@algosuite/vo-mcp 0.2.0-beta.72 → 0.2.0-beta.74

package/dist/index.js

@@ -5274,7 +5274,7 @@ async function handleReportSessionState(deps, rawInput, _signal) {
 import { spawn } from "node:child_process";
 import { homedir as homedir5 } from "node:os";
 import { join as join7 } from "node:path";
-import { closeSync as closeSync2, existsSync as existsSync5, mkdirSync as mkdirSync4, openSync as openSync2, readFileSync as readFileSync7, readdirSync as readdirSync3, statSync as statSync4 } from "node:fs";
+import { closeSync as closeSync2, existsSync as existsSync5, mkdirSync as mkdirSync4, openSync as openSync2, readFileSync as readFileSync7, readdirSync as readdirSync3, statSync as statSync4, writeSync } from "node:fs";
 
 // src/swarm/tier-binding.ts
 var SWARM_TIERS = Object.freeze([
@@ -5871,6 +5871,64 @@ function checkSuccessorLiveness(child, logPath, config, deps = {}) {
   });
 }
 
+// src/swarm/successor-auth-env.ts
+var ALLOW_API_BILLING_ENV = "VO_SUCCESSOR_ALLOW_API_BILLING";
+var ALLOW_API_BILLING_ENV_VALUE = "1";
+var ALLOW_API_BILLING_INPUT = "allow_api_billing";
+var AUTH_SOURCE_LOGIN = "claude.ai login";
+var AUTH_SOURCE_API_KEY = "api key (explicitly allowed)";
+var NAMED_AUTH_ENV_KEYS = Object.freeze([
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "CLAUDE_API_KEY"
+]);
+function isSuccessorAuthEnvKey(name) {
+  const upper = String(name ?? "").trim().toUpperCase();
+  if (upper.length === 0) return false;
+  if (NAMED_AUTH_ENV_KEYS.includes(upper)) return true;
+  if (!upper.endsWith("_API_KEY")) return false;
+  return upper.startsWith("ANTHROPIC_") || upper.startsWith("CLAUDE_");
+}
+function resolveSuccessorAuthEnv(parentEnv, allowApiBillingInput) {
+  const flagRaw = parentEnv[ALLOW_API_BILLING_ENV];
+  const flagSet = typeof flagRaw === "string" && flagRaw.trim() === ALLOW_API_BILLING_ENV_VALUE;
+  const inputAsked = allowApiBillingInput === true;
+  if (flagSet && !inputAsked) {
+    return {
+      ok: false,
+      reason: `${ALLOW_API_BILLING_ENV}=${ALLOW_API_BILLING_ENV_VALUE} is set in this MCP server's environment, but the caller did not pass \`${ALLOW_API_BILLING_INPUT}: true\`. Org API-key billing needs BOTH consents \u2014 an inherited env var on its own is exactly how three headless successors billed ~489M Opus tokens to the org key on 2026-09-06/07. Pass \`${ALLOW_API_BILLING_INPUT}: true\` to bill the API key, or unset ${ALLOW_API_BILLING_ENV} to run the successor on the claude.ai login.`
+    };
+  }
+  if (inputAsked && !flagSet) {
+    return {
+      ok: false,
+      reason: `\`${ALLOW_API_BILLING_INPUT}: true\` was requested, but ${ALLOW_API_BILLING_ENV}=${ALLOW_API_BILLING_ENV_VALUE} is not set in this MCP server's environment. A tool input alone cannot move the payer \u2014 the operator's environment has to consent too. Refusing rather than spawning on the claude.ai login while the caller believes it is on the API key.`
+    };
+  }
+  const env = { ...parentEnv };
+  const present = Object.keys(env).filter((key) => isSuccessorAuthEnvKey(key)).sort();
+  if (flagSet && inputAsked) {
+    return {
+      ok: true,
+      // Honest about what is actually there: an opt-in with no key in the env
+      // still runs on the login, and reporting otherwise would make the receipt
+      // a claim rather than a record.
+      source: present.length > 0 ? AUTH_SOURCE_API_KEY : AUTH_SOURCE_LOGIN,
+      strippedEnvNames: [],
+      preservedEnvNames: present,
+      env
+    };
+  }
+  for (const key of present) delete env[key];
+  return { ok: true, source: AUTH_SOURCE_LOGIN, strippedEnvNames: present, preservedEnvNames: [], env };
+}
+function successorAuthReceiptLine(receipt) {
+  const stripped = receipt.strippedEnvNames.length > 0 ? receipt.strippedEnvNames.join(",") : "none";
+  const note = receipt.source === AUTH_SOURCE_API_KEY ? ` (ORG API KEY BILLING \u2014 ${ALLOW_API_BILLING_ENV}=${ALLOW_API_BILLING_ENV_VALUE} + ${ALLOW_API_BILLING_INPUT}:true)` : "";
+  return `[vo_spawn_successor] ${receipt.nowIso} agent=${receipt.agent} tier=${receipt.tier} auth_source="${receipt.source}" stripped_auth_env=${stripped}${note}
+`;
+}
+
 // src/tools/session/spawn-successor.ts
 var TOOL_NAME21 = "vo_spawn_successor";
 var MAX_HANDOFF_BYTES = 64e3;
@@ -5896,13 +5954,17 @@ var inputSchema21 = {
     agent: {
       type: "string",
       description: `Which agent to spawn ('claude' | 'codex'). Normally omitted: the agent comes from the swarm tier binding inherited via ${SWARM_TIER_BINDING_ENV}. When a binding IS inherited this may only RESTATE the bound agent \u2014 an agent that contradicts the binding is REFUSED, because a different agent is a different payer and the payer was decided once, at admission.`
+    },
+    [ALLOW_API_BILLING_INPUT]: {
+      type: "boolean",
+      description: `Bill this successor to the ORG API key instead of the claude.ai login. Default false: the Anthropic/Claude auth env vars are DELETED from the child env. Requires ${ALLOW_API_BILLING_ENV}=1 in the server environment as well \u2014 both consents must agree or the spawn is refused. Incident 2026-09-06/07: three successors that merely INHERITED ANTHROPIC_API_KEY burned ~489M Opus 5 tokens (~$300) and exhausted the org monthly limit.`
     }
   },
   required: [],
   additionalProperties: false
 };
 var RETIRED_COUNTER_INPUT = "spawns_so_far";
-var description21 = "Mode B auto-handoff (roadmap \xA73.4): spawn a DETACHED headless `claude -p` successor with a handoff doc pre-injected into its prompt. Defaults to the newest handoff in ~/.vo/handoffs/. Verifies the child is actually alive (survives an early-exit window; an optional log-output window is off by default) before reporting success. Returns {spawned, pid, log_path, handoff_path}. The successor works under the same gates as any session (ADR-001: verify-before-act, human merge approval) \u2014 this tool never fires autonomously.";
+var description21 = `Mode B auto-handoff (roadmap \xA73.4): spawn a DETACHED headless \`claude -p\` successor with a handoff doc pre-injected into its prompt. Defaults to the newest handoff in ~/.vo/handoffs/. Verifies the child is actually alive (survives an early-exit window; an optional log-output window is off by default) before reporting success. The successor runs on the operator's claude.ai LOGIN: the ANTHROPIC/CLAUDE auth env vars are deleted from the child env unless ${ALLOW_API_BILLING_ENV}=1 AND \`${ALLOW_API_BILLING_INPUT}: true\` are BOTH present (incident 2026-09-06/07 \u2014 three successors that merely inherited ANTHROPIC_API_KEY billed ~489M Opus 5 tokens, ~$300, to the org key and exhausted its monthly limit). Returns {spawned, pid, log_path, handoff_path, auth_source, stripped_auth_env}. The successor works under the same gates as any session (ADR-001: verify-before-act, human merge approval) \u2014 this tool never fires autonomously.`;
 function isToolInput20(v) {
   if (typeof v !== "object" || v === null) return false;
   const o = v;
@@ -5911,6 +5973,7 @@ function isToolInput20(v) {
   if (o["cwd"] !== void 0 && typeof o["cwd"] !== "string") return false;
   if (o["max_turns"] !== void 0 && typeof o["max_turns"] !== "number") return false;
   if (o["agent"] !== void 0 && typeof o["agent"] !== "string") return false;
+  if (o[ALLOW_API_BILLING_INPUT] !== void 0 && typeof o[ALLOW_API_BILLING_INPUT] !== "boolean") return false;
   return true;
 }
 function retiredCounterRefusal(v) {
@@ -5990,6 +6053,21 @@ async function handleSpawnSuccessor(_deps, rawInput, _signal, spawnImpl = spawn,
       }
     });
   }
+  const envSource = overrides.envSource ?? process.env;
+  const auth = resolveSuccessorAuthEnv(envSource, rawInput[ALLOW_API_BILLING_INPUT]);
+  if (!auth.ok) {
+    return jsonContent({
+      tool: TOOL_NAME21,
+      schema_version: 1,
+      payload: {
+        spawned: false,
+        reason: auth.reason,
+        agent: plan.agent,
+        tier: plan.tier,
+        handoff_path: handoffPath
+      }
+    });
+  }
   const platform = overrides.platform ?? process.platform;
   let resolvedBin = plan.bin;
   if (platform === "win32") {
@@ -6013,6 +6091,16 @@ async function handleSpawnSuccessor(_deps, rawInput, _signal, spawnImpl = spawn,
   mkdirSync4(logDir, { recursive: true });
   const logPath = join7(logDir, `successor-${Date.now()}.log`);
   const logFd = openSync2(logPath, "a");
+  writeSync(
+    logFd,
+    successorAuthReceiptLine({
+      nowIso: (/* @__PURE__ */ new Date()).toISOString(),
+      agent: plan.agent,
+      tier: plan.tier,
+      source: auth.source,
+      strippedEnvNames: auth.strippedEnvNames
+    })
+  );
   const child = spawnImpl(resolvedBin, [...plan.args], {
     cwd: rawInput.cwd?.trim() || process.cwd(),
     detached: true,
@@ -6024,10 +6112,16 @@ async function handleSpawnSuccessor(_deps, rawInput, _signal, spawnImpl = spawn,
     shell: false,
     windowsHide: true,
     windowsVerbatimArguments: false,
-    // Carry the SAME binding to the child. Without this the successor inherits
-    // no tier and re-resolves its own — which is the split-payer defect one
-    // generation down.
-    ...plan.bound ? { env: { ...process.env, ...plan.env } } : {}
+    // ALWAYS an explicit env (2026-09-10). This used to be
+    // `...(plan.bound ? { env: { ...process.env, ...plan.env } } : {})`, so an
+    // UNBOUND spawn — the ordinary case, since `agent`/bindings are "normally
+    // omitted" — passed no `env` key at all and the child inherited the whole
+    // parent environment, ANTHROPIC_API_KEY included. `auth.env` is that same
+    // environment with the Anthropic/Claude auth family removed (or kept, under
+    // the two-consent opt-in). The tier binding is layered ON TOP, unchanged:
+    // without it the successor inherits no tier and re-resolves its own, which
+    // is the split-payer defect one generation down.
+    env: { ...auth.env, ...plan.bound ? plan.env : {} }
   });
   closeSync2(logFd);
   let spawnError = null;
@@ -6069,7 +6163,11 @@ async function handleSpawnSuccessor(_deps, rawInput, _signal, spawnImpl = spawn,
         log_path: logPath,
         agent: plan.agent,
         tier: plan.tier,
-        handoff_path: handoffPath
+        handoff_path: handoffPath,
+        // Surfaced on the failure path too: a successor that died still spent
+        // whatever it spent, and reconciling that needs the payer.
+        auth_source: auth.source,
+        stripped_auth_env: auth.strippedEnvNames
       }
     });
   }
@@ -6091,7 +6189,11 @@ async function handleSpawnSuccessor(_deps, rawInput, _signal, spawnImpl = spawn,
       ledger_cap_remaining_usd: plan.capRemainingUsd,
       // Additive (2026-08-17): true only once the child survived the
       // early-exit window (and the output window, when that gate is enabled).
-      verified_alive: true
+      verified_alive: true,
+      // Additive (2026-09-10): WHO PAYS for this successor, and the auth env
+      // names removed to make that true. Names only — never key material.
+      auth_source: auth.source,
+      stripped_auth_env: auth.strippedEnvNames
     }
   });
 }