@addai/node 0.30.11 → 0.30.13

package/dist/capabilities.d.ts

@@ -1,4 +1,5 @@
 import type { EngineInfo } from './desktop/provider';
+import { type ClaudeModelEntry } from './claude-models';
 import { type AutostartState } from './autostart';
 import { type AutoUpdateState } from './auto-update';
 import { type MachineSample } from './machine-metrics';
@@ -42,9 +43,7 @@ interface CapabilitiesShape {
      *  UIs show "outdated daemon" hints and helps us debug field issues
      *  ("which version was this row produced by?"). */
     daemon_version?: string;
-    claude: BinaryProbe & {
-        models?: string[];
-    };
+    claude: BinaryProbe & ClaudeModelFields;
     codex: BinaryProbe & {
         models?: string[];
     };
@@ -80,6 +79,18 @@ interface CapabilitiesShape {
      *  version silently changes with no explanation. */
     auto_update?: AutoUpdateState;
 }
+/** What the heartbeat says about claude's models. `models` keeps its old
+ *  shape — plain ids — because Studio and Flows read it as strings; the
+ *  newer fields sit beside it and older readers simply never look. */
+interface ClaudeModelFields {
+    models?: string[];
+    /** The CLI's own entries with their names ('Opus 5.5') and alias flags.
+     *  Built-in extras in `models` have none, and are shown by id. */
+    model_catalog?: ClaudeModelEntry[];
+    /** 'cli' when the list came from the CLI, 'builtin' when it is the
+     *  fallback above — so a stale picker can be told apart from a live one. */
+    models_source?: 'cli' | 'builtin';
+}
 /** Codex's credential store: $CODEX_HOME (or ~/.codex) + /auth.json. */
 export declare function codexHome(): string;
 /**

package/dist/capabilities.js

@@ -47,6 +47,7 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 const claude_binary_1 = require("./claude-binary");
+const claude_models_1 = require("./claude-models");
 const kimi_binary_1 = require("./kimi-binary");
 const gemini_binary_1 = require("./gemini-binary");
 const grok_binary_1 = require("./grok-binary");
@@ -92,25 +93,21 @@ function runCmd(cmd, args, timeoutMs = 5000) {
         }
     });
 }
-// Curated model lists baked into the daemon. The CLIs still expose no
-// non-interactive "list models" command, so this stays a constant — but
-// WHAT goes in it is what decides whether the UI's dropdown rots.
+// Curated model lists baked into the daemon.
 //
-// Do not "fix" this by probing the CLI. Checked against Claude Code
-// 2.1.266: there is no `claude models` subcommand and no `claude config
-// list`. Both strings are read as a PROMPT — the CLI starts a billed
-// session and answers in prose. Probing that on every heartbeat would
-// spend money several times a minute and still return nothing parseable.
+// Claude's is now the FLOOR, not the source: the CLI itself is asked which
+// models it offers (claude-models.ts, over the SDK control protocol), so a new
+// Claude model reaches the pickers when a node's CLI updates, not when someone
+// edits this file. This list is what a node reports until that answer arrives
+// or when its CLI cannot give one — and its older pinned ids are kept beside
+// the CLI's answer, which (asked without a login) lists only the aliases.
 //
-// `claude --help` documents the real contract instead: --model takes
-// "an alias for the latest model (e.g. 'fable', 'opus', or 'sonnet') or
-// a model's full name (e.g. 'claude-fable-5')".
+// Do not "fix" the fallback by running `claude models` or `claude config
+// list`. Neither exists (checked to 2.1.304): both strings are read as a
+// PROMPT — the CLI starts a billed session and answers in prose.
 //
-// So the ALIASES lead the list. They are the only entries that cannot go
-// stale — the CLI resolves each to whatever is current in its tier — and
-// staleness is exactly what went wrong before: this list was still
-// offering claude-opus-4-1 and claude-sonnet-4-5 long after they were
-// superseded, and no amount of heartbeating fixes a wrong constant.
+// The ALIASES lead the list. They are the only entries that cannot go
+// stale — the CLI resolves each to whatever is current in its tier.
 // Pinned ids follow, newest first, for anyone who must hold one model.
 //
 // Availability is plan-gated (these nodes sign in with claude.ai
@@ -124,9 +121,12 @@ const CLAUDE_MODELS = [
     'haiku',
     'fable',
     // Pinned ids, newest first.
+    'claude-opus-5-5',
+    'claude-sonnet-5-5',
+    'claude-haiku-5-5',
+    'claude-fable-5-1',
     'claude-opus-5',
     'claude-sonnet-5',
-    'claude-fable-5-1',
     'claude-opus-4-8',
     'claude-opus-4-7',
     'claude-sonnet-4-6',
@@ -178,7 +178,19 @@ async function probeClaude() {
         }
         catch { /* fall through unauthed */ }
     }
-    return { available: true, version, models: CLAUDE_MODELS, ...authShape };
+    // Asked once per binary and version — the probe never sees the login, so
+    // an account change cannot move its answer. Never waits; see
+    // claude-models.ts. No default model is reported: a CLI asked without a
+    // login cannot say what this node's account defaults to.
+    const live = (0, claude_models_1.claudeModelsFor)(bin, `${bin}|${version ?? ''}`);
+    return {
+        available: true,
+        version,
+        models: live ? (0, claude_models_1.withBuiltin)(live, CLAUDE_MODELS).models : CLAUDE_MODELS,
+        ...(live ? { model_catalog: live.catalog } : {}),
+        models_source: live ? 'cli' : 'builtin',
+        ...authShape,
+    };
 }
 /** Codex's credential store: $CODEX_HOME (or ~/.codex) + /auth.json. */
 function codexHome() {

package/dist/claude-models.d.ts

@@ -0,0 +1,79 @@
+import { type CliInvocation } from './win';
+export interface ClaudeModelEntry {
+    /** What goes to `--model`: an alias ('opus') or a full id. */
+    id: string;
+    /** What the CLI runs for it today — the same as `id` for a full id. */
+    resolved: string;
+    /** The CLI's own label, e.g. 'Opus 5.5'. */
+    name: string;
+    /** An alias names a tier, not a version, and moves when the CLI updates. */
+    alias: boolean;
+    /** Effort levels this model takes, when the CLI says. */
+    efforts?: string[];
+}
+export interface ClaudeModelReport {
+    /** Plain ids, aliases first — the shape `capabilities.claude.models` has
+     *  always had. Studio and Flows read it as strings; keep it that way. */
+    models: string[];
+    /** The same models with names, for the UIs that know this field. */
+    catalog: ClaudeModelEntry[];
+    /** What a run with no model set gets — for a logged-OUT CLI, which is all
+     *  the probe ever sees, so it is not reported as this node's default. */
+    defaultModel?: string;
+}
+export type ProbeResult = {
+    ok: true;
+    report: ClaudeModelReport;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Turn the `models` array of an initialize response into a report.
+ *
+ * Every alias also gets a pinned entry for what it resolves to. The CLI lists
+ * `opus` → claude-opus-5-5 but no `claude-opus-5-5` of its own, and without one
+ * nobody could hold an entity on Opus 5.5 once `opus` moves on.
+ *
+ * `default` is left out of `models`: a blank model already means the default,
+ * and nobody has tested what `--model default` does.
+ *
+ * Returns null when nothing usable is in there.
+ */
+export declare function parseInitializeModels(raw: unknown): ClaudeModelReport | null;
+/**
+ * What the heartbeat reports: the CLI's models first, then any built-in id it
+ * did not mention. A logged-out CLI lists only its aliases, and dropping the
+ * older pinned ids (Opus 4.8, Sonnet 4.6, …) from every picker would take
+ * options away from people who use them. The built-in extras carry no catalog
+ * entry — a UI shows them by id, exactly as it always has.
+ */
+export declare function withBuiltin(report: ClaudeModelReport, builtin: readonly string[]): ClaudeModelReport;
+/**
+ * Ask one Claude binary for its models. Never throws; resolves within
+ * `timeoutMs` however the CLI behaves, and leaves no process behind.
+ */
+export declare function probeClaudeModels(bin: string, opts?: {
+    timeoutMs?: number;
+    /** Tests only: run something else in place of the CLI. */
+    resolve?: (bin: string, args: string[]) => CliInvocation;
+    /** Tests only: where the throwaway folder goes. */
+    dir?: string;
+}): Promise<ProbeResult>;
+/** Tests only. */
+export declare function __resetIsolationForTests(): void;
+export interface ModelCacheDeps {
+    probe: (bin: string) => Promise<ProbeResult>;
+    now: () => number;
+    log: (line: string) => void;
+}
+export declare function createClaudeModelCache(deps: ModelCacheDeps): {
+    /**
+     * The models for this binary state, or null to mean "use the built-in
+     * list". Never waits: a missing or stale answer is fetched in the
+     * background and arrives on a later call.
+     */
+    get(bin: string, key: string): ClaudeModelReport | null;
+};
+/** What capabilities.ts reports for claude's models. */
+export declare function claudeModelsFor(bin: string, key: string): ClaudeModelReport | null;

package/dist/claude-models.js

@@ -0,0 +1,406 @@
+"use strict";
+// Which models the installed Claude Code offers — asked of the CLI itself.
+//
+// Until 0.30.13 this was only the CLAUDE_MODELS constant in capabilities.ts,
+// and a constant is only as current as the last release: Opus 5.5 shipped and
+// every node went on offering Opus 5, because nobody had edited the list.
+//
+// The CLI has no `claude models` command (still true in 2.1.304, and anything
+// it does not recognise is read as a PROMPT, which is billed). But it does
+// answer the SDK control protocol: start it in stream-json mode, send the
+// `initialize` control request, and the response carries `models` — the list
+// its own /model picker shows, with what each alias resolves to today. No user
+// message is ever sent, so nothing is billed.
+//
+// ⚠️ THE PROBE MUST NEVER SEE THE NODE'S LOGIN. A Claude process that starts
+// with an expired access token refreshes it, which rotates the refresh token;
+// one that exits a second later — as a probe does — can lose the rotated token,
+// and the next process finds a dead login and wipes it. That logged popadom's
+// Claude out on 2026-10-20 while this was being built. So the probe runs with
+// a throwaway CLAUDE_CONFIG_DIR, `--bare` (no keychain reads — the macOS
+// login lives there, not in the config dir), and no credential env vars. The
+// CLI then reports `tokenSource: "none"` and still answers, with the
+// account-independent list: the aliases and what they resolve to.
+//
+//   2.1.278  `opus[1m]` → claude-opus-5[1m], `sonnet` → claude-sonnet-5
+//   2.1.304  `opus` → claude-opus-5-5, `sonnet` → claude-sonnet-5-5
+//
+// If a CLI ever answers WITH a login despite all that, isolation has failed:
+// this process stops probing for good and says so in the log.
+//
+// A probe costs a CLI start (~1s) and the heartbeat runs every 30s, so the
+// answer is cached per (binary, version) and the heartbeat never waits for it:
+// the first beat after an install or upgrade still reports what it had, kicks
+// the probe off in the background, and the next beat carries the answer. A
+// probe that fails — an old CLI, a protocol change — leaves the built-in list
+// in place (or the last answer that same binary gave) and is not retried for
+// RETRY_AFTER_FAIL_MS, so a broken CLI never costs a spawn every 30 seconds.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseInitializeModels = parseInitializeModels;
+exports.withBuiltin = withBuiltin;
+exports.probeClaudeModels = probeClaudeModels;
+exports.__resetIsolationForTests = __resetIsolationForTests;
+exports.createClaudeModelCache = createClaudeModelCache;
+exports.claudeModelsFor = claudeModelsFor;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const paths_1 = require("./paths");
+const win_1 = require("./win");
+// What a model id may look like before it is passed on: `claude-opus-5-5`,
+// `opus[1m]`, `claude-haiku-4-5-20251001`. Anything else is dropped rather
+// than shipped to every picker.
+const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._:[\]-]{0,119}$/;
+const MAX_ENTRIES = 64;
+/** An alias carries no version number: `opus`, `sonnet`, `opus[1m]`. */
+function isAlias(id) {
+    return !/\d/.test(id.replace(/\[[^\]]*\]$/, ''));
+}
+/**
+ * Turn the `models` array of an initialize response into a report.
+ *
+ * Every alias also gets a pinned entry for what it resolves to. The CLI lists
+ * `opus` → claude-opus-5-5 but no `claude-opus-5-5` of its own, and without one
+ * nobody could hold an entity on Opus 5.5 once `opus` moves on.
+ *
+ * `default` is left out of `models`: a blank model already means the default,
+ * and nobody has tested what `--model default` does.
+ *
+ * Returns null when nothing usable is in there.
+ */
+function parseInitializeModels(raw) {
+    if (!Array.isArray(raw))
+        return null;
+    const aliases = [];
+    const pinned = [];
+    const derived = [];
+    let defaultModel;
+    for (const item of raw.slice(0, MAX_ENTRIES)) {
+        if (!item || typeof item !== 'object')
+            continue;
+        const o = item;
+        const id = typeof o.value === 'string' ? o.value.trim() : '';
+        if (!SAFE_ID.test(id))
+            continue;
+        const resolved = typeof o.resolvedModel === 'string' && SAFE_ID.test(o.resolvedModel.trim())
+            ? o.resolvedModel.trim() : id;
+        const name = typeof o.displayName === 'string' && o.displayName.trim()
+            ? o.displayName.trim().slice(0, 80) : id;
+        const efforts = Array.isArray(o.supportedEffortLevels)
+            ? o.supportedEffortLevels.filter((e) => typeof e === 'string' && /^[a-z]{1,20}$/.test(e))
+            : [];
+        if (id === 'default') {
+            if (resolved !== 'default')
+                defaultModel = resolved;
+            continue;
+        }
+        const entry = { id, resolved, name, alias: isAlias(id), ...(efforts.length ? { efforts } : {}) };
+        (entry.alias ? aliases : pinned).push(entry);
+        if (entry.alias && resolved !== id) {
+            derived.push({ id: resolved, resolved, name, alias: false, ...(efforts.length ? { efforts } : {}) });
+        }
+    }
+    // Aliases first (they never go stale), then what they point at (the newest
+    // models), then the CLI's own pinned list in its order.
+    const seen = new Set();
+    const catalog = [];
+    for (const e of [...aliases, ...derived, ...pinned]) {
+        if (seen.has(e.id))
+            continue;
+        seen.add(e.id);
+        catalog.push(e);
+    }
+    if (catalog.length === 0)
+        return null;
+    return { models: catalog.map(e => e.id), catalog, ...(defaultModel ? { defaultModel } : {}) };
+}
+/**
+ * What the heartbeat reports: the CLI's models first, then any built-in id it
+ * did not mention. A logged-out CLI lists only its aliases, and dropping the
+ * older pinned ids (Opus 4.8, Sonnet 4.6, …) from every picker would take
+ * options away from people who use them. The built-in extras carry no catalog
+ * entry — a UI shows them by id, exactly as it always has.
+ */
+function withBuiltin(report, builtin) {
+    const have = new Set(report.models);
+    return { ...report, models: [...report.models, ...builtin.filter(id => !have.has(id))] };
+}
+/** Never read a login: the CLI must not see, refresh or clear one. */
+const CREDENTIAL_ENV = [
+    'ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN', 'CLAUDE_CODE_OAUTH_TOKEN',
+    'CLAUDE_CODE_OAUTH_REFRESH_TOKEN', 'CLAUDE_CONFIG_DIR',
+];
+/** A throwaway folder that is both the probe's cwd and its CLAUDE_CONFIG_DIR,
+ *  so no project's settings or CLAUDE.md are read and nothing the CLI writes
+ *  lands in the real ~/.claude. Folders older than a day are swept — a
+ *  probe's own cleanup can lose a race with Windows releasing the cwd. */
+function makeProbeDir() {
+    const root = path.join(paths_1.RUNTIME_HOME, 'model-probe');
+    try {
+        fs.mkdirSync(root, { recursive: true });
+        const cutoff = Date.now() - 24 * 60 * 60 * 1000;
+        for (const name of fs.readdirSync(root)) {
+            const p = path.join(root, name);
+            try {
+                if (fs.statSync(p).mtimeMs < cutoff)
+                    fs.rmSync(p, { recursive: true, force: true });
+            }
+            catch { /* next time */ }
+        }
+        return fs.mkdtempSync(path.join(root, 'p-'));
+    }
+    catch {
+        try {
+            return fs.mkdtempSync(path.join(os.tmpdir(), 'ainode-model-probe-'));
+        }
+        catch {
+            return null;
+        }
+    }
+}
+const PROBE_ARGS = [
+    '--print', '--input-format', 'stream-json', '--output-format', 'stream-json', '--verbose',
+    // No keychain reads (the macOS login), no hooks, no plugin sync, no
+    // background prefetches. A CLI too old to know --bare refuses to start,
+    // and that node keeps the built-in list — the safe way to be wrong.
+    '--bare',
+    // No MCP servers: the handshake needs none.
+    '--strict-mcp-config', '--mcp-config', '{"mcpServers":{}}',
+];
+const MAX_LINE = 2 * 1024 * 1024;
+/** Set once a CLI answers with a login despite the isolation above. */
+let isolationBroken = false;
+/**
+ * Ask one Claude binary for its models. Never throws; resolves within
+ * `timeoutMs` however the CLI behaves, and leaves no process behind.
+ */
+function probeClaudeModels(bin, opts = {}) {
+    return new Promise(done => {
+        if (isolationBroken) {
+            done({ ok: false, reason: 'probing is off: a CLI saw a login despite the isolation' });
+            return;
+        }
+        let settled = false;
+        let inv;
+        try {
+            inv = (opts.resolve ?? win_1.resolveCliInvocation)(bin, PROBE_ARGS);
+        }
+        catch (err) {
+            done({ ok: false, reason: err.message || String(err) });
+            return;
+        }
+        const dir = opts.dir ?? makeProbeDir();
+        if (!dir) {
+            done({ ok: false, reason: 'no folder to probe from' });
+            return;
+        }
+        const cleanup = () => {
+            if (opts.dir)
+                return;
+            try {
+                fs.rmSync(dir, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 });
+            }
+            catch { /* swept later */ }
+        };
+        const env = { ...process.env, TERM: 'dumb' };
+        for (const k of CREDENTIAL_ENV)
+            delete env[k];
+        env.CLAUDE_CONFIG_DIR = dir;
+        // A probe is read-only: it must never start a self-update of the CLI.
+        env.DISABLE_AUTOUPDATER = '1';
+        let child;
+        try {
+            child = (0, child_process_1.spawn)(inv.file, inv.args, { cwd: dir, env, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true });
+        }
+        catch (err) {
+            cleanup();
+            done({ ok: false, reason: err.message || String(err) });
+            return;
+        }
+        child.once('close', cleanup);
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            // EOF first — in stream-json mode the CLI exits on its own when its
+            // input ends. The kill is the backstop for one that does not.
+            try {
+                child.stdin?.end();
+            }
+            catch { /* already closed */ }
+            const reap = setTimeout(() => {
+                if (child.exitCode === null && child.signalCode === null)
+                    (0, win_1.killProcessTree)(child);
+            }, 3000);
+            reap.unref();
+            child.once('exit', () => clearTimeout(reap));
+            done(result);
+        };
+        const timer = setTimeout(() => {
+            finish({ ok: false, reason: `no answer within ${opts.timeoutMs ?? 30000}ms` });
+            (0, win_1.killProcessTree)(child);
+        }, opts.timeoutMs ?? 30000);
+        timer.unref();
+        child.on('error', err => finish({ ok: false, reason: err.message || String(err) }));
+        // 'close', not 'exit': close waits for stdout to drain, so an answer the
+        // CLI wrote just before exiting is read rather than reported missing.
+        child.on('close', (code, signal) => {
+            finish({ ok: false, reason: `exited ${code ?? signal} before answering${stderr ? `: ${stderr.trim().slice(0, 200)}` : ''}` });
+        });
+        child.stdin?.on('error', () => { });
+        let stderr = '';
+        child.stderr?.on('data', (d) => { if (stderr.length < 4096)
+            stderr += d.toString('utf8'); });
+        const requestId = `models-${process.pid}-${Date.now()}`;
+        let buf = '';
+        child.stdout?.on('data', (d) => {
+            buf += d.toString('utf8');
+            if (buf.length > MAX_LINE) {
+                finish({ ok: false, reason: 'oversized output' });
+                return;
+            }
+            let nl;
+            while ((nl = buf.indexOf('\n')) >= 0) {
+                const line = buf.slice(0, nl).trim();
+                buf = buf.slice(nl + 1);
+                if (!line.startsWith('{'))
+                    continue;
+                let msg;
+                try {
+                    msg = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                if (msg.type !== 'control_response')
+                    continue;
+                const res = msg.response ?? {};
+                if (res.request_id && res.request_id !== requestId)
+                    continue;
+                if (res.subtype === 'error') {
+                    finish({ ok: false, reason: `initialize refused: ${String(res.error ?? 'unknown').slice(0, 200)}` });
+                    return;
+                }
+                const tokenSource = res.response?.account?.tokenSource;
+                if (typeof tokenSource === 'string' && tokenSource !== 'none') {
+                    isolationBroken = true;
+                    finish({ ok: false, reason: `isolation failed — the CLI saw a login (${tokenSource}); probing is now off on this node` });
+                    return;
+                }
+                const report = parseInitializeModels(res.response?.models);
+                finish(report ? { ok: true, report } : { ok: false, reason: 'initialize answered without a model list' });
+                return;
+            }
+        });
+        try {
+            child.stdin?.write(JSON.stringify({
+                type: 'control_request', request_id: requestId, request: { subtype: 'initialize' },
+            }) + '\n');
+        }
+        catch { /* reported via 'close' / 'error' */ }
+    });
+}
+/** Tests only. */
+function __resetIsolationForTests() { isolationBroken = false; }
+/* ── the cache the heartbeat reads ─────────────────────────────────────── */
+/** Re-ask now and then even when nothing changed: the CLI's list can move
+ *  without a CLI update. */
+const REFRESH_MS = 6 * 60 * 60 * 1000;
+const RETRY_AFTER_FAIL_MS = 30 * 60 * 1000;
+function createClaudeModelCache(deps) {
+    let good = null;
+    let failed = null;
+    let inflight = null;
+    const start = (bin, key) => {
+        if (inflight)
+            return;
+        inflight = deps.probe(bin).then(result => {
+            if (result.ok) {
+                const changed = !good || good.report.models.join() !== result.report.models.join();
+                good = { key, report: result.report, at: deps.now() };
+                if (failed?.key === key)
+                    failed = null;
+                if (changed) {
+                    const head = result.report.catalog.filter(e => e.alias && e.resolved !== e.id)
+                        .map(e => `${e.id} → ${e.resolved}`).join(', ');
+                    deps.log(`[models] claude: ${result.report.models.length} models from the CLI${head ? ` (${head})` : ''}`);
+                }
+            }
+            else {
+                // An answer this exact binary already gave stays good: a refresh
+                // that fails is a reason to retry, not to forget it.
+                failed = { key, at: deps.now() };
+                const kept = good?.key === key;
+                deps.log(`[models] could not read claude's model list (${result.reason}) — ${kept ? 'keeping the last answer' : 'offering the built-in list'}; next try in ${RETRY_AFTER_FAIL_MS / 60000} min`);
+            }
+        }).catch(() => { failed = { key, at: deps.now() }; })
+            .finally(() => { inflight = null; });
+    };
+    return {
+        /**
+         * The models for this binary state, or null to mean "use the built-in
+         * list". Never waits: a missing or stale answer is fetched in the
+         * background and arrives on a later call.
+         */
+        get(bin, key) {
+            const now = deps.now();
+            const recentlyFailed = failed?.key === key && now - failed.at < RETRY_AFTER_FAIL_MS;
+            if (good?.key === key) {
+                if (now - good.at > REFRESH_MS && !recentlyFailed)
+                    start(bin, key);
+                return good.report;
+            }
+            if (!recentlyFailed)
+                start(bin, key);
+            // A new CLI version that has not answered yet: keep showing the last
+            // real list — closer to the truth than the constant, and it stops the
+            // pickers flickering to the built-in list across an upgrade. Once the
+            // new version has actually failed, the built-in list it is.
+            return failed?.key === key ? null : (good?.report ?? null);
+        },
+    };
+}
+const sharedCache = createClaudeModelCache({
+    probe: bin => probeClaudeModels(bin),
+    now: () => Date.now(),
+    log: line => console.log(line),
+});
+/** What capabilities.ts reports for claude's models. */
+function claudeModelsFor(bin, key) {
+    return sharedCache.get(bin, key);
+}

package/dist/codex-spawn.d.ts

@@ -25,14 +25,30 @@ export interface CodexInput {
      *  Mirrors the claude --strict-mcp-config behavior. */
     mcpServers?: CodexMcpServer[];
 }
+export interface CodexHomeOptions {
+    /** Forward a remote server's credentials as headers via env_http_headers.
+     *  spawnCodex passes codexSupportsEnvHttpHeaders(bin), so a codex too old to
+     *  know the key keeps exactly the config it had before. Default true. */
+    envHttpHeaders?: boolean;
+}
 /** Build a config.toml that declares only the supplied MCP servers and
  *  return the CODEX_HOME directory plus any env vars the child needs
- *  (bearer tokens for remote servers). Caller is responsible for cleanup
- *  (we drop it under os.tmpdir() so it gets reaped). */
-export declare function writeCodexHome(servers: CodexMcpServer[], workingDirectory: string): {
+ *  (bearer tokens and header values for remote servers). Caller is
+ *  responsible for cleanup (we drop it under os.tmpdir() so it gets reaped). */
+export declare function writeCodexHome(servers: CodexMcpServer[], workingDirectory: string, opts?: CodexHomeOptions): {
     home: string;
     extraEnv: Record<string, string>;
 };
+/**
+ * Does this codex know env_http_headers? Asked by having it parse a throwaway
+ * config (`codex mcp list --json`, which reads config and contacts nothing)
+ * and checking that the header survived. Remembered per binary. Any failure
+ * answers "no", which keeps the bearer-only config every install ran before.
+ */
+export declare function codexSupportsEnvHttpHeaders(bin: string, probe?: (bin: string, codexHome: string) => string): boolean;
+/** Read `codex mcp list --json` output: did the probe server's header survive?
+ *  Exported for tests. */
+export declare function codexListShowsEnvHeaders(stdout: string): boolean;
 /** First line of an AGENTS.md this daemon wrote. A project's own AGENTS.md
  *  never carries it and is never touched. */
 export declare const AGENTS_MD_MARKER = "<!-- ainode: entity system prompt \u2014 rewritten before every turn; edits here do not persist -->";

package/dist/codex-spawn.js

@@ -42,6 +42,8 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AGENTS_MD_MARKER = void 0;
 exports.writeCodexHome = writeCodexHome;
+exports.codexSupportsEnvHttpHeaders = codexSupportsEnvHttpHeaders;
+exports.codexListShowsEnvHeaders = codexListShowsEnvHeaders;
 exports.writeCodexAgentsMd = writeCodexAgentsMd;
 exports.codexEffort = codexEffort;
 exports.spawnCodex = spawnCodex;
@@ -55,6 +57,7 @@ const diskguard_1 = require("./diskguard");
 const win_1 = require("./win");
 const events_1 = require("./events");
 const prompt_transport_1 = require("./prompt-transport");
+const mcp_headers_1 = require("./mcp-headers");
 /** Quote a string as a TOML basic string (double-quoted, escape backslash + quote). */
 function tomlString(s) {
     return '"' + String(s).replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n') + '"';
@@ -63,11 +66,17 @@ function tomlString(s) {
  *  Only the NAME goes in config.toml — the value rides on the child env, so
  *  the token never lands on disk. */
 const bearerEnvVar = (slug) => `AINODE_MCP_${slug.replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}_TOKEN`;
+/** Env var name carrying one HTTP header's value into the codex process.
+ *  config.toml references it by name via env_http_headers, so the value never
+ *  lands on disk either. */
+const headerEnvVar = (slug, header) => `AINODE_MCP_${slug.replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}` +
+    `_H_${header.replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}`;
 /** Build a config.toml that declares only the supplied MCP servers and
  *  return the CODEX_HOME directory plus any env vars the child needs
- *  (bearer tokens for remote servers). Caller is responsible for cleanup
- *  (we drop it under os.tmpdir() so it gets reaped). */
-function writeCodexHome(servers, workingDirectory) {
+ *  (bearer tokens and header values for remote servers). Caller is
+ *  responsible for cleanup (we drop it under os.tmpdir() so it gets reaped). */
+function writeCodexHome(servers, workingDirectory, opts = {}) {
+    const envHttpHeaders = opts.envHttpHeaders !== false;
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'entities-codex-'));
     const extraEnv = {};
     let toml = '# Generated by ainode — sandboxes codex against host config\n\n';
@@ -92,6 +101,8 @@ function writeCodexHome(servers, workingDirectory) {
             toml += `url = ${tomlString(url)}\n`;
             // codex reads the bearer from its OWN environment (--env is stdio-only),
             // so the value goes on the child env and only the var name in the file.
+            // The bearer is exactly what this adapter always sent, kept so anything
+            // that works on codex today keeps working.
             const creds = Object.entries(s.env || {})
                 .filter(([k, v]) => typeof v === 'string' && v.length > 0 && !k.startsWith('OAUTH_REFRESH'));
             const bearer = creds.find(([k]) => k === 'OAUTH_ACCESS_TOKEN') ?? creds[0];
@@ -99,15 +110,34 @@ function writeCodexHome(servers, workingDirectory) {
                 const varName = bearerEnvVar(s.slug);
                 extraEnv[varName] = String(bearer[1]);
                 toml += `bearer_token_env_var = ${tomlString(varName)}\n`;
-                if (creds.length > 1) {
-                    // codex carries one bearer and no arbitrary headers. Anything that
-                    // authenticates with several custom headers is only partly wired,
-                    // and saying so beats a server that 401s for no visible reason.
-                    console.error(`[codex] MCP ${s.slug}: only ${bearer[0]} is forwarded as a bearer token; ` +
-                        `codex cannot send custom headers, so ${creds.length - 1} other credential ` +
-                        `field(s) were dropped`);
+            }
+            // The bearer alone was never enough. The servers read each credential
+            // from its own header (the claude path sends them all, see
+            // remoteMcpHeaders) and fall back to the bearer for any that is missing,
+            // so +Ai Drive, which carries three, used its API key as its workspace
+            // id and answered "Access denied to workspace" on every codex run.
+            // codex does send custom headers: env_http_headers maps a header name to
+            // the NAME of an env var, so the values stay off disk like the bearer.
+            const headers = (0, mcp_headers_1.remoteMcpHeaders)(s.env);
+            // An OAuth access token is already the bearer above.
+            delete headers.Authorization;
+            const entries = Object.entries(headers);
+            if (entries.length > 0 && envHttpHeaders) {
+                // A sub-table must follow the parent table's scalar keys.
+                toml += `[mcp_servers.${name}.env_http_headers]\n`;
+                for (const [header, value] of entries) {
+                    const varName = headerEnvVar(s.slug, header);
+                    extraEnv[varName] = value;
+                    toml += `${tomlString(header)} = ${tomlString(varName)}\n`;
                 }
             }
+            else if (creds.length > 1) {
+                // A codex too old to know env_http_headers carries the bearer only.
+                // Saying so beats a server that refuses for no visible reason.
+                console.error(`[codex] MCP ${s.slug}: this codex cannot send custom headers, so only ` +
+                    `${bearer?.[0]} is forwarded and ${creds.length - 1} other credential ` +
+                    `field(s) were dropped`);
+            }
             toml += '\n';
             continue;
         }
@@ -159,6 +189,76 @@ function writeCodexHome(servers, workingDirectory) {
     }
     return { home: dir, extraEnv };
 }
+const PROBE_SERVER = 'ainode_probe';
+const PROBE_HEADER = 'X-Ainode-Probe';
+// A real answer holds until the binary might have been updated; a probe that
+// could not run at all is retried sooner.
+const PROBE_TTL_MS = 6 * 60 * 60 * 1000;
+const PROBE_FAILED_TTL_MS = 10 * 60 * 1000;
+const envHeaderSupport = new Map();
+/**
+ * Does this codex know env_http_headers? Asked by having it parse a throwaway
+ * config (`codex mcp list --json`, which reads config and contacts nothing)
+ * and checking that the header survived. Remembered per binary. Any failure
+ * answers "no", which keeps the bearer-only config every install ran before.
+ */
+function codexSupportsEnvHttpHeaders(bin, probe = codexMcpListJson) {
+    const hit = envHeaderSupport.get(bin);
+    if (hit && hit.until > Date.now())
+        return hit.ok;
+    let ok = false;
+    let failed = false;
+    let home = null;
+    try {
+        home = fs.mkdtempSync(path.join(os.tmpdir(), 'ainode-codex-probe-'));
+        fs.writeFileSync(path.join(home, 'config.toml'), `[mcp_servers.${PROBE_SERVER}]\n` +
+            `url = "http://127.0.0.1:9/mcp"\n` +
+            // A bearer keeps codex from looking for stored OAuth credentials.
+            `bearer_token_env_var = "AINODE_PROBE_TOKEN"\n` +
+            `[mcp_servers.${PROBE_SERVER}.env_http_headers]\n` +
+            `"${PROBE_HEADER}" = "AINODE_PROBE_HEADER"\n`, { mode: 0o600 });
+        ok = codexListShowsEnvHeaders(probe(bin, home));
+    }
+    catch {
+        ok = false;
+        failed = true;
+    }
+    finally {
+        if (home) {
+            try {
+                fs.rmSync(home, { recursive: true, force: true });
+            }
+            catch { /* reaped from tmp */ }
+        }
+    }
+    envHeaderSupport.set(bin, { ok, until: Date.now() + (failed ? PROBE_FAILED_TTL_MS : PROBE_TTL_MS) });
+    return ok;
+}
+/** Read `codex mcp list --json` output: did the probe server's header survive?
+ *  Exported for tests. */
+function codexListShowsEnvHeaders(stdout) {
+    const start = stdout.search(/^\s*\[/m);
+    if (start < 0)
+        return false;
+    let list;
+    try {
+        list = JSON.parse(stdout.slice(start));
+    }
+    catch {
+        return false;
+    }
+    if (!Array.isArray(list))
+        return false;
+    const entry = list.find((e) => e && e.name === PROBE_SERVER);
+    return entry?.transport?.env_http_headers?.[PROBE_HEADER] === 'AINODE_PROBE_HEADER';
+}
+function codexMcpListJson(bin, codexHome) {
+    const inv = (0, win_1.resolveCliInvocation)(bin, ['mcp', 'list', '--json']);
+    return (0, child_process_1.execFileSync)(inv.file, inv.args, {
+        encoding: 'utf8', timeout: 20_000, windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'],
+        env: { ...process.env, CODEX_HOME: codexHome },
+    });
+}
 /** First line of an AGENTS.md this daemon wrote. A project's own AGENTS.md
  *  never carries it and is never touched. */
 exports.AGENTS_MD_MARKER = '<!-- ainode: entity system prompt — rewritten before every turn; edits here do not persist -->';
@@ -270,10 +370,19 @@ function spawnCodex(input) {
     const args = input.resumeThreadId
         ? ['exec', ...baseFlags, 'resume', input.resumeThreadId, input.prompt]
         : ['exec', ...baseFlags, input.prompt];
+    // Resolve binary path before spawn. Previously called spawn('codex', ...)
+    // bare, which threw ENOENT under launchd / desktop-app PATH inheritance
+    // and rejected `done` before any session_end event fired → request
+    // stuck at 'running' on the DB. Resolved first now, because the config
+    // below depends on what this codex understands.
+    const bin = (0, codex_binary_1.findCodexBinary)();
     // Sandbox codex against an isolated CODEX_HOME so the host's
     // ~/.codex/config.toml mcp_servers don't leak in. TERM=dumb keeps
     // codex's TTY heuristics happy (no fancy terminal output).
-    const { home: codexHome, extraEnv: mcpBearerEnv } = writeCodexHome(input.mcpServers ?? [], input.workingDirectory);
+    const servers = input.mcpServers ?? [];
+    // Only a remote server that carries credentials needs the header probe.
+    const wantsHeaders = servers.some((s) => (0, mcp_headers_1.isRemoteMcp)(s.command) && Object.keys(s.env ?? {}).length > 0);
+    const { home: codexHome, extraEnv: mcpBearerEnv } = writeCodexHome(servers, input.workingDirectory, { envHttpHeaders: wantsHeaders && bin ? codexSupportsEnvHttpHeaders(bin) : false });
     // Register the scratch dir with DiskGuard: marks it active (so a
     // concurrent sweep won't evict a live run) and writes a PID lock so a
     // different runtime process can tell it's still owned. dispose(true)
@@ -284,15 +393,11 @@ function spawnCodex(input) {
         ...process.env,
         TERM: 'dumb',
         CODEX_HOME: codexHome,
-        // Bearer tokens for remote (http/sse) MCP servers. config.toml names these
-        // vars via bearer_token_env_var; the values only ever live here.
+        // Bearer tokens and header values for remote (http/sse) MCP servers.
+        // config.toml names these vars via bearer_token_env_var and
+        // env_http_headers; the values only ever live here.
         ...mcpBearerEnv,
     };
-    // Resolve binary path before spawn. Previously called spawn('codex', ...)
-    // bare, which threw ENOENT under launchd / desktop-app PATH inheritance
-    // and rejected `done` before any session_end event fired → request
-    // stuck at 'running' on the DB.
-    const bin = (0, codex_binary_1.findCodexBinary)();
     const listeners = [];
     const emit = (e) => { for (const l of listeners)
         try {

package/package.json

@@ -1,62 +1,62 @@
-{
-  "name": "@addai/node",
-  "version": "0.30.11",
-  "description": "Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.",
-  "license": "MIT",
-  "keywords": [
-    "addai",
-    "entity-studio",
-    "claude",
-    "codex",
-    "kimi",
-    "gemini",
-    "agent",
-    "daemon",
-    "supabase",
-    "mcp"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/just-AddAi/addai-entity-runtime.git"
-  },
-  "homepage": "https://github.com/just-AddAi/addai-entity-runtime#readme",
-  "bugs": {
-    "url": "https://github.com/just-AddAi/addai-entity-runtime/issues"
-  },
-  "type": "commonjs",
-  "main": "dist/index.js",
-  "bin": {
-    "ainode": "dist/cli.js"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "files": [
-    "dist",
-    "scripts",
-    "README.md",
-    "assets"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json && node scripts/copy-assets.js",
-    "start": "node dist/cli.js",
-    "dev": "tsc -p tsconfig.json && node dist/cli.js",
-    "test": "npm run build && node --test test/*.test.mjs",
-    "clean": "node -e \"fs.rmSync('dist',{recursive:true,force:true})\"",
-    "postinstall": "node scripts/fix-pty-helper.js",
-    "prepublishOnly": "npm run build"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "dependencies": {
-    "@addai/node-flows": "^1.0.0",
-    "node-pty": "^1.1.0",
-    "ws": "^8.21.3"
-  },
-  "devDependencies": {
-    "@types/node": "^20.0.0",
-    "@types/ws": "^8.18.1",
-    "typescript": "^5.6.0"
-  }
-}
+{
+  "name": "@addai/node",
+  "version": "0.30.13",
+  "description": "Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.",
+  "license": "MIT",
+  "keywords": [
+    "addai",
+    "entity-studio",
+    "claude",
+    "codex",
+    "kimi",
+    "gemini",
+    "agent",
+    "daemon",
+    "supabase",
+    "mcp"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/just-AddAi/addai-entity-runtime.git"
+  },
+  "homepage": "https://github.com/just-AddAi/addai-entity-runtime#readme",
+  "bugs": {
+    "url": "https://github.com/just-AddAi/addai-entity-runtime/issues"
+  },
+  "type": "commonjs",
+  "main": "dist/index.js",
+  "bin": {
+    "ainode": "dist/cli.js"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "scripts",
+    "README.md",
+    "assets"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json && node scripts/copy-assets.js",
+    "start": "node dist/cli.js",
+    "dev": "tsc -p tsconfig.json && node dist/cli.js",
+    "test": "npm run build && node --test test/*.test.mjs",
+    "clean": "node -e \"fs.rmSync('dist',{recursive:true,force:true})\"",
+    "postinstall": "node scripts/fix-pty-helper.js",
+    "prepublishOnly": "npm run build"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "@addai/node-flows": "^1.0.0",
+    "node-pty": "^1.1.0",
+    "ws": "^8.21.3"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "@types/ws": "^8.18.1",
+    "typescript": "^5.6.0"
+  }
+}