@stage-labs/metro 0.1.0-beta.253 → 0.1.0-beta.255

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.253",
+  "version": "0.1.0-beta.255",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.253",
+  "version": "0.1.0-beta.255",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex-auth.ts

@@ -1,66 +1,106 @@
-import { readFileSync } from 'node:fs';
-import { homedir } from 'node:os';
+import { randomBytes, randomUUID } from 'node:crypto';
 import { join } from 'node:path';
 import { isRecord } from '@metro-labs/core/is-record';
-import { PendingLogins } from './pkce.js';
+import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
+import { ticketStore } from '@metro-labs/core/tickets';
+import { agentsDir } from '../agents/files.js';
+import { newPkce } from './pkce.js';
 import { nonEmpty } from './text.js';
 
-export const CODEX_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
-export const CODEX_ISSUER = 'https://auth.openai.com';
-export const CODEX_REDIRECT = 'http://localhost:1455/auth/callback';
-const SCOPE = 'openid profile email offline_access api.connectors.read api.connectors.invoke';
-const AUTH_CLAIM = 'https://api.openai.com/auth';
+const CODEX_ISSUER = 'https://auth.openai.com';
+export const CODEX_REDIRECT = 'http://127.0.0.1:1455/auth/callback';
+export const OPENAI_API = 'https://api.openai.com/v1';
+export const NEW_CLIENT = 'dynamic_agent_client';
+export const APP_NAME = 'Metro';
+export const PLAN_SCOPE = 'chatgpt.tokens.use.direct';
+export const CODEX_SIGN_IN = "Codex needs a ChatGPT sign-in: Metro now uses OpenAI's official Sign in with ChatGPT, so sign in again on the Model page.";
+const SCOPE = `openid profile email offline_access resource.invoke ${PLAN_SCOPE}`;
 const PROFILE_CLAIM = 'https://api.openai.com/profile';
-const ACCESS_TOKEN_TTL_MS = 55 * 60_000;
+const HOST_FILE = 'chatgpt-host.json';
+const HOST_RE = /^urn:uuid:[0-9a-f-]{36}$/;
+const PENDING_TTL_MS = 10 * 60_000;
+const DEFAULT_TTL_MS = 60 * 60_000;
+const RENEW_BEFORE_MS = 2 * 60_000;
+const AGAIN = 'press Continue with ChatGPT again';
 
 export interface CodexTokens {
+  clientId: string;
+  subject: string;
+  email: string | null;
   accessToken: string;
   refreshToken: string;
-  idToken: string;
-  accountId: string;
-  email: string | null;
-  plan: string | null;
+  expiresAt: number;
   savedAt: string;
 }
 
 export class CodexAuthError extends Error {}
 
-const pending = new PendingLogins(24);
+interface Pending {
+  verifier: string;
+  nonce: string;
+  clientId: string | null;
+  subject: string | null;
+}
+
+const pending = ticketStore<Pending>(PENDING_TTL_MS, 24);
+
+export function chatgptHostId(dir = agentsDir()): string {
+  const path = join(dir, HOST_FILE);
+  const saved = readJson<unknown>(path, null);
+  if (isRecord(saved) && typeof saved.hostId === 'string' && HOST_RE.test(saved.hostId)) return saved.hostId;
+  const made = `urn:uuid:${randomUUID()}`;
+  writeSecure(path, JSON.stringify({ hostId: made }));
+  return made;
+}
+
+function returning(previous: CodexTokens | null): Record<string, string> {
+  if (previous === null) return { client_id: NEW_CLIENT, agent_name_hint: APP_NAME };
+  return { client_id: previous.clientId, ...(previous.email === null ? {} : { login_hint: previous.email }) };
+}
 
-export function authorizeUrl(state: string, challenge: string, issuer = CODEX_ISSUER): string {
+export function beginLogin(previous: CodexTokens | null, hostId: string, issuer = CODEX_ISSUER, now = Date.now()): string {
+  const { verifier, challenge } = newPkce();
+  const nonce = randomBytes(32).toString('base64url');
+  const { ticket: state } = pending.mint({ verifier, nonce, clientId: previous?.clientId ?? null, subject: previous?.subject ?? null }, now);
   const query = new URLSearchParams({
+    ...returning(previous),
+    ext_agent_host_id: hostId,
     response_type: 'code',
-    client_id: CODEX_CLIENT_ID,
     redirect_uri: CODEX_REDIRECT,
     scope: SCOPE,
-    code_challenge: challenge,
-    code_challenge_method: 'S256',
-    id_token_add_organizations: 'true',
-    codex_cli_simplified_flow: 'true',
+    resource: OPENAI_API,
     state,
-    originator: 'codex_cli_rs',
+    nonce,
+    code_challenge_method: 'S256',
+    code_challenge: challenge,
   });
-  return `${issuer}/oauth/authorize?${query.toString()}`;
+  return `${issuer}/api/accounts/authorize?${query.toString()}`;
 }
 
-export function beginLogin(issuer = CODEX_ISSUER, now = Date.now()): { url: string; state: string } {
-  const { state, challenge } = pending.begin(now);
-  return { url: authorizeUrl(state, challenge, issuer), state };
-}
-
-export function parseCallback(raw: string): { code: string; state: string } {
+function queryOf(raw: string): URLSearchParams {
   const text = raw.trim();
-  let query: URLSearchParams;
   try {
-    query = new URL(text).searchParams;
+    return new URL(text).searchParams;
   } catch {
-    query = new URLSearchParams(text.replace(/^\?/, ''));
+    return new URLSearchParams(text.replace(/^\?/, ''));
   }
-  const code = query.get('code')?.trim() ?? '';
-  const state = query.get('state')?.trim() ?? '';
-  if (code === '' || state === '')
-    throw new CodexAuthError('paste the whole address the browser landed on; it carries code= and state=');
-  return { code, state };
+}
+
+const param = (query: URLSearchParams, name: string): string => query.get(name)?.trim() ?? '';
+
+function assertAllowed(query: URLSearchParams): void {
+  const error = param(query, 'error');
+  if (error === 'access_denied') throw new CodexAuthError('you did not allow Metro to use your ChatGPT plan, so nothing was saved');
+  if (error !== '') throw new CodexAuthError(`ChatGPT stopped the sign-in (${query.get('error_description') ?? error}); ${AGAIN}`);
+}
+
+export function parseCallback(raw: string): { code: string; state: string; clientId: string | null } {
+  const query = queryOf(raw);
+  assertAllowed(query);
+  const code = param(query, 'code');
+  const state = param(query, 'state');
+  if (code === '' || state === '') throw new CodexAuthError('paste the whole address the browser landed on; it carries code= and state=');
+  return { code, state, clientId: nonEmpty(param(query, 'client_id')) };
 }
 
 function decodeJwtPayload(jwt: string): Record<string, unknown> {
@@ -73,142 +113,74 @@ function decodeJwtPayload(jwt: string): Record<string, unknown> {
   }
 }
 
-
-export function claimsOf(idToken: string): { accountId: string | null; email: string | null; plan: string | null } {
-  const payload = decodeJwtPayload(idToken);
-  const auth = isRecord(payload[AUTH_CLAIM]) ? payload[AUTH_CLAIM] : {};
-  const profile = isRecord(payload[PROFILE_CLAIM]) ? payload[PROFILE_CLAIM] : {};
-  return {
-    accountId: nonEmpty(auth.chatgpt_account_id),
-    email: nonEmpty(payload.email) ?? nonEmpty(profile.email),
-    plan: nonEmpty(auth.chatgpt_plan_type),
-  };
+function identityOf(idToken: unknown, expected: { issuer: string; clientId: string; nonce: string }): { subject: string; email: string | null } {
+  const claims = decodeJwtPayload(typeof idToken === 'string' ? idToken : '');
+  const audience: unknown[] = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+  const subject = nonEmpty(claims.sub);
+  if (subject === null || claims.iss !== expected.issuer || !audience.includes(expected.clientId) || claims.nonce !== expected.nonce)
+    throw new CodexAuthError(`OpenAI sent back an identity that does not match this sign-in; ${AGAIN}`);
+  const profile = isRecord(claims[PROFILE_CLAIM]) ? claims[PROFILE_CLAIM] : {};
+  return { subject, email: nonEmpty(claims.email) ?? nonEmpty(profile.email) };
 }
 
-interface TokenResponse {
-  id_token?: unknown;
-  access_token?: unknown;
-  refresh_token?: unknown;
-}
-
-const EMPTY_TOKENS: CodexTokens = { accessToken: '', refreshToken: '', idToken: '', accountId: '', email: null, plan: null, savedAt: '' };
-
-function assertUsable(next: CodexTokens): CodexTokens {
-  if (next.accessToken === '' || next.refreshToken === '') throw new CodexAuthError('the token endpoint returned no usable tokens');
-  if (next.accountId === '') throw new CodexAuthError('the id token carries no ChatGPT account id; sign in with a ChatGPT account that has Codex');
-  return next;
-}
-
-const pick = (fresh: string | null, kept: string | null): string | null => fresh ?? kept;
-
-export function tokensFrom(body: unknown, previous: CodexTokens | null, now = new Date()): CodexTokens {
-  const res = (isRecord(body) ? body : {}) as TokenResponse;
-  const kept = previous ?? EMPTY_TOKENS;
-  const idToken = pick(nonEmpty(res.id_token), kept.idToken) ?? '';
-  const claims = claimsOf(idToken);
-  return assertUsable({
-    accessToken: nonEmpty(res.access_token) ?? '',
-    refreshToken: pick(nonEmpty(res.refresh_token), kept.refreshToken) ?? '',
-    idToken,
-    accountId: pick(claims.accountId, kept.accountId) ?? '',
-    email: pick(claims.email, kept.email),
-    plan: pick(claims.plan, kept.plan),
-    savedAt: now.toISOString(),
+async function tokenCall(issuer: string, form: Record<string, string>, fetchImpl: typeof fetch): Promise<Record<string, unknown>> {
+  const res = await fetchImpl(`${issuer}/api/accounts/oauth/token`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+    body: new URLSearchParams(form).toString(),
   });
-}
-
-async function tokenCall(issuer: string, init: RequestInit, fetchImpl: typeof fetch): Promise<unknown> {
-  const res = await fetchImpl(`${issuer}/oauth/token`, init);
   const raw = await res.text();
-  if (!res.ok) {
-    let detail = raw.slice(0, 300);
-    try {
-      const parsed: unknown = JSON.parse(raw);
-      if (isRecord(parsed)) detail = nonEmpty(parsed.error_description) ?? nonEmpty(parsed.error) ?? detail;
-    } catch {
-      detail = raw.slice(0, 300);
-    }
-    throw new CodexAuthError(`OpenAI refused the token request (${String(res.status)}): ${detail}`);
+  let parsed: unknown = null;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    parsed = null;
   }
-  return JSON.parse(raw) as unknown;
+  const body = isRecord(parsed) ? parsed : {};
+  if (!res.ok) throw new CodexAuthError(`OpenAI refused the token request (${String(res.status)}): ${nonEmpty(body.error_description) ?? nonEmpty(body.error) ?? raw.slice(0, 300)}`);
+  return body;
 }
 
-export async function finishLogin(
-  callback: string,
-  issuer = CODEX_ISSUER,
-  fetchImpl: typeof fetch = fetch,
-  now = Date.now(),
-): Promise<CodexTokens> {
-  const { code, state } = parseCallback(callback);
-  const verifier = pending.take(state, now);
-  if (verifier === null) throw new CodexAuthError('this sign-in link has expired or was started elsewhere; press Connect again');
-  return exchangeCode(issuer, code, verifier, CODEX_REDIRECT, fetchImpl, now);
+function tokensFrom(body: Record<string, unknown>, who: Pick<CodexTokens, 'clientId' | 'subject' | 'email'>, keptRefresh: string, now: number): CodexTokens {
+  const accessToken = nonEmpty(body.access_token) ?? '';
+  const refreshToken = nonEmpty(body.refresh_token) ?? keptRefresh;
+  if (accessToken === '' || refreshToken === '') throw new CodexAuthError(`OpenAI returned no usable tokens; ${AGAIN}`);
+  const ttl = typeof body.expires_in === 'number' && body.expires_in > 0 ? body.expires_in * 1000 : DEFAULT_TTL_MS;
+  return { clientId: who.clientId, subject: who.subject, email: who.email, accessToken, refreshToken, expiresAt: now + ttl, savedAt: new Date(now).toISOString() };
 }
 
-export async function exchangeCode(
-  issuer: string,
-  code: string,
-  verifier: string,
-  redirectUri: string,
-  fetchImpl: typeof fetch,
-  now = Date.now(),
-): Promise<CodexTokens> {
-  const body = new URLSearchParams({
-    grant_type: 'authorization_code',
-    code,
-    redirect_uri: redirectUri,
-    client_id: CODEX_CLIENT_ID,
-    code_verifier: verifier,
-  });
-  const res = await tokenCall(
+function clientOf(started: Pending, returned: string | null): string {
+  const clientId = started.clientId ?? returned;
+  if (clientId === null || clientId === NEW_CLIENT) throw new CodexAuthError(`ChatGPT did not finish registering Metro; ${AGAIN}`);
+  if (returned !== null && returned !== clientId) throw new CodexAuthError(`ChatGPT answered for another Metro registration; ${AGAIN}`);
+  return clientId;
+}
+
+export async function finishLogin(callback: string, issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<CodexTokens> {
+  const { code, state, clientId: returned } = parseCallback(callback);
+  const started = pending.take(state, now);
+  if (started === undefined) throw new CodexAuthError(`this sign-in link has expired or was started elsewhere; ${AGAIN}`);
+  const clientId = clientOf(started, returned);
+  const body = await tokenCall(
     issuer,
-    { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: body.toString() },
+    { grant_type: 'authorization_code', client_id: clientId, code, code_verifier: started.verifier, redirect_uri: CODEX_REDIRECT, resource: OPENAI_API },
     fetchImpl,
   );
-  return tokensFrom(res, null, new Date(now));
+  const who = identityOf(body.id_token, { issuer, clientId, nonce: started.nonce });
+  if (started.subject !== null && who.subject !== started.subject)
+    throw new CodexAuthError('this is another ChatGPT account than the one this connection signed in with; add a new connection for it');
+  const scopes = (nonEmpty(body.scope) ?? '').split(/\s+/);
+  if (!scopes.includes(PLAN_SCOPE)) throw new CodexAuthError('ChatGPT did not allow Metro to use your plan: sign in again and allow it (it needs ChatGPT Plus or Pro)');
+  return tokensFrom(body, { clientId, ...who }, '', now);
 }
 
-export async function refreshTokens(previous: CodexTokens, issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch): Promise<CodexTokens> {
-  const res = await tokenCall(
+export async function refreshTokens(previous: CodexTokens, issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<CodexTokens> {
+  const body = await tokenCall(
     issuer,
-    {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ client_id: CODEX_CLIENT_ID, grant_type: 'refresh_token', refresh_token: previous.refreshToken }),
-    },
+    { grant_type: 'refresh_token', client_id: previous.clientId, refresh_token: previous.refreshToken, resource: OPENAI_API },
     fetchImpl,
   );
-  return tokensFrom(res, previous);
+  return tokensFrom(body, previous, previous.refreshToken, now);
 }
 
-export const tokensStale = (tokens: CodexTokens, now = Date.now()): boolean =>
-  now - Date.parse(tokens.savedAt) > ACCESS_TOKEN_TTL_MS;
-
-function readAuthFile(home: string): Record<string, unknown> {
-  let raw: unknown;
-  try {
-    raw = JSON.parse(readFileSync(join(home, '.codex', 'auth.json'), 'utf8'));
-  } catch {
-    throw new CodexAuthError('no Codex CLI login on this machine (~/.codex/auth.json); run codex login there first, or connect here');
-  }
-  return isRecord(raw) ? raw : {};
-}
-
-export function readCodexCliAuth(home = homedir()): CodexTokens {
-  const raw = readAuthFile(home);
-  if (!isRecord(raw.tokens)) throw new CodexAuthError('~/.codex/auth.json holds no ChatGPT tokens (an API-key login cannot be reused here)');
-  const stored = raw.tokens;
-  const idToken = nonEmpty(stored.id_token) ?? '';
-  const claims = claimsOf(idToken);
-  const found: CodexTokens = {
-    accessToken: nonEmpty(stored.access_token) ?? '',
-    refreshToken: nonEmpty(stored.refresh_token) ?? '',
-    idToken,
-    accountId: nonEmpty(stored.account_id) ?? claims.accountId ?? '',
-    email: claims.email,
-    plan: claims.plan,
-    savedAt: nonEmpty(raw.last_refresh) ?? new Date(0).toISOString(),
-  };
-  if ([found.accessToken, found.refreshToken, found.accountId].includes('')) throw new CodexAuthError('~/.codex/auth.json is missing a token or the account id');
-  return found;
-}
+export const tokensStale = (tokens: CodexTokens, now = Date.now()): boolean => now >= tokens.expiresAt - RENEW_BEFORE_MS;

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex-stream.ts

@@ -15,8 +15,13 @@ interface Block {
 const responseOf = (data: Item): Item => (isRecord(data.response) ? data.response : {});
 const itemOf = (data: Item): Item => (isRecord(data.item) ? data.item : {});
 
+const PLAN_LIMIT = 'subscription_sharing_usage_limit_exceeded';
+const USAGE_URL = 'https://chatgpt.com/settings/usage';
+
+export const withUsageLink = (code: string, message: string): string => (code === PLAN_LIMIT ? `${message} Manage usage: ${USAGE_URL}` : message);
+
 function errorKind(code: string): string {
-  if (code === 'rate_limit_exceeded' || code === 'usage_limit_reached') return 'rate_limit_error';
+  if (code === 'rate_limit_exceeded' || code === 'usage_limit_reached' || code === PLAN_LIMIT) return 'rate_limit_error';
   if (code === 'context_length_exceeded' || code === 'invalid_prompt') return 'invalid_request_error';
   if (code === 'insufficient_quota') return 'permission_error';
   return 'api_error';
@@ -157,7 +162,8 @@ export class CodexEventTranslator {
   private failed(response: Item, fallback: string): string {
     this.done = true;
     const error = isRecord(response.error) ? response.error : {};
-    return errorFrame(errorKind(stringOf(error.code)), stringOf(error.message) || fallback);
+    const code = stringOf(error.code);
+    return errorFrame(errorKind(code), withUsageLink(code, stringOf(error.message) || fallback));
   }
 
   push(event: string, data: Item): string {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex.ts

@@ -1,20 +1,18 @@
 import { randomUUID } from 'node:crypto';
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { arch, platform, release } from 'node:os';
-import { codexVersion, learnCodexVersion } from './codex-version.js';
-import { refreshTokens, tokensStale, type CodexTokens } from './codex-auth.js';
-import { CodexEventTranslator } from './codex-stream.js';
+import { isRecord } from '@metro-labs/core/is-record';
+import { stringOf } from '@metro-labs/http/api-http';
+import { OPENAI_API, CODEX_SIGN_IN, refreshTokens, tokensStale, type CodexTokens } from './codex-auth.js';
+import { CodexEventTranslator, withUsageLink } from './codex-stream.js';
 import { ToolNames, toResponsesRequest } from './codex-translate.js';
 import { GatewayError, providerStatus, sendError, upstreamMessage, type Watch } from './forward.js';
 import { parseEvent, SseParser, type SseEvent } from './frames.js';
 import type { Connection } from './model-config.js';
 import { listCache } from './model-lists.js';
 import { answerWhole, currentOf, errorKind, reach, refreshed, relayTranslated, sessionHeader, type TokenSource, type TokenState } from './subscription.js';
-import { codexUsageBody, noteUsageHeaders, type Reported } from './usage.js';
+import { noteUsageHeaders } from './usage.js';
 
-const CODEX_BASE = 'https://chatgpt.com/backend-api/codex';
 const INVALID = [400, 404, 422];
-const USAGE_TIMEOUT_MS = 10_000;
 
 export interface CodexDeps {
   base?: string;
@@ -36,25 +34,14 @@ const sourceOf = (deps: CodexDeps): TokenSource<CodexTokens> => ({
   save: deps.save,
 });
 
-const OS_NAMES: Record<string, string> = { darwin: 'Mac OS', linux: 'Linux', win32: 'Windows' };
-
-export const userAgent = (): string => `codex_cli_rs/${codexVersion()} (${OS_NAMES[platform()] ?? platform()} ${release()}; ${arch()}) metro`;
-
-function headersFor(tokens: CodexTokens, sessionId: string): Record<string, string> {
-  return {
-    authorization: `Bearer ${tokens.accessToken}`,
-    'chatgpt-account-id': tokens.accountId,
-    'content-type': 'application/json',
-    accept: 'text/event-stream',
-    originator: 'codex_cli_rs',
-    'user-agent': userAgent(),
-    'openai-beta': 'responses=experimental',
-    'session-id': sessionId,
-  };
-}
+const headersFor = (tokens: CodexTokens, accept: string): Record<string, string> => ({
+  authorization: `Bearer ${tokens.accessToken}`,
+  'content-type': 'application/json',
+  accept,
+});
 
 export const currentTokens = (conn: Connection, deps: CodexDeps, state: CodexState): Promise<CodexTokens> =>
-  currentOf(state, conn.id, conn.codex, sourceOf(deps), 'Codex is not connected: sign in on the Model page.');
+  currentOf(state, conn.id, conn.codex, sourceOf(deps), CODEX_SIGN_IN);
 
 interface Call {
   body: Record<string, unknown>;
@@ -67,15 +54,26 @@ interface Call {
 
 function send(call: Call, tokens: CodexTokens): Promise<Response> {
   const request = toResponsesRequest(call.body, call.model, { promptCacheKey: call.sessionId, names: call.names });
-  return (call.deps.fetchImpl ?? fetch)(`${call.deps.base ?? CODEX_BASE}/responses`, {
+  return (call.deps.fetchImpl ?? fetch)(`${call.deps.base ?? OPENAI_API}/responses`, {
     method: 'POST',
-    headers: headersFor(tokens, call.sessionId),
+    headers: headersFor(tokens, 'text/event-stream'),
     body: JSON.stringify(request),
     signal: call.watch.signal,
     redirect: 'manual',
   });
 }
 
+function refusalOf(text: string, status: number): string {
+  let code = '';
+  try {
+    const parsed: unknown = JSON.parse(text);
+    code = isRecord(parsed) && isRecord(parsed.error) ? stringOf(parsed.error.code) : '';
+  } catch {
+    code = '';
+  }
+  return withUsageLink(code, upstreamMessage(text, `OpenAI answered ${String(status)}`));
+}
+
 export async function codexMessages(
   req: IncomingMessage,
   res: ServerResponse,
@@ -95,7 +93,7 @@ export async function codexMessages(
   noteUsageHeaders('codex', conn.id, upstream.headers);
   if (!upstream.ok) {
     const text = await upstream.text();
-    sendError(res, providerStatus(upstream.status), errorKind(upstream.status, INVALID), upstreamMessage(text, `Codex answered ${String(upstream.status)}`));
+    sendError(res, providerStatus(upstream.status), errorKind(upstream.status, INVALID), refusalOf(text, upstream.status));
     return;
   }
   const translator = new CodexEventTranslator(model, (name) => call.names.restore(name));
@@ -111,45 +109,15 @@ export async function codexMessages(
   answerWhole(res, frames + translator.close(), conn.id);
 }
 
-const jsonHeaders = (tokens: CodexTokens): Record<string, string> => ({ ...headersFor(tokens, randomUUID()), accept: 'application/json' });
-
-export const codexUsageUrl = (base = CODEX_BASE): string => `${base.replace(/\/codex\/?$/, '')}/wham/usage`;
-
-export async function codexUsageNow(conn: Connection, deps: CodexDeps, state: CodexState): Promise<Reported | null> {
-  const fetchImpl = deps.fetchImpl ?? fetch;
-  const res = await reach(
-    () => currentTokens(conn, deps, state),
-    (tokens) => refreshed(state, conn.id, tokens, sourceOf(deps)),
-    (tokens) => fetchImpl(codexUsageUrl(deps.base), { headers: jsonHeaders(tokens), redirect: 'manual', signal: AbortSignal.timeout(USAGE_TIMEOUT_MS) }),
-  );
-  if (!res.ok) {
-    await res.body?.cancel();
-    throw new GatewayError(res.status, errorKind(res.status, INVALID), `Codex would not report its usage (${String(res.status)})`);
-  }
-  return codexUsageBody(await res.json());
-}
-
 export async function codexModels(tokens: CodexTokens, deps: Omit<CodexDeps, 'save'>): Promise<string[]> {
-  const version = await learnCodexVersion();
-  const base = deps.base ?? CODEX_BASE;
-  return codexLists.get(`${base}:${tokens.accountId}:${version}`, () => listCodex(tokens, version, base, deps.fetchImpl ?? fetch));
+  const base = deps.base ?? OPENAI_API;
+  return codexLists.get(`${base}:${tokens.clientId}`, () => listCodex(tokens, base, deps.fetchImpl ?? fetch));
 }
 
-async function listCodex(tokens: CodexTokens, version: string, base: string, fetchImpl: typeof fetch): Promise<string[]> {
-  const res = await fetchImpl(`${base}/models?client_version=${version}`, {
-    headers: jsonHeaders(tokens),
-    redirect: 'manual',
-  });
-  if (!res.ok) throw new GatewayError(res.status, errorKind(res.status, INVALID), `Codex would not list models (${String(res.status)})`);
-  const slugs = new Set<string>();
-  const walk = (value: unknown): void => {
-    if (Array.isArray(value)) value.forEach(walk);
-    else if (typeof value === 'object' && value !== null) {
-      const record = value as Record<string, unknown>;
-      if (typeof record.slug === 'string' && record.slug !== '') slugs.add(record.slug);
-      Object.values(record).forEach(walk);
-    }
-  };
-  walk(await res.json());
-  return [...slugs];
+async function listCodex(tokens: CodexTokens, base: string, fetchImpl: typeof fetch): Promise<string[]> {
+  const res = await fetchImpl(`${base}/models`, { headers: headersFor(tokens, 'application/json'), redirect: 'manual' });
+  if (!res.ok) throw new GatewayError(res.status, errorKind(res.status, INVALID), `OpenAI would not list the models of this ChatGPT plan (${String(res.status)})`);
+  const body: unknown = await res.json();
+  const models: unknown[] = isRecord(body) && Array.isArray(body.models) ? body.models : [];
+  return models.filter(isRecord).flatMap((m) => (m.visibility === 'list' && stringOf(m.slug) !== '' ? [stringOf(m.slug)] : []));
 }

package/runtime/node_modules/@metro-labs/daemon/src/gateway/effort.ts

@@ -38,16 +38,26 @@ export function requestKind(req: IncomingMessage, body: Body): RequestKind {
   return chore(body) ? 'other' : 'main';
 }
 
+const messagesOf = (body: Body): unknown[] => (Array.isArray(body.messages) ? body.messages : []);
+
+const askedEfforts = (body: Body): string[] => [body, ...messagesOf(body).map(record)].map(effortOf).filter((effort) => effort !== '');
+
 export function plannedEffort(req: IncomingMessage, body: Body): string | null {
-  const current = effortOf(body);
-  if (current === '') return null;
+  const asked = askedEfforts(body);
+  if (asked.length === 0) return null;
   const kind = requestKind(req, body);
   if (kind === 'other') return null;
   const wanted = kind === 'subagent' ? SUBAGENT_EFFORT : MAIN_EFFORT;
-  return wanted === current ? null : wanted;
+  return asked.every((effort) => effort === wanted) ? null : wanted;
 }
 
-export const withEffort = (body: Body, effort: string): Body => ({ ...body, output_config: { ...record(body.output_config), effort } });
+const withOwnEffort = (item: Body, effort: string): Body => (effortOf(item) === '' ? item : { ...item, output_config: { ...record(item.output_config), effort } });
+
+export function withEffort(body: Body, effort: string): Body {
+  const top = withOwnEffort(body, effort);
+  if (!Array.isArray(body.messages)) return top;
+  return { ...top, messages: body.messages.map((message: unknown) => (isRecord(message) ? withOwnEffort(message, effort) : message)) };
+}
 
 export function withoutEffort(body: Body): Body {
   const config = Object.fromEntries(Object.entries(record(body.output_config)).filter(([key]) => key !== 'effort'));

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-api.ts

@@ -22,7 +22,7 @@ import {
 } from './model-config.js';
 import { asApiError, BODY_MAX, claudeLoginDeps, connectionFor, settingsBody, type ModelApiDeps, type Route, type Store } from './model-store.js';
 import { dropUnusedClaudeLogins } from './claude-logins.js';
-import { CODEX_ROUTES, codexDeviceRoute, GEMINI_ROUTES } from './model-signin.js';
+import { CODEX_ROUTES, GEMINI_ROUTES } from './model-signin.js';
 import { refreshUsage } from './usage-refresh.js';
 
 const PATH = '/api/model';
@@ -36,8 +36,6 @@ const BEDROCK = '/api/model/bedrock/';
 const BUNDLE = '/api/model/bundle';
 const RESTORE = '/api/model/restore';
 const RESTORE_MAX = 64 * 1024;
-const DEVICE_PREFIX = 'device/';
-const DEVICE_ID_RE = /^[A-Za-z0-9_-]{16,64}$/;
 
 export type { ModelApiDeps } from './model-store.js';
 
@@ -164,21 +162,15 @@ function connectionsRoute(path: string, method: string | undefined): Route | num
   return 405;
 }
 
-function codexRoute(rest: string, method: string | undefined): Route | number {
-  if (rest in CODEX_ROUTES) return named(CODEX_ROUTES, rest, method);
-  const id = rest.startsWith(DEVICE_PREFIX) ? rest.slice(DEVICE_PREFIX.length) : '';
-  if (!DEVICE_ID_RE.test(id)) return 404;
-  return codexDeviceRoute(id, method);
-}
-
 const TABLES: [string, Record<string, Route>][] = [
   [OPENROUTER, OPENROUTER_ROUTES],
   [ANTHROPIC, ANTHROPIC_ROUTES],
   [BEDROCK, BEDROCK_ROUTES],
   [GEMINI, GEMINI_ROUTES],
+  [CODEX, CODEX_ROUTES],
 ];
 const EXACT = new Set([PATH, FALLBACKS, BUNDLE, RESTORE, CONNECTIONS]);
-const PREFIXES = [`${CONNECTIONS}/`, CODEX, ...TABLES.map(([prefix]) => prefix)];
+const PREFIXES = [`${CONNECTIONS}/`, ...TABLES.map(([prefix]) => prefix)];
 
 const mine = (path: string): boolean => EXACT.has(path) || PREFIXES.some((prefix) => path.startsWith(prefix));
 
@@ -187,8 +179,7 @@ function routeFor(path: string, method: string | undefined): Route | number {
   if (path === BUNDLE || path === RESTORE) return bundleRoute(path, method);
   if (path === CONNECTIONS || path.startsWith(`${CONNECTIONS}/`)) return connectionsRoute(path, method);
   const table = TABLES.find(([prefix]) => path.startsWith(prefix));
-  if (table !== undefined) return named(table[1], path.slice(table[0].length), method);
-  return codexRoute(path.slice(CODEX.length), method);
+  return table === undefined ? 404 : named(table[1], path.slice(table[0].length), method);
 }
 
 export function handleModelRequest(req: IncomingMessage, res: ServerResponse, deps: ModelApiDeps): boolean {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-config.ts

@@ -3,7 +3,7 @@ import { ID_RE, newId } from '@metro-labs/core/ids';
 import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
 import { agentsDir } from '../agents/files.js';
 import { isRecord } from '@metro-labs/core/is-record';
-import { claimsOf, type CodexTokens } from './codex-auth.js';
+import { CODEX_SIGN_IN, NEW_CLIENT, type CodexTokens } from './codex-auth.js';
 import { tokensFromDisk as geminiTokensFromDisk, type GeminiTokens } from './gemini-auth.js';
 
 export const PROVIDERS = ['anthropic', 'bedrock', 'openrouter', 'codex', 'gemini'] as const;
@@ -91,17 +91,17 @@ function claudeFromDisk(raw: unknown): ClaudeLogin | null {
 
 function codexFromDisk(raw: unknown): CodexTokens | null {
   if (!isRecord(raw)) return null;
+  const clientId = text(raw.clientId);
   const accessToken = text(raw.accessToken);
   const refreshToken = text(raw.refreshToken);
-  const accountId = text(raw.accountId);
-  if (accessToken === '' || refreshToken === '' || accountId === '') return null;
+  if (clientId === '' || clientId === NEW_CLIENT || accessToken === '' || refreshToken === '') return null;
   return {
+    clientId,
+    subject: text(raw.subject),
+    email: maybe(raw.email),
     accessToken,
     refreshToken,
-    idToken: text(raw.idToken),
-    accountId,
-    email: maybe(raw.email),
-    plan: maybe(raw.plan),
+    expiresAt: typeof raw.expiresAt === 'number' && Number.isFinite(raw.expiresAt) ? raw.expiresAt : 0,
     savedAt: text(raw.savedAt) === '' ? new Date(0).toISOString() : text(raw.savedAt),
   };
 }
@@ -186,7 +186,7 @@ const CHECKS: Record<Provider, [(c: Connection) => boolean, string][]> = {
     [(c) => c.model === '', 'OpenRouter needs a model id: choose one on the Model page.'],
   ],
   codex: [
-    [(c) => c.codex === null, 'Codex is not connected: sign in with ChatGPT on the Model page.'],
+    [(c) => c.codex === null, CODEX_SIGN_IN],
     [(c) => c.model === '', 'Codex needs a model id: choose one on the Model page.'],
   ],
   gemini: [
@@ -235,9 +235,8 @@ export const PASSTHROUGH_ID = 'passthrough';
 
 function signedInAs(c: Connection): { account: string | null; plan: string | null } {
   if (c.claude !== null) return { account: c.claude.email, plan: c.claude.plan };
-  if (c.codex === null) return { account: c.gemini?.email ?? null, plan: c.gemini?.tier ?? null };
-  const claims = claimsOf(c.codex.idToken);
-  return { account: c.codex.email ?? claims.email, plan: c.codex.plan ?? claims.plan };
+  if (c.codex !== null) return { account: c.codex.email, plan: null };
+  return { account: c.gemini?.email ?? null, plan: c.gemini?.tier ?? null };
 }
 
 function publicConnection(c: Connection): Record<string, unknown> {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-signin.ts

@@ -3,9 +3,8 @@ import { ApiError } from '@metro-labs/http/api-error';
 import { readJsonBody } from '@metro-labs/http/api-http';
 import { isRecord } from '@metro-labs/core/is-record';
 import { log } from '@metro-labs/core/log';
-import { beginLogin, finishLogin, readCodexCliAuth, type CodexTokens } from './codex-auth.js';
-import { beginDeviceLogin, pollDeviceLogin } from './codex-device.js';
-import { codexModels, currentTokens, sharedCodexState } from './codex.js';
+import { beginLogin, chatgptHostId, finishLogin, type CodexTokens } from './codex-auth.js';
+import { codexModels, currentTokens, sharedCodexState, type CodexDeps } from './codex.js';
 import { beginLogin as beginGeminiLogin, exchangeCode as exchangeGeminiCode, userEmail, type GeminiTokens } from './gemini-auth.js';
 import { onboard, parseGeminiProject } from './gemini-setup.js';
 import { currentGeminiTokens, listGeminiModels, sharedGeminiState, type GeminiDeps } from './gemini.js';
@@ -40,21 +39,7 @@ const saved = (store: Store, cfg: ModelConfig, note: string, fields: { connectio
   return settingsBody(cfg);
 };
 
-function keepCodex(store: Store, req: IncomingMessage, tokens: CodexTokens | null, note: string): unknown {
-  const { cfg, id } = connectionToFill(store, req, 'codex');
-  const twin = cfg.connections.find((c) => c.id !== id && tokens !== null && c.codex?.refreshToken === tokens.refreshToken);
-  if (twin !== undefined) throw new ApiError(`this ChatGPT login is already connected as ${twin.label}; sign in with ChatGPT to add another one`, 409);
-  const next = setCodexAuth(cfg, id, tokens);
-  return saved(store, next, note, { connection: id, plan: tokens?.plan ?? null });
-}
-
-async function pollDevice(id: string, req: IncomingMessage, deps: ModelApiDeps, store: Store): Promise<unknown> {
-  const result = await pollDeviceLogin(id, deps.fetchImpl).catch(asApiError);
-  if (result.status !== 'done') return result;
-  return { status: 'done', settings: keepCodex(store, req, result.tokens, 'model-api: Codex connected by device code') };
-}
-
-export const codexDepsFor = (deps: ModelApiDeps, store: Store, id: string): { issuer?: string; fetchImpl?: typeof fetch; base?: string; save: (connId: string, t: CodexTokens) => void } => ({
+const codexDepsFor = (deps: ModelApiDeps, store: Store, id: string): CodexDeps => ({
   issuer: deps.issuer,
   fetchImpl: deps.fetchImpl,
   base: deps.codexBase,
@@ -63,34 +48,21 @@ export const codexDepsFor = (deps: ModelApiDeps, store: Store, id: string): { is
   },
 });
 
+const renewing = (store: Store, req: IncomingMessage): CodexTokens | null => (askedConnection(req) === '' ? null : connectionFor(store.read(), req, 'codex').codex);
+
 export const CODEX_ROUTES: Record<string, Route> = {
-  device: {
+  login: {
     method: 'POST',
-    run: async (_req, deps) => {
-      const login = await beginDeviceLogin(deps.issuer, deps.fetchImpl).catch(asApiError);
-      return { id: login.id, user_code: login.userCode, verify_url: login.verifyUrl, interval: login.interval };
-    },
+    run: (req, deps, store) => Promise.resolve({ url: beginLogin(renewing(store, req), chatgptHostId(deps.setup?.agents), deps.issuer) }),
   },
-  login: { method: 'POST', run: (_req, deps) => Promise.resolve({ url: beginLogin(deps.issuer).url }) },
   callback: {
     method: 'POST',
     run: async (req, deps, store) => {
       const body = await readJsonBody(req, BODY_MAX);
       const raw = isRecord(body) && typeof body.url === 'string' ? body.url : '';
       const tokens = await finishLogin(raw, deps.issuer, deps.fetchImpl).catch(asApiError);
-      return keepCodex(store, req, tokens, 'model-api: Codex connected');
-    },
-  },
-  import: {
-    method: 'POST',
-    run: (_req, deps, store) => {
-      let tokens;
-      try {
-        tokens = readCodexCliAuth(deps.codexHome);
-      } catch (err) {
-        asApiError(err);
-      }
-      return Promise.resolve(keepCodex(store, _req, tokens, 'model-api: Codex CLI login imported'));
+      const { cfg, id } = connectionToFill(store, req, 'codex');
+      return saved(store, setCodexAuth(cfg, id, tokens), 'model-api: Codex connected with Sign in with ChatGPT', { connection: id });
     },
   },
   models: {
@@ -157,7 +129,3 @@ export const GEMINI_ROUTES: Record<string, Route> = {
     run: async (req, deps, store) => ({ models: await geminiIds(req, deps, store).catch(asApiError) }),
   },
 };
-
-export function codexDeviceRoute(id: string, method: string | undefined): Route | number {
-  return method === 'GET' ? { method: 'GET', run: (req, deps, store) => pollDevice(id, req, deps, store) } : 405;
-}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-store.ts

@@ -15,7 +15,6 @@ export interface ModelApiDeps {
   write?: (cfg: ModelConfig) => void;
   issuer?: string;
   fetchImpl?: typeof fetch;
-  codexHome?: string;
   codexBase?: string;
   geminiAuthBase?: string;
   geminiTokenBase?: string;

package/runtime/node_modules/@metro-labs/daemon/src/gateway/usage-refresh.ts

@@ -1,11 +1,10 @@
 import { errMsg, log } from '@metro-labs/core/log';
 import { readClaudeUsage } from '../claude/usage-probe.js';
-import { codexUsageNow, sharedCodexState } from './codex.js';
 import { openrouterKey } from './openrouter.js';
 import { lastServed } from './served.js';
 import { claudeLoginUsage, geminiUsage, keepProbeAnswer, mayProbe, mergeUsage, noteUsage, openrouterUsage, probeAnswer, usageOf } from './usage.js';
 import { PASSTHROUGH_ID, readModelConfig, routedConnection, writeModelConfig, type Connection, type ModelConfig } from './model-config.js';
-import { codexDepsFor, geminiModelsOf } from './model-signin.js';
+import { geminiModelsOf } from './model-signin.js';
 import { claudeLoginDeps, CREDITS_TTL_MS, type ModelApiDeps, type Store } from './model-store.js';
 import { probeClaudeLogin } from './claude-logins.js';
 
@@ -34,14 +33,6 @@ async function refreshKey(conn: Connection, deps: ModelApiDeps, now: number): Pr
   });
 }
 
-async function refreshCodex(conn: Connection, deps: ModelApiDeps, store: Store, now: number): Promise<void> {
-  if (conn.codex === null || !due(conn.id, now)) return;
-  await probe('Codex usage', async () => {
-    const usage = await codexUsageNow(conn, codexDepsFor(deps, store, conn.id), sharedCodexState);
-    if (usage !== null) noteUsage(conn.id, usage);
-  });
-}
-
 const modelsInUse = (conn: Connection, cfg: ModelConfig): Set<string> => {
   const served = lastServed();
   const fallbacks = (cfg.fallbacks ?? []).filter((f) => f.connection === conn.id).map((f) => f.model);
@@ -92,7 +83,6 @@ async function refreshLogin(cfg: ModelConfig, deps: ModelApiDeps, now: number):
 
 function refreshOne(conn: Connection, cfg: ModelConfig, deps: ModelApiDeps, store: Store, now: number): Promise<void> {
   if (conn.provider === 'openrouter') return refreshKey(conn, deps, now);
-  if (conn.provider === 'codex') return refreshCodex(conn, deps, store, now);
   if (conn.provider === 'gemini') return refreshQuota(conn, deps, store, now);
   if (conn.provider === 'anthropic') return refreshOwnLogin(conn, cfg, deps, now);
   return Promise.resolve();

package/runtime/node_modules/@metro-labs/daemon/src/gateway/usage.ts

@@ -271,36 +271,6 @@ const textOf = (raw: unknown): string | null => (typeof raw === 'number' || type
 
 const numberOf = (raw: unknown): number | null => (typeof raw === 'number' && Number.isFinite(raw) ? raw : null);
 
-const SECONDS_PER_MINUTE = 60;
-
-function codexBodyWindow(raw: unknown, now: Date): UsageWindow | null {
-  if (!isRecord(raw)) return null;
-  const percent = numberOf(raw.used_percent);
-  if (percent === null) return null;
-  const seconds = numberOf(raw.limit_window_seconds);
-  const minutes = seconds === null || seconds <= 0 ? null : Math.ceil(seconds / SECONDS_PER_MINUTE);
-  const resetAt = whenFrom(textOf(raw.reset_at), now) ?? whenFrom(textOf(raw.reset_after_seconds), now, true);
-  return { label: windowLabel(minutes), used: clamp(percent / 100), resetAt, detail: null };
-}
-
-function codexWall(limit: Record<string, unknown>, reached: unknown): string | null {
-  if (limit.limit_reached !== true && limit.allowed !== false) return null;
-  const kind = isRecord(reached) ? stringOf(reached.type) : '';
-  return kind === '' ? 'limit reached' : kind.replaceAll('_', ' ');
-}
-
-export function codexUsageBody(body: unknown, now = new Date()): Reported | null {
-  if (!isRecord(body)) return null;
-  const limit = isRecord(body.rate_limit) ? body.rate_limit : {};
-  const credits = isRecord(body.credits) ? body.credits : {};
-  const windows = [
-    codexBodyWindow(limit.primary_window, now),
-    codexBodyWindow(limit.secondary_window, now),
-    creditsLeft(credits.has_credits === true, textOf(credits.balance)),
-  ].filter(present);
-  return windows.length === 0 ? null : { windows, note: codexWall(limit, body.rate_limit_reached_type), at: now.toISOString() };
-}
-
 const CLAUDE_WINDOWS: [string, string][] = [
   ['five_hour', '5-hour window'],
   ['seven_day', 'Weekly'],

package/runtime/node_modules/@metro-labs/http/src/return-to.ts

@@ -6,6 +6,10 @@ export function allowedWebHost(host: string): boolean {
   return PREVIEW.test(host);
 }
 
+export const APP_RETURN = 'metro://auth';
+
+export const isAppReturn = (returnTo: string): boolean => returnTo === APP_RETURN;
+
 export function validateReturnTo(returnTo: string): boolean {
   let url: URL;
   try {

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.253"
+  "version": "0.1.0-beta.255"
 }

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex-device.ts

@@ -1,91 +0,0 @@
-import { randomBytes } from 'node:crypto';
-import { isRecord } from '@metro-labs/core/is-record';
-import { errMsg } from '@metro-labs/core/log';
-import { CODEX_CLIENT_ID, CODEX_ISSUER, CodexAuthError, exchangeCode, type CodexTokens } from './codex-auth.js';
-import { stringOf } from '@metro-labs/http/api-http';
-
-const VERIFY_PATH = '/codex/device';
-const DEVICE_TTL_MS = 15 * 60_000;
-const DEFAULT_INTERVAL_S = 5;
-const ID_BYTES = 18;
-
-export interface DeviceLogin {
-  id: string;
-  userCode: string;
-  verifyUrl: string;
-  interval: number;
-}
-
-export type DeviceStatus = { status: 'pending' } | { status: 'done'; tokens: CodexTokens } | { status: 'failed'; error: string };
-
-interface Entry {
-  deviceAuthId: string;
-  userCode: string;
-  interval: number;
-  issuer: string;
-  startedAt: number;
-  polledAt: number | null;
-}
-
-const logins = new Map<string, Entry>();
-
-
-function intervalOf(value: unknown): number {
-  const n = typeof value === 'number' ? value : typeof value === 'string' ? Number(value) : NaN;
-  return Number.isFinite(n) && n >= 1 ? Math.round(n) : DEFAULT_INTERVAL_S;
-}
-
-function sweep(now: number): void {
-  for (const [id, entry] of logins) if (now - entry.startedAt > DEVICE_TTL_MS) logins.delete(id);
-}
-
-const post = (url: string, body: unknown, fetchImpl: typeof fetch): Promise<Response> =>
-  fetchImpl(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });
-
-export async function beginDeviceLogin(issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<DeviceLogin> {
-  sweep(now);
-  const res = await post(`${issuer}/api/accounts/deviceauth/usercode`, { client_id: CODEX_CLIENT_ID }, fetchImpl);
-  if (res.status === 404) throw new CodexAuthError('OpenAI is not offering the device-code sign-in right now; use the browser sign-in instead');
-  if (!res.ok) throw new CodexAuthError(`OpenAI refused to start the device-code sign-in (${String(res.status)})`);
-  const body: unknown = await res.json();
-  const parsed = isRecord(body) ? body : {};
-  const deviceAuthId = stringOf(parsed.device_auth_id);
-  const userCode = stringOf(parsed.user_code) || stringOf(parsed.usercode);
-  if (deviceAuthId === '' || userCode === '') throw new CodexAuthError('OpenAI answered without a device code');
-  const id = randomBytes(ID_BYTES).toString('base64url');
-  const interval = intervalOf(parsed.interval);
-  logins.set(id, { deviceAuthId, userCode, interval, issuer, startedAt: now, polledAt: null });
-  return { id, userCode, verifyUrl: `${issuer}${VERIFY_PATH}`, interval };
-}
-
-async function claim(entry: Entry, fetchImpl: typeof fetch, now: number): Promise<DeviceStatus> {
-  const res = await post(`${entry.issuer}/api/accounts/deviceauth/token`, { device_auth_id: entry.deviceAuthId, user_code: entry.userCode }, fetchImpl);
-  if (res.status === 403 || res.status === 404) {
-    await res.body?.cancel();
-    return { status: 'pending' };
-  }
-  if (!res.ok) return { status: 'failed', error: `OpenAI ended the device-code sign-in (${String(res.status)})` };
-  const body: unknown = await res.json();
-  const parsed = isRecord(body) ? body : {};
-  const code = stringOf(parsed.authorization_code);
-  const verifier = stringOf(parsed.code_verifier);
-  if (code === '' || verifier === '') return { status: 'failed', error: 'OpenAI approved the sign-in but sent no code back' };
-  const tokens = await exchangeCode(entry.issuer, code, verifier, `${entry.issuer}/deviceauth/callback`, fetchImpl, now);
-  return { status: 'done', tokens };
-}
-
-export async function pollDeviceLogin(id: string, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<DeviceStatus> {
-  sweep(now);
-  const entry = logins.get(id);
-  if (entry === undefined) throw new CodexAuthError('this sign-in has expired or already finished; press Connect again');
-  if (entry.polledAt !== null && now - entry.polledAt < entry.interval * 1000) return { status: 'pending' };
-  entry.polledAt = now;
-  let result: DeviceStatus;
-  try {
-    result = await claim(entry, fetchImpl, now);
-  } catch (err) {
-    result = { status: 'failed', error: errMsg(err) };
-  }
-  if (result.status !== 'pending') logins.delete(id);
-  return result;
-}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex-version.ts

@@ -1,44 +0,0 @@
-import { errMsg, log } from '@metro-labs/core/log';
-
-const BUILT_IN = '0.157.1';
-const REGISTRY = 'https://registry.npmjs.org/@openai/codex/latest';
-const OVERRIDE_RE = /^\d+\.\d+\.\d+(?:-[A-Za-z0-9.]+)?$/;
-const STABLE_RE = /^\d+\.\d+\.\d+$/;
-const FRESH_MS = 6 * 3_600_000;
-const FETCH_MS = 5_000;
-
-let learned: { version: string; at: number } | null = null;
-
-const parts = (version: string): number[] => version.split('.').map(Number);
-
-function newer(a: string, b: string): boolean {
-  const [x, y] = [parts(a), parts(b)];
-  for (let i = 0; i < 3; i++) if ((x[i] ?? 0) !== (y[i] ?? 0)) return (x[i] ?? 0) > (y[i] ?? 0);
-  return false;
-}
-
-export function codexVersion(): string {
-  const wanted = process.env.METRO_CODEX_VERSION?.trim() ?? '';
-  if (wanted !== '' && OVERRIDE_RE.test(wanted)) return wanted;
-  if (wanted !== '') log.warn({ value: wanted }, 'gateway: METRO_CODEX_VERSION is not a version like 0.157.1; using the known one');
-  return learned !== null && newer(learned.version, BUILT_IN) ? learned.version : BUILT_IN;
-}
-
-async function latestOnNpm(): Promise<string> {
-  const res = await fetch(process.env.METRO_CODEX_REGISTRY ?? REGISTRY, { signal: AbortSignal.timeout(FETCH_MS) });
-  const body: unknown = await res.json();
-  const version = typeof body === 'object' && body !== null ? (body as { version?: unknown }).version : undefined;
-  if (!res.ok || typeof version !== 'string' || !STABLE_RE.test(version)) throw new Error(`npm answered ${String(res.status)} without a stable version`);
-  return version;
-}
-
-export async function learnCodexVersion(now = Date.now()): Promise<string> {
-  if (learned !== null && now - learned.at < FRESH_MS) return codexVersion();
-  try {
-    learned = { version: await latestOnNpm(), at: now };
-  } catch (err) {
-    log.warn({ err: errMsg(err) }, 'gateway: the latest Codex version could not be read from npm; using the known one');
-    learned = { version: learned?.version ?? BUILT_IN, at: now };
-  }
-  return codexVersion();
-}