@withbuddi/buddi 0.1.0-pre.18 → 0.1.0-pre.20

package/packages/gateway/dist/owner-notify.js.map

@@ -1 +1 @@
-{"version":3,"file":"owner-notify.js","sourceRoot":"","sources":["../src/owner-notify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,WAAW,GAQZ,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,MAA4C;IACvE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;QACnB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAOD,SAAS,MAAM,CAAC,MAAoB,EAAE,MAA2B;IAC/D,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,KAAK,IAAI,YAAY,CAAC,CAAC;IACrG,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAe,EAAE,IAAwB;IACpE,OAAO,KAAK,EAAE,IAAY,EAAE,MAAyB,EAAE,OAAwB,EAAE,EAAE;QACjF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE;YAC3C,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC;YACnC,OAAO,EAAE,KAAK;YACd,GAAG,cAAc,CAAC,IAAI,CAAC;YACvB,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC;AACJ,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,SAAS,CACvB,IAAe,EACf,IAAwB,EACxB,OAAqG;IAErG,OAAO,KAAK,EAAE,IAAY,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE;YAC3C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;YACjC,GAAG,cAAc,CAAC,IAAI,CAAC;YACvB,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAe,EAAE,IAAgB,EAAE,MAAoB;IAC1F,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE;QAC7B,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,GAAG,MAAM,CAAC,OAAO,+BAA+B,MAAM,CAAC,IAAI,EAAE;QACpE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClJ,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,SAAS,EAAE,YAAY,MAAM,CAAC,EAAE,EAAE;KACnC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"owner-notify.js","sourceRoot":"","sources":["../src/owner-notify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,WAAW,GAQZ,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,MAA4C;IACvE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;QACnB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAOD,SAAS,MAAM,CAAC,MAAoB,EAAE,MAA2B;IAC/D,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,KAAK,IAAI,YAAY,CAAC,CAAC;IACrG,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAe,EAAE,IAAwB;IACpE,OAAO,KAAK,EAAE,IAAY,EAAE,MAAyB,EAAE,OAAwB,EAAE,EAAE;QACjF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE;YAC3C,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC;YACnC,OAAO,EAAE,OAAO,EAAE,aAAa,IAAI,KAAK;YACxC,GAAG,cAAc,CAAC,IAAI,CAAC;YACvB,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,cAAc;gBAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE;gBACpH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC;AACJ,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,SAAS,CACvB,IAAe,EACf,IAAwB,EACxB,OAAqG;IAErG,OAAO,KAAK,EAAE,IAAY,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE;YAC3C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;YACjC,GAAG,cAAc,CAAC,IAAI,CAAC;YACvB,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAe,EAAE,IAAgB,EAAE,MAAoB;IAC1F,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE;QAC7B,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,GAAG,MAAM,CAAC,OAAO,+BAA+B,MAAM,CAAC,IAAI,EAAE;QACpE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClJ,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,SAAS,EAAE,YAAY,MAAM,CAAC,EAAE,EAAE;KACnC,CAAC,CAAC;AACL,CAAC"}

package/packages/gateway/dist/provider-accounts.d.ts

@@ -1,9 +1,10 @@
 import { type AgentCatalog, type LoadAgentCatalogOptions, type ProviderAccountsAccess, type ProviderRef, type ResolvedProvider, type Vault } from '@buddi/core';
-import { listProviderModels, type AccountModels, type RuntimeProvider } from '@buddi/runtime';
+import { listProviderModels, type AccountModels, type OllamaConnectProtocol, type RuntimeProvider } from '@buddi/runtime';
 import type { Pool } from 'pg';
 import { type ProviderDiagnostic } from './provider-diagnostics.js';
 import { CodexAccounts } from './codex-accounts.js';
 import { AnthropicAccounts } from './anthropic-accounts.js';
+import { OllamaAccounts, type OllamaDeviceView } from './ollama-accounts.js';
 type Binding = {
     agentId: string;
     accountId: string;
@@ -59,10 +60,17 @@ export declare class ProviderAccounts {
         vault?: Vault;
         test?: (resolved: ResolvedProvider) => Promise<void>;
         listModels?: typeof listProviderModels;
+        /** The one signed `/api/me` call and the device name, replaceable in tests. */
+        ollama?: {
+            protocol?: OllamaConnectProtocol;
+            deviceName?: () => string;
+            now?: () => number;
+        };
     };
     readonly vault: Vault | undefined;
     readonly codex: CodexAccounts | undefined;
     readonly anthropic: AnthropicAccounts | undefined;
+    readonly ollama: OllamaAccounts | undefined;
     /** The vault the OAuth adapters see, with account names translated onto owner secrets. */
     readonly accountVault: Vault | undefined;
     constructor(deps: {
@@ -73,6 +81,12 @@ export declare class ProviderAccounts {
         vault?: Vault;
         test?: (resolved: ResolvedProvider) => Promise<void>;
         listModels?: typeof listProviderModels;
+        /** The one signed `/api/me` call and the device name, replaceable in tests. */
+        ollama?: {
+            protocol?: OllamaConnectProtocol;
+            deviceName?: () => string;
+            now?: () => number;
+        };
     });
     get anthropicOAuthEnabled(): boolean;
     initialize(): Promise<void>;
@@ -92,6 +106,7 @@ export declare class ProviderAccounts {
         accounts: {
             assignedAgents: string[];
             test: TestResult | null;
+            device?: OllamaDeviceView | null | undefined;
             login?: import("./codex-accounts.js").CodexLoginView | {
                 state: "pending";
                 attemptId: string;
@@ -102,6 +117,7 @@ export declare class ProviderAccounts {
             reconnectRequired?: boolean | undefined;
             configured: boolean;
             detectedContextWindowTokens: number;
+            detectedContextWindowSource: "provider" | "table";
             removalPending: boolean;
             refreshable: boolean;
             subscriptionRenewsAt: null;
@@ -159,6 +175,36 @@ export declare class ProviderAccounts {
     } | {
         completed: boolean;
     } | null>;
+    /**
+     * Ollama Cloud with a device key: `connect` makes a key pair in the vault and
+     * answers with the page to press Connect on; `poll` asks ollama.com once
+     * whether that happened; `disconnect` removes the key from the vault. The
+     * device stays listed on ollama.com until the owner removes it there.
+     */
+    ollamaAction(id: string, action: 'connect' | 'poll' | 'disconnect', body: {
+        revision?: unknown;
+        attemptId?: unknown;
+    }, owner: string): Promise<{
+        state: "connected";
+        username: string;
+        deviceName: string;
+    } | {
+        state: "waiting";
+        expiresAt: string;
+    } | {
+        state: "failed";
+        message: string;
+    } | {
+        state: "pending";
+        attemptId: string;
+        verificationUrl: string;
+        deviceName: string;
+        expiresAt: string;
+    } | {
+        removed: boolean;
+        unpaired: boolean;
+        note: string;
+    }>;
     codexAction(id: string, action: 'login' | 'cancel-login' | 'logout', revision: unknown): Promise<import("./codex-accounts.js").CodexLoginView | {
         cancelled: boolean;
         removed?: undefined;

package/packages/gateway/dist/provider-accounts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-accounts.d.ts","sourceRoot":"","sources":["../src/provider-accounts.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAAwB,KAAK,sBAAsB,EAAE,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,KAAK,EACrI,MAAM,aAAa,CAAC;AACrB,OAAO,EAA6D,kBAAkB,EAAuB,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC9K,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACxF,OAAO,EAAE,aAAa,EAA2B,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAI5D,KAAK,OAAO,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AACrE,KAAK,UAAU,GAAG,kBAAkB,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAwB7D,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;EAIF,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,aAAa,EAAE,CAErF;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CACrD;AAED,qFAAqF;AACrF,qBAAa,gBAAgB;;IAgBf,QAAQ,CAAC,IAAI,EAAE;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;QAC9D,OAAO,EAAE,MAAM,YAAY,CAAC;QAAC,MAAM,EAAE,MAAM,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,KAAK,CAAC;QAC/D,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,UAAU,CAAC,EAAE,OAAO,kBAAkB,CAAC;KACxC;IApBD,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAWlD,0FAA0F;IAC1F,QAAQ,CAAC,YAAY,EAAE,KAAK,GAAG,SAAS,CAAC;gBACpB,IAAI,EAAE;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;QAC9D,OAAO,EAAE,MAAM,YAAY,CAAC;QAAC,MAAM,EAAE,MAAM,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,KAAK,CAAC;QAC/D,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,UAAU,CAAC,EAAE,OAAO,kBAAkB,CAAC;KACxC;IAwBD,IAAI,qBAAqB,YAAyF;IAE5G,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAiD3B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAsB3B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAExB,SAAS,EAAE,WAAW,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,CAAC,CAclE;IAEF,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA+BpB,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,UAAQ,GAAG,OAAO,CAAC,aAAa,CAAC;IAkCjE;;;;;;;OAOG;IACG,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;IAgBxD,IAAI,CAAC,IAAI,EAAE,OAAO;;;;IAqElB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO;;;;IAkBrC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;;;IAwBnC,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,WAAW,GAAG,eAAe;IAsBrC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAuB3C;;;;OAIG;IACH,YAAY,IAAI,sBAAsB;IAiGtC,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,gBAAgB,GAAG,cAAc,GAAG,QAAQ,EAAE,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,KAAK,EAAE,MAAM;;;;;;;;IAmE5K,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,cAAc,GAAG,QAAQ,EAAE,QAAQ,EAAE,OAAO;;;;;;;CAyBvF"}
+{"version":3,"file":"provider-accounts.d.ts","sourceRoot":"","sources":["../src/provider-accounts.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAAwB,KAAK,sBAAsB,EAAE,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,KAAK,EACrI,MAAM,aAAa,CAAC;AACrB,OAAO,EAA6D,kBAAkB,EAAwC,KAAK,aAAa,EAAE,KAAK,qBAAqB,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC3N,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACxF,OAAO,EAAE,aAAa,EAA2B,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAgC,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAc3G,KAAK,OAAO,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AACrE,KAAK,UAAU,GAAG,kBAAkB,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAwB7D,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;EAIF,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,aAAa,EAAE,CAErF;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CACrD;AAED,qFAAqF;AACrF,qBAAa,gBAAgB;;IAkBf,QAAQ,CAAC,IAAI,EAAE;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;QAC9D,OAAO,EAAE,MAAM,YAAY,CAAC;QAAC,MAAM,EAAE,MAAM,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,KAAK,CAAC;QAC/D,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,UAAU,CAAC,EAAE,OAAO,kBAAkB,CAAC;QACvC,+EAA+E;QAC/E,MAAM,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,qBAAqB,CAAC;YAAC,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;SAAE,CAAC;KAC9F;IAxBD,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,CAAC;IAY5C,0FAA0F;IAC1F,QAAQ,CAAC,YAAY,EAAE,KAAK,GAAG,SAAS,CAAC;gBACpB,IAAI,EAAE;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;QAC9D,OAAO,EAAE,MAAM,YAAY,CAAC;QAAC,MAAM,EAAE,MAAM,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,KAAK,CAAC;QAC/D,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,UAAU,CAAC,EAAE,OAAO,kBAAkB,CAAC;QACvC,+EAA+E;QAC/E,MAAM,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,qBAAqB,CAAC;YAAC,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;SAAE,CAAC;KAC9F;IAyBD,IAAI,qBAAqB,YAA4E;IAE/F,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAiD3B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAiC3B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAExB,SAAS,EAAE,WAAW,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,CAAC,CAelE;IAEF,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;yCAa8C,UAAU,GAAG,OAAO;;;;;;;;;;;;;;;;IAuBtF,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,UAAQ,GAAG,OAAO,CAAC,aAAa,CAAC;IA0DjE;;;;;;;OAOG;IACG,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;IAgBxD,IAAI,CAAC,IAAI,EAAE,OAAO;;;;IA4ElB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO;;;;IAkBrC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;;;IAyBnC,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,WAAW,GAAG,eAAe;IAwBrC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAuB3C;;;;OAIG;IACH,YAAY,IAAI,sBAAsB;IA+GtC,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,gBAAgB,GAAG,cAAc,GAAG,QAAQ,EAAE,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,KAAK,EAAE,MAAM;;;;;;;;IA2B5K;;;;;OAKG;IACH,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,YAAY,EAAE,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,KAAK,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;IAgFpI,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,cAAc,GAAG,QAAQ,EAAE,QAAQ,EAAE,OAAO;;;;;;;CA+BvF"}

package/packages/gateway/dist/provider-accounts.js

@@ -1,19 +1,28 @@
 import { randomUUID } from 'node:crypto';
 import { setTimeout as delay } from 'node:timers/promises';
-import { accountBaseUrl, accountModelProblem, accountProtocol, createVault, providerFromEnv, putOwnerSecret, registerSecretDestination, resolveProviderAccount, useOwnerSecret, vaultState, } from '@buddi/core';
-import { contextWindowTokens, createProvider, providerCapabilities, listProviderModels, readAnthropicTokens } from '@buddi/runtime';
+import { OLLAMA_CLOUD_ACCOUNT_URL, accountBaseUrl, accountModelProblem, accountProtocol, createVault, providerFromEnv, putOwnerSecret, registerSecretDestination, resolveProviderAccount, useOwnerSecret, vaultState, } from '@buddi/core';
+import { contextWindowTokens, createProvider, providerCapabilities, listProviderModels, readAnthropicTokens, readCodexTokens } from '@buddi/runtime';
 import { z } from 'zod';
 import { providerDiagnostic } from './provider-diagnostics.js';
 import { CodexAccounts } from './codex-accounts.js';
 import { AnthropicAccounts } from './anthropic-accounts.js';
+import { OllamaAccounts, deviceView, readOllamaDevice } from './ollama-accounts.js';
+import { SIGNIN_HIDDEN, subscriptionSignIns } from './subscription-signins.js';
 import { ACCOUNTS_PROVIDER_KIND, accountsProviderDestination, deleteAccountSecret, ownerSecretVault } from './owner-secrets.js';
+/** At most this many models' windows are kept per account. */
+const REPORTED_WINDOWS_MAX = 1000;
+/** The provider's reported window for a model, when it said a usable one. */
+function reportedWindow(map, model) {
+    const tokens = map && Object.hasOwn(map, model) ? map[model] : undefined;
+    return typeof tokens === 'number' && Number.isInteger(tokens) && tokens >= 8_000 && tokens <= 2_000_000 ? tokens : undefined;
+}
 const columns = `id, label, kind, auth, base_url as "baseUrl", default_model as "defaultModel",
-  context_window_tokens as "contextWindowTokens",
+  context_window_tokens as "contextWindowTokens", reported_context_windows as "reportedContextWindows",
   enabled, deleting, revision, secret_ref as "secretRef", legacy_env as "legacyEnv"`;
 const saveSchema = z.object({
     id: z.string().min(1).max(100).optional(), revision: z.number().int().positive().optional(),
     label: z.string().trim().min(1).max(100), kind: z.enum(['anthropic', 'openai', 'openai-compatible', 'codex']),
-    auth: z.enum(['api-key', 'none', 'legacy-subscription-token', 'chatgpt', 'anthropic-oauth']),
+    auth: z.enum(['api-key', 'none', 'legacy-subscription-token', 'chatgpt', 'anthropic-oauth', 'device-key']),
     baseUrl: z.string().trim().max(2048).optional(), defaultModel: z.string().trim().min(1).max(150),
     enabled: z.boolean(), secret: z.string().trim().min(1).max(16384).optional(),
     /**
@@ -62,6 +71,8 @@ export class ProviderAccounts {
     vault;
     codex;
     anthropic;
+    ollama;
+    #devices = new Map();
     #tokenInfo = new Map();
     #rows = new Map();
     #bindings = new Map();
@@ -92,12 +103,14 @@ export class ProviderAccounts {
                 return row === undefined ? 'a provider account' : `the model account “${row.label}”`;
             }));
         }
-        if (deps.env.BUDDI_CODEX_EXPERIMENT === '1' && this.accountVault)
+        if (subscriptionSignIns(deps.env).codex && this.accountVault)
             this.codex = new CodexAccounts({ vault: this.accountVault });
         if (this.accountVault)
             this.anthropic = new AnthropicAccounts(this.accountVault);
+        if (this.accountVault)
+            this.ollama = new OllamaAccounts(this.accountVault, deps.ollama?.protocol, deps.ollama?.now, deps.ollama?.deviceName);
     }
-    get anthropicOAuthEnabled() { return this.deps.env.BUDDI_ANTHROPIC_OAUTH_EXPERIMENT === '1' && !!this.anthropic; }
+    get anthropicOAuthEnabled() { return subscriptionSignIns(this.deps.env).claude && !!this.anthropic; }
     async initialize() {
         // One atomic, restart-safe migration. Never rewrites private agent files or
         // copies a secret into SQL. Missing credentials still get a stable account.
@@ -160,14 +173,26 @@ export class ProviderAccounts {
         const bindings = await this.deps.pool.query('select agent_id as "agentId", account_id as "accountId", model from core.agent_provider_accounts');
         const configured = new Map();
         this.#tokenInfo.clear();
+        this.#devices.clear();
         for (const row of result.rows) {
             try {
                 const raw = await this.#secret(row);
                 configured.set(row.id, row.auth === 'none' || !!raw);
+                if (row.auth === 'device-key') {
+                    // Configured means connected: a key nobody pressed Connect for signs nothing useful.
+                    const device = raw ? readOllamaDevice(raw) : null;
+                    configured.set(row.id, !!device?.connectedAt);
+                    if (device)
+                        this.#devices.set(row.id, deviceView(device));
+                }
                 if (row.auth === 'anthropic-oauth' && raw) {
                     const tokens = readAnthropicTokens(raw);
                     this.#tokenInfo.set(row.id, { tokenExpiresAt: new Date(tokens.expiresAt).toISOString(), reconnectRequired: tokens.state !== 'ready' });
                 }
+                if (row.kind === 'codex' && raw) {
+                    const tokens = readCodexTokens(raw);
+                    this.#tokenInfo.set(row.id, { tokenExpiresAt: new Date(tokens.expiresAt).toISOString(), reconnectRequired: tokens.state !== 'ready' });
+                }
             }
             catch {
                 configured.set(row.id, false);
@@ -187,11 +212,12 @@ export class ProviderAccounts {
             credential: { kind: row.auth === 'legacy-subscription-token' || row.auth === 'anthropic-oauth' ? 'subscription-token' : 'api-key', env: row.secretRef ?? 'NO_CREDENTIAL' },
         } : { ...providerFromEnv(this.deps.env, agent.model, agent.provider), accountId: binding?.accountId ?? '' };
         const issue = !row ? 'Choose a provider account for this agent in Settings → Agents.'
-            : row.kind === 'codex' && !this.codex ? 'Codex experiment is not enabled in this process.'
-                : row.auth === 'anthropic-oauth' && !this.anthropicOAuthEnabled ? 'Claude OAuth experiment is not enabled in this process.'
+            : row.kind === 'codex' && !this.codex ? SIGNIN_HIDDEN.codex
+                : row.auth === 'anthropic-oauth' && !this.anthropicOAuthEnabled ? SIGNIN_HIDDEN.claude
                     : !row.enabled ? `Provider account “${row.label}” is disabled.`
-                        : !this.#configured.get(row.id) ? `Provider account “${row.label}” needs a credential or vault access.`
-                            : accountModelProblem(row.kind, binding.model);
+                        : row.auth === 'device-key' && !this.#configured.get(row.id) ? `Connect Ollama for “${row.label}” in Settings → Model accounts.`
+                            : !this.#configured.get(row.id) ? `Provider account “${row.label}” needs a credential or vault access.`
+                                : accountModelProblem(row.kind, binding.model);
         return { provider, availability: issue ? { ok: false, problem: { code: 'missing-credential', message: issue } } : { ok: true } };
     };
     view(ownerSession) {
@@ -199,19 +225,24 @@ export class ProviderAccounts {
             vault: { kind: this.vault?.kind ?? 'none', ...vaultState({ env: this.deps.env }) },
             codexEnabled: !!this.codex,
             anthropicOAuthEnabled: this.anthropicOAuthEnabled,
-            accounts: [...this.#rows.values()].map(({ secretRef: _secret, legacyEnv: _env, deleting, ...row }) => ({
-                ...row, configured: this.#configured.get(row.id) ?? false,
-                // What the runtime would assume for this account's default model, so
-                // the field can show it as a placeholder instead of a blank the owner
-                // has to guess at.
-                detectedContextWindowTokens: contextWindowTokens(row.defaultModel, row.kind === 'codex' ? 'openai' : row.kind),
-                removalPending: deleting,
-                refreshable: row.kind === 'codex' || row.auth === 'anthropic-oauth', tokenExpiresAt: null, subscriptionRenewsAt: null,
-                ...(row.auth === 'anthropic-oauth' ? { ...this.#tokenInfo.get(row.id), login: this.anthropic?.view(row.id, row.revision, ownerSession) ?? null } : {}),
-                ...(row.kind === 'codex' ? { login: this.codex?.view(row.id) ?? null } : {}),
-                assignedAgents: [...this.#bindings.values()].filter(b => b.accountId === row.id).map(b => b.agentId),
-                test: this.#tests.get(row.id) ?? null,
-            })),
+            accounts: [...this.#rows.values()].map(({ secretRef: _secret, legacyEnv: _env, deleting, reportedContextWindows, ...row }) => {
+                // The provider's own number for the default model when its model list
+                // said one, else what the runtime would assume from the name, so the
+                // field can show it as a placeholder instead of a blank.
+                const reported = reportedWindow(reportedContextWindows, row.defaultModel);
+                return {
+                    ...row, configured: this.#configured.get(row.id) ?? false,
+                    detectedContextWindowTokens: reported ?? contextWindowTokens(row.defaultModel, row.kind === 'codex' ? 'openai' : row.kind),
+                    detectedContextWindowSource: (reported ? 'provider' : 'table'),
+                    removalPending: deleting,
+                    refreshable: row.kind === 'codex' || row.auth === 'anthropic-oauth', tokenExpiresAt: null, subscriptionRenewsAt: null,
+                    ...(row.auth === 'anthropic-oauth' ? { ...this.#tokenInfo.get(row.id), login: this.anthropic?.view(row.id, row.revision, ownerSession) ?? null } : {}),
+                    ...(row.kind === 'codex' ? { ...this.#tokenInfo.get(row.id), login: this.codex?.view(row.id) ?? null } : {}),
+                    ...(row.auth === 'device-key' ? { device: this.#devices.get(row.id) ?? null, login: this.ollama?.view(row.id, row.revision, ownerSession) ?? null } : {}),
+                    assignedAgents: [...this.#bindings.values()].filter(b => b.accountId === row.id).map(b => b.agentId),
+                    test: this.#tests.get(row.id) ?? null,
+                };
+            }),
             bindings: [...this.#bindings.values()],
         };
     }
@@ -242,7 +273,7 @@ export class ProviderAccounts {
                 let value;
                 if (row.kind === 'codex') {
                     if (!this.codex)
-                        throw new ProviderAccountError(409, 'Codex experiment is unavailable.');
+                        throw new ProviderAccountError(409, SIGNIN_HIDDEN.codex);
                     const lease = await this.#codexAccess(row);
                     try {
                         value = await this.codex.models(lease.access);
@@ -261,6 +292,7 @@ export class ProviderAccounts {
                 if (current.revision !== row.revision || !current.enabled || current.deleting)
                     throw new ProviderAccountError(409, 'Account changed. Refresh models again.');
                 this.#modelLists.set(id, { revision: row.revision, until: Date.now() + 60_000, value });
+                await this.#rememberWindows(current, value).catch(() => { });
                 return value;
             }
             catch (error) {
@@ -276,6 +308,32 @@ export class ProviderAccounts {
         this.#modelRequests.set(key, pending);
         return pending;
     }
+    /**
+     * Keep the windows the provider's own model list reported, merged over what
+     * earlier fetches said, so the account page and the transcript budget can
+     * use the provider's number instead of a guess from the model name.
+     */
+    async #rememberWindows(row, list) {
+        const found = list.models.filter(m => typeof m.contextWindow === 'number');
+        if (!found.length)
+            return;
+        const merged = new Map();
+        for (const [model, tokens] of Object.entries(row.reportedContextWindows ?? {})) {
+            if (typeof tokens === 'number' && Number.isFinite(tokens))
+                merged.set(model, tokens);
+        }
+        // Fresh entries go last, so the cap drops the oldest.
+        for (const m of found) {
+            merged.delete(m.id);
+            merged.set(m.id, m.contextWindow);
+        }
+        const entries = [...merged.entries()];
+        const capped = Object.fromEntries(entries.slice(Math.max(0, entries.length - REPORTED_WINDOWS_MAX)));
+        const { rows } = await this.deps.pool.query(`update core.provider_accounts set reported_context_windows=$2::jsonb where id=$1 returning reported_context_windows as "reportedContextWindows"`, [row.id, JSON.stringify(capped)]);
+        const live = this.#rows.get(row.id);
+        if (rows[0] && live)
+            this.#rows.set(row.id, { ...live, reportedContextWindows: rows[0].reportedContextWindows });
+    }
     /**
      * List the models a credential can reach, before anything is saved.
      *
@@ -311,13 +369,23 @@ export class ProviderAccounts {
             const input = parsed.data;
             if ((input.kind === 'codex') !== (input.auth === 'chatgpt'))
                 throw new ProviderAccountError(400, 'Codex accounts require ChatGPT subscription sign-in.');
-            if (input.kind === 'codex' && (!this.codex || input.secret))
-                throw new ProviderAccountError(400, 'Enable the Codex experiment on the host and use device sign-in, not a pasted token.');
+            if (input.kind === 'codex' && !this.codex)
+                throw new ProviderAccountError(400, SIGNIN_HIDDEN.codex);
+            if (input.kind === 'codex' && input.secret)
+                throw new ProviderAccountError(400, 'ChatGPT accounts use device sign-in, not a pasted token.');
             if (input.auth === 'anthropic-oauth' && (input.kind !== 'anthropic' || input.secret))
                 throw new ProviderAccountError(400, 'Claude OAuth requires an Anthropic account and browser sign-in, not a pasted token.');
+            if (input.auth === 'device-key') {
+                if (input.kind !== 'openai-compatible' || input.secret)
+                    throw new ProviderAccountError(400, 'An Ollama device key is made by buddi and connected on ollama.com, not pasted.');
+                if (input.baseUrl && input.baseUrl.replace(/\/+$/, '') !== OLLAMA_CLOUD_ACCOUNT_URL)
+                    throw new ProviderAccountError(400, 'A device key only connects to Ollama Cloud. Use a key for another address.');
+                if (!this.ollama)
+                    throw new ProviderAccountError(409, 'Configure a credential vault on the host first.');
+            }
             const old = input.id ? await this.#row(input.id) : undefined;
             if (input.auth === 'anthropic-oauth' && !old && !this.anthropicOAuthEnabled)
-                throw new ProviderAccountError(400, 'Enable the Claude OAuth experiment on the host first.');
+                throw new ProviderAccountError(400, SIGNIN_HIDDEN.claude);
             if (old?.deleting)
                 throw new ProviderAccountError(409, 'Removal is pending. Unlock the vault and finish removing this account.');
             if (old && input.revision !== old.revision)
@@ -332,7 +400,7 @@ export class ProviderAccounts {
                 throw new ProviderAccountError(400, 'Credential cannot contain control characters.');
             let baseUrl;
             try {
-                baseUrl = accountBaseUrl(input.kind, input.baseUrl);
+                baseUrl = accountBaseUrl(input.kind, input.auth === 'device-key' ? OLLAMA_CLOUD_ACCOUNT_URL : input.baseUrl);
             }
             catch (e) {
                 throw new ProviderAccountError(400, e.message);
@@ -352,7 +420,8 @@ export class ProviderAccounts {
             try {
                 if (old?.auth === 'anthropic-oauth')
                     this.anthropic?.forget(id);
-                let secretRef = old?.secretRef ?? (input.auth === 'anthropic-oauth' ? `ANTHROPIC_ACCOUNT_${randomUUID().replaceAll('-', '_')}` : input.kind === 'codex' ? `CODEX_ACCOUNT_${randomUUID().replaceAll('-', '_')}` : null);
+                let secretRef = old?.secretRef ?? (input.auth === 'anthropic-oauth' ? `ANTHROPIC_ACCOUNT_${randomUUID().replaceAll('-', '_')}` : input.kind === 'codex' ? `CODEX_ACCOUNT_${randomUUID().replaceAll('-', '_')}`
+                    : input.auth === 'device-key' ? `OLLAMA_DEVICE_${randomUUID().replaceAll('-', '_')}` : null);
                 if (input.secret) {
                     if (!this.vault)
                         throw new ProviderAccountError(409, 'Configure a credential vault on the host first.');
@@ -446,6 +515,7 @@ export class ProviderAccounts {
             const oauthLease = row.auth === 'anthropic-oauth' ? await this.#anthropicAccess(row, false) : undefined;
             try {
                 this.anthropic?.forget(id);
+                this.ollama?.forget(id);
                 // A tombstone prevents reactivation even if vault deletion is denied.
                 const disabled = await this.deps.pool.query(`update core.provider_accounts set enabled=false,deleting=true,revision=revision+1
       where id=$1 and revision=$2 returning id`, [id, revision]);
@@ -479,14 +549,16 @@ export class ProviderAccounts {
         if (!snapshot)
             throw new ProviderAccountError(409, 'Provider account is no longer available.');
         return {
-            capabilities: { ...providerCapabilities(accountProtocol(snapshot.kind)), ...(snapshot.kind === 'codex' ? { usageReporting: false, parallelToolCalls: false } : {}) },
+            // A ChatGPT account speaks the Responses API, whose row matches OpenAI's:
+            // parallel tool calls, usage reported, no native search, no documents.
+            capabilities: providerCapabilities(accountProtocol(snapshot.kind)),
             complete: async (request) => {
                 const row = await this.#row(id);
                 if (row.revision !== snapshot.revision)
                     throw new ProviderAccountError(409, 'Provider account settings changed during this run. Send a new message to continue with the updated account.');
                 if (row.kind === 'codex') {
                     if (!this.codex)
-                        throw new ProviderAccountError(409, 'Codex experiment is disabled on this process.');
+                        throw new ProviderAccountError(409, SIGNIN_HIDDEN.codex);
                     const lease = await this.#codexCompletionAccess(row, request.signal);
                     try {
                         return await this.codex.complete(lease.access, ref.model, request);
@@ -507,7 +579,7 @@ export class ProviderAccounts {
         try {
             const row = await this.#row(id);
             if (row.kind === 'codex')
-                throw new ProviderAccountError(400, 'Codex connection testing has no verified output-token cap. Connect and send a test chat instead.');
+                throw new ProviderAccountError(400, 'A ChatGPT subscription has no output-token cap for a connection test. Connect and send a test chat instead.');
             let diagnostic = { state: 'connected', message: 'Connection succeeded.', httpStatus: null, retryAt: null };
             try {
                 const resolved = resolveProviderAccount(row, row.defaultModel, await this.#usableSecret(row));
@@ -553,7 +625,7 @@ export class ProviderAccounts {
                 if (row.kind !== 'codex')
                     throw new ProviderAccountError(400, 'This is not a Codex account.');
                 if (!this.codex)
-                    throw new ProviderAccountError(409, 'Codex experiment is not enabled in this process.');
+                    throw new ProviderAccountError(409, SIGNIN_HIDDEN.codex);
                 if (!row.enabled || row.deleting)
                     throw new ProviderAccountError(409, `Provider account “${row.label}” is disabled.`);
                 const lease = await this.#codexCompletionAccess(row, signal);
@@ -571,9 +643,27 @@ export class ProviderAccounts {
         await this.#codexReleased.get(id);
     }
     async #usableSecret(row, signal) {
+        if (row.auth === 'device-key') {
+            if (!this.ollama || !row.secretRef)
+                throw new ProviderAccountError(409, 'Configure a credential vault on the host first.');
+            try {
+                return await this.ollama.credential(row.secretRef);
+            }
+            catch (error) {
+                // Never propagate vault errors, which may carry key material.
+                throw new ProviderAccountError(409, error instanceof Error && /^(Connect this Ollama|Invalid Ollama device key|The credential vault)/.test(error.message)
+                    ? error.message : 'Could not read the Ollama device key. Check the vault and connect again.');
+            }
+        }
         if (row.auth !== 'anthropic-oauth') {
             if (row.auth === 'none' || row.secretRef === null)
                 return this.#secret(row);
+            // A legacy account names buddi's own key (`CLAUDE_CODE_OAUTH_TOKEN`,
+            // `OPENAI_API_KEY`), which is not an owner secret and never will be until
+            // the owner replaces it. Asking owner secrets for it would only write a
+            // refusal to the use log on every reload; the raw vault answers directly.
+            if (row.legacyEnv !== null)
+                return this.#secret(row);
             /*
              * The run path reads the credential through the owner secrets area
              * (owner-secrets §7): the binding found and the rule applied, the use
@@ -604,7 +694,7 @@ export class ProviderAccounts {
             throw new ProviderAccountError(409, result.refused);
         }
         if (!this.anthropicOAuthEnabled)
-            throw new ProviderAccountError(409, 'Claude OAuth experiment is disabled.');
+            throw new ProviderAccountError(409, SIGNIN_HIDDEN.claude);
         const lease = await this.#anthropicAccess(row, true, signal);
         try {
             return await this.anthropic.credential(row.secretRef);
@@ -660,7 +750,7 @@ export class ProviderAccounts {
             if (!owner || row.auth !== 'anthropic-oauth' || row.revision !== body.revision)
                 throw new ProviderAccountError(409, 'Account changed. Refresh before continuing.');
             if ((action === 'login' || action === 'complete-login') && !this.anthropicOAuthEnabled)
-                throw new ProviderAccountError(409, 'Claude OAuth experiment is disabled.');
+                throw new ProviderAccountError(409, SIGNIN_HIDDEN.claude);
             const lease = await this.#anthropicAccess(row, action === 'login' || action === 'complete-login');
             try {
                 if (action === 'complete-login') {
@@ -696,6 +786,75 @@ export class ProviderAccounts {
             }
         });
     }
+    /**
+     * Ollama Cloud with a device key: `connect` makes a key pair in the vault and
+     * answers with the page to press Connect on; `poll` asks ollama.com once
+     * whether that happened; `disconnect` removes the key from the vault. The
+     * device stays listed on ollama.com until the owner removes it there.
+     */
+    ollamaAction(id, action, body, owner) {
+        return this.#serial(async () => {
+            const row = await this.#row(id);
+            if (!owner || row.auth !== 'device-key' || !row.secretRef)
+                throw new ProviderAccountError(409, 'This is not an Ollama Cloud account connected with a device key.');
+            if (!this.ollama)
+                throw new ProviderAccountError(409, 'Configure a credential vault on the host first.');
+            if (row.deleting)
+                throw new ProviderAccountError(409, 'Removal is pending. Unlock the vault and finish removing this account.');
+            if (action === 'poll') {
+                if (typeof body.attemptId !== 'string')
+                    throw new ProviderAccountError(400, 'Connect first.');
+                let answer;
+                try {
+                    answer = await this.ollama.poll(id, row.revision, owner, body.attemptId, row.secretRef);
+                }
+                catch (error) {
+                    throw new ProviderAccountError(409, error.message);
+                }
+                if (answer.state === 'connected') {
+                    this.#modelLists.delete(id);
+                    this.#tests.delete(id);
+                    await this.load();
+                }
+                return answer;
+            }
+            if (row.revision !== body.revision)
+                throw new ProviderAccountError(409, 'Account changed. Refresh before continuing.');
+            if (action === 'connect' && !row.enabled)
+                throw new ProviderAccountError(409, 'Enable this account before connecting it.');
+            this.ollama.forget(id);
+            let unpaired = false;
+            if (action === 'disconnect') {
+                unpaired = await this.ollama.unpair(row.secretRef);
+                try {
+                    await deleteAccountSecret(this.deps.pool, this.vault, row.secretRef);
+                }
+                catch {
+                    throw new ProviderAccountError(409, 'Could not remove the Ollama device key. Unlock the vault and retry.');
+                }
+            }
+            // A new key, or none: runs that started on the old one stop at their next call.
+            await this.deps.pool.query('update core.provider_accounts set revision=revision+1,updated_at=now() where id=$1', [id]);
+            this.#modelLists.delete(id);
+            this.#tests.delete(id);
+            if (action === 'disconnect') {
+                await this.load();
+                return { removed: true, unpaired, note: unpaired
+                        ? 'Disconnected. The key is gone from buddi, and ollama.com no longer lists this device.'
+                        : 'Disconnected. The key is gone from buddi. ollama.com did not confirm it forgot this device; if it is still listed in your ollama.com settings, remove it there.' };
+            }
+            let started;
+            try {
+                started = await this.ollama.start(id, row.revision + 1, owner, row.secretRef);
+            }
+            catch (error) {
+                await this.load();
+                throw new ProviderAccountError(409, error.message);
+            }
+            await this.load();
+            return started;
+        });
+    }
     async #codexCompletionAccess(row, signal) {
         const deadline = Date.now() + 120_000;
         while (true) {
@@ -758,7 +917,7 @@ export class ProviderAccounts {
         return this.#serial(async () => {
             const row = await this.#row(id);
             if (!this.codex || row.kind !== 'codex' || !row.secretRef)
-                throw new ProviderAccountError(409, 'Codex experiment is unavailable.');
+                throw new ProviderAccountError(409, 'Codex account is unavailable.');
             if (revision !== row.revision)
                 throw new ProviderAccountError(409, 'Account changed. Refresh before continuing.');
             if (action === 'cancel-login') {
@@ -782,12 +941,19 @@ export class ProviderAccounts {
             const lease = await this.#codexAccess(row);
             try {
                 const started = await this.codex.login(lease.access);
-                void started.finished.then(() => lease.release()).catch(() => { });
+                void started.finished.then(() => lease.release()).then(() => {
+                    if (this.codex?.view(id)?.state !== 'connected')
+                        return;
+                    // Fill the provider's windows now, not when the owner next opens the picker.
+                    this.#modelLists.delete(id);
+                    void this.models(id, true).catch(() => { });
+                }).catch(() => { });
                 return started.view;
             }
             catch {
                 await lease.release();
-                throw new ProviderAccountError(409, 'Could not start Codex sign-in. Check CLI version 0.155.0 and host vault access.');
+                const view = this.codex.view(id);
+                throw new ProviderAccountError(409, view?.state === 'failed' && view.message ? view.message : 'Could not start ChatGPT sign-in. Check the host vault and try again.');
             }
         });
     }