@agentclientprotocol/claude-agent-acp 0.73.0 → 0.74.0

package/dist/hide-claude-auth.d.ts

@@ -0,0 +1,145 @@
+/**
+ * `--hide-claude-auth`: this integration must never bill a claude.ai
+ * subscription. The flag hides the claude.ai login method from `initialize`
+ * and makes the agent behave like a logged-out CLI whenever a subscription
+ * would pay for a turn. `acp-agent.ts` decides *when* the guard applies (flag
+ * on, no provider override) and calls in here for the *what*.
+ *
+ * The account the CLI reports at `initialize` is the source of truth. The SDK
+ * memoizes it, so it is a constant for the life of a query, and two layers
+ * keep it honest:
+ *
+ * 1. Session creation refuses an account that holds no credential this
+ *    integration accepts. A logged-out session never exists, so the client's
+ *    sign-in always leads to a new session with a fresh `initialize`. The
+ *    per-turn guard repeats the check on the same cached account, which costs
+ *    microseconds and covers a session created under a provider override that
+ *    `providers/disable` later removed.
+ * 2. A sign-out during the session ends the query. The next turn recreates it,
+ *    so the next `initialize` reports the real account and layer 1 judges it.
+ *    The recreation resumes the stored conversation. When the CLI never wrote
+ *    one, because the first turn was the one that signed out, the recreation
+ *    starts a fresh query under the same session id instead.
+ *
+ * One case is left open. The CLI re-reads its credential store on its own. A
+ * file-based credential can therefore be removed and replaced by a claude.ai
+ * subscription between two turns. This covers a managed Console key and a key
+ * from a settings helper. No turn fails in between, so nothing ends the query,
+ * and the cached account still names the key that is gone. Closing this case
+ * would cost one `initialize` control request per turn. That buys too little
+ * for the price.
+ */
+import { RequestError } from "@agentclientprotocol/sdk";
+import type { AccountInfo, Query } from "@anthropic-ai/claude-agent-sdk";
+import type { SessionFailureController } from "./session-failure-extension.js";
+export declare function shouldHideClaudeAuth(): boolean;
+/**
+ * `data.reason` carried by the `authRequired` JSON-RPC error when the flag
+ * blocks a turn. From the client's point of view the agent is logged out (same
+ * error code and flow as a signed-out CLI); the reason lets it render a
+ * different hint. A string enum so further reasons can be added without a
+ * shape change.
+ */
+export declare const CLAUDE_SUBSCRIPTION_NOT_SUPPORTED_REASON = "claude_subscription_not_supported";
+export type AuthRequiredReason = typeof CLAUDE_SUBSCRIPTION_NOT_SUPPORTED_REASON;
+export declare const CLAUDE_SUBSCRIPTION_NOT_SUPPORTED_MESSAGE = "This integration does not support using claude.ai subscriptions.";
+/** The message of the plain sign-out refusal. It carries no `reason`: the
+ *  account holds nothing this integration can bill, which is the ordinary
+ *  signed-out state every ACP client already knows how to answer. */
+export declare const CLAUDE_LOGIN_REQUIRED_MESSAGE = "Sign in with an API key or a Console account to use this integration.";
+/**
+ * True when a turn on this account is paid by a claude.ai subscription.
+ *
+ * The SDK types `apiKeySource` and `tokenSource` as an open `string`, so this
+ * is an allowlist. An account bills the subscription only when every field
+ * proves it, and an unknown value keeps the guard on.
+ *
+ * - `subscriptionType` must be set. Without it the CLI reports no subscription.
+ * - `tokenSource` must be absent. The CLI sets it in place of the subscription
+ *   when a bearer or OAuth environment token pays for the turn.
+ * - `apiProvider` must be absent or `firstParty`. The SDK documents that the
+ *   Anthropic OAuth login applies only to `firstParty`; for a third-party
+ *   backend such as `bedrock`, `vertex`, `foundry` or `gateway` the other
+ *   fields are absent and the authentication is external.
+ * - `apiKeySource` must not be one of {@link API_KEY_SOURCES_ABOVE_SUBSCRIPTION}.
+ *   Claude Code's credential precedence puts those keys above the `/login`
+ *   subscription, so the key pays and the stored subscription is inert.
+ */
+export declare function billsClaudeSubscription(account: AccountInfo | undefined): boolean;
+/**
+ * True when the account already holds a credential this integration accepts:
+ * a third-party backend, a bearer or OAuth environment token, or one of the
+ * API key sources in {@link API_KEY_SOURCES_ABOVE_SUBSCRIPTION}.
+ *
+ * False therefore covers both the signed-out CLI and the account whose only
+ * credential is a claude.ai subscription. {@link billsClaudeSubscription} runs
+ * first and separates the two, so a caller that reaches a `false` here is
+ * looking at a session with no way to pay.
+ */
+export declare function holdsNonSubscriptionCredential(account: AccountInfo | undefined): boolean;
+export declare function claudeSubscriptionNotSupportedError(): RequestError;
+/** The signed-out refusal. Deliberately without `data`, so a client that reads
+ *  `data.reason` sees the plain ACP sign-out it already handles. */
+export declare function claudeLoginRequiredError(): RequestError;
+/**
+ * The state the guard keeps for one session. It lives on the session so that a
+ * concurrent pair of turns shares one account read and one failure row, and so
+ * that each degraded-guard warning is logged once.
+ */
+export type ClaudeSubscriptionGuardState = {
+    /** The in-flight guard run. Set before the first `await`. */
+    pendingRun?: Promise<RequestError | undefined>;
+    /** True after the "no account source" warning was logged for this session. */
+    degradedWarningLogged?: boolean;
+};
+export type GuardLogger = {
+    error: (...args: unknown[]) => void;
+    warn?: (...args: unknown[]) => void;
+};
+/**
+ * Report once per session that the guard cannot read the account at all. The
+ * guard is then absent, not passing. The CLI build decides this, not the user,
+ * so a message on every turn would only add noise.
+ */
+export declare function warnClaudeSubscriptionGuardDegraded(options: {
+    sessionId: string;
+    guardState: ClaudeSubscriptionGuardState;
+    logger: GuardLogger;
+    cause: string;
+}): void;
+type GuardOptions = {
+    sessionId: string;
+    query: Pick<Query, "accountInfo">;
+    guardState: ClaudeSubscriptionGuardState;
+    /** Built lazily: most turns pass and never need a controller. */
+    sessionFailures: () => SessionFailureController;
+    logger: GuardLogger;
+};
+/**
+ * The per-turn guard for a live session.
+ *
+ * It decides on the account the SDK cached at `initialize`, which is this
+ * integration's source of truth. That account is a constant for the life of
+ * the query, so the check costs microseconds. It still earns its place: it
+ * covers a session created under a provider override that `providers/disable`
+ * later removed, so the create-time check never ran for the routing in force
+ * now. A sign-out ends the query (see `markSessionForSignOutRespawn` in
+ * `acp-agent.ts`), so the next turn recreates it and `initialize` reports the
+ * real account. This guard does not see the residual case the module header
+ * names either.
+ *
+ * A turn is refused when the account bills a subscription, and also when it
+ * holds nothing this integration accepts, which is the user signing out in
+ * mid-session. The refusal mirrors the signed-out path exactly (see
+ * `failActiveWithSessionFailure` for `auth_required` in `acp-agent.ts`): every
+ * client gets the `authRequired` JSON-RPC rejection that starts its own auth
+ * flow, and a capable client additionally gets one session-scoped access
+ * failure whose `login` action stays the way back in.
+ *
+ * Fails open when no account can be read at all: session creation already
+ * refused every account without a usable credential, and an unavailable probe
+ * must not block a session that passed that check.
+ */
+export declare function refuseClaudeSubscriptionTurn(options: GuardOptions): Promise<void>;
+export {};
+//# sourceMappingURL=hide-claude-auth.d.ts.map

package/dist/hide-claude-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hide-claude-auth.d.ts","sourceRoot":"","sources":["../src/hide-claude-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAE/E,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wCAAwC,sCAAsC,CAAC;AAC5F,MAAM,MAAM,kBAAkB,GAAG,OAAO,wCAAwC,CAAC;AAEjF,eAAO,MAAM,yCAAyC,qEACc,CAAC;AAErE;;qEAEqE;AACrE,eAAO,MAAM,6BAA6B,0EAC+B,CAAC;AAmB1E;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CAWjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CAWxF;AAED,wBAAgB,mCAAmC,IAAI,YAAY,CAKlE;AAED;oEACoE;AACpE,wBAAgB,wBAAwB,IAAI,YAAY,CAEvD;AAED;;;;GAIG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,6DAA6D;IAC7D,UAAU,CAAC,EAAE,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IAC/C,8EAA8E;IAC9E,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACpC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACrC,CAAC;AAMF;;;;GAIG;AACH,wBAAgB,mCAAmC,CAAC,OAAO,EAAE;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,4BAA4B,CAAC;IACzC,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,IAAI,CAWP;AAED,KAAK,YAAY,GAAG;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAClC,UAAU,EAAE,4BAA4B,CAAC;IACzC,iEAAiE;IACjE,eAAe,EAAE,MAAM,wBAAwB,CAAC;IAChD,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAavF"}

package/dist/hide-claude-auth.js

@@ -0,0 +1,231 @@
+/**
+ * `--hide-claude-auth`: this integration must never bill a claude.ai
+ * subscription. The flag hides the claude.ai login method from `initialize`
+ * and makes the agent behave like a logged-out CLI whenever a subscription
+ * would pay for a turn. `acp-agent.ts` decides *when* the guard applies (flag
+ * on, no provider override) and calls in here for the *what*.
+ *
+ * The account the CLI reports at `initialize` is the source of truth. The SDK
+ * memoizes it, so it is a constant for the life of a query, and two layers
+ * keep it honest:
+ *
+ * 1. Session creation refuses an account that holds no credential this
+ *    integration accepts. A logged-out session never exists, so the client's
+ *    sign-in always leads to a new session with a fresh `initialize`. The
+ *    per-turn guard repeats the check on the same cached account, which costs
+ *    microseconds and covers a session created under a provider override that
+ *    `providers/disable` later removed.
+ * 2. A sign-out during the session ends the query. The next turn recreates it,
+ *    so the next `initialize` reports the real account and layer 1 judges it.
+ *    The recreation resumes the stored conversation. When the CLI never wrote
+ *    one, because the first turn was the one that signed out, the recreation
+ *    starts a fresh query under the same session id instead.
+ *
+ * One case is left open. The CLI re-reads its credential store on its own. A
+ * file-based credential can therefore be removed and replaced by a claude.ai
+ * subscription between two turns. This covers a managed Console key and a key
+ * from a settings helper. No turn fails in between, so nothing ends the query,
+ * and the cached account still names the key that is gone. Closing this case
+ * would cost one `initialize` control request per turn. That buys too little
+ * for the price.
+ */
+import { RequestError } from "@agentclientprotocol/sdk";
+export function shouldHideClaudeAuth() {
+    return process.argv.includes("--hide-claude-auth");
+}
+/**
+ * `data.reason` carried by the `authRequired` JSON-RPC error when the flag
+ * blocks a turn. From the client's point of view the agent is logged out (same
+ * error code and flow as a signed-out CLI); the reason lets it render a
+ * different hint. A string enum so further reasons can be added without a
+ * shape change.
+ */
+export const CLAUDE_SUBSCRIPTION_NOT_SUPPORTED_REASON = "claude_subscription_not_supported";
+export const CLAUDE_SUBSCRIPTION_NOT_SUPPORTED_MESSAGE = "This integration does not support using claude.ai subscriptions.";
+/** The message of the plain sign-out refusal. It carries no `reason`: the
+ *  account holds nothing this integration can bill, which is the ordinary
+ *  signed-out state every ACP client already knows how to answer. */
+export const CLAUDE_LOGIN_REQUIRED_MESSAGE = "Sign in with an API key or a Console account to use this integration.";
+/**
+ * The `apiKeySource` values that outrank a stored subscription.
+ *
+ * The SDK documents its `ApiKeySource` type as the origin of the credential
+ * used for API requests. `ANTHROPIC_API_KEY` is the environment variable,
+ * `apiKeyHelper` is the configured helper command, and `/login managed key` is
+ * a key that `/login` created with an Anthropic Console account. Each of the
+ * three is an API key that pays instead of the subscription. Every other
+ * member means no API key is in use: `none`, and the legacy `user`, `project`,
+ * `org`, `temporary` and `oauth` that current CLIs never emit.
+ */
+const API_KEY_SOURCES_ABOVE_SUBSCRIPTION = new Set([
+    "ANTHROPIC_API_KEY",
+    "apiKeyHelper",
+    "/login managed key",
+]);
+/**
+ * True when a turn on this account is paid by a claude.ai subscription.
+ *
+ * The SDK types `apiKeySource` and `tokenSource` as an open `string`, so this
+ * is an allowlist. An account bills the subscription only when every field
+ * proves it, and an unknown value keeps the guard on.
+ *
+ * - `subscriptionType` must be set. Without it the CLI reports no subscription.
+ * - `tokenSource` must be absent. The CLI sets it in place of the subscription
+ *   when a bearer or OAuth environment token pays for the turn.
+ * - `apiProvider` must be absent or `firstParty`. The SDK documents that the
+ *   Anthropic OAuth login applies only to `firstParty`; for a third-party
+ *   backend such as `bedrock`, `vertex`, `foundry` or `gateway` the other
+ *   fields are absent and the authentication is external.
+ * - `apiKeySource` must not be one of {@link API_KEY_SOURCES_ABOVE_SUBSCRIPTION}.
+ *   Claude Code's credential precedence puts those keys above the `/login`
+ *   subscription, so the key pays and the stored subscription is inert.
+ */
+export function billsClaudeSubscription(account) {
+    if (!account?.subscriptionType) {
+        return false;
+    }
+    if (account.tokenSource) {
+        return false;
+    }
+    if (account.apiProvider !== undefined && account.apiProvider !== "firstParty") {
+        return false;
+    }
+    return !API_KEY_SOURCES_ABOVE_SUBSCRIPTION.has(account.apiKeySource ?? "");
+}
+/**
+ * True when the account already holds a credential this integration accepts:
+ * a third-party backend, a bearer or OAuth environment token, or one of the
+ * API key sources in {@link API_KEY_SOURCES_ABOVE_SUBSCRIPTION}.
+ *
+ * False therefore covers both the signed-out CLI and the account whose only
+ * credential is a claude.ai subscription. {@link billsClaudeSubscription} runs
+ * first and separates the two, so a caller that reaches a `false` here is
+ * looking at a session with no way to pay.
+ */
+export function holdsNonSubscriptionCredential(account) {
+    if (!account) {
+        return false;
+    }
+    if (account.apiProvider !== undefined && account.apiProvider !== "firstParty") {
+        return true;
+    }
+    if (account.tokenSource) {
+        return true;
+    }
+    return API_KEY_SOURCES_ABOVE_SUBSCRIPTION.has(account.apiKeySource ?? "");
+}
+export function claudeSubscriptionNotSupportedError() {
+    return RequestError.authRequired({ reason: CLAUDE_SUBSCRIPTION_NOT_SUPPORTED_REASON }, CLAUDE_SUBSCRIPTION_NOT_SUPPORTED_MESSAGE);
+}
+/** The signed-out refusal. Deliberately without `data`, so a client that reads
+ *  `data.reason` sees the plain ACP sign-out it already handles. */
+export function claudeLoginRequiredError() {
+    return RequestError.authRequired(undefined, CLAUDE_LOGIN_REQUIRED_MESSAGE);
+}
+function warn(logger, message) {
+    (logger.warn ?? logger.error).call(logger, message);
+}
+/**
+ * Report once per session that the guard cannot read the account at all. The
+ * guard is then absent, not passing. The CLI build decides this, not the user,
+ * so a message on every turn would only add noise.
+ */
+export function warnClaudeSubscriptionGuardDegraded(options) {
+    const { guardState } = options;
+    if (guardState.degradedWarningLogged) {
+        return;
+    }
+    guardState.degradedWarningLogged = true;
+    warn(options.logger, `Session ${options.sessionId}: the --hide-claude-auth subscription guard is degraded ` +
+        `(${options.cause}). This session cannot detect a claude.ai subscription.`);
+}
+/**
+ * The per-turn guard for a live session.
+ *
+ * It decides on the account the SDK cached at `initialize`, which is this
+ * integration's source of truth. That account is a constant for the life of
+ * the query, so the check costs microseconds. It still earns its place: it
+ * covers a session created under a provider override that `providers/disable`
+ * later removed, so the create-time check never ran for the routing in force
+ * now. A sign-out ends the query (see `markSessionForSignOutRespawn` in
+ * `acp-agent.ts`), so the next turn recreates it and `initialize` reports the
+ * real account. This guard does not see the residual case the module header
+ * names either.
+ *
+ * A turn is refused when the account bills a subscription, and also when it
+ * holds nothing this integration accepts, which is the user signing out in
+ * mid-session. The refusal mirrors the signed-out path exactly (see
+ * `failActiveWithSessionFailure` for `auth_required` in `acp-agent.ts`): every
+ * client gets the `authRequired` JSON-RPC rejection that starts its own auth
+ * flow, and a capable client additionally gets one session-scoped access
+ * failure whose `login` action stays the way back in.
+ *
+ * Fails open when no account can be read at all: session creation already
+ * refused every account without a usable credential, and an unavailable probe
+ * must not block a session that passed that check.
+ */
+export async function refuseClaudeSubscriptionTurn(options) {
+    // Concurrent turns must not each re-read the account and each publish a row.
+    // Store the run before the first await, and let the others await the same one.
+    const { guardState } = options;
+    const run = (guardState.pendingRun ??= evaluateGuard(options).finally(() => {
+        if (guardState.pendingRun === run) {
+            guardState.pendingRun = undefined;
+        }
+    }));
+    const refusal = await run;
+    if (refusal) {
+        throw refusal;
+    }
+}
+/** Read the account, publish at most one failure row, and return the error the
+ *  turn must be rejected with. Never throws: an unreadable account fails open. */
+async function evaluateGuard(options) {
+    const account = await readGuardAccount(options);
+    if (!account) {
+        return undefined;
+    }
+    if (billsClaudeSubscription(account)) {
+        await publishRefusal(options.sessionFailures(), {
+            details: CLAUDE_SUBSCRIPTION_NOT_SUPPORTED_MESSAGE,
+            reason: CLAUDE_SUBSCRIPTION_NOT_SUPPORTED_REASON,
+        });
+        return claudeSubscriptionNotSupportedError();
+    }
+    if (!holdsNonSubscriptionCredential(account)) {
+        await publishRefusal(options.sessionFailures(), { details: CLAUDE_LOGIN_REQUIRED_MESSAGE });
+        return claudeLoginRequiredError();
+    }
+    return undefined;
+}
+/** The account the SDK cached at `initialize`. `undefined` when the query
+ *  cannot answer at all. */
+async function readGuardAccount(options) {
+    const { query } = options;
+    if (typeof query.accountInfo !== "function") {
+        warnClaudeSubscriptionGuardDegraded({
+            ...options,
+            cause: "the SDK query has no accountInfo method",
+        });
+        return undefined;
+    }
+    try {
+        return await query.accountInfo();
+    }
+    catch (error) {
+        options.logger.error(`Session ${options.sessionId}: accountInfo failed; skipping the subscription check for this turn:`, error instanceof Error ? error.message : String(error));
+        return undefined;
+    }
+}
+/** The refusal state does not change between turns: publish once, and skip a
+ *  republish while the previous failure with this reason is still active. */
+async function publishRefusal(sessionFailures, failure) {
+    if (sessionFailures.hasActiveSessionError("auth_required", failure.reason)) {
+        return;
+    }
+    await sessionFailures.publish("auth_required", {
+        sessionScoped: true,
+        details: failure.details,
+        ...(failure.reason ? { reason: failure.reason } : {}),
+    });
+}

package/dist/session-failure-extension.d.ts

@@ -15,6 +15,10 @@ export type PublishedSessionFailure = {
     severity: AirSessionFailureSeverity;
     title: string;
     details?: string;
+    /** A machine-readable refinement of `kind`, e.g. the `--hide-claude-auth`
+     *  subscription guard's reason on an `auth_required` failure. Absent for a
+     *  plain sign-out. */
+    reason?: string;
     actions: AirSessionFailureAction[];
     recoveryPolicy: SessionFailureRecoveryPolicy;
 };
@@ -24,6 +28,7 @@ type SessionFailureOptions = {
     title?: string;
     details?: string;
     severity?: AirSessionFailureSeverity;
+    reason?: string;
 };
 export type SessionFailureState = {
     epoch: string;
@@ -71,6 +76,16 @@ export declare class SessionFailureController {
     });
     private isSupported;
     private emit;
+    /** Whether a session-scoped error of `kind` is active. A turn-scoped
+     *  warning of the same kind (an `api_retry` notice) does not count: it
+     *  reports a retry in progress, not the state the error would publish.
+     *
+     *  `reason` refines `kind`, so the active record must carry the same one,
+     *  and an omitted `reason` matches only a record with no reason. A plain
+     *  sign-out and the `--hide-claude-auth` subscription refusal are both
+     *  `auth_required`, but they tell the user different things. Neither may
+     *  suppress the other. */
+    hasActiveSessionError(kind: ClaudeFailureKind, reason?: string): boolean;
     recordActive(failure: PublishedSessionFailure): void;
     clear(shouldClear?: (failure: PublishedSessionFailure) => boolean): Promise<boolean>;
     prepare(kind: ClaudeFailureKind, failureOptions?: SessionFailureOptions): Promise<PublishedSessionFailure | undefined>;

package/dist/session-failure-extension.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-failure-extension.d.ts","sourceRoot":"","sources":["../src/session-failure-extension.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACxF,OAAO,EACL,kBAAkB,EAClB,KAAK,wBAAwB,EAE9B,MAAM,gCAAgC,CAAC;AASxC,wBAAgB,+BAA+B,CAAC,GAAG,sBAAsB,EAAE,MAAM,EAAE,2BAElF;AAED,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,eAAe,GACf,aAAa,GACb,kBAAkB,GAClB,mBAAmB,GACnB,gBAAgB,GAChB,YAAY,GACZ,gBAAgB,GAChB,iBAAiB,GACjB,cAAc,GACd,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB,KAAK,yBAAyB,GAC5B,YAAY,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAExE,KAAK,yBAAyB,GAAG,SAAS,GAAG,OAAO,CAAC;AACrD,KAAK,uBAAuB,GAAG,OAAO,GAAG,OAAO,GAAG,aAAa,CAAC;AAEjE,KAAK,4BAA4B,GAC/B,OAAO,GAAG,cAAc,GAAG,oBAAoB,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAErF,MAAM,MAAM,uBAAuB,GAAG;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,iBAAiB,CAAC;IACxB,QAAQ,EAAE,yBAAyB,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,yBAAyB,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACnC,cAAc,EAAE,4BAA4B,CAAC;CAC9C,CAAC;AAEF,KAAK,qBAAqB,GAAG;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,yBAAyB,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C,CAAC;AAEF,KAAK,MAAM,GAAG;IACZ,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACrC,CAAC;AAEF,wBAAgB,yBAAyB,IAAI,mBAAmB,CAM/D;AAwED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,uBAAuB,2BAUlE;AAED;;;iFAGiF;AACjF,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAkB5E;AAED,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,OAAO,GAAG,OAAO,CAOzE;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,GACvD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAmB7C;AAED,wBAAgB,0BAA0B,CAAC,YAAY,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAErF;AAqBD;;+EAE+E;AAC/E,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAqB;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuD;IAClF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,OAAO,EAAE;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,mBAAmB,CAAC;QAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;QAClC,SAAS,EAAE,MAAM,OAAO,CAAC;QACzB,UAAU,EAAE,CAAC,YAAY,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,EAAE,MAAM,CAAC;KAChB;IASD,OAAO,CAAC,WAAW;YAIL,IAAI;IAwBlB,YAAY,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAO9C,KAAK,CACT,WAAW,GAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAoB,GACtE,OAAO,CAAC,OAAO,CAAC;IAUb,OAAO,CACX,IAAI,EAAE,iBAAiB,EACvB,cAAc,GAAE,qBAA0B,GACzC,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC;IAkDzC,OAAO,CACX,IAAI,EAAE,iBAAiB,EACvB,cAAc,GAAE,qBAA0B,GACzC,OAAO,CAAC,IAAI,CAAC;IAMV,OAAO,CACX,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,iBAAiB,EACvB,KAAK,EAAE,MAAM,EACb,MAAM,UAAO,GACZ,OAAO,CAAC,OAAO,CAAC;CAsBpB;AAED,wBAAgB,uBAAuB,CACrC,SAAS,CAAC,EAAE,wBAAwB,EACpC,YAAY,UAAQ,GACnB,iBAAiB,CAyBnB"}
+{"version":3,"file":"session-failure-extension.d.ts","sourceRoot":"","sources":["../src/session-failure-extension.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACxF,OAAO,EACL,kBAAkB,EAClB,KAAK,wBAAwB,EAE9B,MAAM,gCAAgC,CAAC;AASxC,wBAAgB,+BAA+B,CAAC,GAAG,sBAAsB,EAAE,MAAM,EAAE,2BAElF;AAED,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,eAAe,GACf,aAAa,GACb,kBAAkB,GAClB,mBAAmB,GACnB,gBAAgB,GAChB,YAAY,GACZ,gBAAgB,GAChB,iBAAiB,GACjB,cAAc,GACd,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB,KAAK,yBAAyB,GAC5B,YAAY,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAExE,KAAK,yBAAyB,GAAG,SAAS,GAAG,OAAO,CAAC;AACrD,KAAK,uBAAuB,GAAG,OAAO,GAAG,OAAO,GAAG,aAAa,CAAC;AAEjE,KAAK,4BAA4B,GAC/B,OAAO,GAAG,cAAc,GAAG,oBAAoB,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAErF,MAAM,MAAM,uBAAuB,GAAG;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,iBAAiB,CAAC;IACxB,QAAQ,EAAE,yBAAyB,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,yBAAyB,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;0BAEsB;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACnC,cAAc,EAAE,4BAA4B,CAAC;CAC9C,CAAC;AAEF,KAAK,qBAAqB,GAAG;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C,CAAC;AAEF,KAAK,MAAM,GAAG;IACZ,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACrC,CAAC;AAEF,wBAAgB,yBAAyB,IAAI,mBAAmB,CAM/D;AAwED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,uBAAuB,2BAWlE;AAED;;;iFAGiF;AACjF,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAkB5E;AAED,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,OAAO,GAAG,OAAO,CAOzE;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,GACvD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAmB7C;AAED,wBAAgB,0BAA0B,CAAC,YAAY,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAErF;AAqBD;;+EAE+E;AAC/E,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAqB;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuD;IAClF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,OAAO,EAAE;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,mBAAmB,CAAC;QAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;QAClC,SAAS,EAAE,MAAM,OAAO,CAAC;QACzB,UAAU,EAAE,CAAC,YAAY,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,EAAE,MAAM,CAAC;KAChB;IASD,OAAO,CAAC,WAAW;YAIL,IAAI;IAwBlB;;;;;;;;8BAQ0B;IAC1B,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO;IAcxE,YAAY,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAO9C,KAAK,CACT,WAAW,GAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAoB,GACtE,OAAO,CAAC,OAAO,CAAC;IAUb,OAAO,CACX,IAAI,EAAE,iBAAiB,EACvB,cAAc,GAAE,qBAA0B,GACzC,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC;IAmDzC,OAAO,CACX,IAAI,EAAE,iBAAiB,EACvB,cAAc,GAAE,qBAA0B,GACzC,OAAO,CAAC,IAAI,CAAC;IAMV,OAAO,CACX,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,iBAAiB,EACvB,KAAK,EAAE,MAAM,EACb,MAAM,UAAO,GACZ,OAAO,CAAC,OAAO,CAAC;CAsBpB;AAED,wBAAgB,uBAAuB,CACrC,SAAS,CAAC,EAAE,wBAAwB,EACpC,YAAY,UAAQ,GACnB,iBAAiB,CAyBnB"}

package/dist/session-failure-extension.js

@@ -81,6 +81,7 @@ export function sessionFailureMeta(failure) {
         severity: failure.severity,
         title: failure.title,
         ...(failure.details ? { details: failure.details } : {}),
+        ...(failure.reason ? { reason: failure.reason } : {}),
         actions: failure.actions,
     });
 }
@@ -200,6 +201,26 @@ export class SessionFailureController {
             return false;
         }
     }
+    /** Whether a session-scoped error of `kind` is active. A turn-scoped
+     *  warning of the same kind (an `api_retry` notice) does not count: it
+     *  reports a retry in progress, not the state the error would publish.
+     *
+     *  `reason` refines `kind`, so the active record must carry the same one,
+     *  and an omitted `reason` matches only a record with no reason. A plain
+     *  sign-out and the `--hide-claude-auth` subscription refusal are both
+     *  `auth_required`, but they tell the user different things. Neither may
+     *  suppress the other. */
+    hasActiveSessionError(kind, reason) {
+        for (const failure of this.state.active.values()) {
+            if (failure.kind === kind &&
+                failure.severity === "error" &&
+                failure.turnId === undefined &&
+                failure.reason === reason) {
+                return true;
+            }
+        }
+        return false;
+    }
     recordActive(failure) {
         this.state.revisions.set(failure.id, failure.revision);
         this.state.active.set(failure.id, failure);
@@ -255,6 +276,7 @@ export class SessionFailureController {
             severity: failureOptions.severity ?? "error",
             title,
             ...(failureOptions.details ? { details: failureOptions.details } : {}),
+            ...(failureOptions.reason ? { reason: failureOptions.reason } : {}),
             actions: failureOptions.severity === "warning" ? [] : policy.actions,
             recoveryPolicy: sessionFailureRecoveryPolicy(kind, failureOptions.turnId && !failureOptions.sessionScoped ? failureOptions.turnId : undefined),
             ...(failureOptions.turnId && !failureOptions.sessionScoped

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.73.0",
+  "version": "0.74.0",
   "description": "An ACP-compatible coding agent powered by the Claude Agent SDK (TypeScript)",
   "main": "dist/lib.js",
   "types": "dist/lib.d.ts",