melchizedek-agents 1.3.0 → 1.3.1

package/CHANGELOG.md

@@ -6,6 +6,39 @@ the starter pack and the templates), not the repo's full history.
 
 ## Unreleased
 
+## 1.3.1 — 2026-10-11
+
+A patch for Sign in with ChatGPT, from its first live run on a ChatGPT plan:
+turns on the sign-in now answer, a first sign-in keeps one host id, and a
+plan without plan usage for apps is named as the reason a sign-in is
+refused. Bin paths are written as npm stores them.
+
+### Fixed
+
+- **Sign in with ChatGPT answers again: a stream whose `response.completed`
+  carries an empty `output` builds its final from `response.output_item.done`.**
+  The plan-usage route (`store: false`) sends every finished item only as
+  `output_item.done` and closes with an empty `output`, so on 1.3.0 a turn on
+  the sign-in completed with no text and no tool calls. The Responses stream
+  now keeps each finished item by `output_index` and uses them when the
+  completed reply has none; a populated `output` (every keyed call) still
+  wins. Found in the first live run on a ChatGPT plan (`gpt-5.5`,
+  `gpt-6.1-sol`).
+- **Bin paths are written as npm stores them** (`dist/scripts/<bin>.js`, no
+  leading `./`). Same bin names and targets; npm 11 no longer warns at publish
+  that each bin "was invalid and removed".
+- **Sign in with ChatGPT keeps one host id from the first attempt.** The
+  installation's `ext_agent_host_id` is written to the credential file (mode
+  600) before the browser opens, as OpenAI's docs ask, so a first sign-in that
+  times out or is cancelled no longer sends a new host id on the retry. A
+  stored registration is never overwritten.
+- **A refused ChatGPT sign-in says why.** `invalid_grant` on the
+  authorization-code exchange, and `access_denied` (or another refusal) at
+  the consent page, now print one line: the sign-in was refused, the most
+  common cause is a ChatGPT plan or workspace that does not include plan
+  usage for apps, and how to retry. The error codes are unchanged; a
+  refresh's `invalid_grant` still means sign in again.
+
 ## 1.3.0 — 2026-10-10
 
 Release 1.3.0 connects syndicates to the MCP ecosystem in both directions

package/dist/lib/chatgpt/oauth.d.ts

@@ -75,9 +75,10 @@ export interface SignInResult {
     planUsage: boolean;
 }
 /**
- * The browser sign-in. Stores the registration (host id, issued client id)
- * before the code exchange, and the tokens after the ID token verifies and
- * the plan scope is confirmed.
+ * The browser sign-in. Stores the host id before the browser opens when no
+ * file exists yet, the registration (host id, issued client id) before the
+ * code exchange, and the tokens after the ID token verifies and the plan
+ * scope is confirmed.
  */
 export declare function signIn(opts: SignInOptions): Promise<SignInResult>;
 export interface AccessTokenOptions extends OAuthOptions {

package/dist/lib/chatgpt/oauth.js

@@ -50,6 +50,14 @@ const UNUSABLE_REFRESH = new Set([
     'refresh_token_invalidated',
     'refresh_token_reused',
 ]);
+/**
+ * Callback error codes that mean the consent page refused or the person
+ * stopped there: OpenAI's page for a plan or workspace without plan usage for
+ * apps offers no way on, so leaving it is the usual way these arrive.
+ */
+const REFUSED_AT_CONSENT = new Set(['access_denied', 'unauthorized_client', 'consent_required', 'interaction_required']);
+/** One line for a sign-in OpenAI refused at the consent page or the code exchange. */
+const signInRefused = (code) => `ChatGPT refused the sign-in (${code}); the most common cause is a ChatGPT plan or workspace that does not include plan usage for apps. Retry with \`npm run setup -- --chatgpt-signin\` (\`npx melchizedek-setup --chatgpt-signin\` from an installed package).`;
 /** A sign-in failure: a code for the program, a message for the person, never a token. */
 export class SignInError extends Error {
     code;
@@ -236,7 +244,7 @@ async function listen(port, state, savedClientId, timeoutMs, signal) {
             res.writeHead(200, PAGE_HEADERS).end(page('Sign-in cancelled', 'You can close this tab and return to the terminal.'));
             const raw = url.searchParams.get('error') ?? '';
             const code = /^[a-z0-9_.-]{1,64}$/i.test(raw) ? raw : 'authorization_failed';
-            settle(new SignInError(code, `ChatGPT did not authorize the sign-in (${code}).`));
+            settle(new SignInError(code, REFUSED_AT_CONSENT.has(code) ? signInRefused(code) : `ChatGPT did not authorize the sign-in (${code}).`));
             return;
         }
         const codes = url.searchParams.getAll('code');
@@ -284,9 +292,10 @@ export async function openInBrowser(url) {
     });
 }
 /**
- * The browser sign-in. Stores the registration (host id, issued client id)
- * before the code exchange, and the tokens after the ID token verifies and
- * the plan scope is confirmed.
+ * The browser sign-in. Stores the host id before the browser opens when no
+ * file exists yet, the registration (host id, issued client id) before the
+ * code exchange, and the tokens after the ID token verifies and the plan
+ * scope is confirmed.
  */
 export async function signIn(opts) {
     const issuer = issuerOf(opts);
@@ -295,6 +304,11 @@ export async function signIn(opts) {
     const sameIssuer = previous?.issuer === issuer;
     const hostId = previous?.hostId ?? `urn:uuid:${randomUUID()}`;
     const savedClientId = sameIssuer ? previous?.clientId : undefined;
+    // OpenAI asks for the host id to be chosen and persisted before the first
+    // sign-in, so a timed-out or cancelled attempt does not send a new one next
+    // time. Only written when nothing is stored: a stored registration is kept.
+    if (!previous)
+        writeStoredSignIn(opts.file, { version: 1, issuer, hostId });
     const state = randomValue();
     const nonce = randomValue();
     const verifier = randomValue();
@@ -326,14 +340,24 @@ export async function signIn(opts) {
             ? { ...previous, clientId: cb.clientId, hostId }
             : { version: 1, issuer, hostId, clientId: cb.clientId };
         writeStoredSignIn(opts.file, registration);
-        const data = await tokenRequest(d.token_endpoint, {
-            grant_type: 'authorization_code',
-            client_id: cb.clientId,
-            code: cb.code,
-            code_verifier: verifier,
-            redirect_uri: listener.redirectUri,
-            resource: OPENAI_API_RESOURCE,
-        });
+        let data;
+        try {
+            data = await tokenRequest(d.token_endpoint, {
+                grant_type: 'authorization_code',
+                client_id: cb.clientId,
+                code: cb.code,
+                code_verifier: verifier,
+                redirect_uri: listener.redirectUri,
+                resource: OPENAI_API_RESOURCE,
+            });
+        }
+        catch (err) {
+            // OpenAI's consent page refuses a plan or workspace without plan usage
+            // for apps, and the exchange then answers invalid_grant.
+            if (err instanceof SignInError && err.code === 'invalid_grant')
+                throw new SignInError('invalid_grant', signInRefused('invalid_grant'));
+            throw err;
+        }
         const subject = await verifyIdToken(data.id_token, d, cb.clientId, nonce);
         const fields = tokenFields(data);
         const planUsage = fields.scopes.includes(PLAN_SCOPE);

package/dist/lib/models/gptAdapter.js

@@ -755,6 +755,10 @@ export class GptAdapter {
         let completed;
         let streamedThoughts = false;
         const text = [];
+        // Each finished output item, by its index. The plan-usage route (Sign in
+        // with ChatGPT, store: false) sends response.completed with an empty
+        // output: the items arrive only here, so the final is built from them.
+        const doneItems = [];
         for await (const ev of untilAborted(events, signal)) {
             const delta = streamEventDelta(ev);
             if (delta) {
@@ -765,7 +769,10 @@ export class GptAdapter {
                 yield { partial: true, parts: [delta.thought ? { type: 'thinking', text: delta.text } : { type: 'text', text: delta.text }] };
                 continue;
             }
-            if (ev?.type === 'response.completed' && ev.response) {
+            if (ev?.type === 'response.output_item.done' && ev.item && typeof ev.item === 'object') {
+                doneItems.push({ index: typeof ev.output_index === 'number' ? ev.output_index : doneItems.length, item: ev.item });
+            }
+            else if (ev?.type === 'response.completed' && ev.response) {
                 completed = ev.response;
             }
             else if (ev?.type === 'response.failed' || ev?.type === 'error') {
@@ -775,6 +782,9 @@ export class GptAdapter {
             }
         }
         if (completed) {
+            if ((!Array.isArray(completed.output) || completed.output.length === 0) && doneItems.length > 0) {
+                completed = { ...completed, output: doneItems.sort((x, y) => x.index - y.index).map((d) => d.item) };
+            }
             const { thinking, final } = this.finalOf(completed, model, { skipThoughts: streamedThoughts });
             if (thinking)
                 yield thinking;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "melchizedek-agents",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "A multi-model, multi-agent orchestration framework — YAML-defined syndicates on the engine's own agent loop, Supabase or Postgres session persistence, pgvector long-term memory. Companion repo to the lyceumagents.com curriculum.",
   "type": "module",
   "license": "MIT",
@@ -48,17 +48,17 @@
     "./package.json": "./package.json"
   },
   "bin": {
-    "melchizedek-serve": "./dist/scripts/a2a_server.js",
-    "melchizedek-mcp": "./dist/scripts/mcp_server.js",
-    "melchizedek-chat": "./dist/scripts/syndicate_chat.js",
-    "melchizedek-doctor": "./dist/scripts/doctor.js",
-    "melchizedek-skills": "./dist/scripts/skills_install.js",
-    "melchizedek-worker": "./dist/scripts/assistant_worker.js",
-    "melchizedek-db": "./dist/scripts/db.js",
-    "melchizedek-init": "./dist/scripts/init.js",
-    "melchizedek-setup": "./dist/scripts/setup.js",
-    "melchizedek-registry": "./dist/scripts/registry.js",
-    "melchizedek-codemod": "./dist/scripts/yaml_codemod.js"
+    "melchizedek-serve": "dist/scripts/a2a_server.js",
+    "melchizedek-mcp": "dist/scripts/mcp_server.js",
+    "melchizedek-chat": "dist/scripts/syndicate_chat.js",
+    "melchizedek-doctor": "dist/scripts/doctor.js",
+    "melchizedek-skills": "dist/scripts/skills_install.js",
+    "melchizedek-worker": "dist/scripts/assistant_worker.js",
+    "melchizedek-db": "dist/scripts/db.js",
+    "melchizedek-init": "dist/scripts/init.js",
+    "melchizedek-setup": "dist/scripts/setup.js",
+    "melchizedek-registry": "dist/scripts/registry.js",
+    "melchizedek-codemod": "dist/scripts/yaml_codemod.js"
   },
   "files": [
     "dist",