@0xmaxma/claude-gateway 1.8.3 → 1.8.5

package/dist/logger.js

@@ -33,16 +33,201 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOGS_DEFAULTS = void 0;
+exports.isLogLevel = isLogLevel;
+exports.configureLogging = configureLogging;
+exports.loggingConfig = loggingConfig;
+exports.resetLoggingForTests = resetLoggingForTests;
 exports.createLogger = createLogger;
+exports.sweepOldLogs = sweepOldLogs;
+exports.startLogRetentionSweep = startLogRetentionSweep;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+/** Ordering for the level gate. Only the relative order matters. */
+const LEVEL_RANK = { debug: 10, info: 20, warn: 30, error: 40 };
+function isLogLevel(value) {
+    return typeof value === 'string' && value in LEVEL_RANK;
+}
+/**
+ * Defaults applied when `gateway.logs` is absent or partial.
+ *
+ * `level: 'info'` is the load-bearing one. Session processes log every stream
+ * event at debug (src/session/process.ts), which on a live host measured as
+ * 19,995 debug lines to 5 info lines in a single 217 MB file — so `debug`
+ * on-by-default was, in practice, the whole log directory. Rotation alone would
+ * not have helped: it bounds what is *kept*, not what is *written*.
+ */
+exports.LOGS_DEFAULTS = {
+    level: 'info',
+    maxFileBytes: 16 * 1024 * 1024,
+    maxFiles: 3,
+    retentionDays: 14,
+};
+let active = { ...exports.LOGS_DEFAULTS };
+/**
+ * Install the process-wide logging policy. Called once at boot, before the
+ * first logger exists.
+ *
+ * Policy is module state rather than a per-logger argument because there is one
+ * of it per process, and `createLogger()` has 13 call sites — several of which
+ * (routers, the session process) have no access to the gateway config. Threading
+ * an options bag through all of them would put the same value in 13 places and
+ * let them drift.
+ */
+function configureLogging(cfg) {
+    const level = isLogLevel(cfg?.level) ? cfg.level : exports.LOGS_DEFAULTS.level;
+    active = {
+        level,
+        maxFileBytes: positiveOrDefault(cfg?.maxFileBytes, exports.LOGS_DEFAULTS.maxFileBytes),
+        maxFiles: nonNegativeOrDefault(cfg?.maxFiles, exports.LOGS_DEFAULTS.maxFiles),
+        retentionDays: nonNegativeOrDefault(cfg?.retentionDays, exports.LOGS_DEFAULTS.retentionDays),
+    };
+    return { ...active };
+}
+/** The policy currently in force (a copy — callers must not mutate it). */
+function loggingConfig() {
+    return { ...active };
+}
+/** Test hook: restore defaults and forget per-file state. */
+function resetLoggingForTests() {
+    active = { ...exports.LOGS_DEFAULTS };
+    fileSizes.clear();
+    writeFailureReported = false;
+}
+/** 0 is meaningful for `maxFiles`/`retentionDays` (= disabled) but not for a
+ *  size threshold, where it would rotate on every line. */
+function positiveOrDefault(value, fallback) {
+    return typeof value === 'number' && Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
+}
+function nonNegativeOrDefault(value, fallback) {
+    return typeof value === 'number' && Number.isFinite(value) && value >= 0 ? Math.floor(value) : fallback;
+}
+/**
+ * Live size per log file, keyed by absolute path.
+ *
+ * Kept at module scope rather than on the instance because one file can have
+ * several loggers writing to it — `createLogger(agentConfig.id, …)` is called
+ * from both the boot path and the runner constructor. Per-instance counters
+ * would each see only their own share of the file and rotate late. Seeded from
+ * `statSync` once per file, then maintained by arithmetic so the common path
+ * costs no syscall.
+ *
+ * One entry per log file, and session logs create a new file each. The
+ * retention sweep deletes its entry along with the file, which bounds the map
+ * for any configuration that keeps retention on; with `retentionDays: 0` it
+ * grows with the session count, at roughly a path string per session. That is
+ * small enough not to be worth a second eviction mechanism whose only job would
+ * be to duplicate the sweep.
+ */
+const fileSizes = new Map();
+/**
+ * A failed append is latched and reported once per process.
+ *
+ * This used to be a bare `catch {}` — a full disk or a permission change
+ * silently stopped all file logging, which is precisely the failure that makes
+ * the next incident undiagnosable. Reporting every occurrence would be its own
+ * denial of service (the failing call is in the logger), so it is reported once
+ * and then suppressed.
+ */
+let writeFailureReported = false;
+function reportWriteFailure(file, err) {
+    if (writeFailureReported)
+        return;
+    writeFailureReported = true;
+    const reason = err?.code ?? err?.message ?? String(err);
+    process.stderr.write(`[logger] cannot write to ${file} (${reason}) — file logging is degraded for the rest of this process. ` +
+        'Further write failures will not be reported.\n');
+}
+/**
+ * Remove every rotated generation at or above `maxFiles`.
+ *
+ * Deleting only `<file>.<maxFiles>` would be dead code: `renameSync` clobbers
+ * its destination, so the top generation is overwritten by the shift below
+ * anyway — but only while `maxFiles` stays where it was. Lower it in the config
+ * (5 → 2) and generations 2..5 are orphaned: nothing renames onto them, and the
+ * age sweep is the only thing that would ever collect them. A rotation happens
+ * once per `maxFileBytes`, so it can afford one readdir to stay bounded.
+ */
+function pruneGenerations(file, maxFiles) {
+    const dir = path.dirname(file);
+    const prefix = `${path.basename(file)}.`;
+    let names;
+    try {
+        names = fs.readdirSync(dir);
+    }
+    catch {
+        return; // best-effort
+    }
+    for (const name of names) {
+        if (!name.startsWith(prefix))
+            continue;
+        const gen = Number(name.slice(prefix.length));
+        if (!Number.isInteger(gen) || gen < maxFiles)
+            continue;
+        try {
+            fs.rmSync(path.join(dir, name), { force: true });
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+}
+/** `<name>.log` → `<name>.log.1`, dropping generations past `maxFiles`.
+ *
+ *  Synchronous and best-effort by design: it runs inside a logging call, so it
+ *  must neither block on I/O the caller did not ask for nor throw into code
+ *  that was only trying to log. A rotation that fails leaves the live file in
+ *  place and logging simply continues into it. */
+function rotate(file, maxFiles) {
+    if (maxFiles <= 0) {
+        // No generations kept: the live file is the only file, so start it over.
+        try {
+            fs.unlinkSync(file);
+        }
+        catch {
+            /* best-effort */
+        }
+        return;
+    }
+    pruneGenerations(file, maxFiles);
+    for (let gen = maxFiles - 1; gen >= 1; gen--) {
+        try {
+            fs.renameSync(`${file}.${gen}`, `${file}.${gen + 1}`);
+        }
+        catch {
+            /* a generation that does not exist yet is the normal case */
+        }
+    }
+    try {
+        fs.renameSync(file, `${file}.1`);
+    }
+    catch {
+        /* best-effort */
+    }
+}
 class AgentLogger {
     constructor(agentId, logDir) {
         this.agentId = agentId;
         fs.mkdirSync(logDir, { recursive: true });
         this.logFilePath = path.join(logDir, `${agentId}.log`);
     }
+    currentSize() {
+        const known = fileSizes.get(this.logFilePath);
+        if (known !== undefined)
+            return known;
+        let size = 0;
+        try {
+            size = fs.statSync(this.logFilePath).size;
+        }
+        catch {
+            size = 0; // not created yet
+        }
+        fileSizes.set(this.logFilePath, size);
+        return size;
+    }
     log(level, message, data) {
+        if (LEVEL_RANK[level] < LEVEL_RANK[active.level])
+            return;
         const entry = {
             ts: new Date().toISOString(),
             agentId: this.agentId,
@@ -55,11 +240,18 @@ class AgentLogger {
         // Write to stdout (pretty-printed for readability)
         process.stdout.write(pretty + '\n');
         // Write to log file (compact, one entry per line)
+        const bytes = Buffer.byteLength(line, 'utf-8') + 1;
         try {
+            if (active.maxFileBytes > 0 && this.currentSize() + bytes > active.maxFileBytes) {
+                rotate(this.logFilePath, active.maxFiles);
+                fileSizes.set(this.logFilePath, 0);
+            }
             fs.appendFileSync(this.logFilePath, line + '\n', 'utf-8');
+            fileSizes.set(this.logFilePath, this.currentSize() + bytes);
         }
-        catch {
-            // If we can't write to the log file, just continue
+        catch (err) {
+            // Logging must never throw into a caller, but it must not vanish either.
+            reportWriteFailure(this.logFilePath, err);
         }
     }
     info(message, data) {
@@ -78,4 +270,74 @@ class AgentLogger {
 function createLogger(agentId, logDir) {
     return new AgentLogger(agentId, logDir);
 }
+/**
+ * Delete log files (live and rotated generations) last modified more than
+ * `retentionDays` ago. Returns the paths removed.
+ *
+ * Age, not count, is what bounds a directory of *session* logs: each session
+ * gets its own `<agent>:session:<uuid>.log` that is never written again once the
+ * session ends, so `maxFiles` — which only prunes generations of one stream —
+ * never touches them.
+ */
+function sweepOldLogs(logDir, retentionDays, now = Date.now()) {
+    const removed = [];
+    if (!(retentionDays > 0))
+        return removed; // 0 = keep forever
+    const cutoff = now - retentionDays * 24 * 60 * 60 * 1000;
+    let names;
+    try {
+        names = fs.readdirSync(logDir);
+    }
+    catch {
+        return removed; // no directory yet, or unreadable — nothing to sweep
+    }
+    for (const name of names) {
+        // `.log` and its rotated generations (`.log.1`), and nothing else: the
+        // directory is not exclusively ours to delete from.
+        if (!/\.log(\.\d+)?$/.test(name))
+            continue;
+        const full = path.join(logDir, name);
+        try {
+            if (fs.statSync(full).mtimeMs >= cutoff)
+                continue;
+            fs.rmSync(full, { force: true });
+            fileSizes.delete(full);
+            removed.push(full);
+        }
+        catch {
+            /* best-effort — a file that vanished or cannot be read is not fatal */
+        }
+    }
+    return removed;
+}
+/**
+ * Sweep now, then once a day. Returns a stop function.
+ *
+ * Modelled on `AppInstaller.startBackupCleanup()`: the timer is unref'd so it
+ * never keeps the process alive, and a failing sweep is swallowed rather than
+ * escalated — retention is housekeeping, not a reason to take the gateway down.
+ *
+ * The timer is created unconditionally, including when retention is currently
+ * off. `retentionDays` is read on each run rather than captured, so a policy
+ * reloaded from `gateway.logs` takes effect at the next sweep — and a timer
+ * that was never started because retention happened to be 0 at boot could not
+ * do that. A disabled sweep costs one no-op call a day.
+ */
+function startLogRetentionSweep(logDir, onSwept) {
+    const run = () => {
+        try {
+            const removed = sweepOldLogs(logDir, active.retentionDays);
+            if (removed.length > 0)
+                onSwept?.(removed);
+        }
+        catch {
+            /* best-effort */
+        }
+    };
+    run();
+    const timer = setInterval(run, 24 * 60 * 60 * 1000);
+    if (typeof timer.unref === 'function')
+        timer.unref();
+    return () => clearInterval(timer);
+}
 //# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgEA,oCAEC;AAlED,uCAAyB;AACzB,2CAA6B;AAa7B,MAAM,WAAW;IAIf,YAAY,OAAe,EAAE,MAAc;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,OAAO,MAAM,CAAC,CAAC;IACzD,CAAC;IAEO,GAAG,CAAC,KAAe,EAAE,OAAe,EAAE,IAA8B;QAC1E,MAAM,KAAK,GAAa;YACtB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK;YACL,OAAO;YACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAE9C,mDAAmD;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QAEpC,kDAAkD;QAClD,IAAI,CAAC;YACH,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,IAA8B;QAClD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,IAA8B;QAClD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,IAA8B;QACnD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,IAA8B;QACnD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;CACF;AAED,SAAgB,YAAY,CAAC,OAAe,EAAE,MAAc;IAC1D,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA,gCAEC;AA8BD,4CASC;AAGD,sCAEC;AAGD,oDAIC;AAkMD,oCAEC;AAWD,oCAyBC;AAeD,wDAgBC;AArUD,uCAAyB;AACzB,2CAA6B;AAK7B,oEAAoE;AACpE,MAAM,UAAU,GAAuC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAEpG,SAAgB,UAAU,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,UAAU,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACU,QAAA,aAAa,GAAyB;IACjD,KAAK,EAAE,MAAM;IACb,YAAY,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAC9B,QAAQ,EAAE,CAAC;IACX,aAAa,EAAE,EAAE;CAClB,CAAC;AAEF,IAAI,MAAM,GAAyB,EAAE,GAAG,qBAAa,EAAE,CAAC;AAExD;;;;;;;;;GASG;AACH,SAAgB,gBAAgB,CAAC,GAA2B;IAC1D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,qBAAa,CAAC,KAAK,CAAC;IACvE,MAAM,GAAG;QACP,KAAK;QACL,YAAY,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,qBAAa,CAAC,YAAY,CAAC;QAC9E,QAAQ,EAAE,oBAAoB,CAAC,GAAG,EAAE,QAAQ,EAAE,qBAAa,CAAC,QAAQ,CAAC;QACrE,aAAa,EAAE,oBAAoB,CAAC,GAAG,EAAE,aAAa,EAAE,qBAAa,CAAC,aAAa,CAAC;KACrF,CAAC;IACF,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;AACvB,CAAC;AAED,2EAA2E;AAC3E,SAAgB,aAAa;IAC3B,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;AACvB,CAAC;AAED,6DAA6D;AAC7D,SAAgB,oBAAoB;IAClC,MAAM,GAAG,EAAE,GAAG,qBAAa,EAAE,CAAC;IAC9B,SAAS,CAAC,KAAK,EAAE,CAAC;IAClB,oBAAoB,GAAG,KAAK,CAAC;AAC/B,CAAC;AAED;2DAC2D;AAC3D,SAAS,iBAAiB,CAAC,KAAyB,EAAE,QAAgB;IACpE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACzG,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB,EAAE,QAAgB;IACvE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1G,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE5C;;;;;;;;GAQG;AACH,IAAI,oBAAoB,GAAG,KAAK,CAAC;AAEjC,SAAS,kBAAkB,CAAC,IAAY,EAAE,GAAY;IACpD,IAAI,oBAAoB;QAAE,OAAO;IACjC,oBAAoB,GAAG,IAAI,CAAC;IAC5B,MAAM,MAAM,GAAI,GAA6B,EAAE,IAAI,IAAK,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9F,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4BAA4B,IAAI,KAAK,MAAM,6DAA6D;QACtG,gDAAgD,CACnD,CAAC;AACJ,CAAC;AAUD;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,QAAgB;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;IACzC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,cAAc;IACxB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QACvC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,QAAQ;YAAE,SAAS;QACvD,IAAI,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;kDAKkD;AAClD,SAAS,MAAM,CAAC,IAAY,EAAE,QAAgB;IAC5C,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,yEAAyE;QACzE,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QACD,OAAO;IACT,CAAC;IACD,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjC,KAAK,IAAI,GAAG,GAAG,QAAQ,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,GAAG,IAAI,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC;AAED,MAAM,WAAW;IAIf,YAAY,OAAe,EAAE,MAAc;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,OAAO,MAAM,CAAC,CAAC;IACzD,CAAC;IAEO,WAAW;QACjB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,CAAC,CAAC,CAAC,kBAAkB;QAC9B,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,GAAG,CAAC,KAAe,EAAE,OAAe,EAAE,IAA8B;QAC1E,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO;QAEzD,MAAM,KAAK,GAAa;YACtB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK;YACL,OAAO;YACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAE9C,mDAAmD;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QAEpC,kDAAkD;QAClD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,GAAG,KAAK,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;gBAChF,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC1C,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACrC,CAAC;YACD,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1D,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,IAA8B;QAClD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,IAA8B;QAClD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,IAA8B;QACnD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,IAA8B;QACnD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;CACF;AAED,SAAgB,YAAY,CAAC,OAAe,EAAE,MAAc;IAC1D,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,YAAY,CAAC,MAAc,EAAE,aAAqB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAClF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,mBAAmB;IAC7D,MAAM,MAAM,GAAG,GAAG,GAAG,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACzD,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,CAAC,qDAAqD;IACvE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,uEAAuE;QACvE,oDAAoD;QACpD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM;gBAAE,SAAS;YAClD,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACjC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;QACzE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,sBAAsB,CACpC,MAAc,EACd,OAAqC;IAErC,MAAM,GAAG,GAAG,GAAS,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;YAC3D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC,CAAC;IACF,GAAG,EAAE,CAAC;IACN,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;QAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACrD,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC"}

package/dist/session/process.d.ts

@@ -87,10 +87,52 @@ export declare class SessionProcess extends EventEmitter {
     private setupRestartWatcher;
     private buildInitialPrompt;
     /**
-     * Read stdio MCP servers from Claude Code's user-scoped config (~/.claude/settings.json).
+     * Read stdio MCP servers from Claude Code's user-scoped config
+     * (`$CLAUDE_CONFIG_DIR/settings.json`, else `~/.claude/settings.json`).
      * Returns empty object if file doesn't exist, can't be parsed, or has no mcpServers.
      */
     private readUserScopedMcp;
+    /**
+     * Resolve the Claude credentials handed to an app-agent container this spawn.
+     *
+     * Container agents used to receive their credentials as a read-only bind mount
+     * of the host ~/.claude/settings.json. A Docker *file* bind mount pins an
+     * inode rather than a path, and Claude Code rewrites that file by atomic
+     * rename — so the first host settings change left every long-lived container
+     * reading a deleted inode. Claude Code silently ignores a settings.json whose
+     * inode is unlinked, so the agent stayed healthy and answered every real user
+     * "Not logged in · Please run /login" until someone recreated the container.
+     *
+     * That mechanism was verified directly rather than inferred: with content held
+     * byte-identical (same md5) and only the link count differing, a container
+     * reading the unlinked inode reported "Not logged in" and sent no request,
+     * while the same file at nlink=1 authenticated normally.
+     *
+     * Resolving by path here is immune to that: the container is handed the
+     * current credentials every time a session subprocess is spawned. Because the
+     * unlinked file is *ignored* rather than merely stale, the forwarded env is
+     * what the CLI ends up using — so a container stuck on a stale mount recovers
+     * on its next session spawn, with no container recreate. Note the cadence is
+     * per spawn, not per turn: one `docker exec` serves a whole session and later
+     * turns are written to its stdin, so a rotated credential reaches a live
+     * session only when it is respawned (idle reap, restart or config change).
+     *
+     * settings.json wins over the gateway's own environment. That matches Claude
+     * Code, which applies the file's `env` block over whatever it inherited (also
+     * verified: with both sources set to different endpoints, every request went
+     * to the file's), and it keeps the live file as the single source of truth — a
+     * long-lived gateway started with an exported token would otherwise pin the
+     * container to a credential that can never be rotated without restarting the
+     * service.
+     *
+     * Credentials resolve as a GROUP, not key by key. If the file declares an
+     * identity at all, the gateway's environment must not contribute a *different*
+     * one: forwarding a file OAuth token alongside an environment
+     * ANTHROPIC_API_KEY would hand the container two identities and let the CLI
+     * choose between them silently. A base URL only selects an endpoint, so it is
+     * not part of that group and keeps its own independent fallback.
+     */
+    private resolveContainerAuthEnv;
     /**
      * Read stdio MCP servers from Claude Code's project-scoped config (~/.claude.json).
      * Looks up projects[workspace].mcpServers for the agent's workspace path.

package/dist/session/process.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/session/process.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAKtC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGtD,OAAO,EAAmC,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAYvC,eAAO,MAAM,oBAAoB,KAAK,CAAC;AA+EvC,eAAO,MAAM,yBAAyB,oDAAoD,CAAC;AAE3F;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,CAAC,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAMR;AAuCD,qBAAa,cAAe,SAAQ,YAAY;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAc;IAC7C,cAAc,SAAc;IAQ5B,OAAO,CAAC,6BAA6B,CAAuB;IAG5D,OAAO,CAAC,iBAAiB,CAAqC;IAM9D,OAAO,CAAC,2BAA2B,CAAS;IAC5C,OAAO,CAAC,mBAAmB,CAA8C;IACzE,QAAQ,CAAC,SAAS,SAAc;IAChC,qFAAqF;IACrF,OAAO,EAAE,WAAW,GAAG,UAAU,CAAc;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;IAMvB,YAAY,EAAE,MAAM,CAAwB;IAM5C,aAAa,EAAE,OAAO,CAAS;IAC/B,YAAY,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAQ;IAC1G,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAAK;IAKzB,OAAO,CAAC,WAAW,CAAK;IAOxB,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,eAAe,CAAS;IAUhC,OAAO,CAAC,OAAO,CAAS;IAMxB,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,cAAc,CAAmC;IACzD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,SAAS,UAAS;IAIlB,OAAO,CAAC,eAAe,CAAK;IAE5B,UAAU,SAAM;IAChB,OAAO,CAAC,qBAAqB,CAAK;IAKlC,OAAO,CAAC,qBAAqB,CAAqB;IAMlD,OAAO,CAAC,aAAa,CAAY;IACjC,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,YAAY,CAAM;IAE1B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,aAAa,CAAC,CAAyB;IAC/C,OAAO,CAAC,YAAY,CAAM;IAC1B,OAAO,CAAC,WAAW,CAAC,CAAgC;IACpD,OAAO,CAAC,aAAa,CAAS;IAE9B,OAAO,CAAC,oBAAoB,CAAC,CAAS;gBAGpC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,gBAAgB,EACxB,WAAW,EAAE,WAAW,EACxB,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,YAAY,EAC1B,MAAM,CAAC,EAAE,MAAM;IAmBjB;;;OAGG;IACH,OAAO,KAAK,SAAS,GAEpB;IAED,OAAO,CAAC,aAAa;IAMrB,wFAAwF;IACxF,IAAI,KAAK,IAAI,MAAM,CAElB;IAED,0EAA0E;IAC1E,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,gEAAgE;IAChE,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,OAAO,CAAC,cAAc;IAchB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;YA8Bb,kBAAkB;IA4DhC;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAUzB;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAW5B,OAAO,CAAC,cAAc;IAsHtB,8FAA8F;IAC9F,OAAO,CAAC,kBAAkB;IAY1B,qFAAqF;IACrF,OAAO,CAAC,kBAAkB;IAQ1B;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAY/B,OAAO,CAAC,SAAS;IAsCjB,OAAO,CAAC,MAAM,CAAC,gBAAgB;YAOjB,YAAY;IA+gB1B,OAAO,CAAC,eAAe;IA4DvB;;;;;OAKG;IACH,MAAM,CAAC,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAI5D;;;;;OAKG;IACH,OAAO,CAAC,4BAA4B;IAmBpC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IA+B/B;;;;;;OAMG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAmB/C;;;;;;;OAOG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAkBhC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAqB1D,IAAI,YAAY,IAAI,OAAO,CAA6B;IAExD,OAAO,CAAC,wBAAwB;IAYhC,OAAO,CAAC,iCAAiC;IAczC,OAAO,CAAC,4BAA4B;IAOpC;;;;;;;;OAQG;IACH,4BAA4B,IAAI,OAAO;IA8BvC,aAAa,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAwCpC,SAAS,IAAI,OAAO;IAWpB;;;;;;OAMG;IACH,oBAAoB,IAAI,OAAO;IAM/B,kBAAkB,IAAI,IAAI;IAQ1B;;;;;;OAMG;IACH,iBAAiB,IAAI,OAAO;IAI5B;;;;;;;;;OASG;IACH,kBAAkB,IAAI,OAAO;IAI7B,KAAK,IAAI,IAAI;IAIb,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAI/B;;;;;;;;OAQG;IACH,kCAAkC,IAAI,OAAO;IAK7C,SAAS,IAAI,OAAO;IAOd,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CA6B5B"}
+{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/session/process.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAKtC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGtD,OAAO,EAAmC,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAavC,eAAO,MAAM,oBAAoB,KAAK,CAAC;AA2GvC,eAAO,MAAM,yBAAyB,oDAAoD,CAAC;AAE3F;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,CAAC,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAMR;AAuCD,qBAAa,cAAe,SAAQ,YAAY;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAc;IAC7C,cAAc,SAAc;IAQ5B,OAAO,CAAC,6BAA6B,CAAuB;IAG5D,OAAO,CAAC,iBAAiB,CAAqC;IAM9D,OAAO,CAAC,2BAA2B,CAAS;IAC5C,OAAO,CAAC,mBAAmB,CAA8C;IACzE,QAAQ,CAAC,SAAS,SAAc;IAChC,qFAAqF;IACrF,OAAO,EAAE,WAAW,GAAG,UAAU,CAAc;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;IAMvB,YAAY,EAAE,MAAM,CAAwB;IAM5C,aAAa,EAAE,OAAO,CAAS;IAC/B,YAAY,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAQ;IAC1G,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAAK;IAKzB,OAAO,CAAC,WAAW,CAAK;IAOxB,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,eAAe,CAAS;IAUhC,OAAO,CAAC,OAAO,CAAS;IAMxB,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,cAAc,CAAmC;IACzD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,SAAS,UAAS;IAIlB,OAAO,CAAC,eAAe,CAAK;IAE5B,UAAU,SAAM;IAChB,OAAO,CAAC,qBAAqB,CAAK;IAKlC,OAAO,CAAC,qBAAqB,CAAqB;IAMlD,OAAO,CAAC,aAAa,CAAY;IACjC,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,YAAY,CAAM;IAE1B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,aAAa,CAAC,CAAyB;IAC/C,OAAO,CAAC,YAAY,CAAM;IAC1B,OAAO,CAAC,WAAW,CAAC,CAAgC;IACpD,OAAO,CAAC,aAAa,CAAS;IAE9B,OAAO,CAAC,oBAAoB,CAAC,CAAS;gBAGpC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,gBAAgB,EACxB,WAAW,EAAE,WAAW,EACxB,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,YAAY,EAC1B,MAAM,CAAC,EAAE,MAAM;IAmBjB;;;OAGG;IACH,OAAO,KAAK,SAAS,GAEpB;IAED,OAAO,CAAC,aAAa;IAMrB,wFAAwF;IACxF,IAAI,KAAK,IAAI,MAAM,CAElB;IAED,0EAA0E;IAC1E,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,gEAAgE;IAChE,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,OAAO,CAAC,cAAc;IAchB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;YA8Bb,kBAAkB;IA4DhC;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAMzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACH,OAAO,CAAC,uBAAuB;IAiE/B;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAW5B,OAAO,CAAC,cAAc;IA2HtB,8FAA8F;IAC9F,OAAO,CAAC,kBAAkB;IAY1B,qFAAqF;IACrF,OAAO,CAAC,kBAAkB;IAQ1B;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAY/B,OAAO,CAAC,SAAS;IAsCjB,OAAO,CAAC,MAAM,CAAC,gBAAgB;YAOjB,YAAY;IA8hB1B,OAAO,CAAC,eAAe;IA4DvB;;;;;OAKG;IACH,MAAM,CAAC,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAI5D;;;;;OAKG;IACH,OAAO,CAAC,4BAA4B;IAmBpC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IA+B/B;;;;;;OAMG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAmB/C;;;;;;;OAOG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAkBhC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAqB1D,IAAI,YAAY,IAAI,OAAO,CAA6B;IAExD,OAAO,CAAC,wBAAwB;IAYhC,OAAO,CAAC,iCAAiC;IAczC,OAAO,CAAC,4BAA4B;IAOpC;;;;;;;;OAQG;IACH,4BAA4B,IAAI,OAAO;IA8BvC,aAAa,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAwCpC,SAAS,IAAI,OAAO;IAWpB;;;;;;OAMG;IACH,oBAAoB,IAAI,OAAO;IAM/B,kBAAkB,IAAI,IAAI;IAQ1B;;;;;;OAMG;IACH,iBAAiB,IAAI,OAAO;IAI5B;;;;;;;;;OASG;IACH,kBAAkB,IAAI,OAAO;IAI7B,KAAK,IAAI,IAAI;IAIb,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAI/B;;;;;;;;OAQG;IACH,kCAAkC,IAAI,OAAO;IAK7C,SAAS,IAAI,OAAO;IAOd,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CA6B5B"}

package/dist/session/process.js

@@ -51,8 +51,35 @@ const logger_1 = require("../logger");
 const pty_stream_registry_1 = require("../shell/pty-stream-registry");
 const screen_1 = require("../shell/screen");
 const claude_bin_1 = require("./claude-bin");
+const claude_settings_1 = require("../config/claude-settings");
 const tool_labels_1 = require("../utils/tool-labels");
 exports.MAX_HISTORY_MESSAGES = 50;
+/**
+ * Claude credential / API-routing env vars forwarded from the host into an
+ * app-agent container. Deliberately narrow — auth and endpoint only. Model and
+ * behaviour settings come from the agent's own config, not the host env.
+ *
+ * The keys that prove an identity, as opposed to merely selecting an endpoint.
+ * These resolve as a group so a container is never handed two credentials from
+ * two different sources — see resolveContainerAuthEnv().
+ */
+const CONTAINER_CREDENTIAL_KEYS = [
+    'CLAUDE_CODE_OAUTH_TOKEN',
+    'ANTHROPIC_API_KEY',
+    'ANTHROPIC_AUTH_TOKEN',
+];
+/**
+ * The credential keys plus the endpoint selector. Derived from
+ * CONTAINER_CREDENTIAL_KEYS rather than repeated, so the two lists cannot drift:
+ * a credential added to one is automatically forwarded by the other.
+ *
+ * ANTHROPIC_BASE_URL is not a credential — it only selects an endpoint — so it
+ * sits outside the group that resolves atomically in resolveContainerAuthEnv().
+ */
+const CONTAINER_AUTH_ENV_KEYS = [
+    ...CONTAINER_CREDENTIAL_KEYS,
+    'ANTHROPIC_BASE_URL',
+];
 // The MCP reply tools that deliver an agent's user-facing message to a channel.
 // Their text lives in the tool_use `input.text`, not in an assistant text block,
 // so it is never captured by `assistantBuffer` — the reply is delivered to the
@@ -426,18 +453,117 @@ class SessionProcess extends events_1.EventEmitter {
         };
     }
     /**
-     * Read stdio MCP servers from Claude Code's user-scoped config (~/.claude/settings.json).
+     * Read stdio MCP servers from Claude Code's user-scoped config
+     * (`$CLAUDE_CONFIG_DIR/settings.json`, else `~/.claude/settings.json`).
      * Returns empty object if file doesn't exist, can't be parsed, or has no mcpServers.
      */
     readUserScopedMcp() {
-        try {
-            const settingsPath = path.join(os.homedir(), '.claude', 'settings.json');
-            const parsed = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
-            return parsed?.mcpServers ?? {};
-        }
-        catch {
+        const servers = (0, claude_settings_1.readClaudeSettings)()?.mcpServers;
+        if (!servers || typeof servers !== 'object' || Array.isArray(servers))
             return {};
+        return servers;
+    }
+    /**
+     * Resolve the Claude credentials handed to an app-agent container this spawn.
+     *
+     * Container agents used to receive their credentials as a read-only bind mount
+     * of the host ~/.claude/settings.json. A Docker *file* bind mount pins an
+     * inode rather than a path, and Claude Code rewrites that file by atomic
+     * rename — so the first host settings change left every long-lived container
+     * reading a deleted inode. Claude Code silently ignores a settings.json whose
+     * inode is unlinked, so the agent stayed healthy and answered every real user
+     * "Not logged in · Please run /login" until someone recreated the container.
+     *
+     * That mechanism was verified directly rather than inferred: with content held
+     * byte-identical (same md5) and only the link count differing, a container
+     * reading the unlinked inode reported "Not logged in" and sent no request,
+     * while the same file at nlink=1 authenticated normally.
+     *
+     * Resolving by path here is immune to that: the container is handed the
+     * current credentials every time a session subprocess is spawned. Because the
+     * unlinked file is *ignored* rather than merely stale, the forwarded env is
+     * what the CLI ends up using — so a container stuck on a stale mount recovers
+     * on its next session spawn, with no container recreate. Note the cadence is
+     * per spawn, not per turn: one `docker exec` serves a whole session and later
+     * turns are written to its stdin, so a rotated credential reaches a live
+     * session only when it is respawned (idle reap, restart or config change).
+     *
+     * settings.json wins over the gateway's own environment. That matches Claude
+     * Code, which applies the file's `env` block over whatever it inherited (also
+     * verified: with both sources set to different endpoints, every request went
+     * to the file's), and it keeps the live file as the single source of truth — a
+     * long-lived gateway started with an exported token would otherwise pin the
+     * container to a credential that can never be rotated without restarting the
+     * service.
+     *
+     * Credentials resolve as a GROUP, not key by key. If the file declares an
+     * identity at all, the gateway's environment must not contribute a *different*
+     * one: forwarding a file OAuth token alongside an environment
+     * ANTHROPIC_API_KEY would hand the container two identities and let the CLI
+     * choose between them silently. A base URL only selects an endpoint, so it is
+     * not part of that group and keeps its own independent fallback.
+     */
+    resolveContainerAuthEnv() {
+        // Resolved through the shared helper so an operator who relocated the config
+        // with CLAUDE_CONFIG_DIR is honoured here too. Hardcoding ~/.claude would
+        // read a path that does not exist and forward nothing — reproducing the very
+        // "Not logged in" failure this method was written to prevent.
+        const fileEnv = (0, claude_settings_1.claudeSettingsEnv)();
+        // Presence, not validity: a credential key spelled out in settings.json is
+        // authoritative for the whole group even when its value is malformed, so a
+        // broken token can never silently fall back to a different identity.
+        const fileDeclaresCredential = CONTAINER_CREDENTIAL_KEYS.some((k) => k in fileEnv);
+        const resolved = {};
+        const dropped = [];
+        for (const key of CONTAINER_AUTH_ENV_KEYS) {
+            let value;
+            let origin;
+            if (key in fileEnv) {
+                value = fileEnv[key];
+                origin = 'settings.json';
+            }
+            else if (fileDeclaresCredential && CONTAINER_CREDENTIAL_KEYS.includes(key)) {
+                continue; // the file owns the identity — don't mix in another one
+            }
+            else {
+                value = process.env[key];
+                origin = 'gateway env';
+            }
+            // settings.json is untrusted input: forward only a clean, non-empty
+            // string. A NUL byte throws at spawn, and a newline is never legitimate
+            // in a credential or a base URL.
+            if (value === undefined)
+                continue; // simply not set anywhere — not a defect
+            if (typeof value !== 'string') {
+                dropped.push({ key, reason: `${origin} value is ${typeof value}, not a string` });
+                continue;
+            }
+            if (value.length === 0) {
+                dropped.push({ key, reason: `${origin} value is empty` });
+                continue;
+            }
+            if (/[\0\r\n]/.test(value)) {
+                dropped.push({ key, reason: `${origin} value contains a NUL or newline` });
+                continue;
+            }
+            resolved[key] = value;
+        }
+        // Never fail silently. The bug this whole path exists to fix presented as a
+        // container that looked healthy while answering real users "Not logged in",
+        // so a spawn that forwards no credential at all must say so — otherwise a
+        // malformed token in settings.json reproduces the original symptom with the
+        // original silence. `dropped` names the reason without ever logging a value.
+        const forwardedCredentials = CONTAINER_CREDENTIAL_KEYS.filter((k) => k in resolved);
+        if (forwardedCredentials.length === 0) {
+            this.logger.warn('No Claude credential could be resolved for this container agent — it will likely report "Not logged in"', { sessionId: this.sessionId, dropped, checked: CONTAINER_AUTH_ENV_KEYS });
         }
+        else if (dropped.length > 0) {
+            this.logger.debug('Some container auth env vars were not forwarded', {
+                sessionId: this.sessionId,
+                dropped,
+            });
+        }
+        return resolved;
     }
     /**
      * Read stdio MCP servers from Claude Code's project-scoped config (~/.claude.json).
@@ -547,6 +673,11 @@ class SessionProcess extends events_1.EventEmitter {
                         IMAGE_API_KEY: process.env.IMAGE_API_KEY ?? process.env.ANTHROPIC_AUTH_TOKEN ?? '',
                         IMAGE_DISABLED: process.env.IMAGE_DISABLED ?? '',
                         IMAGE_POLL_TIMEOUT_MS: process.env.IMAGE_POLL_TIMEOUT_MS ?? '',
+                        // #444: the share bridge's env vars were renamed IMAGE_SHARE_* ->
+                        // SHARE_* when it stopped being image-only. Forward BOTH so an
+                        // operator who set either name keeps working; the MCP side reads
+                        // the neutral name first and falls back to the legacy one.
+                        SHARE_MAX_REFS: process.env.SHARE_MAX_REFS ?? '',
                         IMAGE_SHARE_MAX_REFS: process.env.IMAGE_SHARE_MAX_REFS ?? '',
                         // Short-lived public media URLs (LINE image delivery). line_image
                         // mints a share token via the gateway share bridge (using
@@ -732,12 +863,25 @@ class SessionProcess extends events_1.EventEmitter {
         const containerEnv = {
             HOME: os.homedir(),
             CLAUDE_WORKSPACE: '/workspace',
-            TELEGRAM_BOT_TOKEN: this.agentConfig.telegram?.botToken ?? '',
             GATEWAY_RESTART_SIGNAL_PATH: containerRestartPath,
         };
         if (process.env.GATEWAY_API_URL)
             containerEnv.GATEWAY_API_URL = process.env.GATEWAY_API_URL;
-        const dockerEnvFlags = Object.entries(containerEnv).flatMap(([k, v]) => ['-e', `${k}=${v}`]);
+        // Secrets are forwarded by NAME only (`-e KEY`, no `=value`), which makes
+        // Docker read the value from this process's own environment (set on the spawn
+        // below). The value therefore never lands on the docker argv, where any local
+        // user could read it out of `ps`: /proc/<pid>/cmdline is world-readable on a
+        // stock kernel, whereas /proc/<pid>/environ is owner-only.
+        //
+        // TELEGRAM_BOT_TOKEN travels by name for exactly the same reason as the
+        // Claude credentials — it is a bearer token for the agent's whole bot
+        // account. It is already placed in the spawn env below, unconditionally.
+        const containerAuthEnv = isAppAgent ? this.resolveContainerAuthEnv() : {};
+        const byNameKeys = ['TELEGRAM_BOT_TOKEN', ...Object.keys(containerAuthEnv)];
+        const dockerEnvFlags = [
+            ...Object.entries(containerEnv).flatMap(([k, v]) => ['-e', `${k}=${v}`]),
+            ...byNameKeys.flatMap((k) => ['-e', k]),
+        ];
         const spawnArgs = isAppAgent
             ? [
                 'exec', '--workdir', '/workspace', '--user', String(containerUid), '-i',
@@ -761,6 +905,7 @@ class SessionProcess extends events_1.EventEmitter {
         const proc = (0, child_process_1.spawn)(spawnBin, spawnArgs, {
             env: {
                 ...process.env,
+                ...containerAuthEnv,
                 ...(hardenedPath ? { PATH: hardenedPath } : {}),
                 CLAUDE_WORKSPACE: isAppAgent ? '/workspace' : this.agentConfig.workspace,
                 TELEGRAM_BOT_TOKEN: this.agentConfig.telegram?.botToken ?? '',