@stage-labs/metro 0.1.0-beta.254 → 0.1.0-beta.256

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.254",
+  "version": "0.1.0-beta.256",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.254",
+  "version": "0.1.0-beta.256",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex-auth.ts

@@ -1,69 +1,123 @@
-import { readFileSync } from 'node:fs';
-import { homedir } from 'node:os';
+import { randomBytes, randomUUID } from 'node:crypto';
 import { join } from 'node:path';
 import { isRecord } from '@metro-labs/core/is-record';
-import { PendingLogins } from './pkce.js';
+import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
+import { ticketStore } from '@metro-labs/core/tickets';
+import { agentsDir } from '../agents/files.js';
+import { newPkce } from './pkce.js';
 import { nonEmpty } from './text.js';
 
-export const CODEX_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
 export const CODEX_ISSUER = 'https://auth.openai.com';
-export const CODEX_REDIRECT = 'http://localhost:1455/auth/callback';
-const SCOPE = 'openid profile email offline_access api.connectors.read api.connectors.invoke';
-const AUTH_CLAIM = 'https://api.openai.com/auth';
+export const CODEX_REDIRECT = 'http://127.0.0.1:1455/auth/callback';
+export const OPENAI_API = 'https://api.openai.com/v1';
+export const NEW_CLIENT = 'dynamic_agent_client';
+export const APP_NAME = 'Metro';
+export const PLAN_SCOPE = 'chatgpt.tokens.use.direct';
+export const CODEX_SIGN_IN = 'Codex is not signed in: sign in with ChatGPT on the Model page.';
+const SCOPE = `openid profile email offline_access resource.invoke ${PLAN_SCOPE}`;
 const PROFILE_CLAIM = 'https://api.openai.com/profile';
-const ACCESS_TOKEN_TTL_MS = 55 * 60_000;
+const HOST_FILE = 'chatgpt-host.json';
+const HOST_RE = /^urn:uuid:[0-9a-f-]{36}$/;
+const PENDING_TTL_MS = 10 * 60_000;
+const DEFAULT_TTL_MS = 60 * 60_000;
+const RENEW_BEFORE_MS = 2 * 60_000;
+const AGAIN = 'press Continue with ChatGPT again';
 
-export interface CodexTokens {
+export type CodexMethod = 'chatgpt' | 'code';
+
+export interface CodexCredential {
+  email: string | null;
   accessToken: string;
   refreshToken: string;
-  idToken: string;
+  expiresAt: number;
+  savedAt: string;
+}
+
+export interface ChatgptTokens extends CodexCredential {
+  method: 'chatgpt';
+  clientId: string;
+  subject: string;
+}
+
+export interface CodeTokens extends CodexCredential {
+  method: 'code';
   accountId: string;
-  email: string | null;
   plan: string | null;
-  savedAt: string;
 }
 
+export type CodexTokens = ChatgptTokens | CodeTokens;
+
 export class CodexAuthError extends Error {}
 
-const pending = new PendingLogins(24);
+interface Pending {
+  verifier: string;
+  nonce: string;
+  clientId: string | null;
+  subject: string | null;
+}
+
+const pending = ticketStore<Pending>(PENDING_TTL_MS, 24);
+
+export function chatgptHostId(dir = agentsDir()): string {
+  const path = join(dir, HOST_FILE);
+  const saved = readJson<unknown>(path, null);
+  if (isRecord(saved) && typeof saved.hostId === 'string' && HOST_RE.test(saved.hostId)) return saved.hostId;
+  const made = `urn:uuid:${randomUUID()}`;
+  writeSecure(path, JSON.stringify({ hostId: made }));
+  return made;
+}
+
+function returning(previous: ChatgptTokens | null): Record<string, string> {
+  if (previous === null) return { client_id: NEW_CLIENT, agent_name_hint: APP_NAME };
+  return { client_id: previous.clientId, ...(previous.email === null ? {} : { login_hint: previous.email }) };
+}
 
-export function authorizeUrl(state: string, challenge: string, issuer = CODEX_ISSUER): string {
+export function beginLogin(previous: ChatgptTokens | null, hostId: string, issuer = CODEX_ISSUER, now = Date.now()): string {
+  const { verifier, challenge } = newPkce();
+  const nonce = randomBytes(32).toString('base64url');
+  const { ticket: state } = pending.mint({ verifier, nonce, clientId: previous?.clientId ?? null, subject: previous?.subject ?? null }, now);
   const query = new URLSearchParams({
+    ...returning(previous),
+    ext_agent_host_id: hostId,
     response_type: 'code',
-    client_id: CODEX_CLIENT_ID,
     redirect_uri: CODEX_REDIRECT,
     scope: SCOPE,
-    code_challenge: challenge,
-    code_challenge_method: 'S256',
-    id_token_add_organizations: 'true',
-    codex_cli_simplified_flow: 'true',
+    resource: OPENAI_API,
     state,
-    originator: 'codex_cli_rs',
+    nonce,
+    code_challenge_method: 'S256',
+    code_challenge: challenge,
   });
-  return `${issuer}/oauth/authorize?${query.toString()}`;
-}
-
-export function beginLogin(issuer = CODEX_ISSUER, now = Date.now()): { url: string; state: string } {
-  const { state, challenge } = pending.begin(now);
-  return { url: authorizeUrl(state, challenge, issuer), state };
+  return `${issuer}/api/accounts/authorize?${query.toString()}`;
 }
 
-export function parseCallback(raw: string): { code: string; state: string } {
+function queryOf(raw: string): URLSearchParams {
   const text = raw.trim();
-  let query: URLSearchParams;
   try {
-    query = new URL(text).searchParams;
+    return new URL(text).searchParams;
   } catch {
-    query = new URLSearchParams(text.replace(/^\?/, ''));
+    return new URLSearchParams(text.replace(/^\?/, ''));
   }
-  const code = query.get('code')?.trim() ?? '';
-  const state = query.get('state')?.trim() ?? '';
-  if (code === '' || state === '')
-    throw new CodexAuthError('paste the whole address the browser landed on; it carries code= and state=');
-  return { code, state };
 }
 
-function decodeJwtPayload(jwt: string): Record<string, unknown> {
+const param = (query: URLSearchParams, name: string): string => query.get(name)?.trim() ?? '';
+
+function assertAllowed(query: URLSearchParams): void {
+  const error = param(query, 'error');
+  if (error === 'access_denied') throw new CodexAuthError('you did not allow Metro to use your ChatGPT plan, so nothing was saved');
+  if (error !== '') throw new CodexAuthError(`ChatGPT stopped the sign-in (${query.get('error_description') ?? error}); ${AGAIN}`);
+}
+
+export function parseCallback(raw: string): { code: string; state: string; clientId: string | null } {
+  const query = queryOf(raw);
+  assertAllowed(query);
+  const code = param(query, 'code');
+  const state = param(query, 'state');
+  if (code === '' || state === '') throw new CodexAuthError('paste the whole address the browser landed on; it carries code= and state=');
+  return { code, state, clientId: nonEmpty(param(query, 'client_id')) };
+}
+
+export function decodeJwtPayload(jwt: string): Record<string, unknown> {
   const part = jwt.split('.')[1] ?? '';
   try {
     const parsed: unknown = JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
@@ -73,142 +127,93 @@ function decodeJwtPayload(jwt: string): Record<string, unknown> {
   }
 }
 
+export function emailOf(claims: Record<string, unknown>): string | null {
+  const profile = isRecord(claims[PROFILE_CLAIM]) ? claims[PROFILE_CLAIM] : {};
+  return nonEmpty(claims.email) ?? nonEmpty(profile.email);
+}
 
-export function claimsOf(idToken: string): { accountId: string | null; email: string | null; plan: string | null } {
-  const payload = decodeJwtPayload(idToken);
-  const auth = isRecord(payload[AUTH_CLAIM]) ? payload[AUTH_CLAIM] : {};
-  const profile = isRecord(payload[PROFILE_CLAIM]) ? payload[PROFILE_CLAIM] : {};
-  return {
-    accountId: nonEmpty(auth.chatgpt_account_id),
-    email: nonEmpty(payload.email) ?? nonEmpty(profile.email),
-    plan: nonEmpty(auth.chatgpt_plan_type),
-  };
+function identityOf(idToken: unknown, expected: { issuer: string; clientId: string; nonce: string }): { subject: string; email: string | null } {
+  const claims = decodeJwtPayload(typeof idToken === 'string' ? idToken : '');
+  const audience: unknown[] = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+  const subject = nonEmpty(claims.sub);
+  if (subject === null || claims.iss !== expected.issuer || !audience.includes(expected.clientId) || claims.nonce !== expected.nonce)
+    throw new CodexAuthError(`OpenAI sent back an identity that does not match this sign-in; ${AGAIN}`);
+  return { subject, email: emailOf(claims) };
 }
 
-interface TokenResponse {
-  id_token?: unknown;
-  access_token?: unknown;
-  refresh_token?: unknown;
+interface Encoded {
+  type: string;
+  body: string;
 }
 
-const EMPTY_TOKENS: CodexTokens = { accessToken: '', refreshToken: '', idToken: '', accountId: '', email: null, plan: null, savedAt: '' };
+export const asForm = (fields: Record<string, string>): Encoded => ({ type: 'application/x-www-form-urlencoded', body: new URLSearchParams(fields).toString() });
 
-function assertUsable(next: CodexTokens): CodexTokens {
-  if (next.accessToken === '' || next.refreshToken === '') throw new CodexAuthError('the token endpoint returned no usable tokens');
-  if (next.accountId === '') throw new CodexAuthError('the id token carries no ChatGPT account id; sign in with a ChatGPT account that has Codex');
-  return next;
+export const asJson = (fields: Record<string, string>): Encoded => ({ type: 'application/json', body: JSON.stringify(fields) });
+
+export async function tokenCall(url: string, sent: Encoded, fetchImpl: typeof fetch): Promise<Record<string, unknown>> {
+  const res = await fetchImpl(url, { method: 'POST', headers: { 'content-type': sent.type, accept: 'application/json' }, body: sent.body });
+  const raw = await res.text();
+  let parsed: unknown = null;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    parsed = null;
+  }
+  const body = isRecord(parsed) ? parsed : {};
+  if (!res.ok) throw new CodexAuthError(`OpenAI refused the token request (${String(res.status)}): ${nonEmpty(body.error_description) ?? nonEmpty(body.error) ?? raw.slice(0, 300)}`);
+  return body;
 }
 
-const pick = (fresh: string | null, kept: string | null): string | null => fresh ?? kept;
+export function grantOf(body: Record<string, unknown>, keptRefresh: string, now: number): Omit<CodexCredential, 'email'> {
+  const accessToken = nonEmpty(body.access_token) ?? '';
+  const refreshToken = nonEmpty(body.refresh_token) ?? keptRefresh;
+  if (accessToken === '' || refreshToken === '') throw new CodexAuthError('OpenAI returned no usable tokens; sign in again');
+  const ttl = typeof body.expires_in === 'number' && body.expires_in > 0 ? body.expires_in * 1000 : DEFAULT_TTL_MS;
+  return { accessToken, refreshToken, expiresAt: now + ttl, savedAt: new Date(now).toISOString() };
+}
 
-export function tokensFrom(body: unknown, previous: CodexTokens | null, now = new Date()): CodexTokens {
-  const res = (isRecord(body) ? body : {}) as TokenResponse;
-  const kept = previous ?? EMPTY_TOKENS;
-  const idToken = pick(nonEmpty(res.id_token), kept.idToken) ?? '';
-  const claims = claimsOf(idToken);
-  return assertUsable({
-    accessToken: nonEmpty(res.access_token) ?? '',
-    refreshToken: pick(nonEmpty(res.refresh_token), kept.refreshToken) ?? '',
-    idToken,
-    accountId: pick(claims.accountId, kept.accountId) ?? '',
-    email: pick(claims.email, kept.email),
-    plan: pick(claims.plan, kept.plan),
-    savedAt: now.toISOString(),
-  });
+const tokensFrom = (body: Record<string, unknown>, who: Pick<ChatgptTokens, 'clientId' | 'subject' | 'email'>, keptRefresh: string, now: number): ChatgptTokens => ({
+  method: 'chatgpt',
+  clientId: who.clientId,
+  subject: who.subject,
+  email: who.email,
+  ...grantOf(body, keptRefresh, now),
+});
+
+const officialToken = (issuer: string): string => `${issuer}/api/accounts/oauth/token`;
+
+function clientOf(started: Pending, returned: string | null): string {
+  const clientId = started.clientId ?? returned;
+  if (clientId === null || clientId === NEW_CLIENT) throw new CodexAuthError(`ChatGPT did not finish registering Metro; ${AGAIN}`);
+  if (returned !== null && returned !== clientId) throw new CodexAuthError(`ChatGPT answered for another Metro registration; ${AGAIN}`);
+  return clientId;
 }
 
-async function tokenCall(issuer: string, init: RequestInit, fetchImpl: typeof fetch): Promise<unknown> {
-  const res = await fetchImpl(`${issuer}/oauth/token`, init);
-  const raw = await res.text();
-  if (!res.ok) {
-    let detail = raw.slice(0, 300);
-    try {
-      const parsed: unknown = JSON.parse(raw);
-      if (isRecord(parsed)) detail = nonEmpty(parsed.error_description) ?? nonEmpty(parsed.error) ?? detail;
-    } catch {
-      detail = raw.slice(0, 300);
-    }
-    throw new CodexAuthError(`OpenAI refused the token request (${String(res.status)}): ${detail}`);
-  }
-  return JSON.parse(raw) as unknown;
-}
-
-export async function finishLogin(
-  callback: string,
-  issuer = CODEX_ISSUER,
-  fetchImpl: typeof fetch = fetch,
-  now = Date.now(),
-): Promise<CodexTokens> {
-  const { code, state } = parseCallback(callback);
-  const verifier = pending.take(state, now);
-  if (verifier === null) throw new CodexAuthError('this sign-in link has expired or was started elsewhere; press Connect again');
-  return exchangeCode(issuer, code, verifier, CODEX_REDIRECT, fetchImpl, now);
-}
-
-export async function exchangeCode(
-  issuer: string,
-  code: string,
-  verifier: string,
-  redirectUri: string,
-  fetchImpl: typeof fetch,
-  now = Date.now(),
-): Promise<CodexTokens> {
-  const body = new URLSearchParams({
-    grant_type: 'authorization_code',
-    code,
-    redirect_uri: redirectUri,
-    client_id: CODEX_CLIENT_ID,
-    code_verifier: verifier,
-  });
-  const res = await tokenCall(
-    issuer,
-    { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: body.toString() },
+export async function finishLogin(callback: string, issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<ChatgptTokens> {
+  const { code, state, clientId: returned } = parseCallback(callback);
+  const started = pending.take(state, now);
+  if (started === undefined) throw new CodexAuthError(`this sign-in link has expired or was started elsewhere; ${AGAIN}`);
+  const clientId = clientOf(started, returned);
+  const body = await tokenCall(
+    officialToken(issuer),
+    asForm({ grant_type: 'authorization_code', client_id: clientId, code, code_verifier: started.verifier, redirect_uri: CODEX_REDIRECT, resource: OPENAI_API }),
     fetchImpl,
   );
-  return tokensFrom(res, null, new Date(now));
+  const who = identityOf(body.id_token, { issuer, clientId, nonce: started.nonce });
+  if (started.subject !== null && who.subject !== started.subject)
+    throw new CodexAuthError('this is another ChatGPT account than the one this connection signed in with; add a new connection for it');
+  const scopes = (nonEmpty(body.scope) ?? '').split(/\s+/);
+  if (!scopes.includes(PLAN_SCOPE)) throw new CodexAuthError('ChatGPT did not allow Metro to use your plan: sign in again and allow it (it needs ChatGPT Plus or Pro)');
+  return tokensFrom(body, { clientId, ...who }, '', now);
 }
 
-export async function refreshTokens(previous: CodexTokens, issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch): Promise<CodexTokens> {
-  const res = await tokenCall(
-    issuer,
-    {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ client_id: CODEX_CLIENT_ID, grant_type: 'refresh_token', refresh_token: previous.refreshToken }),
-    },
+export async function refreshTokens(previous: ChatgptTokens, issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<ChatgptTokens> {
+  const body = await tokenCall(
+    officialToken(issuer),
+    asForm({ grant_type: 'refresh_token', client_id: previous.clientId, refresh_token: previous.refreshToken, resource: OPENAI_API }),
     fetchImpl,
   );
-  return tokensFrom(res, previous);
+  return tokensFrom(body, previous, previous.refreshToken, now);
 }
 
-export const tokensStale = (tokens: CodexTokens, now = Date.now()): boolean =>
-  now - Date.parse(tokens.savedAt) > ACCESS_TOKEN_TTL_MS;
-
-function readAuthFile(home: string): Record<string, unknown> {
-  let raw: unknown;
-  try {
-    raw = JSON.parse(readFileSync(join(home, '.codex', 'auth.json'), 'utf8'));
-  } catch {
-    throw new CodexAuthError('no Codex CLI login on this machine (~/.codex/auth.json); run codex login there first, or connect here');
-  }
-  return isRecord(raw) ? raw : {};
-}
-
-export function readCodexCliAuth(home = homedir()): CodexTokens {
-  const raw = readAuthFile(home);
-  if (!isRecord(raw.tokens)) throw new CodexAuthError('~/.codex/auth.json holds no ChatGPT tokens (an API-key login cannot be reused here)');
-  const stored = raw.tokens;
-  const idToken = nonEmpty(stored.id_token) ?? '';
-  const claims = claimsOf(idToken);
-  const found: CodexTokens = {
-    accessToken: nonEmpty(stored.access_token) ?? '',
-    refreshToken: nonEmpty(stored.refresh_token) ?? '',
-    idToken,
-    accountId: nonEmpty(stored.account_id) ?? claims.accountId ?? '',
-    email: claims.email,
-    plan: claims.plan,
-    savedAt: nonEmpty(raw.last_refresh) ?? new Date(0).toISOString(),
-  };
-  if ([found.accessToken, found.refreshToken, found.accountId].includes('')) throw new CodexAuthError('~/.codex/auth.json is missing a token or the account id');
-  return found;
-}
+export const tokensStale = (tokens: CodexTokens, now = Date.now()): boolean => now >= tokens.expiresAt - RENEW_BEFORE_MS;

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex-device.ts

@@ -1,13 +1,17 @@
 import { randomBytes } from 'node:crypto';
 import { isRecord } from '@metro-labs/core/is-record';
 import { errMsg } from '@metro-labs/core/log';
-import { CODEX_CLIENT_ID, CODEX_ISSUER, CodexAuthError, exchangeCode, type CodexTokens } from './codex-auth.js';
 import { stringOf } from '@metro-labs/http/api-http';
+import { asForm, asJson, CODEX_ISSUER, CodexAuthError, decodeJwtPayload, emailOf, grantOf, tokenCall, type CodeTokens } from './codex-auth.js';
+import { nonEmpty } from './text.js';
 
+const CODEX_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
+const AUTH_CLAIM = 'https://api.openai.com/auth';
 const VERIFY_PATH = '/codex/device';
 const DEVICE_TTL_MS = 15 * 60_000;
 const DEFAULT_INTERVAL_S = 5;
 const ID_BYTES = 18;
+const AGAIN = 'press Sign in with a code again';
 
 export interface DeviceLogin {
   id: string;
@@ -16,7 +20,7 @@ export interface DeviceLogin {
   interval: number;
 }
 
-export type DeviceStatus = { status: 'pending' } | { status: 'done'; tokens: CodexTokens } | { status: 'failed'; error: string };
+export type DeviceStatus = { status: 'pending' } | { status: 'done'; tokens: CodeTokens } | { status: 'failed'; error: string };
 
 interface Entry {
   deviceAuthId: string;
@@ -29,6 +33,26 @@ interface Entry {
 
 const logins = new Map<string, Entry>();
 
+function claimsOf(idToken: string): { accountId: string | null; email: string | null; plan: string | null } {
+  const payload = decodeJwtPayload(idToken);
+  const auth = isRecord(payload[AUTH_CLAIM]) ? payload[AUTH_CLAIM] : {};
+  return { accountId: nonEmpty(auth.chatgpt_account_id), email: emailOf(payload), plan: nonEmpty(auth.chatgpt_plan_type) };
+}
+
+function codeTokensFrom(body: Record<string, unknown>, previous: CodeTokens | null, now: number): CodeTokens {
+  const fresh = claimsOf(nonEmpty(body.id_token) ?? '');
+  const kept = previous ?? { accountId: null, email: null, plan: null, refreshToken: '' };
+  const accountId = fresh.accountId ?? kept.accountId ?? '';
+  if (accountId === '') throw new CodexAuthError('the id token carries no ChatGPT account id; sign in with a ChatGPT account that has Codex');
+  return { method: 'code', accountId, email: fresh.email ?? kept.email, plan: fresh.plan ?? kept.plan, ...grantOf(body, kept.refreshToken, now) };
+}
+
+const cliToken = (issuer: string): string => `${issuer}/oauth/token`;
+
+export async function refreshCodeTokens(previous: CodeTokens, issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<CodeTokens> {
+  const body = await tokenCall(cliToken(issuer), asJson({ client_id: CODEX_CLIENT_ID, grant_type: 'refresh_token', refresh_token: previous.refreshToken }), fetchImpl);
+  return codeTokensFrom(body, previous, now);
+}
 
 function intervalOf(value: unknown): number {
   const n = typeof value === 'number' ? value : typeof value === 'string' ? Number(value) : NaN;
@@ -45,8 +69,8 @@ const post = (url: string, body: unknown, fetchImpl: typeof fetch): Promise<Resp
 export async function beginDeviceLogin(issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<DeviceLogin> {
   sweep(now);
   const res = await post(`${issuer}/api/accounts/deviceauth/usercode`, { client_id: CODEX_CLIENT_ID }, fetchImpl);
-  if (res.status === 404) throw new CodexAuthError('OpenAI is not offering the device-code sign-in right now; use the browser sign-in instead');
-  if (!res.ok) throw new CodexAuthError(`OpenAI refused to start the device-code sign-in (${String(res.status)})`);
+  if (res.status === 404) throw new CodexAuthError('OpenAI is not offering the code sign-in right now; use Continue with ChatGPT instead');
+  if (!res.ok) throw new CodexAuthError(`OpenAI refused to start the code sign-in (${String(res.status)})`);
   const body: unknown = await res.json();
   const parsed = isRecord(body) ? body : {};
   const deviceAuthId = stringOf(parsed.device_auth_id);
@@ -64,20 +88,24 @@ async function claim(entry: Entry, fetchImpl: typeof fetch, now: number): Promis
     await res.body?.cancel();
     return { status: 'pending' };
   }
-  if (!res.ok) return { status: 'failed', error: `OpenAI ended the device-code sign-in (${String(res.status)})` };
+  if (!res.ok) return { status: 'failed', error: `OpenAI ended the code sign-in (${String(res.status)})` };
   const body: unknown = await res.json();
   const parsed = isRecord(body) ? body : {};
   const code = stringOf(parsed.authorization_code);
   const verifier = stringOf(parsed.code_verifier);
   if (code === '' || verifier === '') return { status: 'failed', error: 'OpenAI approved the sign-in but sent no code back' };
-  const tokens = await exchangeCode(entry.issuer, code, verifier, `${entry.issuer}/deviceauth/callback`, fetchImpl, now);
-  return { status: 'done', tokens };
+  const granted = await tokenCall(
+    cliToken(entry.issuer),
+    asForm({ grant_type: 'authorization_code', code, redirect_uri: `${entry.issuer}/deviceauth/callback`, client_id: CODEX_CLIENT_ID, code_verifier: verifier }),
+    fetchImpl,
+  );
+  return { status: 'done', tokens: codeTokensFrom(granted, null, now) };
 }
 
 export async function pollDeviceLogin(id: string, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<DeviceStatus> {
   sweep(now);
   const entry = logins.get(id);
-  if (entry === undefined) throw new CodexAuthError('this sign-in has expired or already finished; press Connect again');
+  if (entry === undefined) throw new CodexAuthError(`this sign-in has expired or already finished; ${AGAIN}`);
   if (entry.polledAt !== null && now - entry.polledAt < entry.interval * 1000) return { status: 'pending' };
   entry.polledAt = now;
   let result: DeviceStatus;

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex-stream.ts

@@ -15,8 +15,13 @@ interface Block {
 const responseOf = (data: Item): Item => (isRecord(data.response) ? data.response : {});
 const itemOf = (data: Item): Item => (isRecord(data.item) ? data.item : {});
 
+const PLAN_LIMIT = 'subscription_sharing_usage_limit_exceeded';
+const USAGE_URL = 'https://chatgpt.com/settings/usage';
+
+export const withUsageLink = (code: string, message: string): string => (code === PLAN_LIMIT ? `${message} Manage usage: ${USAGE_URL}` : message);
+
 function errorKind(code: string): string {
-  if (code === 'rate_limit_exceeded' || code === 'usage_limit_reached') return 'rate_limit_error';
+  if (code === 'rate_limit_exceeded' || code === 'usage_limit_reached' || code === PLAN_LIMIT) return 'rate_limit_error';
   if (code === 'context_length_exceeded' || code === 'invalid_prompt') return 'invalid_request_error';
   if (code === 'insufficient_quota') return 'permission_error';
   return 'api_error';
@@ -157,7 +162,8 @@ export class CodexEventTranslator {
   private failed(response: Item, fallback: string): string {
     this.done = true;
     const error = isRecord(response.error) ? response.error : {};
-    return errorFrame(errorKind(stringOf(error.code)), stringOf(error.message) || fallback);
+    const code = stringOf(error.code);
+    return errorFrame(errorKind(code), withUsageLink(code, stringOf(error.message) || fallback));
   }
 
   push(event: string, data: Item): string {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex.ts

@@ -1,20 +1,22 @@
 import { randomUUID } from 'node:crypto';
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { arch, platform, release } from 'node:os';
+import { isRecord } from '@metro-labs/core/is-record';
+import { stringOf } from '@metro-labs/http/api-http';
+import { OPENAI_API, CODEX_SIGN_IN, refreshTokens, tokensStale, type CodexTokens } from './codex-auth.js';
+import { refreshCodeTokens } from './codex-device.js';
 import { codexVersion, learnCodexVersion } from './codex-version.js';
-import { refreshTokens, tokensStale, type CodexTokens } from './codex-auth.js';
-import { CodexEventTranslator } from './codex-stream.js';
+import { CodexEventTranslator, withUsageLink } from './codex-stream.js';
 import { ToolNames, toResponsesRequest } from './codex-translate.js';
 import { GatewayError, providerStatus, sendError, upstreamMessage, type Watch } from './forward.js';
 import { parseEvent, SseParser, type SseEvent } from './frames.js';
 import type { Connection } from './model-config.js';
 import { listCache } from './model-lists.js';
 import { answerWhole, currentOf, errorKind, reach, refreshed, relayTranslated, sessionHeader, type TokenSource, type TokenState } from './subscription.js';
-import { codexUsageBody, noteUsageHeaders, type Reported } from './usage.js';
+import { noteUsageHeaders } from './usage.js';
 
-const CODEX_BASE = 'https://chatgpt.com/backend-api/codex';
+const CODEX_BACKEND = 'https://chatgpt.com/backend-api/codex';
 const INVALID = [400, 404, 422];
-const USAGE_TIMEOUT_MS = 10_000;
 
 export interface CodexDeps {
   base?: string;
@@ -32,7 +34,7 @@ const codexLists = listCache<string>('codex');
 const sourceOf = (deps: CodexDeps): TokenSource<CodexTokens> => ({
   label: 'Codex',
   stale: (tokens) => tokensStale(tokens),
-  refresh: (tokens) => refreshTokens(tokens, deps.issuer, deps.fetchImpl),
+  refresh: (tokens) => (tokens.method === 'code' ? refreshCodeTokens(tokens, deps.issuer, deps.fetchImpl) : refreshTokens(tokens, deps.issuer, deps.fetchImpl)),
   save: deps.save,
 });
 
@@ -40,12 +42,14 @@ const OS_NAMES: Record<string, string> = { darwin: 'Mac OS', linux: 'Linux', win
 
 export const userAgent = (): string => `codex_cli_rs/${codexVersion()} (${OS_NAMES[platform()] ?? platform()} ${release()}; ${arch()}) metro`;
 
-function headersFor(tokens: CodexTokens, sessionId: string): Record<string, string> {
+const baseFor = (tokens: CodexTokens, deps: Pick<CodexDeps, 'base'>): string => deps.base ?? (tokens.method === 'code' ? CODEX_BACKEND : OPENAI_API);
+
+function headersFor(tokens: CodexTokens, accept: string, sessionId: string): Record<string, string> {
+  const plain = { authorization: `Bearer ${tokens.accessToken}`, 'content-type': 'application/json', accept };
+  if (tokens.method === 'chatgpt') return plain;
   return {
-    authorization: `Bearer ${tokens.accessToken}`,
+    ...plain,
     'chatgpt-account-id': tokens.accountId,
-    'content-type': 'application/json',
-    accept: 'text/event-stream',
     originator: 'codex_cli_rs',
     'user-agent': userAgent(),
     'openai-beta': 'responses=experimental',
@@ -54,7 +58,7 @@ function headersFor(tokens: CodexTokens, sessionId: string): Record<string, stri
 }
 
 export const currentTokens = (conn: Connection, deps: CodexDeps, state: CodexState): Promise<CodexTokens> =>
-  currentOf(state, conn.id, conn.codex, sourceOf(deps), 'Codex is not connected: sign in on the Model page.');
+  currentOf(state, conn.id, conn.codex, sourceOf(deps), CODEX_SIGN_IN);
 
 interface Call {
   body: Record<string, unknown>;
@@ -67,15 +71,26 @@ interface Call {
 
 function send(call: Call, tokens: CodexTokens): Promise<Response> {
   const request = toResponsesRequest(call.body, call.model, { promptCacheKey: call.sessionId, names: call.names });
-  return (call.deps.fetchImpl ?? fetch)(`${call.deps.base ?? CODEX_BASE}/responses`, {
+  return (call.deps.fetchImpl ?? fetch)(`${baseFor(tokens, call.deps)}/responses`, {
     method: 'POST',
-    headers: headersFor(tokens, call.sessionId),
+    headers: headersFor(tokens, 'text/event-stream', call.sessionId),
     body: JSON.stringify(request),
     signal: call.watch.signal,
     redirect: 'manual',
   });
 }
 
+function refusalOf(text: string, status: number): string {
+  let code = '';
+  try {
+    const parsed: unknown = JSON.parse(text);
+    code = isRecord(parsed) && isRecord(parsed.error) ? stringOf(parsed.error.code) : '';
+  } catch {
+    code = '';
+  }
+  return withUsageLink(code, upstreamMessage(text, `OpenAI answered ${String(status)}`));
+}
+
 export async function codexMessages(
   req: IncomingMessage,
   res: ServerResponse,
@@ -95,7 +110,7 @@ export async function codexMessages(
   noteUsageHeaders('codex', conn.id, upstream.headers);
   if (!upstream.ok) {
     const text = await upstream.text();
-    sendError(res, providerStatus(upstream.status), errorKind(upstream.status, INVALID), upstreamMessage(text, `Codex answered ${String(upstream.status)}`));
+    sendError(res, providerStatus(upstream.status), errorKind(upstream.status, INVALID), refusalOf(text, upstream.status));
     return;
   }
   const translator = new CodexEventTranslator(model, (name) => call.names.restore(name));
@@ -111,45 +126,18 @@ export async function codexMessages(
   answerWhole(res, frames + translator.close(), conn.id);
 }
 
-const jsonHeaders = (tokens: CodexTokens): Record<string, string> => ({ ...headersFor(tokens, randomUUID()), accept: 'application/json' });
-
-export const codexUsageUrl = (base = CODEX_BASE): string => `${base.replace(/\/codex\/?$/, '')}/wham/usage`;
-
-export async function codexUsageNow(conn: Connection, deps: CodexDeps, state: CodexState): Promise<Reported | null> {
-  const fetchImpl = deps.fetchImpl ?? fetch;
-  const res = await reach(
-    () => currentTokens(conn, deps, state),
-    (tokens) => refreshed(state, conn.id, tokens, sourceOf(deps)),
-    (tokens) => fetchImpl(codexUsageUrl(deps.base), { headers: jsonHeaders(tokens), redirect: 'manual', signal: AbortSignal.timeout(USAGE_TIMEOUT_MS) }),
-  );
-  if (!res.ok) {
-    await res.body?.cancel();
-    throw new GatewayError(res.status, errorKind(res.status, INVALID), `Codex would not report its usage (${String(res.status)})`);
-  }
-  return codexUsageBody(await res.json());
-}
-
 export async function codexModels(tokens: CodexTokens, deps: Omit<CodexDeps, 'save'>): Promise<string[]> {
+  const base = baseFor(tokens, deps);
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  if (tokens.method === 'chatgpt') return codexLists.get(`${base}:${tokens.clientId}`, () => listCodex(tokens, `${base}/models`, fetchImpl));
   const version = await learnCodexVersion();
-  const base = deps.base ?? CODEX_BASE;
-  return codexLists.get(`${base}:${tokens.accountId}:${version}`, () => listCodex(tokens, version, base, deps.fetchImpl ?? fetch));
+  return codexLists.get(`${base}:${tokens.accountId}:${version}`, () => listCodex(tokens, `${base}/models?client_version=${version}`, fetchImpl));
 }
 
-async function listCodex(tokens: CodexTokens, version: string, base: string, fetchImpl: typeof fetch): Promise<string[]> {
-  const res = await fetchImpl(`${base}/models?client_version=${version}`, {
-    headers: jsonHeaders(tokens),
-    redirect: 'manual',
-  });
-  if (!res.ok) throw new GatewayError(res.status, errorKind(res.status, INVALID), `Codex would not list models (${String(res.status)})`);
-  const slugs = new Set<string>();
-  const walk = (value: unknown): void => {
-    if (Array.isArray(value)) value.forEach(walk);
-    else if (typeof value === 'object' && value !== null) {
-      const record = value as Record<string, unknown>;
-      if (typeof record.slug === 'string' && record.slug !== '') slugs.add(record.slug);
-      Object.values(record).forEach(walk);
-    }
-  };
-  walk(await res.json());
-  return [...slugs];
+async function listCodex(tokens: CodexTokens, url: string, fetchImpl: typeof fetch): Promise<string[]> {
+  const res = await fetchImpl(url, { headers: headersFor(tokens, 'application/json', randomUUID()), redirect: 'manual' });
+  if (!res.ok) throw new GatewayError(res.status, errorKind(res.status, INVALID), `OpenAI would not list the models of this ChatGPT plan (${String(res.status)})`);
+  const body: unknown = await res.json();
+  const models: unknown[] = isRecord(body) && Array.isArray(body.models) ? body.models : [];
+  return models.filter(isRecord).flatMap((m) => ((m.visibility ?? 'list') === 'list' && stringOf(m.slug) !== '' ? [stringOf(m.slug)] : []));
 }

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-config.ts

@@ -3,7 +3,7 @@ import { ID_RE, newId } from '@metro-labs/core/ids';
 import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
 import { agentsDir } from '../agents/files.js';
 import { isRecord } from '@metro-labs/core/is-record';
-import { claimsOf, type CodexTokens } from './codex-auth.js';
+import { CODEX_SIGN_IN, NEW_CLIENT, type CodexCredential, type CodexMethod, type CodexTokens } from './codex-auth.js';
 import { tokensFromDisk as geminiTokensFromDisk, type GeminiTokens } from './gemini-auth.js';
 
 export const PROVIDERS = ['anthropic', 'bedrock', 'openrouter', 'codex', 'gemini'] as const;
@@ -89,23 +89,29 @@ function claudeFromDisk(raw: unknown): ClaudeLogin | null {
   return { id: text(raw.id), email: maybe(raw.email), plan: maybe(raw.plan), savedAt: text(raw.savedAt) };
 }
 
-function codexFromDisk(raw: unknown): CodexTokens | null {
-  if (!isRecord(raw)) return null;
+function credentialFromDisk(raw: Record<string, unknown>): CodexCredential | null {
   const accessToken = text(raw.accessToken);
   const refreshToken = text(raw.refreshToken);
-  const accountId = text(raw.accountId);
-  if (accessToken === '' || refreshToken === '' || accountId === '') return null;
+  if (accessToken === '' || refreshToken === '') return null;
   return {
+    email: maybe(raw.email),
     accessToken,
     refreshToken,
-    idToken: text(raw.idToken),
-    accountId,
-    email: maybe(raw.email),
-    plan: maybe(raw.plan),
+    expiresAt: typeof raw.expiresAt === 'number' && Number.isFinite(raw.expiresAt) ? raw.expiresAt : 0,
     savedAt: text(raw.savedAt) === '' ? new Date(0).toISOString() : text(raw.savedAt),
   };
 }
 
+function codexFromDisk(raw: unknown): CodexTokens | null {
+  if (!isRecord(raw)) return null;
+  const held = credentialFromDisk(raw);
+  if (held === null) return null;
+  const accountId = text(raw.accountId);
+  if (accountId !== '') return { method: 'code', accountId, plan: maybe(raw.plan), ...held };
+  const clientId = text(raw.clientId);
+  return clientId === '' || clientId === NEW_CLIENT ? null : { method: 'chatgpt', clientId, subject: text(raw.subject), ...held };
+}
+
 function connectionFromDisk(raw: unknown): Connection | null {
   if (!isRecord(raw) || !isProvider(raw.provider)) return null;
   const id = text(raw.id);
@@ -186,7 +192,7 @@ const CHECKS: Record<Provider, [(c: Connection) => boolean, string][]> = {
     [(c) => c.model === '', 'OpenRouter needs a model id: choose one on the Model page.'],
   ],
   codex: [
-    [(c) => c.codex === null, 'Codex is not connected: sign in with ChatGPT on the Model page.'],
+    [(c) => c.codex === null, CODEX_SIGN_IN],
     [(c) => c.model === '', 'Codex needs a model id: choose one on the Model page.'],
   ],
   gemini: [
@@ -233,11 +239,10 @@ export const routeLabel = (route: Route): string =>
 
 export const PASSTHROUGH_ID = 'passthrough';
 
-function signedInAs(c: Connection): { account: string | null; plan: string | null } {
+function signedInAs(c: Connection): { account: string | null; plan: string | null; method?: CodexMethod } {
   if (c.claude !== null) return { account: c.claude.email, plan: c.claude.plan };
-  if (c.codex === null) return { account: c.gemini?.email ?? null, plan: c.gemini?.tier ?? null };
-  const claims = claimsOf(c.codex.idToken);
-  return { account: c.codex.email ?? claims.email, plan: c.codex.plan ?? claims.plan };
+  if (c.codex !== null) return { account: c.codex.email, plan: c.codex.method === 'code' ? c.codex.plan : null, method: c.codex.method };
+  return { account: c.gemini?.email ?? null, plan: c.gemini?.tier ?? null };
 }
 
 function publicConnection(c: Connection): Record<string, unknown> {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-signin.ts

@@ -3,9 +3,9 @@ import { ApiError } from '@metro-labs/http/api-error';
 import { readJsonBody } from '@metro-labs/http/api-http';
 import { isRecord } from '@metro-labs/core/is-record';
 import { log } from '@metro-labs/core/log';
-import { beginLogin, finishLogin, readCodexCliAuth, type CodexTokens } from './codex-auth.js';
+import { beginLogin, chatgptHostId, finishLogin, type ChatgptTokens, type CodexTokens } from './codex-auth.js';
 import { beginDeviceLogin, pollDeviceLogin } from './codex-device.js';
-import { codexModels, currentTokens, sharedCodexState } from './codex.js';
+import { codexModels, currentTokens, sharedCodexState, type CodexDeps } from './codex.js';
 import { beginLogin as beginGeminiLogin, exchangeCode as exchangeGeminiCode, userEmail, type GeminiTokens } from './gemini-auth.js';
 import { onboard, parseGeminiProject } from './gemini-setup.js';
 import { currentGeminiTokens, listGeminiModels, sharedGeminiState, type GeminiDeps } from './gemini.js';
@@ -40,21 +40,7 @@ const saved = (store: Store, cfg: ModelConfig, note: string, fields: { connectio
   return settingsBody(cfg);
 };
 
-function keepCodex(store: Store, req: IncomingMessage, tokens: CodexTokens | null, note: string): unknown {
-  const { cfg, id } = connectionToFill(store, req, 'codex');
-  const twin = cfg.connections.find((c) => c.id !== id && tokens !== null && c.codex?.refreshToken === tokens.refreshToken);
-  if (twin !== undefined) throw new ApiError(`this ChatGPT login is already connected as ${twin.label}; sign in with ChatGPT to add another one`, 409);
-  const next = setCodexAuth(cfg, id, tokens);
-  return saved(store, next, note, { connection: id, plan: tokens?.plan ?? null });
-}
-
-async function pollDevice(id: string, req: IncomingMessage, deps: ModelApiDeps, store: Store): Promise<unknown> {
-  const result = await pollDeviceLogin(id, deps.fetchImpl).catch(asApiError);
-  if (result.status !== 'done') return result;
-  return { status: 'done', settings: keepCodex(store, req, result.tokens, 'model-api: Codex connected by device code') };
-}
-
-export const codexDepsFor = (deps: ModelApiDeps, store: Store, id: string): { issuer?: string; fetchImpl?: typeof fetch; base?: string; save: (connId: string, t: CodexTokens) => void } => ({
+const codexDepsFor = (deps: ModelApiDeps, store: Store, id: string): CodexDeps => ({
   issuer: deps.issuer,
   fetchImpl: deps.fetchImpl,
   base: deps.codexBase,
@@ -63,34 +49,42 @@ export const codexDepsFor = (deps: ModelApiDeps, store: Store, id: string): { is
   },
 });
 
+function renewing(store: Store, req: IncomingMessage): ChatgptTokens | null {
+  if (askedConnection(req) === '') return null;
+  const tokens = connectionFor(store.read(), req, 'codex').codex;
+  return tokens?.method === 'chatgpt' ? tokens : null;
+}
+
+function keepCodex(store: Store, req: IncomingMessage, tokens: CodexTokens, note: string): unknown {
+  const { cfg, id } = connectionToFill(store, req, 'codex');
+  return saved(store, setCodexAuth(cfg, id, tokens), note, { connection: id, method: tokens.method });
+}
+
+async function pollDevice(id: string, req: IncomingMessage, deps: ModelApiDeps, store: Store): Promise<unknown> {
+  const result = await pollDeviceLogin(id, deps.fetchImpl).catch(asApiError);
+  if (result.status !== 'done') return result;
+  return { status: 'done', settings: keepCodex(store, req, result.tokens, 'model-api: Codex connected with a code') };
+}
+
 export const CODEX_ROUTES: Record<string, Route> = {
-  device: {
+  login: {
     method: 'POST',
-    run: async (_req, deps) => {
-      const login = await beginDeviceLogin(deps.issuer, deps.fetchImpl).catch(asApiError);
-      return { id: login.id, user_code: login.userCode, verify_url: login.verifyUrl, interval: login.interval };
-    },
+    run: (req, deps, store) => Promise.resolve({ url: beginLogin(renewing(store, req), chatgptHostId(deps.setup?.agents), deps.issuer) }),
   },
-  login: { method: 'POST', run: (_req, deps) => Promise.resolve({ url: beginLogin(deps.issuer).url }) },
   callback: {
     method: 'POST',
     run: async (req, deps, store) => {
       const body = await readJsonBody(req, BODY_MAX);
       const raw = isRecord(body) && typeof body.url === 'string' ? body.url : '';
       const tokens = await finishLogin(raw, deps.issuer, deps.fetchImpl).catch(asApiError);
-      return keepCodex(store, req, tokens, 'model-api: Codex connected');
+      return keepCodex(store, req, tokens, 'model-api: Codex connected with Sign in with ChatGPT');
     },
   },
-  import: {
+  device: {
     method: 'POST',
-    run: (_req, deps, store) => {
-      let tokens;
-      try {
-        tokens = readCodexCliAuth(deps.codexHome);
-      } catch (err) {
-        asApiError(err);
-      }
-      return Promise.resolve(keepCodex(store, _req, tokens, 'model-api: Codex CLI login imported'));
+    run: async (_req, deps) => {
+      const login = await beginDeviceLogin(deps.issuer, deps.fetchImpl).catch(asApiError);
+      return { id: login.id, user_code: login.userCode, verify_url: login.verifyUrl, interval: login.interval };
     },
   },
   models: {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-store.ts

@@ -15,7 +15,6 @@ export interface ModelApiDeps {
   write?: (cfg: ModelConfig) => void;
   issuer?: string;
   fetchImpl?: typeof fetch;
-  codexHome?: string;
   codexBase?: string;
   geminiAuthBase?: string;
   geminiTokenBase?: string;

package/runtime/node_modules/@metro-labs/daemon/src/gateway/usage-refresh.ts

@@ -1,11 +1,10 @@
 import { errMsg, log } from '@metro-labs/core/log';
 import { readClaudeUsage } from '../claude/usage-probe.js';
-import { codexUsageNow, sharedCodexState } from './codex.js';
 import { openrouterKey } from './openrouter.js';
 import { lastServed } from './served.js';
 import { claudeLoginUsage, geminiUsage, keepProbeAnswer, mayProbe, mergeUsage, noteUsage, openrouterUsage, probeAnswer, usageOf } from './usage.js';
 import { PASSTHROUGH_ID, readModelConfig, routedConnection, writeModelConfig, type Connection, type ModelConfig } from './model-config.js';
-import { codexDepsFor, geminiModelsOf } from './model-signin.js';
+import { geminiModelsOf } from './model-signin.js';
 import { claudeLoginDeps, CREDITS_TTL_MS, type ModelApiDeps, type Store } from './model-store.js';
 import { probeClaudeLogin } from './claude-logins.js';
 
@@ -34,14 +33,6 @@ async function refreshKey(conn: Connection, deps: ModelApiDeps, now: number): Pr
   });
 }
 
-async function refreshCodex(conn: Connection, deps: ModelApiDeps, store: Store, now: number): Promise<void> {
-  if (conn.codex === null || !due(conn.id, now)) return;
-  await probe('Codex usage', async () => {
-    const usage = await codexUsageNow(conn, codexDepsFor(deps, store, conn.id), sharedCodexState);
-    if (usage !== null) noteUsage(conn.id, usage);
-  });
-}
-
 const modelsInUse = (conn: Connection, cfg: ModelConfig): Set<string> => {
   const served = lastServed();
   const fallbacks = (cfg.fallbacks ?? []).filter((f) => f.connection === conn.id).map((f) => f.model);
@@ -92,7 +83,6 @@ async function refreshLogin(cfg: ModelConfig, deps: ModelApiDeps, now: number):
 
 function refreshOne(conn: Connection, cfg: ModelConfig, deps: ModelApiDeps, store: Store, now: number): Promise<void> {
   if (conn.provider === 'openrouter') return refreshKey(conn, deps, now);
-  if (conn.provider === 'codex') return refreshCodex(conn, deps, store, now);
   if (conn.provider === 'gemini') return refreshQuota(conn, deps, store, now);
   if (conn.provider === 'anthropic') return refreshOwnLogin(conn, cfg, deps, now);
   return Promise.resolve();

package/runtime/node_modules/@metro-labs/daemon/src/gateway/usage.ts

@@ -271,36 +271,6 @@ const textOf = (raw: unknown): string | null => (typeof raw === 'number' || type
 
 const numberOf = (raw: unknown): number | null => (typeof raw === 'number' && Number.isFinite(raw) ? raw : null);
 
-const SECONDS_PER_MINUTE = 60;
-
-function codexBodyWindow(raw: unknown, now: Date): UsageWindow | null {
-  if (!isRecord(raw)) return null;
-  const percent = numberOf(raw.used_percent);
-  if (percent === null) return null;
-  const seconds = numberOf(raw.limit_window_seconds);
-  const minutes = seconds === null || seconds <= 0 ? null : Math.ceil(seconds / SECONDS_PER_MINUTE);
-  const resetAt = whenFrom(textOf(raw.reset_at), now) ?? whenFrom(textOf(raw.reset_after_seconds), now, true);
-  return { label: windowLabel(minutes), used: clamp(percent / 100), resetAt, detail: null };
-}
-
-function codexWall(limit: Record<string, unknown>, reached: unknown): string | null {
-  if (limit.limit_reached !== true && limit.allowed !== false) return null;
-  const kind = isRecord(reached) ? stringOf(reached.type) : '';
-  return kind === '' ? 'limit reached' : kind.replaceAll('_', ' ');
-}
-
-export function codexUsageBody(body: unknown, now = new Date()): Reported | null {
-  if (!isRecord(body)) return null;
-  const limit = isRecord(body.rate_limit) ? body.rate_limit : {};
-  const credits = isRecord(body.credits) ? body.credits : {};
-  const windows = [
-    codexBodyWindow(limit.primary_window, now),
-    codexBodyWindow(limit.secondary_window, now),
-    creditsLeft(credits.has_credits === true, textOf(credits.balance)),
-  ].filter(present);
-  return windows.length === 0 ? null : { windows, note: codexWall(limit, body.rate_limit_reached_type), at: now.toISOString() };
-}
-
 const CLAUDE_WINDOWS: [string, string][] = [
   ['five_hour', '5-hour window'],
   ['seven_day', 'Weekly'],

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.254"
+  "version": "0.1.0-beta.256"
 }