@100xprompt/brain 0.1.3 → 0.1.5

package/src/gateway/connect.ts

@@ -15,9 +15,10 @@
 // stores the key that comes back in <home>/.brain/gateway.key (0600). For scripts and CI, --key-env VAR takes it from an
 // environment variable instead; --from-cli reuses the 100xprompt CLI's sign-in. It is never printed. Tools read it at run time where they can (Claude Code's apiKeyHelper,
 // OpenCode's {file:...}); Codex and Gemini CLI can only take it in their own config, which is then made private (0600).
-import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, writeFileSync } from "node:fs"
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmdirSync, rmSync, statSync } from "node:fs"
 import { basename, dirname, join, resolve } from "node:path"
 import {
+  AUTO_ROUTE,
   brainDir,
   type Codec,
   type Connector,
@@ -44,6 +45,10 @@ import {
 } from "./common.ts"
 import { EXTRA_CONNECTORS } from "./connectors/index.ts"
 import { askHidden, browserSignIn, type SignInDeps } from "./signin.ts"
+import { writeAtomic } from "../fsutil.ts"
+import { withBrainLockSync } from "../lock.ts"
+import { toolGatewayPrefs } from "../settings/values.ts"
+import { readMachineToken } from "../dashboard/state.ts"
 
 export {
   AUTO_MODEL,
@@ -78,7 +83,17 @@ interface State {
   keySource?: string
   /** Who signed in (from the sign-in page), shown by status. */
   email?: string
-  tools: Record<string, { at: string; changes: Change[]; created?: string[]; createdDirs?: string[]; modes?: Record<string, number> }>
+  tools: Record<string, ToolRecord>
+}
+
+interface ToolRecord {
+  at: string
+  changes: Change[]
+  created?: string[]
+  createdDirs?: string[]
+  modes?: Record<string, number>
+  /** The settings this tool was connected with (older records have none: `settings` above is the last connect's). */
+  settings?: GatewaySettings
 }
 
 function loadState(home: string): State {
@@ -97,11 +112,7 @@ function saveState(home: string, s: State) {
 
 /** Atomic write with mode 0600 (the key and the record of what was changed). */
 function writePrivate(path: string, text: string) {
-  const tmp = `${path}.brain-tmp`
-  rmSync(tmp, { force: true })
-  writeFileSync(tmp, text, { mode: 0o600 })
-  chmodSync(tmp, 0o600)
-  renameSync(tmp, path)
+  writeAtomic(path, text, 0o600)
 }
 
 /**
@@ -124,11 +135,7 @@ function writeToolFile(home: string, tool: string, path: string, text: string, m
       keep = statSync(real).mode & 0o777
     } catch {}
   }
-  const tmp = `${real}.brain-tmp`
-  rmSync(tmp, { force: true })
-  writeFileSync(tmp, text, keep === undefined ? {} : { mode: keep })
-  if (keep !== undefined) chmodSync(tmp, keep)
-  renameSync(tmp, real)
+  writeAtomic(real, text, keep)
 }
 
 // ---- the key ----------------------------------------------------------------------------------------------------------
@@ -169,6 +176,10 @@ export function hasKey(home: string): boolean {
  * on the old one while status names the new. Returns the tools whose copy was replaced.
  */
 export function storeKey(home: string, key: string, source: string, email?: string, env: Env = process.env): string[] {
+  return withBrainLockSync(home, () => storeKeyLocked(home, key, source, email, env), { what: "storing the gateway key" })
+}
+
+function storeKeyLocked(home: string, key: string, source: string, email: string | undefined, env: Env): string[] {
   const old = readKey(home)
   mkdirSync(brainDir(home), { recursive: true, mode: 0o700 })
   writePrivate(keyPath(home), `${key}\n`)
@@ -253,6 +264,10 @@ export async function signIn(home: string, d: SignInDeps, env: Env = process.env
 
 /** Forgets the key. Tools still connected stop working until the next login, which is said. */
 export function logout(home: string, env: Record<string, string | undefined> = process.env): string[] {
+  return withBrainLockSync(home, () => logoutLocked(home, env), { what: "signing out" })
+}
+
+function logoutLocked(home: string, env: Record<string, string | undefined>): string[] {
   const had = hasKey(home)
   rmSync(keyPath(home), { force: true })
   const s = loadState(home)
@@ -577,6 +592,8 @@ export async function probeKey(home: string, c: Connector, s: GatewaySettings, f
 export interface Result {
   ok: boolean
   lines: string[]
+  /** connect: the settings the tool was connected with. */
+  settings?: GatewaySettings
 }
 
 export function installedHere(c: Connector, home: string, env: Record<string, string | undefined>): boolean {
@@ -585,106 +602,219 @@ export function installedHere(c: Connector, home: string, env: Record<string, st
   return existsSync(f) || (resolve(dirname(f)) !== resolve(home) && existsSync(dirname(f))) || c.probe.some((p) => existsSync(join(home, p)))
 }
 
+/** Whether a tool is on the gateway now, read from its files (gateway.json alone can be wrong after a hand edit). */
+export interface Connection {
+  /** brain's values are all in the tool's files, some of them, or none (or brain never connected it). */
+  state: "connected" | "partial" | "not-connected"
+  /** The settings it was connected with; undefined when an older brain connected it and they cannot be told. */
+  settings?: GatewaySettings
+  /** What no longer holds brain's value, when it is not all there. */
+  why?: string
+  /** The values brain set that the files no longer hold (JSON), to tell which part was changed. */
+  changed?: string[]
+}
+
+/** Every string in a value (and every key of an object in it). */
+const stringsOf = (v: unknown): string[] =>
+  typeof v === "string" ? [v] : Array.isArray(v) ? v.flatMap(stringsOf) : v && typeof v === "object" ? Object.entries(v).flatMap(([k, x]) => [k, ...stringsOf(x)]) : []
+
+/**
+ * The settings a tool was connected with. Brains before 0.1.4 kept only the last connect's settings (for every tool): those
+ * are this tool's only when it was the last one connected. Otherwise they are read back from what connect wrote in the
+ * tool's files: the gateway address and route, the model, and whether the context-editing header is there.
+ */
+function settingsOf(st: State, id: string, values: unknown[]): GatewaySettings | undefined {
+  const rec = st.tools[id]
+  if (!rec) return undefined
+  if (rec.settings) return rec.settings
+  const newest = Object.entries(st.tools).sort((a, b) => (b[1].at ?? "").localeCompare(a[1].at ?? ""))[0]?.[0]
+  if (newest === id && st.settings) return st.settings
+  let url: string | undefined
+  let route: string | undefined
+  let model: string | undefined
+  let edit = false
+  for (const t of values.flatMap(stringsOf)) {
+    if (t.includes(EDIT_HEADER)) edit = true
+    model ??= Object.keys(MODEL_NAMES).find((m) => t === m || t.endsWith(`/${m}`))
+    const m = /^(https?:\/\/\S+?)\/([a-z0-9-]{1,40})(?:\/v1)?\/?$/.exec(t)
+    if (m && !url) {
+      url = m[1]
+      route = m[2]
+    }
+  }
+  return url && route && model ? { url, route, model, contextEdit: edit } : undefined
+}
+
+export function connectionState(home: string, toolId: string, env: Env = process.env): Connection {
+  const c = connectorFor(toolId)
+  if (!c) return { state: "not-connected" }
+  const st = loadState(home)
+  const rec = st.tools[c.id]
+  if (!rec) return { state: "not-connected" }
+  const codecs = codecsOf(c, home, st, env)
+  const docs = new Map<string, Doc | { error: string }>()
+  let held = 0
+  let first: string | undefined
+  const changed: string[] = []
+  // What connect wrote: its recorded values, and for entries holding the key, what the file has (the key itself is never kept).
+  const written: unknown[] = []
+  for (const x of rec.changes) {
+    if (!docs.has(x.file)) docs.set(x.file, load(x.format, x.file, codecs.get(x.file)))
+    const d = docs.get(x.file)!
+    const current = "error" in d ? undefined : getKey(d, x.key)
+    const secret = x.after === "(contains the key)"
+    const ours = !("error" in d) && (secret ? current !== undefined : same(current, x.after))
+    written.push(secret ? current : x.after)
+    if (ours) held++
+    else {
+      first ??= `${basename(x.file)}: ${x.key.replace(/\//g, ".")}`
+      changed.push(JSON.stringify(x.after))
+    }
+  }
+  const settings = settingsOf(st, c.id, written)
+  const withSettings = settings ? { settings } : {}
+  if (held === rec.changes.length) return { state: "connected", ...withSettings }
+  if (held === 0) return { state: "not-connected", ...withSettings, why: `brain's settings are no longer in ${c.label}'s files (changed by hand?)`, changed }
+  return { state: "partial", ...withSettings, why: `${first} changed since brain connected it`, changed }
+}
+
 export async function connect(
   home: string,
   toolId: string,
-  o: { settings?: Partial<GatewaySettings>; dryRun?: boolean; probe?: boolean; env?: Record<string, string | undefined>; fetchImpl?: typeof fetch } = {},
+  o: {
+    settings?: Partial<GatewaySettings>
+    dryRun?: boolean
+    probe?: boolean
+    env?: Record<string, string | undefined>
+    fetchImpl?: typeof fetch
+    /** Where a flag leaves the model or context editing open, use the ones saved for this tool with `brain settings`. */
+    usePrefs?: boolean
+    /** Called after the files are written, still under the brain lock, with the settings used (to record them). */
+    onWritten?: (s: GatewaySettings) => void
+  } = {},
 ): Promise<Result> {
   const env = o.env ?? process.env
   const c = connectorFor(toolId)
   if (!c) return { ok: false, lines: [`unknown tool "${toolId}"; \`brain gateway tools\` lists the ones that can be connected`] }
   if (!hasKey(home) && !o.dryRun) return { ok: false, lines: ["not signed in to the gateway yet: run `brain gateway login`"] }
-  const st = loadState(home)
-  // --model auto goes with the auto route (and back to flash after it): common.ts routeAndModel.
-  const rm = routeAndModel({ route: o.settings?.route, model: o.settings?.model }, st.settings ?? {})
-  if ("why" in rm) return { ok: false, lines: [rm.why] }
-  const s: GatewaySettings = {
-    url: o.settings?.url ?? st.settings?.url ?? DEFAULT_URL,
-    route: rm.route,
-    model: rm.model,
-    contextEdit: o.settings?.contextEdit ?? st.settings?.contextEdit ?? true,
-  }
-  if (!/^https?:\/\/[^\s]+$/.test(s.url) || (/^http:/.test(s.url) && !/^http:\/\/(127\.0\.0\.1|localhost)(:|\/|$)/.test(s.url))) return { ok: false, lines: ["--url must be https:// (http:// only for a gateway on this machine)"] }
-  if (!/^[a-z0-9-]{1,40}$/.test(s.route)) return { ok: false, lines: ["--route must be a gateway route name such as flash or pro"] }
-  if (!/^[\w.:/-]{1,80}$/.test(s.model)) return { ok: false, lines: ["--model must be pro, flash, auto or a plain model name"] }
+  // The settings to connect with, from the flags, then (with usePrefs) what is saved for this tool, then the last connect's.
+  // Worked out again inside the lock: another brain may have changed them while the key was checked.
+  const resolveSettings = (st: State): GatewaySettings | { why: string } => {
+    const given = o.settings ?? {}
+    const prefs = o.usePrefs ? toolGatewayPrefs(home, c.id) : {}
+    // With --route, a saved model is used only when neither is auto (the auto model and the auto route go together).
+    const model = given.model ?? (prefs.model !== undefined && (given.route === undefined || (given.route !== AUTO_ROUTE && prefs.model !== "auto")) ? prefs.model : undefined)
+    // --model auto goes with the auto route (and back to flash after it): common.ts routeAndModel.
+    const rm = routeAndModel({ route: given.route, model }, st.settings ?? {})
+    if ("why" in rm) return rm
+    const s: GatewaySettings = { url: given.url ?? st.settings?.url ?? DEFAULT_URL, route: rm.route, model: rm.model, contextEdit: given.contextEdit ?? prefs.contextEdit ?? st.settings?.contextEdit ?? true }
+    if (!/^https?:\/\/[^\s]+$/.test(s.url) || (/^http:/.test(s.url) && !/^http:\/\/(127\.0\.0\.1|localhost)(:|\/|$)/.test(s.url))) return { why: "--url must be https:// (http:// only for a gateway on this machine)" }
+    if (!/^[a-z0-9-]{1,40}$/.test(s.route)) return { why: "--route must be a gateway route name such as flash or pro" }
+    if (!/^[\w.:/-]{1,80}$/.test(s.model)) return { why: "--model must be pro, flash, auto or a plain model name" }
+    return s
+  }
+  const first = resolveSettings(loadState(home))
+  if ("why" in first) return { ok: false, lines: [first.why] }
+  const checked: GatewaySettings = first
   const main = c.file(home, env)
   if (!installedHere(c, home, env)) return { ok: false, lines: [`${c.label} has not been run on this machine (nothing at ${main}); run it once, then connect it`] }
   let limit: string | undefined
-  if (o.probe !== false && !o.dryRun) {
-    const p = await probeKey(home, c, s, o.fetchImpl)
+  const probed = o.probe !== false && !o.dryRun
+  if (probed) {
+    const p = await probeKey(home, c, checked, o.fetchImpl)
     limit = p.limit
-    if (p.verdict === "rejected") return { ok: false, lines: [`the gateway at ${routeUrl(s)} refused the key the way ${c.label} sends it (${c.authHeader}); nothing was changed`] }
-    if (p.verdict === "unreachable") return { ok: false, lines: [`could not reach ${routeUrl(s)}; nothing was changed (pass --no-probe to connect anyway)`] }
-  }
-  // Read and check every file first: nothing is written unless all of them can be changed.
-  const edits = c.edits(home, s, env)
-  const docs: Array<{ e: FileEdit; d: Doc }> = []
-  for (const e of edits) {
-    const d = load(e.format, e.path, e.codec)
-    if ("error" in d) return { ok: false, lines: [`${e.path}: ${d.error}; nothing was changed`] }
-    docs.push({ e, d })
-  }
-  const prior = st.tools[c.id]?.changes ?? []
-  const changes: Change[] = []
-  const shown: string[] = []
-  try {
-    for (const { e, d } of docs) {
-      for (const [key, after] of Object.entries(e.values)) {
-        const current = getKey(d, key)
-        // A reconnect keeps the value from before the FIRST connect, so disconnect still restores the person's own.
-        const was = prior.find((x) => x.file === e.path && x.key === key)
-        const secret = isSecret(e, key)
-        changes.push({ file: e.path, format: e.format, key, before: was ? was.before : current, after: secret ? "(contains the key)" : after })
-        if (!same(current, after)) setKey(d, key, after)
-        shown.push(`  ${basename(e.path)}: ${key.replace(/\//g, ".")} = ${secret ? "(gateway settings and key)" : shownValue(after)}`)
-      }
-      // A key an earlier connect set that this one no longer wants (--no-context-edit after a connect with it): put it back now.
-      for (const x of prior) {
-        if (x.file !== e.path || x.key in e.values) continue
-        const current = getKey(d, x.key)
-        if (x.after === "(contains the key)" ? current !== undefined : same(current, x.after)) setKey(d, x.key, x.before)
+    if (p.verdict === "rejected") return { ok: false, lines: [`the gateway at ${routeUrl(checked)} refused the key the way ${c.label} sends it (${c.authHeader}); nothing was changed`] }
+    if (p.verdict === "unreachable") return { ok: false, lines: [`could not reach ${routeUrl(checked)}; nothing was changed (pass --no-probe to connect anyway)`] }
+  }
+  // Read, change and write under the brain lock (the network check above is done before taking it), from the state
+  // as it is now: another brain may have changed it while the key was checked.
+  const write = (): Result => {
+    const st = loadState(home)
+    // Signed out while the key was checked: nothing to put in the tool's files.
+    if (!o.dryRun && !hasKey(home)) return { ok: false, lines: ["not signed in to the gateway any more (signed out meanwhile); nothing was changed"] }
+    const fresh = resolveSettings(st)
+    if ("why" in fresh) return { ok: false, lines: [fresh.why] }
+    if (probed && routeUrl(fresh) !== routeUrl(checked)) return { ok: false, lines: [`the gateway address changed to ${routeUrl(fresh)} while the key was checked at ${routeUrl(checked)}; nothing was changed: run it again`] }
+    const s = fresh
+    // Read and check every file first: nothing is written unless all of them can be changed.
+    const edits = c.edits(home, s, env)
+    const docs: Array<{ e: FileEdit; d: Doc }> = []
+    for (const e of edits) {
+      const d = load(e.format, e.path, e.codec)
+      if ("error" in d) return { ok: false, lines: [`${e.path}: ${d.error}; nothing was changed`] }
+      docs.push({ e, d })
+    }
+    const prior = st.tools[c.id]?.changes ?? []
+    const changes: Change[] = []
+    const shown: string[] = []
+    try {
+      for (const { e, d } of docs) {
+        for (const [key, after] of Object.entries(e.values)) {
+          const current = getKey(d, key)
+          // A reconnect keeps the value from before the FIRST connect, so disconnect still restores the person's own.
+          const was = prior.find((x) => x.file === e.path && x.key === key)
+          const secret = isSecret(e, key)
+          changes.push({ file: e.path, format: e.format, key, before: was ? was.before : current, after: secret ? "(contains the key)" : after })
+          if (!same(current, after)) setKey(d, key, after)
+          shown.push(`  ${basename(e.path)}: ${key.replace(/\//g, ".")} = ${secret ? "(gateway settings and key)" : shownValue(after)}`)
+        }
+        // A key an earlier connect set that this one no longer wants (--no-context-edit after a connect with it): put it back now.
+        for (const x of prior) {
+          if (x.file !== e.path || x.key in e.values) continue
+          const current = getKey(d, x.key)
+          if (x.after === "(contains the key)" ? current !== undefined : same(current, x.after)) setKey(d, x.key, x.before)
+        }
       }
+    } catch (err) {
+      // A file format the connector's codec could not change after all: nothing has been written yet.
+      return { ok: false, lines: [`could not change ${c.label}'s settings (${(err as Error).message.slice(0, 200)}); nothing was changed`] }
     }
-  } catch (err) {
-    // A file format the connector's codec could not change after all: nothing has been written yet.
-    return { ok: false, lines: [`could not change ${c.label}'s settings (${(err as Error).message.slice(0, 200)}); nothing was changed`] }
-  }
-  const named = MODEL_NAMES[s.model] ? [`note: models are shown by their 100xprompt names; the files get the gateway's id for ${modelName(s.model)}`] : []
-  if (o.dryRun) return { ok: true, lines: [`would change:`, ...shown, ...named, ...c.notes.map((n) => `note: ${n}`)] }
-  const created = new Set(st.tools[c.id]?.created ?? [])
-  for (const { e } of docs) if (!existsSync(e.path)) created.add(e.path)
-  // Folders connect has to create (Goose's custom_providers/), so disconnect can take them away again when they are empty.
-  const createdDirs = new Set(st.tools[c.id]?.createdDirs ?? [])
-  for (const { e } of docs) for (let dir = dirname(e.path); !existsSync(dir) && dir.startsWith(`${resolve(home)}/`); dir = dirname(dir)) createdDirs.add(dir)
-  // A file that is made private (it gets the key) goes back to the mode it had when disconnect gives it back.
-  const modes: Record<string, number> = { ...(st.tools[c.id]?.modes ?? {}) }
-  for (const { e } of docs) {
-    if (!e.holdsKey || !existsSync(e.path) || modes[e.path] !== undefined) continue
+    const named = MODEL_NAMES[s.model] ? [`note: models are shown by their 100xprompt names; the files get the gateway's id for ${modelName(s.model)}`] : []
+    if (o.dryRun) return { ok: true, lines: [`would change:`, ...shown, ...named, ...c.notes.map((n) => `note: ${n}`)] }
+    const created = new Set(st.tools[c.id]?.created ?? [])
+    for (const { e } of docs) if (!existsSync(e.path)) created.add(e.path)
+    // Folders connect has to create (Goose's custom_providers/), so disconnect can take them away again when they are empty.
+    const createdDirs = new Set(st.tools[c.id]?.createdDirs ?? [])
+    for (const { e } of docs) for (let dir = dirname(e.path); !existsSync(dir) && dir.startsWith(`${resolve(home)}/`); dir = dirname(dir)) createdDirs.add(dir)
+    // A file that is made private (it gets the key) goes back to the mode it had when disconnect gives it back.
+    const modes: Record<string, number> = { ...(st.tools[c.id]?.modes ?? {}) }
+    for (const { e } of docs) {
+      if (!e.holdsKey || !existsSync(e.path) || modes[e.path] !== undefined) continue
+      try {
+        modes[e.path] = statSync(e.path).mode & 0o777
+      } catch {}
+    }
+    const first = !st.tools[c.id]
+    for (const { e, d } of docs) writeToolFile(home, c.id, e.path, render(d), e.holdsKey ? 0o600 : undefined, first)
+    st.settings = s
+    st.tools[c.id] = { at: new Date().toISOString(), changes, ...(created.size ? { created: [...created] } : {}), ...(createdDirs.size ? { createdDirs: [...createdDirs] } : {}), ...(Object.keys(modes).length ? { modes } : {}), settings: s }
+    saveState(home, st)
     try {
-      modes[e.path] = statSync(e.path).mode & 0o777
+      o.onWritten?.(s)
     } catch {}
+    return {
+      ok: true,
+      settings: s,
+      lines: [
+        `connected ${c.label} to ${routeUrl(s)} (${modelName(s.model)}${s.contextEdit ? ", context editing on" : ""})`,
+        ...(limit ? [`warning: the gateway accepts the key, but this account cannot use it right now: ${limit}`, `warning: ${c.label} will get that error on every request until the limit resets (or brain gateway disconnect --tool ${c.id} puts it back).`] : []),
+        "changed:",
+        ...shown,
+        ...c.notes.map((n) => `note: ${n}`),
+        `undo: brain gateway disconnect --tool ${c.id}`,
+      ],
+    }
   }
-  const first = !st.tools[c.id]
-  for (const { e, d } of docs) writeToolFile(home, c.id, e.path, render(d), e.holdsKey ? 0o600 : undefined, first)
-  st.settings = s
-  st.tools[c.id] = { at: new Date().toISOString(), changes, ...(created.size ? { created: [...created] } : {}), ...(createdDirs.size ? { createdDirs: [...createdDirs] } : {}), ...(Object.keys(modes).length ? { modes } : {}) }
-  saveState(home, st)
-  return {
-    ok: true,
-    lines: [
-      `connected ${c.label} to ${routeUrl(s)} (${modelName(s.model)}${s.contextEdit ? ", context editing on" : ""})`,
-      ...(limit ? [`warning: the gateway accepts the key, but this account cannot use it right now: ${limit}`, `warning: ${c.label} will get that error on every request until the limit resets (or brain gateway disconnect --tool ${c.id} puts it back).`] : []),
-      "changed:",
-      ...shown,
-      ...c.notes.map((n) => `note: ${n}`),
-      `undo: brain gateway disconnect --tool ${c.id}`,
-    ],
-  }
+  return o.dryRun ? write() : withBrainLockSync(home, write, { what: `connecting ${c.label}` })
 }
 
 export function disconnect(home: string, toolId: string, o: { dryRun?: boolean; env?: Env } = {}): Result {
   const c = connectorFor(toolId)
   if (!c) return { ok: false, lines: [`unknown tool "${toolId}"`] }
+  return o.dryRun ? disconnectLocked(home, c, o) : withBrainLockSync(home, () => disconnectLocked(home, c, o), { what: `disconnecting ${c.label}` })
+}
+
+function disconnectLocked(home: string, c: Connector, o: { dryRun?: boolean; env?: Env }): Result {
   const st = loadState(home)
   const rec = st.tools[c.id]
   if (!rec) return { ok: true, lines: [`${c.label} is not connected by brain; nothing to undo`] }
@@ -749,6 +879,7 @@ export function status(home: string, env: Record<string, string | undefined> = p
 
 // ---- the command --------------------------------------------------------------------------------------------------------
 
+
 const USAGE = [
   "brain gateway login [--no-browser]        sign in to 100xprompt in your browser, as `100xprompt auth login` does",
   "brain gateway login --key-env VAR | --from-cli   take the key from VAR (scripts, CI) or from the 100xprompt CLI's sign-in",
@@ -787,6 +918,8 @@ export async function gatewayCommand(
   }
   const refreshedNote = (labels: string[]) => {
     if (labels.length) io.out(`the new key also replaced the old one in ${labels.join(" and ")}'s own config`)
+    // Signed in but not paired: the one step that puts this computer's settings in the dashboard.
+    if (!readMachineToken(home)) io.out("to see this computer's settings in your dashboard: brain pair")
   }
   // The browser sign-in, with a hidden paste prompt when there is a terminal to ask in.
   const browserLogin = async () => {
@@ -819,25 +952,43 @@ export async function gatewayCommand(
         io.out(`usage: ${USAGE[sub === "connect" ? 3 : 4]}`)
         return 2
       }
-      if (sub === "disconnect") return print(disconnect(home, tool, { dryRun: has("dry-run"), env }))
+      // What connect and disconnect do is recorded as this computer's settings (`brain settings` shows who set what),
+      // inside the same hold of the brain lock as the change itself. Loaded here, before connecting: the settings modules
+      // import this one.
+      const { recordConnected } = await import("../settings/apply.ts")
+      if (sub === "disconnect") {
+        if (has("dry-run")) return print(disconnect(home, tool, { dryRun: true, env }))
+        const r = withBrainLockSync(
+          home,
+          () => {
+            const d = disconnect(home, tool, { env })
+            if (d.ok && connectorFor(tool)) recordConnected(home, connectorFor(tool)!.id, undefined)
+            return d
+          },
+          { what: "disconnecting a tool" },
+        )
+        return print(r)
+      }
       const settings = { ...(flag("url") ? { url: flag("url")! } : {}), ...(flag("route") ? { route: flag("route")! } : {}), ...(flag("model") ? { model: flag("model")! } : {}), ...(has("no-context-edit") ? { contextEdit: false } : has("context-edit") ? { contextEdit: true } : {}) }
       // Not signed in yet: sign in first, as the 100xprompt CLI would, then connect. Everything that can be checked here
       // (the tool, its files, the flags) is checked first, so nobody signs in for a connect that was bound to fail.
       if (!hasKey(home) && !has("dry-run")) {
-        const pre = await connect(home, tool, { settings, dryRun: true, env })
+        const pre = await connect(home, tool, { settings, dryRun: true, env, usePrefs: true })
         if (!pre.ok) return print(pre)
         io.out("not signed in to the gateway yet; signing in first")
         if (!(await browserLogin())) return 1
       }
-      return print(
-        await connect(home, tool, {
-          settings,
-          dryRun: has("dry-run"),
-          probe: !has("no-probe"),
-          env,
-          ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}),
-        }),
-      )
+      const id = connectorFor(tool)?.id
+      const r = await connect(home, tool, {
+        settings,
+        dryRun: has("dry-run"),
+        probe: !has("no-probe"),
+        env,
+        usePrefs: true,
+        ...(id ? { onWritten: (s: GatewaySettings) => recordConnected(home, id, s) } : {}),
+        ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}),
+      })
+      return print(r)
     }
     case "status":
       status(home, env).forEach((l) => io.out(l))

package/src/gateway/connectors/hermes.ts

@@ -105,7 +105,7 @@ function section(lines: string[], name: string): Section | undefined {
   const at = lines.findIndex((l) => keyLine("", name).test(l))
   if (at < 0) return undefined
   const inline = inlineValue(lines[at]!)
-  if (inline && !/^(?:\{\s*\}|null|~)$/.test(inline)) throw new Error(`${name}: is written on one line (${inline.slice(0, 40)}), not as a section`)
+  if (inline && !/^(?:\{\s*\}|null|~)$/.test(inline)) throw new Error(`${name}: is written on one line, not as a section`)
   const end = blockEnd(lines, at)
   const first = lines.slice(at + 1, end).find((l) => !blank(l))
   const indent = first ? indentOf(first) : ""

package/src/gateway/signin.ts

@@ -118,8 +118,38 @@ export interface SignInDeps {
 
 export type SignIn = { ok: true; key: string; email?: string; via: "browser" | "code" } | { ok: false; why: string }
 
+type Took = { ok: true; key: string; email?: string } | { ok: false; why: string }
+
+/**
+ * Which browser round trip to run: the sign-in (`brain gateway login`: /auth/cli, a gateway key comes back) or pairing
+ * (`brain pair`: /auth/brain, the computer's own token comes back). Everything else (the loopback server, the state,
+ * the paste fallback) is the same.
+ */
+export interface BrowserFlow {
+  /** The command the person ran, named in the refusal page. */
+  command: string
+  /** The site's page, and what else it is told. */
+  path: string
+  params?: Record<string, string>
+  /** What a callback's token or a pasted text must be to be kept. */
+  accept(token: string): Took
+  /** Words: what the browser is opened for, the page shown when it worked, and what to paste. */
+  opening: string
+  done: (email?: string) => { title: string; body: string }
+  paste: string
+}
+
+export const SIGN_IN_FLOW: BrowserFlow = {
+  command: "brain gateway login",
+  path: "/auth/cli",
+  accept: (token) => callbackKey(token),
+  opening: "sign in to 100xprompt",
+  done: (email) => ({ title: "Signed in", body: `brain is now signed in to the 100xprompt gateway${email ? ` as ${email}` : ""}. You can close this tab and go back to your terminal.` }),
+  paste: "Paste the key from the page's Copy key button, or the address the browser could not open",
+}
+
 /** Signs in through the browser (or a pasted code). Does not store anything: the caller does. */
-export async function browserSignIn(d: SignInDeps): Promise<SignIn> {
+export async function browserSignIn(d: SignInDeps, flow: BrowserFlow = SIGN_IN_FLOW): Promise<SignIn> {
   const base = signInBase(d.authUrl)
   if (!base) return { ok: false, why: "HUNDREDXPROMPT_AUTH_URL must be an http:// or https:// address" }
   const { challenge } = await pkce()
@@ -145,35 +175,37 @@ export async function browserSignIn(d: SignInDeps): Promise<SignIn> {
       const got = url.searchParams.get("state") ?? ""
       const error = url.searchParams.get("error")
       // Only the page this command opened knows the state: anything else is refused and the wait goes on.
-      if (!/^[0-9a-f]{64}$/.test(got) || !sameState(got, state)) return page("Sign-in refused", "This link was not started by this brain gateway login. Start again from your terminal.", 400)
+      if (!/^[0-9a-f]{64}$/.test(got) || !sameState(got, state)) return page("Sign-in refused", `This link was not started by this ${flow.command}. Start again from your terminal.`, 400)
       if (error) {
         settle({ ok: false, why: `the sign-in page said: ${error.slice(0, 200)}` })
         return page("Sign-in failed", `${error.slice(0, 200)}. Go back to your terminal.`, 400)
       }
-      const c = callbackKey(url.searchParams.get("token") ?? "")
+      const c = flow.accept(url.searchParams.get("token") ?? "")
       if (!c.ok) {
         settle({ ok: false, why: c.why })
         return page("Sign-in failed", "No usable key came back. Go back to your terminal.", 400)
       }
       const email = url.searchParams.get("email") || c.email || undefined
       settle({ ok: true, key: c.key, ...(email ? { email } : {}), via: "browser" })
-      return page("Signed in", `brain is now signed in to the 100xprompt gateway${email ? ` as ${email}` : ""}. You can close this tab and go back to your terminal.`)
+      const done = flow.done(email)
+      return page(done.title, done.body)
     },
   })
-  const url = `${base}/auth/cli?port=${server.port}&state=${state}&challenge=${challenge}`
+  const extra = Object.entries(flow.params ?? {}).map(([k, v]) => `&${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("")
+  const url = `${base}${flow.path}?port=${server.port}&state=${state}&challenge=${challenge}${extra}`
   const stopAsking = new AbortController()
   const timer = setTimeout(() => settle({ ok: false, why: `no sign-in came back within ${Math.round((d.timeoutMs ?? TIMEOUT_MS) / 60_000) || 1} minutes` }), d.timeoutMs ?? TIMEOUT_MS)
   try {
-    if (d.browser === false) d.say(`Open this address in a browser to sign in to 100xprompt:\n  ${url}`)
+    if (d.browser === false) d.say(`Open this address in a browser to ${flow.opening}:\n  ${url}`)
     else {
-      d.say(`Opening your browser to sign in to 100xprompt:\n  ${url}`)
+      d.say(`Opening your browser to ${flow.opening}:\n  ${url}`)
       try {
         ;(d.open ?? openInBrowser)(url)
       } catch {}
     }
     if (d.ask) {
       d.say(
-        "Waiting for the browser. Signing in on another machine (SSH)? Paste the key from the page's Copy key button, or the address the browser could not open, then press Enter (Escape cancels).",
+        `Waiting for the browser. Signing in on another machine (SSH)? ${flow.paste}, then press Enter (Escape cancels).`,
       )
       // The paste runs alongside the browser: whichever comes first wins. A bad paste asks again; Escape ends the sign-in
       // (an abandoned hidden prompt would leave the terminal echoing whatever is pasted next, and the shell reading it).
@@ -183,7 +215,7 @@ export async function browserSignIn(d: SignInDeps): Promise<SignIn> {
           if (settled) return
           if (pasted === undefined) return settle({ ok: false, why: "sign-in cancelled" })
           if (!pasted.trim()) continue
-          const c = fromPaste(pasted.trim(), state)
+          const c = fromPaste(pasted.trim(), state, flow)
           if (c.ok) return settle({ ok: true, key: c.key, ...(c.email ? { email: c.email } : {}), via: "code" })
           if ("fatal" in c) return settle({ ok: false, why: c.why })
           d.say(`  ${c.why}`)
@@ -207,7 +239,7 @@ export async function browserSignIn(d: SignInDeps): Promise<SignIn> {
  * 127.0.0.1 on the wrong machine, and the address it could not open holds the key). An address must carry this sign-in's
  * state, so one from another sign-in, or one made up, is refused.
  */
-export function fromPaste(pasted: string, state: string): { ok: true; key: string; email?: string } | { ok: false; why: string } | { ok: false; why: string; fatal: true } {
+export function fromPaste(pasted: string, state: string, flow: BrowserFlow = SIGN_IN_FLOW): { ok: true; key: string; email?: string } | { ok: false; why: string } | { ok: false; why: string; fatal: true } {
   if (/^https?:\/\//i.test(pasted)) {
     let u: URL
     try {
@@ -220,12 +252,12 @@ export function fromPaste(pasted: string, state: string): { ok: true; key: strin
     if (!/^[0-9a-f]{64}$/.test(got) || !sameState(got, state)) return { ok: false, why: "that address is from another sign-in: paste the one from this sign-in" }
     const error = u.searchParams.get("error")
     if (error) return { ok: false, why: `the sign-in page said: ${error.slice(0, 200)}`, fatal: true }
-    const c = callbackKey(u.searchParams.get("token") ?? "")
+    const c = flow.accept(u.searchParams.get("token") ?? "")
     if (!c.ok) return c
     const email = u.searchParams.get("email") || c.email
     return { ok: true, key: c.key, ...(email ? { email } : {}) }
   }
-  return checkCredential(pasted)
+  return flow === SIGN_IN_FLOW ? checkCredential(pasted) : flow.accept(pasted)
 }
 
 /**