@algosuite/vo-mcp 0.2.0-beta.71 → 0.2.0-beta.73

package/dist/agent-auth-probe-cli.mjs

@@ -300,7 +300,7 @@ function normalizeClaudePermissionMode(value) {
   }
   return normalized;
 }
-function buildClaudeArgs({ permissionMode = DEFAULT_PERMISSION_MODE, maxTurns, model, effort, maxBudgetUsd, researchHarness = false, toolPolicy = "default", env = process.env } = {}) {
+function buildClaudeArgs({ permissionMode = DEFAULT_PERMISSION_MODE, maxTurns, model, effort, maxBudgetUsd, researchHarness = false, toolPolicy = "default", structuredOutputSchema, env = process.env } = {}) {
   const effectivePermissionMode = normalizeClaudePermissionMode(permissionMode);
   if (!["default", "skill_readonly", "frozen_inputs_only"].includes(toolPolicy)) {
     throw new Error(`unsupported Claude tool policy "${toolPolicy}"`);
@@ -338,6 +338,12 @@ function buildClaudeArgs({ permissionMode = DEFAULT_PERMISSION_MODE, maxTurns, m
       "none"
     );
   }
+  if (structuredOutputSchema !== void 0) {
+    if (!restrictedSkill || !structuredOutputSchema || typeof structuredOutputSchema !== "object" || Array.isArray(structuredOutputSchema)) {
+      throw new Error("structured output schema is allowed only for a restricted skill");
+    }
+    args.push("--json-schema", JSON.stringify(structuredOutputSchema));
+  }
   if (frozenInputsOnly) {
     args.push("--strict-mcp-config", "--safe-mode");
   }
@@ -425,13 +431,15 @@ function extractModelUsage(evt) {
 // ../../scripts/virtual-office/code-runner/claude-result-event.mjs
 var CAPPED_RESULT_SUBTYPES = Object.freeze(["error_max_budget_usd", "error_max_turns"]);
 function buildResultEvent(evt) {
-  const isError = Boolean(evt.is_error) || evt.subtype === "error_max_turns" || evt.subtype === "error_during_execution";
+  const isError = Boolean(evt.is_error) || evt.subtype === "error_max_budget_usd" || evt.subtype === "error_max_turns" || evt.subtype === "error_max_structured_output_retries" || evt.subtype === "error_during_execution";
   return {
     kind: "result",
     isError,
     costUsd: typeof evt.total_cost_usd === "number" ? evt.total_cost_usd : null,
     summary: typeof evt.result === "string" && evt.result.length > 0 ? evt.result : evt.subtype || (isError ? "error" : "completed"),
+    terminalSubtype: typeof evt.subtype === "string" ? evt.subtype : null,
     numTurns: typeof evt.num_turns === "number" ? evt.num_turns : null,
+    structuredOutput: Object.hasOwn(evt, "structured_output") ? evt.structured_output : null,
     tokenUsage: extractTokenUsage(evt),
     modelUsage: extractModelUsage(evt)
   };
@@ -544,9 +552,145 @@ function applyCliVersionFloor({ versionOutput, env = process.env, log = console.
   return { refused: !allowUnsafe, check, message };
 }
 
+// ../../scripts/virtual-office/code-runner/claude-skill-capability.mjs
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { accessSync, constants, realpathSync as realpathSync2, statSync } from "node:fs";
+import path3 from "node:path";
+var VALIDATED_CLAUDE_SKILL_VERSIONS = Object.freeze(["2.1.263"]);
+var REQUIRED_CLAUDE_SKILL_HELP = Object.freeze([
+  "--allowedTools",
+  "--disable-slash-commands",
+  "--json-schema",
+  "--max-budget-usd",
+  "--no-chrome",
+  "--no-session-persistence",
+  "--output-format",
+  "--permission-mode",
+  "--permission-prompts",
+  "--safe-mode",
+  "--strict-mcp-config",
+  "--tools"
+]);
+var PROBE_TIMEOUT_MS = 2e3;
+var CACHE_TTL_MS = 5 * 60 * 1e3;
+var cache = /* @__PURE__ */ new Map();
+function hasOption(help, option) {
+  const literal = option.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+  return new RegExp(`(^|\\s)${literal}(?=\\s|,|=|<|$)`, "mu").test(help);
+}
+function assessClaudeSkillCapability({ versionOutput, helpOutput }) {
+  const version = parseCliVersion(versionOutput);
+  if (!version || !VALIDATED_CLAUDE_SKILL_VERSIONS.includes(version)) {
+    return { compatible: false, version, reason: "claude version is not in the validated restricted-skill manifest" };
+  }
+  const help = String(helpOutput ?? "");
+  const missing = REQUIRED_CLAUDE_SKILL_HELP.filter((option) => !hasOption(help, option));
+  if (missing.length > 0) {
+    return { compatible: false, version, reason: `claude help is missing required options: ${missing.join(", ")}` };
+  }
+  if (!/--permission-prompts[\s\S]{0,300}(?:"none"|\bnone\b)/mu.test(help) || !/--output-format[\s\S]{0,300}\bstream-json\b/mu.test(help)) {
+    return { compatible: false, version, reason: "claude help does not prove required none/stream-json values" };
+  }
+  return { compatible: true, version, reason: "validated restricted-skill CLI contract" };
+}
+function runProbe(bin, args, env, timeoutMs = PROBE_TIMEOUT_MS) {
+  if (process.platform === "win32") {
+    try {
+      const launch = buildWindowsClaudeLaunch({ bin, args, env });
+      return spawnSync6(launch.bin, launch.args, {
+        ...launch.spawnOptions,
+        env,
+        encoding: "utf8",
+        timeout: timeoutMs
+      });
+    } catch (error) {
+      return { status: null, stdout: "", stderr: "", error };
+    }
+  }
+  return spawnSync6(bin, args, { env, encoding: "utf8", timeout: timeoutMs, windowsHide: true });
+}
+function probeText(probe) {
+  return `${String(probe?.stdout ?? "")}
+${String(probe?.stderr ?? "")}`.trim();
+}
+function resolveClaudeBinaryIdentity(bin = "claude", env = process.env) {
+  let resolvedBin = String(bin);
+  try {
+    if (process.platform === "win32") {
+      resolvedBin = buildWindowsClaudeLaunch({ bin: resolvedBin, args: [], env }).bin;
+    } else if (!path3.isAbsolute(resolvedBin)) {
+      const found = String(env?.PATH ?? "").split(path3.delimiter).find((dir) => {
+        try {
+          accessSync(path3.join(dir, resolvedBin), constants.X_OK);
+          return true;
+        } catch {
+          return false;
+        }
+      });
+      if (found) resolvedBin = path3.join(found, resolvedBin);
+    }
+    const canonical = realpathSync2(resolvedBin);
+    const stat = statSync(canonical);
+    return { resolvedBin: canonical, fingerprint: `${canonical}\0${stat.size}\0${stat.mtimeMs}` };
+  } catch {
+    const pathValue2 = String(env?.PATH ?? env?.Path ?? "");
+    return { resolvedBin, fingerprint: `${resolvedBin}\0${pathValue2}` };
+  }
+}
+function probeClaudeSkillCapability({
+  bin = "claude",
+  env = process.env,
+  versionOutput,
+  spawnProbe = runProbe,
+  now = () => Date.now(),
+  cacheTtlMs = CACHE_TTL_MS,
+  timeoutMs = PROBE_TIMEOUT_MS,
+  freshIdentity = false,
+  resolveIdentity = resolveClaudeBinaryIdentity
+} = {}) {
+  const identity = resolveIdentity(bin, env);
+  const key = identity.fingerprint;
+  const existing = cache.get(key);
+  if (!freshIdentity && versionOutput === void 0 && existing && now() - existing.at < cacheTtlMs) {
+    return existing.value;
+  }
+  const versionProbe = freshIdentity || versionOutput === void 0 ? spawnProbe(identity.resolvedBin, ["--version"], env, timeoutMs) : null;
+  if (versionProbe?.error || versionProbe && versionProbe.status !== 0) {
+    return {
+      compatible: false,
+      version: null,
+      resolvedBin: identity.resolvedBin,
+      reason: "claude version capability probe failed"
+    };
+  }
+  const effectiveVersionOutput = versionProbe ? probeText(versionProbe) : versionOutput;
+  const suppliedVersion = parseCliVersion(effectiveVersionOutput);
+  if (existing && now() - existing.at < cacheTtlMs && suppliedVersion === existing.value.version) {
+    return existing.value;
+  }
+  const helpProbe = spawnProbe(identity.resolvedBin, ["--help"], env, timeoutMs);
+  if (helpProbe?.error || helpProbe?.status !== 0) {
+    return {
+      compatible: false,
+      version: suppliedVersion,
+      resolvedBin: identity.resolvedBin,
+      reason: "claude help capability probe failed"
+    };
+  }
+  const assessed = assessClaudeSkillCapability({
+    versionOutput: effectiveVersionOutput,
+    helpOutput: probeText(helpProbe)
+  });
+  const value = { ...assessed, resolvedBin: identity.resolvedBin };
+  cache.set(key, { at: now(), value });
+  return value;
+}
+
 // ../../scripts/virtual-office/code-runner/claude-auth-check.mjs
 var FIRST_VERSION_TIMEOUT_MS = 4500;
 var RETRY_VERSION_TIMEOUT_MS = 2e3;
+var AUTH_PROBE_BUDGET_MS = 9500;
+var MIN_SKILL_PROBE_MS = 250;
 function errorCode(error) {
   return String(error?.code || "").toUpperCase();
 }
@@ -572,9 +716,12 @@ async function checkClaudeAuth({
   spawnVersion = spawnClaudeSync,
   probeLogin = probeClaudeLoginState,
   getStoredKey = getAnthropicKey,
-  env = process.env
+  probeSkillCapability = probeClaudeSkillCapability,
+  env = process.env,
+  now = () => Date.now()
 } = {}) {
   try {
+    const startedAt = now();
     let probe = spawnVersion(["--version"], {
       timeout: FIRST_VERSION_TIMEOUT_MS,
       encoding: "utf8",
@@ -608,23 +755,40 @@ async function checkClaudeAuth({
     }
     const floorGate = applyCliVersionFloor({ versionOutput: probe.stdout, env });
     if (floorGate.refused) {
-      return { installed: true, authenticated: false, message: floorGate.message };
+      return {
+        installed: true,
+        authenticated: false,
+        version: floorGate.check.version ?? void 0,
+        skillCapable: false,
+        message: floorGate.message
+      };
     }
     const loggedIn = retriedAfterTimeout ? null : probeLogin();
     if (loggedIn === false) {
       return {
         installed: true,
         authenticated: false,
+        version: floorGate.check.version ?? void 0,
+        skillCapable: false,
         message: "claude CLI is installed but NOT logged in \u2014 its login is SEPARATE from the Claude Desktop app and the Claude Code IDE extension. Run: claude auth login (Claude subscription), then restart the runner."
       };
     }
+    const authTier = resolveClaudeAuthTier({ env, loggedIn, getStoredKey });
+    const remainingMs = AUTH_PROBE_BUDGET_MS - (now() - startedAt);
+    const skillCapability = loggedIn === true && remainingMs >= MIN_SKILL_PROBE_MS ? probeSkillCapability({
+      versionOutput: probe.stdout,
+      env,
+      timeoutMs: Math.min(2e3, remainingMs)
+    }) : { compatible: false };
     return {
       installed: true,
       authenticated: true,
+      version: floorGate.check.version ?? void 0,
+      skillCapable: skillCapability.compatible === true,
       // Dispatch-time billing signal, carried on the same probe that already
       // paid for the login read. Never sent for a non-authenticated result:
       // there is no tier without a working credential.
-      authTier: resolveClaudeAuthTier({ env, loggedIn, getStoredKey }),
+      authTier,
       message: loggedIn === true ? "claude CLI installed and logged in (claude auth status)" : "claude binary found (login state unknown \u2014 auth check is best-effort)"
     };
   } catch (error) {
@@ -636,6 +800,24 @@ async function checkClaudeAuth({
   }
 }
 
+// ../../scripts/virtual-office/code-runner/agent-auth-attestation.mjs
+var AGENT_AUTH_SOURCE = Object.freeze({
+  /** A flat-cost linked account (`claude auth login`). No per-token vendor bill. */
+  LOGIN: "login",
+  /** A metered per-token credential the vendor bills. */
+  API_KEY: "api_key"
+});
+var AGENT_AUTH_SOURCES = Object.freeze([
+  AGENT_AUTH_SOURCE.LOGIN,
+  AGENT_AUTH_SOURCE.API_KEY
+]);
+var API_BILLING_ENV_NAMES = Object.freeze([
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "CLAUDE_API_KEY"
+]);
+var API_BILLING_ENV_NAME_SET = new Set(API_BILLING_ENV_NAMES);
+
 // ../../scripts/virtual-office/code-runner/claude-runner.mjs
 function parseStreamEvent(line) {
   return parseClaudeStreamEvent(line);
@@ -647,8 +829,8 @@ var ClaudeRunner = class {
   get binary() {
     return "claude";
   }
-  buildArgs({ permissionMode, maxTurns, model, effort, maxBudgetUsd, researchHarness, toolPolicy } = {}) {
-    return buildClaudeArgs({ permissionMode, maxTurns, model, effort, maxBudgetUsd, researchHarness, toolPolicy });
+  buildArgs({ permissionMode, maxTurns, model, effort, maxBudgetUsd, researchHarness, toolPolicy, structuredOutputSchema } = {}) {
+    return buildClaudeArgs({ permissionMode, maxTurns, model, effort, maxBudgetUsd, researchHarness, toolPolicy, structuredOutputSchema });
   }
   parseEvent(line) {
     return parseStreamEvent(line);
@@ -672,11 +854,14 @@ var ClaudeRunner = class {
   async checkAuth() {
     return checkClaudeAuth();
   }
+  checkSkillCapability({ bin = this.binary, env = process.env } = {}) {
+    return probeClaudeSkillCapability({ bin, env, freshIdentity: true });
+  }
 };
 var claudeRunner = new ClaudeRunner();
 
 // ../../scripts/virtual-office/code-runner/codex-runner.mjs
-import { spawnSync as spawnSync6 } from "node:child_process";
+import { spawnSync as spawnSync7 } from "node:child_process";
 import { existsSync as existsSync3 } from "node:fs";
 import { win32 } from "node:path";
 
@@ -928,7 +1113,7 @@ function parseCodexEvent(line) {
   return null;
 }
 var CodexRunner = class {
-  constructor({ spawn: spawn2 = spawnSync6, resolveBinary = resolveCodexBinary, env = process.env } = {}) {
+  constructor({ spawn: spawn2 = spawnSync7, resolveBinary = resolveCodexBinary, env = process.env } = {}) {
     this.spawn = spawn2;
     this.resolveBinary = resolveBinary;
     this.env = env;
@@ -1039,7 +1224,7 @@ ${login.stderr || ""}`.trim();
 var codexRunner = new CodexRunner();
 
 // ../../scripts/virtual-office/code-runner/cursor-runner.mjs
-import { spawnSync as spawnSync7 } from "node:child_process";
+import { spawnSync as spawnSync8 } from "node:child_process";
 function buildCursorArgs({ model, prompt } = {}) {
   const args = ["-p", "--output-format", "stream-json", "--force"];
   if (model) {
@@ -1144,7 +1329,7 @@ var CursorRunner = class {
   /** Best-effort: is `cursor-agent` on PATH? Never throws. */
   async checkAuth() {
     try {
-      const { status, error } = spawnSync7("cursor-agent", ["--version"], {
+      const { status, error } = spawnSync8("cursor-agent", ["--version"], {
         shell: false,
         windowsHide: true,
         timeout: 3e3,

package/dist/cli.js

@@ -6295,7 +6295,7 @@ init_common();
 import { spawn } from "node:child_process";
 import { homedir as homedir5 } from "node:os";
 import { join as join7 } from "node:path";
-import { closeSync as closeSync2, existsSync as existsSync5, mkdirSync as mkdirSync4, openSync as openSync2, readFileSync as readFileSync7, readdirSync as readdirSync3, statSync as statSync4 } from "node:fs";
+import { closeSync as closeSync2, existsSync as existsSync5, mkdirSync as mkdirSync4, openSync as openSync2, readFileSync as readFileSync7, readdirSync as readdirSync3, statSync as statSync4, writeSync } from "node:fs";
 
 // src/swarm/tier-binding.ts
 var SWARM_TIERS = Object.freeze([
@@ -6892,6 +6892,64 @@ function checkSuccessorLiveness(child, logPath, config, deps = {}) {
   });
 }
 
+// src/swarm/successor-auth-env.ts
+var ALLOW_API_BILLING_ENV = "VO_SUCCESSOR_ALLOW_API_BILLING";
+var ALLOW_API_BILLING_ENV_VALUE = "1";
+var ALLOW_API_BILLING_INPUT = "allow_api_billing";
+var AUTH_SOURCE_LOGIN = "claude.ai login";
+var AUTH_SOURCE_API_KEY = "api key (explicitly allowed)";
+var NAMED_AUTH_ENV_KEYS = Object.freeze([
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "CLAUDE_API_KEY"
+]);
+function isSuccessorAuthEnvKey(name) {
+  const upper = String(name ?? "").trim().toUpperCase();
+  if (upper.length === 0) return false;
+  if (NAMED_AUTH_ENV_KEYS.includes(upper)) return true;
+  if (!upper.endsWith("_API_KEY")) return false;
+  return upper.startsWith("ANTHROPIC_") || upper.startsWith("CLAUDE_");
+}
+function resolveSuccessorAuthEnv(parentEnv, allowApiBillingInput) {
+  const flagRaw = parentEnv[ALLOW_API_BILLING_ENV];
+  const flagSet = typeof flagRaw === "string" && flagRaw.trim() === ALLOW_API_BILLING_ENV_VALUE;
+  const inputAsked = allowApiBillingInput === true;
+  if (flagSet && !inputAsked) {
+    return {
+      ok: false,
+      reason: `${ALLOW_API_BILLING_ENV}=${ALLOW_API_BILLING_ENV_VALUE} is set in this MCP server's environment, but the caller did not pass \`${ALLOW_API_BILLING_INPUT}: true\`. Org API-key billing needs BOTH consents \u2014 an inherited env var on its own is exactly how three headless successors billed ~489M Opus tokens to the org key on 2026-09-06/07. Pass \`${ALLOW_API_BILLING_INPUT}: true\` to bill the API key, or unset ${ALLOW_API_BILLING_ENV} to run the successor on the claude.ai login.`
+    };
+  }
+  if (inputAsked && !flagSet) {
+    return {
+      ok: false,
+      reason: `\`${ALLOW_API_BILLING_INPUT}: true\` was requested, but ${ALLOW_API_BILLING_ENV}=${ALLOW_API_BILLING_ENV_VALUE} is not set in this MCP server's environment. A tool input alone cannot move the payer \u2014 the operator's environment has to consent too. Refusing rather than spawning on the claude.ai login while the caller believes it is on the API key.`
+    };
+  }
+  const env = { ...parentEnv };
+  const present = Object.keys(env).filter((key) => isSuccessorAuthEnvKey(key)).sort();
+  if (flagSet && inputAsked) {
+    return {
+      ok: true,
+      // Honest about what is actually there: an opt-in with no key in the env
+      // still runs on the login, and reporting otherwise would make the receipt
+      // a claim rather than a record.
+      source: present.length > 0 ? AUTH_SOURCE_API_KEY : AUTH_SOURCE_LOGIN,
+      strippedEnvNames: [],
+      preservedEnvNames: present,
+      env
+    };
+  }
+  for (const key of present) delete env[key];
+  return { ok: true, source: AUTH_SOURCE_LOGIN, strippedEnvNames: present, preservedEnvNames: [], env };
+}
+function successorAuthReceiptLine(receipt) {
+  const stripped = receipt.strippedEnvNames.length > 0 ? receipt.strippedEnvNames.join(",") : "none";
+  const note = receipt.source === AUTH_SOURCE_API_KEY ? ` (ORG API KEY BILLING \u2014 ${ALLOW_API_BILLING_ENV}=${ALLOW_API_BILLING_ENV_VALUE} + ${ALLOW_API_BILLING_INPUT}:true)` : "";
+  return `[vo_spawn_successor] ${receipt.nowIso} agent=${receipt.agent} tier=${receipt.tier} auth_source="${receipt.source}" stripped_auth_env=${stripped}${note}
+`;
+}
+
 // src/tools/session/spawn-successor.ts
 var TOOL_NAME21 = "vo_spawn_successor";
 var MAX_HANDOFF_BYTES = 64e3;
@@ -6917,13 +6975,17 @@ var inputSchema21 = {
     agent: {
       type: "string",
       description: `Which agent to spawn ('claude' | 'codex'). Normally omitted: the agent comes from the swarm tier binding inherited via ${SWARM_TIER_BINDING_ENV}. When a binding IS inherited this may only RESTATE the bound agent \u2014 an agent that contradicts the binding is REFUSED, because a different agent is a different payer and the payer was decided once, at admission.`
+    },
+    [ALLOW_API_BILLING_INPUT]: {
+      type: "boolean",
+      description: `Bill this successor to the ORG API key instead of the claude.ai login. Default false: the Anthropic/Claude auth env vars are DELETED from the child env. Requires ${ALLOW_API_BILLING_ENV}=1 in the server environment as well \u2014 both consents must agree or the spawn is refused. Incident 2026-09-06/07: three successors that merely INHERITED ANTHROPIC_API_KEY burned ~489M Opus 5 tokens (~$300) and exhausted the org monthly limit.`
     }
   },
   required: [],
   additionalProperties: false
 };
 var RETIRED_COUNTER_INPUT = "spawns_so_far";
-var description21 = "Mode B auto-handoff (roadmap \xA73.4): spawn a DETACHED headless `claude -p` successor with a handoff doc pre-injected into its prompt. Defaults to the newest handoff in ~/.vo/handoffs/. Verifies the child is actually alive (survives an early-exit window; an optional log-output window is off by default) before reporting success. Returns {spawned, pid, log_path, handoff_path}. The successor works under the same gates as any session (ADR-001: verify-before-act, human merge approval) \u2014 this tool never fires autonomously.";
+var description21 = `Mode B auto-handoff (roadmap \xA73.4): spawn a DETACHED headless \`claude -p\` successor with a handoff doc pre-injected into its prompt. Defaults to the newest handoff in ~/.vo/handoffs/. Verifies the child is actually alive (survives an early-exit window; an optional log-output window is off by default) before reporting success. The successor runs on the operator's claude.ai LOGIN: the ANTHROPIC/CLAUDE auth env vars are deleted from the child env unless ${ALLOW_API_BILLING_ENV}=1 AND \`${ALLOW_API_BILLING_INPUT}: true\` are BOTH present (incident 2026-09-06/07 \u2014 three successors that merely inherited ANTHROPIC_API_KEY billed ~489M Opus 5 tokens, ~$300, to the org key and exhausted its monthly limit). Returns {spawned, pid, log_path, handoff_path, auth_source, stripped_auth_env}. The successor works under the same gates as any session (ADR-001: verify-before-act, human merge approval) \u2014 this tool never fires autonomously.`;
 function isToolInput20(v) {
   if (typeof v !== "object" || v === null) return false;
   const o = v;
@@ -6932,6 +6994,7 @@ function isToolInput20(v) {
   if (o["cwd"] !== void 0 && typeof o["cwd"] !== "string") return false;
   if (o["max_turns"] !== void 0 && typeof o["max_turns"] !== "number") return false;
   if (o["agent"] !== void 0 && typeof o["agent"] !== "string") return false;
+  if (o[ALLOW_API_BILLING_INPUT] !== void 0 && typeof o[ALLOW_API_BILLING_INPUT] !== "boolean") return false;
   return true;
 }
 function retiredCounterRefusal(v) {
@@ -7011,6 +7074,21 @@ async function handleSpawnSuccessor(_deps, rawInput, _signal, spawnImpl = spawn,
       }
     });
   }
+  const envSource = overrides.envSource ?? process.env;
+  const auth = resolveSuccessorAuthEnv(envSource, rawInput[ALLOW_API_BILLING_INPUT]);
+  if (!auth.ok) {
+    return jsonContent({
+      tool: TOOL_NAME21,
+      schema_version: 1,
+      payload: {
+        spawned: false,
+        reason: auth.reason,
+        agent: plan.agent,
+        tier: plan.tier,
+        handoff_path: handoffPath
+      }
+    });
+  }
   const platform = overrides.platform ?? process.platform;
   let resolvedBin = plan.bin;
   if (platform === "win32") {
@@ -7034,6 +7112,16 @@ async function handleSpawnSuccessor(_deps, rawInput, _signal, spawnImpl = spawn,
   mkdirSync4(logDir, { recursive: true });
   const logPath = join7(logDir, `successor-${Date.now()}.log`);
   const logFd = openSync2(logPath, "a");
+  writeSync(
+    logFd,
+    successorAuthReceiptLine({
+      nowIso: (/* @__PURE__ */ new Date()).toISOString(),
+      agent: plan.agent,
+      tier: plan.tier,
+      source: auth.source,
+      strippedEnvNames: auth.strippedEnvNames
+    })
+  );
   const child = spawnImpl(resolvedBin, [...plan.args], {
     cwd: rawInput.cwd?.trim() || process.cwd(),
     detached: true,
@@ -7045,10 +7133,16 @@ async function handleSpawnSuccessor(_deps, rawInput, _signal, spawnImpl = spawn,
     shell: false,
     windowsHide: true,
     windowsVerbatimArguments: false,
-    // Carry the SAME binding to the child. Without this the successor inherits
-    // no tier and re-resolves its own — which is the split-payer defect one
-    // generation down.
-    ...plan.bound ? { env: { ...process.env, ...plan.env } } : {}
+    // ALWAYS an explicit env (2026-09-10). This used to be
+    // `...(plan.bound ? { env: { ...process.env, ...plan.env } } : {})`, so an
+    // UNBOUND spawn — the ordinary case, since `agent`/bindings are "normally
+    // omitted" — passed no `env` key at all and the child inherited the whole
+    // parent environment, ANTHROPIC_API_KEY included. `auth.env` is that same
+    // environment with the Anthropic/Claude auth family removed (or kept, under
+    // the two-consent opt-in). The tier binding is layered ON TOP, unchanged:
+    // without it the successor inherits no tier and re-resolves its own, which
+    // is the split-payer defect one generation down.
+    env: { ...auth.env, ...plan.bound ? plan.env : {} }
   });
   closeSync2(logFd);
   let spawnError = null;
@@ -7090,7 +7184,11 @@ async function handleSpawnSuccessor(_deps, rawInput, _signal, spawnImpl = spawn,
         log_path: logPath,
         agent: plan.agent,
         tier: plan.tier,
-        handoff_path: handoffPath
+        handoff_path: handoffPath,
+        // Surfaced on the failure path too: a successor that died still spent
+        // whatever it spent, and reconciling that needs the payer.
+        auth_source: auth.source,
+        stripped_auth_env: auth.strippedEnvNames
       }
     });
   }
@@ -7112,7 +7210,11 @@ async function handleSpawnSuccessor(_deps, rawInput, _signal, spawnImpl = spawn,
       ledger_cap_remaining_usd: plan.capRemainingUsd,
       // Additive (2026-08-17): true only once the child survived the
       // early-exit window (and the output window, when that gate is enabled).
-      verified_alive: true
+      verified_alive: true,
+      // Additive (2026-09-10): WHO PAYS for this successor, and the auth env
+      // names removed to make that true. Names only — never key material.
+      auth_source: auth.source,
+      stripped_auth_env: auth.strippedEnvNames
     }
   });
 }