@100xprompt/brain 0.1.0 → 0.1.2

package/src/gateway/connect.ts

@@ -15,36 +15,52 @@
 // stores the key that comes back in <home>/.brain/gateway.key (0600). For scripts and CI, --key-env VAR takes it from an
 // environment variable instead; --from-cli reuses the 100xprompt CLI's sign-in. It is never printed. Tools read it at run time where they can (Claude Code's apiKeyHelper,
 // OpenCode's {file:...}); Codex and Gemini CLI can only take it in their own config, which is then made private (0600).
-import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs"
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, writeFileSync } from "node:fs"
 import { basename, dirname, join, resolve } from "node:path"
+import {
+  brainDir,
+  type Codec,
+  type Connector,
+  DEFAULT_MODEL,
+  DEFAULT_ROUTE,
+  DEFAULT_URL,
+  deleteAt,
+  EDIT_HEADER,
+  type Env,
+  type FileEdit,
+  type Format,
+  type GatewaySettings,
+  getAt,
+  type Json,
+  keyPath,
+  MODEL_NAMES,
+  modelId,
+  modelName,
+  readKey,
+  routeUrl,
+  setAt,
+  shellQuote,
+  statePath,
+} from "./common.ts"
+import { EXTRA_CONNECTORS } from "./connectors/index.ts"
 import { askHidden, browserSignIn, type SignInDeps } from "./signin.ts"
 
-type Json = Record<string, any>
+export {
+  DEFAULT_MODEL,
+  DEFAULT_ROUTE,
+  DEFAULT_URL,
+  EDIT_HEADER,
+  keyPath,
+  modelId,
+  modelName,
+  statePath,
+  type Connector,
+  type FileEdit,
+  type GatewaySettings,
+} from "./common.ts"
 
-export const DEFAULT_URL = "https://proxy.100xprompt.com"
-export const DEFAULT_ROUTE = "flash"
-export const DEFAULT_MODEL = "gemini-3.8-flash"
-
-/**
- * What 100xprompt calls the models brain may connect a tool to, as the 100xprompt CLI shows them: tools are given the
- * gateway's model id (that is what the gateway serves), and everything brain prints uses the product name.
- */
-const MODEL_NAMES: Record<string, string> = { "gemini-3.8-flash": "100xprompt Pro", "gemini-3.7-flash": "100xprompt Flash", "gemini-3.6-flash": "100xprompt Flash" }
-/** `--model pro` / `--model flash`: the product names, turned into the gateway's model ids. */
-const MODEL_ALIASES: Record<string, string> = { pro: "gemini-3.8-flash", flash: "gemini-3.7-flash" }
-export const modelName = (id: string) => MODEL_NAMES[id] ?? id
-export const modelId = (given: string) => MODEL_ALIASES[given.trim().toLowerCase()] ?? given.trim()
 /** A value as connect and its dry run show it: the model ids in it by their product names. */
 const shownValue = (v: unknown) => Object.entries(MODEL_NAMES).reduce((t, [id, name]) => t.replaceAll(id, name), JSON.stringify(v))
-export const EDIT_HEADER = "x-100x-context-edit"
-
-export interface GatewaySettings {
-  url: string
-  route: string
-  model: string
-  /** Send `x-100x-context-edit: on` (the gateway clears old tool results when that saves money). */
-  contextEdit: boolean
-}
 
 /** What one connect changed in one file: the key (JSON path with "/", TOML or .env key) and the value it had before (undefined: absent). */
 interface Change {
@@ -55,29 +71,14 @@ interface Change {
   after: unknown
 }
 
-type Format = "json" | "toml" | "dotenv"
-
-/** One file a connector changes, and the values it sets there. */
-export interface FileEdit {
-  path: string
-  format: Format
-  values: Record<string, unknown>
-  /** The file holds the key: make it private (0600). */
-  holdsKey?: boolean
-}
-
 interface State {
   settings?: GatewaySettings
   keySource?: string
   /** Who signed in (from the sign-in page), shown by status. */
   email?: string
-  tools: Record<string, { at: string; changes: Change[]; created?: string[] }>
+  tools: Record<string, { at: string; changes: Change[]; created?: string[]; createdDirs?: string[]; modes?: Record<string, number> }>
 }
 
-const brainDir = (home: string) => join(home, ".brain")
-export const statePath = (home: string) => join(brainDir(home), "gateway.json")
-export const keyPath = (home: string) => join(brainDir(home), "gateway.key")
-
 function loadState(home: string): State {
   try {
     const s = JSON.parse(readFileSync(statePath(home), "utf8"))
@@ -160,21 +161,12 @@ export function hasKey(home: string): boolean {
   }
 }
 
-/** The stored key ("" when there is none: a dry run shows what would change without one). */
-const readKey = (home: string) => {
-  try {
-    return readFileSync(keyPath(home), "utf8").trim()
-  } catch {
-    return ""
-  }
-}
-
 /**
  * Writes the key (0600, never printed) and where it came from. Tools that keep their own copy of the key (Codex, Gemini
  * CLI) get the new one too, where their copy is still the old key: otherwise a sign-in to another account would leave them
  * on the old one while status names the new. Returns the tools whose copy was replaced.
  */
-export function storeKey(home: string, key: string, source: string, email?: string): string[] {
+export function storeKey(home: string, key: string, source: string, email?: string, env: Env = process.env): string[] {
   const old = readKey(home)
   mkdirSync(brainDir(home), { recursive: true, mode: 0o700 })
   writePrivate(keyPath(home), `${key}\n`)
@@ -183,28 +175,40 @@ export function storeKey(home: string, key: string, source: string, email?: stri
   if (email) s.email = email
   else delete s.email
   saveState(home, s)
-  return refreshKeyCopies(home, old, key)
+  return refreshKeyCopies(home, old, key, env)
+}
+
+/** Whether `v` (a string, or anything holding strings) contains `k`; and `v` with every `a` in it replaced by `b`. */
+const holds = (v: unknown, k: string): boolean =>
+  typeof v === "string" ? v.includes(k) : Array.isArray(v) ? v.some((x) => holds(x, k)) : !!v && typeof v === "object" && Object.values(v).some((x) => holds(x, k))
+const swap = (v: unknown, a: string, b: string): unknown =>
+  typeof v === "string" ? v.replaceAll(a, b) : Array.isArray(v) ? v.map((x) => swap(x, a, b)) : v && typeof v === "object" ? Object.fromEntries(Object.entries(v).map(([k, x]) => [k, swap(x, a, b)])) : v
+
+/** The codec of each custom-format file a connector edits, by path (disconnect and the key refresh need it to read the file). */
+function codecsOf(c: Connector, home: string, st: State, env: Env): Map<string, Codec> {
+  const s = st.settings ?? { url: DEFAULT_URL, route: DEFAULT_ROUTE, model: DEFAULT_MODEL, contextEdit: true }
+  try {
+    return new Map(c.edits(home, s, env).flatMap((e) => (e.codec ? [[e.path, e.codec] as const] : [])))
+  } catch {
+    return new Map()
+  }
 }
 
-/** Replaces `old` with `key` in the key copies connect wrote (only where the copy is still `old`: a changed one is left). */
-function refreshKeyCopies(home: string, old: string, key: string): string[] {
+/** Replaces `old` with `key` in the key copies connect wrote (only where the copy still holds `old`: a changed one is left). */
+function refreshKeyCopies(home: string, old: string, key: string, env: Env): string[] {
   if (!old || old === key) return []
   const st = loadState(home)
   const done = new Set<string>()
   for (const c of CONNECTORS) {
     const rec = st.tools[c.id]
     if (!rec) continue
-    for (const x of rec.changes.filter((y) => SECRET_KEYS.has(y.key))) {
-      const d = load(x.format, x.file)
+    const codecs = codecsOf(c, home, st, env)
+    for (const x of rec.changes.filter((y) => y.after === "(contains the key)")) {
+      const d = load(x.format, x.file, codecs.get(x.file))
       if ("error" in d) continue
       const cur = getKey(d, x.key)
-      if (x.key === "GEMINI_API_KEY") {
-        if (cur !== old) continue
-        setKey(d, x.key, key)
-      } else {
-        if (!cur || typeof cur !== "object" || (cur as Json).experimental_bearer_token !== old) continue
-        setKey(d, x.key, { ...(cur as Json), experimental_bearer_token: key })
-      }
+      if (!holds(cur, old)) continue
+      setKey(d, x.key, swap(cur, old, key))
       writeToolFile(home, c.id, x.file, render(d), 0o600, false)
       done.add(c.label)
     }
@@ -233,15 +237,15 @@ export function login(home: string, opts: { keyEnv?: string; fromCli?: boolean;
     if (!key) return { ok: false, why: "the 100xprompt CLI is not signed in here; run `brain gateway login` to sign in in the browser" }
   } else return { ok: false, why: "say where the key comes from (--key-env VAR or --from-cli), or run `brain gateway login` to sign in in the browser" }
   if (/\s/.test(key) || key.length < 8) return { ok: false, why: "that does not look like a gateway key" }
-  return { ok: true, source, refreshed: storeKey(home, key, source) }
+  return { ok: true, source, refreshed: storeKey(home, key, source, undefined, env) }
 }
 
 /** Signs in in the browser (signin.ts) and stores the key that comes back. */
-export async function signIn(home: string, d: SignInDeps): Promise<{ ok: true; source: string; email?: string; refreshed: string[] } | { ok: false; why: string }> {
+export async function signIn(home: string, d: SignInDeps, env: Env = process.env): Promise<{ ok: true; source: string; email?: string; refreshed: string[] } | { ok: false; why: string }> {
   const r = await browserSignIn(d)
   if (!r.ok) return r
   const source = r.via === "browser" ? "signing in in the browser" : "a pasted key"
-  const refreshed = storeKey(home, r.key, source, r.email)
+  const refreshed = storeKey(home, r.key, source, r.email, env)
   return { ok: true, source, ...(r.email ? { email: r.email } : {}), refreshed }
 }
 
@@ -260,7 +264,7 @@ export function logout(home: string, env: Record<string, string | undefined> = p
   const readers = connected.filter((c) => !copies.includes(c))
   const names = (cs: Connector[]) => cs.map((c) => c.label).join(" and ")
   if (readers.length)
-    out.push(`${names(readers)} ${readers.length === 1 ? "reads" : "read"} the key from that file, so ${readers.length === 1 ? "it" : "they"} cannot reach the gateway until you sign in again (brain gateway login); brain gateway disconnect --tool <id> puts ${readers.length === 1 ? "it" : "them"} back as before.`)
+    out.push(`${names(readers)} ${readers.length === 1 ? "reads" : "read"} the key from that file, so ${readers.length === 1 ? "it" : "they"} cannot reach the gateway until you sign in again (brain gateway login), and a tool that reads it at start may refuse to start; brain gateway disconnect --tool <id> puts ${readers.length === 1 ? "it" : "them"} back as before.`)
   if (copies.length)
     out.push(`${names(copies)} ${copies.length === 1 ? "keeps its" : "keep their"} own copy of the key and still ${copies.length === 1 ? "reaches" : "reach"} the gateway with it (signing out here does not revoke a key): brain gateway disconnect --tool <id> removes the copy.`)
   return out
@@ -269,65 +273,13 @@ export function logout(home: string, env: Record<string, string | undefined> = p
 // ---- connectors -------------------------------------------------------------------------------------------------------
 
 /** Dotted-path get/set/delete on JSON objects (keys never contain dots here except where quoted with a slash). */
-const split = (k: string) => k.split("/")
-function getAt(o: Json, key: string): unknown {
-  let cur: any = o
-  for (const p of split(key)) {
-    if (!cur || typeof cur !== "object" || !(p in cur)) return undefined
-    cur = cur[p]
-  }
-  return cur
-}
-function setAt(o: Json, key: string, v: unknown) {
-  const ps = split(key)
-  let cur: any = o
-  for (const p of ps.slice(0, -1)) {
-    if (!cur[p] || typeof cur[p] !== "object" || Array.isArray(cur[p])) cur[p] = {}
-    cur = cur[p]
-  }
-  cur[ps[ps.length - 1]!] = v
-}
-function deleteAt(o: Json, key: string) {
-  const ps = split(key)
-  const parents: any[] = [o]
-  let cur: any = o
-  for (const p of ps.slice(0, -1)) {
-    if (!cur || typeof cur !== "object") return
-    cur = cur[p]
-    parents.push(cur)
-  }
-  if (cur && typeof cur === "object") delete cur[ps[ps.length - 1]!]
-  // Drop objects this left empty (env: {} after the last key went), never the root.
-  for (let i = ps.length - 1; i >= 1; i--) {
-    const parent = parents[i - 1]
-    const child = parent?.[ps[i - 1]!]
-    if (child && typeof child === "object" && !Array.isArray(child) && !Object.keys(child).length) delete parent[ps[i - 1]!]
-  }
-}
 const same = (a: unknown, b: unknown) => JSON.stringify(a) === JSON.stringify(b)
-const shellQuote = (s: string) => `'${s.replace(/'/g, `'\\''`)}'`
-
-export interface Connector {
-  id: string
-  label: string
-  /** The main file it edits (shown in status), absolute. */
-  file(home: string, env: Record<string, string | undefined>): string
-  /** Folder or file that shows the tool has run here (relative to home), besides the main file or its folder. */
-  probe: string[]
-  /** Every file it changes, with the values to set. */
-  edits(home: string, s: GatewaySettings, env: Record<string, string | undefined>): FileEdit[]
-  /** How the key reaches the gateway from this tool, for the key check: header name. */
-  authHeader: "x-api-key" | "authorization" | "x-goog-api-key"
-  /** What the person should know (shown on connect). */
-  notes: string[]
-}
-
-const routeUrl = (s: GatewaySettings) => `${s.url.replace(/\/+$/, "")}/${s.route}`
+
 const claudeDir = (home: string, env: Record<string, string | undefined>) => (env.CLAUDE_CONFIG_DIR && existsSync(env.CLAUDE_CONFIG_DIR) ? env.CLAUDE_CONFIG_DIR : join(home, ".claude"))
 const codexDir = (home: string, env: Record<string, string | undefined>) => (env.CODEX_HOME && existsSync(env.CODEX_HOME) ? env.CODEX_HOME : join(home, ".codex"))
 const geminiDir = (home: string, env: Record<string, string | undefined>) => join(env.GEMINI_CLI_HOME && existsSync(env.GEMINI_CLI_HOME) ? env.GEMINI_CLI_HOME : home, ".gemini")
 
-export const CONNECTORS: Connector[] = [
+const BUILT_IN: Connector[] = [
   {
     id: "claude-code",
     label: "Claude Code",
@@ -414,20 +366,25 @@ export const CONNECTORS: Connector[] = [
     notes: [
       "Gemini CLI reads ~/.gemini/.env at start; the key is kept there, so the file is now readable by you only (0600). Its sign-in is set to API key.",
       "Gemini CLI cannot send extra headers: context editing applies only when the gateway turns it on for everyone.",
+      "Gemini CLI loads only the first .env it finds from the project folder up, and ~/.gemini/.env only when there is none: in a project with its own .env (or .gemini/.env), add GOOGLE_GEMINI_BASE_URL, GEMINI_API_KEY and GEMINI_MODEL there, or export them.",
     ],
   },
 ]
 
-/** Keys whose value contains the key: recorded and shown without it. */
+/** The four connectors written first; every other tool's is in connectors/<tool>.ts. */
+export const CONNECTORS: Connector[] = [...BUILT_IN, ...EXTRA_CONNECTORS]
+
+/** Keys of the built-in connectors whose value contains the key (the others say so with FileEdit.secretKeys). */
 const SECRET_KEYS = new Set(["GEMINI_API_KEY", "model_providers/brain-gateway"])
+const isSecret = (e: FileEdit, key: string) => SECRET_KEYS.has(key) || !!e.secretKeys?.includes(key)
 
 export const connectorFor = (id: string) => CONNECTORS.find((c) => c.id === id || c.label.toLowerCase() === id.toLowerCase())
 
 // ---- reading and writing each format ---------------------------------------------------------------------------------
 
-type Doc = { kind: "json"; obj: Json; indent: string } | { kind: "toml"; text: string } | { kind: "dotenv"; lines: string[] }
+type Doc = { kind: "json"; obj: Json; indent: string } | { kind: "toml"; text: string } | { kind: "dotenv"; lines: string[] } | { kind: "custom"; text: string; codec: Codec }
 
-function load(format: Format, path: string): Doc | { error: string } {
+function load(format: Format, path: string, codec?: Codec): Doc | { error: string } {
   let text = ""
   if (existsSync(path)) {
     try {
@@ -436,6 +393,11 @@ function load(format: Format, path: string): Doc | { error: string } {
       return { error: `cannot read it (${(e as Error).message})` }
     }
   }
+  if (format === "custom") {
+    if (!codec) return { error: "no codec for this file; left as it is" }
+    const why = codec.check?.(text)
+    return why ? { error: why } : { kind: "custom", text, codec }
+  }
   if (format === "json") {
     if (!text.trim()) return { kind: "json", obj: {}, indent: "  " }
     try {
@@ -460,6 +422,7 @@ function load(format: Format, path: string): Doc | { error: string } {
 }
 
 function render(d: Doc): string {
+  if (d.kind === "custom") return d.text
   if (d.kind === "json") return `${JSON.stringify(d.obj, null, d.indent)}\n`
   if (d.kind === "toml") return d.text.endsWith("\n") || !d.text ? d.text : `${d.text}\n`
   return d.lines.length ? `${d.lines.join("\n")}\n` : ""
@@ -545,11 +508,16 @@ function dotenvSet(lines: string[], key: string, v: string | undefined): string[
 }
 
 function getKey(d: Doc, key: string): unknown {
+  if (d.kind === "custom") return d.codec.get(d.text, key)
   if (d.kind === "json") return getAt(d.obj, key)
   if (d.kind === "toml") return tomlGet(d.text, key)
   return dotenvGet(d.lines, key)
 }
 function setKey(d: Doc, key: string, v: unknown) {
+  if (d.kind === "custom") {
+    d.text = d.codec.set(d.text, key, v)
+    return
+  }
   if (d.kind === "json") return v === undefined ? deleteAt(d.obj, key) : setAt(d.obj, key, v)
   if (d.kind === "toml") d.text = tomlSet(d.text, key, v)
   else d.lines = dotenvSet(d.lines, key, v === undefined ? undefined : String(v))
@@ -611,7 +579,8 @@ export interface Result {
 
 export function installedHere(c: Connector, home: string, env: Record<string, string | undefined>): boolean {
   const f = c.file(home, env)
-  return existsSync(f) || existsSync(dirname(f)) || c.probe.some((p) => existsSync(join(home, p)))
+  // The main file's folder counts, unless it is the home itself (~/.aider.conf.yml: every home has a home).
+  return existsSync(f) || (resolve(dirname(f)) !== resolve(home) && existsSync(dirname(f))) || c.probe.some((p) => existsSync(join(home, p)))
 }
 
 export async function connect(
@@ -646,37 +615,54 @@ export async function connect(
   const edits = c.edits(home, s, env)
   const docs: Array<{ e: FileEdit; d: Doc }> = []
   for (const e of edits) {
-    const d = load(e.format, e.path)
+    const d = load(e.format, e.path, e.codec)
     if ("error" in d) return { ok: false, lines: [`${e.path}: ${d.error}; nothing was changed`] }
     docs.push({ e, d })
   }
   const prior = st.tools[c.id]?.changes ?? []
   const changes: Change[] = []
   const shown: string[] = []
-  for (const { e, d } of docs) {
-    for (const [key, after] of Object.entries(e.values)) {
-      const current = getKey(d, key)
-      // A reconnect keeps the value from before the FIRST connect, so disconnect still restores the person's own.
-      const was = prior.find((x) => x.file === e.path && x.key === key)
-      changes.push({ file: e.path, format: e.format, key, before: was ? was.before : current, after: SECRET_KEYS.has(key) ? "(contains the key)" : after })
-      if (!same(current, after)) setKey(d, key, after)
-      shown.push(`  ${basename(e.path)}: ${key.replace(/\//g, ".")} = ${SECRET_KEYS.has(key) ? "(gateway settings and key)" : shownValue(after)}`)
-    }
-    // A key an earlier connect set that this one no longer wants (--no-context-edit after a connect with it): put it back now.
-    for (const x of prior) {
-      if (x.file !== e.path || x.key in e.values) continue
-      const current = getKey(d, x.key)
-      if (x.after === "(contains the key)" ? current !== undefined : same(current, x.after)) setKey(d, x.key, x.before)
+  try {
+    for (const { e, d } of docs) {
+      for (const [key, after] of Object.entries(e.values)) {
+        const current = getKey(d, key)
+        // A reconnect keeps the value from before the FIRST connect, so disconnect still restores the person's own.
+        const was = prior.find((x) => x.file === e.path && x.key === key)
+        const secret = isSecret(e, key)
+        changes.push({ file: e.path, format: e.format, key, before: was ? was.before : current, after: secret ? "(contains the key)" : after })
+        if (!same(current, after)) setKey(d, key, after)
+        shown.push(`  ${basename(e.path)}: ${key.replace(/\//g, ".")} = ${secret ? "(gateway settings and key)" : shownValue(after)}`)
+      }
+      // A key an earlier connect set that this one no longer wants (--no-context-edit after a connect with it): put it back now.
+      for (const x of prior) {
+        if (x.file !== e.path || x.key in e.values) continue
+        const current = getKey(d, x.key)
+        if (x.after === "(contains the key)" ? current !== undefined : same(current, x.after)) setKey(d, x.key, x.before)
+      }
     }
+  } catch (err) {
+    // A file format the connector's codec could not change after all: nothing has been written yet.
+    return { ok: false, lines: [`could not change ${c.label}'s settings (${(err as Error).message.slice(0, 200)}); nothing was changed`] }
   }
   const named = MODEL_NAMES[s.model] ? [`note: models are shown by their 100xprompt names; the files get the gateway's id for ${modelName(s.model)}`] : []
   if (o.dryRun) return { ok: true, lines: [`would change:`, ...shown, ...named, ...c.notes.map((n) => `note: ${n}`)] }
   const created = new Set(st.tools[c.id]?.created ?? [])
   for (const { e } of docs) if (!existsSync(e.path)) created.add(e.path)
+  // Folders connect has to create (Goose's custom_providers/), so disconnect can take them away again when they are empty.
+  const createdDirs = new Set(st.tools[c.id]?.createdDirs ?? [])
+  for (const { e } of docs) for (let dir = dirname(e.path); !existsSync(dir) && dir.startsWith(`${resolve(home)}/`); dir = dirname(dir)) createdDirs.add(dir)
+  // A file that is made private (it gets the key) goes back to the mode it had when disconnect gives it back.
+  const modes: Record<string, number> = { ...(st.tools[c.id]?.modes ?? {}) }
+  for (const { e } of docs) {
+    if (!e.holdsKey || !existsSync(e.path) || modes[e.path] !== undefined) continue
+    try {
+      modes[e.path] = statSync(e.path).mode & 0o777
+    } catch {}
+  }
   const first = !st.tools[c.id]
   for (const { e, d } of docs) writeToolFile(home, c.id, e.path, render(d), e.holdsKey ? 0o600 : undefined, first)
   st.settings = s
-  st.tools[c.id] = { at: new Date().toISOString(), changes, ...(created.size ? { created: [...created] } : {}) }
+  st.tools[c.id] = { at: new Date().toISOString(), changes, ...(created.size ? { created: [...created] } : {}), ...(createdDirs.size ? { createdDirs: [...createdDirs] } : {}), ...(Object.keys(modes).length ? { modes } : {}) }
   saveState(home, st)
   return {
     ok: true,
@@ -691,36 +677,48 @@ export async function connect(
   }
 }
 
-export function disconnect(home: string, toolId: string, o: { dryRun?: boolean } = {}): Result {
+export function disconnect(home: string, toolId: string, o: { dryRun?: boolean; env?: Env } = {}): Result {
   const c = connectorFor(toolId)
   if (!c) return { ok: false, lines: [`unknown tool "${toolId}"`] }
   const st = loadState(home)
   const rec = st.tools[c.id]
   if (!rec) return { ok: true, lines: [`${c.label} is not connected by brain; nothing to undo`] }
+  const codecs = codecsOf(c, home, st, o.env ?? process.env)
   const lines: string[] = []
   for (const path of [...new Set(rec.changes.map((x) => x.file))]) {
-    const d = load(rec.changes.find((x) => x.file === path)!.format ?? "json", path)
-    if ("error" in d) {
-      lines.push(`${path}: ${d.error}`)
-      continue
-    }
-    for (const x of rec.changes.filter((y) => y.file === path)) {
-      const current = getKey(d, x.key)
-      // Our own value (or, for entries holding the key, still our provider/key entry): put back what was there before.
-      const ours = x.after === "(contains the key)" ? current !== undefined : same(current, x.after)
-      if (!ours) {
-        lines.push(`  ${basename(path)}: ${x.key.replace(/\//g, ".")} changed since connect; left as it is`)
+    try {
+      const d = load(rec.changes.find((x) => x.file === path)!.format ?? "json", path, codecs.get(path))
+      if ("error" in d) {
+        lines.push(`${path}: ${d.error}`)
         continue
       }
-      setKey(d, x.key, x.before)
-      lines.push(`  ${basename(path)}: ${x.key.replace(/\//g, ".")} ${x.before === undefined ? "removed" : "restored"}`)
+      for (const x of rec.changes.filter((y) => y.file === path)) {
+        const current = getKey(d, x.key)
+        // Our own value (or, for entries holding the key, still our provider/key entry): put back what was there before.
+        const ours = x.after === "(contains the key)" ? current !== undefined : same(current, x.after)
+        if (!ours) {
+          lines.push(`  ${basename(path)}: ${x.key.replace(/\//g, ".")} changed since connect; left as it is`)
+          continue
+        }
+        setKey(d, x.key, x.before)
+        lines.push(`  ${basename(path)}: ${x.key.replace(/\//g, ".")} ${x.before === undefined ? "removed" : "restored"}`)
+      }
+      if (o.dryRun) continue
+      const text = render(d)
+      // A file connect created and that holds nothing else now is removed, not left behind empty.
+      if (rec.created?.includes(path) && /^(\{\}\n?|\s*)$/.test(text)) rmSync(path, { force: true })
+      else writeToolFile(home, c.id, path, text, rec.modes?.[path], false)
+    } catch (err) {
+      lines.push(`${path}: could not be changed back (${(err as Error).message.slice(0, 200)}); left as it is`)
     }
-    if (o.dryRun) continue
-    const text = render(d)
-    // A file connect created and that holds nothing else now is removed, not left behind empty.
-    if (rec.created?.includes(path) && /^(\{\}\n?|\s*)$/.test(text)) rmSync(path, { force: true })
-    else writeToolFile(home, c.id, path, text, undefined, false)
   }
+  // Folders connect created, deepest first, if nothing else has been put in them.
+  if (!o.dryRun)
+    for (const dir of [...(rec.createdDirs ?? [])].sort((a, b) => b.length - a.length)) {
+      try {
+        if (readdirSync(dir).length === 0) rmdirSync(dir)
+      } catch {}
+    }
   if (!o.dryRun) {
     delete st.tools[c.id]
     saveState(home, st)
@@ -787,7 +785,7 @@ export async function gatewayCommand(
   }
   // The browser sign-in, with a hidden paste prompt when there is a terminal to ask in.
   const browserLogin = async () => {
-    const r = await signIn(home, { say: io.out, ask: process.stdin.isTTY ? askHidden : undefined, browser: !has("no-browser"), ...deps.signIn })
+    const r = await signIn(home, { say: io.out, ask: process.stdin.isTTY ? askHidden : undefined, browser: !has("no-browser"), ...deps.signIn }, env)
     io.out(r.ok ? `signed in${r.email ? ` as ${r.email}` : ""}; gateway key stored in ${keyPath(home)} (mode 0600)` : `brain gateway login: ${r.why}`)
     if (r.ok) refreshedNote(r.refreshed)
     return r.ok
@@ -802,9 +800,13 @@ export async function gatewayCommand(
       }
       return (await browserLogin()) ? 0 : 1
     }
-    case "logout":
+    case "logout": {
+      // The dashboard's last word from this machine: signed out (after logout there is no key to send it with).
+      const { reportSignedOut } = await import("../dashboard/send.ts")
+      await reportSignedOut(home, { env, ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}) })
       logout(home, env).forEach((l) => io.out(l))
       return 0
+    }
     case "connect":
     case "disconnect": {
       const tool = flag("tool")
@@ -812,7 +814,7 @@ export async function gatewayCommand(
         io.out(`usage: ${USAGE[sub === "connect" ? 3 : 4]}`)
         return 2
       }
-      if (sub === "disconnect") return print(disconnect(home, tool, { dryRun: has("dry-run") }))
+      if (sub === "disconnect") return print(disconnect(home, tool, { dryRun: has("dry-run"), env }))
       const settings = { ...(flag("url") ? { url: flag("url")! } : {}), ...(flag("route") ? { route: flag("route")! } : {}), ...(flag("model") ? { model: flag("model")! } : {}), ...(has("no-context-edit") ? { contextEdit: false } : has("context-edit") ? { contextEdit: true } : {}) }
       // Not signed in yet: sign in first, as the 100xprompt CLI would, then connect. Everything that can be checked here
       // (the tool, its files, the flags) is checked first, so nobody signs in for a connect that was bound to fail.