@miruzero/zgpt 0.1.3 → 0.1.4

package/README.md

@@ -14,7 +14,7 @@ This package contains only ChatGPT-specific runtime code:
 - direct HTTP/SSE transport
 - ChatGPT mutable state under `M:\Zero_ChatGPT\state`
 
-It contains no Zero Core, MCP, Agent orchestration, CLI adapter, or generic device/task runtime.
+It contains no Zero Core, MCP, Agent orchestration, or generic device/task runtime. The CLI is a thin adapter over the same public SDK exports.
 
 ## CLI
 
@@ -34,6 +34,27 @@ npx zgpt
 
 The package exposes the `zgpt` executable through npm's `bin` field. A local `npm install` does not add `node_modules/.bin` to the parent shell's PATH, so use `npx zgpt` for local installs or install globally for the bare `zgpt` command.
 
+### Hierarchical SDK → CLI automatic command discovery
+
+The CLI discovers top-level public SDK namespaces at runtime, and groups the methods under each namespace. New namespaces and methods appear automatically without a second command registry. Use `zgpt help`, `zgpt help profile`, or `zgpt api families` to browse:
+
+```sh
+zgpt help profile
+zgpt profile getMe
+zgpt profile getAuraIdentity
+zgpt conversation get conversation-id
+zgpt api models
+zgpt api models getModels
+zgpt api invoke "GET /public-api/conversation_limit"
+```
+
+- Preferred: `zgpt <namespace> <method> [arguments...]` dispatches to the same SDK owner function. Use `--args JSON_ARRAY` for structured parameters. Older `zgpt call namespace.function` remains compatible.
+- `zgpt api <family> <methodName>` groups the API catalog by `family` without duplicating routes. `zgpt api invoke "METHOD /route"` remains available, and supports `--path-values`, `--query`, `--options`, and `--body` for JSON input.
+- Explicit non-read operations need `--allow-write` and required arguments. The generic adapter does not invent request payloads or permissions.
+- Results are JSON and credentials in recognized sensitive fields are redacted for CLI output; direct JS callers receive unmodified objects.
+- On this host, `npm link` points to `M:\Zero_ChatGPT`, so source changes take effect in the next CLI process. For a separately installed or published npm package, its installed version must be updated to receive changes.
+
+
 ## Public API
 
 ```js
@@ -45,8 +66,35 @@ await chatgpt.conversation.get(id);
 await chatgpt.conversation.send(id, message);
 await chatgpt.project.listProjects(options);
 await chatgpt.connector.listConnectors(options);
+
+// Profile and Chat settings (only when entitled; writes require explicit bodies)
+await chatgpt.profile.getMe();
+await chatgpt.profile.getCreator();
+await chatgpt.profile.updateCreator({ body: { display_name: 'Sky' } });
+await chatgpt.settings.getUser();
+await chatgpt.settings.getConsent();
+await chatgpt.settings.getNotifications();
+await chatgpt.profile.getAuraIdentity();  // GET /backend-api/aura/identity
+
+// ChatGPT Web API catalog: saved Web evidence plus verified supplemental routes.
+// Generic routes require appropriate account permissions and exact request contracts.
+console.log(chatgpt.api.summary.total); // 1287 (includes provisional paths)
+const route = chatgpt.api.find({ method: 'GET', route: '/api/auth/session' });
+const authSession = await chatgpt.api.invoke(route.key);
+const limits = await chatgpt.api.invoke('GET /public-api/conversation_limit');
+// Never log authSession: it can contain authentication credentials.
+
+// Parameterized route and explicit one-shot writes (only with a verified payload):
+// await chatgpt.api.invoke('POST /backend-api/hosting/sites/{id}/access',
+//   { pathValues: [siteId], body: verifiedBody });
 ```
 
+Discovered Web endpoints and their evidence are stored in `src/api/discovered.json`.
+Historical endpoints remain in `src/api/catalog.json`; the runtime combines both.
+`api.byKey`, `api.functions` and `api.groups` provide typed route-name dispatch.
+This is an **undocumented Web endpoint catalog**, not a guarantee of API stability,
+authorization, correct mutation payloads, or complete browser-feature parity.
+
 ## Runtime rules
 
 - Direct ChatGPT Web transport is the only conversation transport.

package/docs/architecture.md

@@ -7,7 +7,7 @@
 ## Runtime
 
 ```text
-auth / session / conversation / project / connector / file / memory / settings / share
+auth / session / conversation / project / connector / file / memory / settings / profile / share / api
                     |
                  protocol
 sentinel / proof / conduit / payload / SSE
@@ -43,7 +43,9 @@ The state directory is the only default writer for ChatGPT runtime state.
 - `connector` owns ChatGPT Chat connector discovery, app metadata, system hints, actions, refresh, and mention resolution.
 - `file` owns Chat composer file reservation, file-entry creation, upload processing, and reservation finalization.
 - `memory` owns Chat memory reads used by the normal Chat surface.
-- `settings` owns normal Chat user settings and explicit user-setting mutations.
+- `settings` owns normal Chat user settings, consent, notifications, voice options, locale and explicit model-preference mutations.
+- `profile` owns profile reads including the Chrome extension's Aura identity GET, GPT creator profile writes and explicitly addressed account user profile updates; no implicit account mutation.
+- `api` exposes an evidence-backed route catalog (historical and supplemental), with a shared direct transport and proper `/public-api` routing; it is not a separate independent Core/Agent or a promise that each route is an implemented or supported feature. Work-only candidate routes carry explicit scope/evidence flags.
 - `share` owns normal Chat conversation share lifecycle.
 - `protocol` owns ChatGPT Web payload, Sentinel, conduit, and SSE mechanics.
 - `transport` owns HTTP, headers, retries, cooldown, and session-cookie persistence.
@@ -72,6 +74,4 @@ conversation is the only owner of stream diagnosis and repair. Callers request a
 5. External ChatGPT responses are validated before state mutation.
 6. This package owns only ChatGPT runtime state.
 7. No Zero Core, MCP, Agent, device, task, or adapter implementation lives here.
-8. No background polling or hidden retry loop is allowed; recovery work occurs only on the active demand or an explicit retry demand.
-
-
+8. No background polling or hidden retry loop is allowed; recovery work occurs only on the active demand or an explicit retry demand.

package/package.json

@@ -1,13 +1,16 @@
 {
   "name": "@miruzero/zgpt",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "type": "commonjs",
   "main": "src/index.js",
   "bin": {
     "zgpt": "src/cli.js"
   },
   "scripts": {
-    "test": "node --test"
+    "start": "src/cli.js",
+    "test": "node --test",
+    "api:rescan": "node scripts/collect-web-api.js",
+    "api:reconcile": "node scripts/reconcile-web-api.js"
   },
   "engines": {
     "node": ">=20"

package/src/api/discovered.json

@@ -0,0 +1,165 @@
+{
+  "source": "2026-10-11 local OSSGPT, OSSGPT1 and Chrome extension evidence; supplemental to historical catalog",
+  "entries": [
+    {
+      "key": "GET /api/auth/session",
+      "method": "GET",
+      "route": "/api/auth/session",
+      "name": "getWebAuthSession",
+      "family": "auth",
+      "client": "Request",
+      "evidence": [
+        "CAPTURE_OSSGPT1"
+      ],
+      "captureCount": 2,
+      "statuses": {
+        "200": 2
+      },
+      "scope": "WEB_AUTH",
+      "verification": "CAPTURED_SUCCESS"
+    },
+    {
+      "key": "GET /backend-api/aura/identity",
+      "method": "GET",
+      "route": "/backend-api/aura/identity",
+      "name": "getAuraIdentity",
+      "family": "profile",
+      "client": "Request",
+      "evidence": [
+        "EXTENSION_BACKGROUND_FETCH"
+      ],
+      "captureCount": 0,
+      "statuses": {},
+      "scope": "CHATGPT_BROWSER_EXTENSION",
+      "verification": "STATIC_CALLSITE"
+    },
+    {
+      "key": "GET /backend-api/diag",
+      "method": "GET",
+      "route": "/backend-api/diag",
+      "name": "getWebDiagnostics",
+      "family": "diag",
+      "client": "Request",
+      "evidence": [
+        "CAPTURE_OSSGPT1"
+      ],
+      "captureCount": 2,
+      "statuses": {
+        "200": 2
+      },
+      "scope": "WEB_DIAGNOSTICS",
+      "verification": "CAPTURED_SUCCESS"
+    },
+    {
+      "key": "GET /backend-api/hosting/sites/{id}/access",
+      "method": "GET",
+      "route": "/backend-api/hosting/sites/{id}/access",
+      "name": "getHostingSiteAccess",
+      "family": "hosting",
+      "client": "Request",
+      "evidence": [
+        "STATIC_OSSGPT"
+      ],
+      "captureCount": 0,
+      "statuses": {},
+      "scope": "WORK_HOSTING",
+      "verification": "STATIC_CALLSITE"
+    },
+    {
+      "key": "GET /backend-api/models/",
+      "method": "GET",
+      "route": "/backend-api/models/",
+      "name": "getModelsTrailingSlash",
+      "family": "models",
+      "client": "Request",
+      "evidence": [
+        "CAPTURE_OSSGPT1"
+      ],
+      "captureCount": 1,
+      "statuses": {
+        "307": 1
+      },
+      "scope": "CHATGPT_WEB_REDIRECT_ALIAS",
+      "verification": "CAPTURED_REDIRECT_ONLY"
+    },
+    {
+      "key": "GET /public-api/conversation_limit",
+      "method": "GET",
+      "route": "/public-api/conversation_limit",
+      "name": "getPublicConversationLimitActualPath",
+      "family": "public-request",
+      "client": "PublicRequest",
+      "evidence": [
+        "CAPTURE_OSSGPT"
+      ],
+      "captureCount": 1,
+      "statuses": {
+        "200": 1
+      },
+      "scope": "CHATGPT_WEB_PUBLIC",
+      "verification": "CAPTURED_SUCCESS"
+    },
+    {
+      "key": "GET /public-api/gizmos/{id}",
+      "method": "GET",
+      "route": "/public-api/gizmos/{id}",
+      "name": "getPublicGizmoActualPath",
+      "family": "public-request",
+      "client": "PublicRequest",
+      "evidence": [
+        "CAPTURE_OSSGPT"
+      ],
+      "captureCount": 3,
+      "statuses": {
+        "403": 3
+      },
+      "scope": "CHATGPT_WEB_PUBLIC",
+      "verification": "CAPTURED_FORBIDDEN_ONLY"
+    },
+    {
+      "key": "PATCH /backend-api/my/image/{id}/{id}",
+      "method": "PATCH",
+      "route": "/backend-api/my/image/{id}/{id}",
+      "name": "patchMyImageByIdByIdCandidate",
+      "family": "my",
+      "client": "Request",
+      "evidence": [
+        "STATIC_OSSGPT"
+      ],
+      "captureCount": 0,
+      "statuses": {},
+      "scope": "CHATGPT_WEB_DYNAMIC_PATH_UNVALIDATED",
+      "verification": "STATIC_DYNAMIC_ROUTE_CANDIDATE"
+    },
+    {
+      "key": "POST /backend-api/hosting/sites/{id}/access",
+      "method": "POST",
+      "route": "/backend-api/hosting/sites/{id}/access",
+      "name": "postHostingSiteAccess",
+      "family": "hosting",
+      "client": "Request",
+      "evidence": [
+        "STATIC_OSSGPT"
+      ],
+      "captureCount": 0,
+      "statuses": {},
+      "scope": "WORK_HOSTING",
+      "verification": "STATIC_CALLSITE"
+    },
+    {
+      "key": "POST /backend-api/hosting/sites/{id}/source_repository/read_credential",
+      "method": "POST",
+      "route": "/backend-api/hosting/sites/{id}/source_repository/read_credential",
+      "name": "postHostingSiteSourceCredentialRead",
+      "family": "hosting",
+      "client": "Request",
+      "evidence": [
+        "STATIC_OSSGPT"
+      ],
+      "captureCount": 0,
+      "statuses": {},
+      "scope": "WORK_HOSTING_SECURITY_SENSITIVE",
+      "verification": "STATIC_CALLSITE"
+    }
+  ]
+}

package/src/api/index.js

@@ -5,9 +5,21 @@ const auth = require('../auth');
 const paths = require('../config/paths');
 const direct = require('../transport/direct/http-client');
 const catalogData = require('./catalog.json');
+const discoveredData = require('./discovered.json');
 
-const catalog = Object.freeze(catalogData.entries.map((entry) => Object.freeze({ ...entry })));
-const summary = Object.freeze({ ...catalogData.summary, source: catalogData.source });
+const catalog = Object.freeze([...catalogData.entries, ...discoveredData.entries].map((entry) => Object.freeze({ ...entry })));
+if (new Set(catalog.map((entry) => entry.key)).size !== catalog.length ||
+    new Set(catalog.map((entry) => entry.name)).size !== catalog.length) {
+  throw new Error('ChatGPT Web API catalog contains duplicate keys or function names');
+}
+const summary = Object.freeze({
+  ...catalogData.summary,
+  total: catalog.length,
+  publicRequest: catalog.filter((entry) => entry.client === 'PublicRequest').length,
+  supplemental: discoveredData.entries.length,
+  source: catalogData.source,
+  supplementSource: discoveredData.source
+});
 
 const readSessionHeaders = (env) => {
   const file = paths.sessionFile(env);
@@ -103,7 +115,11 @@ exports.find = (criteria = {}) => exports.list(criteria)[0] || null;
 
 exports.invoke = async (reference, options = {}) => {
   const entry = resolveEntry(reference);
-  const target = appendQuery(renderRoute(entry.route, options), options.query);
+  const rendered = renderRoute(entry.route, options);
+  // PublicRequest uses /public-api as its base. Captured wire paths already include it.
+  const endpoint = entry.client === 'PublicRequest' && !rendered.startsWith('/public-api/')
+    ? '/public-api' + rendered : rendered;
+  const target = appendQuery(endpoint, options.query);
   const context = await bindContext(entry, options);
   const responseType = options.responseType === 'text' ? 'text' : 'json';
   const request = responseType === 'text'

package/src/cli/sdk-dispatch.js

@@ -0,0 +1,310 @@
+'use strict';
+
+// Generic CLI adapter for the public SDK. No duplicate endpoint registry or operation implementation.
+const forbiddenKeys = new Set(['__proto__', 'prototype', 'constructor']);
+const secretKey = /(?:access[_-]?token|refresh[_-]?token|id[_-]?token|auth(?:orization)?|cookie|password|passphrase|secret|credential|csrf|api[_-]?key|session[_-]?token|private[_-]?key)/i;
+const safeReaderName = /^(?:(?:get|list|read|find|search|has|is|can|check|describe|inspect|status)$|(?:get|list|read|find|search|has|is|can|check|describe|inspect|status)[A-Z_])/;
+const error = (message) => Object.assign(new Error(message), { code: 'CLI_USAGE', exitCode: 2 });
+const own = (obj, key) => {
+  if (!obj || typeof obj !== 'object' && typeof obj !== 'function' || forbiddenKeys.has(key)) return undefined;
+  const descriptor = Object.getOwnPropertyDescriptor(obj, key);
+  return descriptor && Object.hasOwn(descriptor, 'value') ? descriptor.value : undefined;
+};
+const json = (value) => JSON.stringify(value, null, 2);
+const redact = (value, depth = 0, seen = new WeakSet()) => {
+  if (depth > 30) return '[DEPTH_LIMIT]';
+  if (!value || typeof value !== 'object') return value;
+  if (seen.has(value)) return '[CIRCULAR]';
+  seen.add(value);
+  if (Array.isArray(value)) return value.map((entry) => redact(entry, depth + 1, seen));
+  return Object.fromEntries(Object.entries(value).map(([key, entry]) =>
+    [key, secretKey.test(key) ? '[REDACTED]' : redact(entry, depth + 1, seen)]));
+};
+const show = (stdout, value) => stdout(json(redact(value)));
+const jsonArgument = (input, flag, kind) => {
+  let value;
+  try { value = JSON.parse(input); }
+  catch { throw error(flag + ' requires valid JSON'); }
+  if (kind === 'array' && !Array.isArray(value)) throw error(flag + ' must be a JSON array');
+  if (kind === 'object' && (value === null || typeof value !== 'object' || Array.isArray(value)))
+    throw error(flag + ' must be a JSON object');
+  return value;
+};
+const optionsFrom = (args, allowed) => {
+  const flags = {};
+  for (let index = 0; index < args.length; index += 1) {
+    const key = args[index];
+    if (!allowed.includes(key)) throw error('Unknown option: ' + key);
+    if (Object.hasOwn(flags, key)) throw error('Duplicate option: ' + key);
+    if (key === '--allow-write' || key === '--json') { flags[key] = true; continue; }
+    if (index + 1 >= args.length || args[index + 1].startsWith('--'))
+      throw error('Missing value after ' + key);
+    flags[key] = args[++index];
+  }
+  return flags;
+};
+const getPublicFunction = (runtime, path) => {
+  if (typeof path !== 'string' || !/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+$/.test(path)) return null;
+  const parts = path.split('.');
+  if (parts[0] === 'api' || parts.some(part => forbiddenKeys.has(part))) return null;
+  let current = runtime;
+  for (const part of parts) current = own(current, part);
+  return typeof current === 'function' ? current : null;
+};
+const availableFunctions = (runtime, namespace) => {
+  const found = [];
+  const visit = (obj, prefix, depth) => {
+    if (!obj || typeof obj !== 'object' || depth > 5) return;
+    for (const key of Object.keys(obj)) {
+      if (forbiddenKeys.has(key)) continue;
+      const value = own(obj, key);
+      const name = prefix ? prefix + '.' + key : key;
+      if (typeof value === 'function') found.push(name);
+      else if (value && typeof value === 'object' && depth < 5) visit(value, name, depth + 1);
+    }
+  };
+  for (const owner of Object.keys(runtime)) {
+    if (owner === 'api' || forbiddenKeys.has(owner) || namespace && owner !== namespace) continue;
+    visit(own(runtime, owner), owner, 0);
+  }
+  return found.sort();
+};
+const writeRequired = (method) => !['GET','HEAD','OPTIONS'].includes(String(method || '').toUpperCase());
+
+const sdkNamespace = (runtime, key) => {
+  if (typeof key !== 'string' || !/^[A-Za-z_$][\w$]*$/.test(key) ||
+      key === 'api' || forbiddenKeys.has(key)) return null;
+  const candidate = own(runtime, key);
+  return candidate && typeof candidate === 'object' ? candidate : null;
+};
+const namespaceHelp = (runtime, name) => {
+  if (!sdkNamespace(runtime, name)) throw error('Unknown SDK namespace: ' + name);
+  const methods = availableFunctions(runtime, name).map(path => path.slice(name.length + 1));
+  return [
+    'zgpt ' + name + ' — SDK namespace',
+    '',
+    'Usage: zgpt ' + name + ' <method> [arguments...] [--args JSON_ARRAY] [--allow-write]',
+    'Methods (' + methods.length + '):',
+    ...methods.map(method => '  zgpt ' + name + ' ' + method),
+    '',
+    'Details: zgpt help ' + name,
+    'Run state-changing methods explicitly with --allow-write.'
+  ].join('\n');
+};
+const apiFamilies = (api) => {
+  const counts = new Map();
+  for (const item of Array.isArray(own(api, 'catalog')) ? api.catalog : []) {
+    if (typeof item.family === 'string' && item.family) {
+      counts.set(item.family, (counts.get(item.family) || 0) + 1);
+    }
+  }
+  return [...counts].sort((a, b) => a[0].localeCompare(b[0]));
+};
+const apiRootHelp = (api, complete = false) => {
+  const families = apiFamilies(api);
+  const visible = complete ? families : families.slice(0, 18);
+  return [
+    'zgpt api — ChatGPT Web API catalog',
+    '',
+    'Usage:',
+    '  zgpt api <family> [methodName]',
+    '  zgpt api <family> list [--method GET] [--json]',
+    '  zgpt api list [--family NAME] [--method GET] [--json]',
+    '  zgpt api show "GET /backend-api/..."',
+    '  zgpt api invoke "GET /backend-api/..."',
+    '',
+    'API families (' + families.length + '):',
+    ...visible.map(([name, count]) => '  ' + name.padEnd(27) + count + ' routes'),
+    ...(visible.length < families.length ? ['  ... (' + (families.length - visible.length) + ' more: zgpt api families)'] : []),
+    '',
+    'View a family: zgpt api <family>',
+    'Routes are evidence-backed and not all are live-verified.'
+  ].join('\n');
+};
+const apiFamilyHelp = (api, family) => {
+  const matching = api.catalog.filter(item => item.family === family);
+  if (!matching.length) throw error('Unknown API family: ' + family);
+  return [
+    'zgpt api ' + family + ' — ' + matching.length + ' routes',
+    '',
+    'Usage: zgpt api ' + family + ' <methodName> [--path-values JSON_ARRAY] [--query JSON_OBJECT]',
+    '',
+    ...matching.map(item => '  zgpt api ' + family + ' ' + item.name + '  [' + item.method + ' ' + item.route + ']'),
+    '',
+    'Writes require --allow-write. API routes may be provisional.'
+  ].join('\n');
+};
+exports.help = (runtime = require('../index')) => {
+  const categories = Object.keys(runtime)
+    .filter(name => name !== 'api' && sdkNamespace(runtime, name))
+    .sort()
+    .map(name => [name, availableFunctions(runtime, name).length]);
+  const api = own(runtime, 'api');
+  const total = api && Array.isArray(api.catalog) ? api.catalog.length : 0;
+  return [
+    'Zero ChatGPT CLI',
+    '',
+    'Usage:',
+    '  zgpt <namespace> <method> [arguments...] [--args JSON_ARRAY]',
+    '  zgpt help <namespace>',
+    '  zgpt api <family> <methodName> [options]',
+    '',
+    'SDK namespaces:',
+    ...categories.map(([name, count]) => '  ' + name.padEnd(17) + count + ' functions'),
+    ...(api ? ['  api'.padEnd(19) + total + ' catalog routes'] : []),
+    '',
+    'Examples:',
+    '  zgpt profile getMe',
+    '  zgpt project listProjects',
+    '  zgpt help profile',
+    '  zgpt api models',
+    '',
+    'Legacy aliases (still supported):',
+    '  zgpt login | logout | auth-status',
+    '  zgpt conversations list [--json]',
+    '  zgpt get <conversation-id> [--limit N|A-B] [--debug|--json]',
+    '  zgpt export <conversation-id> [--out <path>]',
+    '  zgpt retry <conversation-id>',
+    '  zgpt functions [--namespace NAME] [--json]',
+    '  zgpt call <namespace.function> [--args JSON_ARRAY] [--allow-write]',
+    '',
+    'Change operations require --allow-write on the grouped command interface.'
+  ].join('\n');
+};
+
+async function apiCommand(argv, runtime, stdout) {
+  const api = own(runtime, 'api');
+  if (!api) throw error('The loaded SDK has no API catalog');
+  const action = argv[1];
+  if (!action || action === 'help' || action === '--help') {
+    if (argv.length > 2) throw error('Usage: zgpt api help');
+    stdout(apiRootHelp(api));
+    return 0;
+  }
+  if (action === 'families') {
+    if (argv.length > 3 || argv[2] && argv[2] !== '--json') throw error('Usage: zgpt api families [--json]');
+    const families = apiFamilies(api);
+    if (argv[2] === '--json') show(stdout, families.map(([name,count]) => ({name,count})));
+    else stdout(apiRootHelp(api, true));
+    return 0;
+  }
+  // Any family discovered in the SDK catalog is a navigable CLI command.
+  if (!['list','show','invoke'].includes(action)) {
+    if (!Array.isArray(own(api, 'catalog'))) throw error('The loaded SDK does not expose api.catalog');
+    if (!apiFamilies(api).some(([name]) => name === action)) throw error('Unknown API family: ' + action);
+    const selected = argv[2];
+    if (!selected || selected === 'help' || selected === '--help') {
+      if (argv.length > 3) throw error('Usage: zgpt api ' + action + ' help');
+      stdout(apiFamilyHelp(api, action));
+      return 0;
+    }
+    if (selected === 'list') {
+      const flags = optionsFrom(argv.slice(3), ['--method','--json']);
+      const rows = api.catalog.filter(item => item.family === action &&
+        (!flags['--method'] || item.method === flags['--method'].toUpperCase()));
+      if (flags['--json']) show(stdout, rows);
+      else stdout(rows.map(item => item.key).join('\\n'));
+      return 0;
+    }
+    const entry = api.catalog.find(item => item.family === action &&
+      (item.name === selected || item.key === selected));
+    if (!entry) throw error('Unknown API method in ' + action + ': ' + selected);
+    return apiCommand(['api','invoke',entry.key,...argv.slice(3)], runtime, stdout);
+  }
+  if (action === 'list') {
+    if (typeof own(api, 'list') !== 'function') throw error('The loaded SDK does not expose api.list');
+    const opts = optionsFrom(argv.slice(2), ['--family', '--method', '--json']);
+    const criteria = {};
+    if (opts['--family']) criteria.family = opts['--family'];
+    if (opts['--method']) criteria.method = opts['--method'].toUpperCase();
+    const rows = api.list(criteria);
+    if (opts['--json']) show(stdout, rows);
+    else stdout(rows.map(item => item.key).join('\n'));
+    return 0;
+  }
+  if (action === 'show') {
+    if (!Array.isArray(own(api, 'catalog'))) throw error('The loaded SDK does not expose api.catalog');
+    const key = argv[2];
+    if (!key || argv.length !== 3) throw error('Usage: zgpt api show "GET /backend-api/..."');
+    const entry = api.catalog.find(item => item.key === key || item.name === key);
+    if (!entry) throw error('Unknown API capability: ' + key);
+    show(stdout, entry);
+    return 0;
+  }
+  if (action === 'invoke') {
+    if (!Array.isArray(own(api, 'catalog')) || typeof own(api, 'invoke') !== 'function')
+      throw error('The loaded SDK does not expose api.invoke/catalog');
+    const key = argv[2];
+    if (!key) throw error('API method and route key required');
+    const entry = api.catalog.find(item => item.key === key || item.name === key);
+    if (!entry) throw error('Unknown API capability: ' + key);
+    const flags = optionsFrom(argv.slice(3),
+      ['--path-values', '--query', '--body', '--options', '--allow-write']);
+    const options = flags['--options'] === undefined ? {} : jsonArgument(flags['--options'], '--options', 'object');
+    for (const key of ['token','sessionHeaders','requestJson','requestText','env','sessionFile','headers','rawResponse','auth'])
+      if (Object.hasOwn(options, key)) throw error('CLI cannot override SDK authentication/transport: ' + key);
+    if (flags['--path-values']) options.pathValues = jsonArgument(flags['--path-values'], '--path-values', 'array');
+    if (flags['--query']) options.query = jsonArgument(flags['--query'], '--query', 'object');
+    if (flags['--body']) options.body = jsonArgument(flags['--body'], '--body', 'object');
+    if (writeRequired(entry.method) && !flags['--allow-write']) throw error('Non-read API requires --allow-write');
+    if (!writeRequired(entry.method) && Object.hasOwn(options, 'body')) throw error('Read-only API cannot use --body');
+    show(stdout, await api.invoke(entry.key, options));
+    return 0;
+  }
+  throw error('Usage: zgpt api list|show|invoke');
+}
+
+async function callCommand(argv, runtime, stdout) {
+  const name = argv[1];
+  const fn = getPublicFunction(runtime, name);
+  if (!fn) throw error('Unknown SDK function: ' + (name || '(missing)'));
+  const tail = argv.slice(2);
+  const firstFlag = tail.findIndex(item => item.startsWith('--'));
+  const positionals = firstFlag === -1 ? tail : tail.slice(0, firstFlag);
+  const flags = optionsFrom(firstFlag === -1 ? [] : tail.slice(firstFlag), ['--args', '--allow-write']);
+  if (positionals.length && flags['--args'] !== undefined) throw error('Use positional arguments or --args, not both');
+  const args = flags['--args'] === undefined ? positionals : jsonArgument(flags['--args'], '--args', 'array');
+  const method = name.split('.').at(-1);
+  if (!safeReaderName.test(method) && !flags['--allow-write']) throw error('Mutating/unknown SDK function requires --allow-write');
+  show(stdout, await fn(...args));
+  return 0;
+}
+
+exports.run = async (argv, options = {}) => {
+  const runtime = options.runtime || require('../index');
+  const stdout = options.stdout || console.log;
+  const stderr = options.stderr || console.error;
+  try {
+    if (argv[0] === 'help' || argv[0] === '--help' || argv[0] === '-h') {
+      const name = argv[1];
+      if (argv.length > 3 || argv.length === 3 && name !== 'api') throw error('Usage: zgpt help [namespace]');
+      if (!name) stdout(exports.help(runtime));
+      else if (name === 'api') stdout(argv[2] ? apiFamilyHelp(own(runtime, 'api'), argv[2]) : apiRootHelp(own(runtime, 'api')));
+      else stdout(namespaceHelp(runtime, name));
+      return 0;
+    }
+    if (argv[0] === 'functions') {
+      const flags = optionsFrom(argv.slice(1), ['--namespace','--json']);
+      if (flags['--namespace'] && !Object.hasOwn(runtime, flags['--namespace']))
+        throw error('Unknown SDK namespace: ' + flags['--namespace']);
+      const names = availableFunctions(runtime, flags['--namespace']);
+      if (flags['--json']) show(stdout, names);
+      else stdout(names.join('\n'));
+      return 0;
+    }
+    if (argv[0] === 'api') return await apiCommand(argv, runtime, stdout);
+    if (argv[0] === 'call') return await callCommand(argv, runtime, stdout);
+    if (sdkNamespace(runtime, argv[0])) {
+      if (!argv[1] || argv[1] === 'help' || argv[1] === '--help') {
+        if (argv.length > 2) throw error('Usage: zgpt ' + argv[0] + ' [method]');
+        stdout(namespaceHelp(runtime, argv[0]));
+        return 0;
+      }
+      return await callCommand(['call', argv[0] + '.' + argv[1], ...argv.slice(2)], runtime, stdout);
+    }
+    throw error('Unknown SDK namespace or dispatch command: ' + (argv[0] || '(missing)'));
+  } catch (cause) {
+    stderr((cause.code === 'CLI_USAGE' ? '' : (cause.code ? cause.code + ': ' : '')) + (cause.message || 'SDK dispatch failed'));
+    return cause.exitCode || 1;
+  }
+};

package/src/cli.js

@@ -5,19 +5,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const formatter = require('./cli/formatter');
 
-const usage = () => [
-  'Zero ChatGPT CLI',
-  '',
-  'Usage:',
-  '  zgpt login',
-  '  zgpt logout',
-  '  zgpt auth-status',
-  '  zgpt conversations list [--json]',
-  '  zgpt retry <conversation-id>',
-  '  zgpt get <conversation-id> [--limit N|A-B] [--debug|--json]',
-  '  zgpt export <conversation-id> [--limit N|A-B] [--debug|--json] [--out <path>]',
-  '  zgpt help'
-].join('\n');
+const usage = () => require('./cli/sdk-dispatch').help();
 
 const parseOptions = (argv) => {
   const result = { json: false, debug: false, limit: null, out: null };
@@ -49,9 +37,14 @@ exports.run = async (argv = [], options = {}) => {
   const stderr = options.stderr || console.error;
   const command = argv[0] || 'help';
   if (command === 'help' || command === '--help' || command === '-h') {
-    stdout(usage());
-    return 0;
+    return require('./cli/sdk-dispatch').run(argv, { ...options, stdout, stderr });
   }
+  // SDK namespaces are routed dynamically; legacy aliases below remain compatible.
+  const runtime = options.runtime || require('./index');
+  if (command === 'functions' || command === 'call' || command === 'api' ||
+      Object.hasOwn(runtime, command) && command !== 'api' && typeof runtime[command] === 'object') {
+    return require('./cli/sdk-dispatch').run(argv, { ...options, runtime, stdout, stderr });
+  }
   if (!['login', 'logout', 'auth-status', 'conversations', 'get', 'export', 'stream-status', 'retry', 'resume'].includes(command)) {
     stderr(`Unknown command: ${command}\n\n${usage()}`);
     return 2;

package/src/index.js

@@ -9,6 +9,5 @@ exports.file = require('./file');
 exports.memory = require('./memory');
 exports.settings = require('./settings');
 exports.share = require('./share');
-
-
-
+exports.profile = require('./profile');
+exports.api = require('./api');

package/src/profile/index.js

@@ -0,0 +1,41 @@
+'use strict';
+const context = require('../runtime-context');
+const direct = require('../transport/direct/http-client');
+
+const bodyRequired = (value) => {
+  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).length === 0)
+    throw Object.assign(new Error('body must be a nonempty object'), { code: 'BAD_ARGS' });
+  return value;
+};
+const idRequired = (value, name) => {
+  if (typeof value !== 'string' || value.trim().length === 0)
+    throw Object.assign(new Error(name + ' is required'), { code: 'BAD_ARGS' });
+  return encodeURIComponent(value);
+};
+const call = async (target, method, options) => {
+  const resolved = await context.bind(options);
+  const route = method === 'PATCH' ? '/backend-api/accounts/{id}/users/{id}' : target;
+  const args = { method, route, retry: false };
+  if (method !== 'GET') args.body = bodyRequired(resolved.body);
+  const response = await (resolved.requestJson || direct.requestJson)(target, resolved.token, resolved.sessionHeaders, args);
+  if (!response || response.status < 200 || response.status >= 300)
+    throw Object.assign(new Error('ChatGPT profile request failed (' + (response?.status || 'no-status') + '): ' + target), {
+      status: response?.status || null, code: response?.status === 429 ? 'RATE_LIMITED' : 'PROFILE_REQUEST_FAILED', target
+    });
+  if (method === 'GET' && (response.json === undefined || response.json === null))
+    throw Object.assign(new Error('Profile response missing JSON'), { code: 'PROFILE_BAD_RESPONSE' });
+  return response.json || { success: true };
+};
+
+// These are captured/static Web Chat routes. Callers must be entitled to the requested surface.
+exports.getMe = (options = {}) => call('/backend-api/profiles/me', 'GET', options);
+exports.getIdentity = (options = {}) => call('/backend-anon/me', 'GET', options);
+exports.getAuraIdentity = (options = {}) => call('/backend-api/aura/identity', 'GET', options);
+exports.getCreator = (options = {}) => call('/backend-api/gizmo_creator_profile', 'GET', options);
+exports.updateCreator = (options = {}) => call('/backend-api/gizmo_creator_profile', 'POST', options);
+exports.updateWorkspaceUser = async (options = {}) => {
+  const a = idRequired(options.accountId, 'accountId');
+  const u = idRequired(options.userId, 'userId');
+  bodyRequired(options.body);
+  return call('/backend-api/accounts/' + a + '/users/' + u, 'PATCH', options);
+};

package/src/session/direct-transport.js

@@ -1,68 +1,60 @@
-'use strict';
-
-const fs = require('node:fs');
-const paths = require('../config/paths');
-const direct = require('../transport/direct/http-client');
-
-const readJson = (file) => { try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; } };
-const mergeSetCookies = (cookieString, setCookie) => {
-  const jar = new Map();
-  const add = (entry) => {
-    const first = String(entry || '').split(';')[0];
-    const index = first.indexOf('=');
-    if (index > 0) jar.set(first.slice(0, index).trim(), first.slice(index + 1).trim());
-  };
-  for (const pair of String(cookieString || '').split(';')) add(pair);
-  for (const entry of Array.isArray(setCookie) ? setCookie : [setCookie]) add(entry);
-  return [...jar].map(([name, value]) => `${name}=${value}`).join('; ');
-};
-const bootstrapHeaders = (env) => {
-  const state = readJson(paths.sessionFile(env)) || {};
-  const saved = state.headers && typeof state.headers === 'object' && !Array.isArray(state.headers) ? state.headers : {};
-  const { Cookie: _cookie, cookie: _cookieLower, authorization: _authorization, ...safe } = saved;
-  return {
-    ...safe,
-    origin: safe.origin || 'https://chatgpt.com',
-    referer: safe.referer || 'https://chatgpt.com/',
-    accept: safe.accept || 'application/json'
-  };
-};
-
-exports.createTransport = ({ requestJson = direct.requestJson } = {}) => async ({ sessionMarker, workspaceAccountId = null, env = process.env } = {}) => {
-  if (!sessionMarker || typeof sessionMarker !== 'string') {
-    throw Object.assign(new Error('Missing local ChatGPT session marker'), { code: 'CHATGPT_SESSION_MARKER_MISSING' });
-  }
-  const sessionFile = paths.sessionFile(env);
-  const sessionHeaders = bootstrapHeaders(env);
-  const first = await requestJson('/api/auth/session', sessionMarker, sessionHeaders, {
-    route: '/api/auth/session', env, sessionFile, persistSession: false
-  });
-  if (![200, 403].includes(Number(first?.status))) {
-    throw Object.assign(new Error('ChatGPT session bootstrap round one failed'), { code: 'CHATGPT_SESSION_BOOTSTRAP_FAILED', status: first?.status || 0 });
-  }
-  const cookie = mergeSetCookies('', first?.headers?.['set-cookie']);
-  if (!cookie) {
-    throw Object.assign(new Error('ChatGPT session bootstrap did not return a cookie'), { code: 'CHATGPT_SESSION_BOOTSTRAP_COOKIE_MISSING', status: first?.status || 0 });
-  }
-  sessionHeaders.Cookie = cookie;
-  const switched = await requestJson('/account-switch/switch', null, sessionHeaders, {
-    method: 'POST',
-    body: workspaceAccountId ? { workspaceAccountId } : {},
-    route: '/account-switch/switch',
-    headers: { 'OAI-Account-Switch-Session-Token': sessionMarker },
-    env,
-    sessionFile,
-    persistSession: false
-  });
-  if (!switched || switched.status < 200 || switched.status >= 300) {
-    throw Object.assign(new Error('ChatGPT direct session exchange failed'), { code: 'CHATGPT_SESSION_EXCHANGE_FAILED', status: switched?.status || 0 });
-  }
-  const switchedCookie = mergeSetCookies(sessionHeaders.Cookie, switched?.headers?.['set-cookie']);
-  if (switchedCookie) sessionHeaders.Cookie = switchedCookie;
-  const second = await requestJson('/api/auth/session', null, sessionHeaders, {
-    route: '/api/auth/session', env, sessionFile, persistSession: false
-  });
-  return { status: Number(second?.status || 0), body: second?.json ?? null, sessionHeaders };
-};
-
-exports.transport = exports.createTransport();
+'use strict';
+
+const fs = require('node:fs');
+const paths = require('../config/paths');
+const direct = require('../transport/direct/http-client');
+
+const readJson = (file) => { try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; } };
+const mergeSetCookies = (cookieString, setCookie) => {
+  const jar = new Map();
+  const add = (entry) => {
+    const first = String(entry || '').split(';')[0];
+    const index = first.indexOf('=');
+    if (index > 0) jar.set(first.slice(0, index).trim(), first.slice(index + 1).trim());
+  };
+  for (const pair of String(cookieString || '').split(';')) add(pair);
+  for (const entry of Array.isArray(setCookie) ? setCookie : [setCookie]) add(entry);
+  return [...jar].map(([name, value]) => `${name}=${value}`).join('; ');
+};
+const bootstrapHeaders = (env) => {
+  const state = readJson(paths.sessionFile(env)) || {};
+  const saved = state.headers && typeof state.headers === 'object' && !Array.isArray(state.headers) ? state.headers : {};
+  const { Cookie: _cookie, cookie: _cookieLower, authorization: _authorization, ...safe } = saved;
+  return {
+    ...safe,
+    origin: safe.origin || 'https://chatgpt.com',
+    referer: safe.referer || 'https://chatgpt.com/',
+    accept: safe.accept || 'application/json'
+  };
+};
+
+exports.createTransport = ({ requestJson = direct.requestJson } = {}) => async ({ sessionMarker, workspaceAccountId = null, env = process.env } = {}) => {
+  if (!sessionMarker || typeof sessionMarker !== 'string') {
+    throw Object.assign(new Error('Missing local ChatGPT session marker'), { code: 'CHATGPT_SESSION_MARKER_MISSING' });
+  }
+  const sessionFile = paths.sessionFile(env);
+  const sessionHeaders = bootstrapHeaders(env);
+  sessionHeaders.Cookie = mergeSetCookies(sessionHeaders.Cookie || sessionHeaders.cookie || '', `__Secure-next-auth.session-token=${sessionMarker}`);
+  delete sessionHeaders.cookie;
+
+  const first = await requestJson('/api/auth/session', null, sessionHeaders, {
+    route: '/api/auth/session', env, sessionFile, persistSession: false
+  });
+  if (![200, 403].includes(Number(first?.status))) {
+    throw Object.assign(new Error('ChatGPT session bootstrap round one failed'), { code: 'CHATGPT_SESSION_BOOTSTRAP_FAILED', status: first?.status || 0 });
+  }
+
+  sessionHeaders.Cookie = mergeSetCookies(sessionHeaders.Cookie, first?.headers?.['set-cookie']);
+  const firstBody = first?.json;
+  const firstAuthenticated = Boolean(firstBody && typeof firstBody === 'object' && !Array.isArray(firstBody) && (firstBody.user || firstBody.account || firstBody.accessToken || firstBody.sessionToken));
+  if (Number(first?.status) === 200 && firstAuthenticated) {
+    return { status: 200, body: firstBody, sessionHeaders };
+  }
+
+  const second = await requestJson('/api/auth/session', null, sessionHeaders, {
+    route: '/api/auth/session', env, sessionFile, persistSession: false
+  });
+  return { status: Number(second?.status || 0), body: second?.json ?? null, sessionHeaders };
+};
+
+exports.transport = exports.createTransport();

package/src/settings/index.js

@@ -15,4 +15,6 @@ exports.updateAccountUserSetting = async (options = {}) => {
   if (!options.body || typeof options.body !== 'object' || Array.isArray(options.body)) throw Object.assign(new Error('body is required'), { code: 'BAD_ARGS' });
   const target = '/backend-api/settings/account_user_setting';
   return requireOk(await (options.requestJson || direct.requestJson)(target, options.token, options.sessionHeaders, { method: 'PATCH', retry: false, route: target, body: options.body }), target);
-};
+};
+
+Object.assign(exports, require('./web'));

package/src/settings/web.js

@@ -0,0 +1,38 @@
+'use strict';
+const context = require('../runtime-context');
+const direct = require('../transport/direct/http-client');
+
+const invoke = async (route, method, options = {}) => {
+  const requestOptions = { route, method, retry: false };
+  if (method !== 'GET') {
+    if (!options.body || typeof options.body !== 'object' || Array.isArray(options.body) || Object.keys(options.body).length === 0)
+      throw Object.assign(new Error('body must be a nonempty object'), { code: 'BAD_ARGS' });
+    requestOptions.body = options.body;
+  }
+  const bound = await context.bind(options);
+  const response = await (bound.requestJson || direct.requestJson)(route, bound.token, bound.sessionHeaders, requestOptions);
+  if (!response || response.status < 200 || response.status >= 300) {
+    const error = new Error('ChatGPT settings request failed (' + (response?.status || 'no-status') + '): ' + route);
+    error.status = response?.status || null;
+    error.target = route;
+    error.code = response?.status === 429 ? 'RATE_LIMITED' : 'SETTINGS_REQUEST_FAILED';
+    throw error;
+  }
+  if (method === 'GET' && (response.json === undefined || response.json === null))
+    throw Object.assign(new Error('Settings response missing JSON'), { code: 'SETTINGS_BAD_RESPONSE' });
+  return response.json || { success: true };
+};
+
+exports.getVoices = (options = {}) => invoke('/backend-api/settings/voices', 'GET', options);
+exports.getTrainingDataUsage = (options = {}) => invoke('/backend-api/accounts/data_usage_for_training', 'GET', options);
+exports.getAgeVerificationEnabled = (options = {}) => invoke('/backend-api/settings/age_verification_enabled', 'GET', options);
+exports.getAdultStatus = (options = {}) => invoke('/backend-api/settings/is_adult', 'GET', options);
+exports.getConsent = (options = {}) => invoke('/backend-api/user_granular_consent', 'GET', options);
+exports.updateConsent = (options = {}) => invoke('/backend-api/user_granular_consent', 'POST', options);
+exports.getNotifications = (options = {}) => invoke('/backend-api/notifications/settings', 'GET', options);
+exports.updateNotifications = (options = {}) => invoke('/backend-api/notifications/settings', 'PATCH', options);
+exports.setDefaultModel = (options = {}) => invoke('/backend-api/settings/user_default_model_config', 'PATCH', options);
+exports.setLastUsedModel = (options = {}) => invoke('/backend-api/settings/user_last_used_model_config', 'PATCH', options);
+exports.setTppDefaultModel = (options = {}) => invoke('/backend-api/settings/user_tpp_default_model_config', 'PATCH', options);
+exports.setTppLastUsedModel = (options = {}) => invoke('/backend-api/settings/user_tpp_last_used_model_config', 'PATCH', options);
+exports.setLocale = (options = {}) => invoke('/backend-api/accounts/users/locale', 'PATCH', options);