@melaya/runner 1.0.73 → 1.0.76

package/dist/detect.d.ts

@@ -1,5 +1,5 @@
 export interface DetectedModel {
-    provider: "lmstudio" | "ollama" | "claude_code";
+    provider: "lmstudio" | "ollama" | "claude_code" | "codex";
     name: string;
 }
 export declare function detectModels(): Promise<DetectedModel[]>;

package/dist/detect.js

@@ -4,32 +4,137 @@
  */
 import { execFile } from "child_process";
 import { promisify } from "util";
+import { readFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
 const execFileAsync = promisify(execFile);
-/** Claude Code is a subscription CLI — when it's installed AND logged in on
- *  this machine, report its model aliases so the platform's model picker can
- *  show the TRUE availability for local runs (the cloud host's CLI status is
- *  the wrong signal: claude_code pipelines execute HERE, on the runner). */
+/** Fallbacks used ONLY when live discovery fails (offline runner, transient
+ *  error, missing cache). The REAL lists are fetched dynamically below so a new
+ *  claude/codex release is available on Melaya automatically — no code change,
+ *  no redeploy. Kept minimal + in step with the registry `staticModels`. */
+const CODEX_MODELS_FALLBACK = ["gpt-5.5", "gpt-5.4", "gpt-5.4-mini"];
+const CLAUDE_ALIASES_FALLBACK = ["sonnet", "opus", "haiku"];
+/** Discover the claude model FAMILIES this subscription serves, so a new
+ *  family (a future tier) appears on Melaya automatically. Hits the same
+ *  GET /v1/models the runtime resolver uses (model.py::_resolve_claude_model_id)
+ *  with the OAuth token, then reduces concrete ids (claude-<family>-<ver>-<date>)
+ *  to their family aliases (opus/sonnet/haiku/…). Each alias resolves to the
+ *  NEWEST model of its family at call time, so within-family releases are picked
+ *  up for free too. Best-effort: any failure falls back to the known aliases. */
+async function fetchClaudeFamilies(token) {
+    try {
+        const r = await fetch("https://api.anthropic.com/v1/models?limit=100", {
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "anthropic-version": "2023-06-01",
+                "anthropic-beta": "oauth-2025-04-20",
+                "x-app": "cli",
+                "User-Agent": "claude-code/2.1.81",
+            },
+            signal: AbortSignal.timeout(6000),
+        });
+        if (r.ok) {
+            const data = (await r.json());
+            const fams = new Set();
+            for (const m of data.data ?? []) {
+                const mm = /^claude-([a-z]+)-/.exec(m?.id ?? "");
+                if (mm)
+                    fams.add(mm[1]);
+            }
+            if (fams.size)
+                return [...fams];
+        }
+    }
+    catch { /* offline / transient → fallback */ }
+    return CLAUDE_ALIASES_FALLBACK;
+}
+/** Read the codex model catalog from the CLI's OWN auto-refreshed cache
+ *  (~/.codex/models_cache.json, written by codex when it lists models), so a
+ *  new codex release appears on Melaya automatically. File-based like auth.json
+ *  — no API call, no subprocess/terminal. Filters non-chat helper slugs
+ *  (e.g. codex-auto-review). Falls back to a known set. */
+async function readCodexModels() {
+    try {
+        const raw = await readFile(join(homedir(), ".codex", "models_cache.json"), "utf8");
+        const j = JSON.parse(raw);
+        const slugs = (j.models ?? [])
+            .map((m) => m?.slug ?? "")
+            .filter((s) => s && !/(^|-)(auto|review|embed|moderation)(-|$)/i.test(s));
+        if (slugs.length)
+            return slugs;
+    }
+    catch { /* no cache / malformed → fallback */ }
+    return CODEX_MODELS_FALLBACK;
+}
+/** Claude Code is a subscription CLI — when it's logged in on this machine,
+ *  report its model aliases so the platform's model picker shows TRUE
+ *  availability for local runs (claude_code pipelines execute HERE).
+ *
+ *  We read the CLI's OAuth credentials FILE directly rather than spawning
+ *  `claude auth status`. That subprocess flashed a console window on Windows
+ *  every time the runner started (`windowsHide` is unreliable through the
+ *  `.cmd` shell wrapper, which spawns its own conhost). The file is the source
+ *  of truth on Windows/Linux; macOS keeps the grant in the Keychain, where
+ *  `security` is a subprocess but pops NO window. Zero windows, faster, and
+ *  it mirrors exactly what the runtime (model.py `_read_claude_oauth`) reads. */
 async function detectClaudeCode() {
-    // npm global installs on Windows expose claude.cmd — execFile with a bare
-    // name won't resolve .cmd without a shell, so try the .cmd wrapper first.
-    const candidates = process.platform === "win32" ? ["claude.cmd", "claude"] : ["claude"];
-    for (const exe of candidates) {
+    let raw = null;
+    try {
+        raw = await readFile(join(homedir(), ".claude", ".credentials.json"), "utf8");
+    }
+    catch {
+        raw = null;
+    }
+    if (!raw && process.platform === "darwin") {
         try {
-            const { stdout } = await execFileAsync(exe, ["auth", "status"], {
-                timeout: 10_000,
-                windowsHide: true,
-                // .cmd files need a shell on win32; harmless elsewhere.
-                shell: process.platform === "win32",
-            });
-            const status = JSON.parse(stdout);
-            if (status.loggedIn) {
-                return ["sonnet", "opus", "haiku"].map((name) => ({ provider: "claude_code", name }));
-            }
-            return []; // installed but logged out — don't advertise models
+            const { stdout } = await execFileAsync("security", ["find-generic-password", "-s", "Claude Code-credentials", "-w"], { timeout: 8000 });
+            if (stdout && stdout.trim())
+                raw = stdout.trim();
+        }
+        catch { /* not in keychain */ }
+    }
+    if (!raw)
+        return [];
+    try {
+        const oauth = (JSON.parse(raw)?.claudeAiOauth ?? {});
+        const expiresAt = Number(oauth.expiresAt ?? 0);
+        if (oauth.accessToken && (!expiresAt || Date.now() < expiresAt)) {
+            const names = await fetchClaudeFamilies(oauth.accessToken);
+            return names.map((name) => ({ provider: "claude_code", name }));
+        }
+    }
+    catch { /* malformed creds → treat as logged out */ }
+    return []; // not logged in / expired → don't advertise models
+}
+/** OpenAI Codex CLI is a subscription CLI (ChatGPT Plus/Pro) — when it's
+ *  logged in on this machine, advertise its models so the platform's picker
+ *  shows TRUE availability for local runs (codex pipelines execute HERE).
+ *
+ *  Same file-based approach as `detectClaudeCode`: read `~/.codex/auth.json`
+ *  directly rather than spawning `codex login status`. The subprocess flashed
+ *  a console window on Windows on every runner start (`windowsHide` is
+ *  unreliable through the `.cmd` shell wrapper). The file is the source of
+ *  truth cross-platform and mirrors what the runtime (model.py) authenticates
+ *  against. A ChatGPT login stores `tokens.access_token`; an API-key login
+ *  stores `OPENAI_API_KEY`. Either means "logged in". */
+async function detectCodex() {
+    let raw = null;
+    try {
+        raw = await readFile(join(homedir(), ".codex", "auth.json"), "utf8");
+    }
+    catch {
+        return [];
+    }
+    try {
+        const auth = JSON.parse(raw);
+        const loggedIn = !!(auth?.tokens?.access_token || auth?.OPENAI_API_KEY);
+        if (loggedIn) {
+            const names = await readCodexModels();
+            return names.map((name) => ({ provider: "codex", name }));
         }
-        catch { /* not installed / not on PATH / non-JSON — try next candidate */ }
     }
-    return [];
+    catch { /* malformed creds → treat as logged out */ }
+    return []; // not logged in → don't advertise models
 }
 export async function detectModels() {
     const models = [];
@@ -57,5 +162,7 @@ export async function detectModels() {
     catch { /* not running */ }
     // Claude Code CLI — subscription auth on THIS machine
     models.push(...await detectClaudeCode());
+    // OpenAI Codex CLI — subscription auth on THIS machine
+    models.push(...await detectCodex());
     return models;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.0.73",
+  "version": "1.0.76",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "UNLICENSED",
   "private": false,