hydramcp 1.0.1 → 1.0.4

package/dist/providers/subscription.d.ts

@@ -1,27 +1,30 @@
 /**
  * Subscription Provider — use your monthly subscriptions as an API.
  *
- * Wraps installed CLI tools (Gemini CLI, Claude Code, Codex CLI) that
- * authenticate via OAuth to your subscription accounts. No API keys needed.
+ * Reads OAuth tokens stored by CLI tools (Claude Code, Gemini CLI, Codex CLI)
+ * and makes direct HTTP requests to provider-internal APIs.
  *
- * HydraMCP spawns the CLIs in non-interactive mode, captures their output,
- * and normalizes it to the Provider interface. The CLIs handle all auth.
+ * Token locations:
+ *   Claude  → ~/.claude/.credentials.json
+ *   Gemini  → ~/.gemini/oauth_creds.json
+ *   Codex   → ~/.codex/auth.json
  *
- * 100% our code. No CLIProxyAPI dependency.
+ * Endpoints (from CLIProxyAPI & Gemini CLI source):
+ *   Gemini  → https://cloudcode-pa.googleapis.com/v1internal:generateContent
+ *   Codex   → https://chatgpt.com/backend-api/codex/responses (SSE)
+ *   Claude  → CLI subprocess (api.anthropic.com rejects OAuth without TLS fingerprint)
+ *
+ * Approach learned from CLIProxyAPI (github.com/router-for-me/CLIProxyAPI).
  */
 import { Provider, ModelInfo, QueryOptions, QueryResponse } from "./provider.js";
 export declare class SubscriptionProvider implements Provider {
     name: string;
     private backends;
-    /** Map model ID → backend that serves it */
     private modelToBackend;
-    /**
-     * Detect which CLI tools are installed on this machine.
-     * Must be called before using the provider.
-     */
+    private tokenCache;
     detect(): Promise<number>;
     healthCheck(): Promise<boolean>;
     listModels(): Promise<ModelInfo[]>;
     query(model: string, prompt: string, options?: QueryOptions): Promise<QueryResponse>;
-    private runBackend;
+    private runQuery;
 }

package/dist/providers/subscription.js

@@ -1,148 +1,538 @@
 /**
  * Subscription Provider — use your monthly subscriptions as an API.
  *
- * Wraps installed CLI tools (Gemini CLI, Claude Code, Codex CLI) that
- * authenticate via OAuth to your subscription accounts. No API keys needed.
+ * Reads OAuth tokens stored by CLI tools (Claude Code, Gemini CLI, Codex CLI)
+ * and makes direct HTTP requests to provider-internal APIs.
  *
- * HydraMCP spawns the CLIs in non-interactive mode, captures their output,
- * and normalizes it to the Provider interface. The CLIs handle all auth.
+ * Token locations:
+ *   Claude  → ~/.claude/.credentials.json
+ *   Gemini  → ~/.gemini/oauth_creds.json
+ *   Codex   → ~/.codex/auth.json
  *
- * 100% our code. No CLIProxyAPI dependency.
+ * Endpoints (from CLIProxyAPI & Gemini CLI source):
+ *   Gemini  → https://cloudcode-pa.googleapis.com/v1internal:generateContent
+ *   Codex   → https://chatgpt.com/backend-api/codex/responses (SSE)
+ *   Claude  → CLI subprocess (api.anthropic.com rejects OAuth without TLS fingerprint)
+ *
+ * Approach learned from CLIProxyAPI (github.com/router-for-me/CLIProxyAPI).
  */
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
 import { spawn } from "node:child_process";
 import { logger } from "../utils/logger.js";
-const GEMINI_CLI = {
-    id: "gemini-cli",
-    displayName: "Gemini CLI",
-    command: "gemini",
-    versionArgs: ["--version"],
-    buildArgs(model, prompt) {
-        return ["-p", prompt, "-m", model];
-    },
-    parseOutput(stdout) {
-        return stdout.trim();
-    },
-    models: [
-        { id: "gemini-2.5-flash", name: "Gemini 2.5 Flash" },
-        { id: "gemini-2.5-flash-lite", name: "Gemini 2.5 Flash Lite" },
-        { id: "gemini-2.5-pro", name: "Gemini 2.5 Pro" },
-        { id: "gemini-3-flash", name: "Gemini 3 Flash" },
-        { id: "gemini-3-pro", name: "Gemini 3 Pro" },
-    ],
-    timeout: 120_000,
-};
-const CLAUDE_CLI = {
-    id: "claude-cli",
-    displayName: "Claude Code",
-    command: "claude",
-    versionArgs: ["--version"],
-    buildArgs(model, prompt) {
-        return ["-p", prompt, "--output-format", "json", "--model", model];
-    },
-    parseOutput(stdout) {
-        // Claude Code --output-format json returns a JSON object
-        // with a "result" field containing the response text.
+// ---------------------------------------------------------------------------
+// Token file readers
+// ---------------------------------------------------------------------------
+function readClaudeTokens() {
+    try {
+        const raw = readFileSync(join(homedir(), ".claude", ".credentials.json"), "utf-8");
+        const data = JSON.parse(raw);
+        const oauth = data.claudeAiOauth;
+        if (!oauth?.accessToken || !oauth?.refreshToken)
+            return null;
+        return {
+            accessToken: oauth.accessToken,
+            refreshToken: oauth.refreshToken,
+            expiresAt: oauth.expiresAt ?? 0,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function readGeminiTokens() {
+    try {
+        const raw = readFileSync(join(homedir(), ".gemini", "oauth_creds.json"), "utf-8");
+        const data = JSON.parse(raw);
+        if (!data.access_token || !data.refresh_token)
+            return null;
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            expiresAt: data.expiry_date ?? 0,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function readCodexTokens() {
+    try {
+        const raw = readFileSync(join(homedir(), ".codex", "auth.json"), "utf-8");
+        const data = JSON.parse(raw);
+        const tokens = data.tokens;
+        if (!tokens?.access_token || !tokens?.refresh_token)
+            return null;
+        let expiresAt = 0;
         try {
-            const data = JSON.parse(stdout);
-            return data.result ?? data.content ?? stdout.trim();
+            const payload = JSON.parse(Buffer.from(tokens.access_token.split(".")[1], "base64").toString());
+            if (payload.exp)
+                expiresAt = payload.exp * 1000;
         }
-        catch {
-            // If JSON parsing fails, return raw text
-            return stdout.trim();
+        catch { /* non-JWT or malformed */ }
+        return {
+            accessToken: tokens.access_token,
+            refreshToken: tokens.refresh_token,
+            expiresAt,
+            accountId: tokens.account_id ?? undefined,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// Token refresh
+// ---------------------------------------------------------------------------
+async function refreshClaudeToken(refreshToken) {
+    try {
+        const res = await fetch("https://console.anthropic.com/v1/oauth/token", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                client_id: "9d1c250a-e61b-44d9-88ed-5944d1962f5e",
+                grant_type: "refresh_token",
+                refresh_token: refreshToken,
+            }),
+        });
+        if (!res.ok)
+            return null;
+        const data = (await res.json());
+        const accessToken = data.access_token;
+        const newRefresh = data.refresh_token;
+        const expiresIn = data.expires_in ?? 86400;
+        if (!accessToken)
+            return null;
+        try {
+            const credPath = join(homedir(), ".claude", ".credentials.json");
+            const existing = JSON.parse(readFileSync(credPath, "utf-8"));
+            existing.claudeAiOauth.accessToken = accessToken;
+            existing.claudeAiOauth.refreshToken = newRefresh || refreshToken;
+            existing.claudeAiOauth.expiresAt = Date.now() + expiresIn * 1000;
+            writeFileSync(credPath, JSON.stringify(existing), "utf-8");
         }
-    },
-    models: [
-        { id: "claude-opus-4-6", name: "Claude Opus 4.6" },
-        { id: "claude-sonnet-4-5-20250929", name: "Claude Sonnet 4.5" },
-        { id: "claude-haiku-4-5-20251001", name: "Claude Haiku 4.5" },
-    ],
-    timeout: 180_000,
-};
-const CODEX_CLI = {
-    id: "codex-cli",
-    displayName: "Codex CLI",
-    command: "codex",
-    versionArgs: ["--version"],
-    buildArgs(_model, prompt) {
-        // Codex exec streams progress to stderr, final message to stdout
-        return ["exec", prompt];
-    },
-    parseOutput(stdout) {
-        return stdout.trim();
-    },
-    models: [
-        { id: "gpt-5.3-codex", name: "GPT-5.3 Codex" },
-        { id: "gpt-5.2-codex", name: "GPT-5.2 Codex" },
-    ],
-    timeout: 180_000,
-};
-/** All supported CLI backends, tried in order. */
-const ALL_BACKENDS = [GEMINI_CLI, CLAUDE_CLI, CODEX_CLI];
-function execCLI(command, args, timeout) {
-    return new Promise((resolve, reject) => {
-        let child;
+        catch { /* non-fatal */ }
+        return {
+            accessToken,
+            refreshToken: newRefresh || refreshToken,
+            expiresAt: Date.now() + expiresIn * 1000,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+async function refreshGeminiToken(refreshToken) {
+    try {
+        const body = new URLSearchParams({
+            client_id: "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com",
+            client_secret: "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",
+            refresh_token: refreshToken,
+            grant_type: "refresh_token",
+        });
+        const res = await fetch("https://oauth2.googleapis.com/token", {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: body.toString(),
+        });
+        if (!res.ok)
+            return null;
+        const data = (await res.json());
+        const accessToken = data.access_token;
+        const expiresIn = data.expires_in ?? 3600;
+        if (!accessToken)
+            return null;
         try {
-            child = spawn(command, args, {
-                stdio: ["pipe", "pipe", "pipe"],
-                // On Windows, .cmd shims from npm need a shell to resolve.
-                // Arguments are passed as an array so Node quotes them safely.
-                shell: process.platform === "win32",
-            });
+            const credPath = join(homedir(), ".gemini", "oauth_creds.json");
+            const existing = JSON.parse(readFileSync(credPath, "utf-8"));
+            existing.access_token = accessToken;
+            existing.expiry_date = Date.now() + expiresIn * 1000;
+            if (data.id_token)
+                existing.id_token = data.id_token;
+            writeFileSync(credPath, JSON.stringify(existing, null, 2), "utf-8");
+        }
+        catch { /* non-fatal */ }
+        return {
+            accessToken,
+            refreshToken,
+            expiresAt: Date.now() + expiresIn * 1000,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+async function refreshCodexToken(refreshToken) {
+    try {
+        const body = new URLSearchParams({
+            client_id: "app_EMoamEEZ73f0CkXaXp7hrann",
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            scope: "openid profile email",
+        });
+        const res = await fetch("https://auth.openai.com/oauth/token", {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: body.toString(),
+        });
+        if (!res.ok)
+            return null;
+        const data = (await res.json());
+        const accessToken = data.access_token;
+        const newRefresh = data.refresh_token;
+        const expiresIn = data.expires_in ?? 864000;
+        if (!accessToken)
+            return null;
+        let accountId;
+        try {
+            const credPath = join(homedir(), ".codex", "auth.json");
+            const existing = JSON.parse(readFileSync(credPath, "utf-8"));
+            accountId = existing.tokens?.account_id;
+            existing.tokens.access_token = accessToken;
+            existing.tokens.refresh_token = newRefresh || refreshToken;
+            if (data.id_token)
+                existing.tokens.id_token = data.id_token;
+            existing.last_refresh = new Date().toISOString();
+            writeFileSync(credPath, JSON.stringify(existing, null, 2), "utf-8");
+        }
+        catch { /* non-fatal */ }
+        return {
+            accessToken,
+            refreshToken: newRefresh || refreshToken,
+            expiresAt: Date.now() + expiresIn * 1000,
+            accountId,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// Gemini project ID — resolved via Cloud Code Assist loadCodeAssist API
+// ---------------------------------------------------------------------------
+let cachedGeminiProjectId = null;
+async function getGeminiProjectId(token) {
+    if (cachedGeminiProjectId)
+        return cachedGeminiProjectId;
+    const res = await fetch("https://cloudcode-pa.googleapis.com/v1internal:loadCodeAssist", {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            "Authorization": `Bearer ${token}`,
+            "User-Agent": "google-api-nodejs-client/9.15.1",
+            "X-Goog-Api-Client": "gl-node/22.17.0",
+        },
+        body: JSON.stringify({
+            metadata: {
+                ideType: "IDE_UNSPECIFIED",
+                platform: "PLATFORM_UNSPECIFIED",
+                pluginType: "GEMINI",
+            },
+        }),
+    });
+    if (!res.ok) {
+        const err = await res.text();
+        throw new Error(`Gemini loadCodeAssist failed (${res.status}): ${err}`);
+    }
+    const data = (await res.json());
+    let projectId = null;
+    if (typeof data.cloudaicompanionProject === "string") {
+        projectId = data.cloudaicompanionProject;
+    }
+    else if (data.cloudaicompanionProject &&
+        typeof data.cloudaicompanionProject === "object" &&
+        typeof data.cloudaicompanionProject.id === "string") {
+        projectId = data.cloudaicompanionProject.id;
+    }
+    if (!projectId && Array.isArray(data.allowedTiers)) {
+        const defaultTier = data.allowedTiers.find((t) => t.isDefault === true);
+        if (typeof defaultTier?.id === "string") {
+            projectId = defaultTier.id;
         }
-        catch (err) {
-            reject(err);
-            return;
+    }
+    if (!projectId) {
+        throw new Error("Gemini: no project ID from loadCodeAssist. Run `gemini` CLI once to set up your account.");
+    }
+    cachedGeminiProjectId = projectId;
+    logger.info(`Gemini project ID resolved: ${projectId}`);
+    return projectId;
+}
+// ---------------------------------------------------------------------------
+// Query: Codex — chatgpt.com/backend-api/codex SSE streaming
+// ---------------------------------------------------------------------------
+async function queryCodex(tokens, model, prompt, options) {
+    const startTime = Date.now();
+    const input = [];
+    if (options?.system_prompt) {
+        input.push({ role: "developer", content: options.system_prompt });
+    }
+    input.push({ role: "user", content: prompt });
+    const body = {
+        model,
+        instructions: "",
+        input,
+        stream: true,
+        store: false,
+    };
+    if (options?.temperature !== undefined)
+        body.temperature = options.temperature;
+    if (options?.max_tokens !== undefined)
+        body.max_output_tokens = options.max_tokens;
+    const headers = {
+        "Content-Type": "application/json",
+        "Authorization": `Bearer ${tokens.accessToken}`,
+        "Accept": "text/event-stream",
+        "Version": "0.98.0",
+        "Openai-Beta": "responses=experimental",
+        "User-Agent": "codex_cli_rs/0.98.0",
+        "Originator": "codex_cli_rs",
+        "Connection": "Keep-Alive",
+    };
+    if (tokens.accountId) {
+        headers["Chatgpt-Account-Id"] = tokens.accountId;
+    }
+    const res = await fetch("https://chatgpt.com/backend-api/codex/responses", { method: "POST", headers, body: JSON.stringify(body) });
+    if (!res.ok) {
+        const err = await res.text();
+        throw new Error(`Codex subscription query failed (${res.status}): ${err}`);
+    }
+    // Parse SSE stream — look for response.completed event
+    const text = await res.text();
+    const lines = text.split("\n");
+    let content = "";
+    let usage;
+    let finishReason;
+    for (const line of lines) {
+        if (!line.startsWith("data: "))
+            continue;
+        try {
+            const event = JSON.parse(line.slice(6));
+            if (event.type === "response.output_text.done") {
+                content += event.text ?? "";
+            }
+            else if (event.type === "response.completed") {
+                const resp = event.response;
+                if (resp?.usage)
+                    usage = resp.usage;
+                finishReason = resp?.status;
+                // Also extract content from completed response if not yet captured
+                if (!content && resp?.output) {
+                    for (const item of resp.output) {
+                        if (item.type === "message" && item.content) {
+                            for (const block of item.content) {
+                                if (block.type === "output_text")
+                                    content += block.text ?? "";
+                            }
+                        }
+                    }
+                }
+            }
         }
+        catch { /* skip non-JSON lines */ }
+    }
+    return {
+        model,
+        content,
+        usage: usage
+            ? {
+                prompt_tokens: usage.input_tokens ?? 0,
+                completion_tokens: usage.output_tokens ?? 0,
+                total_tokens: usage.total_tokens ?? 0,
+            }
+            : undefined,
+        latency_ms: Date.now() - startTime,
+        finish_reason: finishReason,
+    };
+}
+// ---------------------------------------------------------------------------
+// Query: Gemini — Cloud Code Assist direct HTTP
+// ---------------------------------------------------------------------------
+async function queryGemini(tokens, model, prompt, options) {
+    const startTime = Date.now();
+    const projectId = await getGeminiProjectId(tokens.accessToken);
+    const request = {
+        contents: [{ role: "user", parts: [{ text: prompt }] }],
+    };
+    if (options?.system_prompt) {
+        request.systemInstruction = { parts: [{ text: options.system_prompt }] };
+    }
+    const genConfig = {};
+    if (options?.temperature !== undefined)
+        genConfig.temperature = options.temperature;
+    if (options?.max_tokens !== undefined)
+        genConfig.maxOutputTokens = options.max_tokens;
+    if (Object.keys(genConfig).length > 0)
+        request.generationConfig = genConfig;
+    const body = { model, project: projectId, request };
+    const res = await fetch("https://cloudcode-pa.googleapis.com/v1internal:generateContent", {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            "Accept": "application/json",
+            "Authorization": `Bearer ${tokens.accessToken}`,
+            "User-Agent": "google-api-nodejs-client/9.15.1",
+            "X-Goog-Api-Client": "gl-node/22.17.0",
+            "Client-Metadata": "ideType=IDE_UNSPECIFIED,platform=PLATFORM_UNSPECIFIED,pluginType=GEMINI",
+        },
+        body: JSON.stringify(body),
+    });
+    if (!res.ok) {
+        const err = await res.text();
+        throw new Error(`Gemini subscription query failed (${res.status}): ${err}`);
+    }
+    // Cloud Code Assist wraps the standard Gemini response in a "response" field
+    const data = (await res.json());
+    const inner = (data.response ?? data);
+    const candidates = inner.candidates;
+    const parts = candidates?.[0]?.content?.parts;
+    const content = parts?.map((p) => p.text ?? "").join("") ?? "";
+    const meta = inner.usageMetadata;
+    return {
+        model,
+        content,
+        usage: meta
+            ? {
+                prompt_tokens: meta.promptTokenCount ?? 0,
+                completion_tokens: meta.candidatesTokenCount ?? 0,
+                total_tokens: meta.totalTokenCount ?? 0,
+            }
+            : undefined,
+        latency_ms: Date.now() - startTime,
+        finish_reason: candidates?.[0]?.finishReason ?? undefined,
+    };
+}
+// ---------------------------------------------------------------------------
+// Query: Claude — CLI subprocess (api.anthropic.com requires TLS fingerprint
+// bypass for OAuth tokens, which needs Go's utls library. Node.js can't do it
+// natively, so we use the Claude CLI as a subprocess.)
+// ---------------------------------------------------------------------------
+function execCLI(command, args, stdinData, timeoutMs = 120_000) {
+    return new Promise((resolve) => {
+        const isWin = process.platform === "win32";
+        const proc = spawn(command, args, {
+            shell: isWin,
+            env: { ...process.env },
+            stdio: ["pipe", "pipe", "pipe"],
+        });
         let stdout = "";
         let stderr = "";
-        child.stdout?.on("data", (d) => {
-            stdout += d.toString();
-        });
-        child.stderr?.on("data", (d) => {
-            stderr += d.toString();
-        });
         const timer = setTimeout(() => {
-            child.kill("SIGTERM");
-            reject(new Error(`${command} timed out after ${timeout}ms`));
-        }, timeout);
-        child.on("error", (err) => {
+            proc.kill();
+            resolve({ stdout, stderr: stderr + "\n[TIMEOUT]", code: 124 });
+        }, timeoutMs);
+        proc.stdout.on("data", (d) => { stdout += d.toString(); });
+        proc.stderr.on("data", (d) => { stderr += d.toString(); });
+        proc.on("close", (code) => {
             clearTimeout(timer);
-            reject(err);
+            resolve({ stdout, stderr, code: code ?? 1 });
         });
-        child.on("close", (code) => {
+        proc.on("error", (err) => {
             clearTimeout(timer);
-            resolve({ stdout, stderr, exitCode: code ?? 1 });
+            resolve({ stdout, stderr: err.message, code: 1 });
         });
-        // Close stdin — we pass the prompt via args, not stdin
-        child.stdin?.end();
+        if (stdinData && proc.stdin) {
+            proc.stdin.write(stdinData);
+            proc.stdin.end();
+        }
     });
 }
+async function queryClaude(_tokens, model, prompt, options) {
+    const startTime = Date.now();
+    const args = [
+        "--output-format", "json",
+        "-p", "-", // Read prompt from stdin
+        "--model", model,
+    ];
+    if (options?.max_tokens)
+        args.push("--max-tokens", String(options.max_tokens));
+    const result = await execCLI("claude", args, prompt, 120_000);
+    if (result.code !== 0) {
+        throw new Error(`Claude CLI failed (code ${result.code}): ${result.stderr.substring(0, 200)}`);
+    }
+    // Parse JSON output from claude --output-format json
+    let content = "";
+    try {
+        const data = JSON.parse(result.stdout);
+        if (typeof data.result === "string") {
+            content = data.result;
+        }
+        else if (typeof data.content === "string") {
+            content = data.content;
+        }
+        else if (Array.isArray(data.content)) {
+            content = data.content
+                .filter((b) => b.type === "text")
+                .map((b) => b.text ?? "")
+                .join("");
+        }
+        else {
+            content = result.stdout;
+        }
+    }
+    catch {
+        content = result.stdout;
+    }
+    return {
+        model,
+        content,
+        latency_ms: Date.now() - startTime,
+    };
+}
+const CLAUDE_BACKEND = {
+    id: "claude-sub",
+    displayName: "Claude (subscription)",
+    readTokens: readClaudeTokens,
+    refreshTokens: refreshClaudeToken,
+    query: queryClaude,
+    models: [
+        { id: "claude-sonnet-4-5-20250929", name: "Claude Sonnet 4.5" },
+        { id: "claude-haiku-4-5-20251001", name: "Claude Haiku 4.5" },
+    ],
+};
+const GEMINI_BACKEND = {
+    id: "gemini-sub",
+    displayName: "Gemini (subscription)",
+    readTokens: readGeminiTokens,
+    refreshTokens: refreshGeminiToken,
+    query: queryGemini,
+    models: [
+        { id: "gemini-2.5-flash", name: "Gemini 2.5 Flash" },
+        { id: "gemini-2.5-pro", name: "Gemini 2.5 Pro" },
+        { id: "gemini-2.0-flash", name: "Gemini 2.0 Flash" },
+    ],
+};
+const CODEX_BACKEND = {
+    id: "codex-sub",
+    displayName: "Codex (subscription)",
+    readTokens: readCodexTokens,
+    refreshTokens: refreshCodexToken,
+    query: queryCodex,
+    models: [
+        { id: "gpt-5.3-codex", name: "GPT-5.3 Codex" },
+        { id: "gpt-5.2-codex", name: "GPT-5.2 Codex" },
+        { id: "gpt-5.1-codex-mini", name: "GPT-5.1 Codex Mini" },
+    ],
+};
+const ALL_BACKENDS = [CLAUDE_BACKEND, GEMINI_BACKEND, CODEX_BACKEND];
 // ---------------------------------------------------------------------------
 // SubscriptionProvider
 // ---------------------------------------------------------------------------
 export class SubscriptionProvider {
     name = "Subscription";
     backends = [];
-    /** Map model ID → backend that serves it */
     modelToBackend = new Map();
-    /**
-     * Detect which CLI tools are installed on this machine.
-     * Must be called before using the provider.
-     */
+    tokenCache = new Map();
     async detect() {
         for (const backend of ALL_BACKENDS) {
-            try {
-                const result = await execCLI(backend.command, backend.versionArgs, 10_000);
-                if (result.exitCode === 0) {
-                    this.backends.push(backend);
-                    for (const model of backend.models) {
-                        this.modelToBackend.set(model.id, backend);
-                    }
-                    logger.info(`Subscription: ${backend.displayName} detected ✓`);
+            const tokens = backend.readTokens();
+            if (tokens) {
+                this.backends.push(backend);
+                this.tokenCache.set(backend.id, tokens);
+                for (const model of backend.models) {
+                    this.modelToBackend.set(model.id, backend);
                 }
-            }
-            catch {
-                // CLI not installed — skip silently
+                logger.info(`Subscription: ${backend.displayName} detected (token on disk)`);
             }
         }
         return this.backends.length;
@@ -160,34 +550,36 @@ export class SubscriptionProvider {
     async query(model, prompt, options) {
         const backend = this.modelToBackend.get(model);
         if (!backend) {
-            // Try to find a backend by partial match
             const match = this.backends.find((b) => b.models.some((m) => model.includes(m.id) || m.id.includes(model)));
             if (!match) {
-                throw new Error(`No subscription CLI handles model "${model}". ` +
+                throw new Error(`No subscription handles model "${model}". ` +
                     `Available: ${[...this.modelToBackend.keys()].join(", ")}`);
             }
-            return this.runBackend(match, model, prompt, options);
+            return this.runQuery(match, model, prompt, options);
         }
-        return this.runBackend(backend, model, prompt, options);
-    }
-    async runBackend(backend, model, prompt, options) {
-        const startTime = Date.now();
-        const args = backend.buildArgs(model, prompt, options);
-        logger.info(`Subscription: querying ${backend.displayName} (${model})`);
-        const result = await execCLI(backend.command, args, backend.timeout);
-        if (result.exitCode !== 0) {
-            throw new Error(`${backend.displayName} exited with code ${result.exitCode}: ${result.stderr.slice(0, 500)}`);
+        return this.runQuery(backend, model, prompt, options);
+    }
+    async runQuery(backend, model, prompt, options) {
+        let tokens = this.tokenCache.get(backend.id);
+        if (!tokens) {
+            const fresh = backend.readTokens();
+            if (!fresh)
+                throw new Error(`${backend.displayName}: no tokens found`);
+            tokens = fresh;
+            this.tokenCache.set(backend.id, tokens);
         }
-        const content = backend.parseOutput(result.stdout);
-        const latency_ms = Date.now() - startTime;
-        if (!content) {
-            throw new Error(`${backend.displayName} returned empty response. stderr: ${result.stderr.slice(0, 500)}`);
+        // Refresh if expired (with 60s buffer)
+        if (tokens.expiresAt > 0 && tokens.expiresAt < Date.now() + 60_000) {
+            logger.info(`Subscription: refreshing ${backend.displayName} token`);
+            const refreshed = await backend.refreshTokens(tokens.refreshToken);
+            if (refreshed) {
+                tokens = refreshed;
+                this.tokenCache.set(backend.id, tokens);
+            }
+            else {
+                logger.warn(`Subscription: ${backend.displayName} token refresh failed, trying existing token`);
+            }
         }
-        return {
-            model,
-            content,
-            latency_ms,
-            finish_reason: "stop",
-        };
+        return backend.query(tokens, model, prompt, options);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hydramcp",
-  "version": "1.0.1",
+  "version": "1.0.4",
   "description": "Multi-model MCP server — compare, vote, and synthesize across GPT, Gemini, Claude, and local models from one terminal",
   "type": "module",
   "main": "dist/index.js",