airgate 0.1.3 → 0.1.4

package/README.md

@@ -38,6 +38,7 @@ airgate run "get the failing tests passing"   # a fresh pod; the result comes ba
 airgate skill install                         # teach Claude Code when and how to use airgate
 claude mcp add airgate -- airgate mcp         # airgate as tools (pod_run, pod_up, pod_down…)
 airgate models connect claude --laptop        # a token from `claude setup-token`, kept on this laptop
+airgate models connect chatgpt --laptop       # or Codex on your ChatGPT plan
 ```
 
 The last line lets this laptop sign the pods' model calls while airgate runs, so tasks run without

package/dist/airgate.mjs

@@ -301,6 +301,72 @@ function dotenvExample(names) {
   return names.map((n2) => `${n2}=`).join("\n") + (names.length ? "\n" : "");
 }
 
+// ../sandbox/src/chatgpt.ts
+var CHATGPT_CODEX_BASE = "https://chatgpt.com/backend-api/codex";
+var CHATGPT_TOKEN_URL = "https://auth.openai.com/oauth/token";
+var CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+function jwtClaims(token) {
+  const part = token?.split(".")[1];
+  if (!part) return null;
+  try {
+    const b64 = part.replace(/-/g, "+").replace(/_/g, "/");
+    const bin = atob(b64 + "=".repeat((4 - b64.length % 4) % 4));
+    return JSON.parse(new TextDecoder().decode(Uint8Array.from(bin, (c) => c.charCodeAt(0))));
+  } catch {
+    return null;
+  }
+}
+function accountIdOf(t) {
+  if (typeof t.account_id === "string" && t.account_id) return t.account_id;
+  const auth = jwtClaims(typeof t.id_token === "string" ? t.id_token : void 0)?.["https://api.openai.com/auth"];
+  return typeof auth?.chatgpt_account_id === "string" ? auth.chatgpt_account_id : null;
+}
+function parseChatgptLogin(text2) {
+  let j;
+  try {
+    j = JSON.parse(text2);
+  } catch {
+    throw new Error("not a Codex login: expected the auth.json that `codex login` writes");
+  }
+  const t = j.tokens && typeof j.tokens === "object" ? j.tokens : j;
+  if (typeof t.access_token !== "string" || typeof t.refresh_token !== "string") {
+    throw new Error("this Codex login has no ChatGPT tokens: sign in with ChatGPT in `codex login`, not an API key");
+  }
+  const account = accountIdOf(t);
+  if (!account) throw new Error("this Codex login doesn't name a ChatGPT account");
+  return { access_token: t.access_token, refresh_token: t.refresh_token, id_token: typeof t.id_token === "string" ? t.id_token : void 0, account_id: account };
+}
+function chatgptNeedsRefresh(t, now = Date.now(), windowMs = 5 * 6e4) {
+  const exp = jwtClaims(t.access_token)?.exp;
+  return typeof exp !== "number" || exp * 1e3 - now < windowMs;
+}
+async function refreshChatgpt(t, o = {}) {
+  const res = await (o.fetch ?? fetch)(o.tokenUrl ?? CHATGPT_TOKEN_URL, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ client_id: CODEX_CLIENT_ID, grant_type: "refresh_token", refresh_token: t.refresh_token, scope: "openid profile email" }),
+    signal: AbortSignal.timeout(45e3)
+  });
+  if (!res.ok) {
+    const why = await res.text().catch(() => "");
+    throw new Error(
+      res.status === 400 || res.status === 401 ? "the ChatGPT sign-in expired or was revoked: connect it again (airgate models connect chatgpt)" : `couldn't renew the ChatGPT sign-in (${res.status}${why ? `: ${why.slice(0, 120)}` : ""})`
+    );
+  }
+  const r = await res.json();
+  if (!r.access_token) throw new Error("renewing the ChatGPT sign-in returned no access token");
+  return { ...t, access_token: r.access_token, refresh_token: r.refresh_token ?? t.refresh_token, id_token: r.id_token ?? t.id_token };
+}
+function chatgptUrl(path, base = CHATGPT_CODEX_BASE) {
+  return base + path.replace(/^\/?v1(?=\/|$)/, "").replace(/^(?!\/)/, "/");
+}
+function signChatgpt(t, headers) {
+  delete headers["x-api-key"];
+  headers.authorization = `Bearer ${t.access_token}`;
+  headers["chatgpt-account-id"] = t.account_id;
+  headers.originator ??= "codex_cli_rs";
+}
+
 // src/api.ts
 var UPLOAD_PART = 6 * 1024 * 1024;
 var ApiError = class extends Error {
@@ -518,8 +584,8 @@ var Api = class {
   modelsAuth() {
     return this.request("GET", "/v1/models/auth");
   }
-  connectModel(vendor, value) {
-    return this.request("PUT", `/v1/models/auth/${enc(vendor)}`, { body: { value } });
+  connectModel(vendor, value, kind) {
+    return this.request("PUT", `/v1/models/auth/${enc(vendor)}`, { body: { value, ...kind ? { kind } : {} } });
   }
   disconnectModel(vendor) {
     return this.request("DELETE", `/v1/models/auth/${enc(vendor)}`);
@@ -4388,8 +4454,8 @@ function linked(s2, j, b2, ascii) {
   }
   return m;
 }
-function place3(s2, j, c, k, join7, a = ARMS.get(c), ascii = false, round = false) {
-  if (join7 && a !== void 0) {
+function place3(s2, j, c, k, join8, a = ARMS.get(c), ascii = false, round = false) {
+  if (join8 && a !== void 0) {
     const old = s2.chars[j], b2 = ascii ? asciiArms(old) : ARMS.get(old);
     if (b2 !== void 0) {
       const kept = linked(s2, j, b2, ascii);
@@ -4555,7 +4621,7 @@ function rect(s2, x, y, w, h, o) {
   if (title)
     for (const ch of title)
       code(ch);
-  const join7 = yes(o?.join, "join", true);
+  const join8 = yes(o?.join, "join", true);
   const k = paint(s2, color), fk = fillColor === void 0 ? k : paint(s2, fillColor);
   if (!finite3(x, y, w, h))
     return { x: 0, y: 0, cols: 0, rows: 0 };
@@ -4578,7 +4644,7 @@ function rect(s2, x, y, w, h, o) {
     const put = (cx, cy, e, reach = 255) => {
       const j = s2.index(cx, cy), a = ascii ? EDGE_ARMS[e] : ARMS.get(ed[e]);
       if (j >= 0)
-        place3(s2, j, ed[e], k, join7, a === void 0 ? a : a & reach, ascii, round);
+        place3(s2, j, ed[e], k, join8, a === void 0 ? a : a & reach, ascii, round);
     };
     const end = (i, n2, first, last) => n2 < 2 ? 255 : i === 0 ? 3 << first : i === n2 - 1 ? 3 << last : 255;
     const from = (o2, lo) => Math.max(lo, -o2), to = (o2, hi, n2) => Math.min(hi, n2 - o2);
@@ -4714,11 +4780,11 @@ function shape(s2, cx, cy, rx, ry, o, what, from = 0, span = 1) {
   const ch = char === "auto" ? "auto" : brush(char, `${/^[aeiou]/.test(what) ? "an" : "a"} ${what}'s char`);
   const f = fill === void 0 || fill === false ? null : brush(fill, "fill");
   const k = paint(s2, color), fk = fillColor === void 0 ? k : paint(s2, fillColor);
-  const join7 = yes(o?.join, "join", true);
+  const join8 = yes(o?.join, "join", true);
   ellipseCells(s2.cols, s2.rows, cx, cy, rx, ry, f !== null, (x, y, edge, slope) => {
     const j = y * s2.cols + x;
     if (edge)
-      place3(s2, j, ch === "auto" ? slope : ch, k, join7 && ch !== "auto");
+      place3(s2, j, ch === "auto" ? slope : ch, k, join8 && ch !== "auto");
     else
       s2.put(j, f, f === EMPTY ? NONE : fk);
   }, ch === "auto" ? s2.aspect : 0, from, span);
@@ -7662,7 +7728,7 @@ var log = {
 import { createInterface } from "node:readline";
 
 // src/version.ts
-var VERSION = "0.1.3";
+var VERSION = "0.1.4";
 
 // src/commands/updown.ts
 import { appendFileSync, existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync5, realpathSync as realpathSync2, statSync as statSync2, writeFileSync as writeFileSync3 } from "node:fs";
@@ -7671,7 +7737,7 @@ import { basename, dirname as dirname2, isAbsolute, join as join4, relative as r
 
 // src/pack.ts
 import { spawn, spawnSync } from "node:child_process";
-import { existsSync, lstatSync } from "node:fs";
+import { existsSync, lstatSync, readdirSync } from "node:fs";
 import { join as join2 } from "node:path";
 var UPLOAD_LIMIT = 32 * 6 * 1024 * 1024;
 var TooLargeError = class extends Error {
@@ -7681,6 +7747,11 @@ var TooLargeError = class extends Error {
     this.limit = limit;
   }
 };
+function isEnvFile(path) {
+  const name = path.split("/").pop() ?? "";
+  return /^\.env($|\.)/.test(name) && !/\.(example|sample|template|dist|defaults?|schema)$/.test(name);
+}
+var ENV_EXCLUDES = [".env", ".env.local", ".env.*.local", ".env.development", ".env.production", ".env.test", ".env.staging", ".envrc"].map((p) => `--exclude=${p}`);
 function git(cwd, args, input) {
   const r = spawnSync("git", args, { cwd, input, maxBuffer: 256 * 1024 * 1024 });
   return { status: r.status ?? (r.error ? 127 : 1), stdout: r.stdout?.toString("utf8") ?? "", stderr: r.stderr?.toString("utf8") ?? "", error: r.error };
@@ -7737,13 +7808,17 @@ function runTar(cwd, args, input, limit = UPLOAD_LIMIT) {
 }
 async function packProject(dir, limit = UPLOAD_LIMIT) {
   if (isGitRepo(dir)) {
-    const files = gitFiles(dir).filter((f) => !f.startsWith(".airgate/"));
+    const tracked = new Set(git(dir, ["ls-files", "-c", "-z"]).stdout.split("\0"));
+    const all = gitFiles(dir).filter((f) => !f.startsWith(".airgate/"));
+    const skipped2 = all.filter((f) => (isEnvFile(f) || f.split("/").pop() === ".envrc") && !tracked.has(f));
+    const files = all.filter((f) => !skipped2.includes(f));
     if (!files.length) throw new Error("no files to send (git sees nothing tracked or untracked here)");
     const archive2 = await runTar(dir, ["--null", "-T", "-", "-czf", "-"], files.join("\0") + "\0", limit);
-    return { archive: archive2, files: files.length, git: true };
+    return { archive: archive2, files: files.length, git: true, skipped: skipped2 };
   }
-  const archive = await runTar(dir, ["--exclude=node_modules", "--exclude=.git", "--exclude=.airgate", "-czf", "-", "."], null, limit);
-  return { archive, files: -1, git: false };
+  const skipped = readdirSync(dir).filter((f) => isEnvFile(f) || f === ".envrc");
+  const archive = await runTar(dir, ["--exclude=node_modules", "--exclude=.git", "--exclude=.airgate", ...ENV_EXCLUDES, "-czf", "-", "."], null, limit);
+  return { archive, files: -1, git: false, skipped };
 }
 var CLAUDE_CONFIG = ["settings.json", "CLAUDE.md", "skills", "agents", "commands"];
 async function packClaudeConfig(home, limit = UPLOAD_LIMIT) {
@@ -7765,7 +7840,7 @@ import { gunzipSync } from "node:zlib";
 
 // src/sessions.ts
 import { createHash, randomUUID } from "node:crypto";
-import { closeSync, existsSync as existsSync2, mkdirSync as mkdirSync2, mkdtempSync, openSync, readdirSync, readFileSync as readFileSync4, readSync, realpathSync, renameSync as renameSync2, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { closeSync, existsSync as existsSync2, mkdirSync as mkdirSync2, mkdtempSync, openSync, readdirSync as readdirSync2, readFileSync as readFileSync4, readSync, realpathSync, renameSync as renameSync2, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join as join3, relative } from "node:path";
 var POD_HOME = "/home/sprite";
@@ -7793,7 +7868,7 @@ function findClaudeSession(home, projectDir, id, env = {}) {
     const dir = join3(claudeHome(home, env), "projects", claudeKey(p));
     let names = [];
     try {
-      names = readdirSync(dir).filter((n2) => n2.endsWith(".jsonl"));
+      names = readdirSync2(dir).filter((n2) => n2.endsWith(".jsonl"));
     } catch {
       continue;
     }
@@ -7824,7 +7899,7 @@ function codexRollouts(root, limit = 3e3) {
   const walk = (d, depth) => {
     let list2 = [];
     try {
-      list2 = readdirSync(d, { withFileTypes: true });
+      list2 = readdirSync2(d, { withFileTypes: true });
     } catch {
       return;
     }
@@ -7879,7 +7954,7 @@ async function packSession(s2, projectDir, podPath, limit = UPLOAD_LIMIT) {
       names.push(`${s2.id}.jsonl`);
       if (s2.sidecar) {
         const copy2 = (src, dst) => {
-          for (const x of readdirSync(src, { withFileTypes: true })) {
+          for (const x of readdirSync2(src, { withFileTypes: true })) {
             const a = join3(src, x.name);
             const b2 = join3(dst, x.name);
             if (x.isDirectory()) {
@@ -8293,10 +8368,11 @@ var up = {
     const state = { gateway: ctx.cfg.gateway, podId: pod.id, podName: pod.spec.name, dir: podDir, at: Date.now(), ...sent.length ? { sessions: sent } : {} };
     writeState(projectDir, state);
     if (ctx.json) {
-      return ui2.json({ pod, dir: podDir, bytes: packed.archive.length, files: packed.files, config: config?.parts ?? [], baseSet: based, sessions: resumed, secrets: envSent });
+      return ui2.json({ pod, dir: podDir, bytes: packed.archive.length, files: packed.files, skipped: packed.skipped, config: config?.parts ?? [], baseSet: based, sessions: resumed, secrets: envSent });
     }
     ui2.out(`${ui2.c("ok", "up")}: ${name} \u2192 ${pod.spec.name}:~/${podDir} \xB7 ${packed.files >= 0 ? `${packed.files} files, ` : ""}${bytes(packed.archive.length)}`);
     if (config) ui2.out(`config: ~/.claude/{${config.parts.join(",")}}`);
+    if (packed.skipped.length) ui2.out(ui2.c("dim", `kept here: ${packed.skipped.join(", ")} (env files go to a pod only as secrets: --env${packed.skipped.includes(".env") ? "" : " <file>"})`));
     if (!based) ui2.err(ui2.ce("warn", "couldn't set the down base; the first down will include the files you sent"));
     if (envSent) {
       ui2.out(`secrets for ${pod.spec.name}: ${envSent.sent.length ? envSent.sent.join(", ") : "none"}${envSent.skipped.length ? ui2.c("dim", ` (skipped: ${envSent.skipped.join(", ")})`) : ""}`);
@@ -8655,7 +8731,7 @@ async function runCommand(ctx, cmd, argv, cwd) {
 }
 
 // src/commands/run.ts
-import { existsSync as existsSync5, readFileSync as readFileSync7, rmSync as rmSync3, statSync as statSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync8, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync5 } from "node:fs";
 import { basename as basename2, resolve as resolve5 } from "node:path";
 import { randomBytes } from "node:crypto";
 
@@ -8678,9 +8754,9 @@ function readSaved(env) {
     return {};
   }
 }
-function saveLocal(env, vendor, value) {
+function saveLocal(env, vendor, value, kind = value ? kindOf(vendor, value) : "api_key") {
   const all = readSaved(env);
-  if (value) all[vendor] = { kind: kindOf(vendor, value), value };
+  if (value) all[vendor] = { kind, value };
   else delete all[vendor];
   const dir = configDir(env);
   mkdirSync4(dir, { recursive: true, mode: 448 });
@@ -8721,6 +8797,14 @@ function sign(vendor, auth, headers) {
   }
 }
 var UPSTREAM = { anthropic: "https://api.anthropic.com", openai: "https://api.openai.com" };
+async function chatgptReady(io, auth, f) {
+  const t = JSON.parse(auth.value);
+  if (!chatgptNeedsRefresh(t)) return t;
+  const fresh = await refreshChatgpt(t, { fetch: f, tokenUrl: io.env.AIRGATE_RELAY_CHATGPT_TOKEN_URL || void 0 });
+  auth.value = JSON.stringify(fresh);
+  if (auth.from === "this laptop") saveLocal(io.env, "openai", auth.value, "chatgpt");
+  return fresh;
+}
 function startRelay(o) {
   const vendors = Object.keys(o.auth).filter((v) => o.auth[v]);
   const inflight = /* @__PURE__ */ new Map();
@@ -8736,11 +8820,15 @@ function startRelay(o) {
     const auth = o.auth[m.vendor];
     if (!auth) return send({ t: "error", id: m.id, message: `this laptop has no ${vendorLabel(m.vendor)} sign-in` });
     const headers = { ...m.headers };
-    sign(m.vendor, auth, headers);
     const ctl = new AbortController();
     inflight.set(m.id, ctl);
     try {
-      const res = await o.fetch(`${base(m.vendor)}${m.path}`, {
+      let url = `${base(m.vendor)}${m.path}`;
+      if (auth.kind === "chatgpt") {
+        signChatgpt(await chatgptReady(o.io, auth, o.fetch), headers);
+        url = chatgptUrl(m.path, o.io.env.AIRGATE_RELAY_CHATGPT_URL || CHATGPT_CODEX_BASE);
+      } else sign(m.vendor, auth, headers);
+      const res = await o.fetch(url, {
         method: m.method,
         headers,
         body: m.body ? Buffer.from(m.body, "base64") : void 0,
@@ -8809,9 +8897,13 @@ function startRelay(o) {
 }
 
 // src/commands/models.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { mkdtempSync as mkdtempSync2, readFileSync as readFileSync7, rmSync as rmSync3 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join6 } from "node:path";
 var HOW = {
   anthropic: "a Claude subscription token (run `claude setup-token` and paste what it prints) or an Anthropic API key",
-  openai: "an OpenAI API key"
+  openai: "an OpenAI API key (for a ChatGPT plan: airgate models connect chatgpt)"
 };
 function relayIfSignedIn(ctx, say) {
   const auth = localAuth(ctx.io.env);
@@ -8822,19 +8914,66 @@ function relayIfSignedIn(ctx, say) {
     return null;
   }
 }
+var KIND = { oauth_token: "subscription token", api_key: "API key", chatgpt: "ChatGPT plan" };
+async function connectChatgpt(ctx, laptop) {
+  const { ui: ui2 } = ctx;
+  let text2;
+  if (!ctx.io.stdin.isTTY) {
+    text2 = await readValue(ctx, "a Codex auth.json", "cat auth.json | airgate models connect chatgpt");
+  } else {
+    if (spawnSync2("codex", ["--version"], { stdio: "ignore" }).status !== 0) {
+      throw new CliError("Codex is not installed on this laptop", "npm i -g @openai/codex, then: airgate models connect chatgpt");
+    }
+    const home = mkdtempSync2(join6(tmpdir2(), "airgate-codex-"));
+    try {
+      ui2.err(ui2.ce("dim", "signing in to ChatGPT for airgate: a separate Codex login, so the one on this laptop stays as it is."));
+      const args = ["login", ...bool(ctx.args, "device") ? ["--device-auth"] : [], "-c", 'cli_auth_credentials_store="file"'];
+      const r2 = spawnSync2("codex", args, { stdio: "inherit", env: { ...process.env, ...ctx.io.env, CODEX_HOME: home } });
+      if (r2.status !== 0) throw new CliError("the ChatGPT sign-in did not finish", "try again, or with --device");
+      try {
+        text2 = readFileSync7(join6(home, "auth.json"), "utf8");
+      } catch {
+        throw new CliError("Codex didn't write a login file", "update Codex (npm i -g @openai/codex) and try again");
+      }
+    } finally {
+      rmSync3(home, { recursive: true, force: true });
+    }
+  }
+  let tokens2;
+  try {
+    tokens2 = parseChatgptLogin(text2);
+  } catch (e) {
+    throw new CliError(e.message);
+  }
+  const value = JSON.stringify(tokens2);
+  if (laptop) {
+    saveLocal(ctx.io.env, "openai", value, "chatgpt");
+    if (ctx.json) return ui2.json({ ok: true, vendor: "openai", kind: "chatgpt", where: "laptop" });
+    ui2.out(`${ui2.c("ok", "saved")} on this laptop only (ChatGPT plan). airgate doesn't get it.`);
+    return void ui2.out(ui2.c("dim", "pods' Codex uses it while this laptop is connected: airgate relay (airgate run and airgate mcp do this on their own)."));
+  }
+  const r = await ctx.api.connectModel("openai", value, "chatgpt");
+  if (ctx.json) return ui2.json({ ...r, where: "airgate" });
+  ui2.out(`${ui2.c("ok", "connected")}: ChatGPT plan for Codex, kept encrypted on airgate (renewed there) and never sent to a pod.`);
+  ui2.out(ui2.c("dim", "undo: airgate models disconnect chatgpt"));
+}
 var models = {
   name: "models",
   group: "account",
-  usage: "[connect|disconnect <claude|openai> [--laptop]]",
+  usage: "[connect|disconnect <claude|openai|chatgpt> [--laptop]]",
   summary: "how pods' agents sign in to their model: in the pod, through this laptop, or connected to airgate",
   example: "airgate models connect claude --laptop",
   notes: [
     "three ways, pick per your comfort: sign in inside the pod (nothing stored with airgate); this laptop signs (airgate relay: airgate holds nothing, works while the laptop is connected); or connect a sign-in to airgate (encrypted on the gateway, never sent to a pod).",
-    "connect <claude|openai>: saves it on airgate. with --laptop: saves it only on this laptop (~/.config/airgate/models.json), for airgate relay.",
+    "connect <claude|openai|chatgpt>: saves it on airgate. with --laptop: saves it only on this laptop (~/.config/airgate/models.json), for airgate relay.",
     "claude takes a subscription token (claude setup-token) or an API key; openai takes an API key. the value is read from a hidden prompt or stdin, never from the command line.",
+    "chatgpt (Codex on a ChatGPT plan) runs `codex login` into a fresh folder, so airgate gets its own Codex login and never the one on this laptop (sharing one would sign you out here). --device uses the device-code login. or pipe a Codex auth.json in.",
     "this laptop also uses CLAUDE_CODE_OAUTH_TOKEN, ANTHROPIC_API_KEY or OPENAI_API_KEY from its environment."
   ],
-  flags: { laptop: { type: "boolean", help: "keep the sign-in on this laptop only (for airgate relay)" } },
+  flags: {
+    laptop: { type: "boolean", help: "keep the sign-in on this laptop only (for airgate relay)" },
+    device: { type: "boolean", help: "chatgpt: sign in with a device code instead of this browser" }
+  },
   async run(ctx) {
     const { ui: ui2 } = ctx;
     const [action, who, extra] = ctx.args.positionals;
@@ -8853,6 +8992,7 @@ var models = {
         if (ctx.json) return ui2.json({ ...r2, vendor, where: "airgate" });
         return void ui2.out(r2.ok ? `${vendorLabel(vendor)}: disconnected from airgate. airgate no longer holds it.` : `${vendorLabel(vendor)} wasn't connected to airgate.`);
       }
+      if (who?.toLowerCase() === "chatgpt") return connectChatgpt(ctx, laptop);
       if (!ctx.json && ctx.io.stdin.isTTY) ui2.err(ui2.ce("dim", `paste ${HOW[vendor]}.`));
       const value = (await readValue(ctx, vendor === "anthropic" ? "your Claude sign-in" : "your OpenAI key", `printf %s "$KEY" | airgate models connect ${who}${laptop ? " --laptop" : ""}`)).trim();
       if (value.length < 20 || /\s/.test(value)) throw new CliError("that doesn't look like a key or token", HOW[vendor]);
@@ -8864,7 +9004,7 @@ var models = {
       }
       const r = await ctx.api.connectModel(vendor, value);
       if (ctx.json) return ui2.json({ ...r, where: "airgate" });
-      ui2.out(`${ui2.c("ok", "connected")}: ${vendorLabel(vendor)} (${r.kind === "oauth_token" ? "subscription token" : "API key"}), kept encrypted on airgate and never sent to a pod.`);
+      ui2.out(`${ui2.c("ok", "connected")}: ${vendorLabel(vendor)} (${KIND[r.kind] ?? r.kind}), kept encrypted on airgate and never sent to a pod.`);
       return void ui2.out(ui2.c("dim", `every pod's ${vendor === "anthropic" ? "Claude Code" : "Codex"} can use it now, unless signed in inside the pod. undo: airgate models disconnect ${who}`));
     }
     if (action) throw new UsageError(`unknown "${action}"`, "airgate models \xB7 airgate models connect claude [--laptop] \xB7 airgate models disconnect claude [--laptop]");
@@ -8876,8 +9016,8 @@ var models = {
       const l = local[v];
       return [
         vendorLabel(v),
-        c ? ui2.c("ok", `connected to airgate (${c.kind === "oauth_token" ? "subscription" : "API key"})`) : ui2.c("dim", "not on airgate"),
-        l ? `this laptop: ${l.from}${st.laptop.connected && st.laptop.vendors.includes(v) ? ui2.c("ok", " \xB7 relaying") : ""}` : ui2.c("dim", "not on this laptop")
+        c ? ui2.c("ok", `connected to airgate (${KIND[c.kind] ?? c.kind})`) : ui2.c("dim", "not on airgate"),
+        l ? `this laptop: ${l.kind === "chatgpt" ? "ChatGPT plan" : l.from}${st.laptop.connected && st.laptop.vendors.includes(v) ? ui2.c("ok", " \xB7 relaying") : ""}` : ui2.c("dim", "not on this laptop")
       ];
     });
     ui2.table(rows2, { head: ["model", "airgate", "laptop"] });
@@ -8935,7 +9075,7 @@ async function signInWarning(ctx, agent, relaying) {
   const list2 = await ctx.api.secrets().catch(() => null);
   if (list2?.account.some((s2) => m.secrets.includes(s2.name))) return null;
   if (!st && !list2) return null;
-  const who = m.vendor === "anthropic" ? "claude" : "openai";
+  const who = m.vendor === "anthropic" ? "claude" : "chatgpt";
   return `${AGENTS[agent].label} has no sign-in for a fresh pod. pick one: airgate models connect ${who} --laptop (this laptop signs; airgate holds nothing), or airgate models connect ${who} (kept on airgate)`;
 }
 async function finish(ctx, pod, keep) {
@@ -9029,11 +9169,11 @@ var runTask = {
         throw new CliError(`${projectDir} isn't a git repo, so the result can't come back as a patch`, "git init && git add -A && git commit -m base, or use --no-apply");
       }
       const sp = statePath(projectDir);
-      const before = existsSync5(sp) ? readFileSync7(sp, "utf8") : null;
+      const before = existsSync5(sp) ? readFileSync8(sp, "utf8") : null;
       const restoreState = () => {
         try {
           if (before !== null) writeFileSync5(sp, before);
-          else rmSync3(sp, { force: true });
+          else rmSync4(sp, { force: true });
         } catch {
         }
       };
@@ -9493,7 +9633,7 @@ var mcp = {
 // src/commands/misc.ts
 import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync6 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 var PAGES = ["pods", "airlock", "usage", "settings", "mask", "chat", "notes", "data", "status"];
 var open = {
   name: "open",
@@ -9569,12 +9709,12 @@ var skill = {
     if (!text2.startsWith("---")) throw new CliError(`${url} isn't a skill file`);
     if (action === "show") return void ctx.io.stdout.write(text2);
     if (action !== "install") throw new UsageError(`unknown action "${action}"`, "airgate skill install [--project] | airgate skill show");
-    const base = bool(ctx.args, "project") ? join6(ctx.io.cwd, ".claude") : join6(ctx.io.env.HOME ?? homedir3(), ".claude");
-    const dir = join6(base, "skills", "airgate");
+    const base = bool(ctx.args, "project") ? join7(ctx.io.cwd, ".claude") : join7(ctx.io.env.HOME ?? homedir3(), ".claude");
+    const dir = join7(base, "skills", "airgate");
     mkdirSync5(dir, { recursive: true });
-    writeFileSync6(join6(dir, "SKILL.md"), text2);
-    if (ctx.json) return ctx.ui.json({ installed: join6(dir, "SKILL.md") });
-    ctx.ui.out(`${ctx.ui.c("ok", "installed")} the airgate skill: ${join6(dir, "SKILL.md")}`);
+    writeFileSync6(join7(dir, "SKILL.md"), text2);
+    if (ctx.json) return ctx.ui.json({ installed: join7(dir, "SKILL.md") });
+    ctx.ui.out(`${ctx.ui.c("ok", "installed")} the airgate skill: ${join7(dir, "SKILL.md")}`);
     ctx.ui.out(ctx.ui.c("dim", 'claude code picks it up in its next session. ask it to "move this to an airgate pod".'));
   }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "airgate",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Give your AI its own computer: the airgate command line.",
   "type": "module",
   "bin": {