@stage-labs/metro 0.1.0-beta.255 → 0.1.0-beta.256

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.255",
+  "version": "0.1.0-beta.256",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.255",
+  "version": "0.1.0-beta.256",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex-auth.ts

@@ -7,13 +7,13 @@ import { agentsDir } from '../agents/files.js';
 import { newPkce } from './pkce.js';
 import { nonEmpty } from './text.js';
 
-const CODEX_ISSUER = 'https://auth.openai.com';
+export const CODEX_ISSUER = 'https://auth.openai.com';
 export const CODEX_REDIRECT = 'http://127.0.0.1:1455/auth/callback';
 export const OPENAI_API = 'https://api.openai.com/v1';
 export const NEW_CLIENT = 'dynamic_agent_client';
 export const APP_NAME = 'Metro';
 export const PLAN_SCOPE = 'chatgpt.tokens.use.direct';
-export const CODEX_SIGN_IN = "Codex needs a ChatGPT sign-in: Metro now uses OpenAI's official Sign in with ChatGPT, so sign in again on the Model page.";
+export const CODEX_SIGN_IN = 'Codex is not signed in: sign in with ChatGPT on the Model page.';
 const SCOPE = `openid profile email offline_access resource.invoke ${PLAN_SCOPE}`;
 const PROFILE_CLAIM = 'https://api.openai.com/profile';
 const HOST_FILE = 'chatgpt-host.json';
@@ -23,9 +23,9 @@ const DEFAULT_TTL_MS = 60 * 60_000;
 const RENEW_BEFORE_MS = 2 * 60_000;
 const AGAIN = 'press Continue with ChatGPT again';
 
-export interface CodexTokens {
-  clientId: string;
-  subject: string;
+export type CodexMethod = 'chatgpt' | 'code';
+
+export interface CodexCredential {
   email: string | null;
   accessToken: string;
   refreshToken: string;
@@ -33,6 +33,20 @@ export interface CodexTokens {
   savedAt: string;
 }
 
+export interface ChatgptTokens extends CodexCredential {
+  method: 'chatgpt';
+  clientId: string;
+  subject: string;
+}
+
+export interface CodeTokens extends CodexCredential {
+  method: 'code';
+  accountId: string;
+  plan: string | null;
+}
+
+export type CodexTokens = ChatgptTokens | CodeTokens;
+
 export class CodexAuthError extends Error {}
 
 interface Pending {
@@ -53,12 +67,12 @@ export function chatgptHostId(dir = agentsDir()): string {
   return made;
 }
 
-function returning(previous: CodexTokens | null): Record<string, string> {
+function returning(previous: ChatgptTokens | null): Record<string, string> {
   if (previous === null) return { client_id: NEW_CLIENT, agent_name_hint: APP_NAME };
   return { client_id: previous.clientId, ...(previous.email === null ? {} : { login_hint: previous.email }) };
 }
 
-export function beginLogin(previous: CodexTokens | null, hostId: string, issuer = CODEX_ISSUER, now = Date.now()): string {
+export function beginLogin(previous: ChatgptTokens | null, hostId: string, issuer = CODEX_ISSUER, now = Date.now()): string {
   const { verifier, challenge } = newPkce();
   const nonce = randomBytes(32).toString('base64url');
   const { ticket: state } = pending.mint({ verifier, nonce, clientId: previous?.clientId ?? null, subject: previous?.subject ?? null }, now);
@@ -103,7 +117,7 @@ export function parseCallback(raw: string): { code: string; state: string; clien
   return { code, state, clientId: nonEmpty(param(query, 'client_id')) };
 }
 
-function decodeJwtPayload(jwt: string): Record<string, unknown> {
+export function decodeJwtPayload(jwt: string): Record<string, unknown> {
   const part = jwt.split('.')[1] ?? '';
   try {
     const parsed: unknown = JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
@@ -113,22 +127,31 @@ function decodeJwtPayload(jwt: string): Record<string, unknown> {
   }
 }
 
+export function emailOf(claims: Record<string, unknown>): string | null {
+  const profile = isRecord(claims[PROFILE_CLAIM]) ? claims[PROFILE_CLAIM] : {};
+  return nonEmpty(claims.email) ?? nonEmpty(profile.email);
+}
+
 function identityOf(idToken: unknown, expected: { issuer: string; clientId: string; nonce: string }): { subject: string; email: string | null } {
   const claims = decodeJwtPayload(typeof idToken === 'string' ? idToken : '');
   const audience: unknown[] = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
   const subject = nonEmpty(claims.sub);
   if (subject === null || claims.iss !== expected.issuer || !audience.includes(expected.clientId) || claims.nonce !== expected.nonce)
     throw new CodexAuthError(`OpenAI sent back an identity that does not match this sign-in; ${AGAIN}`);
-  const profile = isRecord(claims[PROFILE_CLAIM]) ? claims[PROFILE_CLAIM] : {};
-  return { subject, email: nonEmpty(claims.email) ?? nonEmpty(profile.email) };
+  return { subject, email: emailOf(claims) };
 }
 
-async function tokenCall(issuer: string, form: Record<string, string>, fetchImpl: typeof fetch): Promise<Record<string, unknown>> {
-  const res = await fetchImpl(`${issuer}/api/accounts/oauth/token`, {
-    method: 'POST',
-    headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
-    body: new URLSearchParams(form).toString(),
-  });
+interface Encoded {
+  type: string;
+  body: string;
+}
+
+export const asForm = (fields: Record<string, string>): Encoded => ({ type: 'application/x-www-form-urlencoded', body: new URLSearchParams(fields).toString() });
+
+export const asJson = (fields: Record<string, string>): Encoded => ({ type: 'application/json', body: JSON.stringify(fields) });
+
+export async function tokenCall(url: string, sent: Encoded, fetchImpl: typeof fetch): Promise<Record<string, unknown>> {
+  const res = await fetchImpl(url, { method: 'POST', headers: { 'content-type': sent.type, accept: 'application/json' }, body: sent.body });
   const raw = await res.text();
   let parsed: unknown = null;
   try {
@@ -141,14 +164,24 @@ async function tokenCall(issuer: string, form: Record<string, string>, fetchImpl
   return body;
 }
 
-function tokensFrom(body: Record<string, unknown>, who: Pick<CodexTokens, 'clientId' | 'subject' | 'email'>, keptRefresh: string, now: number): CodexTokens {
+export function grantOf(body: Record<string, unknown>, keptRefresh: string, now: number): Omit<CodexCredential, 'email'> {
   const accessToken = nonEmpty(body.access_token) ?? '';
   const refreshToken = nonEmpty(body.refresh_token) ?? keptRefresh;
-  if (accessToken === '' || refreshToken === '') throw new CodexAuthError(`OpenAI returned no usable tokens; ${AGAIN}`);
+  if (accessToken === '' || refreshToken === '') throw new CodexAuthError('OpenAI returned no usable tokens; sign in again');
   const ttl = typeof body.expires_in === 'number' && body.expires_in > 0 ? body.expires_in * 1000 : DEFAULT_TTL_MS;
-  return { clientId: who.clientId, subject: who.subject, email: who.email, accessToken, refreshToken, expiresAt: now + ttl, savedAt: new Date(now).toISOString() };
+  return { accessToken, refreshToken, expiresAt: now + ttl, savedAt: new Date(now).toISOString() };
 }
 
+const tokensFrom = (body: Record<string, unknown>, who: Pick<ChatgptTokens, 'clientId' | 'subject' | 'email'>, keptRefresh: string, now: number): ChatgptTokens => ({
+  method: 'chatgpt',
+  clientId: who.clientId,
+  subject: who.subject,
+  email: who.email,
+  ...grantOf(body, keptRefresh, now),
+});
+
+const officialToken = (issuer: string): string => `${issuer}/api/accounts/oauth/token`;
+
 function clientOf(started: Pending, returned: string | null): string {
   const clientId = started.clientId ?? returned;
   if (clientId === null || clientId === NEW_CLIENT) throw new CodexAuthError(`ChatGPT did not finish registering Metro; ${AGAIN}`);
@@ -156,14 +189,14 @@ function clientOf(started: Pending, returned: string | null): string {
   return clientId;
 }
 
-export async function finishLogin(callback: string, issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<CodexTokens> {
+export async function finishLogin(callback: string, issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<ChatgptTokens> {
   const { code, state, clientId: returned } = parseCallback(callback);
   const started = pending.take(state, now);
   if (started === undefined) throw new CodexAuthError(`this sign-in link has expired or was started elsewhere; ${AGAIN}`);
   const clientId = clientOf(started, returned);
   const body = await tokenCall(
-    issuer,
-    { grant_type: 'authorization_code', client_id: clientId, code, code_verifier: started.verifier, redirect_uri: CODEX_REDIRECT, resource: OPENAI_API },
+    officialToken(issuer),
+    asForm({ grant_type: 'authorization_code', client_id: clientId, code, code_verifier: started.verifier, redirect_uri: CODEX_REDIRECT, resource: OPENAI_API }),
     fetchImpl,
   );
   const who = identityOf(body.id_token, { issuer, clientId, nonce: started.nonce });
@@ -174,10 +207,10 @@ export async function finishLogin(callback: string, issuer = CODEX_ISSUER, fetch
   return tokensFrom(body, { clientId, ...who }, '', now);
 }
 
-export async function refreshTokens(previous: CodexTokens, issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<CodexTokens> {
+export async function refreshTokens(previous: ChatgptTokens, issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<ChatgptTokens> {
   const body = await tokenCall(
-    issuer,
-    { grant_type: 'refresh_token', client_id: previous.clientId, refresh_token: previous.refreshToken, resource: OPENAI_API },
+    officialToken(issuer),
+    asForm({ grant_type: 'refresh_token', client_id: previous.clientId, refresh_token: previous.refreshToken, resource: OPENAI_API }),
     fetchImpl,
   );
   return tokensFrom(body, previous, previous.refreshToken, now);

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex-device.ts

@@ -0,0 +1,119 @@
+import { randomBytes } from 'node:crypto';
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg } from '@metro-labs/core/log';
+import { stringOf } from '@metro-labs/http/api-http';
+import { asForm, asJson, CODEX_ISSUER, CodexAuthError, decodeJwtPayload, emailOf, grantOf, tokenCall, type CodeTokens } from './codex-auth.js';
+import { nonEmpty } from './text.js';
+
+const CODEX_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
+const AUTH_CLAIM = 'https://api.openai.com/auth';
+const VERIFY_PATH = '/codex/device';
+const DEVICE_TTL_MS = 15 * 60_000;
+const DEFAULT_INTERVAL_S = 5;
+const ID_BYTES = 18;
+const AGAIN = 'press Sign in with a code again';
+
+export interface DeviceLogin {
+  id: string;
+  userCode: string;
+  verifyUrl: string;
+  interval: number;
+}
+
+export type DeviceStatus = { status: 'pending' } | { status: 'done'; tokens: CodeTokens } | { status: 'failed'; error: string };
+
+interface Entry {
+  deviceAuthId: string;
+  userCode: string;
+  interval: number;
+  issuer: string;
+  startedAt: number;
+  polledAt: number | null;
+}
+
+const logins = new Map<string, Entry>();
+
+function claimsOf(idToken: string): { accountId: string | null; email: string | null; plan: string | null } {
+  const payload = decodeJwtPayload(idToken);
+  const auth = isRecord(payload[AUTH_CLAIM]) ? payload[AUTH_CLAIM] : {};
+  return { accountId: nonEmpty(auth.chatgpt_account_id), email: emailOf(payload), plan: nonEmpty(auth.chatgpt_plan_type) };
+}
+
+function codeTokensFrom(body: Record<string, unknown>, previous: CodeTokens | null, now: number): CodeTokens {
+  const fresh = claimsOf(nonEmpty(body.id_token) ?? '');
+  const kept = previous ?? { accountId: null, email: null, plan: null, refreshToken: '' };
+  const accountId = fresh.accountId ?? kept.accountId ?? '';
+  if (accountId === '') throw new CodexAuthError('the id token carries no ChatGPT account id; sign in with a ChatGPT account that has Codex');
+  return { method: 'code', accountId, email: fresh.email ?? kept.email, plan: fresh.plan ?? kept.plan, ...grantOf(body, kept.refreshToken, now) };
+}
+
+const cliToken = (issuer: string): string => `${issuer}/oauth/token`;
+
+export async function refreshCodeTokens(previous: CodeTokens, issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<CodeTokens> {
+  const body = await tokenCall(cliToken(issuer), asJson({ client_id: CODEX_CLIENT_ID, grant_type: 'refresh_token', refresh_token: previous.refreshToken }), fetchImpl);
+  return codeTokensFrom(body, previous, now);
+}
+
+function intervalOf(value: unknown): number {
+  const n = typeof value === 'number' ? value : typeof value === 'string' ? Number(value) : NaN;
+  return Number.isFinite(n) && n >= 1 ? Math.round(n) : DEFAULT_INTERVAL_S;
+}
+
+function sweep(now: number): void {
+  for (const [id, entry] of logins) if (now - entry.startedAt > DEVICE_TTL_MS) logins.delete(id);
+}
+
+const post = (url: string, body: unknown, fetchImpl: typeof fetch): Promise<Response> =>
+  fetchImpl(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });
+
+export async function beginDeviceLogin(issuer = CODEX_ISSUER, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<DeviceLogin> {
+  sweep(now);
+  const res = await post(`${issuer}/api/accounts/deviceauth/usercode`, { client_id: CODEX_CLIENT_ID }, fetchImpl);
+  if (res.status === 404) throw new CodexAuthError('OpenAI is not offering the code sign-in right now; use Continue with ChatGPT instead');
+  if (!res.ok) throw new CodexAuthError(`OpenAI refused to start the code sign-in (${String(res.status)})`);
+  const body: unknown = await res.json();
+  const parsed = isRecord(body) ? body : {};
+  const deviceAuthId = stringOf(parsed.device_auth_id);
+  const userCode = stringOf(parsed.user_code) || stringOf(parsed.usercode);
+  if (deviceAuthId === '' || userCode === '') throw new CodexAuthError('OpenAI answered without a device code');
+  const id = randomBytes(ID_BYTES).toString('base64url');
+  const interval = intervalOf(parsed.interval);
+  logins.set(id, { deviceAuthId, userCode, interval, issuer, startedAt: now, polledAt: null });
+  return { id, userCode, verifyUrl: `${issuer}${VERIFY_PATH}`, interval };
+}
+
+async function claim(entry: Entry, fetchImpl: typeof fetch, now: number): Promise<DeviceStatus> {
+  const res = await post(`${entry.issuer}/api/accounts/deviceauth/token`, { device_auth_id: entry.deviceAuthId, user_code: entry.userCode }, fetchImpl);
+  if (res.status === 403 || res.status === 404) {
+    await res.body?.cancel();
+    return { status: 'pending' };
+  }
+  if (!res.ok) return { status: 'failed', error: `OpenAI ended the code sign-in (${String(res.status)})` };
+  const body: unknown = await res.json();
+  const parsed = isRecord(body) ? body : {};
+  const code = stringOf(parsed.authorization_code);
+  const verifier = stringOf(parsed.code_verifier);
+  if (code === '' || verifier === '') return { status: 'failed', error: 'OpenAI approved the sign-in but sent no code back' };
+  const granted = await tokenCall(
+    cliToken(entry.issuer),
+    asForm({ grant_type: 'authorization_code', code, redirect_uri: `${entry.issuer}/deviceauth/callback`, client_id: CODEX_CLIENT_ID, code_verifier: verifier }),
+    fetchImpl,
+  );
+  return { status: 'done', tokens: codeTokensFrom(granted, null, now) };
+}
+
+export async function pollDeviceLogin(id: string, fetchImpl: typeof fetch = fetch, now = Date.now()): Promise<DeviceStatus> {
+  sweep(now);
+  const entry = logins.get(id);
+  if (entry === undefined) throw new CodexAuthError(`this sign-in has expired or already finished; ${AGAIN}`);
+  if (entry.polledAt !== null && now - entry.polledAt < entry.interval * 1000) return { status: 'pending' };
+  entry.polledAt = now;
+  let result: DeviceStatus;
+  try {
+    result = await claim(entry, fetchImpl, now);
+  } catch (err) {
+    result = { status: 'failed', error: errMsg(err) };
+  }
+  if (result.status !== 'pending') logins.delete(id);
+  return result;
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex-version.ts

@@ -0,0 +1,44 @@
+import { errMsg, log } from '@metro-labs/core/log';
+
+const BUILT_IN = '0.157.1';
+const REGISTRY = 'https://registry.npmjs.org/@openai/codex/latest';
+const OVERRIDE_RE = /^\d+\.\d+\.\d+(?:-[A-Za-z0-9.]+)?$/;
+const STABLE_RE = /^\d+\.\d+\.\d+$/;
+const FRESH_MS = 6 * 3_600_000;
+const FETCH_MS = 5_000;
+
+let learned: { version: string; at: number } | null = null;
+
+const parts = (version: string): number[] => version.split('.').map(Number);
+
+function newer(a: string, b: string): boolean {
+  const [x, y] = [parts(a), parts(b)];
+  for (let i = 0; i < 3; i++) if ((x[i] ?? 0) !== (y[i] ?? 0)) return (x[i] ?? 0) > (y[i] ?? 0);
+  return false;
+}
+
+export function codexVersion(): string {
+  const wanted = process.env.METRO_CODEX_VERSION?.trim() ?? '';
+  if (wanted !== '' && OVERRIDE_RE.test(wanted)) return wanted;
+  if (wanted !== '') log.warn({ value: wanted }, 'gateway: METRO_CODEX_VERSION is not a version like 0.157.1; using the known one');
+  return learned !== null && newer(learned.version, BUILT_IN) ? learned.version : BUILT_IN;
+}
+
+async function latestOnNpm(): Promise<string> {
+  const res = await fetch(process.env.METRO_CODEX_REGISTRY ?? REGISTRY, { signal: AbortSignal.timeout(FETCH_MS) });
+  const body: unknown = await res.json();
+  const version = typeof body === 'object' && body !== null ? (body as { version?: unknown }).version : undefined;
+  if (!res.ok || typeof version !== 'string' || !STABLE_RE.test(version)) throw new Error(`npm answered ${String(res.status)} without a stable version`);
+  return version;
+}
+
+export async function learnCodexVersion(now = Date.now()): Promise<string> {
+  if (learned !== null && now - learned.at < FRESH_MS) return codexVersion();
+  try {
+    learned = { version: await latestOnNpm(), at: now };
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'gateway: the latest Codex version could not be read from npm; using the known one');
+    learned = { version: learned?.version ?? BUILT_IN, at: now };
+  }
+  return codexVersion();
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex.ts

@@ -1,8 +1,11 @@
 import { randomUUID } from 'node:crypto';
 import type { IncomingMessage, ServerResponse } from 'node:http';
+import { arch, platform, release } from 'node:os';
 import { isRecord } from '@metro-labs/core/is-record';
 import { stringOf } from '@metro-labs/http/api-http';
 import { OPENAI_API, CODEX_SIGN_IN, refreshTokens, tokensStale, type CodexTokens } from './codex-auth.js';
+import { refreshCodeTokens } from './codex-device.js';
+import { codexVersion, learnCodexVersion } from './codex-version.js';
 import { CodexEventTranslator, withUsageLink } from './codex-stream.js';
 import { ToolNames, toResponsesRequest } from './codex-translate.js';
 import { GatewayError, providerStatus, sendError, upstreamMessage, type Watch } from './forward.js';
@@ -12,6 +15,7 @@ import { listCache } from './model-lists.js';
 import { answerWhole, currentOf, errorKind, reach, refreshed, relayTranslated, sessionHeader, type TokenSource, type TokenState } from './subscription.js';
 import { noteUsageHeaders } from './usage.js';
 
+const CODEX_BACKEND = 'https://chatgpt.com/backend-api/codex';
 const INVALID = [400, 404, 422];
 
 export interface CodexDeps {
@@ -30,15 +34,28 @@ const codexLists = listCache<string>('codex');
 const sourceOf = (deps: CodexDeps): TokenSource<CodexTokens> => ({
   label: 'Codex',
   stale: (tokens) => tokensStale(tokens),
-  refresh: (tokens) => refreshTokens(tokens, deps.issuer, deps.fetchImpl),
+  refresh: (tokens) => (tokens.method === 'code' ? refreshCodeTokens(tokens, deps.issuer, deps.fetchImpl) : refreshTokens(tokens, deps.issuer, deps.fetchImpl)),
   save: deps.save,
 });
 
-const headersFor = (tokens: CodexTokens, accept: string): Record<string, string> => ({
-  authorization: `Bearer ${tokens.accessToken}`,
-  'content-type': 'application/json',
-  accept,
-});
+const OS_NAMES: Record<string, string> = { darwin: 'Mac OS', linux: 'Linux', win32: 'Windows' };
+
+export const userAgent = (): string => `codex_cli_rs/${codexVersion()} (${OS_NAMES[platform()] ?? platform()} ${release()}; ${arch()}) metro`;
+
+const baseFor = (tokens: CodexTokens, deps: Pick<CodexDeps, 'base'>): string => deps.base ?? (tokens.method === 'code' ? CODEX_BACKEND : OPENAI_API);
+
+function headersFor(tokens: CodexTokens, accept: string, sessionId: string): Record<string, string> {
+  const plain = { authorization: `Bearer ${tokens.accessToken}`, 'content-type': 'application/json', accept };
+  if (tokens.method === 'chatgpt') return plain;
+  return {
+    ...plain,
+    'chatgpt-account-id': tokens.accountId,
+    originator: 'codex_cli_rs',
+    'user-agent': userAgent(),
+    'openai-beta': 'responses=experimental',
+    'session-id': sessionId,
+  };
+}
 
 export const currentTokens = (conn: Connection, deps: CodexDeps, state: CodexState): Promise<CodexTokens> =>
   currentOf(state, conn.id, conn.codex, sourceOf(deps), CODEX_SIGN_IN);
@@ -54,9 +71,9 @@ interface Call {
 
 function send(call: Call, tokens: CodexTokens): Promise<Response> {
   const request = toResponsesRequest(call.body, call.model, { promptCacheKey: call.sessionId, names: call.names });
-  return (call.deps.fetchImpl ?? fetch)(`${call.deps.base ?? OPENAI_API}/responses`, {
+  return (call.deps.fetchImpl ?? fetch)(`${baseFor(tokens, call.deps)}/responses`, {
     method: 'POST',
-    headers: headersFor(tokens, 'text/event-stream'),
+    headers: headersFor(tokens, 'text/event-stream', call.sessionId),
     body: JSON.stringify(request),
     signal: call.watch.signal,
     redirect: 'manual',
@@ -110,14 +127,17 @@ export async function codexMessages(
 }
 
 export async function codexModels(tokens: CodexTokens, deps: Omit<CodexDeps, 'save'>): Promise<string[]> {
-  const base = deps.base ?? OPENAI_API;
-  return codexLists.get(`${base}:${tokens.clientId}`, () => listCodex(tokens, base, deps.fetchImpl ?? fetch));
+  const base = baseFor(tokens, deps);
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  if (tokens.method === 'chatgpt') return codexLists.get(`${base}:${tokens.clientId}`, () => listCodex(tokens, `${base}/models`, fetchImpl));
+  const version = await learnCodexVersion();
+  return codexLists.get(`${base}:${tokens.accountId}:${version}`, () => listCodex(tokens, `${base}/models?client_version=${version}`, fetchImpl));
 }
 
-async function listCodex(tokens: CodexTokens, base: string, fetchImpl: typeof fetch): Promise<string[]> {
-  const res = await fetchImpl(`${base}/models`, { headers: headersFor(tokens, 'application/json'), redirect: 'manual' });
+async function listCodex(tokens: CodexTokens, url: string, fetchImpl: typeof fetch): Promise<string[]> {
+  const res = await fetchImpl(url, { headers: headersFor(tokens, 'application/json', randomUUID()), redirect: 'manual' });
   if (!res.ok) throw new GatewayError(res.status, errorKind(res.status, INVALID), `OpenAI would not list the models of this ChatGPT plan (${String(res.status)})`);
   const body: unknown = await res.json();
   const models: unknown[] = isRecord(body) && Array.isArray(body.models) ? body.models : [];
-  return models.filter(isRecord).flatMap((m) => (m.visibility === 'list' && stringOf(m.slug) !== '' ? [stringOf(m.slug)] : []));
+  return models.filter(isRecord).flatMap((m) => ((m.visibility ?? 'list') === 'list' && stringOf(m.slug) !== '' ? [stringOf(m.slug)] : []));
 }

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-api.ts

@@ -22,7 +22,7 @@ import {
 } from './model-config.js';
 import { asApiError, BODY_MAX, claudeLoginDeps, connectionFor, settingsBody, type ModelApiDeps, type Route, type Store } from './model-store.js';
 import { dropUnusedClaudeLogins } from './claude-logins.js';
-import { CODEX_ROUTES, GEMINI_ROUTES } from './model-signin.js';
+import { CODEX_ROUTES, codexDeviceRoute, GEMINI_ROUTES } from './model-signin.js';
 import { refreshUsage } from './usage-refresh.js';
 
 const PATH = '/api/model';
@@ -36,6 +36,8 @@ const BEDROCK = '/api/model/bedrock/';
 const BUNDLE = '/api/model/bundle';
 const RESTORE = '/api/model/restore';
 const RESTORE_MAX = 64 * 1024;
+const DEVICE_PREFIX = 'device/';
+const DEVICE_ID_RE = /^[A-Za-z0-9_-]{16,64}$/;
 
 export type { ModelApiDeps } from './model-store.js';
 
@@ -162,15 +164,21 @@ function connectionsRoute(path: string, method: string | undefined): Route | num
   return 405;
 }
 
+function codexRoute(rest: string, method: string | undefined): Route | number {
+  if (rest in CODEX_ROUTES) return named(CODEX_ROUTES, rest, method);
+  const id = rest.startsWith(DEVICE_PREFIX) ? rest.slice(DEVICE_PREFIX.length) : '';
+  if (!DEVICE_ID_RE.test(id)) return 404;
+  return codexDeviceRoute(id, method);
+}
+
 const TABLES: [string, Record<string, Route>][] = [
   [OPENROUTER, OPENROUTER_ROUTES],
   [ANTHROPIC, ANTHROPIC_ROUTES],
   [BEDROCK, BEDROCK_ROUTES],
   [GEMINI, GEMINI_ROUTES],
-  [CODEX, CODEX_ROUTES],
 ];
 const EXACT = new Set([PATH, FALLBACKS, BUNDLE, RESTORE, CONNECTIONS]);
-const PREFIXES = [`${CONNECTIONS}/`, ...TABLES.map(([prefix]) => prefix)];
+const PREFIXES = [`${CONNECTIONS}/`, CODEX, ...TABLES.map(([prefix]) => prefix)];
 
 const mine = (path: string): boolean => EXACT.has(path) || PREFIXES.some((prefix) => path.startsWith(prefix));
 
@@ -179,7 +187,8 @@ function routeFor(path: string, method: string | undefined): Route | number {
   if (path === BUNDLE || path === RESTORE) return bundleRoute(path, method);
   if (path === CONNECTIONS || path.startsWith(`${CONNECTIONS}/`)) return connectionsRoute(path, method);
   const table = TABLES.find(([prefix]) => path.startsWith(prefix));
-  return table === undefined ? 404 : named(table[1], path.slice(table[0].length), method);
+  if (table !== undefined) return named(table[1], path.slice(table[0].length), method);
+  return codexRoute(path.slice(CODEX.length), method);
 }
 
 export function handleModelRequest(req: IncomingMessage, res: ServerResponse, deps: ModelApiDeps): boolean {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-config.ts

@@ -3,7 +3,7 @@ import { ID_RE, newId } from '@metro-labs/core/ids';
 import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
 import { agentsDir } from '../agents/files.js';
 import { isRecord } from '@metro-labs/core/is-record';
-import { CODEX_SIGN_IN, NEW_CLIENT, type CodexTokens } from './codex-auth.js';
+import { CODEX_SIGN_IN, NEW_CLIENT, type CodexCredential, type CodexMethod, type CodexTokens } from './codex-auth.js';
 import { tokensFromDisk as geminiTokensFromDisk, type GeminiTokens } from './gemini-auth.js';
 
 export const PROVIDERS = ['anthropic', 'bedrock', 'openrouter', 'codex', 'gemini'] as const;
@@ -89,15 +89,11 @@ function claudeFromDisk(raw: unknown): ClaudeLogin | null {
   return { id: text(raw.id), email: maybe(raw.email), plan: maybe(raw.plan), savedAt: text(raw.savedAt) };
 }
 
-function codexFromDisk(raw: unknown): CodexTokens | null {
-  if (!isRecord(raw)) return null;
-  const clientId = text(raw.clientId);
+function credentialFromDisk(raw: Record<string, unknown>): CodexCredential | null {
   const accessToken = text(raw.accessToken);
   const refreshToken = text(raw.refreshToken);
-  if (clientId === '' || clientId === NEW_CLIENT || accessToken === '' || refreshToken === '') return null;
+  if (accessToken === '' || refreshToken === '') return null;
   return {
-    clientId,
-    subject: text(raw.subject),
     email: maybe(raw.email),
     accessToken,
     refreshToken,
@@ -106,6 +102,16 @@ function codexFromDisk(raw: unknown): CodexTokens | null {
   };
 }
 
+function codexFromDisk(raw: unknown): CodexTokens | null {
+  if (!isRecord(raw)) return null;
+  const held = credentialFromDisk(raw);
+  if (held === null) return null;
+  const accountId = text(raw.accountId);
+  if (accountId !== '') return { method: 'code', accountId, plan: maybe(raw.plan), ...held };
+  const clientId = text(raw.clientId);
+  return clientId === '' || clientId === NEW_CLIENT ? null : { method: 'chatgpt', clientId, subject: text(raw.subject), ...held };
+}
+
 function connectionFromDisk(raw: unknown): Connection | null {
   if (!isRecord(raw) || !isProvider(raw.provider)) return null;
   const id = text(raw.id);
@@ -233,9 +239,9 @@ export const routeLabel = (route: Route): string =>
 
 export const PASSTHROUGH_ID = 'passthrough';
 
-function signedInAs(c: Connection): { account: string | null; plan: string | null } {
+function signedInAs(c: Connection): { account: string | null; plan: string | null; method?: CodexMethod } {
   if (c.claude !== null) return { account: c.claude.email, plan: c.claude.plan };
-  if (c.codex !== null) return { account: c.codex.email, plan: null };
+  if (c.codex !== null) return { account: c.codex.email, plan: c.codex.method === 'code' ? c.codex.plan : null, method: c.codex.method };
   return { account: c.gemini?.email ?? null, plan: c.gemini?.tier ?? null };
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-signin.ts

@@ -3,7 +3,8 @@ import { ApiError } from '@metro-labs/http/api-error';
 import { readJsonBody } from '@metro-labs/http/api-http';
 import { isRecord } from '@metro-labs/core/is-record';
 import { log } from '@metro-labs/core/log';
-import { beginLogin, chatgptHostId, finishLogin, type CodexTokens } from './codex-auth.js';
+import { beginLogin, chatgptHostId, finishLogin, type ChatgptTokens, type CodexTokens } from './codex-auth.js';
+import { beginDeviceLogin, pollDeviceLogin } from './codex-device.js';
 import { codexModels, currentTokens, sharedCodexState, type CodexDeps } from './codex.js';
 import { beginLogin as beginGeminiLogin, exchangeCode as exchangeGeminiCode, userEmail, type GeminiTokens } from './gemini-auth.js';
 import { onboard, parseGeminiProject } from './gemini-setup.js';
@@ -48,7 +49,22 @@ const codexDepsFor = (deps: ModelApiDeps, store: Store, id: string): CodexDeps =
   },
 });
 
-const renewing = (store: Store, req: IncomingMessage): CodexTokens | null => (askedConnection(req) === '' ? null : connectionFor(store.read(), req, 'codex').codex);
+function renewing(store: Store, req: IncomingMessage): ChatgptTokens | null {
+  if (askedConnection(req) === '') return null;
+  const tokens = connectionFor(store.read(), req, 'codex').codex;
+  return tokens?.method === 'chatgpt' ? tokens : null;
+}
+
+function keepCodex(store: Store, req: IncomingMessage, tokens: CodexTokens, note: string): unknown {
+  const { cfg, id } = connectionToFill(store, req, 'codex');
+  return saved(store, setCodexAuth(cfg, id, tokens), note, { connection: id, method: tokens.method });
+}
+
+async function pollDevice(id: string, req: IncomingMessage, deps: ModelApiDeps, store: Store): Promise<unknown> {
+  const result = await pollDeviceLogin(id, deps.fetchImpl).catch(asApiError);
+  if (result.status !== 'done') return result;
+  return { status: 'done', settings: keepCodex(store, req, result.tokens, 'model-api: Codex connected with a code') };
+}
 
 export const CODEX_ROUTES: Record<string, Route> = {
   login: {
@@ -61,8 +77,14 @@ export const CODEX_ROUTES: Record<string, Route> = {
       const body = await readJsonBody(req, BODY_MAX);
       const raw = isRecord(body) && typeof body.url === 'string' ? body.url : '';
       const tokens = await finishLogin(raw, deps.issuer, deps.fetchImpl).catch(asApiError);
-      const { cfg, id } = connectionToFill(store, req, 'codex');
-      return saved(store, setCodexAuth(cfg, id, tokens), 'model-api: Codex connected with Sign in with ChatGPT', { connection: id });
+      return keepCodex(store, req, tokens, 'model-api: Codex connected with Sign in with ChatGPT');
+    },
+  },
+  device: {
+    method: 'POST',
+    run: async (_req, deps) => {
+      const login = await beginDeviceLogin(deps.issuer, deps.fetchImpl).catch(asApiError);
+      return { id: login.id, user_code: login.userCode, verify_url: login.verifyUrl, interval: login.interval };
     },
   },
   models: {
@@ -129,3 +151,7 @@ export const GEMINI_ROUTES: Record<string, Route> = {
     run: async (req, deps, store) => ({ models: await geminiIds(req, deps, store).catch(asApiError) }),
   },
 };
+
+export function codexDeviceRoute(id: string, method: string | undefined): Route | number {
+  return method === 'GET' ? { method: 'GET', run: (req, deps, store) => pollDevice(id, req, deps, store) } : 405;
+}

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.255"
+  "version": "0.1.0-beta.256"
 }