pennyrouter 0.3.4 → 0.3.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pennyrouter",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "description": "Install and manage PennyRouter local coding-agent integrations.",
   "homepage": "https://pennyrouter.com",
   "bugs": {

package/src/harnesses/codex.js

@@ -37,6 +37,7 @@ export const codexHarness = {
       apiKey,
       gatewayBaseUrl,
       subscriptionAuth,
+      surface: "codex-terminal",
     });
 
     await atomicWrite(CONFIG_PATH, next);
@@ -98,7 +99,10 @@ export async function detectCodexChatgptAuth() {
  * x-pennyrouter-key header authenticates the account to our gateway. In Penny-only mode
  * the pr- key is the provider bearer, matching the isolated probe's existing behavior.
  */
-export function renderCodexConfig(text, { apiKey, gatewayBaseUrl, subscriptionAuth }) {
+export function renderCodexConfig(
+  text,
+  { apiKey, gatewayBaseUrl, subscriptionAuth, surface = "codex-terminal" },
+) {
   const clean = removeManagedCodexConfig(text, { removeRootProvider: true }).trimEnd();
   if (new RegExp(`^\\s*\\[model_providers\\.${escapeRegex(PROVIDER_ID)}\\]\\s*$`, "m").test(clean)) {
     throw new Error(
@@ -111,9 +115,12 @@ export function renderCodexConfig(text, { apiKey, gatewayBaseUrl, subscriptionAu
   const authLines = subscriptionAuth
     ? [
         "requires_openai_auth = true",
-        `http_headers = { "x-pennyrouter-key" = ${escapedKey} }`,
+        `http_headers = { "x-pennyrouter-key" = ${escapedKey}, "x-pennyrouter-harness" = "codex", "x-pennyrouter-surface" = ${tomlString(surface)} }`,
       ]
-    : [`experimental_bearer_token = ${escapedKey}`];
+    : [
+        `experimental_bearer_token = ${escapedKey}`,
+        `http_headers = { "x-pennyrouter-harness" = "codex", "x-pennyrouter-surface" = ${tomlString(surface)} }`,
+      ];
   const block = [
     MANAGED_START,
     `model_provider = "${PROVIDER_ID}"`,

package/src/harnesses/codex.test.js

@@ -29,7 +29,9 @@ function testSubscriptionProviderIsRootSafe() {
   assert.ok(next.includes('[model_providers.pennyrouter]'));
   assert.ok(next.includes('base_url = "http://localhost:8400/v1"'));
   assert.ok(next.includes("requires_openai_auth = true"));
-  assert.ok(next.includes('http_headers = { "x-pennyrouter-key" = "pr-test-secret" }'));
+  assert.ok(next.includes('"x-pennyrouter-key" = "pr-test-secret"'));
+  assert.ok(next.includes('"x-pennyrouter-harness" = "codex"'));
+  assert.ok(next.includes('"x-pennyrouter-surface" = "codex-terminal"'));
   assert.ok(!next.includes("experimental_bearer_token"));
   assert.equal((next.match(/# --- PennyRouter managed Codex provider ---/g) || []).length, 1);
 }
@@ -51,6 +53,7 @@ function testLegacyMigrationAndIdempotence() {
   assert.ok(!once.includes("openai_base_url"));
   assert.ok(!once.includes("openai_api_key"));
   assert.ok(once.includes('experimental_bearer_token = "pr-new"'));
+  assert.ok(once.includes('"x-pennyrouter-surface" = "codex-terminal"'));
   assert.ok(!once.includes("requires_openai_auth"));
 }
 

package/src/harnesses/opencode.js

@@ -65,6 +65,10 @@ export const opencodeHarness = {
       options: {
         baseURL: `${String(gatewayBaseUrl).replace(/\/+$/, "")}/v1`,
         apiKey,
+        headers: {
+          "x-pennyrouter-title-session": "{env:PENNYROUTER_TITLE_SESSION_ID}",
+          "x-pennyrouter-harness": "opencode",
+        },
       },
       models: Object.fromEntries(
         (models || OPENCODE_MODEL_CHOICES).map((model) => [

package/src/launch.js

@@ -4,6 +4,7 @@ import {
   cp,
   mkdtemp,
   mkdir,
+  readFile,
   rm,
   readdir,
   stat,
@@ -15,6 +16,7 @@ import { constants as osConstants } from "node:os";
 import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { basename, dirname, join, resolve } from "node:path";
+import { randomUUID } from "node:crypto";
 
 import { configureClaudeCodeStatusline } from "./statusline.js";
 import {
@@ -293,9 +295,12 @@ export function renderCodexLaunchProfile({ gatewayBaseUrl, subscriptionAuth }) {
   const authLines = subscriptionAuth
     ? [
         "requires_openai_auth = true",
-        'env_http_headers = { "x-pennyrouter-key" = "PENNYROUTER_API_KEY" }',
+        'env_http_headers = { "x-pennyrouter-key" = "PENNYROUTER_API_KEY", "x-pennyrouter-title-session" = "PENNYROUTER_TITLE_SESSION_ID", "x-pennyrouter-harness" = "codex", "x-pennyrouter-surface" = "codex-terminal" }',
       ]
-    : ['env_key = "PENNYROUTER_API_KEY"'];
+    : [
+        'env_key = "PENNYROUTER_API_KEY"',
+        'http_headers = { "x-pennyrouter-title-session" = "PENNYROUTER_TITLE_SESSION_ID", "x-pennyrouter-harness" = "codex", "x-pennyrouter-surface" = "codex-terminal" }',
+      ];
   return [
     CODEX_PROFILE_MARKER,
     'model_provider = "pennyrouter"',
@@ -540,6 +545,7 @@ export async function createCodexDesktopHome({ config, realHome }) {
       apiKey: config.api_key,
       gatewayBaseUrl: config.gateway_base_url,
       subscriptionAuth: Boolean(config.harnesses?.codex?.subscription_auth),
+      surface: "codex-desktop",
     }));
     await privateWrite(join(overlay, "config.toml"), desktopConfig);
     return overlay;
@@ -606,19 +612,27 @@ function renderCacheWarmth(status) {
  * This is deliberately local and best-effort: failure to poll the gateway must never
  * affect Codex, and non-TTY invocations (CI, pipes) receive no escape sequences.
  */
-export function startPennyTerminalTitle({ gatewayBaseUrl, apiKey }) {
+export function startPennyTerminalTitle({ gatewayBaseUrl, apiKey, titleSessionId,
+                                           titleSessionFile }) {
   if (!process.stdout.isTTY) return () => {};
 
   let status = null;
   let stopped = false;
   let statusInFlight = false;
+  let resolvedTitleSessionId = titleSessionId || "";
 
   const refreshStatus = async () => {
     if (stopped || statusInFlight || !gatewayBaseUrl || !apiKey) return;
     statusInFlight = true;
     try {
+      if (!resolvedTitleSessionId && titleSessionFile) {
+        try { resolvedTitleSessionId = (await readFile(titleSessionFile, "utf8")).trim(); }
+        catch { /* Claude statusline has not handed off its session yet */ }
+      }
+      const headers = { "x-api-key": apiKey };
+      if (resolvedTitleSessionId) headers["x-pennyrouter-title-session"] = resolvedTitleSessionId;
       const response = await fetch(`${String(gatewayBaseUrl).replace(/\/$/, "")}/v1/penny/statusline`, {
-        headers: { "x-api-key": apiKey },
+        headers,
         signal: AbortSignal.timeout(4000),
       });
       if (response.ok) status = await response.json();
@@ -845,6 +859,7 @@ export function buildPennyInvocation(harness, args, config) {
   assertNoConflictingArgs(harness, args);
   const env = { ...process.env, PENNYROUTER_API_KEY: config.api_key };
   if (harness === "claude") {
+    env.PENNYROUTER_TITLE_SESSION_FILE = join(pennyDataDir(), `title-session-${randomUUID()}`);
     const models = item.models || {};
     env.ANTHROPIC_BASE_URL = config.gateway_base_url;
     env.ANTHROPIC_AUTH_TOKEN = config.api_key;
@@ -870,9 +885,14 @@ export function buildPennyInvocation(harness, args, config) {
     };
   }
   if (harness === "codex") {
+    // The parent process owns the OSC tab title, while Codex owns the actual conversation
+    // identity. Give both sides a launch-local join token so title warmth cannot bleed between
+    // two Codex TUIs using the same Penny key.
+    env.PENNYROUTER_TITLE_SESSION_ID = randomUUID();
     return { command: "codex", args: ["--profile", "pennyrouter", ...args], env };
   }
   if (harness === "opencode") {
+    env.PENNYROUTER_TITLE_SESSION_ID = randomUUID();
     return { command: "opencode", args, env };
   }
   throw new Error(`Unknown Penny harness "${harness}". Try penny claude, penny codex, or penny opencode.`);
@@ -952,10 +972,14 @@ export async function runPenny(argv = process.argv.slice(2)) {
     stdio: "inherit",
     shell: process.platform === "win32",
   });
-  const stopTerminalTitle = ["claude", "codex", "opencode"].includes(harness)
+  // Claude Code owns its own terminal title updates while a turn is running. Do not
+  // compete with it from the parent process; Codex and OpenCode remain Penny-owned.
+  const stopTerminalTitle = ["codex", "opencode"].includes(harness)
     ? startPennyTerminalTitle({
         gatewayBaseUrl: config.gateway_base_url,
         apiKey: config.api_key,
+        titleSessionId: invocation.env.PENNYROUTER_TITLE_SESSION_ID,
+        titleSessionFile: invocation.env.PENNYROUTER_TITLE_SESSION_FILE,
       })
     : () => {};
   const result = await waitForChild(child);
@@ -998,7 +1022,10 @@ async function runCodexDesktop(config, { logs = false, mode = "gateway" } = {})
   }
   if (mode === "native") {
     const child = spawn(codexDesktopExecutable(), [], {
-      cwd: process.cwd(),
+      // Desktop launches must not inherit a project directory. When PennyRouter itself is
+      // started from ~/Documents, that makes macOS attribute Codex's access to Documents to
+      // PennyRouter and trigger a protected-folder prompt.
+      cwd: homeDir(),
       env: process.env,
       stdio: logs ? "inherit" : "ignore",
       detached: !logs,
@@ -1021,7 +1048,8 @@ async function runCodexDesktop(config, { logs = false, mode = "gateway" } = {})
       "__codex-desktop-supervisor",
       overlay,
     ], {
-      cwd: process.cwd(),
+      // Keep the detached supervisor out of the caller's protected project directory too.
+      cwd: homeDir(),
       env: process.env,
       stdio: "ignore",
       detached: true,
@@ -1036,7 +1064,7 @@ async function runCodexDesktop(config, { logs = false, mode = "gateway" } = {})
 
 export async function runCodexDesktopSupervisor(overlay) {
   const child = spawn(codexDesktopExecutable(), [], {
-    cwd: process.cwd(),
+    cwd: homeDir(),
     env: { ...process.env, CODEX_HOME: overlay },
     stdio: "inherit",
     shell: process.platform === "win32",

package/src/launch.test.js

@@ -179,12 +179,16 @@ async function main() {
     const desktopConfig = fs.readFileSync(path.join(desktopHome, "config.toml"), "utf8");
     assert.match(desktopConfig, /^model_provider = "pennyrouter"/);
     assert.match(desktopConfig, /\[model_providers\.pennyrouter\]/);
-    assert.match(desktopConfig, /http_headers = \{ "x-pennyrouter-key" = "pr-super-secret" \}/);
+    assert.match(desktopConfig, /"x-pennyrouter-key" = "pr-super-secret"/);
+    assert.match(desktopConfig, /"x-pennyrouter-surface" = "codex-desktop"/);
     assert.equal(fs.readFileSync(path.join(home, ".codex", "config.toml"), "utf8"), nativeCodex);
     fs.rmSync(desktopHome, { recursive: true, force: true });
     const codexProfile = fs.readFileSync(codexLaunchProfilePath(), "utf8");
-    assert.ok(codexProfile.includes('env_http_headers = { "x-pennyrouter-key" = "PENNYROUTER_API_KEY" }'));
+    assert.ok(codexProfile.includes('"x-pennyrouter-key" = "PENNYROUTER_API_KEY"'));
     assert.ok(codexProfile.includes("[tui]\nterminal_title = []"));
+    assert.ok(codexProfile.includes('"x-pennyrouter-title-session" = "PENNYROUTER_TITLE_SESSION_ID"'));
+    assert.ok(codexProfile.includes('"x-pennyrouter-harness" = "codex"'));
+    assert.ok(codexProfile.includes('"x-pennyrouter-surface" = "codex-terminal"'));
     assert.ok(!codexProfile.includes("pr-super-secret"));
     assert.ok(!rc.includes("pr-super-secret"));
 

package/src/statusline.js

@@ -91,6 +91,7 @@ const stateDir = join(
   "pennyrouter",
 );
 const cacheDir = join(stateDir, "statusline-cache");
+const titleSessionFile = process.env.PENNYROUTER_TITLE_SESSION_FILE || "";
 // A wrapped user statusline command can be slow to spawn (npx especially: on Windows
 // it goes through an extra cmd.exe/npx.cmd hop and can take 2-4s per invocation, vs
 // well under 1s on macOS/Linux). Claude Code re-invokes this script every ~1s
@@ -164,6 +165,11 @@ const raw = readFileSync(0, "utf8");
 let input = {};
 try { input = JSON.parse(raw); } catch { /* keep {} */ }
 const sessionId = input.session_id || "";
+// The parent Penny launcher owns the tab title, while this command knows Claude Code's
+// actual session id. Hand it across a launch-local file for an exact title lookup.
+if (titleSessionFile && sessionId) {
+  try { writeFileSync(titleSessionFile, sessionId, { mode: 0o600 }); } catch { /* best-effort */ }
+}
 const refreshMs = (config.refresh_seconds ?? 15) * 1000;
 
 const cachePath = join(cacheDir, sessionId + ".json");