@algosuite/vo-mcp 0.2.0-beta.27 → 0.2.0-beta.28

package/dist/agent-auth-probe-cli.mjs

@@ -190,7 +190,8 @@ function wantsKey(env) {
   return isTruthyFlag(env[CLAUDE_PREFER_KEY_ENV]) || isTruthyFlag(env[PREFER_KEY_ENV]);
 }
 function withAnthropicKey(baseEnv = {}, { getKey = getAnthropicKey, probeLogin = probeClaudeLoginState } = {}) {
-  if (wantsLogin(baseEnv)) {
+  const preferKey = wantsKey(baseEnv);
+  if (!preferKey && wantsLogin(baseEnv)) {
     const next = { ...baseEnv };
     delete next.ANTHROPIC_API_KEY;
     return next;
@@ -198,19 +199,20 @@ function withAnthropicKey(baseEnv = {}, { getKey = getAnthropicKey, probeLogin =
   if (baseEnv.ANTHROPIC_API_KEY) return { ...baseEnv };
   const key = getKey();
   if (!key) return { ...baseEnv };
-  if (!wantsKey(baseEnv) && probeLogin() === true) return { ...baseEnv };
+  if (!preferKey && probeLogin() === true) return { ...baseEnv };
   return { ...baseEnv, ANTHROPIC_API_KEY: key };
 }
 function claudeCostBasis(env = process.env) {
   return String(env.ANTHROPIC_API_KEY || "").trim() ? "vendor_billed" : "subscription_api_equivalent";
 }
 function describeAnthropicAuthSource(baseEnv = {}, { getKey = getAnthropicKey, probeLogin = probeClaudeLoginState } = {}) {
-  if (wantsLogin(baseEnv)) {
+  const preferKey = wantsKey(baseEnv);
+  if (!preferKey && wantsLogin(baseEnv)) {
     return "claude auth login (VO_RUNNER_PREFER_LOGIN set \u2014 any API key ignored)";
   }
   if (baseEnv.ANTHROPIC_API_KEY) return "ANTHROPIC_API_KEY from environment";
   if (!getKey()) return "claude auth login session (no API key set)";
-  if (wantsKey(baseEnv)) {
+  if (preferKey) {
     return "ANTHROPIC_API_KEY from OS keychain (VO_RUNNER_PREFER_KEY set \u2014 subscription ignored)";
   }
   if (probeLogin() === true) {
@@ -1347,7 +1349,7 @@ var OpenAICompatibleRunner = class {
   buildArgs(opts = {}) {
     void opts;
     throw new Error(
-      "OpenAI-compatible full-repository coding is disabled. Use an explicit sanitized task capsule through the AlgoSuite Model Firewall."
+      "OpenAI-compatible full-repository coding is disabled. The `oai` runner lane is RETIRED (PR #8742) and executes nothing. Set VO_CODE_RUNNER_AGENT to claude, codex, cursor, local, or meta. Use an explicit sanitized task capsule through the AlgoSuite Model Firewall."
     );
   }
   /** Codex JSONL events map identically → reuse the proven parser. */
@@ -1370,14 +1372,14 @@ var OpenAICompatibleRunner = class {
   describeAuth(env = process.env) {
     const hasKey = Boolean(String(env[OAI_API_KEY_ENV] || "").trim());
     const baseUrl = resolveOaiBaseUrl(env);
-    return `oai-compat endpoint=${baseUrl || "<unset>"} key=${hasKey ? "set" : "MISSING"}`;
+    return `oai-compat RETIRED endpoint=${baseUrl || "<unset>"} key=${hasKey ? "set" : "MISSING"}`;
   }
-  /** Best-effort: base URL chosen AND the codex transport is installed. */
+  /** Always unavailable: the lane is retired, so nothing can authenticate it. */
   async checkAuth() {
     return {
       installed: false,
       authenticated: false,
-      message: "OpenAI-compatible coding is disabled; sanitized Model Firewall task capsules only"
+      message: "the `oai` lane is RETIRED (PR #8742); OpenAI-compatible coding is disabled \u2014 sanitized Model Firewall task capsules only"
     };
   }
 };

package/dist/runner-cli.js

@@ -3033,7 +3033,8 @@ function wantsKey(env2) {
   return isTruthyFlag(env2[CLAUDE_PREFER_KEY_ENV]) || isTruthyFlag(env2[PREFER_KEY_ENV]);
 }
 function withAnthropicKey(baseEnv = {}, { getKey = getAnthropicKey, probeLogin = probeClaudeLoginState } = {}) {
-  if (wantsLogin(baseEnv)) {
+  const preferKey = wantsKey(baseEnv);
+  if (!preferKey && wantsLogin(baseEnv)) {
     const next = { ...baseEnv };
     delete next.ANTHROPIC_API_KEY;
     return next;
@@ -3041,19 +3042,20 @@ function withAnthropicKey(baseEnv = {}, { getKey = getAnthropicKey, probeLogin =
   if (baseEnv.ANTHROPIC_API_KEY) return { ...baseEnv };
   const key = getKey();
   if (!key) return { ...baseEnv };
-  if (!wantsKey(baseEnv) && probeLogin() === true) return { ...baseEnv };
+  if (!preferKey && probeLogin() === true) return { ...baseEnv };
   return { ...baseEnv, ANTHROPIC_API_KEY: key };
 }
 function claudeCostBasis(env2 = process.env) {
   return String(env2.ANTHROPIC_API_KEY || "").trim() ? "vendor_billed" : "subscription_api_equivalent";
 }
 function describeAnthropicAuthSource(baseEnv = {}, { getKey = getAnthropicKey, probeLogin = probeClaudeLoginState } = {}) {
-  if (wantsLogin(baseEnv)) {
+  const preferKey = wantsKey(baseEnv);
+  if (!preferKey && wantsLogin(baseEnv)) {
     return "claude auth login (VO_RUNNER_PREFER_LOGIN set \u2014 any API key ignored)";
   }
   if (baseEnv.ANTHROPIC_API_KEY) return "ANTHROPIC_API_KEY from environment";
   if (!getKey()) return "claude auth login session (no API key set)";
-  if (wantsKey(baseEnv)) {
+  if (preferKey) {
     return "ANTHROPIC_API_KEY from OS keychain (VO_RUNNER_PREFER_KEY set \u2014 subscription ignored)";
   }
   if (probeLogin() === true) {
@@ -3068,13 +3070,13 @@ function augmentAuthError(summary) {
 \u21B3 Anthropic auth failed on the runner. The \`claude\` CLI is a SEPARATE install/login from the Claude Desktop app and the Claude Code IDE extension \u2014 signing into those does NOT authenticate it. Fix: run \`claude auth login\` (Claude subscription) on the runner machine, or clear any stale ANTHROPIC_API_KEY (env / OS keychain / .env.local) and set VO_RUNNER_PREFER_LOGIN=1 \u2014 then restart the runner. Verify with \`claude -p "say hi"\`.`;
 }
 function probeClaudeLoginState({
-  spawn: spawn6 = spawnSync2,
+  spawn: spawn5 = spawnSync2,
   buildWindowsLaunch = buildWindowsClaudeLaunch,
   platform = process.platform
 } = {}) {
   try {
     const launch = platform === "win32" ? buildWindowsLaunch({ bin: "claude", args: ["auth", "status"] }) : { bin: "claude", args: ["auth", "status"], spawnOptions: { windowsHide: true } };
-    const st = spawn6(launch.bin, launch.args, { ...launch.spawnOptions, timeout: 5e3, encoding: "utf8" });
+    const st = spawn5(launch.bin, launch.args, { ...launch.spawnOptions, timeout: 5e3, encoding: "utf8" });
     const parsed = JSON.parse(String(st.stdout || "").trim() || "{}");
     return typeof parsed.loggedIn === "boolean" ? parsed.loggedIn : null;
   } catch {
@@ -3327,11 +3329,11 @@ import { spawnSync as spawnSync4 } from "node:child_process";
 function terminateAgentProcessTree({
   child,
   platform = process.platform,
-  spawn: spawn6 = spawnSync4
+  spawn: spawn5 = spawnSync4
 } = {}) {
   if (!child || !Number.isInteger(child.pid) || child.pid <= 0) return false;
   if (platform === "win32") {
-    const result = spawn6("taskkill", ["/PID", String(child.pid), "/T", "/F"], {
+    const result = spawn5("taskkill", ["/PID", String(child.pid), "/T", "/F"], {
       windowsHide: true,
       stdio: "ignore",
       timeout: 15e3
@@ -3507,11 +3509,11 @@ function windowsSystemRoot(env2 = process.env) {
 function windowsPowershellExe(env2 = process.env) {
   return path11.join(windowsSystemRoot(env2), "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
 }
-function listProcessCreationTimes({ platform = process.platform, spawn: spawn6 = spawnSync5, env: env2 = process.env, warn = console.warn } = {}) {
+function listProcessCreationTimes({ platform = process.platform, spawn: spawn5 = spawnSync5, env: env2 = process.env, warn = console.warn } = {}) {
   const map = /* @__PURE__ */ new Map();
   if (platform === "win32") {
     const ps = "Get-CimInstance Win32_Process | ForEach-Object { '{0} {1}' -f $_.ProcessId, (([DateTimeOffset]$_.CreationDate.ToUniversalTime()).ToUnixTimeMilliseconds()) }";
-    const result2 = spawn6(windowsPowershellExe(env2), ["-NoProfile", "-NonInteractive", "-Command", ps], {
+    const result2 = spawn5(windowsPowershellExe(env2), ["-NoProfile", "-NonInteractive", "-Command", ps], {
       windowsHide: true,
       encoding: "utf8",
       timeout: 2e4,
@@ -3527,7 +3529,7 @@ function listProcessCreationTimes({ platform = process.platform, spawn: spawn6 =
     }
     return map;
   }
-  const result = spawn6("ps", ["-eo", "pid=,lstart="], { encoding: "utf8", timeout: 2e4, maxBuffer: 32 * 1024 * 1024 });
+  const result = spawn5("ps", ["-eo", "pid=,lstart="], { encoding: "utf8", timeout: 2e4, maxBuffer: 32 * 1024 * 1024 });
   if (result.error || result.status !== 0 || typeof result.stdout !== "string") {
     warn(`[orphan-reaper] process enumeration failed (${result.error ? result.error.message : `ps exit ${result.status}`}); reaping nothing this cycle`);
     return map;
@@ -3547,11 +3549,11 @@ function parsePosixPsLine(line) {
   if (!Number.isInteger(pid) || pid <= 0 || !Number.isFinite(when)) return null;
   return { pid, creationMs: when };
 }
-function killProcessTree(pid, { platform = process.platform, spawn: spawn6 = spawnSync5, env: env2 = process.env } = {}) {
+function killProcessTree(pid, { platform = process.platform, spawn: spawn5 = spawnSync5, env: env2 = process.env } = {}) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
   if (platform === "win32") {
     const taskkill = path11.join(windowsSystemRoot(env2), "System32", "taskkill.exe");
-    const r = spawn6(taskkill, ["/PID", String(pid), "/T", "/F"], { windowsHide: true, stdio: "ignore", timeout: 15e3 });
+    const r = spawn5(taskkill, ["/PID", String(pid), "/T", "/F"], { windowsHide: true, stdio: "ignore", timeout: 15e3 });
     return !r.error && r.status === 0;
   }
   try {
@@ -4451,8 +4453,8 @@ var init_codex_runner = __esm({
     CODEX_PREFER_LOGIN_ENV = "VO_RUNNER_CODEX_PREFER_LOGIN";
     LEGACY_PREFER_LOGIN_ENV = "VO_RUNNER_PREFER_LOGIN";
     CodexRunner = class {
-      constructor({ spawn: spawn6 = spawnSync6, resolveBinary = resolveCodexBinary, env: env2 = process.env } = {}) {
-        this.spawn = spawn6;
+      constructor({ spawn: spawn5 = spawnSync6, resolveBinary = resolveCodexBinary, env: env2 = process.env } = {}) {
+        this.spawn = spawn5;
         this.resolveBinary = resolveBinary;
         this.env = env2;
       }
@@ -4821,12 +4823,12 @@ var init_local_model_runner = __esm({
     LOCAL_MODEL_RE = new RegExp("^[A-Za-z0-9][A-Za-z0-9._/:-]{0,127}$");
     LocalModelRunner = class {
       constructor({
-        spawn: spawn6 = null,
+        spawn: spawn5 = null,
         resolveBinary = resolveCodexBinary,
         env: env2 = process.env,
         fetchImpl = globalThis.fetch
       } = {}) {
-        this.spawn = spawn6;
+        this.spawn = spawn5;
         this.resolveBinary = resolveBinary;
         this.env = env2;
         this.fetchImpl = fetchImpl;
@@ -5012,7 +5014,7 @@ var init_openai_compatible_runner = __esm({
       buildArgs(opts = {}) {
         void opts;
         throw new Error(
-          "OpenAI-compatible full-repository coding is disabled. Use an explicit sanitized task capsule through the AlgoSuite Model Firewall."
+          "OpenAI-compatible full-repository coding is disabled. The `oai` runner lane is RETIRED (PR #8742) and executes nothing. Set VO_CODE_RUNNER_AGENT to claude, codex, cursor, local, or meta. Use an explicit sanitized task capsule through the AlgoSuite Model Firewall."
         );
       }
       /** Codex JSONL events map identically → reuse the proven parser. */
@@ -5035,14 +5037,14 @@ var init_openai_compatible_runner = __esm({
       describeAuth(env2 = process.env) {
         const hasKey = Boolean(String(env2[OAI_API_KEY_ENV] || "").trim());
         const baseUrl = resolveOaiBaseUrl(env2);
-        return `oai-compat endpoint=${baseUrl || "<unset>"} key=${hasKey ? "set" : "MISSING"}`;
+        return `oai-compat RETIRED endpoint=${baseUrl || "<unset>"} key=${hasKey ? "set" : "MISSING"}`;
       }
-      /** Best-effort: base URL chosen AND the codex transport is installed. */
+      /** Always unavailable: the lane is retired, so nothing can authenticate it. */
       async checkAuth() {
         return {
           installed: false,
           authenticated: false,
-          message: "OpenAI-compatible coding is disabled; sanitized Model Firewall task capsules only"
+          message: "the `oai` lane is RETIRED (PR #8742); OpenAI-compatible coding is disabled \u2014 sanitized Model Firewall task capsules only"
         };
       }
     };
@@ -7731,83 +7733,6 @@ var init_codex = __esm({
   }
 });
 
-// ../../scripts/virtual-office/code-runner/account-usage/copilot.mjs
-import { spawn as spawn5 } from "node:child_process";
-function parseCopilotUsage(body, { now = () => Date.now() } = {}) {
-  if (!body || typeof body !== "object") return null;
-  const snapshots = body.quota_snapshots;
-  if (!snapshots || typeof snapshots !== "object") return null;
-  const bucket = snapshots[METERED_BUCKET];
-  if (!bucket || typeof bucket !== "object") return null;
-  if (bucket.unlimited === true || bucket.has_quota === false) return null;
-  const remaining = clampPct(bucket.percent_remaining);
-  if (remaining === null) return null;
-  const resetDate = typeof body.quota_reset_date === "string" ? body.quota_reset_date : null;
-  const resetsAt = resetDate && /^\d{4}-\d{2}-\d{2}$/.test(resetDate) ? `${resetDate}T00:00:00.000Z` : null;
-  return makeUsageRow({
-    agent: "copilot",
-    source: "cli",
-    capturedAt: new Date(now()).toISOString(),
-    // The API reports REMAINING; every row in this system stores USED.
-    monthly: 100 - remaining,
-    monthlyResetsAt: resetsAt,
-    accountId: typeof body.login === "string" ? body.login : null
-  });
-}
-function readCopilotUsage({
-  spawnImpl = spawn5,
-  timeoutMs = 8e3,
-  env: env2 = process.env,
-  now = () => Date.now()
-} = {}) {
-  return new Promise((resolve2) => {
-    let child;
-    let settled = false;
-    let stdout = "";
-    const finish = (value) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      try {
-        child?.kill();
-      } catch {
-      }
-      resolve2(value);
-    };
-    const timer = setTimeout(() => finish(null), timeoutMs);
-    try {
-      child = spawnImpl("gh", ["api", "copilot_internal/user"], {
-        env: env2,
-        windowsHide: true,
-        shell: false,
-        stdio: ["ignore", "pipe", "ignore"]
-      });
-      child.on("error", () => finish(null));
-      child.stdout?.on("data", (chunk) => {
-        stdout += chunk.toString();
-      });
-      child.on("close", (code) => {
-        if (code !== 0) return finish(null);
-        try {
-          finish(parseCopilotUsage(JSON.parse(stdout), { now }));
-        } catch {
-          finish(null);
-        }
-      });
-    } catch {
-      finish(null);
-    }
-  });
-}
-var METERED_BUCKET;
-var init_copilot = __esm({
-  "../../scripts/virtual-office/code-runner/account-usage/copilot.mjs"() {
-    "use strict";
-    init_shared();
-    METERED_BUCKET = "premium_interactions";
-  }
-});
-
 // ../../scripts/virtual-office/code-runner/account-usage/index.mjs
 function collectAccountUsage(opts = {}) {
   const claude = readClaudeFileUsage(opts);
@@ -7816,13 +7741,11 @@ function collectAccountUsage(opts = {}) {
 async function collectConnectedAccountUsage({
   readClaude = readClaudeUsage,
   readCodex = readCodexUsage,
-  readCopilot = readCopilotUsage,
   ...agentOptions
 } = {}) {
   const settled = await Promise.allSettled([
     readClaude(agentOptions),
-    readCodex(agentOptions),
-    readCopilot(agentOptions)
+    readCodex(agentOptions)
   ]);
   return settled.map((outcome) => outcome.status === "fulfilled" ? outcome.value : null).filter(Boolean);
 }
@@ -7858,12 +7781,10 @@ var init_account_usage = __esm({
     "use strict";
     init_claude();
     init_codex();
-    init_copilot();
     init_shared();
     AGENT_USAGE_CAPABILITY = Object.freeze({
       claude: Object.freeze({ five_hour: true, seven_day: true, monthly: false }),
       codex: Object.freeze({ five_hour: false, seven_day: true, monthly: false }),
-      copilot: Object.freeze({ five_hour: false, seven_day: false, monthly: true }),
       cursor: Object.freeze({ five_hour: false, seven_day: false, monthly: false }),
       gemini: Object.freeze({ five_hour: false, seven_day: false, monthly: false })
     });