mohdel 3.4.0 → 3.6.0

package/README.md

@@ -1,6 +1,6 @@
 # Mohdel
 
-Self-hosted LLM gateway and SDK for Node — think LiteLLM, for the JS world. One `answer()` call for 14 providers or local inference; swap models by changing one string; get real per-call USD cost back on every result, with OpenTelemetry built in and process isolation when you need it. Your keys, your infra, no SaaS proxy in the path.
+Self-hosted LLM gateway and SDK for Node — think LiteLLM, for the JS world. One `answer()` call for 15 providers or local inference; swap models by changing one string; get real per-call USD cost back on every result, with OpenTelemetry built in and process isolation when you need it. Your keys, your infra, no SaaS proxy in the path.
 
 ```bash
 npm install -g mohdel
@@ -20,7 +20,35 @@ curate novita` writes complete, priced entries on its own, and setup counts the
 models that cost nothing and offers to add all of them in one keystroke. A
 working catalog without a pricing page or a brief.
 
-Providers: Anthropic, OpenAI, Gemini, Mistral, Groq, xAI, Cerebras, Fireworks, DeepSeek, Qwen Cloud, Xiaomi, Meta Model API, OpenRouter, Novita. Node 22+, ES modules.
+Providers: Anthropic, OpenAI, ChatGPT, Gemini, Mistral, Groq, xAI, Cerebras, Fireworks, DeepSeek, Qwen Cloud, Xiaomi, Meta Model API, OpenRouter, Novita. Node 22+, ES modules.
+
+### Using a ChatGPT subscription
+
+```bash
+mo chatgpt login              # open the printed URL in your browser
+mo chatgpt models             # account-specific models, discovered from OpenAI
+mo model curate chatgpt       # choose models to add to the local catalog
+mo ask chatgpt/<model-slug> "Hello"
+```
+
+`chatgpt/` uses OAuth and an eligible ChatGPT plan. It always streams through
+the public Responses API with `store: false`. `openai/` continues using API
+billing. Token counts are reported for both; ChatGPT's `cost: 0` means no
+per-call API charge is calculated, not unlimited or free plan usage. Manage
+allowance and credits with `mo chatgpt usage`.
+
+Use `mo chatgpt list`, `select <account-id>`, `login --new`, and
+`logout [account-id]` to manage accounts. Credentials live in Mohdel's user
+data directory (`~/.local/share/mohdel/chatgpt/` on Linux), with owner-only
+files and serialized token refresh. They are separate from the catalog.
+`mo chatgpt login <account-id>` reuses a saved registration after sign-out
+or a failed code exchange. If a crashed process leaves `accounts.lock`,
+confirm its recorded PID has exited before removing that lock.
+
+This OpenAI flow is intended for open-source and personal local tools;
+paid or remotely hosted offerings require OpenAI's private-app acceptance.
+See [OpenAI's guide](https://developers.openai.com/cookbook/articles/sign-in-with-chatgpt)
+and [library/gate integration](INTEGRATION.md#chatgpt-plan-access).
 
 Mohdel runs the inference layer of production stacks, among them [docAnalyzer](https://docanalyzer.ai), a document analysis and chat platform serving hundreds of thousands of users.
 
@@ -29,7 +57,7 @@ Mohdel runs the inference layer of production stacks, among them [docAnalyzer](h
 - **Real numbers on every call.** Token counts and per-call USD cost computed from your own pricing catalog (`curated.json`) — not estimates, not provider-specific shapes. Bill tenants, alert on spend, reconcile invoices. Your own catalog means your negotiated rates and your own tags, and it is not a spreadsheet you maintain: `mo model instructions` hands the provider's docs page to your coding agent, which drafts the entries for you to review. See [docs/CATALOG.md](docs/CATALOG.md).
 - **One interface across providers.** Same `answer()` call, same event stream, same `{ status, output, inputTokens, outputTokens, cost }` result. Switching from `anthropic/claude-sonnet-5-5` to `openai/gpt-5.4-mini` is one string change — adapter differences stay inside mohdel.
 - **Self-hosted, no vendor in the path.** API keys live in `~/.config/mohdel/`. Mohdel calls provider APIs directly; nothing routes through a third party, nothing marks up your tokens, no extra hop of availability risk.
-- **Nothing to compromise.** No network listener, no credential store, no tool execution. Mohdel runs a model call and returns the result; it cannot read a file, run a command, or hand back a key. See [Attack surface](#attack-surface).
+- **Inference without tool execution.** Mohdel returns model output and tool calls for your harness to handle. Optional ChatGPT sign-in uses a temporary loopback listener and a protected local credential store. See [Attack surface](#attack-surface).
 - **Observability without instrumentation.** OpenTelemetry spans, trace-linked logs, and OTLP metrics over one endpoint. Set `OTEL_EXPORTER_OTLP_ENDPOINT`; everything else is wired.
 - **Fully typed.** Declarations are generated from the source's own JSDoc and ship with the package — `CallEnvelope`, `Event`, `AnswerResult` and `MohdelError` are the frozen wire contract, typed as such. No `@types` package, no separate TypeScript build to keep in sync.
 - **Two integration paths, same API.** In-process factory for CLI tools, scripts, single-process services. Optional `thin-gate` subprocess for fault isolation, cross-process quota, and any-language HTTP callers — no code change to switch.
@@ -118,12 +146,15 @@ reading them. Mohdel is built so neither is present.
   prompt-injected response cannot make mohdel read a file, run a shell, or make
   a call of its own. Tool execution belongs to the caller, in the caller's
   process.
-- **No network listener.** `thin-gate` binds **unix sockets**, not TCP, for
+- **Gate listeners use unix sockets.** `thin-gate` binds **unix sockets**, not TCP, for
   both its data and admin planes, and chmods them `0600` — the default umask
-  would otherwise leave them world-connectable. There is no port to reach.
-- **No credential store.** The provider key rides on each call envelope and
-  goes straight to the SDK client. Mohdel never accumulates a pool of tenant
-  keys, because it never holds one.
+  would otherwise leave them world-connectable. ChatGPT sign-in separately
+  starts a temporary HTTP callback listener on `127.0.0.1` with PKCE and state validation.
+- **Session credentials come from the caller.** The provider credential rides
+  on each envelope and goes to the SDK. Optional ChatGPT sign-in saves OAuth
+  credentials in the caller's user-data directory. The standalone gate and its
+  sessions never read that store. Only an embedder that opts into `ChatGptAuth`
+  reads it, through mohdel's helper.
 - **The session subprocess starts from an empty environment.** It is given
   back only what the runtime reads — `PATH`, proxy and TLS settings, mohdel's
   own dials, `OTEL_*`. Every `*_API_SK`, cloud credential and database URL the
@@ -467,6 +498,7 @@ What each provider supports through mohdel's unified interface:
 |----------|-----------|-------|--------|-------|----------|-------|
 | Anthropic | Yes | Yes | Yes | No | Yes (adaptive / budget) | `identifier` → `metadata.user_id` |
 | OpenAI | Yes | Yes | Yes | No | Yes (o-series) | GPT-5 verbosity via `outputStyle` |
+| ChatGPT | Yes | Yes | Yes | No | Per model catalog | OAuth; uses an eligible ChatGPT plan; `mo chatgpt --help` |
 | Gemini | Yes | Yes | Yes | Yes | Yes (`thinkingLevel` / `thinkingBudget`) | Auto-uploads large videos; content-hashed cache |
 | Cerebras | Yes | Yes | Yes | No | Yes (`reasoning_effort` or zai `disable_reasoning`) | Shared chat-completions path |
 | Groq | Yes | Yes | Yes | No | No | Shared chat-completions path |

package/js/chatgpt/bin.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+/**
+ * Access-token helper for a supervisor that cannot run the OAuth refresh
+ * itself (thin-gate's `ChatGptAuth`). Invoked as
+ * `node <path-to-this-file> access [--account <id>]`.
+ *
+ * stdout: `{"accessToken": "…", "refreshAt": <epoch ms>}`, exit 0.
+ * stderr: the error message, exit 1. The token never reaches stderr.
+ *
+ * @module chatgpt/bin
+ */
+
+import { createChatGPT } from './index.js'
+
+const USAGE = 'usage: node bin.js access [--account <id>]'
+
+async function main (args) {
+  const [verb, flag, id, ...rest] = args
+  if (verb !== 'access' || rest.length || (flag !== undefined && (flag !== '--account' || !id))) {
+    throw new Error(USAGE)
+  }
+  const { accessToken, refreshAt } = await createChatGPT().access(id)
+  process.stdout.write(JSON.stringify({ accessToken, refreshAt }))
+}
+
+main(process.argv.slice(2)).catch(err => {
+  process.stderr.write(err.message)
+  process.exitCode = 1
+})

package/js/chatgpt/index.js

@@ -0,0 +1,230 @@
+import { randomBytes, createHash } from 'node:crypto'
+import { createServer } from 'node:http'
+import { createRemoteJWKSet, jwtVerify } from 'jose'
+import { defaultDirectory, readStore, withStore } from './store.js'
+import { discoverModels, visibleModels } from './models.js'
+
+const ISSUER = 'https://auth.openai.com'
+const RESOURCE = 'https://api.openai.com/v1'
+const TOKEN = `${ISSUER}/api/accounts/oauth/token`
+const PERMISSION = 'chatgpt.tokens.use.direct'
+const SCOPE = `openid profile email offline_access resource.invoke ${PERMISSION}`
+const jwks = createRemoteJWKSet(new URL(`${ISSUER}/.well-known/jwks.json`))
+const random = () => randomBytes(32).toString('base64url')
+const REFRESH_MARGIN = 30000
+export const usageURL = 'https://chatgpt.com/settings/usage'
+
+async function jsonRequest (fetcher, url, options = {}) {
+  let response
+  try {
+    response = await fetcher(url, { ...options, redirect: 'error', signal: AbortSignal.timeout(30000) })
+  } catch {
+    throw new Error('ChatGPT connection failed. Try again.')
+  }
+  if (!response.ok) {
+    const err = new Error(`ChatGPT request failed (${response.status}).${response.status === 401 || response.status === 400 ? ' Run mo chatgpt login to reconnect.' : ''}`)
+    Object.assign(err, { status: response.status })
+    throw err
+  }
+  return response.json()
+}
+
+async function verifyIdentity (token, clientId, nonce) {
+  const { payload } = await jwtVerify(token, jwks, {
+    issuer: ISSUER,
+    audience: clientId,
+    requiredClaims: ['sub', 'exp', 'iat'],
+    clockTolerance: 5
+  })
+  if (payload.nonce !== nonce || typeof payload.sub !== 'string' || !payload.sub) {
+    throw new Error('ChatGPT identity validation failed')
+  }
+  return payload
+}
+
+function credentials (tokens, previous = {}) {
+  if (typeof tokens.access_token !== 'string' || !tokens.access_token ||
+      typeof tokens.refresh_token !== 'string' || !tokens.refresh_token ||
+      !Number.isFinite(tokens.expires_in) || tokens.expires_in <= 0 ||
+      tokens.token_type?.toLowerCase() !== 'bearer') {
+    throw new Error('ChatGPT returned incomplete credentials; reconnect with mo chatgpt login')
+  }
+  return {
+    ...previous,
+    access_token: tokens.access_token,
+    refresh_token: tokens.refresh_token,
+    id_token: tokens.id_token ?? previous.id_token,
+    scopes: typeof tokens.scope === 'string' ? tokens.scope.split(/\s+/) : previous.scopes ?? [],
+    expires_at: Date.now() + tokens.expires_in * 1000
+  }
+}
+
+const summary = (id, account, active) => ({
+  id,
+  email: account.email ?? null,
+  active: id === active,
+  connected: !!account.access_token,
+  planUsage: !!account.access_token && account.scopes?.includes(PERMISSION) === true
+})
+
+/**
+ * OAuth credentials belong to this installation, independently of the public model catalog.
+ * `authorize` receives a sensitive browser URL; open it without recording it in logs.
+ * @param {{ directory?: string, fetch?: typeof fetch, verifyIdentity?: Function }} [options]
+ */
+export function createChatGPT (options = {}) {
+  const directory = options.directory ?? defaultDirectory()
+  const fetcher = options.fetch ?? globalThis.fetch
+  const verify = options.verifyIdentity ?? verifyIdentity
+  const tokenRequest = params => jsonRequest(fetcher, TOKEN, {
+    method: 'POST',
+    body: new URLSearchParams({ ...params, resource: RESOURCE })
+  })
+
+  const accounts = async () => {
+    const store = await readStore(directory)
+    return Object.entries(store.accounts).map(([id, account]) => summary(id, account, store.active))
+  }
+
+  /** @param {string} id */
+  const select = async id => withStore(directory, async (store, save) => {
+    if (!store.accounts[id]?.access_token) throw new Error('ChatGPT account is not connected; run mo chatgpt login')
+    store.active = id
+    await save(store)
+  })
+
+  /**
+   * `refreshAt` is when this token stops being handed out; a caller may reuse it until then.
+   * @param {string} [id] @returns {Promise<{accessToken: string, accountId: string, refreshAt: number}>}
+   */
+  const access = async (id) => withStore(directory, async (store, save) => {
+    const account = store.accounts[id ?? store.active]
+    if (!account?.access_token) throw new Error('ChatGPT is not connected; run mo chatgpt login')
+    if (!account.scopes?.includes(PERMISSION)) throw new Error('ChatGPT plan usage is not enabled; run mo chatgpt login and grant plan usage')
+    if (account.expires_at <= Date.now() + REFRESH_MARGIN) {
+      const tokens = await tokenRequest({ grant_type: 'refresh_token', client_id: account.client_id, refresh_token: account.refresh_token })
+      Object.assign(account, credentials(tokens, account))
+      await save(store)
+      if (!account.scopes.includes(PERMISSION)) throw new Error('ChatGPT plan usage permission was removed; reconnect with mo chatgpt login')
+    }
+    return { accessToken: account.access_token, accountId: account.client_id, refreshAt: account.expires_at - REFRESH_MARGIN }
+  })
+
+  /** @param {string} [id] @returns {Promise<Array<{id: string, model: string, label: string}>>} */
+  const models = async (id) => {
+    const { accessToken } = await access(id)
+    return visibleModels(await discoverModels(accessToken, { fetch: fetcher }))
+  }
+
+  /** @param {string} [id] @returns {Promise<{revoked: boolean}>} */
+  const logout = async (id) => withStore(directory, async (store, save) => {
+    id ??= store.active
+    const account = store.accounts[id]
+    if (!account) throw new Error('Unknown ChatGPT account')
+    let revoked = !account.refresh_token
+    try {
+      if (account.refresh_token) {
+        const discovery = await jsonRequest(fetcher, `${ISSUER}/.well-known/openid-configuration`)
+        const endpoint = new URL(discovery.revocation_endpoint)
+        if (endpoint.origin !== ISSUER) throw new Error('Invalid revocation endpoint')
+        const response = await fetcher(endpoint, {
+          method: 'POST',
+          redirect: 'error',
+          signal: AbortSignal.timeout(30000),
+          body: new URLSearchParams({ token: account.refresh_token, token_type_hint: 'refresh_token', client_id: account.client_id })
+        })
+        revoked = response.status === 200
+      }
+    } catch {
+      revoked = false
+    }
+    for (const key of ['access_token', 'refresh_token', 'id_token', 'expires_at', 'scopes']) delete account[key]
+    if (store.active === id) store.active = null
+    await save(store)
+    return { revoked }
+  })
+
+  /** @param {{ authorize: (url: string) => any, accountId?: string, timeoutMs?: number }} settings */
+  const login = async ({ authorize, accountId, timeoutMs = 300000 }) => {
+    const initial = await withStore(directory, async (store, save) => {
+      if (accountId && !store.accounts[accountId]) throw new Error('Unknown ChatGPT account')
+      await save(store)
+      return { host: store.host, account: store.accounts[accountId] }
+    })
+    const state = random()
+    const nonce = random()
+    const verifier = random()
+    let consume
+    let fail
+    const callback = new Promise((resolve, reject) => { consume = resolve; fail = reject })
+    // A callback may reject while the system browser is still opening.
+    callback.catch(() => {})
+    let used = false
+    const server = createServer((req, res) => {
+      const url = new URL(req.url, 'http://127.0.0.1')
+      res.setHeader('Cache-Control', 'no-store')
+      res.setHeader('Content-Type', 'text/plain; charset=utf-8')
+      if (req.method !== 'GET' || url.pathname !== '/auth/callback') { res.writeHead(404); res.end(); return }
+      if (used || url.searchParams.get('state') !== state) { res.writeHead(400); res.end('Invalid sign-in state.'); return }
+      used = true
+      if (url.searchParams.has('error')) {
+        res.end('Sign-in was not completed. Return to Mohdel.')
+        fail(new Error('ChatGPT authorization was not granted'))
+        return
+      }
+      res.end('Return to Mohdel to check whether sign-in completed.')
+      consume(url.searchParams)
+    })
+    await new Promise((resolve, reject) => {
+      server.once('error', reject)
+      server.listen(0, '127.0.0.1', () => resolve(undefined))
+    })
+    const redirect = `http://127.0.0.1:${server.address().port}/auth/callback`
+    const url = new URL(`${ISSUER}/api/accounts/authorize`)
+    url.search = new URLSearchParams({
+      client_id: initial.account?.client_id ?? 'dynamic_agent_client',
+      ext_agent_host_id: initial.host,
+      response_type: 'code',
+      redirect_uri: redirect,
+      scope: SCOPE,
+      resource: RESOURCE,
+      state,
+      nonce,
+      code_challenge_method: 'S256',
+      code_challenge: createHash('sha256').update(verifier).digest('base64url')
+    }).toString()
+    if (!initial.account) url.searchParams.set('agent_name_hint', 'Mohdel')
+    if (initial.account?.id_token) url.searchParams.set('id_token_hint', initial.account.id_token)
+    const timer = setTimeout(() => fail(new Error('ChatGPT sign-in timed out')), timeoutMs)
+    try {
+      Promise.resolve(authorize(url.toString())).catch(fail)
+      const params = await callback
+      const clientId = params.get('client_id') ?? initial.account?.client_id
+      if (!clientId || clientId === 'dynamic_agent_client' || (accountId && clientId !== accountId) || !params.get('code')) {
+        throw new Error('ChatGPT returned an invalid registration')
+      }
+      // Keep the issued ID even if code exchange fails; it must not be registered again.
+      await withStore(directory, async (store, save) => {
+        store.accounts[clientId] ??= { client_id: clientId }
+        await save(store)
+      })
+      const tokens = await tokenRequest({ grant_type: 'authorization_code', client_id: clientId, code: params.get('code'), code_verifier: verifier, redirect_uri: redirect })
+      const identity = await verify(tokens.id_token, clientId, nonce)
+      return await withStore(directory, async (store, save) => {
+        const previous = store.accounts[clientId]
+        if (previous.subject && previous.subject !== identity.sub) throw new Error('ChatGPT returned a different account identity')
+        const account = { ...credentials(tokens), client_id: clientId, subject: identity.sub, email: identity.email ?? null }
+        store.accounts[clientId] = account
+        store.active = clientId
+        await save(store)
+        return summary(clientId, account, store.active)
+      })
+    } finally {
+      clearTimeout(timer)
+      server.closeAllConnections()
+      await new Promise(resolve => server.close(resolve))
+    }
+  }
+
+  return { accounts, select, access, models, login, logout }
+}

package/js/chatgpt/models.js

@@ -0,0 +1,14 @@
+/** @param {string} accessToken @param {{fetch?: typeof fetch, signal?: AbortSignal}} [options] */
+export async function discoverModels (accessToken, options = {}) {
+  const signal = options.signal ? AbortSignal.any([options.signal, AbortSignal.timeout(30000)]) : AbortSignal.timeout(30000)
+  const response = await (options.fetch ?? fetch)('https://api.openai.com/v1/models', {
+    headers: { Authorization: `Bearer ${accessToken}` }, redirect: 'error', signal
+  })
+  if (!response.ok) throw Object.assign(new Error('ChatGPT model discovery failed'), { status: response.status })
+  const body = await response.json()
+  if (!Array.isArray(body.models)) throw new Error('ChatGPT returned an invalid model list')
+  return body.models.filter(m => typeof m.slug === 'string' && m.slug)
+}
+
+export const visibleModels = models => models.filter(m => m.visibility === 'list')
+  .map(m => ({ id: `chatgpt/${m.slug}`, model: m.slug, label: m.display_name || m.slug }))

package/js/chatgpt/store.js

@@ -0,0 +1,57 @@
+import { mkdir, readFile, writeFile, rename, unlink } from 'node:fs/promises'
+import { randomUUID } from 'node:crypto'
+import { join } from 'node:path'
+import { setTimeout as delay } from 'node:timers/promises'
+import envPaths from 'env-paths'
+
+export const defaultDirectory = () => join(envPaths('mohdel', { suffix: null }).data, 'chatgpt')
+
+export async function readStore (directory) {
+  const path = join(directory, 'accounts.json')
+  let text
+  try {
+    text = await readFile(path, 'utf8')
+  } catch (err) {
+    if (err.code === 'ENOENT') return { host: `urn:uuid:${randomUUID()}`, active: null, accounts: {} }
+    throw err
+  }
+  try {
+    return JSON.parse(text)
+  } catch {
+    // V8's parse error quotes the input, which here holds tokens.
+    throw new Error(`ChatGPT credentials are not valid JSON: ${path}`)
+  }
+}
+
+export async function writeStore (directory, store) {
+  const temporary = join(directory, `${randomUUID()}.tmp`)
+  try {
+    await writeFile(temporary, JSON.stringify(store), { mode: 0o600, flag: 'wx' })
+    await rename(temporary, join(directory, 'accounts.json'))
+  } finally {
+    await unlink(temporary).catch(err => { if (err.code !== 'ENOENT') throw err })
+  }
+}
+
+// A filesystem lock also serializes refresh-token rotation between session processes.
+// Never steal a lock on a timer: a slow token exchange may still own it.
+export async function withStore (directory, action) {
+  await mkdir(directory, { recursive: true, mode: 0o700 })
+  const lock = join(directory, 'accounts.lock')
+  const until = Date.now() + 35000
+  while (true) {
+    try {
+      await writeFile(lock, String(process.pid), { flag: 'wx', mode: 0o600 })
+      break
+    } catch (err) {
+      if (err.code !== 'EEXIST') throw err
+      if (Date.now() >= until) throw new Error(`ChatGPT credentials are locked: ${lock}. If its owner has exited, remove this lock and retry.`)
+      await delay(100)
+    }
+  }
+  try {
+    return await action(await readStore(directory), store => writeStore(directory, store))
+  } finally {
+    await unlink(lock)
+  }
+}

package/js/session/adapters/_pricing.js

@@ -112,6 +112,8 @@ function resolveTier (price, tokens) {
  * @returns {number}
  */
 export function costFor (envelope, usage) {
+  // Plan usage has no per-call API invoice; it still consumes the plan allowance.
+  if (envelope.model.startsWith('chatgpt/')) return 0
   return computeCost(specFor(envelope), usage)
 }
 

package/js/session/adapters/_registry.js

@@ -13,6 +13,7 @@
 export const ADAPTER_NAMES = Object.freeze([
   'anthropic',
   'cerebras',
+  'chatgpt',
   'deepseek',
   'echo',
   'fake',

package/js/session/adapters/chatgpt.js

@@ -0,0 +1,56 @@
+import OpenAI from 'openai'
+import { openai } from './openai.js'
+import { streamingDispatcher } from './_dispatcher.js'
+import { classifyProviderError } from './_errors.js'
+import { catalogKey, bareOf } from '#core/model-id.js'
+import { getSpec } from './_catalog.js'
+import { discoverModels } from '../../chatgpt/models.js'
+import { abortedDone } from './_aborted.js'
+
+// A token belongs to one account, so its model list only changes with the token.
+const discovered = new Map()
+const DISCOVERED_TOKENS = 8
+
+async function accountModels (key, deps) {
+  const cached = discovered.get(key)
+  if (cached) return cached
+  const models = await discoverModels(key, deps)
+  discovered.set(key, models)
+  if (discovered.size > DISCOVERED_TOKENS) discovered.delete(discovered.keys().next().value)
+  return models
+}
+
+/**
+ * Uses only the caller's OAuth access token, including behind the gate.
+ * Session subprocesses never read the host's saved ChatGPT account.
+ * @param {import('#core/envelope.js').CallEnvelope} envelope
+ * @param {{client?: any, fetch?: typeof fetch, signal?: AbortSignal, log?: any, span?: any}} [deps]
+ */
+export async function * chatgpt (envelope, deps = {}) {
+  const key = envelope.auth?.key
+  const start = String(process.hrtime.bigint())
+  const model = getSpec(catalogKey(envelope.model))?.model ?? bareOf(catalogKey(envelope.model))
+  try {
+    const models = await accountModels(key, deps)
+    if (!models.some(m => m.slug === model)) {
+      yield { type: 'error', error: { type: 'INVALID_REQUEST', severity: 'error', message: 'This model is not available to the selected ChatGPT account.', retryable: false } }
+      return
+    }
+  } catch (err) {
+    if (deps.signal?.aborted) {
+      yield abortedDone(start, null, envelope, '', 0, 0)
+      return
+    }
+    yield { type: 'error', error: classifyProviderError(err, key, { provider: 'chatgpt' }) }
+    return
+  }
+  const client = deps.client ?? new OpenAI({
+    apiKey: key,
+    baseURL: 'https://api.openai.com/v1',
+    maxRetries: 0,
+    fetchOptions: { dispatcher: streamingDispatcher() }
+  })
+  // SDK errors can carry request details; never put OAuth credentials in logs.
+  const log = deps.log ? { warn: (_data, message) => deps.log.warn({ provider: 'chatgpt' }, message) } : undefined
+  yield * openai(envelope, { ...deps, client, log })
+}

package/js/session/adapters/index.js

@@ -13,6 +13,7 @@
 
 import { anthropic } from './anthropic.js'
 import { cerebras } from './cerebras.js'
+import { chatgpt } from './chatgpt.js'
 import { deepseek } from './deepseek.js'
 import { echo } from './echo.js'
 import { fake } from './fake.js'
@@ -32,6 +33,7 @@ import { xiaomi } from './xiaomi.js'
 export const adapters = Object.freeze({
   anthropic,
   cerebras,
+  chatgpt,
   deepseek,
   echo,
   fake,

package/js/session/adapters/openai.js

@@ -70,7 +70,7 @@ export async function * openai (envelope, deps = {}) {
   }
 
   const { instructions, input } = splitPrompt(envelope.prompt, imageParts, {
-    toolResultImages: providerOf(envelope.model) === 'openai'
+    toolResultImages: ['openai', 'chatgpt'].includes(providerOf(envelope.model))
   })
   if (imageInputs.length) injectImageParts(input, imageInputs)
 
@@ -84,6 +84,7 @@ export async function * openai (envelope, deps = {}) {
   let thinkingTokens = 0
   let cachedInputTokens = 0
   let cacheWriteTokens = 0
+  let terminalResponse = false
   let status = STATUS_COMPLETED
   /** @type {string | undefined} */
   let warning
@@ -136,6 +137,7 @@ export async function * openai (envelope, deps = {}) {
           break
 
         case 'response.completed':
+          terminalResponse = true
           servedTier = event.response?.service_tier ?? servedTier
           if (event.response?.usage) {
             inputTokens = event.response.usage.input_tokens ?? 0
@@ -150,6 +152,7 @@ export async function * openai (envelope, deps = {}) {
           break
 
         case 'response.incomplete':
+          terminalResponse = true
           servedTier = event.response?.service_tier ?? servedTier
           status = STATUS_INCOMPLETE
           if (event.response?.incomplete_details?.reason === 'max_output_tokens') {
@@ -164,6 +167,13 @@ export async function * openai (envelope, deps = {}) {
           }
           break
 
+        case 'response.failed':
+          if (providerOf(envelope.model) === 'chatgpt') {
+            yield { type: 'error', error: classifyProviderError(new Error('ChatGPT response failed'), envelope.auth?.key, { provider: 'chatgpt' }) }
+            return
+          }
+          break
+
         default:
           break
       }
@@ -184,6 +194,10 @@ export async function * openai (envelope, deps = {}) {
   }
 
   const end = String(process.hrtime.bigint())
+  if (providerOf(envelope.model) === 'chatgpt' && !terminalResponse) {
+    yield { type: 'error', error: classifyProviderError(new Error('ChatGPT stream ended before completion'), envelope.auth?.key, { provider: 'chatgpt' }) }
+    return
+  }
   // OpenAI Responses reports `output_tokens` INCLUDING reasoning
   // tokens. The `AnswerResult` contract separates them into
   // `outputTokens` (message-only) and `thinkingTokens`, so subtract
@@ -350,7 +364,7 @@ function buildRequest (envelope, input, instructions) {
   // Per-user identifier — openai uses `safety_identifier`; other
   // Responses-API providers (xai) use the legacy `user` field.
   if (envelope.identifier) {
-    if (provider === 'openai') {
+    if (provider === 'openai' || provider === 'chatgpt') {
       request.safety_identifier = envelope.identifier
       request.prompt_cache_key = envelope.identifier
     } else {
@@ -362,6 +376,10 @@ function buildRequest (envelope, input, instructions) {
 
   // Meta's Responses API stores every prompt and response unless told not to.
   if (provider === 'meta') request.store = false
+  if (provider === 'chatgpt') {
+    request.store = false
+    request.stream = true
+  }
 
   return request
 }

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "mohdel",
-  "version": "3.4.0",
+  "version": "3.6.0",
   "license": "MIT",
   "author": {
     "name": "Christophe Le Bars",
     "email": "clb@toort.net"
   },
-  "description": "Self-hosted LLM gateway and SDK for Node — a LiteLLM-style unified API for 14 providers (Anthropic, OpenAI, Gemini, Mistral, Groq, xAI, DeepSeek, OpenRouter, …) with per-call USD cost tracking, streaming, tool calls, vision, speech-to-text, and built-in OpenTelemetry. Run in-process, or behind the process-isolated thin-gate for fault containment.",
+  "description": "Self-hosted LLM gateway and SDK for Node — a LiteLLM-style unified API for 15 providers (Anthropic, OpenAI, Gemini, Mistral, Groq, xAI, DeepSeek, OpenRouter, …) with per-call USD cost tracking, streaming, tool calls, vision, speech-to-text, and built-in OpenTelemetry. Run in-process, or behind the process-isolated thin-gate for fault containment.",
   "type": "module",
   "keywords": [
     "llm",
@@ -42,6 +42,14 @@
   },
   "main": "src/lib/index.js",
   "exports": {
+    "./chatgpt": {
+      "types": "./js/chatgpt/index.d.ts",
+      "default": "./js/chatgpt/index.js"
+    },
+    "./chatgpt/bin": {
+      "types": "./js/chatgpt/bin.d.ts",
+      "default": "./js/chatgpt/bin.js"
+    },
     ".": {
       "types": "./src/lib/index.d.ts",
       "default": "./src/lib/index.js"
@@ -136,7 +144,7 @@
     "@opentelemetry/exporter-trace-otlp-grpc": "^0.222.0",
     "@opentelemetry/sdk-node": "^0.222.0",
     "chalk": "^6.0.1",
-    "mohdel-thin-gate-linux-x64-gnu": "3.4.0"
+    "mohdel-thin-gate-linux-x64-gnu": "3.6.0"
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.129.0",
@@ -146,7 +154,8 @@
     "@opentelemetry/api": "^1.9.1",
     "env-paths": "^4.0.0",
     "groq-sdk": "^1.6.0",
-    "openai": "^7.23.0",
+    "jose": "^6.2.12",
+    "openai": "^7.25.0",
     "undici": "^7.29.0"
   },
   "lint-staged": {

package/src/cli/ask.js

@@ -42,10 +42,15 @@ export const hintsForError = (err, modelId) => {
   }
 
   if (/API key not found/i.test(both) || /AUTH_INVALID/i.test(err?.type || '') || /401|unauthorized|invalid api key/i.test(both)) {
-    if (provider) hints.push(`→ run:  mo setup ${provider}`)
+    if (provider === 'chatgpt') hints.push('→ run:  mo chatgpt login')
+    else if (provider) hints.push(`→ run:  mo setup ${provider}`)
     else hints.push('→ run:  mo                          # interactive provider/key setup')
   }
 
+  if (provider === 'chatgpt' && /RATE_LIMIT|QUOTA_EXHAUSTED|429|usage limit/i.test(`${err?.type || ''} ${both}`)) {
+    hints.push('→ manage ChatGPT plan usage: https://chatgpt.com/settings/usage')
+  }
+
   if (/deprecated/i.test(both) && /replacement/i.test(both)) {
     hints.push('→ run:  mo check                    # find broken deprecation links in curated.json')
   }
@@ -218,7 +223,8 @@ Examples:
     if (tokens.inputTokens) summary.push(`${tokens.inputTokens} in`)
     if (tokens.outputTokens) summary.push(`${tokens.outputTokens} out`)
     if (tokens.thinkingTokens) summary.push(`${tokens.thinkingTokens} think`)
-    if (tokens.cost != null) summary.push(`$${tokens.cost.toFixed(4)}`)
+    if (model.id.startsWith('chatgpt/')) summary.push('Using ChatGPT plan — manage usage: https://chatgpt.com/settings/usage')
+    else if (tokens.cost != null) summary.push(`$${tokens.cost.toFixed(4)}`)
     if (tokens.speed) {
       const served = tokens.servedSpeed
       summary.push(served === tokens.speed

package/src/cli/chatgpt.js

@@ -0,0 +1,65 @@
+import { createChatGPT, usageURL } from '../../js/chatgpt/index.js'
+import { parseJsonFlag, printAvailableFields, jsonOutput } from './json-output.js'
+
+export async function runChatGPT (args) {
+  const output = parseJsonFlag(args)
+  const [verb, id] = args
+  const auth = createChatGPT()
+  try {
+    if (verb === 'list' || verb === 'models') {
+      const fields = verb === 'list' ? ['id', 'email', 'active', 'connected', 'planUsage'] : ['id', 'model', 'label']
+      if (output.json && !output.fields) { printAvailableFields(fields); return }
+      const items = verb === 'list' ? await auth.accounts() : await auth.models(id)
+      if (output.json) jsonOutput(items, output.fields)
+      else {
+        for (const item of items) {
+          console.log(verb === 'list'
+            ? `${item.active ? '*' : ' '} ${item.id}  ${item.email ?? ''}  ${item.planUsage ? 'Using ChatGPT plan' : item.connected ? 'Plan usage not enabled' : 'Signed out'}`
+            : `${item.id}  ${item.label}`)
+        }
+      }
+      return
+    }
+    if (verb === 'login') {
+      const active = (await auth.accounts()).find(a => a.active)
+      const account = await auth.login({
+        accountId: id === '--new' ? undefined : id ?? active?.id,
+        authorize: value => {
+          // Retained ID-token hints must never be printed to a terminal or log.
+          const url = new URL(value)
+          url.searchParams.delete('id_token_hint')
+          console.log(`Continue with ChatGPT — open this URL in your browser:\n${url}`)
+        }
+      })
+      console.log(`Connected: ${account.id} ${account.email ?? ''}`)
+      console.log(account.planUsage ? 'Using ChatGPT plan. Discover models: mo chatgpt models' : 'Plan usage not enabled. Run mo chatgpt login to grant access.')
+      console.log(`Manage usage: ${usageURL}`)
+    } else if (verb === 'select' && id) {
+      await auth.select(id)
+      console.log(`Selected ChatGPT account: ${id}`)
+    } else if (verb === 'logout') {
+      const { revoked } = await auth.logout(id)
+      console.log('Signed out locally.')
+      if (!revoked) console.log(`Remote revocation was not confirmed. Disconnect Mohdel in ChatGPT Settings: ${usageURL}`)
+    } else if (verb === 'usage') {
+      console.log(usageURL)
+    } else {
+      console.log(`mo chatgpt — use your eligible ChatGPT plan
+
+  login [account-id|--new]   Continue with ChatGPT in your browser
+  list [--json fields]      Saved accounts and the active account
+  select <account-id>       Choose a saved account
+  logout [account-id]       Revoke and clear its local credentials
+  models [--json fields]    Discover the selected account's models
+  usage                    Open this link to manage plan usage
+
+After signing in, add models with: mo model curate chatgpt
+Then call them with: mo ask chatgpt/<model-slug> "your prompt"
+Usage consumes your ChatGPT allowance. Reported cost is API USD only.`)
+      if (verb && !['--help', '-h'].includes(verb)) process.exitCode = 1
+    }
+  } catch (err) {
+    console.error(err.message)
+    process.exitCode = 1
+  }
+}

package/src/cli/index.js

@@ -49,6 +49,7 @@ Run a model, see what the call cost, and curate the catalog those prices
 come from. Your keys, your infra, no SaaS in the path.
 
 Commands:
+  chatgpt login|list|select|logout|models  Connect and use your ChatGPT plan
   model list [--sort price|context|name]  List all curated models                 (mo ls, mo models)
   model search <term>                     Filter models by name/label             (mo search)
   model stats                             Catalog summary                         (mo stats)
@@ -136,7 +137,10 @@ const alias = ALIASES[command]
 const resolved = alias ? alias.noun : command
 const resolvedArgs = alias ? [...alias.inject, ...args] : args
 
-if (resolved === 'default') {
+if (resolved === 'chatgpt') {
+  const { runChatGPT } = await import('./chatgpt.js')
+  await runChatGPT(resolvedArgs)
+} else if (resolved === 'default') {
   const { runDefault } = await import('./default.js')
   await runDefault(resolvedArgs)
 } else if (resolved === 'doctor') {

package/src/cli/model.js

@@ -431,7 +431,7 @@ Requires an API key for the chosen provider — run 'mo' to configure one.`)
     const { providerApi, providersWithKeys, processModels } = await import('../lib/select.js')
     const withKeys = providersWithKeys()
 
-    if (!withKeys.length) {
+    if (!withKeys.length && !arg1) {
       console.error(err('No providers with API keys configured. Run "mo" to set up.'))
       process.exit(1)
     }
@@ -731,6 +731,10 @@ Alibaba's Qwen. Routing follows the provider — see "mo provider --help".`)
 
 // The provider API returns ids, never prices — curated entries land unpriced.
 function printCurateNext (providerName) {
+  if (providerName === 'chatgpt') {
+    console.log('ChatGPT plan models are ready. Use mo ask chatgpt/<model-slug> "your prompt". Plan usage is not API billing.')
+    return
+  }
   const def = providerDefs[providerName]
   if (def?.pricesFromApi) {
     console.log(`\n${meta(`${providerName} publishes prices in its model list — the entries are complete.`)}`)

package/src/lib/catalog/chatgpt.js

@@ -0,0 +1,20 @@
+import { createChatGPT } from '../../../js/chatgpt/index.js'
+import { discoverModels, visibleModels } from '../../../js/chatgpt/models.js'
+
+export default (configuration = {}) => {
+  const auth = createChatGPT()
+  let models
+  const load = async () => {
+    models ??= configuration.apiKey
+      ? visibleModels(await discoverModels(configuration.apiKey))
+      : await auth.models()
+    return models
+  }
+  return {
+    listModels: async () => (await load()).map(m => ({ id: m.model, label: m.label })),
+    getModelInfo: async id => {
+      const model = (await load()).find(m => m.model === id)
+      return model ? { model: id, label: model.label, creator: 'openai', inputPrice: 0, outputPrice: 0 } : null
+    }
+  }
+}

package/src/lib/index.js

@@ -587,7 +587,11 @@ const createModelProxy = (resolvedModelId, modelSpec, handlers, aliasOutputEffor
             // factory-owned trackers are threaded in so
             // `setProviderRateLimit` / factory-scoped cooldown settings
             // remain the source of truth for this factory instance.
-            const { configuration: defaultConfiguration } = await getRuntime()
+            const defaultConfiguration = providers[modelSpec.provider].refreshConfiguration
+              ? externalConfigurations?.[modelSpec.provider] ?? (sdkOptions.configuration
+                ? undefined
+                : await resolveProviderConfiguration(providers[modelSpec.provider], modelSpec.provider))
+              : (await getRuntime()).configuration
             const effectiveConfiguration = sdkOptions.configuration || defaultConfiguration
             delete sdkOptions.configuration
 

package/src/lib/providers.js

@@ -31,6 +31,21 @@ const providers = {
     contextSemantics: 'shared',
     outputCapStrategy: 'accept'
   },
+  chatgpt: {
+    sdk: 'openai',
+    catalogClient: 'chatgpt',
+    refreshConfiguration: true,
+    resolveConfiguration: async () => {
+      const { createChatGPT } = await import('../../js/chatgpt/index.js')
+      const { accessToken } = await createChatGPT().access()
+      return { apiKey: accessToken }
+    },
+    references: {
+      models: 'https://developers.openai.com/siwc/token-sharing-open-source/models-and-inference'
+    },
+    contextSemantics: 'shared',
+    outputCapStrategy: 'accept'
+  },
   deepseek: {
     sdk: 'openai',
     api: 'chatCompletions',

package/src/lib/select.js

@@ -21,6 +21,10 @@ loadDefaultEnv()
 // One provider's catalog client, for callers that don't need all of them.
 export const providerApi = async (name) => {
   const config = providers[name]
+  if (config?.catalogClient === 'chatgpt') {
+    const { default: API } = await import('./catalog/chatgpt.js')
+    return API()
+  }
   if (!config || config.catalog === false || !config.apiKeyEnv) return null
   const apiKey = getAPIKey(config.apiKeyEnv)
   if (!apiKey) return null