pennyrouter 0.3.7 → 0.3.10

package/README.md

@@ -23,6 +23,44 @@ npx pennyrouter status
 Installation opens a browser and requires login to the PennyRouter account that should own
 the new machine key. CLI installs no longer create anonymous ghost accounts.
 
+## Private and enterprise gateways
+
+Installing against a self-hosted gateway is its own flow, with no browser login: the gateway
+keeps its own accounts, so the key is minted there.
+
+```bash
+npx pennyrouter install --private-gateway https://gateway.example.internal
+```
+
+It asks for the gateway URL (unless given) and your email, and mints a key against that
+gateway. Installing on a second machine with the same email adds a key to the same account.
+Where an administrator issues keys instead, pass `--private-key pr-...` and no email is
+asked for. Self-service minting works only where the operator enabled it
+(`PENNYROUTER_OPEN_PROVISIONING`); otherwise install says so.
+
+To hand a whole team one file, put the shared answers in JSON and leave out the per-person
+ones:
+
+```json
+{
+  "harnesses": ["claude-code", "codex"],
+  "gatewayBaseUrl": "https://gateway.example.internal",
+  "claudeFunding": ["anthropic-proxy"],
+  "proxyBaseUrl": "https://litellm.example.internal",
+  "codexFunding": ["openai-proxy"],
+  "openaiProxyBaseUrl": "https://litellm.example.internal"
+}
+```
+
+```bash
+npx pennyrouter install --config team-install.json
+```
+
+Each person is prompted for their email and their proxy key; everything else is prefilled.
+Any field left out of the file is prompted for, and an unattended run that cannot prompt
+refuses by name rather than installing a half-configured harness. Add `email`, `proxyApiKey`
+and `openaiProxyApiKey` to the file to skip the prompts entirely.
+
 With no `--harness` flag, the interactive installer shows Claude Code, Codex, and OpenCode. Detected
 tools start checked. The additional legacy integrations remain available through an explicit
 `--harness <id>` selection or `--all`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pennyrouter",
-  "version": "0.3.7",
+  "version": "0.3.10",
   "description": "Install and manage PennyRouter local coding-agent integrations.",
   "homepage": "https://pennyrouter.com",
   "bugs": {

package/src/cli.js

@@ -20,7 +20,7 @@ import {
 import { clineHarness } from "./harnesses/cline.js";
 import { codeGptHarness } from "./harnesses/codegpt.js";
 import { codexHarness, detectCodexChatgptAuth } from "./harnesses/codex.js";
-import { opencodeHarness } from "./harnesses/opencode.js";
+import { fetchOpenCodeModels, opencodeHarness } from "./harnesses/opencode.js";
 import { windsurfHarness } from "./harnesses/windsurf.js";
 import { zedHarness } from "./harnesses/zed.js";
 import {
@@ -285,8 +285,13 @@ export function applyConfigFile(flags) {
     for (const option of INSTALL_MANIFEST.funding_groups[group].options) {
       if (!chosen.has(option.id)) continue;
       for (const field of option.fields) {
-        if (flags[field.config_key] === undefined) {
-          flags[field.config_key] = config[field.config_key] || "";
+        // Only copy what the file actually carries. Writing "" for an absent field would
+        // make it look supplied-but-empty, which reads as "this option was configured" to
+        // the provider selection below and skips the prompt that would have filled it --
+        // exactly what a shared file with the secrets left out depends on.
+        const value = String(config[field.config_key] ?? "").trim();
+        if (value && flags[field.config_key] === undefined) {
+          flags[field.config_key] = value;
         }
       }
     }
@@ -751,12 +756,15 @@ export async function install(flags = {}) {
 
       let record;
       if (!supportsPennyCommand || makeDefault) {
+        const opencodeModels = harness.id === "opencode" && flags.privateGatewayFlow
+          ? await fetchOpenCodeModels(gatewayBaseUrl, claim.api_key, { requireFresh: true })
+          : null;
         record = harness.id === "claude-code" && claudeSubscriptionAuth
           ? await harness.installStoredToken({
               apiKey: claim.api_key, gatewayBaseUrl, plan, existingRecord,
             })
           : await harness.install({
-              apiKey: claim.api_key, gatewayBaseUrl, plan, existingRecord,
+              apiKey: claim.api_key, gatewayBaseUrl, plan, existingRecord, models: opencodeModels,
             });
       } else {
         if (hadGlobalRouting) {
@@ -896,7 +904,7 @@ function mcpTargets(flags) {
 async function resolvePrivateGatewayUrl(flags) {
   let raw = (flags.gatewayBaseUrl || "").trim();
   if (!raw) {
-    if (flags.yes || !input.isTTY || !output.isTTY) {
+    if ((flags.yes && !flags.fromConfig) || !input.isTTY || !output.isTTY) {
       throw new Error(
         "--private-gateway needs the gateway URL in a non-interactive install: "
         + "`--private-gateway https://gateway.example.com`.",
@@ -931,7 +939,9 @@ async function obtainPrivateGatewayKey(flags, gatewayBaseUrl) {
 
   let email = (flags.email || "").trim();
   if (!email) {
-    if (flags.yes || !input.isTTY || !output.isTTY) {
+    // A shared --config file names the gateway but not who is installing, so the email is
+    // still asked for even though --config implies --yes.
+    if ((flags.yes && !flags.fromConfig) || !input.isTTY || !output.isTTY) {
       throw new Error(
         "--private-gateway needs an email in a non-interactive install: `--email you@example.com` "
         + "(or pass an admin-issued `--private-key pr-...`).",
@@ -1290,6 +1300,12 @@ async function selectClaudeFundingProviders(flags, selected) {
       && (flags.proxyApiKey || process.env.PENNYROUTER_PROXY_API_KEY)) {
     supplied.add("anthropic-proxy");
   }
+  // A --config file states its providers outright, and that choice stands whether or not the
+  // file also carried their secrets: a file shared with a team deliberately omits those, and
+  // configureUserFunding prompts for what is missing (or refuses, with no TTY to prompt on).
+  // Without this, an option whose secret was left out is silently dropped and the install
+  // completes having configured nothing.
+  for (const id of flags.configClaudeFunding || []) supplied.add(id);
 
   // Explicit flags are the automation selector. Interactive installs always default to the
   // subscription alone; environment keys are used if the user checks their provider.
@@ -1317,6 +1333,7 @@ async function selectCodexFundingProviders(flags, selected) {
   if ((flags.openaiProxyBaseUrl || process.env.PENNYROUTER_OPENAI_PROXY_BASE_URL)
       && (flags.openaiProxyApiKey || process.env.PENNYROUTER_OPENAI_PROXY_API_KEY)) supplied.add("openai-proxy");
   if (flags.openrouterApiKey || process.env.OPENROUTER_API_KEY) supplied.add("openrouter");
+  for (const id of flags.configCodexFunding || []) supplied.add(id);
   const hasChatgptLogin = await detectCodexChatgptAuth();
   if (hasChatgptLogin) supplied.add("subscription");
 
@@ -1393,7 +1410,10 @@ async function configureUserFunding(flags, selected, claudeAnthropicAuth,
                                     claudeProviders = new Set(), codexProviders = new Set()) {
   const wantsClaude = selected.some((harness) => harness.id === "claude-code");
   const wantsCodex = selected.some((harness) => harness.id === "codex");
-  const interactive = !flags.yes && input.isTTY && output.isTTY;
+  // --config drives --yes to skip the question screens, but a file meant to be shared with a
+  // team deliberately carries no secrets: the fields it leaves out are still asked for here,
+  // the same way the subscription sign-in below stays interactive under --config.
+  const interactive = (!flags.yes || flags.fromConfig) && input.isTTY && output.isTTY;
   const credentials = [];
 
   let anthropicApiKey = String(

package/src/cli.test.js

@@ -305,3 +305,49 @@ test("--private-gateway does not consume a following flag as its URL", async ()
     /needs the gateway URL/,
   );
 });
+
+// A --config file meant to be shared with a team carries no secrets and does not know who is
+// installing. --config implies --yes, so the omitted fields are prompted for when there is a
+// TTY; with no TTY the install must REFUSE. It previously completed here having configured no
+// credential at all, because a funding option whose secret was absent was silently dropped.
+test("a shared --config without its secret refuses rather than installing nothing", async () => {
+  // Isolate the install state: against a real one where this harness is already installed
+  // with this funding, install takes its "nothing changed" refresh path and never reaches
+  // credential collection.
+  const stateDir = mkdtempSync(join(tmpdir(), "pennyrouter-state-"));
+  const priorState = process.env.XDG_STATE_HOME;
+  process.env.XDG_STATE_HOME = stateDir;
+  try {
+  await assert.rejects(
+    () => withConfigFile({
+      harnesses: ["claude-code"],
+      gatewayBaseUrl: "https://gateway.example.com",
+      claudeFunding: ["anthropic-proxy"],
+      proxyBaseUrl: "https://proxy.example.com",
+      privateKey: "pr-test",
+    }, (path) => captureLogs(() => main(["install", "--config", path]))),
+    /--proxy-base-url and --proxy-api-key were not both provided/,
+  );
+  } finally {
+    if (priorState === undefined) delete process.env.XDG_STATE_HOME;
+    else process.env.XDG_STATE_HOME = priorState;
+    rmSync(stateDir, { recursive: true, force: true });
+  }
+});
+
+// The config names its providers; that choice stands even when the file omits their secrets.
+test("--config funding choices survive a missing secret", async () => {
+  await withConfigFile({
+    harnesses: ["claude-code"],
+    claudeFunding: ["anthropic-proxy"],
+    proxyBaseUrl: "https://proxy.example.com",
+  }, (path) => {
+    const flags = { configPath: path, args: [] };
+    applyConfigFile(flags);
+    assert.deepEqual([...flags.configClaudeFunding], ["anthropic-proxy"]);
+    // Absent fields stay undefined so the prompt path can fill them; "" would read as
+    // supplied-but-empty and skip it.
+    assert.equal(flags.proxyApiKey, undefined);
+    assert.equal(flags.proxyBaseUrl, "https://proxy.example.com");
+  });
+});

package/src/harnesses/opencode.js

@@ -8,14 +8,17 @@ import {
   readText,
   writeJsonFile,
 } from "../state.js";
+import { unlink } from "node:fs/promises";
 const JSONC_PATH = "~/.config/opencode/opencode.jsonc";
 const JSON_PATH = "~/.config/opencode/opencode.json";
 const MODEL_STATE_PATH = "~/.local/state/opencode/model.json";
+const MODEL_CACHE_PATH = "~/.cache/opencode/models.json";
 export const OPENCODE_MODEL_CHOICES = [
-  { id: "pennyrouter/penny-core:premium", name: "Penny Core" },
-  { id: "pennyrouter/penny-speed:standard", name: "Penny Speed" },
-  { id: "pennyrouter/penny-power:premium", name: "Penny Power" },
   { id: "pennyrouter/auto", name: "PennyRouter Auto" },
+  { id: "claude-haiku-4-5-20251001", name: "Haiku 4.5" },
+  { id: "claude-sonnet-5", name: "Sonnet 5" },
+  { id: "claude-opus-5", name: "Opus 5" },
+  { id: "claude-fable-5", name: "Fable 5" },
   { id: "claude-penny-deepseek-v4-flash", name: "DeepSeek V4 Flash" },
   { id: "claude-penny-glm-5-3", name: "GLM 5.3" },
   { id: "claude-penny-gpt-5-6-luna", name: "GPT-5.6 Luna" },
@@ -25,6 +28,16 @@ export const OPENCODE_MODEL_CHOICES = [
   { id: "claude-penny-minimax-m3", name: "MiniMax M3" },
   { id: "claude-penny-nemotron-ultra-free", name: "Nemotron 3 Ultra (free)" },
   { id: "claude-penny-solar-pro4", name: "Solar Pro 4" },
+  { id: "gpt-5.6-sol", name: "GPT 5.6 Sol (PennyRouter)" },
+  { id: "gpt-5.6-terra", name: "GPT 5.6 Terra (PennyRouter)" },
+  { id: "gpt-5.6-luna", name: "GPT 5.6 Luna (PennyRouter)" },
+  { id: "gpt-5.5", name: "GPT 5.5 (PennyRouter)" },
+  { id: "gpt-5.4", name: "GPT 5.4 (PennyRouter)" },
+  { id: "gpt-5.4-mini", name: "GPT 5.4 Mini (PennyRouter)" },
+  { id: "gpt-penny-auto", name: "PennyRouter Auto (GPT)" },
+  { id: "gpt-penny-deepseek", name: "DeepSeek V4 Flash (PennyRouter)" },
+  { id: "gpt-penny-glm", name: "GLM 5.3 (PennyRouter)" },
+  { id: "gpt-penny-grok", name: "Grok 4.6 (PennyRouter)" },
 ];
 
 export const opencodeHarness = {
@@ -42,8 +55,8 @@ export const opencodeHarness = {
       summary: [
         `write ${configPath}`,
         "merge PennyRouter provider without replacing existing providers",
-        "publish the curated Penny bundles and individual model pins",
-        `reset ${MODEL_STATE_PATH} so opencode rediscovers configured models`,
+        "publish PennyRouter Auto and the available Claude/GPT model pins",
+        `reset ${MODEL_STATE_PATH} and ${MODEL_CACHE_PATH} so opencode rediscovers configured models`,
       ],
     };
   },
@@ -90,6 +103,10 @@ export const opencodeHarness = {
       }
     }
     await writeJsonFile(MODEL_STATE_PATH, model);
+    // OpenCode keeps a separate generated registry cache. Clearing it is necessary when a
+    // provider's model map changes; otherwise the picker can continue showing retired models
+    // even though opencode.json has been rewritten correctly.
+    await removeGeneratedModelCache();
 
     return {
       harness: "opencode",
@@ -129,6 +146,14 @@ export const opencodeHarness = {
   },
 };
 
+async function removeGeneratedModelCache() {
+  try {
+    await unlink(expandHome(MODEL_CACHE_PATH));
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+}
+
 async function readConfig(path) {
   const text = await readText(path, "");
   if (!text.trim()) return {};
@@ -183,27 +208,30 @@ export function opencodeModelId(modelId) {
   return modelId;
 }
 
-export async function fetchOpenCodeModels(gatewayBaseUrl) {
+export async function fetchOpenCodeModels(gatewayBaseUrl, apiKey, { requireFresh = false } = {}) {
   try {
-    const response = await fetch(`${String(gatewayBaseUrl).replace(/\/+$/, "")}/v1/models`);
+    const headers = apiKey
+      ? { Authorization: `Bearer ${apiKey}`, "x-api-key": apiKey }
+      : undefined;
+    const response = await fetch(`${String(gatewayBaseUrl).replace(/\/+$/, "")}/v1/models`, { headers });
     if (!response.ok) throw new Error(`model catalog returned ${response.status}`);
     const payload = await response.json();
-    const catalog = new Map(
-      Array.isArray(payload?.data)
-        ? payload.data
-          .filter((model) => typeof model?.id === "string")
-          .map((model) => [model.id, model])
-        : [],
-    );
-    const models = OPENCODE_MODEL_CHOICES.map((choice) => {
-      const model = catalog.get(choice.id);
-      return {
-        ...choice,
-        ...(model?.description ? { description: model.description } : {}),
-      };
-    });
+    const models = Array.isArray(payload?.data)
+      ? payload.data
+        .filter((model) => typeof model?.id === "string")
+        // Bundles are a legacy OpenCode surface. Auto is the one intentional exception.
+        .filter((model) => !model.id.startsWith("pennyrouter/") || model.id === "pennyrouter/auto")
+        .map((model) => ({
+          id: model.id,
+          name: model.display_name || model.name || openCodeModelName(model.id),
+          ...(model.description ? { description: model.description } : {}),
+        }))
+      : [];
     if (models.length > 0) return models;
-  } catch {}
+  } catch (error) {
+    if (requireFresh) throw new Error(`Could not fetch the private gateway model catalog: ${error.message}`);
+  }
+  if (requireFresh) throw new Error("The private gateway returned no usable OpenCode models.");
   return OPENCODE_MODEL_CHOICES;
 }
 

package/src/harnesses/opencode.test.js

@@ -3,13 +3,19 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
-import { opencodeHarness, opencodeModelId, OPENCODE_MODEL_CHOICES } from "./opencode.js";
+import {
+  fetchOpenCodeModels,
+  opencodeHarness,
+  opencodeModelId,
+  OPENCODE_MODEL_CHOICES,
+} from "./opencode.js";
 
 const ENV_KEYS = ["HOME", "XDG_STATE_HOME"];
 
 async function main() {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), "pr-opencode-test-"));
   const previous = Object.fromEntries(ENV_KEYS.map((key) => [key, process.env[key]]));
+  const previousFetch = globalThis.fetch;
   const home = path.join(root, "home");
   const configPath = path.join(home, ".config", "opencode", "opencode.jsonc");
   const modelStatePath = path.join(home, ".local", "state", "opencode", "model.json");
@@ -35,6 +41,33 @@ async function main() {
   try {
     assert.equal(opencodeModelId("pennyrouter/auto"), "pennyrouter/auto");
     assert.equal(opencodeModelId("custom/model-a"), "custom/model-a");
+
+    let request;
+    globalThis.fetch = async (url, options) => {
+      request = { url, options };
+      return {
+        ok: true,
+        async json() {
+          return { data: [
+            { id: "pennyrouter/auto", display_name: "Auto from private gateway" },
+            { id: "pennyrouter/penny-core:premium", display_name: "Legacy bundle" },
+            { id: "claude-sonnet-5", display_name: "Private Sonnet", description: "Fresh" },
+          ] };
+        },
+      };
+    };
+    assert.deepEqual(await fetchOpenCodeModels(
+      "https://private.example/", "pr-test", { requireFresh: true },
+    ), [
+      { id: "pennyrouter/auto", name: "Auto from private gateway" },
+      { id: "claude-sonnet-5", name: "Private Sonnet", description: "Fresh" },
+    ]);
+    assert.equal(request.url, "https://private.example/v1/models");
+    assert.deepEqual(request.options.headers, {
+      Authorization: "Bearer pr-test",
+      "x-api-key": "pr-test",
+    });
+
     const plan = await opencodeHarness.planInstall();
     const record = await opencodeHarness.install({
       apiKey: "pr-test",
@@ -63,6 +96,7 @@ async function main() {
       if (previous[key] === undefined) delete process.env[key];
       else process.env[key] = previous[key];
     }
+    globalThis.fetch = previousFetch;
     fs.rmSync(root, { recursive: true, force: true });
   }