pennyrouter 0.3.55 → 0.3.57

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pennyrouter",
-  "version": "0.3.55",
+  "version": "0.3.57",
   "description": "Install and manage PennyRouter local coding-agent integrations.",
   "homepage": "https://pennyrouter.com",
   "bugs": {
@@ -25,7 +25,7 @@
   ],
   "scripts": {
     "start": "node ./bin/pennyrouter.js",
-    "check": "node --check ./bin/pennyrouter.js && node --check ./bin/penny.js && find src -name '*.js' -print0 | xargs -0 -n1 node --check && node --test src/cli.test.js src/remote.test.js src/pilots.test.js && node src/session.test.js && node src/statusline.test.js && node src/harnesses/claude-code.test.js && node src/harnesses/codex.test.js && node src/harnesses/opencode.test.js && node src/launch.test.js && node src/thread-session.test.js && node src/thread-session-codex.test.js && node src/mcp-register.test.js && node src/mcp.test.js"
+    "check": "node --check ./bin/pennyrouter.js && node --check ./bin/penny.js && find src -name '*.js' -print0 | xargs -0 -n1 node --check && node --test src/cli.test.js src/remote.test.js src/pilots.test.js && node src/session.test.js && node src/statusline.test.js && node src/harnesses/claude-code.test.js && node src/harnesses/codex.test.js && node src/harnesses/opencode.test.js && node src/launch.test.js && node src/thread-session.test.js && node src/thread-session-codex.test.js && node src/codex-resume-hint.test.js && node src/mcp-register.test.js && node src/mcp.test.js"
   },
   "dependencies": {
     "@xterm/addon-fit": "^0.10.0",

package/src/cli.js

@@ -39,6 +39,7 @@ import {
   maskKey,
   pollForKey,
   probeClaudeCodeGateway,
+  checkGatewayKey,
   provisionPrivateGatewayKey,
   sleep,
   storeAnthropicToken,
@@ -691,13 +692,10 @@ export async function install(flags = {}) {
   const selected = await selectHarnesses(flags);
   if (selected.length === 0) {
     console.log("No supported harnesses selected.");
-    await printAdditionalHarnessesHint([]);
     return;
   }
 
   console.log("PennyRouter install");
-  console.log("PennyRouter can be installed into multiple coding harnesses on this machine.");
-  await printAdditionalHarnessesHint(selected);
   console.log("");
 
   const manifest = await loadManifest();
@@ -1025,19 +1023,19 @@ export async function install(flags = {}) {
     const mcp = await registerMcp(records.map((r) => r.harness), {
       gatewayBaseUrl: customGatewayBaseUrl(gatewayBaseUrl),
     });
-    const registered = mcp.filter((r) => r.changed).map((r) => HARNESS_BY_ID[r.harness]?.name);
-    if (registered.length) {
-      console.log("");
-      console.log(color("Threads MCP", "bold"));
-      console.log(`  Registered on ${registered.join(" and ")}.`);
-      console.log("  Ask your agent to read or resume an AI share link:");
-      console.log('    "code based on this chat: <paste a ChatGPT/Claude/Gemini/Perplexity link>"');
-    }
     for (const result of mcp.filter((r) => r.error)) {
       console.log(`  MCP registration skipped for ${result.harness}: ${result.error}`);
     }
   }
 
+  if (records.some((record) => record.launch_available)) {
+    console.log("");
+    console.log(color("See what PennyRouter saves you", "bold"));
+    console.log("");
+    console.log(`  ${color("penny claude --stats", "bold")}  → live token usage for your session`);
+    console.log(`  ${color("penny compare", "bold")}       → run native and PennyRouter head to head on this machine`);
+  }
+
   console.log("");
   reportFailures(failures);
 }
@@ -1115,9 +1113,14 @@ async function obtainPrivateGatewayKey(flags, gatewayBaseUrl, existingApiKey = n
   }
 
   if (existingApiKey) {
-    console.log(`Using existing PennyRouter key for ${gatewayBaseUrl}.`);
+    const status = await checkGatewayKey({ gatewayBaseUrl, apiKey: existingApiKey });
+    if (status !== "rejected") {
+      console.log(`Using existing PennyRouter key for ${gatewayBaseUrl}.`);
+      console.log("");
+      return existingApiKey;
+    }
+    console.log(`The saved PennyRouter key for ${gatewayBaseUrl} is no longer accepted; requesting a new one.`);
     console.log("");
-    return existingApiKey;
   }
 
   let email = (flags.email || "").trim();
@@ -1536,6 +1539,13 @@ async function chooseDefaultRouting(flags, selected, manifest) {
 async function selectClaudeFundingProviders(flags, selected) {
   if (!selected.some((harness) => harness.id === "claude-code")) return new Set();
 
+  // A --config file states its providers outright, and that choice stands whether or not the
+  // file also carried their secrets: a file shared with a team deliberately omits those, and
+  // configureUserFunding prompts for what is missing (or refuses, with no TTY to prompt on).
+  // Ambient credentials (an exported
+  // ANTHROPIC_AUTH_TOKEN, a leftover API key) must not add providers the file did not ask for.
+  if (flags.configClaudeFunding?.size) return new Set(flags.configClaudeFunding);
+
   const supplied = new Set();
   if (!flags.noAnthropicAuth && (flags.anthropicAuth || flags.token || flags.tokenCommand
       || process.env.ANTHROPIC_AUTH_TOKEN)) supplied.add("subscription");
@@ -1547,13 +1557,6 @@ async function selectClaudeFundingProviders(flags, selected) {
       || process.env.PENNYROUTER_PROXY_API_KEY)) {
     supplied.add("anthropic-proxy");
   }
-  // A --config file states its providers outright, and that choice stands whether or not the
-  // file also carried their secrets: a file shared with a team deliberately omits those, and
-  // configureUserFunding prompts for what is missing (or refuses, with no TTY to prompt on).
-  // Without this, an option whose secret was left out is silently dropped and the install
-  // completes having configured nothing.
-  for (const id of flags.configClaudeFunding || []) supplied.add(id);
-
   // Explicit flags are the automation selector. Interactive installs always default to the
   // subscription alone; environment keys are used if the user checks their provider.
   const explicit = flags.anthropicAuth || flags.noAnthropicAuth || flags.token
@@ -1587,12 +1590,13 @@ async function selectClaudeFundingProviders(flags, selected) {
 async function selectCodexFundingProviders(flags, selected) {
   if (!selected.some((harness) => harness.id === "codex")) return new Set();
 
+  if (flags.configCodexFunding?.size) return new Set(flags.configCodexFunding);
+
   const supplied = new Set();
   if (flags.openaiApiKey || process.env.OPENAI_API_KEY) supplied.add("openai-api");
   if ((flags.openaiProxyBaseUrl || process.env.PENNYROUTER_OPENAI_PROXY_BASE_URL)
       && (flags.openaiProxyApiKey || process.env.PENNYROUTER_OPENAI_PROXY_API_KEY)) supplied.add("openai-proxy");
   if (flags.openrouterApiKey || process.env.OPENROUTER_API_KEY) supplied.add("openrouter");
-  for (const id of flags.configCodexFunding || []) supplied.add(id);
   const hasChatgptLogin = await detectCodexChatgptAuth();
   if (hasChatgptLogin) supplied.add("subscription");
 
@@ -1711,6 +1715,21 @@ async function configureUserFunding(flags, selected, claudeAnthropicAuth,
     ? await detectCodexChatgptAuth()
     : false;
 
+  // A key only counts when its provider was chosen: one left in the environment must not be
+  // stored on the gateway for an install that asked for a different provider.
+  if (!(wantsClaude && claudeProviders.has("anthropic-api"))) anthropicApiKey = "";
+  if (!(wantsCodex && codexProviders.has("openai-api"))) openaiApiKey = "";
+  if (!(wantsClaude && claudeProviders.has("openrouter"))
+      && !(wantsCodex && codexProviders.has("openrouter"))) openrouterApiKey = "";
+  if (!(wantsCodex && codexProviders.has("openai-proxy"))) {
+    openaiProxyBaseUrl = "";
+    openaiProxyApiKey = "";
+  }
+  if (!(wantsClaude && claudeProviders.has("anthropic-proxy"))) {
+    proxyBaseUrl = "";
+    proxyApiKey = "";
+  }
+
   if (wantsClaude && claudeProviders.has("anthropic-api") && !anthropicApiKey) {
     if (!interactive) throw new Error("Anthropic API was selected, but no key was provided.");
     anthropicApiKey = (await promptSecretish("Anthropic API key: ")).trim();
@@ -2150,20 +2169,6 @@ async function selectHarnesses(flags) {
   return promptHarnessCheckboxes(available, detected);
 }
 
-async function printAdditionalHarnessesHint(selected) {
-  const selectedIds = new Set(selected.map(({ id }) => id));
-  const available = [];
-  for (const harness of Object.values(HARNESS_BY_ID)) {
-    if (selectedIds.has(harness.id)) continue;
-    if (!(await safeDetect(harness))) available.push(harness.name);
-  }
-  if (available.length === 0) return;
-  const names = available.length === 1
-    ? available[0]
-    : `${available.slice(0, -1).join(", ")}, or ${available.at(-1)}`;
-  console.log(`To use PennyRouter with ${names}, install ${available.length === 1 ? "it" : "them"} and re-run \`npx pennyrouter install\`.`);
-}
-
 async function promptHarnessCheckboxes(available, detected) {
   const detectedIds = new Set(detected.map((harness) => harness.id));
   const selectedIds = new Set(detectedIds);

package/src/codex-resume-hint.js

@@ -0,0 +1,80 @@
+import { open, readdir, stat } from "node:fs/promises";
+import { join } from "node:path";
+
+/**
+ * Find the Codex sessions a `penny codex` launch wrote to: rollout files under
+ * `<codexHome>/sessions` modified since the launch began whose session_meta records the
+ * launch directory. Resumed sessions keep their original date directory, so the whole
+ * tree is walked rather than just today's.
+ */
+export async function findCodexSessionsSince(codexHome, sinceMs, cwd) {
+  const found = [];
+  for (const path of await rolloutFiles(join(codexHome, "sessions"))) {
+    let info;
+    try {
+      info = await stat(path);
+    } catch {
+      continue;
+    }
+    if (info.mtimeMs < sinceMs) continue;
+    const meta = await readSessionMeta(path);
+    if (meta?.id && meta.cwd === cwd) {
+      found.push({ id: meta.id, modelProvider: meta.model_provider || null, mtimeMs: info.mtimeMs });
+    }
+  }
+  return found.sort((a, b) => b.mtimeMs - a.mtimeMs);
+}
+
+/**
+ * Commands to continue a session either through Penny or in plain Codex. `profile` is
+ * null when the launch used the active profile, which a bare `penny codex` selects. A session
+ * recorded under Penny's custom provider names a provider plain Codex does not define,
+ * so the plain command switches it to the built-in OpenAI provider.
+ */
+export function renderCodexResumeHint(session, profile) {
+  const profileFlag = !profile ? ""
+    : profile === "cloud" || profile === "private" ? ` --${profile}`
+      : ` --penny-profile ${profile}`;
+  const native = session.modelProvider && session.modelProvider !== "openai"
+    ? `codex resume ${session.id} -c model_provider=openai`
+    : `codex resume ${session.id}`;
+  return [
+    "Resume this session:",
+    `  through PennyRouter:  penny codex${profileFlag} resume ${session.id}`,
+    `  in plain Codex:       ${native}`,
+  ].join("\n");
+}
+
+async function rolloutFiles(dir) {
+  let entries;
+  try {
+    entries = await readdir(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const files = [];
+  for (const entry of entries) {
+    const path = join(dir, entry.name);
+    if (entry.isDirectory()) files.push(...await rolloutFiles(path));
+    else if (entry.isFile() && /^rollout-.*\.jsonl$/.test(entry.name)) files.push(path);
+  }
+  return files;
+}
+
+async function readSessionMeta(path) {
+  let handle;
+  try {
+    handle = await open(path, "r");
+    let text = "";
+    for await (const line of handle.readLines()) {
+      text = line;
+      break;
+    }
+    const record = JSON.parse(text);
+    return record?.type === "session_meta" ? record.payload : null;
+  } catch {
+    return null;
+  } finally {
+    await handle?.close();
+  }
+}

package/src/codex-resume-hint.test.js

@@ -0,0 +1,69 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { findCodexSessionsSince, renderCodexResumeHint } from "./codex-resume-hint.js";
+
+function writeRollout(codexHome, day, id, { cwd, modelProvider = "pennyrouter", mtimeMs }) {
+  const dir = path.join(codexHome, "sessions", ...day.split("/"));
+  fs.mkdirSync(dir, { recursive: true });
+  const file = path.join(dir, `rollout-${day.replaceAll("/", "-")}T10-00-00-${id}.jsonl`);
+  const meta = { type: "session_meta", payload: { id, cwd, model_provider: modelProvider } };
+  fs.writeFileSync(file, `${JSON.stringify(meta)}\n{"type":"response_item"}\n`);
+  fs.utimesSync(file, mtimeMs / 1000, mtimeMs / 1000);
+  return file;
+}
+
+async function testFindsOnlySessionsWrittenSinceLaunchInCwd() {
+  const codexHome = fs.mkdtempSync(path.join(os.tmpdir(), "penny-codex-hint-"));
+  const launchedAt = Date.now() - 60_000;
+  writeRollout(codexHome, "2026/10/07", "fresh", { cwd: "/work/a", mtimeMs: launchedAt + 10_000 });
+  // A resumed session keeps its original date directory.
+  writeRollout(codexHome, "2026/09/01", "resumed", { cwd: "/work/a", mtimeMs: launchedAt + 20_000 });
+  writeRollout(codexHome, "2026/10/07", "stale", { cwd: "/work/a", mtimeMs: launchedAt - 10_000 });
+  writeRollout(codexHome, "2026/10/07", "elsewhere", { cwd: "/work/b", mtimeMs: launchedAt + 10_000 });
+  const junkDir = path.join(codexHome, "sessions", "2026", "10", "07");
+  fs.writeFileSync(path.join(junkDir, "rollout-broken.jsonl"), "not json\n");
+  fs.writeFileSync(path.join(junkDir, "notes.txt"), "ignore me\n");
+
+  const sessions = await findCodexSessionsSince(codexHome, launchedAt, "/work/a");
+  assert.deepEqual(sessions.map((s) => s.id), ["resumed", "fresh"]);
+  assert.equal(sessions[0].modelProvider, "pennyrouter");
+}
+
+async function testMissingSessionsDirectory() {
+  const codexHome = fs.mkdtempSync(path.join(os.tmpdir(), "penny-codex-hint-empty-"));
+  assert.deepEqual(await findCodexSessionsSince(codexHome, 0, "/work/a"), []);
+}
+
+function testRenderHint() {
+  assert.match(
+    renderCodexResumeHint({ id: "abc", modelProvider: "pennyrouter" }, null),
+    /through PennyRouter: +penny codex resume abc$/m,
+  );
+
+  const penny = renderCodexResumeHint({ id: "abc", modelProvider: "pennyrouter" }, "cloud");
+  assert.match(penny, /penny codex --cloud resume abc/);
+  assert.match(penny, /codex resume abc -c model_provider=openai$/m);
+
+  const subscription = renderCodexResumeHint({ id: "abc", modelProvider: "openai" }, "private");
+  assert.match(subscription, /penny codex --private resume abc/);
+  assert.match(subscription, /in plain Codex: +codex resume abc$/m);
+
+  assert.match(
+    renderCodexResumeHint({ id: "abc", modelProvider: "pennyrouter" }, "work"),
+    /penny codex --penny-profile work resume abc/,
+  );
+}
+
+async function main() {
+  await testFindsOnlySessionsWrittenSinceLaunchInCwd();
+  await testMissingSessionsDirectory();
+  testRenderHint();
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});

package/src/launch.js

@@ -24,6 +24,7 @@ import { configureClaudeCodeStatusline } from "./statusline.js";
 import { runPennyRemote } from "./remote.js";
 import { extractPilotArgs, resolvePilotCapabilities, pilotSettings, pilotClaudeArgs } from "./pilots.js";
 import { quickSystemPrompt } from "./quick-context.js";
+import { findCodexSessionsSince, renderCodexResumeHint } from "./codex-resume-hint.js";
 import {
   fetchClaudeCodeModels,
   upgradeClaudeCodeModelValue,
@@ -1148,13 +1149,15 @@ async function writeCodexLaunchProfile({
         rootTomlString(native, "model"),
       )
     : null;
-  await privateWrite(path, renderCodexLaunchProfile({
+  const text = renderCodexLaunchProfile({
     gatewayBaseUrl,
     subscriptionAuth,
     privateGateway,
     modelCatalogPath,
     model,
-  }));
+  });
+  await privateWrite(path, text);
+  return { modelProvider: rootTomlString(text, "model_provider") };
 }
 
 export async function configurePennyHarness(harness, {
@@ -1688,13 +1691,14 @@ export async function runPenny(argv = process.argv.slice(2)) {
     }
     return runCodexDesktop(config, { logs, mode });
   }
+  let codexProfile = null;
   if (harness === "codex") {
     // Re-render on every launch so an upgraded Penny command moves existing subscription
     // profiles onto Codex's built-in OpenAI provider without requiring a reinstall. Profiles
     // using API/proxy/OpenRouter funding retain the custom HTTP provider for now. Only a
     // gateway that explicitly identifies itself as private may replace Codex's built-in catalog.
     const catalog = await resolveCodexLaunchCatalog(config);
-    await writeCodexLaunchProfile({
+    codexProfile = await writeCodexLaunchProfile({
       gatewayBaseUrl: config.gateway_base_url,
       subscriptionAuth: resolveSubscriptionAuth(config, "codex"),
       profile: config.profile,
@@ -1732,6 +1736,7 @@ export async function runPenny(argv = process.argv.slice(2)) {
   }
   if (harness === "opencode") models = await resolveOpenCodeLaunchModels(config);
   const invocation = buildPennyInvocation(harness, argv.slice(1), config, models);
+  const launchedAtMs = Date.now();
   const child = spawn(invocation.command, invocation.args, {
     cwd: process.cwd(),
     env: invocation.env,
@@ -1756,10 +1761,32 @@ export async function runPenny(argv = process.argv.slice(2)) {
     if (config._pilotSettingsPath) await rm(config._pilotSettingsPath, { force: true });
     if (config._quickPromptPath) await rm(config._quickPromptPath, { force: true });
   }
+  if (harness === "codex") await printCodexResumeHint(
+    launchedAtMs,
+    config.profile === activePennyProfile(config) ? null : config.profile,
+    codexProfile.modelProvider,
+  );
   if (result.signal) return 128 + (osConstants.signals[result.signal] || 0);
   return result.code ?? 1;
 }
 
+async function printCodexResumeHint(launchedAtMs, profile, modelProvider) {
+  const codexHome = process.env.CODEX_HOME || join(homeDir(), ".codex");
+  let sessions;
+  try {
+    sessions = (await findCodexSessionsSince(codexHome, launchedAtMs, process.cwd()))
+      .filter((session) => session.modelProvider === modelProvider);
+  } catch {
+    return;
+  }
+  // Two Penny Codex windows in the same directory can both write during this launch; a
+  // guessed id could resume the wrong conversation, so only an unambiguous match is named.
+  if (sessions.length === 1) console.log(`\n${renderCodexResumeHint(sessions[0], profile)}`);
+  else if (sessions.length > 1) {
+    console.log(`\n${renderCodexResumeHint({ ...sessions[0], id: "<session-id>" }, profile)}`);
+  }
+}
+
 async function runClaudeDesktop(config, { logs = false, mode = "gateway" } = {}) {
   if (isClaudeDesktopRunning()) {
     throw new Error(

package/src/session.js

@@ -66,11 +66,34 @@ export async function storeUpstreamCredential({ gatewayBaseUrl, apiKey, provider
     } catch {
       // non-JSON body; fall through to status-only message
     }
+    if (response.status === 401 || response.status === 403) {
+      throw new Error(
+        `The gateway at ${gatewayBaseUrl} rejected your PennyRouter key (HTTP ${response.status}), `
+        + `so the ${provider} credential was not stored. Re-run with \`--private-key pr-...\`, `
+        + "or remove the saved key to have a new one issued.",
+      );
+    }
     throw new Error(`Storing ${provider} credential failed: HTTP ${response.status}${detail ? ` — ${detail}` : ""}`);
   }
   return response.json();
 }
 
+// Whether the gateway still honors a saved key: "valid", "rejected" (the gateway answered 401
+// or 403), or "unknown" when it could not be asked. Only "rejected" is worth acting on; an
+// unreachable gateway fails loudly later with its own message.
+export async function checkGatewayKey({ gatewayBaseUrl, apiKey, timeoutMs = 8000 }) {
+  try {
+    const response = await fetch(`${gatewayBaseUrl.replace(/\/+$/, "")}/v1/auth/capabilities`, {
+      headers: { authorization: `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (response.ok) return "valid";
+    return response.status === 401 || response.status === 403 ? "rejected" : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
 export async function fetchGatewayCapabilities({ gatewayBaseUrl, apiKey, timeoutMs = 5000 }) {
   try {
     const url = `${gatewayBaseUrl.replace(/\/+$/, "")}/v1/auth/capabilities`;

package/src/session.test.js

@@ -1,5 +1,6 @@
 import assert from "node:assert/strict";
-import { createCliSession, probeClaudeCodeGateway } from "./session.js";
+import { createServer } from "node:http";
+import { checkGatewayKey, createCliSession, probeClaudeCodeGateway, storeUpstreamCredential } from "./session.js";
 
 const originalFetch = globalThis.fetch;
 
@@ -42,3 +43,24 @@ try {
 } finally {
   globalThis.fetch = originalFetch;
 }
+
+async function withStubGateway(status, run) {
+  const server = createServer((_, res) => { res.statusCode = status; res.end("{}"); });
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  try {
+    return await run(`http://127.0.0.1:${server.address().port}`);
+  } finally {
+    server.close();
+  }
+}
+
+// A rejected key is distinguishable from a gateway that could not be asked, and a 401 while
+// storing a credential blames the PennyRouter key rather than the credential being stored.
+assert.equal(await withStubGateway(200, (u) => checkGatewayKey({ gatewayBaseUrl: u, apiKey: "pr-x" })), "valid");
+assert.equal(await withStubGateway(401, (u) => checkGatewayKey({ gatewayBaseUrl: u, apiKey: "pr-x" })), "rejected");
+assert.equal(await withStubGateway(500, (u) => checkGatewayKey({ gatewayBaseUrl: u, apiKey: "pr-x" })), "unknown");
+assert.equal(await checkGatewayKey({ gatewayBaseUrl: "http://127.0.0.1:1", apiKey: "pr-x" }), "unknown");
+await withStubGateway(401, (u) => assert.rejects(
+  storeUpstreamCredential({ gatewayBaseUrl: u, apiKey: "pr-x", provider: "anthropic_oauth", token: "t" }),
+  /rejected your PennyRouter key/,
+));

package/standalone/web-demo/compare.html

@@ -267,7 +267,7 @@
         <label>Right label <input id="right-custom-label" placeholder="PENNY"></label>
       </div>
       <label>Model (both panes)
-        <input id="model" placeholder="Harness default" autocomplete="off" spellcheck="false"></label>
+        <input id="model" placeholder="Loading models…" autocomplete="off" spellcheck="false"></label>
       <details id="environment">
         <summary>Environment <span class="choice" id="environment-choice"></span></summary>
         <label>Provider
@@ -1534,15 +1534,9 @@
           select.append(option);
         }
       }
-      const modelChoices = {
-        // Claude Code resolves these aliases (and the penny wrapper maps them to the gateway's
-        // ids), so the alias is what is sent; the label names the model it currently resolves to.
-        claude: [['opus', 'Claude Opus 5.5'], ['sonnet', 'Claude Sonnet 5.5'], ['haiku', 'Claude Haiku 4.5'],
-          ['fable', 'Claude Fable 5.1']],
-        codex: [['gpt-6.1-sol', 'GPT-6.1 Sol'], ['gpt-6-astra', 'GPT-6 Astra'], ['gpt-6-sol', 'GPT-6 Sol'],
-          ['gpt-6-luna', 'GPT-6 Luna'], ['gpt-5.6-sol', 'GPT-5.6 Sol'], ['gpt-5.6-terra', 'GPT-5.6 Terra'],
-          ['gpt-5.6-luna', 'GPT-5.6 Luna'], ['gpt-5.5', 'GPT-5.5']],
-      };
+      // Filled from the server's /models, which lists Codex models from Codex's configured proxy.
+      let modelChoices = { claude: [], codex: [] };
+      let modelsLoaded = false;
       $('left-variant').value = config.defaultHarness;
       $('right-variant').value = `penny-${config.defaultHarness}`;
       $('left-cwd').value = config.folders.left;
@@ -1603,17 +1597,26 @@
         const model = $('model');
         model.disabled = leftCodex !== rightCodex;
         const family = leftCodex && rightCodex ? 'codex' : !leftCodex && !rightCodex ? 'claude' : null;
-        if (family !== modelFamily) model.value = '';
+        modelSuggestions = family ? modelChoices[family].map(([value, label]) => ({ value, label })) : [];
+        if (family !== modelFamily || !model.value) model.value = modelSuggestions[0]?.label || '';
         modelFamily = family;
-        modelSuggestions = family ? [{ value: '', label: 'Harness default' },
-          ...modelChoices[family].map(([value, label]) => ({ value, label }))] : [];
-        model.placeholder = family ? 'Harness default' : 'Pick panes from the same harness to choose a model';
+        model.placeholder = !family ? 'Pick panes from the same harness to choose a model'
+          : !modelsLoaded ? 'Loading models…' : 'No models available';
         refreshOptions();
         refreshPickers();
       };
       $('left-variant').onchange = refreshVariants;
       $('right-variant').onchange = refreshVariants;
       refreshVariants();
+      fetch('/models', { cache: 'no-store' }).then((response) => response.json()).then((choices) => {
+        modelChoices = { claude: choices.claude, codex: choices.codex };
+        if (choices.codexError) $('local-error').textContent = choices.codexError;
+      }).catch(() => {
+        $('local-error').textContent = 'Could not load the model list. Reload to try again.';
+      }).finally(() => {
+        modelsLoaded = true;
+        refreshVariants();
+      });
       if (config.compare) {
         $('setup').hidden = false;
         $('local-setup').hidden = false;

package/standalone/web-demo/model-choices.mjs

@@ -0,0 +1,12 @@
+// Models a demo pane may be launched with, as [alias, label]. Claude Code resolves the Claude
+// aliases (and the penny wrapper maps them to the gateway's ids); the label names the current model.
+export const modelChoices = {
+  claude: [['opus', 'Claude Opus 5.5'], ['sonnet', 'Claude Sonnet 5.5'], ['haiku', 'Claude Haiku 4.5'],
+    ['fable', 'Claude Fable 5.1']],
+  codex: [['gpt-6.1-sol', 'GPT-6.1 Sol'], ['gpt-6-astra', 'GPT-6 Astra'], ['gpt-6-sol', 'GPT-6 Sol'],
+    ['gpt-6-luna', 'GPT-6 Luna'], ['gpt-5.6-sol', 'GPT-5.6 Sol'], ['gpt-5.6-terra', 'GPT-5.6 Terra'],
+    ['gpt-5.6-luna', 'GPT-5.6 Luna'], ['gpt-5.5', 'GPT-5.5']],
+};
+
+export const isModelChoice = (harness, model) =>
+  model === '' || Boolean(modelChoices[harness]?.some(([alias]) => alias === model));

package/standalone/web-demo/proxy-models.mjs

@@ -0,0 +1,93 @@
+// Codex model choices from the proxy Codex is configured to use, as [id, label].
+//
+// When ~/.codex/config.toml selects a custom provider (codex-proxy.sh writes one), the proxy's
+// own /models list is the set both panes can actually run, so the picker offers that list
+// instead of a fixed one. Codex's prompts and tools target recent GPT releases, so only GPT
+// 5.4 and newer are offered, matching what the PennyRouter gateway lists to Codex.
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const minimumGptVersion = [5, 4];
+const gptVersionId = /^(?:.+\/)?gpt-(\d+)(?:\.(\d+))?(?:-|$)/i;
+
+export const codexConfigPath = (env = process.env) =>
+  join(env.CODEX_HOME || join(homedir(), '.codex'), 'config.toml');
+
+// A TOML basic ("...") or literal ('...') string value, or null.
+function tomlString(raw) {
+  const value = raw.trim().replace(/\s+#.*$/, '');
+  if (value.startsWith('"')) {
+    try { return JSON.parse(value); } catch { return null; }
+  }
+  const literal = value.match(/^'([^']*)'$/);
+  return literal ? literal[1] : null;
+}
+
+// The custom provider Codex's config selects, as { baseUrl, token }, or null when Codex talks
+// to a built-in provider. Only the keys a provider table needs for an authenticated GET are read.
+export function codexProxy(configText, env = process.env) {
+  let table = '';
+  let providerId = null;
+  const tables = new Map();
+  for (const line of configText.split(/\r?\n/)) {
+    const header = line.match(/^\s*\[([^\]]+)\]\s*(?:#.*)?$/);
+    if (header) { table = header[1].trim(); continue; }
+    const pair = line.match(/^\s*([A-Za-z0-9_-]+)\s*=\s*(.+)$/);
+    if (!pair) continue;
+    const value = tomlString(pair[2]);
+    if (value === null) continue;
+    if (!table && pair[1] === 'model_provider') providerId = value;
+    else if (table) tables.set(table, { ...tables.get(table), [pair[1]]: value });
+  }
+  if (!providerId) return null;
+  const provider = tables.get(`model_providers.${providerId}`)
+    || tables.get(`model_providers."${providerId}"`);
+  if (!provider?.base_url) return null;
+  const token = provider.experimental_bearer_token || (provider.env_key ? env[provider.env_key] : '') || '';
+  return { baseUrl: provider.base_url.replace(/\/+$/, ''), token };
+}
+
+const versionOf = (id) => {
+  const match = id.match(gptVersionId);
+  return match ? [Number(match[1]), Number(match[2] || 0)] : null;
+};
+const newer = (a, b) => a[0] - b[0] || a[1] - b[1];
+
+// "gpt-5.6-luna" -> "GPT-5.6 Luna"; a provider prefix such as "openai/" is left off the label.
+export function modelLabel(id) {
+  const [, version, ...rest] = id.split('/').pop().split('-');
+  return [`GPT-${version}`, ...rest.map((word) => word.charAt(0).toUpperCase() + word.slice(1))].join(' ');
+}
+
+// The proxy catalog's GPT 5.4+ models, newest release first, one entry per id.
+export function codexModelChoices(catalog) {
+  const records = Array.isArray(catalog?.data) ? catalog.data : [];
+  const seen = new Set();
+  const models = [];
+  for (const record of records) {
+    const id = record?.id;
+    if (typeof id !== 'string' || seen.has(id)) continue;
+    const version = versionOf(id);
+    if (!version || newer(version, minimumGptVersion) < 0) continue;
+    seen.add(id);
+    models.push({ id, version });
+  }
+  return models.sort((a, b) => newer(b.version, a.version)).map(({ id }) => [id, modelLabel(id)]);
+}
+
+// The configured proxy's Codex choices, or null when Codex is not configured to use a proxy.
+// Throws when a proxy is configured but its catalog cannot be read.
+export async function fetchCodexModelChoices({ env = process.env, fetchImpl = fetch } = {}) {
+  const configText = await readFile(codexConfigPath(env), 'utf8').catch(() => null);
+  const proxy = configText && codexProxy(configText, env);
+  if (!proxy) return null;
+  const response = await fetchImpl(`${proxy.baseUrl}/models`, {
+    headers: proxy.token ? { authorization: `Bearer ${proxy.token}` } : {},
+    signal: AbortSignal.timeout(10_000),
+  });
+  if (!response.ok) throw new Error(`the Codex proxy's model list returned HTTP ${response.status}`);
+  const choices = codexModelChoices(await response.json());
+  if (!choices.length) throw new Error("the Codex proxy lists no GPT 5.4 or newer model");
+  return choices;
+}

package/standalone/web-demo/server.mjs

@@ -15,6 +15,8 @@ import { listArtifacts, readArtifact } from './artifacts.mjs';
 import { readTelemetry, telemetryEnv, telemetryRoute } from './telemetry.mjs';
 import { Readable } from 'node:stream';
 import { bundleTranscripts, maxTranscriptBytes, transcriptBytes } from './session-transcripts.mjs';
+import { modelChoices as builtInModelChoices } from './model-choices.mjs';
+import { fetchCodexModelChoices } from './proxy-models.mjs';
 
 const here = dirname(fileURLToPath(import.meta.url));
 const compareDir = dirname(here);
@@ -74,6 +76,12 @@ const server = createServer(async (request, response) => {
     await submitFeedback(request, response);
     return;
   }
+  if (url.pathname === '/models' && request.method === 'GET') {
+    const choices = await modelChoices();
+    response.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' })
+      .end(JSON.stringify(choices));
+    return;
+  }
   const telemetryMeter = telemetryMeters.get(url.pathname);
   if (telemetryMeter && request.method === 'POST') {
     try {
@@ -218,10 +226,30 @@ function validateEnvironment(environment = {}) {
 }
 const safeModel = /^[A-Za-z0-9._/-]{1,160}$/;
 
+// The models the page offers, as { claude, codex } lists of [id, label]. Codex's come from the
+// proxy Codex is configured to use, when there is one; codexError says why they are missing.
+let proxyChoices = { expires: 0, codex: null, codexError: null };
+async function modelChoices() {
+  if (Date.now() >= proxyChoices.expires) {
+    try {
+      proxyChoices = { expires: Date.now() + 60_000, codex: await fetchCodexModelChoices(), codexError: null };
+    } catch (error) {
+      console.warn(`Codex proxy models unavailable: ${error.message}`);
+      proxyChoices = { expires: Date.now() + 10_000, codex: [],
+        codexError: `Could not list Codex models: ${error.message}.` };
+    }
+  }
+  const { codex, codexError } = proxyChoices;
+  return { claude: builtInModelChoices.claude, codex: codex ?? builtInModelChoices.codex, codexError };
+}
+
 async function validateConfig(config) {
-  const codexModels = ['gpt-6.1-sol', 'gpt-6-astra', 'gpt-6-sol', 'gpt-6-luna', 'gpt-5.6-sol', 'gpt-5.6-terra',
-    'gpt-5.6-luna', 'gpt-5.5'];
-  const claudeModels = ['opus', 'sonnet', 'haiku', 'fable'];
+  const choices = await modelChoices();
+  const codexModels = choices.codex.map(([id]) => id);
+  const claudeModels = choices.claude.map(([id]) => id);
+  if (choices.codexError && config?.model && variants.has(config.variant) && config.variant.includes('codex')) {
+    throw new Error(choices.codexError);
+  }
   if (!config || !variants.has(config.variant) || typeof config.cwd !== 'string' ||
       config.cwd.length > 4096 || typeof config.label !== 'string' || config.label.length > 80 ||
       typeof config.model !== 'string' || (config.model && !safeModel.test(config.model)) ||