pennyrouter 0.3.25 → 0.3.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pennyrouter",
-  "version": "0.3.25",
+  "version": "0.3.27",
   "description": "Install and manage PennyRouter local coding-agent integrations.",
   "homepage": "https://pennyrouter.com",
   "bugs": {

package/src/cli.js

@@ -19,7 +19,13 @@ import {
 } from "./harnesses/claude-code.js";
 import { clineHarness } from "./harnesses/cline.js";
 import { codeGptHarness } from "./harnesses/codegpt.js";
-import { codexHarness, detectCodexChatgptAuth, isHostedPennyRouterGateway } from "./harnesses/codex.js";
+import {
+  codexHarness,
+  detectCodexChatgptAuth,
+  isCodexSubscriptionAuthGateway,
+  isHostedPennyRouterGateway,
+  isLocalPennyRouterGateway,
+} from "./harnesses/codex.js";
 import { fetchOpenCodeModels, opencodeHarness } from "./harnesses/opencode.js";
 import { windsurfHarness } from "./harnesses/windsurf.js";
 import { zedHarness } from "./harnesses/zed.js";
@@ -38,8 +44,12 @@ import {
   storeUpstreamCredential,
 } from "./session.js";
 
-async function codexNativeAuthAvailable({ gatewayBaseUrl, apiKey, localAuth }) {
-  if (!isHostedPennyRouterGateway(gatewayBaseUrl)) return false;
+async function codexNativeAuthAvailable({ gatewayBaseUrl, apiKey, localAuth, privateGateway = false }) {
+  if (privateGateway) return false;
+  if (!isCodexSubscriptionAuthGateway(gatewayBaseUrl)) return false;
+  // A local gateway should use Codex's detected login as the opt-in. Do not infer
+  // subscription auth from some other upstream credential stored on the local gateway.
+  if (isLocalPennyRouterGateway(gatewayBaseUrl)) return Boolean(localAuth);
   const capabilities = await fetchGatewayCapabilities({ gatewayBaseUrl, apiKey });
   const hasOpenAiCredential = Array.isArray(capabilities?.upstream_credentials)
     && capabilities.upstream_credentials.includes("openai_api");
@@ -535,7 +545,7 @@ async function authProvider(flags) {
     apiKey: pennyKey,
     gatewayBaseUrl,
     subscriptionAuth: true,
-    models: CLAUDE_CODE_MODELS,
+    models: flags.profile === "private" ? null : CLAUDE_CODE_MODELS,
     profile: flags.profile,
   });
   let record = existingRecord || {
@@ -552,6 +562,7 @@ async function authProvider(flags) {
       ...record,
       ...(await claudeCodeHarness.installStoredToken({
         apiKey: pennyKey, gatewayBaseUrl, plan, existingRecord,
+        privateGateway: flags.profile === "private",
       })),
     };
   }
@@ -883,6 +894,7 @@ export async function install(flags = {}) {
         ? await codexNativeAuthAvailable({
             gatewayBaseUrl: gatewayBaseUrl,
             apiKey: claim.api_key,
+            privateGateway: flags.privateGatewayFlow,
             localAuth: harnessNeededAuth
               ? funding.codexSubscriptionAuth
               : Boolean(existingRecord?.openai_subscription_auth),
@@ -898,7 +910,11 @@ export async function install(flags = {}) {
           subscriptionAuth: harness.id === "claude-code"
             ? claudeSubscriptionAuth
             : codexSubscriptionAuth,
-          models: harness.id === "claude-code" ? CLAUDE_CODE_MODELS : null,
+          privateGateway: flags.privateGatewayFlow,
+          // Private gateways advertise their complete upstream catalog. Leave the
+          // Claude defaults unset there so the picker does not merge hosted-only ids.
+          models: harness.id === "claude-code" && !flags.privateGatewayFlow
+            ? CLAUDE_CODE_MODELS : null,
           profile: flags.profile,
         });
       }
@@ -911,9 +927,11 @@ export async function install(flags = {}) {
         record = harness.id === "claude-code" && claudeSubscriptionAuth
           ? await harness.installStoredToken({
               apiKey: claim.api_key, gatewayBaseUrl, plan, existingRecord,
+              privateGateway: flags.privateGatewayFlow,
             })
           : await harness.install({
               apiKey: claim.api_key, gatewayBaseUrl, plan, existingRecord, models: opencodeModels,
+              privateGateway: flags.privateGatewayFlow,
             });
       } else {
         if (hadGlobalRouting) {
@@ -1364,6 +1382,7 @@ async function update(flags) {
         ? await codexNativeAuthAvailable({
             gatewayBaseUrl,
             apiKey,
+            privateGateway: profile === "private",
             localAuth: await detectCodexChatgptAuth(),
           })
         : false;
@@ -1375,7 +1394,9 @@ async function update(flags) {
           subscriptionAuth: record.harness === "claude-code"
             ? claudeSubscriptionAuth
             : codexSubscriptionAuth,
-          models: record.harness === "claude-code" ? CLAUDE_CODE_MODELS : null,
+          privateGateway: profile === "private",
+          models: record.harness === "claude-code" && profile !== "private"
+            ? CLAUDE_CODE_MODELS : null,
           profile,
         });
       }
@@ -1387,8 +1408,14 @@ async function update(flags) {
         // (previous_model_provider, claude_ai_connectors_before) survives the rewrite
         // and a later uninstall still restores the user's original values.
         const installed = record.harness === "claude-code" && claudeSubscriptionAuth
-          ? await harness.installStoredToken({ apiKey, gatewayBaseUrl, plan, existingRecord: record })
-          : await harness.install({ apiKey, gatewayBaseUrl, plan, existingRecord: record });
+          ? await harness.installStoredToken({
+              apiKey, gatewayBaseUrl, plan, existingRecord: record,
+              privateGateway: profile === "private",
+            })
+          : await harness.install({
+              apiKey, gatewayBaseUrl, plan, existingRecord: record,
+              privateGateway: profile === "private",
+            });
         next = { ...record, ...installed, installed_at: record.installed_at };
       }
 

package/src/harnesses/claude-code.js

@@ -79,7 +79,7 @@ export const claudeCodeHarness = {
     };
   },
 
-  async install({ apiKey, gatewayBaseUrl, plan, existingRecord }) {
+  async install({ apiKey, gatewayBaseUrl, plan, existingRecord, privateGateway = false }) {
     const backupPath = await backupFile(CONFIG_PATH, "claude-code");
     const current = (await readJsonFile(CONFIG_PATH, null)) || {};
     const claudeAiConnectorsBefore = disableClaudeAiConnectors(current, existingRecord);
@@ -90,13 +90,23 @@ export const claudeCodeHarness = {
     current.env.ANTHROPIC_AUTH_TOKEN = apiKey;
     delete current.env.ANTHROPIC_API_KEY;
     current.env.CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY = "1";
-    // Claude Code displays these env values directly in its model picker; the
-    // gateway decodes the friendly labels into bundle/profile overrides.
-    current.env.ANTHROPIC_DEFAULT_OPUS_MODEL = CLAUDE_CODE_MODELS.opus;
-    current.env.ANTHROPIC_DEFAULT_SONNET_MODEL = CLAUDE_CODE_MODELS.sonnet;
-    current.env.ANTHROPIC_DEFAULT_HAIKU_MODEL = CLAUDE_CODE_MODELS.haiku;
-    current.env.ANTHROPIC_DEFAULT_FABLE_MODEL = CLAUDE_CODE_MODELS.fable;
-    writeClaudeCodeModelPresentation(current.env);
+    if (privateGateway) {
+      // A private gateway's /v1/models response is the complete model catalog. Do not
+      // merge the hosted Claude defaults into that picker: they may not exist upstream.
+      for (const slot of ["OPUS", "SONNET", "HAIKU", "FABLE"]) {
+        delete current.env[`ANTHROPIC_DEFAULT_${slot}_MODEL`];
+        delete current.env[`ANTHROPIC_DEFAULT_${slot}_MODEL_NAME`];
+        delete current.env[`ANTHROPIC_DEFAULT_${slot}_MODEL_DESCRIPTION`];
+      }
+    } else {
+      // Claude Code displays these env values directly in its model picker; the
+      // gateway decodes the friendly labels into bundle/profile overrides.
+      current.env.ANTHROPIC_DEFAULT_OPUS_MODEL = CLAUDE_CODE_MODELS.opus;
+      current.env.ANTHROPIC_DEFAULT_SONNET_MODEL = CLAUDE_CODE_MODELS.sonnet;
+      current.env.ANTHROPIC_DEFAULT_HAIKU_MODEL = CLAUDE_CODE_MODELS.haiku;
+      current.env.ANTHROPIC_DEFAULT_FABLE_MODEL = CLAUDE_CODE_MODELS.fable;
+      writeClaudeCodeModelPresentation(current.env);
+    }
     delete current.env.ANTHROPIC_CUSTOM_MODEL_OPTION;
     delete current.env.ANTHROPIC_CUSTOM_MODEL_OPTION_NAME;
     delete current.env.ANTHROPIC_CUSTOM_MODEL_OPTION_DESCRIPTION;
@@ -136,7 +146,7 @@ export const claudeCodeHarness = {
   // config therefore carries only the pr- bearer + base URL, not the Anthropic token.
   // The gateway pulls the stored token per request. This avoids putting the Anthropic
   // credential on disk and avoids a dual-credential configuration.
-  async installStoredToken({ apiKey, gatewayBaseUrl, plan, existingRecord }) {
+  async installStoredToken({ apiKey, gatewayBaseUrl, plan, existingRecord, privateGateway = false }) {
     const backupPath = await backupFile(CONFIG_PATH, "claude-code");
     const current = (await readJsonFile(CONFIG_PATH, null)) || {};
     const claudeAiConnectorsBefore = disableClaudeAiConnectors(current, existingRecord);
@@ -146,11 +156,19 @@ export const claudeCodeHarness = {
     // Single credential only: no stale api key, no separate Anthropic bearer.
     delete current.env.ANTHROPIC_API_KEY;
     current.env.CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY = "1";
-    current.env.ANTHROPIC_DEFAULT_OPUS_MODEL = CLAUDE_CODE_MODELS.opus;
-    current.env.ANTHROPIC_DEFAULT_SONNET_MODEL = CLAUDE_CODE_MODELS.sonnet;
-    current.env.ANTHROPIC_DEFAULT_HAIKU_MODEL = CLAUDE_CODE_MODELS.haiku;
-    current.env.ANTHROPIC_DEFAULT_FABLE_MODEL = CLAUDE_CODE_MODELS.fable;
-    writeClaudeCodeModelPresentation(current.env);
+    if (privateGateway) {
+      for (const slot of ["OPUS", "SONNET", "HAIKU", "FABLE"]) {
+        delete current.env[`ANTHROPIC_DEFAULT_${slot}_MODEL`];
+        delete current.env[`ANTHROPIC_DEFAULT_${slot}_MODEL_NAME`];
+        delete current.env[`ANTHROPIC_DEFAULT_${slot}_MODEL_DESCRIPTION`];
+      }
+    } else {
+      current.env.ANTHROPIC_DEFAULT_OPUS_MODEL = CLAUDE_CODE_MODELS.opus;
+      current.env.ANTHROPIC_DEFAULT_SONNET_MODEL = CLAUDE_CODE_MODELS.sonnet;
+      current.env.ANTHROPIC_DEFAULT_HAIKU_MODEL = CLAUDE_CODE_MODELS.haiku;
+      current.env.ANTHROPIC_DEFAULT_FABLE_MODEL = CLAUDE_CODE_MODELS.fable;
+      writeClaudeCodeModelPresentation(current.env);
+    }
     delete current.env.ANTHROPIC_CUSTOM_MODEL_OPTION;
     delete current.env.ANTHROPIC_CUSTOM_MODEL_OPTION_NAME;
     delete current.env.ANTHROPIC_CUSTOM_MODEL_OPTION_DESCRIPTION;

package/src/harnesses/codex.js

@@ -27,9 +27,9 @@ export const codexHarness = {
     };
   },
 
-  async install({ apiKey, gatewayBaseUrl, plan, existingRecord }) {
+  async install({ apiKey, gatewayBaseUrl, plan, existingRecord, privateGateway = false }) {
     const current = await readText(CONFIG_PATH, "");
-    const subscriptionAuth = await detectCodexChatgptAuth();
+    const subscriptionAuth = !privateGateway && await detectCodexChatgptAuth();
     const previousModelProvider = existingRecord?.previous_model_provider
       || rootAssignment(removeManagedCodexConfig(current), "model_provider");
     const backupPath = await backupFile(CONFIG_PATH, "codex");
@@ -37,6 +37,7 @@ export const codexHarness = {
       apiKey,
       gatewayBaseUrl,
       subscriptionAuth,
+      privateGateway,
       surface: "codex-terminal",
     });
 
@@ -101,14 +102,15 @@ export async function detectCodexChatgptAuth() {
  */
 export function renderCodexConfig(
   text,
-  { apiKey, gatewayBaseUrl, subscriptionAuth, surface = "codex-terminal" },
+  { apiKey, gatewayBaseUrl, subscriptionAuth, privateGateway = false, surface = "codex-terminal" },
 ) {
-  // Native Codex subscription/WebSocket auth is valid only through PennyRouter's hosted
-  // cloud gateway. Local, private, proxy, and other custom gateways must always use the
-  // ordinary PennyRouter bearer provider, even when Codex itself is logged into ChatGPT.
+  // Native Codex ChatGPT subscription auth is allowed through the hosted gateway and the
+  // explicitly supported local development gateway. Other custom gateways use Penny auth.
   // Keep this guard at the final renderer so every install/update/desktop path gets the
   // same safety rule regardless of which profile selected it.
-  subscriptionAuth = Boolean(subscriptionAuth && isHostedPennyRouterGateway(gatewayBaseUrl));
+  subscriptionAuth = Boolean(
+    subscriptionAuth && !privateGateway && isCodexSubscriptionAuthGateway(gatewayBaseUrl),
+  );
   const clean = removeManagedCodexConfig(text, { removeRootProvider: true }).trimEnd();
   if (new RegExp(`^\\s*\\[model_providers\\.${escapeRegex(PROVIDER_ID)}\\]\\s*$`, "m").test(clean)) {
     throw new Error(
@@ -156,6 +158,20 @@ export function isHostedPennyRouterGateway(gatewayBaseUrl) {
   }
 }
 
+export function isLocalPennyRouterGateway(gatewayBaseUrl) {
+  try {
+    const url = new URL(String(gatewayBaseUrl));
+    return url.hostname.toLowerCase() === "localhost" && url.port === "8400";
+  } catch {
+    return false;
+  }
+}
+
+export function isCodexSubscriptionAuthGateway(gatewayBaseUrl) {
+  return isHostedPennyRouterGateway(gatewayBaseUrl)
+    || isLocalPennyRouterGateway(gatewayBaseUrl);
+}
+
 export function removeManagedCodexConfig(text, { removeRootProvider = false } = {}) {
   let out = String(text || "").replace(
     new RegExp(`${escapeRegex(MANAGED_START)}[\\s\\S]*?${escapeRegex(MANAGED_END)}\\n?`, "g"),

package/src/harnesses/codex.test.js

@@ -40,7 +40,6 @@ function testSubscriptionProviderIsRootSafe() {
 function testPrivateAndProxyGatewaysNeverEnableNativeSubscription() {
   assert.equal(isHostedPennyRouterGateway("https://api.pennyrouter.com"), true);
   for (const gateway of [
-    "http://localhost:8400",
     "https://private.example.test",
     "https://openrouter.example.test",
   ]) {
@@ -49,6 +48,7 @@ function testPrivateAndProxyGatewaysNeverEnableNativeSubscription() {
       apiKey: "pr-private",
       gatewayBaseUrl: gateway,
       subscriptionAuth: true,
+      privateGateway: true,
     });
     assert.ok(next.includes('model_provider = "pennyrouter"'));
     assert.ok(next.includes('experimental_bearer_token = "pr-private"'));

package/src/launch.js

@@ -24,7 +24,10 @@ import {
   upgradeClaudeCodeModelValue,
   writeClaudeCodeModelPresentation,
 } from "./harnesses/claude-code.js";
-import { renderCodexConfig } from "./harnesses/codex.js";
+import {
+  isCodexSubscriptionAuthGateway,
+  renderCodexConfig,
+} from "./harnesses/codex.js";
 import {
   OPENCODE_MODEL_CHOICES,
   fetchOpenCodeModels,
@@ -439,17 +442,13 @@ export async function installPennyRuntime({ updatePath = true } = {}) {
   return { supported: true, ...path, shim_path: pennyShimPath(), compare };
 }
 
-export function renderCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth }) {
-  // Private/proxy/custom gateways never use Codex's native subscription/WebSocket lane.
-  // Apply the same hosted-only rule as the Codex config renderer at this launch-profile
+export function renderCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth, privateGateway = false }) {
+  // Native ChatGPT subscription auth is allowed for the hosted gateway and the explicitly
+  // supported local development gateway. Apply the same rule as the config renderer at this
   // boundary, since this path is what bare `penny codex` selects at runtime.
-  try {
-    subscriptionAuth = Boolean(
-      subscriptionAuth && new URL(String(gatewayBaseUrl)).hostname.toLowerCase() === "api.pennyrouter.com",
-    );
-  } catch {
-    subscriptionAuth = false;
-  }
+  subscriptionAuth = Boolean(
+    subscriptionAuth && !privateGateway && isCodexSubscriptionAuthGateway(gatewayBaseUrl),
+  );
   if (subscriptionAuth) {
     return [
       CODEX_PROFILE_MARKER,
@@ -880,7 +879,7 @@ async function writeClaudeUserSkill() {
   }
 }
 
-async function writeCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth, profile }) {
+async function writeCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth, profile, privateGateway = false }) {
   const path = codexLaunchProfilePath(profile);
   const existing = await readText(path, "");
   if (existing.trim() && !existing.startsWith(CODEX_PROFILE_MARKER)) {
@@ -888,13 +887,14 @@ async function writeCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth, profi
       `${path} already exists and is not managed by PennyRouter. Rename it before installing.`,
     );
   }
-  await privateWrite(path, renderCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth }));
+  await privateWrite(path, renderCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth, privateGateway }));
 }
 
 export async function configurePennyHarness(harness, {
   apiKey,
   gatewayBaseUrl,
   subscriptionAuth = false,
+  privateGateway = false,
   models = null,
   profile = null,
 }) {
@@ -920,6 +920,7 @@ export async function configurePennyHarness(harness, {
     await writeCodexLaunchProfile({
       gatewayBaseUrl,
       subscriptionAuth,
+      privateGateway,
       profile: config.active_profile,
     });
     config.harnesses.codex = {

package/src/launch.test.js

@@ -266,6 +266,25 @@ async function main() {
     assert.equal(persistedClaude.env.ANTHROPIC_DEFAULT_SONNET_MODEL, "claude-sonnet-5[1m]");
     assert.equal("CLAUDE_CODE_MAX_CONTEXT_TOKENS" in persistedClaude.env, false);
 
+    // Private gateways own the model catalog. Their picker must not merge the
+    // hosted Claude defaults, which may not exist in the configured proxy.
+    await claudeCodeHarness.install({
+      apiKey: "pr-super-secret",
+      gatewayBaseUrl: "http://localhost:8400",
+      plan: { configPath: path.join(home, ".claude", "settings.json") },
+      privateGateway: true,
+    });
+    const persistedPrivateClaude = JSON.parse(
+      fs.readFileSync(path.join(home, ".claude", "settings.json"), "utf8"),
+    );
+    for (const slot of ["OPUS", "SONNET", "HAIKU", "FABLE"]) {
+      assert.equal(persistedPrivateClaude.env[`ANTHROPIC_DEFAULT_${slot}_MODEL`], undefined);
+      assert.equal(persistedPrivateClaude.env[`ANTHROPIC_DEFAULT_${slot}_MODEL_NAME`], undefined);
+      assert.equal(
+        persistedPrivateClaude.env[`ANTHROPIC_DEFAULT_${slot}_MODEL_DESCRIPTION`], undefined,
+      );
+    }
+
     await removePennyHarness("claude-code");
     assert.ok(!fs.existsSync(claudeUserSkillPath()));
     fs.mkdirSync(path.dirname(claudeUserSkillPath()), { recursive: true });
@@ -300,6 +319,15 @@ async function main() {
     });
     assert.ok(paid.includes('env_key = "PENNYROUTER_API_KEY"'));
     assert.ok(!paid.includes("requires_openai_auth"));
+    const localSubscription = renderCodexLaunchProfile({
+      gatewayBaseUrl: "http://localhost:8400", subscriptionAuth: true,
+    });
+    assert.ok(localSubscription.includes('model_provider = "openai"'));
+    const localPrivate = renderCodexLaunchProfile({
+      gatewayBaseUrl: "http://localhost:8400", subscriptionAuth: true, privateGateway: true,
+    });
+    assert.ok(localPrivate.includes('model_provider = "pennyrouter"'));
+    assert.ok(localPrivate.includes('env_key = "PENNYROUTER_API_KEY"'));
 
     // Inside the fixture: testProfiles persists a config, which must land in the
     // temporary HOME and never in the developer's real ~/.config/pennyrouter.