mohdel 3.5.0 → 3.6.1

package/README.md

@@ -42,7 +42,10 @@ Use `mo chatgpt list`, `select <account-id>`, `login --new`, and
 data directory (`~/.local/share/mohdel/chatgpt/` on Linux), with owner-only
 files and serialized token refresh. They are separate from the catalog.
 `mo chatgpt login <account-id>` reuses a saved registration after sign-out
-or a failed code exchange. If a crashed process leaves `accounts.lock`,
+or a failed code exchange. ChatGPT lists each registration by name: a new one
+is `Mohdel (<hostname>)`, or the label from `mo chatgpt login --name <label>`
+if you'd rather not send the hostname. The name is fixed when the registration
+is made, and `mo chatgpt list` shows it next to the account id. If a crashed process leaves `accounts.lock`,
 confirm its recorded PID has exited before removing that lock.
 
 This OpenAI flow is intended for open-source and personal local tools;
@@ -152,8 +155,9 @@ reading them. Mohdel is built so neither is present.
   starts a temporary HTTP callback listener on `127.0.0.1` with PKCE and state validation.
 - **Session credentials come from the caller.** The provider credential rides
   on each envelope and goes to the SDK. Optional ChatGPT sign-in saves OAuth
-  credentials in the caller's user-data directory; gate workers do not load
-  that store or select a local account.
+  credentials in the caller's user-data directory. The standalone gate and its
+  sessions never read that store. Only an embedder that opts into `ChatGptAuth`
+  reads it, through mohdel's helper.
 - **The session subprocess starts from an empty environment.** It is given
   back only what the runtime reads — `PATH`, proxy and TLS settings, mohdel's
   own dials, `OTEL_*`. Every `*_API_SK`, cloud credential and database URL the

package/js/chatgpt/bin.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+/**
+ * Access-token helper for a supervisor that cannot run the OAuth refresh
+ * itself (thin-gate's `ChatGptAuth`). Invoked as
+ * `node <path-to-this-file> access [--account <id>]`.
+ *
+ * stdout: `{"accessToken": "…", "refreshAt": <epoch ms>}`, exit 0.
+ * stderr: the error message, exit 1. The token never reaches stderr.
+ *
+ * @module chatgpt/bin
+ */
+
+import { createChatGPT } from './index.js'
+
+const USAGE = 'usage: node bin.js access [--account <id>]'
+
+async function main (args) {
+  const [verb, flag, id, ...rest] = args
+  if (verb !== 'access' || rest.length || (flag !== undefined && (flag !== '--account' || !id))) {
+    throw new Error(USAGE)
+  }
+  const { accessToken, refreshAt } = await createChatGPT().access(id)
+  process.stdout.write(JSON.stringify({ accessToken, refreshAt }))
+}
+
+main(process.argv.slice(2)).catch(err => {
+  process.stderr.write(err.message)
+  process.exitCode = 1
+})

package/js/chatgpt/index.js

@@ -1,5 +1,6 @@
 import { randomBytes, createHash } from 'node:crypto'
 import { createServer } from 'node:http'
+import { hostname } from 'node:os'
 import { createRemoteJWKSet, jwtVerify } from 'jose'
 import { defaultDirectory, readStore, withStore } from './store.js'
 import { discoverModels, visibleModels } from './models.js'
@@ -11,6 +12,9 @@ const PERMISSION = 'chatgpt.tokens.use.direct'
 const SCOPE = `openid profile email offline_access resource.invoke ${PERMISSION}`
 const jwks = createRemoteJWKSet(new URL(`${ISSUER}/.well-known/jwks.json`))
 const random = () => randomBytes(32).toString('base64url')
+const REFRESH_MARGIN = 30000
+// Every registration made before names were stored was sent this hint.
+const UNNAMED_REGISTRATION = 'Mohdel'
 export const usageURL = 'https://chatgpt.com/settings/usage'
 
 async function jsonRequest (fetcher, url, options = {}) {
@@ -60,6 +64,7 @@ function credentials (tokens, previous = {}) {
 
 const summary = (id, account, active) => ({
   id,
+  name: account.name ?? UNNAMED_REGISTRATION,
   email: account.email ?? null,
   active: id === active,
   connected: !!account.access_token,
@@ -92,18 +97,21 @@ export function createChatGPT (options = {}) {
     await save(store)
   })
 
-  /** @param {string} [id] @returns {Promise<{accessToken: string, accountId: string}>} */
+  /**
+   * `refreshAt` is when this token stops being handed out; a caller may reuse it until then.
+   * @param {string} [id] @returns {Promise<{accessToken: string, accountId: string, refreshAt: number}>}
+   */
   const access = async (id) => withStore(directory, async (store, save) => {
     const account = store.accounts[id ?? store.active]
     if (!account?.access_token) throw new Error('ChatGPT is not connected; run mo chatgpt login')
     if (!account.scopes?.includes(PERMISSION)) throw new Error('ChatGPT plan usage is not enabled; run mo chatgpt login and grant plan usage')
-    if (account.expires_at <= Date.now() + 30000) {
+    if (account.expires_at <= Date.now() + REFRESH_MARGIN) {
       const tokens = await tokenRequest({ grant_type: 'refresh_token', client_id: account.client_id, refresh_token: account.refresh_token })
       Object.assign(account, credentials(tokens, account))
       await save(store)
       if (!account.scopes.includes(PERMISSION)) throw new Error('ChatGPT plan usage permission was removed; reconnect with mo chatgpt login')
     }
-    return { accessToken: account.access_token, accountId: account.client_id }
+    return { accessToken: account.access_token, accountId: account.client_id, refreshAt: account.expires_at - REFRESH_MARGIN }
   })
 
   /** @param {string} [id] @returns {Promise<Array<{id: string, model: string, label: string}>>} */
@@ -112,7 +120,7 @@ export function createChatGPT (options = {}) {
     return visibleModels(await discoverModels(accessToken, { fetch: fetcher }))
   }
 
-  /** @param {string} [id] @returns {Promise<{revoked: boolean}>} */
+  /** @param {string} [id] @returns {Promise<{revoked: boolean, name: string}>} */
   const logout = async (id) => withStore(directory, async (store, save) => {
     id ??= store.active
     const account = store.accounts[id]
@@ -137,16 +145,25 @@ export function createChatGPT (options = {}) {
     for (const key of ['access_token', 'refresh_token', 'id_token', 'expires_at', 'scopes']) delete account[key]
     if (store.active === id) store.active = null
     await save(store)
-    return { revoked }
+    return { revoked, name: account.name ?? UNNAMED_REGISTRATION }
   })
 
-  /** @param {{ authorize: (url: string) => any, accountId?: string, timeoutMs?: number }} settings */
-  const login = async ({ authorize, accountId, timeoutMs = 300000 }) => {
+  /**
+   * `name` labels a new registration on the ChatGPT side (default `Mohdel (<hostname>)`);
+   * an existing registration keeps the name it was created with.
+   * @param {{ authorize: (url: string) => any, accountId?: string, name?: string, timeoutMs?: number }} settings
+   */
+  const login = async ({ authorize, accountId, name, timeoutMs = 300000 }) => {
+    if (name !== undefined && (typeof name !== 'string' || !name.trim())) throw new Error('ChatGPT registration name must not be empty')
     const initial = await withStore(directory, async (store, save) => {
       if (accountId && !store.accounts[accountId]) throw new Error('Unknown ChatGPT account')
+      if (name !== undefined && store.accounts[accountId]) {
+        throw new Error('A ChatGPT registration keeps the name it was created with; start a new registration to use another name')
+      }
       await save(store)
       return { host: store.host, account: store.accounts[accountId] }
     })
+    const label = name ?? `Mohdel (${hostname()})`
     const state = random()
     const nonce = random()
     const verifier = random()
@@ -189,7 +206,7 @@ export function createChatGPT (options = {}) {
       code_challenge_method: 'S256',
       code_challenge: createHash('sha256').update(verifier).digest('base64url')
     }).toString()
-    if (!initial.account) url.searchParams.set('agent_name_hint', 'Mohdel')
+    if (!initial.account) url.searchParams.set('agent_name_hint', label)
     if (initial.account?.id_token) url.searchParams.set('id_token_hint', initial.account.id_token)
     const timer = setTimeout(() => fail(new Error('ChatGPT sign-in timed out')), timeoutMs)
     try {
@@ -201,7 +218,7 @@ export function createChatGPT (options = {}) {
       }
       // Keep the issued ID even if code exchange fails; it must not be registered again.
       await withStore(directory, async (store, save) => {
-        store.accounts[clientId] ??= { client_id: clientId }
+        store.accounts[clientId] ??= { client_id: clientId, name: label }
         await save(store)
       })
       const tokens = await tokenRequest({ grant_type: 'authorization_code', client_id: clientId, code: params.get('code'), code_verifier: verifier, redirect_uri: redirect })
@@ -209,7 +226,7 @@ export function createChatGPT (options = {}) {
       return await withStore(directory, async (store, save) => {
         const previous = store.accounts[clientId]
         if (previous.subject && previous.subject !== identity.sub) throw new Error('ChatGPT returned a different account identity')
-        const account = { ...credentials(tokens), client_id: clientId, subject: identity.sub, email: identity.email ?? null }
+        const account = { ...credentials(tokens), client_id: clientId, name: previous.name, subject: identity.sub, email: identity.email ?? null }
         store.accounts[clientId] = account
         store.active = clientId
         await save(store)

package/js/chatgpt/store.js

@@ -7,12 +7,20 @@ import envPaths from 'env-paths'
 export const defaultDirectory = () => join(envPaths('mohdel', { suffix: null }).data, 'chatgpt')
 
 export async function readStore (directory) {
+  const path = join(directory, 'accounts.json')
+  let text
   try {
-    return JSON.parse(await readFile(join(directory, 'accounts.json'), 'utf8'))
+    text = await readFile(path, 'utf8')
   } catch (err) {
     if (err.code === 'ENOENT') return { host: `urn:uuid:${randomUUID()}`, active: null, accounts: {} }
     throw err
   }
+  try {
+    return JSON.parse(text)
+  } catch {
+    // V8's parse error quotes the input, which here holds tokens.
+    throw new Error(`ChatGPT credentials are not valid JSON: ${path}`)
+  }
 }
 
 export async function writeStore (directory, store) {

package/js/session/adapters/chatgpt.js

@@ -7,6 +7,19 @@ import { getSpec } from './_catalog.js'
 import { discoverModels } from '../../chatgpt/models.js'
 import { abortedDone } from './_aborted.js'
 
+// A token belongs to one account, so its model list only changes with the token.
+const discovered = new Map()
+const DISCOVERED_TOKENS = 8
+
+async function accountModels (key, deps) {
+  const cached = discovered.get(key)
+  if (cached) return cached
+  const models = await discoverModels(key, deps)
+  discovered.set(key, models)
+  if (discovered.size > DISCOVERED_TOKENS) discovered.delete(discovered.keys().next().value)
+  return models
+}
+
 /**
  * Uses only the caller's OAuth access token, including behind the gate.
  * Session subprocesses never read the host's saved ChatGPT account.
@@ -18,7 +31,7 @@ export async function * chatgpt (envelope, deps = {}) {
   const start = String(process.hrtime.bigint())
   const model = getSpec(catalogKey(envelope.model))?.model ?? bareOf(catalogKey(envelope.model))
   try {
-    const models = await discoverModels(key, deps)
+    const models = await accountModels(key, deps)
     if (!models.some(m => m.slug === model)) {
       yield { type: 'error', error: { type: 'INVALID_REQUEST', severity: 'error', message: 'This model is not available to the selected ChatGPT account.', retryable: false } }
       return

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mohdel",
-  "version": "3.5.0",
+  "version": "3.6.1",
   "license": "MIT",
   "author": {
     "name": "Christophe Le Bars",
@@ -46,6 +46,10 @@
       "types": "./js/chatgpt/index.d.ts",
       "default": "./js/chatgpt/index.js"
     },
+    "./chatgpt/bin": {
+      "types": "./js/chatgpt/bin.d.ts",
+      "default": "./js/chatgpt/bin.js"
+    },
     ".": {
       "types": "./src/lib/index.d.ts",
       "default": "./src/lib/index.js"
@@ -140,7 +144,7 @@
     "@opentelemetry/exporter-trace-otlp-grpc": "^0.222.0",
     "@opentelemetry/sdk-node": "^0.222.0",
     "chalk": "^6.0.1",
-    "mohdel-thin-gate-linux-x64-gnu": "3.5.0"
+    "mohdel-thin-gate-linux-x64-gnu": "3.6.1"
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.129.0",

package/src/cli/chatgpt.js

@@ -3,18 +3,23 @@ import { parseJsonFlag, printAvailableFields, jsonOutput } from './json-output.j
 
 export async function runChatGPT (args) {
   const output = parseJsonFlag(args)
+  const nameAt = args.indexOf('--name')
+  const name = nameAt === -1 ? undefined : args.splice(nameAt, 2)[1]
   const [verb, id] = args
   const auth = createChatGPT()
   try {
+    if (nameAt !== -1 && (verb !== 'login' || !name || name.startsWith('--'))) {
+      throw new Error('Usage: mo chatgpt login --name <label>')
+    }
     if (verb === 'list' || verb === 'models') {
-      const fields = verb === 'list' ? ['id', 'email', 'active', 'connected', 'planUsage'] : ['id', 'model', 'label']
+      const fields = verb === 'list' ? ['id', 'name', 'email', 'active', 'connected', 'planUsage'] : ['id', 'model', 'label']
       if (output.json && !output.fields) { printAvailableFields(fields); return }
       const items = verb === 'list' ? await auth.accounts() : await auth.models(id)
       if (output.json) jsonOutput(items, output.fields)
       else {
         for (const item of items) {
           console.log(verb === 'list'
-            ? `${item.active ? '*' : ' '} ${item.id}  ${item.email ?? ''}  ${item.planUsage ? 'Using ChatGPT plan' : item.connected ? 'Plan usage not enabled' : 'Signed out'}`
+            ? `${item.active ? '*' : ' '} ${item.id}  ${item.name}  ${item.email ?? ''}  ${item.planUsage ? 'Using ChatGPT plan' : item.connected ? 'Plan usage not enabled' : 'Signed out'}`
             : `${item.id}  ${item.label}`)
         }
       }
@@ -23,7 +28,8 @@ export async function runChatGPT (args) {
     if (verb === 'login') {
       const active = (await auth.accounts()).find(a => a.active)
       const account = await auth.login({
-        accountId: id === '--new' ? undefined : id ?? active?.id,
+        accountId: id === '--new' || (name && !id) ? undefined : id ?? active?.id,
+        name,
         authorize: value => {
           // Retained ID-token hints must never be printed to a terminal or log.
           const url = new URL(value)
@@ -31,22 +37,24 @@ export async function runChatGPT (args) {
           console.log(`Continue with ChatGPT — open this URL in your browser:\n${url}`)
         }
       })
-      console.log(`Connected: ${account.id} ${account.email ?? ''}`)
+      console.log(`Connected: ${account.id} ${account.name} ${account.email ?? ''}`)
       console.log(account.planUsage ? 'Using ChatGPT plan. Discover models: mo chatgpt models' : 'Plan usage not enabled. Run mo chatgpt login to grant access.')
       console.log(`Manage usage: ${usageURL}`)
     } else if (verb === 'select' && id) {
       await auth.select(id)
       console.log(`Selected ChatGPT account: ${id}`)
     } else if (verb === 'logout') {
-      const { revoked } = await auth.logout(id)
+      const { revoked, name: registration } = await auth.logout(id)
       console.log('Signed out locally.')
-      if (!revoked) console.log(`Remote revocation was not confirmed. Disconnect Mohdel in ChatGPT Settings: ${usageURL}`)
+      if (!revoked) console.log(`Remote revocation was not confirmed. Disconnect "${registration}" in ChatGPT Settings: ${usageURL}`)
     } else if (verb === 'usage') {
       console.log(usageURL)
     } else {
       console.log(`mo chatgpt — use your eligible ChatGPT plan
 
   login [account-id|--new]   Continue with ChatGPT in your browser
+  login --name <label>       Start a new registration, named as ChatGPT shows it
+                             (a new registration defaults to Mohdel (<hostname>))
   list [--json fields]      Saved accounts and the active account
   select <account-id>       Choose a saved account
   logout [account-id]       Revoke and clear its local credentials

package/src/cli/index.js

@@ -9,6 +9,7 @@
  * Aliases: ls → model list, rl → ratelimit
  */
 
+import { createRequire } from 'node:module'
 import { detectAssistants, launchLines } from '../lib/assistants.js'
 import { getConfig } from '../lib/common.js'
 import { ALIASES } from './aliases.js'
@@ -34,6 +35,11 @@ if (command === 'completion') {
   process.exit(0)
 }
 
+if (command === '--version') {
+  console.log(createRequire(import.meta.url)('../../package.json').version)
+  process.exit(0)
+}
+
 if (command === '-h' || command === '--help') {
   const assistant = (await getConfig()).assistant || null
   const { default: PROVIDER_INFO } = await import('../lib/provider-info.js')
@@ -92,6 +98,7 @@ Commands:
   default [model]                         Set the model "mo ask" uses by default
   doctor                                  Check that your install is wired up
   completion bash                         Shell completion — source <(mo completion bash)
+  --version                               Print the installed mohdel version
 
 Catalog work with a coding agent:
   Prices, context limits and cache rates are in no provider API — they live on