@100xprompt/brain 0.1.2 → 0.1.4

package/src/gateway/common.ts

@@ -12,15 +12,66 @@ export const DEFAULT_ROUTE = "flash"
 export const DEFAULT_MODEL = "gemini-3.8-flash"
 export const EDIT_HEADER = "x-100x-context-edit"
 
+/**
+ * `--model auto`: the gateway's auto-routing (the router's docs/routing-contract.md, "The /auto route"). Its route serves
+ * only this model id, and this id only on its route: per kind of work (everyday asks, code, reasoning) the gateway serves
+ * a cheaper model where the company's own test in the Savings app proved it no worse, and 100xprompt Pro everywhere else.
+ */
+export const AUTO_ROUTE = "auto"
+export const AUTO_MODEL = "100xprompt-auto"
+
 /**
  * What 100xprompt calls the models brain may connect a tool to, as the 100xprompt CLI shows them: tools are given the
  * gateway's model id (that is what the gateway serves), and everything brain prints uses the product name.
  */
-export const MODEL_NAMES: Record<string, string> = { "gemini-3.8-flash": "100xprompt Pro", "gemini-3.7-flash": "100xprompt Flash", "gemini-3.6-flash": "100xprompt Flash" }
-/** `--model pro` / `--model flash`: the product names, turned into the gateway's model ids. */
-export const MODEL_ALIASES: Record<string, string> = { pro: "gemini-3.8-flash", flash: "gemini-3.7-flash" }
+export const MODEL_NAMES: Record<string, string> = {
+  "gemini-3.8-flash": "100xprompt Pro",
+  "gemini-3.7-flash": "100xprompt Flash",
+  "gemini-3.6-flash": "100xprompt Flash",
+  "gemini-3.5-flash": "100xprompt Flash",
+  [AUTO_MODEL]: "100xprompt Auto",
+}
+/** `--model pro` / `--model flash` / `--model auto`: the product names, turned into the gateway's model ids. */
+export const MODEL_ALIASES: Record<string, string> = { pro: "gemini-3.8-flash", flash: "gemini-3.7-flash", auto: AUTO_MODEL }
 export const modelName = (id: string) => MODEL_NAMES[id] ?? id
 export const modelId = (given: string) => MODEL_ALIASES[given.trim().toLowerCase()] ?? given.trim()
+/**
+ * Whether a connect uses auto-routing. No tool knows this id: a connector whose tool sizes its context window (or picks
+ * its capabilities) from the model id it is given tells it, for auto, what every model auto may serve takes (limitsFor).
+ */
+export const isAuto = (s: Pick<GatewaySettings, "model">) => s.model === AUTO_MODEL
+/** What the Gemini Flash models behind 100xprompt Pro and Flash take: 1,048,576 tokens in, 65,536 out. */
+export const GEMINI_LIMITS = { context: 1_048_576, output: 65_536 } as const
+/**
+ * What every model auto-routing may serve takes (the contract's table: the Gemini Flash models and DeepSeek V4 Flash): the
+ * smaller window, DeepSeek V4 Flash's 1,000,000 tokens, and Gemini's 65,536 out (DeepSeek allows more). Both take text and
+ * images; audio, video and PDF only Gemini, so a tool told what it may send gets images only.
+ */
+export const AUTO_LIMITS = { context: 1_000_000, output: 65_536 } as const
+/** The context window and output limit a connector tells its tool, for the model it connects. */
+export const limitsFor = (s: Pick<GatewaySettings, "model">) => (isAuto(s) ? AUTO_LIMITS : GEMINI_LIMITS)
+
+/**
+ * The route and model a connect uses, from the flags given (undefined: not given) and the settings stored by the last
+ * connect. The auto model and the auto route go together: `--model auto` picks the auto route (a different --route with
+ * it is refused), `--route auto` picks the auto model, and another model or route after an auto connect goes back to the
+ * default route (flash) or model (100xprompt Pro).
+ */
+export function routeAndModel(given: { route?: string; model?: string }, stored: { route?: string; model?: string } = {}): { route: string; model: string } | { why: string } {
+  const model = given.model !== undefined ? modelId(given.model) : undefined
+  const route = given.route
+  if (model === AUTO_MODEL) {
+    if (route !== undefined && route !== AUTO_ROUTE) return { why: `--model auto uses the gateway's ${AUTO_ROUTE} route, so it cannot be combined with --route ${route}; leave out --route` }
+    return { route: AUTO_ROUTE, model }
+  }
+  if (route === AUTO_ROUTE) {
+    if (model !== undefined) return { why: `the ${AUTO_ROUTE} route chooses the model itself, so it cannot be combined with --model ${given.model!.trim()}; use --model auto` }
+    return { route: AUTO_ROUTE, model: AUTO_MODEL }
+  }
+  const wasAuto = stored.model === AUTO_MODEL || stored.route === AUTO_ROUTE
+  if (route === undefined && model === undefined) return wasAuto ? { route: AUTO_ROUTE, model: AUTO_MODEL } : { route: stored.route ?? DEFAULT_ROUTE, model: stored.model ?? DEFAULT_MODEL }
+  return { route: route ?? (wasAuto ? DEFAULT_ROUTE : (stored.route ?? DEFAULT_ROUTE)), model: model ?? (wasAuto ? DEFAULT_MODEL : (stored.model ?? DEFAULT_MODEL)) }
+}
 
 export interface GatewaySettings {
   url: string
@@ -46,7 +97,8 @@ export function readKey(home: string): string {
 }
 
 /**
- * The gateway route's base address, e.g. https://proxy.100xprompt.com/flash. Under it the gateway serves, for every model:
+ * The gateway route's base address, e.g. https://proxy.100xprompt.com/flash (or /auto, which takes the same paths). Under
+ * it the gateway serves, for every model:
  *   /v1/chat/completions   OpenAI Chat Completions (Authorization: Bearer <key>)
  *   /v1/responses          OpenAI Responses (Authorization: Bearer <key>)
  *   /v1/messages           Anthropic Messages (x-api-key: <key>, or Authorization: Bearer)

package/src/gateway/connect.ts

@@ -15,9 +15,10 @@
 // stores the key that comes back in <home>/.brain/gateway.key (0600). For scripts and CI, --key-env VAR takes it from an
 // environment variable instead; --from-cli reuses the 100xprompt CLI's sign-in. It is never printed. Tools read it at run time where they can (Claude Code's apiKeyHelper,
 // OpenCode's {file:...}); Codex and Gemini CLI can only take it in their own config, which is then made private (0600).
-import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, writeFileSync } from "node:fs"
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmdirSync, rmSync, statSync } from "node:fs"
 import { basename, dirname, join, resolve } from "node:path"
 import {
+  AUTO_ROUTE,
   brainDir,
   type Codec,
   type Connector,
@@ -34,9 +35,9 @@ import {
   type Json,
   keyPath,
   MODEL_NAMES,
-  modelId,
   modelName,
   readKey,
+  routeAndModel,
   routeUrl,
   setAt,
   shellQuote,
@@ -44,8 +45,14 @@ import {
 } from "./common.ts"
 import { EXTRA_CONNECTORS } from "./connectors/index.ts"
 import { askHidden, browserSignIn, type SignInDeps } from "./signin.ts"
+import { writeAtomic } from "../fsutil.ts"
+import { withBrainLockSync } from "../lock.ts"
+import { toolGatewayPrefs } from "../settings/values.ts"
+import { readMachineToken } from "../dashboard/state.ts"
 
 export {
+  AUTO_MODEL,
+  AUTO_ROUTE,
   DEFAULT_MODEL,
   DEFAULT_ROUTE,
   DEFAULT_URL,
@@ -76,7 +83,17 @@ interface State {
   keySource?: string
   /** Who signed in (from the sign-in page), shown by status. */
   email?: string
-  tools: Record<string, { at: string; changes: Change[]; created?: string[]; createdDirs?: string[]; modes?: Record<string, number> }>
+  tools: Record<string, ToolRecord>
+}
+
+interface ToolRecord {
+  at: string
+  changes: Change[]
+  created?: string[]
+  createdDirs?: string[]
+  modes?: Record<string, number>
+  /** The settings this tool was connected with (older records have none: `settings` above is the last connect's). */
+  settings?: GatewaySettings
 }
 
 function loadState(home: string): State {
@@ -95,11 +112,7 @@ function saveState(home: string, s: State) {
 
 /** Atomic write with mode 0600 (the key and the record of what was changed). */
 function writePrivate(path: string, text: string) {
-  const tmp = `${path}.brain-tmp`
-  rmSync(tmp, { force: true })
-  writeFileSync(tmp, text, { mode: 0o600 })
-  chmodSync(tmp, 0o600)
-  renameSync(tmp, path)
+  writeAtomic(path, text, 0o600)
 }
 
 /**
@@ -122,11 +135,7 @@ function writeToolFile(home: string, tool: string, path: string, text: string, m
       keep = statSync(real).mode & 0o777
     } catch {}
   }
-  const tmp = `${real}.brain-tmp`
-  rmSync(tmp, { force: true })
-  writeFileSync(tmp, text, keep === undefined ? {} : { mode: keep })
-  if (keep !== undefined) chmodSync(tmp, keep)
-  renameSync(tmp, real)
+  writeAtomic(real, text, keep)
 }
 
 // ---- the key ----------------------------------------------------------------------------------------------------------
@@ -167,6 +176,10 @@ export function hasKey(home: string): boolean {
  * on the old one while status names the new. Returns the tools whose copy was replaced.
  */
 export function storeKey(home: string, key: string, source: string, email?: string, env: Env = process.env): string[] {
+  return withBrainLockSync(home, () => storeKeyLocked(home, key, source, email, env), { what: "storing the gateway key" })
+}
+
+function storeKeyLocked(home: string, key: string, source: string, email: string | undefined, env: Env): string[] {
   const old = readKey(home)
   mkdirSync(brainDir(home), { recursive: true, mode: 0o700 })
   writePrivate(keyPath(home), `${key}\n`)
@@ -251,6 +264,10 @@ export async function signIn(home: string, d: SignInDeps, env: Env = process.env
 
 /** Forgets the key. Tools still connected stop working until the next login, which is said. */
 export function logout(home: string, env: Record<string, string | undefined> = process.env): string[] {
+  return withBrainLockSync(home, () => logoutLocked(home, env), { what: "signing out" })
+}
+
+function logoutLocked(home: string, env: Record<string, string | undefined>): string[] {
   const had = hasKey(home)
   rmSync(keyPath(home), { force: true })
   const s = loadState(home)
@@ -575,6 +592,8 @@ export async function probeKey(home: string, c: Connector, s: GatewaySettings, f
 export interface Result {
   ok: boolean
   lines: string[]
+  /** connect: the settings the tool was connected with. */
+  settings?: GatewaySettings
 }
 
 export function installedHere(c: Connector, home: string, env: Record<string, string | undefined>): boolean {
@@ -583,103 +602,219 @@ export function installedHere(c: Connector, home: string, env: Record<string, st
   return existsSync(f) || (resolve(dirname(f)) !== resolve(home) && existsSync(dirname(f))) || c.probe.some((p) => existsSync(join(home, p)))
 }
 
+/** Whether a tool is on the gateway now, read from its files (gateway.json alone can be wrong after a hand edit). */
+export interface Connection {
+  /** brain's values are all in the tool's files, some of them, or none (or brain never connected it). */
+  state: "connected" | "partial" | "not-connected"
+  /** The settings it was connected with; undefined when an older brain connected it and they cannot be told. */
+  settings?: GatewaySettings
+  /** What no longer holds brain's value, when it is not all there. */
+  why?: string
+  /** The values brain set that the files no longer hold (JSON), to tell which part was changed. */
+  changed?: string[]
+}
+
+/** Every string in a value (and every key of an object in it). */
+const stringsOf = (v: unknown): string[] =>
+  typeof v === "string" ? [v] : Array.isArray(v) ? v.flatMap(stringsOf) : v && typeof v === "object" ? Object.entries(v).flatMap(([k, x]) => [k, ...stringsOf(x)]) : []
+
+/**
+ * The settings a tool was connected with. Brains before 0.1.4 kept only the last connect's settings (for every tool): those
+ * are this tool's only when it was the last one connected. Otherwise they are read back from what connect wrote in the
+ * tool's files: the gateway address and route, the model, and whether the context-editing header is there.
+ */
+function settingsOf(st: State, id: string, values: unknown[]): GatewaySettings | undefined {
+  const rec = st.tools[id]
+  if (!rec) return undefined
+  if (rec.settings) return rec.settings
+  const newest = Object.entries(st.tools).sort((a, b) => (b[1].at ?? "").localeCompare(a[1].at ?? ""))[0]?.[0]
+  if (newest === id && st.settings) return st.settings
+  let url: string | undefined
+  let route: string | undefined
+  let model: string | undefined
+  let edit = false
+  for (const t of values.flatMap(stringsOf)) {
+    if (t.includes(EDIT_HEADER)) edit = true
+    model ??= Object.keys(MODEL_NAMES).find((m) => t === m || t.endsWith(`/${m}`))
+    const m = /^(https?:\/\/\S+?)\/([a-z0-9-]{1,40})(?:\/v1)?\/?$/.exec(t)
+    if (m && !url) {
+      url = m[1]
+      route = m[2]
+    }
+  }
+  return url && route && model ? { url, route, model, contextEdit: edit } : undefined
+}
+
+export function connectionState(home: string, toolId: string, env: Env = process.env): Connection {
+  const c = connectorFor(toolId)
+  if (!c) return { state: "not-connected" }
+  const st = loadState(home)
+  const rec = st.tools[c.id]
+  if (!rec) return { state: "not-connected" }
+  const codecs = codecsOf(c, home, st, env)
+  const docs = new Map<string, Doc | { error: string }>()
+  let held = 0
+  let first: string | undefined
+  const changed: string[] = []
+  // What connect wrote: its recorded values, and for entries holding the key, what the file has (the key itself is never kept).
+  const written: unknown[] = []
+  for (const x of rec.changes) {
+    if (!docs.has(x.file)) docs.set(x.file, load(x.format, x.file, codecs.get(x.file)))
+    const d = docs.get(x.file)!
+    const current = "error" in d ? undefined : getKey(d, x.key)
+    const secret = x.after === "(contains the key)"
+    const ours = !("error" in d) && (secret ? current !== undefined : same(current, x.after))
+    written.push(secret ? current : x.after)
+    if (ours) held++
+    else {
+      first ??= `${basename(x.file)}: ${x.key.replace(/\//g, ".")}`
+      changed.push(JSON.stringify(x.after))
+    }
+  }
+  const settings = settingsOf(st, c.id, written)
+  const withSettings = settings ? { settings } : {}
+  if (held === rec.changes.length) return { state: "connected", ...withSettings }
+  if (held === 0) return { state: "not-connected", ...withSettings, why: `brain's settings are no longer in ${c.label}'s files (changed by hand?)`, changed }
+  return { state: "partial", ...withSettings, why: `${first} changed since brain connected it`, changed }
+}
+
 export async function connect(
   home: string,
   toolId: string,
-  o: { settings?: Partial<GatewaySettings>; dryRun?: boolean; probe?: boolean; env?: Record<string, string | undefined>; fetchImpl?: typeof fetch } = {},
+  o: {
+    settings?: Partial<GatewaySettings>
+    dryRun?: boolean
+    probe?: boolean
+    env?: Record<string, string | undefined>
+    fetchImpl?: typeof fetch
+    /** Where a flag leaves the model or context editing open, use the ones saved for this tool with `brain settings`. */
+    usePrefs?: boolean
+    /** Called after the files are written, still under the brain lock, with the settings used (to record them). */
+    onWritten?: (s: GatewaySettings) => void
+  } = {},
 ): Promise<Result> {
   const env = o.env ?? process.env
   const c = connectorFor(toolId)
   if (!c) return { ok: false, lines: [`unknown tool "${toolId}"; \`brain gateway tools\` lists the ones that can be connected`] }
   if (!hasKey(home) && !o.dryRun) return { ok: false, lines: ["not signed in to the gateway yet: run `brain gateway login`"] }
-  const st = loadState(home)
-  const s: GatewaySettings = {
-    url: o.settings?.url ?? st.settings?.url ?? DEFAULT_URL,
-    route: o.settings?.route ?? st.settings?.route ?? DEFAULT_ROUTE,
-    model: o.settings?.model !== undefined ? modelId(o.settings.model) : (st.settings?.model ?? DEFAULT_MODEL),
-    contextEdit: o.settings?.contextEdit ?? st.settings?.contextEdit ?? true,
-  }
-  if (!/^https?:\/\/[^\s]+$/.test(s.url) || (/^http:/.test(s.url) && !/^http:\/\/(127\.0\.0\.1|localhost)(:|\/|$)/.test(s.url))) return { ok: false, lines: ["--url must be https:// (http:// only for a gateway on this machine)"] }
-  if (!/^[a-z0-9-]{1,40}$/.test(s.route)) return { ok: false, lines: ["--route must be a gateway route name such as flash or pro"] }
-  if (!/^[\w.:/-]{1,80}$/.test(s.model)) return { ok: false, lines: ["--model must be pro, flash or a plain model name"] }
+  // The settings to connect with, from the flags, then (with usePrefs) what is saved for this tool, then the last connect's.
+  // Worked out again inside the lock: another brain may have changed them while the key was checked.
+  const resolveSettings = (st: State): GatewaySettings | { why: string } => {
+    const given = o.settings ?? {}
+    const prefs = o.usePrefs ? toolGatewayPrefs(home, c.id) : {}
+    // With --route, a saved model is used only when neither is auto (the auto model and the auto route go together).
+    const model = given.model ?? (prefs.model !== undefined && (given.route === undefined || (given.route !== AUTO_ROUTE && prefs.model !== "auto")) ? prefs.model : undefined)
+    // --model auto goes with the auto route (and back to flash after it): common.ts routeAndModel.
+    const rm = routeAndModel({ route: given.route, model }, st.settings ?? {})
+    if ("why" in rm) return rm
+    const s: GatewaySettings = { url: given.url ?? st.settings?.url ?? DEFAULT_URL, route: rm.route, model: rm.model, contextEdit: given.contextEdit ?? prefs.contextEdit ?? st.settings?.contextEdit ?? true }
+    if (!/^https?:\/\/[^\s]+$/.test(s.url) || (/^http:/.test(s.url) && !/^http:\/\/(127\.0\.0\.1|localhost)(:|\/|$)/.test(s.url))) return { why: "--url must be https:// (http:// only for a gateway on this machine)" }
+    if (!/^[a-z0-9-]{1,40}$/.test(s.route)) return { why: "--route must be a gateway route name such as flash or pro" }
+    if (!/^[\w.:/-]{1,80}$/.test(s.model)) return { why: "--model must be pro, flash, auto or a plain model name" }
+    return s
+  }
+  const first = resolveSettings(loadState(home))
+  if ("why" in first) return { ok: false, lines: [first.why] }
+  const checked: GatewaySettings = first
   const main = c.file(home, env)
   if (!installedHere(c, home, env)) return { ok: false, lines: [`${c.label} has not been run on this machine (nothing at ${main}); run it once, then connect it`] }
   let limit: string | undefined
-  if (o.probe !== false && !o.dryRun) {
-    const p = await probeKey(home, c, s, o.fetchImpl)
+  const probed = o.probe !== false && !o.dryRun
+  if (probed) {
+    const p = await probeKey(home, c, checked, o.fetchImpl)
     limit = p.limit
-    if (p.verdict === "rejected") return { ok: false, lines: [`the gateway at ${routeUrl(s)} refused the key the way ${c.label} sends it (${c.authHeader}); nothing was changed`] }
-    if (p.verdict === "unreachable") return { ok: false, lines: [`could not reach ${routeUrl(s)}; nothing was changed (pass --no-probe to connect anyway)`] }
-  }
-  // Read and check every file first: nothing is written unless all of them can be changed.
-  const edits = c.edits(home, s, env)
-  const docs: Array<{ e: FileEdit; d: Doc }> = []
-  for (const e of edits) {
-    const d = load(e.format, e.path, e.codec)
-    if ("error" in d) return { ok: false, lines: [`${e.path}: ${d.error}; nothing was changed`] }
-    docs.push({ e, d })
-  }
-  const prior = st.tools[c.id]?.changes ?? []
-  const changes: Change[] = []
-  const shown: string[] = []
-  try {
-    for (const { e, d } of docs) {
-      for (const [key, after] of Object.entries(e.values)) {
-        const current = getKey(d, key)
-        // A reconnect keeps the value from before the FIRST connect, so disconnect still restores the person's own.
-        const was = prior.find((x) => x.file === e.path && x.key === key)
-        const secret = isSecret(e, key)
-        changes.push({ file: e.path, format: e.format, key, before: was ? was.before : current, after: secret ? "(contains the key)" : after })
-        if (!same(current, after)) setKey(d, key, after)
-        shown.push(`  ${basename(e.path)}: ${key.replace(/\//g, ".")} = ${secret ? "(gateway settings and key)" : shownValue(after)}`)
-      }
-      // A key an earlier connect set that this one no longer wants (--no-context-edit after a connect with it): put it back now.
-      for (const x of prior) {
-        if (x.file !== e.path || x.key in e.values) continue
-        const current = getKey(d, x.key)
-        if (x.after === "(contains the key)" ? current !== undefined : same(current, x.after)) setKey(d, x.key, x.before)
+    if (p.verdict === "rejected") return { ok: false, lines: [`the gateway at ${routeUrl(checked)} refused the key the way ${c.label} sends it (${c.authHeader}); nothing was changed`] }
+    if (p.verdict === "unreachable") return { ok: false, lines: [`could not reach ${routeUrl(checked)}; nothing was changed (pass --no-probe to connect anyway)`] }
+  }
+  // Read, change and write under the brain lock (the network check above is done before taking it), from the state
+  // as it is now: another brain may have changed it while the key was checked.
+  const write = (): Result => {
+    const st = loadState(home)
+    // Signed out while the key was checked: nothing to put in the tool's files.
+    if (!o.dryRun && !hasKey(home)) return { ok: false, lines: ["not signed in to the gateway any more (signed out meanwhile); nothing was changed"] }
+    const fresh = resolveSettings(st)
+    if ("why" in fresh) return { ok: false, lines: [fresh.why] }
+    if (probed && routeUrl(fresh) !== routeUrl(checked)) return { ok: false, lines: [`the gateway address changed to ${routeUrl(fresh)} while the key was checked at ${routeUrl(checked)}; nothing was changed: run it again`] }
+    const s = fresh
+    // Read and check every file first: nothing is written unless all of them can be changed.
+    const edits = c.edits(home, s, env)
+    const docs: Array<{ e: FileEdit; d: Doc }> = []
+    for (const e of edits) {
+      const d = load(e.format, e.path, e.codec)
+      if ("error" in d) return { ok: false, lines: [`${e.path}: ${d.error}; nothing was changed`] }
+      docs.push({ e, d })
+    }
+    const prior = st.tools[c.id]?.changes ?? []
+    const changes: Change[] = []
+    const shown: string[] = []
+    try {
+      for (const { e, d } of docs) {
+        for (const [key, after] of Object.entries(e.values)) {
+          const current = getKey(d, key)
+          // A reconnect keeps the value from before the FIRST connect, so disconnect still restores the person's own.
+          const was = prior.find((x) => x.file === e.path && x.key === key)
+          const secret = isSecret(e, key)
+          changes.push({ file: e.path, format: e.format, key, before: was ? was.before : current, after: secret ? "(contains the key)" : after })
+          if (!same(current, after)) setKey(d, key, after)
+          shown.push(`  ${basename(e.path)}: ${key.replace(/\//g, ".")} = ${secret ? "(gateway settings and key)" : shownValue(after)}`)
+        }
+        // A key an earlier connect set that this one no longer wants (--no-context-edit after a connect with it): put it back now.
+        for (const x of prior) {
+          if (x.file !== e.path || x.key in e.values) continue
+          const current = getKey(d, x.key)
+          if (x.after === "(contains the key)" ? current !== undefined : same(current, x.after)) setKey(d, x.key, x.before)
+        }
       }
+    } catch (err) {
+      // A file format the connector's codec could not change after all: nothing has been written yet.
+      return { ok: false, lines: [`could not change ${c.label}'s settings (${(err as Error).message.slice(0, 200)}); nothing was changed`] }
     }
-  } catch (err) {
-    // A file format the connector's codec could not change after all: nothing has been written yet.
-    return { ok: false, lines: [`could not change ${c.label}'s settings (${(err as Error).message.slice(0, 200)}); nothing was changed`] }
-  }
-  const named = MODEL_NAMES[s.model] ? [`note: models are shown by their 100xprompt names; the files get the gateway's id for ${modelName(s.model)}`] : []
-  if (o.dryRun) return { ok: true, lines: [`would change:`, ...shown, ...named, ...c.notes.map((n) => `note: ${n}`)] }
-  const created = new Set(st.tools[c.id]?.created ?? [])
-  for (const { e } of docs) if (!existsSync(e.path)) created.add(e.path)
-  // Folders connect has to create (Goose's custom_providers/), so disconnect can take them away again when they are empty.
-  const createdDirs = new Set(st.tools[c.id]?.createdDirs ?? [])
-  for (const { e } of docs) for (let dir = dirname(e.path); !existsSync(dir) && dir.startsWith(`${resolve(home)}/`); dir = dirname(dir)) createdDirs.add(dir)
-  // A file that is made private (it gets the key) goes back to the mode it had when disconnect gives it back.
-  const modes: Record<string, number> = { ...(st.tools[c.id]?.modes ?? {}) }
-  for (const { e } of docs) {
-    if (!e.holdsKey || !existsSync(e.path) || modes[e.path] !== undefined) continue
+    const named = MODEL_NAMES[s.model] ? [`note: models are shown by their 100xprompt names; the files get the gateway's id for ${modelName(s.model)}`] : []
+    if (o.dryRun) return { ok: true, lines: [`would change:`, ...shown, ...named, ...c.notes.map((n) => `note: ${n}`)] }
+    const created = new Set(st.tools[c.id]?.created ?? [])
+    for (const { e } of docs) if (!existsSync(e.path)) created.add(e.path)
+    // Folders connect has to create (Goose's custom_providers/), so disconnect can take them away again when they are empty.
+    const createdDirs = new Set(st.tools[c.id]?.createdDirs ?? [])
+    for (const { e } of docs) for (let dir = dirname(e.path); !existsSync(dir) && dir.startsWith(`${resolve(home)}/`); dir = dirname(dir)) createdDirs.add(dir)
+    // A file that is made private (it gets the key) goes back to the mode it had when disconnect gives it back.
+    const modes: Record<string, number> = { ...(st.tools[c.id]?.modes ?? {}) }
+    for (const { e } of docs) {
+      if (!e.holdsKey || !existsSync(e.path) || modes[e.path] !== undefined) continue
+      try {
+        modes[e.path] = statSync(e.path).mode & 0o777
+      } catch {}
+    }
+    const first = !st.tools[c.id]
+    for (const { e, d } of docs) writeToolFile(home, c.id, e.path, render(d), e.holdsKey ? 0o600 : undefined, first)
+    st.settings = s
+    st.tools[c.id] = { at: new Date().toISOString(), changes, ...(created.size ? { created: [...created] } : {}), ...(createdDirs.size ? { createdDirs: [...createdDirs] } : {}), ...(Object.keys(modes).length ? { modes } : {}), settings: s }
+    saveState(home, st)
     try {
-      modes[e.path] = statSync(e.path).mode & 0o777
+      o.onWritten?.(s)
     } catch {}
+    return {
+      ok: true,
+      settings: s,
+      lines: [
+        `connected ${c.label} to ${routeUrl(s)} (${modelName(s.model)}${s.contextEdit ? ", context editing on" : ""})`,
+        ...(limit ? [`warning: the gateway accepts the key, but this account cannot use it right now: ${limit}`, `warning: ${c.label} will get that error on every request until the limit resets (or brain gateway disconnect --tool ${c.id} puts it back).`] : []),
+        "changed:",
+        ...shown,
+        ...c.notes.map((n) => `note: ${n}`),
+        `undo: brain gateway disconnect --tool ${c.id}`,
+      ],
+    }
   }
-  const first = !st.tools[c.id]
-  for (const { e, d } of docs) writeToolFile(home, c.id, e.path, render(d), e.holdsKey ? 0o600 : undefined, first)
-  st.settings = s
-  st.tools[c.id] = { at: new Date().toISOString(), changes, ...(created.size ? { created: [...created] } : {}), ...(createdDirs.size ? { createdDirs: [...createdDirs] } : {}), ...(Object.keys(modes).length ? { modes } : {}) }
-  saveState(home, st)
-  return {
-    ok: true,
-    lines: [
-      `connected ${c.label} to ${routeUrl(s)} (${modelName(s.model)}${s.contextEdit ? ", context editing on" : ""})`,
-      ...(limit ? [`warning: the gateway accepts the key, but this account cannot use it right now: ${limit}`, `warning: ${c.label} will get that error on every request until the limit resets (or brain gateway disconnect --tool ${c.id} puts it back).`] : []),
-      "changed:",
-      ...shown,
-      ...c.notes.map((n) => `note: ${n}`),
-      `undo: brain gateway disconnect --tool ${c.id}`,
-    ],
-  }
+  return o.dryRun ? write() : withBrainLockSync(home, write, { what: `connecting ${c.label}` })
 }
 
 export function disconnect(home: string, toolId: string, o: { dryRun?: boolean; env?: Env } = {}): Result {
   const c = connectorFor(toolId)
   if (!c) return { ok: false, lines: [`unknown tool "${toolId}"`] }
+  return o.dryRun ? disconnectLocked(home, c, o) : withBrainLockSync(home, () => disconnectLocked(home, c, o), { what: `disconnecting ${c.label}` })
+}
+
+function disconnectLocked(home: string, c: Connector, o: { dryRun?: boolean; env?: Env }): Result {
   const st = loadState(home)
   const rec = st.tools[c.id]
   if (!rec) return { ok: true, lines: [`${c.label} is not connected by brain; nothing to undo`] }
@@ -744,11 +879,12 @@ export function status(home: string, env: Record<string, string | undefined> = p
 
 // ---- the command --------------------------------------------------------------------------------------------------------
 
+
 const USAGE = [
   "brain gateway login [--no-browser]        sign in to 100xprompt in your browser, as `100xprompt auth login` does",
   "brain gateway login --key-env VAR | --from-cli   take the key from VAR (scripts, CI) or from the 100xprompt CLI's sign-in",
   "brain gateway logout                      forget the key",
-  "brain gateway connect --tool <id> [--model pro|flash] [--route flash] [--url https://...] [--no-context-edit | --context-edit] [--dry-run] [--no-probe]",
+  "brain gateway connect --tool <id> [--model pro|flash|auto] [--route flash] [--url https://...] [--no-context-edit | --context-edit] [--dry-run] [--no-probe]",
   "brain gateway disconnect --tool <id> [--dry-run]",
   "brain gateway status | tools",
 ]
@@ -782,6 +918,8 @@ export async function gatewayCommand(
   }
   const refreshedNote = (labels: string[]) => {
     if (labels.length) io.out(`the new key also replaced the old one in ${labels.join(" and ")}'s own config`)
+    // Signed in but not paired: the one step that puts this computer's settings in the dashboard.
+    if (!readMachineToken(home)) io.out("to see this computer's settings in your dashboard: brain pair")
   }
   // The browser sign-in, with a hidden paste prompt when there is a terminal to ask in.
   const browserLogin = async () => {
@@ -814,25 +952,43 @@ export async function gatewayCommand(
         io.out(`usage: ${USAGE[sub === "connect" ? 3 : 4]}`)
         return 2
       }
-      if (sub === "disconnect") return print(disconnect(home, tool, { dryRun: has("dry-run"), env }))
+      // What connect and disconnect do is recorded as this computer's settings (`brain settings` shows who set what),
+      // inside the same hold of the brain lock as the change itself. Loaded here, before connecting: the settings modules
+      // import this one.
+      const { recordConnected } = await import("../settings/apply.ts")
+      if (sub === "disconnect") {
+        if (has("dry-run")) return print(disconnect(home, tool, { dryRun: true, env }))
+        const r = withBrainLockSync(
+          home,
+          () => {
+            const d = disconnect(home, tool, { env })
+            if (d.ok && connectorFor(tool)) recordConnected(home, connectorFor(tool)!.id, undefined)
+            return d
+          },
+          { what: "disconnecting a tool" },
+        )
+        return print(r)
+      }
       const settings = { ...(flag("url") ? { url: flag("url")! } : {}), ...(flag("route") ? { route: flag("route")! } : {}), ...(flag("model") ? { model: flag("model")! } : {}), ...(has("no-context-edit") ? { contextEdit: false } : has("context-edit") ? { contextEdit: true } : {}) }
       // Not signed in yet: sign in first, as the 100xprompt CLI would, then connect. Everything that can be checked here
       // (the tool, its files, the flags) is checked first, so nobody signs in for a connect that was bound to fail.
       if (!hasKey(home) && !has("dry-run")) {
-        const pre = await connect(home, tool, { settings, dryRun: true, env })
+        const pre = await connect(home, tool, { settings, dryRun: true, env, usePrefs: true })
         if (!pre.ok) return print(pre)
         io.out("not signed in to the gateway yet; signing in first")
         if (!(await browserLogin())) return 1
       }
-      return print(
-        await connect(home, tool, {
-          settings,
-          dryRun: has("dry-run"),
-          probe: !has("no-probe"),
-          env,
-          ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}),
-        }),
-      )
+      const id = connectorFor(tool)?.id
+      const r = await connect(home, tool, {
+        settings,
+        dryRun: has("dry-run"),
+        probe: !has("no-probe"),
+        env,
+        usePrefs: true,
+        ...(id ? { onWritten: (s: GatewaySettings) => recordConnected(home, id, s) } : {}),
+        ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}),
+      })
+      return print(r)
     }
     case "status":
       status(home, env).forEach((l) => io.out(l))

package/src/gateway/connectors/aider.ts

@@ -29,15 +29,12 @@
 //   Docs: https://aider.chat/docs/config/adv-model-settings.html (extra_params, extra_headers, metadata file),
 //         https://aider.chat/docs/llms/openai-compat.html (openai/<model> against an OpenAI-compatible API).
 import { join } from "node:path"
-import { type Codec, type Connector, EDIT_HEADER, type Json, readKey, routeUrl, yamlTopLevel } from "../common.ts"
+import { type Codec, type Connector, EDIT_HEADER, type Json, limitsFor, readKey, routeUrl, yamlTopLevel } from "../common.ts"
 
 /** The one key of brain's own entry in the settings list and in the metadata object. */
 export const AIDER_ENTRY = "brain-gateway"
 /** Marks brain's entry in each file (a YAML comment, a JSON5 comment), so it is told apart from the person's own. */
 export const AIDER_MARK = "100xprompt gateway, added by brain gateway connect --tool aider"
-/** What Aider is told about the gateway's model: the Gemini Flash models' window and output limit. */
-const CONTEXT = 1_048_576
-const OUTPUT = 65_536
 
 const esc = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
 
@@ -337,7 +334,8 @@ export const connectors: Connector[] = [
           path: join(home, ".aider.model.metadata.json"),
           format: "custom",
           codec: modelMetadataJson,
-          values: { [AIDER_ENTRY]: { [model]: { max_input_tokens: CONTEXT, max_output_tokens: OUTPUT, max_tokens: OUTPUT, litellm_provider: "openai", mode: "chat" } } },
+          // The Gemini Flash models' window and output limit, or for 100xprompt Auto what every model it may serve takes.
+          values: { [AIDER_ENTRY]: { [model]: { max_input_tokens: limitsFor(s).context, max_output_tokens: limitsFor(s).output, max_tokens: limitsFor(s).output, litellm_provider: "openai", mode: "chat" } } },
         },
         {
           path: join(home, ".aider.conf.yml"),

package/src/gateway/connectors/cline-sdk.ts

@@ -26,12 +26,9 @@
 // not followed; CLINE_DIR and CLINE_DATA_DIR are, when they exist. The VS Code extension (id `cline`, see cline.ts) shares
 // ~/.cline/data but chooses its provider from its own globalState.json, so this connector does not change it.
 import { join } from "node:path"
-import { type Connector, dirFromEnv, EDIT_HEADER, type Env, modelName, readKey, routeUrl } from "../common.ts"
+import { type Connector, dirFromEnv, EDIT_HEADER, type Env, limitsFor, modelName, readKey, routeUrl } from "../common.ts"
 
 const ID = "brain-gateway"
-/** Gemini 3.x Flash, which the gateway's models are: a 1M-token window, 64K out. */
-const CONTEXT_WINDOW = 1_048_576
-const MAX_OUTPUT = 65_536
 /** Cline requires an ISO date here; a fixed one keeps edits() free of side effects (Cline sets its own when it saves). */
 const UPDATED_AT = "2026-01-01T00:00:00.000Z"
 
@@ -56,7 +53,7 @@ export const connectors: Connector[] = [
             version: 1,
             [`providers/${ID}`]: {
               provider: { name: "100xprompt gateway", baseUrl, defaultModelId: s.model, protocol: "openai-chat", client: "openai-compatible", capabilities: ["tools", "streaming"] },
-              models: { [s.model]: { id: s.model, name: modelName(s.model), contextWindow: CONTEXT_WINDOW, maxTokens: MAX_OUTPUT, capabilities: ["tools", "streaming", "images"] } },
+              models: { [s.model]: { id: s.model, name: modelName(s.model), contextWindow: limitsFor(s).context, maxTokens: limitsFor(s).output, capabilities: ["tools", "streaming", "images"] } },
             },
           },
         },