` } });
+    if (!response.ok) return null;
+    return await response.json();
+  } catch {
+    return null;
+  }
+}
+
 // Mint a key on a private gateway that has self-service provisioning enabled. The hosted
 // browser claim mints against pennyrouter.com's key store, which a private gateway does not
 // share, so this is the equivalent step for a self-hosted install. A gateway that has not