@algosuite/vo-mcp 0.2.0-beta.27 → 0.2.0-beta.29

package/dist/agent-auth-probe-cli.mjs

@@ -151,6 +151,56 @@ function spawnClaudeSync(args = [], options = {}) {
   }
 }
 
+// ../../scripts/virtual-office/code-runner/claude-credential-choice.mjs
+var PREFER_LOGIN_ENV = "VO_RUNNER_PREFER_LOGIN";
+var CLAUDE_PREFER_LOGIN_ENV = "VO_RUNNER_CLAUDE_PREFER_LOGIN";
+var PREFER_KEY_ENV = "VO_RUNNER_PREFER_KEY";
+var CLAUDE_PREFER_KEY_ENV = "VO_RUNNER_CLAUDE_PREFER_KEY";
+var CLAUDE_CREDENTIAL_SOURCE = Object.freeze({
+  /** PREFER_LOGIN set (and not overridden): any API key is ignored. */
+  PREFER_LOGIN: "prefer_login",
+  /** An explicit ANTHROPIC_API_KEY in the environment — the manual override. */
+  ENV_KEY: "env_key",
+  /** No key anywhere; the spawn falls through to the login session. */
+  NO_KEY: "no_key",
+  /** A stored key, used because the operator explicitly opted out of tier 1. */
+  KEYCHAIN_PREFER_KEY: "keychain_prefer_key",
+  /** A stored key exists but a proven live subscription outranks it. */
+  SUBSCRIPTION_WINS: "subscription_wins",
+  /** A stored key, used because no live subscription was proven. */
+  KEYCHAIN: "keychain"
+});
+function isTruthyFlag(v) {
+  const s = String(v ?? "").trim().toLowerCase();
+  return s === "1" || s === "true" || s === "yes" || s === "on";
+}
+function wantsLogin(env) {
+  return isTruthyFlag(env[CLAUDE_PREFER_LOGIN_ENV]) || isTruthyFlag(env[PREFER_LOGIN_ENV]);
+}
+function wantsKey(env) {
+  return isTruthyFlag(env[CLAUDE_PREFER_KEY_ENV]) || isTruthyFlag(env[PREFER_KEY_ENV]);
+}
+function classifyClaudeCredential(baseEnv = {}, { getKey, probeLogin } = {}) {
+  const preferKey = wantsKey(baseEnv);
+  if (!preferKey && wantsLogin(baseEnv)) {
+    return { source: CLAUDE_CREDENTIAL_SOURCE.PREFER_LOGIN, key: null };
+  }
+  if (baseEnv.ANTHROPIC_API_KEY) {
+    return { source: CLAUDE_CREDENTIAL_SOURCE.ENV_KEY, key: null };
+  }
+  const key = getKey();
+  if (!key) {
+    return { source: CLAUDE_CREDENTIAL_SOURCE.NO_KEY, key: null };
+  }
+  if (preferKey) {
+    return { source: CLAUDE_CREDENTIAL_SOURCE.KEYCHAIN_PREFER_KEY, key };
+  }
+  if (probeLogin() === true) {
+    return { source: CLAUDE_CREDENTIAL_SOURCE.SUBSCRIPTION_WINS, key: null };
+  }
+  return { source: CLAUDE_CREDENTIAL_SOURCE.KEYCHAIN, key };
+}
+
 // ../../scripts/virtual-office/code-runner/anthropic-key-store.mjs
 var require2 = createRequire(import.meta.url);
 var KEY_SERVICE = "algosuite-vo";
@@ -175,48 +225,30 @@ function getAnthropicKey({ EntryCtor = defaultEntryCtor() } = {}) {
     return null;
   }
 }
-var PREFER_LOGIN_ENV = "VO_RUNNER_PREFER_LOGIN";
-var CLAUDE_PREFER_LOGIN_ENV = "VO_RUNNER_CLAUDE_PREFER_LOGIN";
-var PREFER_KEY_ENV = "VO_RUNNER_PREFER_KEY";
-var CLAUDE_PREFER_KEY_ENV = "VO_RUNNER_CLAUDE_PREFER_KEY";
-function isTruthyFlag(v) {
-  const s = String(v ?? "").trim().toLowerCase();
-  return s === "1" || s === "true" || s === "yes" || s === "on";
-}
-function wantsLogin(env) {
-  return isTruthyFlag(env[CLAUDE_PREFER_LOGIN_ENV]) || isTruthyFlag(env[PREFER_LOGIN_ENV]);
-}
-function wantsKey(env) {
-  return isTruthyFlag(env[CLAUDE_PREFER_KEY_ENV]) || isTruthyFlag(env[PREFER_KEY_ENV]);
-}
 function withAnthropicKey(baseEnv = {}, { getKey = getAnthropicKey, probeLogin = probeClaudeLoginState } = {}) {
-  if (wantsLogin(baseEnv)) {
-    const next = { ...baseEnv };
+  const { source, key } = classifyClaudeCredential(baseEnv, { getKey, probeLogin });
+  const next = { ...baseEnv };
+  if (source === CLAUDE_CREDENTIAL_SOURCE.PREFER_LOGIN) {
     delete next.ANTHROPIC_API_KEY;
     return next;
   }
-  if (baseEnv.ANTHROPIC_API_KEY) return { ...baseEnv };
-  const key = getKey();
-  if (!key) return { ...baseEnv };
-  if (!wantsKey(baseEnv) && probeLogin() === true) return { ...baseEnv };
-  return { ...baseEnv, ANTHROPIC_API_KEY: key };
+  if (key !== null) next.ANTHROPIC_API_KEY = key;
+  return next;
 }
 function claudeCostBasis(env = process.env) {
   return String(env.ANTHROPIC_API_KEY || "").trim() ? "vendor_billed" : "subscription_api_equivalent";
 }
+var AUTH_SOURCE_DESCRIPTION = Object.freeze({
+  [CLAUDE_CREDENTIAL_SOURCE.PREFER_LOGIN]: "claude auth login (VO_RUNNER_PREFER_LOGIN set \u2014 any API key ignored)",
+  [CLAUDE_CREDENTIAL_SOURCE.ENV_KEY]: "ANTHROPIC_API_KEY from environment",
+  [CLAUDE_CREDENTIAL_SOURCE.NO_KEY]: "claude auth login session (no API key set)",
+  [CLAUDE_CREDENTIAL_SOURCE.KEYCHAIN_PREFER_KEY]: "ANTHROPIC_API_KEY from OS keychain (VO_RUNNER_PREFER_KEY set \u2014 subscription ignored)",
+  [CLAUDE_CREDENTIAL_SOURCE.SUBSCRIPTION_WINS]: "claude auth login session (subscription beats the stored keychain key)",
+  [CLAUDE_CREDENTIAL_SOURCE.KEYCHAIN]: "ANTHROPIC_API_KEY from OS keychain"
+});
 function describeAnthropicAuthSource(baseEnv = {}, { getKey = getAnthropicKey, probeLogin = probeClaudeLoginState } = {}) {
-  if (wantsLogin(baseEnv)) {
-    return "claude auth login (VO_RUNNER_PREFER_LOGIN set \u2014 any API key ignored)";
-  }
-  if (baseEnv.ANTHROPIC_API_KEY) return "ANTHROPIC_API_KEY from environment";
-  if (!getKey()) return "claude auth login session (no API key set)";
-  if (wantsKey(baseEnv)) {
-    return "ANTHROPIC_API_KEY from OS keychain (VO_RUNNER_PREFER_KEY set \u2014 subscription ignored)";
-  }
-  if (probeLogin() === true) {
-    return "claude auth login session (subscription beats the stored keychain key)";
-  }
-  return "ANTHROPIC_API_KEY from OS keychain";
+  const { source } = classifyClaudeCredential(baseEnv, { getKey, probeLogin });
+  return AUTH_SOURCE_DESCRIPTION[source];
 }
 function probeClaudeLoginState({
   spawn: spawn2 = spawnSync2,
@@ -1347,7 +1379,7 @@ var OpenAICompatibleRunner = class {
   buildArgs(opts = {}) {
     void opts;
     throw new Error(
-      "OpenAI-compatible full-repository coding is disabled. Use an explicit sanitized task capsule through the AlgoSuite Model Firewall."
+      "OpenAI-compatible full-repository coding is disabled. The `oai` runner lane is RETIRED (PR #8742) and executes nothing. Set VO_CODE_RUNNER_AGENT to claude, codex, cursor, local, or meta. Use an explicit sanitized task capsule through the AlgoSuite Model Firewall."
     );
   }
   /** Codex JSONL events map identically → reuse the proven parser. */
@@ -1370,14 +1402,14 @@ var OpenAICompatibleRunner = class {
   describeAuth(env = process.env) {
     const hasKey = Boolean(String(env[OAI_API_KEY_ENV] || "").trim());
     const baseUrl = resolveOaiBaseUrl(env);
-    return `oai-compat endpoint=${baseUrl || "<unset>"} key=${hasKey ? "set" : "MISSING"}`;
+    return `oai-compat RETIRED endpoint=${baseUrl || "<unset>"} key=${hasKey ? "set" : "MISSING"}`;
   }
-  /** Best-effort: base URL chosen AND the codex transport is installed. */
+  /** Always unavailable: the lane is retired, so nothing can authenticate it. */
   async checkAuth() {
     return {
       installed: false,
       authenticated: false,
-      message: "OpenAI-compatible coding is disabled; sanitized Model Firewall task capsules only"
+      message: "the `oai` lane is RETIRED (PR #8742); OpenAI-compatible coding is disabled \u2014 sanitized Model Firewall task capsules only"
     };
   }
 };