@stage-labs/metro 0.1.0-beta.307 → 0.1.0-beta.309

package/runtime/node_modules/@metro-labs/daemon/src/claude/setup-api.ts

@@ -1,8 +1,7 @@
 import type { IncomingMessage } from 'node:http';
-import { log } from '@metro-labs/core/log';
 import { isRecord } from '@metro-labs/core/is-record';
 import { ApiError } from '@metro-labs/http/api-error';
-import { readJsonBody, type ApiSession } from '@metro-labs/http/api-http';
+import { readJsonBody } from '@metro-labs/http/api-http';
 import {
   claudeSetupStatus,
   ensureClaudeSetup,
@@ -19,12 +18,10 @@ import {
   type PermissionMode,
   type SetupDeps,
 } from './setup.js';
-import { harnessRunner, isHarnessRunner, sdkAllowed, sdkOnLogin, SDK_NEEDS_KEY, setHarnessRunner, setSdkOnLogin, type HarnessRunner } from './runner.js';
-import { assertSdkDrained, assertSessionStopped, prepareSessionRunner, setAutostart, withSessionChange, type SessionDeps } from './session.js';
+import { assertSessionStopped, type SessionDeps } from './session.js';
 import { tryMemoryJob } from './memory-routine.js';
 
 const SETUP_BODY_MAX = SYSTEM_PROMPT_MAX * 2;
-const OPERATOR_ONLY = 'only the Metro operator can allow the Agent SDK on a Claude login';
 
 export interface SetupApiDeps {
   session?: SessionDeps;
@@ -36,8 +33,6 @@ export interface SetupApiDeps {
 interface SetupChange {
   privacy?: boolean;
   permissionMode?: PermissionMode;
-  runner?: HarnessRunner;
-  sdkOnLogin?: boolean;
   systemPrompt?: string;
   liveEvents?: boolean;
   memoryRoutine?: boolean;
@@ -62,19 +57,11 @@ function modeChange(raw: unknown): PermissionMode | undefined {
   return raw;
 }
 
-function runnerChange(raw: unknown): HarnessRunner | undefined {
-  if (raw === undefined) return undefined;
-  if (!isHarnessRunner(raw)) throw new ApiError('runner must be cli or sdk', 400);
-  return raw;
-}
-
 function setupChange(body: unknown): SetupChange {
   if (!isRecord(body)) throw new ApiError('a body is required', 400);
   const change: SetupChange = {
     privacy: flagChange(body.privacy, 'privacy'),
     permissionMode: modeChange(body.permissionMode),
-    runner: runnerChange(body.runner),
-    sdkOnLogin: flagChange(body.sdkOnLogin, 'sdkOnLogin'),
     systemPrompt: promptChange(body.systemPrompt),
     liveEvents: flagChange(body.liveEvents, 'liveEvents'),
     memoryRoutine: flagChange(body.memoryRoutine, 'memoryRoutine'),
@@ -84,44 +71,11 @@ function setupChange(body: unknown): SetupChange {
   return given;
 }
 
-function checkRunnerChange(change: SetupChange, session: ApiSession, agents: string | undefined): void {
-  if (change.sdkOnLogin !== undefined && session.operator !== true) throw new ApiError(OPERATOR_ONLY, 403);
-  if (change.runner === 'sdk' && !sdkAllowed(agents, undefined, change.sdkOnLogin ?? sdkOnLogin(agents))) throw new ApiError(SDK_NEEDS_KEY, 403);
-}
-
-function nextRunner(change: SetupChange, agents: string | undefined): HarnessRunner {
-  const runner = change.runner ?? harnessRunner(agents);
-  return runner === 'sdk' && change.sdkOnLogin === false && !sdkAllowed(agents, undefined, false) ? 'cli' : runner;
-}
-
 function changesSession(change: SetupChange, agents: string | undefined): boolean {
-  return nextRunner(change, agents) !== harnessRunner(agents)
-    || (change.permissionMode !== undefined && change.permissionMode !== permissionMode(agents))
+  return (change.permissionMode !== undefined && change.permissionMode !== permissionMode(agents))
     || (change.systemPrompt !== undefined && change.systemPrompt.trim() !== systemPrompt(agents));
 }
 
-function saveSessionSettings(change: SetupChange, runner: HarnessRunner, agents: string | undefined): void {
-  if (change.sdkOnLogin !== undefined && change.sdkOnLogin !== sdkOnLogin(agents)) {
-    setSdkOnLogin(change.sdkOnLogin, agents);
-    log.info({ on: change.sdkOnLogin }, 'claude-setup: the operator changed whether the Agent SDK may run on this box’s Claude login');
-  }
-  if (runner !== harnessRunner(agents)) {
-    setAutostart(false, agents);
-    setHarnessRunner(runner, agents);
-  }
-  if (change.permissionMode !== undefined) setPermissionMode(change.permissionMode, agents);
-  if (change.systemPrompt !== undefined) setSystemPrompt(change.systemPrompt, agents);
-}
-
-function checkStoppedChange(change: SetupChange, deps: SetupApiDeps): HarnessRunner {
-  const agents = deps.setup?.agents;
-  const session = { ...deps.session, agents: deps.session?.agents ?? agents };
-  const runner = nextRunner(change, agents);
-  if (changesSession(change, agents)) assertSessionStopped(session);
-  if (runner !== harnessRunner(agents) && harnessRunner(agents) === 'sdk') assertSdkDrained(session);
-  return runner;
-}
-
 function applyLiveEvents(on: boolean, deps: SetupApiDeps): void {
   const agents = deps.setup?.agents;
   if (on !== liveEvents(agents)) setLiveEvents(on, agents);
@@ -133,29 +87,28 @@ function applyMemoryRoutine(on: boolean, deps: SetupApiDeps): void {
   (deps.memoryJob ?? tryMemoryJob)(on);
 }
 
-async function applySetupChange(change: SetupChange, session: ApiSession, deps: SetupApiDeps, req: IncomingMessage): Promise<void> {
+function saveSessionSettings(change: SetupChange, deps: SetupApiDeps): void {
+  const agents = deps.setup?.agents;
+  if (changesSession(change, agents)) assertSessionStopped({ ...deps.session, agents: deps.session?.agents ?? agents });
+  if (change.permissionMode !== undefined) setPermissionMode(change.permissionMode, agents);
+  if (change.systemPrompt !== undefined) setSystemPrompt(change.systemPrompt, agents);
+}
+
+function applySetupChange(change: SetupChange, deps: SetupApiDeps): void {
   const setup = deps.setup ?? {};
-  checkRunnerChange(change, session, setup.agents);
-  const runner = checkStoppedChange(change, deps);
-  if (runner !== harnessRunner(setup.agents)) {
-    await prepareSessionRunner(runner, deps.session);
-    checkRunnerChange(change, session, setup.agents);
-    if (checkStoppedChange(change, deps) !== runner) throw new ApiError('The model setup changed during preparation. Choose the runner again.', 409);
-  }
-  if (req.socket.destroyed) throw new ApiError('The request disconnected during preparation. The runner choice was not changed.', 409);
+  saveSessionSettings(change, deps);
   if (change.privacy !== undefined) setPrivacy(change.privacy, setup.agents);
   if (change.liveEvents !== undefined) applyLiveEvents(change.liveEvents, deps);
   if (change.memoryRoutine !== undefined) applyMemoryRoutine(change.memoryRoutine, deps);
-  saveSessionSettings(change, runner, setup.agents);
   ensureClaudeSetup(setup);
 }
 
-export async function setupAnswer(req: IncomingMessage, deps: SetupApiDeps, session: ApiSession): Promise<unknown> {
+export async function setupAnswer(req: IncomingMessage, deps: SetupApiDeps): Promise<unknown> {
   const setup = deps.setup ?? {};
   const method = req.method ?? 'GET';
   if (method === 'GET') return claudeSetupStatus(setup);
   if (method !== 'POST') throw new ApiError('method not allowed', 405);
   const change = setupChange(await readJsonBody(req, SETUP_BODY_MAX));
-  await withSessionChange(() => applySetupChange(change, session, deps, req));
+  applySetupChange(change, deps);
   return claudeSetupStatus(setup);
 }

package/runtime/node_modules/@metro-labs/daemon/src/claude/setup.ts

@@ -11,8 +11,6 @@ import { claudeDir } from './files.js';
 import { memoryJobStatus, type MemoryJob } from './memory-routine.js';
 import { cliPackageDir, hooksDir, skillsDir } from './cli-files.js';
 import { hasMetroGuard, withMetroHooks } from './hooks.js';
-import { readModelConfig, routedConnection, type ModelConfig } from '../gateway/model-config.js';
-import { harnessRunner, runnerModel, sdkAllowed, sdkOnLogin, type HarnessRunner } from './runner.js';
 import { readSetupState, writeSetupState } from './setup-state.js';
 
 export const PRIVACY_ENV: Record<string, string> = {
@@ -69,9 +67,6 @@ export interface SetupReport {
 export interface SetupStatus {
   privacy: boolean;
   permissionMode: PermissionMode;
-  runner: HarnessRunner;
-  runnerAllowed: boolean;
-  sdkOnLogin: boolean;
   systemPrompt: string;
   liveEvents: boolean;
   memoryRoutine: boolean;
@@ -218,16 +213,23 @@ interface SettingsApplied {
   guard: boolean;
 }
 
-function applySettings(dir: string, privacy: boolean, hooks: string | null): SettingsApplied {
+const MODELS_KEYS = new Set(['availableModels', 'enforceAvailableModels']);
+
+const withoutMetroModels = (settings: Record<string, unknown>, metroWrote: boolean): Record<string, unknown> =>
+  metroWrote ? Object.fromEntries(Object.entries(settings).filter(([key]) => !MODELS_KEYS.has(key))) : settings;
+
+function applySettings(dir: string, agents: string, privacy: boolean, hooks: string | null): SettingsApplied {
+  const metroModels = readSetupState(agents).modelsByMetro === true;
   let guard = false;
   const settings = mergeSettings(dir, (current) => {
-    const next = withPrivacy(current, privacy);
+    const next = withPrivacy(withoutMetroModels(current, metroModels), privacy);
     const hooked = hooks === null ? null : withMetroHooks(next, hooks);
     if (hooks !== null && hooked === null)
       log.warn({ path: join(dir, 'settings.json') }, 'claude-setup: the hooks in settings.json are not in the shape Claude Code reads, so metro did not add its own');
     guard = hasMetroGuard(hooked ?? next);
     return hooked ?? next;
   });
+  if (metroModels && settings !== 'unreadable') writeSetupState(agents, { modelsByMetro: false });
   return { settings, guard };
 }
 
@@ -280,9 +282,8 @@ export function ensureClaudeSetup(deps: SetupDeps = {}): SetupReport {
   const skill = placeSkill(dir, skills, METRO_SKILL);
   const stage = placeSkill(dir, skills, STAGE_SKILL);
   const memory = placeSkill(dir, skills, MEMORY_SKILL);
-  const applied = applySettings(dir, privacy, hooks);
+  const applied = applySettings(dir, agents, privacy, hooks);
   const report: SetupReport = { privacy, guard: applied.guard, worker, skill, stage, memory, settings: applied.settings };
-  syncAvailableModelsQuietly({ ...deps, dir, agents });
   if ([report.worker, report.skill, report.stage, report.memory].some(written) || report.settings === 'written')
     log.info(report, 'claude-setup: applied the Claude Code setup for a metro box');
   if (report.settings === 'unreadable') log.warn({ path: join(dir, 'settings.json') }, 'claude-setup: settings.json is not valid JSON, so the privacy settings and metro hooks were not written');
@@ -299,9 +300,6 @@ export function claudeSetupStatus(deps: SetupDeps = {}): SetupStatus {
   return {
     privacy: privacyEnabled(agents),
     permissionMode: permissionMode(agents),
-    runner: harnessRunner(agents),
-    runnerAllowed: sdkAllowed(agents),
-    sdkOnLogin: sdkOnLogin(agents),
     systemPrompt: systemPrompt(agents),
     liveEvents: liveEvents(agents),
     memoryRoutine: memoryRoutine(agents),
@@ -323,33 +321,3 @@ export function tryClaudeSetup(deps: SetupDeps = {}): void {
     log.warn({ err: errMsg(err) }, 'claude-setup: could not apply the Claude Code setup');
   }
 }
-
-const MODELS_KEY = 'availableModels';
-const ENFORCE_KEY = 'enforceAvailableModels';
-
-export const routeOf = (cfg: ModelConfig): string | null => (routedConnection(cfg)?.provider === 'anthropic' ? null : runnerModel(cfg));
-
-function withAvailableModels(settings: Record<string, unknown>, route: string | null, metroWrote: boolean): Record<string, unknown> {
-  if (route !== null) return { ...settings, [MODELS_KEY]: [route], [ENFORCE_KEY]: true };
-  if (!metroWrote) return settings;
-  return Object.fromEntries(Object.entries(settings).filter(([key]) => key !== MODELS_KEY && key !== ENFORCE_KEY));
-}
-
-export function syncAvailableModels(cfg: ModelConfig, deps: SetupDeps = {}): SettingsOutcome {
-  const dir = deps.dir ?? claudeDir();
-  const agents = deps.agents ?? agentsDir();
-  const route = routeOf(cfg);
-  const metroWrote = readSetupState(agents).modelsByMetro === true;
-  return mergeSettings(dir, (current) => {
-    writeSetupState(agents, { modelsByMetro: route !== null });
-    return withAvailableModels(current, route, metroWrote);
-  });
-}
-
-export function syncAvailableModelsQuietly(deps: SetupDeps = {}, cfg?: ModelConfig): void {
-  try {
-    syncAvailableModels(cfg ?? readModelConfig(deps.agents ?? agentsDir()), deps);
-  } catch (err) {
-    log.warn({ err: errMsg(err) }, 'claude-setup: could not sync the model allowlist');
-  }
-}

package/runtime/node_modules/@metro-labs/daemon/src/claude/usage-probe.ts

@@ -1,7 +1,7 @@
 import { spawn } from 'node:child_process';
 import { isRecord } from '@metro-labs/core/is-record';
 import { errMsg, log } from '@metro-labs/core/log';
-import { agentCommand, agentUser, agentUserExpected, claudeBin } from '../agent-user/user.js';
+import { agentCommand, agentUser, agentUserExpected, CLAUDE_ENV, claudeBin } from '../agent-user/user.js';
 import { runningAsRoot } from '../metro-user/privilege.js';
 import { PRIVACY_ENV } from './setup.js';
 
@@ -24,7 +24,7 @@ const ARGS = [
 const BLOCKS_USAGE = 'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC';
 const PROBE_ENV: Record<string, string> = {
   ...Object.fromEntries(Object.entries(PRIVACY_ENV).filter(([name]) => name !== BLOCKS_USAGE)),
-  DISABLE_AUTOUPDATER: '1',
+  ...CLAUDE_ENV,
   DISABLE_BUG_COMMAND: '1',
   ENABLE_CLAUDEAI_MCP_SERVERS: 'false',
 };

package/runtime/node_modules/@metro-labs/daemon/src/gateway/bedrock.ts

@@ -1,7 +1,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { log } from '@metro-labs/core/log';
 import { EventStreamDecoder, type EventStreamMessage } from './eventstream.js';
-import { errorFrame, GatewayError, providerStatus, relayFrames, sendError, upstreamMessage, type Watch } from './forward.js';
+import { errorFrame, providerStatus, relayFrames, sendError, upstreamMessage, type Watch } from './forward.js';
 import type { Connection } from './model-config.js';
 import { estimateTokens } from './subscription.js';
 import { UsageScanner } from './usage.js';
@@ -226,8 +226,3 @@ export async function bedrockCount(
   res.writeHead(200, { 'content-type': 'application/json' });
   res.end(JSON.stringify({ input_tokens: counted ?? estimateTokens(rewritten.body) }));
 }
-
-export function assertBedrockReady(settings: Connection): void {
-  if (settings.apiKey === '' || settings.region === '')
-    throw new GatewayError(400, 'invalid_request_error', 'Bedrock needs an API key and a region: add them on the Model page.');
-}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/claude-logins.ts

@@ -5,13 +5,14 @@ import { isRecord } from '@metro-labs/core/is-record';
 import { errMsg, log } from '@metro-labs/core/log';
 import { ApiError } from '@metro-labs/http/api-error';
 import { readFileSync } from '../agent-user/agent-fs.js';
-import { removeHome } from '../agent-user/home-fs.js';
+import { moveHome, removeHome } from '../agent-user/home-fs.js';
 import { claudeHome } from '../agent-user/user.js';
 import { claudeAccountIn, type ClaudeAccount, type LoginTarget } from '../claude/login.js';
 import { readClaudeUsage } from '../claude/usage-probe.js';
 import { currentOf, reach, refreshed, type TokenSource, type TokenState } from './subscription.js';
-import { forgetReported } from './usage.js';
-import { addConnection, connectionOf, readModelConfig, setClaudeLogin, writeModelConfig, type ModelConfig } from './model-config.js';
+import { forgetOne, forgetReported } from './usage.js';
+import { readClaudeLogins, writeClaudeLogins, type ClaudeLogin } from './claude-store.js';
+import { loginRef } from './model-config.js';
 
 const CREDENTIALS = '.credentials.json';
 const RENEW_MARGIN_MS = 60_000;
@@ -22,8 +23,7 @@ export interface ClaudeLoginDeps {
   root?: string;
   probe?: (env: Record<string, string>) => Promise<unknown>;
   account?: (env: Record<string, string>) => ClaudeAccount;
-  read?: () => ModelConfig;
-  write?: (cfg: ModelConfig) => void;
+  dir?: string;
 }
 
 interface ClaudeTokens {
@@ -110,56 +110,80 @@ export function withClaudeLogin(login: string, deps: ClaudeLoginDeps, send: (tok
   );
 }
 
-function dropClaudeLogin(login: string, deps: ClaudeLoginDeps): void {
+const folderOf = (login: string, deps: ClaudeLoginDeps): string => claudeLoginEnv(login, deps).CLAUDE_CONFIG_DIR ?? '';
+
+function forgetTokens(login: string): void {
   seen.delete(login);
   state.delete(login);
+}
+
+function dropFolder(login: string, deps: ClaudeLoginDeps): void {
+  forgetTokens(login);
   try {
-    removeHome(claudeLoginEnv(login, deps).CLAUDE_CONFIG_DIR ?? '', true);
+    removeHome(folderOf(login, deps), true);
   } catch (err) {
-    log.warn({ err: errMsg(err) }, 'claude-logins: could not remove a Claude login that is no longer used');
+    log.warn({ err: errMsg(err) }, 'claude-logins: could not remove the folder of a Claude login that is no longer used');
   }
 }
 
-export function dropUnusedClaudeLogins(before: ModelConfig, after: ModelConfig, deps: ClaudeLoginDeps = {}): void {
-  const kept = new Set(after.connections.flatMap((c) => (c.claude === null ? [] : [c.claude.id])));
-  for (const c of before.connections) if (c.claude !== null && !kept.has(c.claude.id)) dropClaudeLogin(c.claude.id, deps);
+export function removeClaudeLogin(login: string, deps: ClaudeLoginDeps = {}): void {
+  const logins = readClaudeLogins(deps.dir);
+  if (!logins.some((l) => l.id === login)) throw new ApiError('no such Claude login on this box', 404);
+  writeClaudeLogins(logins.filter((l) => l.id !== login), deps.dir);
+  dropFolder(login, deps);
+  forgetOne(loginRef(login));
+  log.info({ login }, 'claude-logins: a Claude login was removed from this box');
+}
+
+function takeOver(fresh: string, replaced: string, deps: ClaudeLoginDeps): void {
+  const aside = `${folderOf(replaced, deps)}.old-${newId()}`;
+  moveHome(folderOf(replaced, deps), aside);
+  try {
+    moveHome(folderOf(fresh, deps), folderOf(replaced, deps));
+  } catch (err) {
+    moveHome(aside, folderOf(replaced, deps));
+    throw err;
+  }
+  forgetTokens(replaced);
+  try {
+    removeHome(aside, true);
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'claude-logins: could not remove the folder of the login that was signed in again');
+  }
 }
 
-function keep(login: string, connection: string | null, account: ClaudeAccount, deps: ClaudeLoginDeps): string | null {
-  const before = (deps.read ?? readModelConfig)();
-  const cfg = connection === null ? addConnection(before, { provider: 'anthropic' }) : before;
-  const id = connection ?? cfg.connections.at(-1)?.id ?? '';
-  if (connectionOf(cfg, id)?.provider !== 'anthropic') return 'that connection was removed during the sign-in';
-  const next = setClaudeLogin(cfg, id, { id: login, email: account.account, plan: account.plan, savedAt: new Date().toISOString() });
-  (deps.write ?? writeModelConfig)(next);
-  dropUnusedClaudeLogins(before, next, deps);
-  forgetReported(id);
-  log.info({ connection: id, plan: account.plan, added: connection === null }, 'claude-logins: the Claude login was kept for its own connection');
+function keep(login: string, replacing: string | null, account: ClaudeAccount, deps: ClaudeLoginDeps): string | null {
+  const logins = readClaudeLogins(deps.dir);
+  if (replacing !== null && !logins.some((l) => l.id === replacing)) return 'that Claude login was removed during the sign-in';
+  if (replacing !== null) takeOver(login, replacing, deps);
+  const entry: ClaudeLogin = { id: replacing ?? login, email: account.account, plan: account.plan, savedAt: new Date().toISOString() };
+  writeClaudeLogins(replacing === null ? [...logins, entry] : logins.map((l) => (l.id === replacing ? entry : l)), deps.dir);
+  forgetReported(loginRef(entry.id));
+  log.info({ login: entry.id, plan: account.plan, added: replacing === null }, 'claude-logins: the Claude login was kept on this box');
   return null;
 }
 
-function settle(ok: boolean, login: string, connection: string | null, deps: ClaudeLoginDeps): Promise<string | null> {
+function settle(ok: boolean, login: string, replacing: string | null, deps: ClaudeLoginDeps): Promise<string | null> {
   if (!ok) {
-    dropClaudeLogin(login, deps);
+    dropFolder(login, deps);
     return Promise.resolve(null);
   }
   let problem: string | null;
   try {
     const account = (deps.account ?? claudeAccountIn)(claudeLoginEnv(login, deps));
-    problem = account.signedIn ? keep(login, connection, account, deps) : 'the sign-in finished but Claude Code holds no login; try again';
+    problem = account.signedIn ? keep(login, replacing, account, deps) : 'the sign-in finished but Claude Code holds no login; try again';
   } catch (err) {
     problem = errMsg(err);
   }
-  if (problem !== null) dropClaudeLogin(login, deps);
+  if (problem !== null) dropFolder(login, deps);
   return Promise.resolve(problem);
 }
 
 export function claudeLoginTarget(asked: string, deps: ClaudeLoginDeps = {}): LoginTarget {
-  const connection = asked === NEW ? null : asked;
-  if (connection !== null && connectionOf((deps.read ?? readModelConfig)(), connection)?.provider !== 'anthropic')
-    throw new ApiError('no such Anthropic connection', 404);
+  const replacing = asked === NEW ? null : asked;
+  if (replacing !== null && !readClaudeLogins(deps.dir).some((l) => l.id === replacing)) throw new ApiError('no such Claude login on this box', 404);
   const login = newId();
-  return { key: asked, env: claudeLoginEnv(login, deps), settle: (ok) => settle(ok, login, connection, deps) };
+  return { key: asked, env: claudeLoginEnv(login, deps), settle: (ok) => settle(ok, login, replacing, deps) };
 }
 
 export function forgetClaudeTokens(): void {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/claude-store.ts

@@ -0,0 +1,55 @@
+import { join } from 'node:path';
+import { ID_RE, newId } from '@metro-labs/core/ids';
+import { isRecord } from '@metro-labs/core/is-record';
+import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
+import { agentsDir } from '../agents/files.js';
+
+export interface ClaudeLogin {
+  id: string;
+  email: string | null;
+  plan: string | null;
+  savedAt: string;
+}
+
+const MODEL_FILE = 'model.json';
+
+const text = (value: unknown): string => (typeof value === 'string' ? value.trim() : '');
+const maybe = (value: unknown): string | null => (typeof value === 'string' && value !== '' ? value : null);
+
+export function claudeLoginOf(raw: unknown): ClaudeLogin | null {
+  if (!isRecord(raw) || !ID_RE.test(text(raw.id))) return null;
+  return { id: text(raw.id), email: maybe(raw.email), plan: maybe(raw.plan), savedAt: text(raw.savedAt) };
+}
+
+export const modelPath = (dir: string): string => join(dir, MODEL_FILE);
+
+export const readModelFile = (dir = agentsDir()): unknown =>
+  readJson<unknown>(modelPath(dir), null, { warn: 'model.json is unreadable, so the Claude logins of this box are not seen until it is fixed' });
+
+export const isV2 = (raw: unknown): raw is Record<string, unknown> & { connections: unknown[] } =>
+  isRecord(raw) && raw.version !== 3 && Array.isArray(raw.connections);
+
+const unique = (logins: ClaudeLogin[]): ClaudeLogin[] => logins.filter((l, at) => logins.findIndex((o) => o.id === l.id) === at);
+
+export function claudeLoginsIn(raw: unknown): ClaudeLogin[] {
+  if (isV2(raw)) return unique(raw.connections.flatMap((c: unknown) => (isRecord(c) && c.provider === 'anthropic' ? (claudeLoginOf(c.claude) ?? []) : [])));
+  if (!isRecord(raw) || !Array.isArray(raw.claude)) return [];
+  return unique(raw.claude.flatMap((c: unknown) => claudeLoginOf(c) ?? []));
+}
+
+export const readClaudeLogins = (dir = agentsDir()): ClaudeLogin[] => claudeLoginsIn(readModelFile(dir));
+
+export const v3Text = (logins: ClaudeLogin[]): string => JSON.stringify({ version: 3, claude: logins }, null, 2);
+
+function v2With(raw: Record<string, unknown> & { connections: unknown[] }, logins: ClaudeLogin[]): Record<string, unknown> {
+  const holds = (c: unknown): c is Record<string, unknown> => isRecord(c) && c.provider === 'anthropic' && claudeLoginOf(c.claude) !== null;
+  const held = new Map(raw.connections.filter(holds).map((c) => [claudeLoginOf(c.claude)?.id ?? '', c]));
+  const others = raw.connections.filter((c) => !holds(c));
+  const logged = logins.map((login) => ({ ...(held.get(login.id) ?? { id: newId(), provider: 'anthropic', label: 'Anthropic', model: '' }), claude: login }));
+  return { ...raw, connections: [...others, ...logged] };
+}
+
+export function writeClaudeLogins(logins: ClaudeLogin[], dir = agentsDir()): void {
+  const raw = readModelFile(dir);
+  writeSecure(modelPath(dir), isV2(raw) ? JSON.stringify(v2With(raw, logins), null, 2) : v3Text(logins));
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex.ts

@@ -2,54 +2,40 @@ import { randomUUID } from 'node:crypto';
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { arch, platform, release } from 'node:os';
 import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg, log } from '@metro-labs/core/log';
 import { stringOf } from '@metro-labs/http/api-http';
-import { OPENAI_API, CODEX_SIGN_IN, refreshTokens, tokensStale, type CodexTokens } from './codex-auth.js';
-import { refreshCodeTokens } from './codex-device.js';
 import { codexVersion, learnCodexVersion } from './codex-version.js';
 import { CodexEventTranslator, withUsageLink } from './codex-stream.js';
 import { ToolNames, toResponsesRequest } from './codex-translate.js';
 import { GatewayError, providerStatus, sendError, upstreamMessage, type Watch } from './forward.js';
 import { parseEvent, SseParser, type SseEvent } from './frames.js';
-import type { Connection } from './model-config.js';
-import { listCache } from './model-lists.js';
-import { answerWhole, currentOf, errorKind, reach, refreshed, relayTranslated, sessionHeader, type TokenSource, type TokenState } from './subscription.js';
+import { CODEX_SIGN_IN, type CodexAccess, type Connection } from './model-config.js';
+import { answerWhole, errorKind, relayTranslated, sessionHeader } from './subscription.js';
 import { noteUsageHeaders } from './usage.js';
 
 const CODEX_BACKEND = 'https://chatgpt.com/backend-api/codex';
+const OPENAI_API = 'https://api.openai.com/v1';
 const INVALID = [400, 404, 422];
+const RENEW_FAILED = "Codex refused its sign-in and api.metro.box could not renew it: sign in again on the organization's Models page.";
 
 export interface CodexDeps {
   base?: string;
-  issuer?: string;
   fetchImpl?: typeof fetch;
-  save: (id: string, tokens: CodexTokens) => void;
+  refresh: (conn: Connection) => Promise<Connection | null>;
 }
 
-export type CodexState = TokenState<CodexTokens>;
-
-export const sharedCodexState: CodexState = new Map();
-
-const codexLists = listCache<string>('codex');
-
-const sourceOf = (deps: CodexDeps): TokenSource<CodexTokens> => ({
-  label: 'Codex',
-  stale: (tokens) => tokensStale(tokens),
-  refresh: (tokens) => (tokens.method === 'code' ? refreshCodeTokens(tokens, deps.issuer, deps.fetchImpl) : refreshTokens(tokens, deps.issuer, deps.fetchImpl)),
-  save: deps.save,
-});
-
 const OS_NAMES: Record<string, string> = { darwin: 'Mac OS', linux: 'Linux', win32: 'Windows' };
 
 export const userAgent = (): string => `codex_cli_rs/${codexVersion()} (${OS_NAMES[platform()] ?? platform()} ${release()}; ${arch()}) metro`;
 
-const baseFor = (tokens: CodexTokens, deps: Pick<CodexDeps, 'base'>): string => deps.base ?? (tokens.method === 'code' ? CODEX_BACKEND : OPENAI_API);
+const baseFor = (access: CodexAccess, deps: Pick<CodexDeps, 'base'>): string => deps.base ?? (access.method === 'code' ? CODEX_BACKEND : OPENAI_API);
 
-function headersFor(tokens: CodexTokens, accept: string, sessionId: string): Record<string, string> {
-  const plain = { authorization: `Bearer ${tokens.accessToken}`, 'content-type': 'application/json', accept };
-  if (tokens.method === 'chatgpt') return plain;
+function headersFor(access: CodexAccess, sessionId: string): Record<string, string> {
+  const plain = { authorization: `Bearer ${access.accessToken}`, 'content-type': 'application/json', accept: 'text/event-stream' };
+  if (access.method === 'chatgpt') return plain;
   return {
     ...plain,
-    'chatgpt-account-id': tokens.accountId,
+    'chatgpt-account-id': access.accountId ?? '',
     originator: 'codex_cli_rs',
     'user-agent': userAgent(),
     'openai-beta': 'responses=experimental',
@@ -57,9 +43,6 @@ function headersFor(tokens: CodexTokens, accept: string, sessionId: string): Rec
   };
 }
 
-export const currentTokens = (conn: Connection, deps: CodexDeps, state: CodexState): Promise<CodexTokens> =>
-  currentOf(state, conn.id, conn.codex, sourceOf(deps), CODEX_SIGN_IN);
-
 interface Call {
   body: Record<string, unknown>;
   model: string;
@@ -69,11 +52,11 @@ interface Call {
   names: ToolNames;
 }
 
-function send(call: Call, tokens: CodexTokens): Promise<Response> {
+function send(call: Call, access: CodexAccess): Promise<Response> {
   const request = toResponsesRequest(call.body, call.model, { promptCacheKey: call.sessionId, names: call.names });
-  return (call.deps.fetchImpl ?? fetch)(`${baseFor(tokens, call.deps)}/responses`, {
+  return (call.deps.fetchImpl ?? fetch)(`${baseFor(access, call.deps)}/responses`, {
     method: 'POST',
-    headers: headersFor(tokens, 'text/event-stream', call.sessionId),
+    headers: headersFor(access, call.sessionId),
     body: JSON.stringify(request),
     signal: call.watch.signal,
     redirect: 'manual',
@@ -91,22 +74,33 @@ function refusalOf(text: string, status: number): string {
   return withUsageLink(code, upstreamMessage(text, `OpenAI answered ${String(status)}`));
 }
 
-export async function codexMessages(
-  req: IncomingMessage,
-  res: ServerResponse,
-  body: Record<string, unknown>,
-  model: string,
-  conn: Connection,
-  deps: CodexDeps,
-  state: CodexState,
-  watch: Watch,
-): Promise<void> {
+let learning: Promise<unknown> | null = null;
+
+function learnVersion(access: CodexAccess): void {
+  if (access.method !== 'code' || learning !== null) return;
+  learning = learnCodexVersion()
+    .catch((err: unknown) => {
+      log.warn({ err: errMsg(err) }, 'gateway: the latest Codex version could not be learned');
+    })
+    .finally(() => {
+      learning = null;
+    });
+}
+
+async function reach(call: Call, conn: Connection): Promise<Response> {
+  if (conn.codex === null) throw new GatewayError(400, 'invalid_request_error', CODEX_SIGN_IN);
+  learnVersion(conn.codex);
+  const upstream = await send(call, conn.codex);
+  if (upstream.status !== 401) return upstream;
+  await upstream.body?.cancel();
+  const fresh = await call.deps.refresh(conn);
+  if (fresh?.codex === null || fresh?.codex === undefined) throw new GatewayError(403, 'permission_error', RENEW_FAILED);
+  return send(call, fresh.codex);
+}
+
+export async function codexMessages(req: IncomingMessage, res: ServerResponse, body: Record<string, unknown>, model: string, conn: Connection, deps: CodexDeps, watch: Watch): Promise<void> {
   const call: Call = { body, model, sessionId: sessionHeader(req) || randomUUID(), watch, deps, names: new ToolNames() };
-  const upstream = await reach(
-    () => currentTokens(conn, deps, state),
-    (tokens) => refreshed(state, conn.id, tokens, sourceOf(deps)),
-    (tokens) => send(call, tokens),
-  );
+  const upstream = await reach(call, conn);
   noteUsageHeaders('codex', conn.id, upstream.headers);
   if (!upstream.ok) {
     const text = await upstream.text();
@@ -125,19 +119,3 @@ export async function codexMessages(
   const frames = new SseParser().push(await upstream.text()).map(onEvent).join('');
   answerWhole(res, frames + translator.close(), conn.id);
 }
-
-export async function codexModels(tokens: CodexTokens, deps: Omit<CodexDeps, 'save'>): Promise<string[]> {
-  const base = baseFor(tokens, deps);
-  const fetchImpl = deps.fetchImpl ?? fetch;
-  if (tokens.method === 'chatgpt') return codexLists.get(`${base}:${tokens.clientId}`, () => listCodex(tokens, `${base}/models`, fetchImpl));
-  const version = await learnCodexVersion();
-  return codexLists.get(`${base}:${tokens.accountId}:${version}`, () => listCodex(tokens, `${base}/models?client_version=${version}`, fetchImpl));
-}
-
-async function listCodex(tokens: CodexTokens, url: string, fetchImpl: typeof fetch): Promise<string[]> {
-  const res = await fetchImpl(url, { headers: headersFor(tokens, 'application/json', randomUUID()), redirect: 'manual' });
-  if (!res.ok) throw new GatewayError(res.status, errorKind(res.status, INVALID), `OpenAI would not list the models of this ChatGPT plan (${String(res.status)})`);
-  const body: unknown = await res.json();
-  const models: unknown[] = isRecord(body) && Array.isArray(body.models) ? body.models : [];
-  return models.filter(isRecord).flatMap((m) => ((m.visibility ?? 'list') === 'list' && stringOf(m.slug) !== '' ? [stringOf(m.slug)] : []));
-}