pennyrouter 0.3.7 → 0.3.8

package/README.md

@@ -23,6 +23,44 @@ npx pennyrouter status
 Installation opens a browser and requires login to the PennyRouter account that should own
 the new machine key. CLI installs no longer create anonymous ghost accounts.
 
+## Private and enterprise gateways
+
+Installing against a self-hosted gateway is its own flow, with no browser login: the gateway
+keeps its own accounts, so the key is minted there.
+
+```bash
+npx pennyrouter install --private-gateway https://gateway.example.internal
+```
+
+It asks for the gateway URL (unless given) and your email, and mints a key against that
+gateway. Installing on a second machine with the same email adds a key to the same account.
+Where an administrator issues keys instead, pass `--private-key pr-...` and no email is
+asked for. Self-service minting works only where the operator enabled it
+(`PENNYROUTER_OPEN_PROVISIONING`); otherwise install says so.
+
+To hand a whole team one file, put the shared answers in JSON and leave out the per-person
+ones:
+
+```json
+{
+  "harnesses": ["claude-code", "codex"],
+  "gatewayBaseUrl": "https://gateway.example.internal",
+  "claudeFunding": ["anthropic-proxy"],
+  "proxyBaseUrl": "https://litellm.example.internal",
+  "codexFunding": ["openai-proxy"],
+  "openaiProxyBaseUrl": "https://litellm.example.internal"
+}
+```
+
+```bash
+npx pennyrouter install --config team-install.json
+```
+
+Each person is prompted for their email and their proxy key; everything else is prefilled.
+Any field left out of the file is prompted for, and an unattended run that cannot prompt
+refuses by name rather than installing a half-configured harness. Add `email`, `proxyApiKey`
+and `openaiProxyApiKey` to the file to skip the prompts entirely.
+
 With no `--harness` flag, the interactive installer shows Claude Code, Codex, and OpenCode. Detected
 tools start checked. The additional legacy integrations remain available through an explicit
 `--harness <id>` selection or `--all`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pennyrouter",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "Install and manage PennyRouter local coding-agent integrations.",
   "homepage": "https://pennyrouter.com",
   "bugs": {

package/src/cli.js

@@ -285,8 +285,13 @@ export function applyConfigFile(flags) {
     for (const option of INSTALL_MANIFEST.funding_groups[group].options) {
       if (!chosen.has(option.id)) continue;
       for (const field of option.fields) {
-        if (flags[field.config_key] === undefined) {
-          flags[field.config_key] = config[field.config_key] || "";
+        // Only copy what the file actually carries. Writing "" for an absent field would
+        // make it look supplied-but-empty, which reads as "this option was configured" to
+        // the provider selection below and skips the prompt that would have filled it --
+        // exactly what a shared file with the secrets left out depends on.
+        const value = String(config[field.config_key] ?? "").trim();
+        if (value && flags[field.config_key] === undefined) {
+          flags[field.config_key] = value;
         }
       }
     }
@@ -896,7 +901,7 @@ function mcpTargets(flags) {
 async function resolvePrivateGatewayUrl(flags) {
   let raw = (flags.gatewayBaseUrl || "").trim();
   if (!raw) {
-    if (flags.yes || !input.isTTY || !output.isTTY) {
+    if ((flags.yes && !flags.fromConfig) || !input.isTTY || !output.isTTY) {
       throw new Error(
         "--private-gateway needs the gateway URL in a non-interactive install: "
         + "`--private-gateway https://gateway.example.com`.",
@@ -931,7 +936,9 @@ async function obtainPrivateGatewayKey(flags, gatewayBaseUrl) {
 
   let email = (flags.email || "").trim();
   if (!email) {
-    if (flags.yes || !input.isTTY || !output.isTTY) {
+    // A shared --config file names the gateway but not who is installing, so the email is
+    // still asked for even though --config implies --yes.
+    if ((flags.yes && !flags.fromConfig) || !input.isTTY || !output.isTTY) {
       throw new Error(
         "--private-gateway needs an email in a non-interactive install: `--email you@example.com` "
         + "(or pass an admin-issued `--private-key pr-...`).",
@@ -1290,6 +1297,12 @@ async function selectClaudeFundingProviders(flags, selected) {
       && (flags.proxyApiKey || process.env.PENNYROUTER_PROXY_API_KEY)) {
     supplied.add("anthropic-proxy");
   }
+  // A --config file states its providers outright, and that choice stands whether or not the
+  // file also carried their secrets: a file shared with a team deliberately omits those, and
+  // configureUserFunding prompts for what is missing (or refuses, with no TTY to prompt on).
+  // Without this, an option whose secret was left out is silently dropped and the install
+  // completes having configured nothing.
+  for (const id of flags.configClaudeFunding || []) supplied.add(id);
 
   // Explicit flags are the automation selector. Interactive installs always default to the
   // subscription alone; environment keys are used if the user checks their provider.
@@ -1317,6 +1330,7 @@ async function selectCodexFundingProviders(flags, selected) {
   if ((flags.openaiProxyBaseUrl || process.env.PENNYROUTER_OPENAI_PROXY_BASE_URL)
       && (flags.openaiProxyApiKey || process.env.PENNYROUTER_OPENAI_PROXY_API_KEY)) supplied.add("openai-proxy");
   if (flags.openrouterApiKey || process.env.OPENROUTER_API_KEY) supplied.add("openrouter");
+  for (const id of flags.configCodexFunding || []) supplied.add(id);
   const hasChatgptLogin = await detectCodexChatgptAuth();
   if (hasChatgptLogin) supplied.add("subscription");
 
@@ -1393,7 +1407,10 @@ async function configureUserFunding(flags, selected, claudeAnthropicAuth,
                                     claudeProviders = new Set(), codexProviders = new Set()) {
   const wantsClaude = selected.some((harness) => harness.id === "claude-code");
   const wantsCodex = selected.some((harness) => harness.id === "codex");
-  const interactive = !flags.yes && input.isTTY && output.isTTY;
+  // --config drives --yes to skip the question screens, but a file meant to be shared with a
+  // team deliberately carries no secrets: the fields it leaves out are still asked for here,
+  // the same way the subscription sign-in below stays interactive under --config.
+  const interactive = (!flags.yes || flags.fromConfig) && input.isTTY && output.isTTY;
   const credentials = [];
 
   let anthropicApiKey = String(

package/src/cli.test.js

@@ -305,3 +305,49 @@ test("--private-gateway does not consume a following flag as its URL", async ()
     /needs the gateway URL/,
   );
 });
+
+// A --config file meant to be shared with a team carries no secrets and does not know who is
+// installing. --config implies --yes, so the omitted fields are prompted for when there is a
+// TTY; with no TTY the install must REFUSE. It previously completed here having configured no
+// credential at all, because a funding option whose secret was absent was silently dropped.
+test("a shared --config without its secret refuses rather than installing nothing", async () => {
+  // Isolate the install state: against a real one where this harness is already installed
+  // with this funding, install takes its "nothing changed" refresh path and never reaches
+  // credential collection.
+  const stateDir = mkdtempSync(join(tmpdir(), "pennyrouter-state-"));
+  const priorState = process.env.XDG_STATE_HOME;
+  process.env.XDG_STATE_HOME = stateDir;
+  try {
+  await assert.rejects(
+    () => withConfigFile({
+      harnesses: ["claude-code"],
+      gatewayBaseUrl: "https://gateway.example.com",
+      claudeFunding: ["anthropic-proxy"],
+      proxyBaseUrl: "https://proxy.example.com",
+      privateKey: "pr-test",
+    }, (path) => captureLogs(() => main(["install", "--config", path]))),
+    /--proxy-base-url and --proxy-api-key were not both provided/,
+  );
+  } finally {
+    if (priorState === undefined) delete process.env.XDG_STATE_HOME;
+    else process.env.XDG_STATE_HOME = priorState;
+    rmSync(stateDir, { recursive: true, force: true });
+  }
+});
+
+// The config names its providers; that choice stands even when the file omits their secrets.
+test("--config funding choices survive a missing secret", async () => {
+  await withConfigFile({
+    harnesses: ["claude-code"],
+    claudeFunding: ["anthropic-proxy"],
+    proxyBaseUrl: "https://proxy.example.com",
+  }, (path) => {
+    const flags = { configPath: path, args: [] };
+    applyConfigFile(flags);
+    assert.deepEqual([...flags.configClaudeFunding], ["anthropic-proxy"]);
+    // Absent fields stay undefined so the prompt path can fill them; "" would read as
+    // supplied-but-empty and skip it.
+    assert.equal(flags.proxyApiKey, undefined);
+    assert.equal(flags.proxyBaseUrl, "https://proxy.example.com");
+  });
+});