@bridge4dev/runner 0.26.0 → 0.27.0

package/dist/agent-auth.d.ts

@@ -0,0 +1,29 @@
+export declare function agentAuthPath(): string;
+/** The token we hold for Claude, or null once it is too old to trust. */
+export declare function storedClaudeToken(): string | null;
+export declare function storeClaudeToken(token: string): void;
+export declare function clearStoredClaudeToken(): void;
+/**
+ * Put a stored token into this process's environment, unless the operator
+ * already set one.
+ *
+ * Their variable wins on purpose: an explicitly exported
+ * `CLAUDE_CODE_OAUTH_TOKEN` in the unit or in `environment.d` is a deliberate
+ * choice, and silently overriding it with something we captured months ago is
+ * the kind of surprise this file exists to prevent.
+ *
+ * Returns true when it applied one.
+ */
+export declare function applyStoredClaudeToken(): boolean;
+/**
+ * The OAuth token `claude setup-token` printed, reassembled out of pty output.
+ *
+ * Written against how the output actually arrives rather than how it looks in a
+ * terminal: the pty wraps at its width, so a ~100-character token is routinely
+ * split across lines. Continuation lines are joined only while they consist
+ * ENTIRELY of token characters — prose ("Store this token securely") contains
+ * spaces or punctuation and stops the join, which is what keeps the reassembly
+ * from swallowing the sentence after it.
+ */
+export declare function extractOauthToken(text: string): string | null;
+//# sourceMappingURL=agent-auth.d.ts.map

package/dist/agent-auth.js

@@ -0,0 +1,136 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { configDir } from './paths.js';
+/**
+ * A Claude login this runner owns, for the one CLI that cannot store one.
+ *
+ * Background, because this file only makes sense with it. The dashboard's
+ * sign-in button relays a real OAuth flow to the machine — and until 0.27.0 it
+ * relayed `claude setup-token`, which is not a login at all. Measured against
+ * the 2.1.220 binary and confirmed by Anthropic's own docs: `setup-token` mints
+ * a long-lived INFERENCE-ONLY token, prints it, and «does not save the token
+ * anywhere». The runner threw the printed token away, then judged the login by
+ * reading `~/.claude/.credentials.json` — a file that command never writes. So
+ * the flow completed, the panel re-probed within a second, and answered «No
+ * Claude login on this server» underneath a success screen. That is the bug
+ * behind every «I signed in and it still says signed out».
+ *
+ * The main path is now `claude auth login`, which persists properly and needs
+ * nothing from this module. This exists for the fallback: a CLI old enough not
+ * to have `auth login` still has `setup-token`, and rather than leave that
+ * machine with no way in, we capture the token it prints and keep it ourselves.
+ * `CLAUDE_CODE_OAUTH_TOKEN` is already on the session env allowlist, so a stored
+ * token reaches the agent exactly like an operator-configured one.
+ *
+ * Stored on the machine, 0600, in the runner's own config directory. DevBridge
+ * never receives it: the token travels from the provider into a pty on this
+ * host and onto this host's disk.
+ */
+const FILE_MODE = 0o600;
+export function agentAuthPath() {
+    return path.join(configDir(), 'agent-auth.json');
+}
+/**
+ * How long a captured token is believed without further evidence.
+ *
+ * `claude setup-token` mints a one-year credential and there is no way to ask
+ * whether it is still good without spending a request. A stored token that
+ * never ages out is a green light nobody can turn off: the panel would keep
+ * saying «signed in» about a revoked account for as long as the file exists.
+ * Eleven months keeps it inside the token's own life while still expiring.
+ */
+const TOKEN_MAX_AGE_MS = 334 * 24 * 60 * 60 * 1000;
+function read() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(agentAuthPath(), 'utf8'));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            return {};
+        return parsed;
+    }
+    catch {
+        return {};
+    }
+}
+/** The token we hold for Claude, or null once it is too old to trust. */
+export function storedClaudeToken() {
+    const file = read();
+    const value = file.claudeOauthToken;
+    if (typeof value !== 'string' || value.length === 0)
+        return null;
+    const stamped = typeof file.updatedAt === 'string' ? Date.parse(file.updatedAt) : NaN;
+    if (Number.isFinite(stamped) && Date.now() - stamped > TOKEN_MAX_AGE_MS)
+        return null;
+    return value;
+}
+export function storeClaudeToken(token) {
+    const dir = configDir();
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const file = agentAuthPath();
+    // Same write-then-rename as the config: a torn file here reads as «signed
+    // out» and sends somebody through the whole login again.
+    const tmp = path.join(dir, `.agent-auth.${process.pid}.tmp`);
+    fs.writeFileSync(tmp, `${JSON.stringify({ claudeOauthToken: token, updatedAt: new Date().toISOString() }, null, 2)}\n`, { mode: FILE_MODE });
+    fs.renameSync(tmp, file);
+    fs.chmodSync(file, FILE_MODE);
+}
+export function clearStoredClaudeToken() {
+    try {
+        fs.rmSync(agentAuthPath(), { force: true });
+    }
+    catch {
+        /* nothing to clear */
+    }
+}
+/**
+ * Put a stored token into this process's environment, unless the operator
+ * already set one.
+ *
+ * Their variable wins on purpose: an explicitly exported
+ * `CLAUDE_CODE_OAUTH_TOKEN` in the unit or in `environment.d` is a deliberate
+ * choice, and silently overriding it with something we captured months ago is
+ * the kind of surprise this file exists to prevent.
+ *
+ * Returns true when it applied one.
+ */
+export function applyStoredClaudeToken() {
+    if (process.env['CLAUDE_CODE_OAUTH_TOKEN'])
+        return false;
+    const token = storedClaudeToken();
+    if (!token)
+        return false;
+    process.env['CLAUDE_CODE_OAUTH_TOKEN'] = token;
+    return true;
+}
+/**
+ * The OAuth token `claude setup-token` printed, reassembled out of pty output.
+ *
+ * Written against how the output actually arrives rather than how it looks in a
+ * terminal: the pty wraps at its width, so a ~100-character token is routinely
+ * split across lines. Continuation lines are joined only while they consist
+ * ENTIRELY of token characters — prose ("Store this token securely") contains
+ * spaces or punctuation and stops the join, which is what keeps the reassembly
+ * from swallowing the sentence after it.
+ */
+export function extractOauthToken(text) {
+    const lines = text.split('\n').map((line) => line.trim());
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i] ?? '';
+        const start = line.match(/sk-ant-oat[0-9]*-[A-Za-z0-9_-]*$/);
+        // The token must run to the end of its line; anything after it on the same
+        // line means this is prose mentioning a token, not the token itself.
+        if (!start)
+            continue;
+        let token = start[0];
+        for (let j = i + 1; j < lines.length; j++) {
+            const next = lines[j] ?? '';
+            if (!/^[A-Za-z0-9_-]+$/.test(next))
+                break;
+            token += next;
+        }
+        // Long enough to be real, short enough not to be a runaway join.
+        if (token.length >= 40 && token.length <= 400)
+            return token;
+    }
+    return null;
+}
+//# sourceMappingURL=agent-auth.js.map

package/dist/auth-relay.d.ts

@@ -24,18 +24,46 @@ export interface AgentAuthStatus {
     expiresAt?: string;
     detail?: string;
 }
+/**
+ * Rejoin a secret the pty split across lines, so the masker can see it.
+ *
+ * `maskString` matches `sk-ant-[A-Za-z0-9_-]{8,}`, which a line break inside
+ * the token defeats — and the pty wraps at its width, so a ~100-character
+ * token arrives in pieces as a matter of course. Measured: the head gets
+ * masked and the tail is printed verbatim into an error detail that travels to
+ * the dashboard. Rejoining first costs nothing and closes it.
+ */
+export declare function rejoinWrappedSecrets(text: string): string;
 /** Strip ANSI/OSC control sequences so text matching sees plain output. */
 export declare function stripControl(raw: string): string;
 export declare function extractLoginUrl(agent: RelayAgent, raw: string): string | null;
 export declare function extractDeviceCode(raw: string): string | null;
+export interface AuthRelayDeps {
+    /**
+     * How we find out whether Claude is signed in, after the CLI says it is.
+     * Injected so a test can exercise the contract without an OAuth provider.
+     */
+    claudeStatus?: () => Promise<AgentAuthStatus>;
+}
 export declare class AuthRelay {
     private readonly commands;
+    private readonly deps;
     private active;
-    constructor(commands?: Record<RelayAgent, string>);
+    constructor(commands?: Record<RelayAgent, string>, deps?: AuthRelayDeps);
     /** Start (or restart) a login flow and wait until the sign-in URL appears. */
     start(agent: RelayAgent): Promise<LoginStartResult>;
+    private startWith;
     /** Paste the confirmation code back into the waiting CLI (Claude flow). */
     submitCode(agent: RelayAgent, code: string): Promise<LoginCodeResult>;
+    /**
+     * The CLI exited 0 — but is the machine actually signed in?
+     *
+     * Asked rather than assumed. Reporting a success the panel then contradicts
+     * one second later is worse than reporting a failure: it sends the person
+     * looking for a permissions problem that does not exist, which is exactly
+     * what happened on axon-prod-01.
+     */
+    private confirmSignedIn;
     cancel(): void;
 }
 /**

package/dist/auth-relay.js

@@ -5,6 +5,8 @@ import path from 'node:path';
 import { promisify } from 'node:util';
 import { log } from './log.js';
 import { maskString } from './policy.js';
+import { runnerIdentity, whichExecutable } from './environment.js';
+import { applyStoredClaudeToken, clearStoredClaudeToken, extractOauthToken, storeClaudeToken, storedClaudeToken, } from './agent-auth.js';
 import { adoptLoginResult, discardStagingHome, prepareStagingHome, repairCodexAuth, stagingCodexHomePath, } from './adapters/codex-home.js';
 const execFileAsync = promisify(execFile);
 /* eslint-disable no-control-regex -- this module parses raw pty output, so
@@ -18,6 +20,18 @@ const URL_PATTERNS = {
     claude: /https:\/\/(?:claude\.com|claude\.ai)\/[^\s\x07\x1b"']+/,
     codex: /https:\/\/[^\s\x07\x1b"']+/,
 };
+/**
+ * Rejoin a secret the pty split across lines, so the masker can see it.
+ *
+ * `maskString` matches `sk-ant-[A-Za-z0-9_-]{8,}`, which a line break inside
+ * the token defeats — and the pty wraps at its width, so a ~100-character
+ * token arrives in pieces as a matter of course. Measured: the head gets
+ * masked and the tail is printed verbatim into an error detail that travels to
+ * the dashboard. Rejoining first costs nothing and closes it.
+ */
+export function rejoinWrappedSecrets(text) {
+    return text.replace(/sk-ant-[A-Za-z0-9_-]*(?:\n[A-Za-z0-9_-]+)+/g, (match) => match.replace(/\n/g, ''));
+}
 /** Strip ANSI/OSC control sequences so text matching sees plain output. */
 export function stripControl(raw) {
     return raw
@@ -38,18 +52,132 @@ export function extractDeviceCode(raw) {
     // Device-auth user codes look like XXXX-XXXX (letters/digits).
     return stripControl(raw).match(/\b[A-Z0-9]{4,8}-[A-Z0-9]{4,8}\b/)?.[0] ?? null;
 }
+/**
+ * Did the CLI reject the subcommand itself, rather than fail the login?
+ *
+ * Commander prints «unknown command» / «error: unknown option» and exits
+ * before any network call. Anything else — a refused grant, no subscription, a
+ * DNS failure — is a real answer and must NOT be retried on the legacy command,
+ * or we would quietly downgrade a healthy machine to an inference-only token.
+ */
+function looksLikeUnsupportedSubcommand(output) {
+    // Anchored to Commander's own usage-error wording. The loose version matched
+    // anywhere in the relayed CLI output, so a genuine login failure that merely
+    // mentioned an unknown option would silently downgrade a healthy machine to
+    // an inference-only token — the very thing this release stops doing.
+    return /error:\s*unknown (?:command|option)\b|unrecognized subcommand/i.test(output);
+}
+/**
+ * What «sign in» actually is, per agent.
+ *
+ * `claude auth login` and NOT `claude setup-token`, and the difference is the
+ * whole of ticket «Sign in does nothing». Measured against the 2.1.220 binary
+ * and stated outright in Anthropic's docs: `setup-token` mints a long-lived
+ * INFERENCE-ONLY token, prints it to the terminal, and «does not save the token
+ * anywhere». It never touches `~/.claude/.credentials.json` — the file
+ * `claudeAuthStatus()` below reads to decide whether this machine is signed in.
+ * So the relay completed a real OAuth flow, the CLI exited 0, we reported
+ * success, and the panel's immediate re-probe answered «No Claude login on this
+ * server». Nobody was wrong; the two halves were simply about different things.
+ *
+ * `claude auth login --claudeai` is the same OAuth flow through the same pty
+ * harness — verified live: it prints the authorize URL and then waits on stdin
+ * with «Paste code here if prompted >» — except it persists the credential and
+ * asks for the full subscription scope rather than inference alone.
+ *
+ * `--claudeai` is explicit so the CLI never stops to ask «subscription or
+ * Console?»: a menu waiting for an arrow key is indistinguishable, from here,
+ * from a login that hung.
+ */
 const LOGIN_COMMANDS = {
-    claude: 'claude setup-token',
+    claude: 'claude auth login --claudeai',
     codex: 'codex login --device-auth',
 };
+/**
+ * The pre-0.27.0 command, kept for one job only: a `claude` old enough to have
+ * no `auth login` subcommand. There the CLI exits immediately with a usage
+ * error, and leaving that machine with no way to sign in at all would be a
+ * worse regression than the bug this replaced. On that path we capture the
+ * printed token ourselves (see `agent-auth.ts`) so the outcome is still a
+ * login the panel can see.
+ */
+const CLAUDE_LEGACY_LOGIN = 'claude setup-token';
+/**
+ * A pty on a headless server must not try to launch a browser.
+ *
+ * `claude auth login` prints «Opening browser to sign in…» and calls the
+ * platform opener first. On a server that is merely noise, but on a machine
+ * with a desktop session it pops a window in front of whoever is sitting there
+ * — for a sign-in they did not start, on a host they may not own. The URL is
+ * printed regardless, which is the only part this flow uses.
+ */
+function relayEnv(extra = {}) {
+    const env = { ...process.env, ...extra };
+    env['BROWSER'] = 'true';
+    delete env['DISPLAY'];
+    delete env['WAYLAND_DISPLAY'];
+    return env;
+}
+/**
+ * Is the command this relay is about to run actually present?
+ *
+ * Split out because the answer differs by shape: a bare name is looked up on
+ * PATH, while an absolute path (what the tests inject, and what a hand-written
+ * config could hold) is checked where it points. Without this the missing-CLI
+ * case surfaced as «login exited before printing a sign-in URL: script:
+ * command not found» — an error about the pty helper, on a machine whose real
+ * problem was that nobody had installed the agent for that user. That was
+ * axon-prod-01 exactly: a dedicated user, an empty home, no `claude` anywhere.
+ */
+function commandExists(command) {
+    const binary = command.trim().split(/\s+/)[0] ?? '';
+    if (!binary)
+        return false;
+    if (binary.includes(path.sep)) {
+        try {
+            fs.accessSync(binary, fs.constants.X_OK);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    return whichExecutable(binary) !== null;
+}
 export class AuthRelay {
     commands;
+    deps;
     active = null;
-    constructor(commands = LOGIN_COMMANDS) {
+    constructor(commands = LOGIN_COMMANDS, deps = {}) {
         this.commands = commands;
+        this.deps = deps;
     }
     /** Start (or restart) a login flow and wait until the sign-in URL appears. */
     async start(agent) {
+        this.cancel();
+        const command = this.commands[agent] ?? '';
+        if (!commandExists(command)) {
+            const binary = command.trim().split(/\s+/)[0] ?? agent;
+            throw new Error(`\`${binary}\` is not installed for ${runnerIdentity().user} on this server — ` +
+                'install the agent CLI for that user (or use the installer’s --user mode, which does it) and try again');
+        }
+        if (!whichExecutable('script')) {
+            // util-linux, and the only reason a pty exists here at all.
+            throw new Error('the `script` command (util-linux) is missing on this server — the sign-in needs it to run the agent CLI on a terminal');
+        }
+        try {
+            return await this.startWith(agent, this.commands[agent] ?? '', false);
+        }
+        catch (error) {
+            // Only the one recoverable shape: a `claude` too old to have `auth
+            // login`. Everything else is the answer, not a reason to try again.
+            if (agent !== 'claude' || !looksLikeUnsupportedSubcommand(String(error)))
+                throw error;
+            log.warn('auth-relay: this claude has no `auth login` — falling back to setup-token');
+            return this.startWith(agent, CLAUDE_LEGACY_LOGIN, true);
+        }
+    }
+    async startWith(agent, command, captureToken) {
         this.cancel();
         // Codex logs into a THROWAWAY home and is promoted only on success. The
         // old flow deleted the shared credential link up front, so abandoning the
@@ -57,10 +185,10 @@ export class AuthRelay {
         // with no way back except restarting the daemon — and writing through the
         // link would have overwritten the host user's own account (QA-100 MINOR-5).
         const stagingHome = agent === 'codex' ? prepareStagingHome() : null;
-        const proc = spawn('script', ['-qec', this.commands[agent], '/dev/null'], {
+        const proc = spawn('script', ['-qec', command, '/dev/null'], {
             stdio: ['pipe', 'pipe', 'pipe'],
             // Codex must log in to a home WE control, never the host user's ~/.codex.
-            ...(stagingHome ? { env: { ...process.env, CODEX_HOME: stagingHome } } : {}),
+            env: relayEnv(stagingHome ? { CODEX_HOME: stagingHome } : {}),
         });
         const relay = {
             agent,
@@ -68,6 +196,8 @@ export class AuthRelay {
             buffer: '',
             exited: false,
             exitCode: null,
+            command,
+            captureToken,
             killTimer: setTimeout(() => this.cancel(), RELAY_MAX_LIFETIME_MS),
         };
         relay.killTimer.unref();
@@ -121,7 +251,7 @@ export class AuthRelay {
                 return { url, ...(code ? { code } : {}), expectsCode: agent === 'claude' };
             }
             if (relay.exited) {
-                const tail = maskString(stripControl(relay.buffer)).slice(-400);
+                const tail = maskString(rejoinWrappedSecrets(stripControl(relay.buffer))).slice(-400);
                 this.cancel();
                 throw new Error(`${agent} login exited before printing a sign-in URL: ${tail}`);
             }
@@ -148,21 +278,79 @@ export class AuthRelay {
         while (Date.now() < deadline) {
             const fresh = stripControl(relay.buffer.slice(bufferMark));
             if (relay.exited) {
+                const raw = relay.buffer;
                 this.cancel();
-                if (relay.exitCode === 0)
-                    return { ok: true };
-                return { ok: false, detail: maskString(fresh).slice(-400) || 'Login failed' };
+                if (relay.exitCode !== 0) {
+                    return {
+                        ok: false,
+                        detail: maskString(rejoinWrappedSecrets(fresh)).slice(-400) || 'Login failed',
+                    };
+                }
+                // Exit 0 is the CLI's opinion. Ours has to be «is this machine signed
+                // in now», because those two came apart before and nobody noticed for
+                // weeks: `setup-token` exits 0 over a credential it never stored.
+                return this.confirmSignedIn(relay, raw);
             }
             if (/invalid|error|failed|expired/i.test(fresh)) {
                 // The CLI usually re-prompts after a bad code; surface it and keep
                 // the relay alive so the user can retry with a corrected code.
-                return { ok: false, detail: maskString(fresh).trim().slice(-400) };
+                return { ok: false, detail: maskString(rejoinWrappedSecrets(fresh)).trim().slice(-400) };
             }
             await sleep(300);
         }
         this.cancel();
         return { ok: false, detail: 'Timed out waiting for the login to complete' };
     }
+    /**
+     * The CLI exited 0 — but is the machine actually signed in?
+     *
+     * Asked rather than assumed. Reporting a success the panel then contradicts
+     * one second later is worse than reporting a failure: it sends the person
+     * looking for a permissions problem that does not exist, which is exactly
+     * what happened on axon-prod-01.
+     */
+    async confirmSignedIn(relay, raw) {
+        if (relay.agent !== 'claude')
+            return { ok: true };
+        // Legacy `setup-token`: the token exists only in the output. Keep it, or
+        // the whole flow was for nothing.
+        if (relay.captureToken) {
+            const token = extractOauthToken(stripControl(raw));
+            if (!token) {
+                return {
+                    ok: false,
+                    detail: 'the sign-in finished but this older Claude CLI printed no usable token — ' +
+                        'update the Claude CLI on the server and try again',
+                };
+            }
+            try {
+                storeClaudeToken(token);
+                applyStoredClaudeToken();
+            }
+            catch (error) {
+                return { ok: false, detail: `could not store the token on this server: ${String(error)}` };
+            }
+            log.info('auth-relay: stored a long-lived Claude token for this runner');
+            clearAgentAuthFailure('claude');
+            return { ok: true, detail: 'signed in with a long-lived token stored on this server' };
+        }
+        // `claude auth login` writes the credential just before it exits; give the
+        // filesystem a couple of beats rather than racing it.
+        const probe = this.deps.claudeStatus ?? claudeAuthStatus;
+        for (let attempt = 0; attempt < 4; attempt++) {
+            const status = await probe();
+            if (status.status === 'ok') {
+                clearAgentAuthFailure('claude');
+                return { ok: true };
+            }
+            await sleep(300);
+        }
+        return {
+            ok: false,
+            detail: 'the sign-in completed but no login was stored on this server — ' +
+                'check that the user the runner runs as can write its own ~/.claude directory',
+        };
+    }
     cancel() {
         const relay = this.active;
         if (!relay)
@@ -224,6 +412,25 @@ export async function claudeAuthStatus(homedir = os.homedir()) {
     if (process.env['CLAUDE_CODE_OAUTH_TOKEN']) {
         return { status: 'ok', detail: 'CLAUDE_CODE_OAUTH_TOKEN is configured' };
     }
+    /**
+     * A token this runner captured itself (the `setup-token` fallback) is the
+     * LAST word, never the first.
+     *
+     * It used to short-circuit ahead of the credentials file, and that was three
+     * bugs in one line: a real `/login` afterwards could never show through, the
+     * post-exchange re-probe could not fail (so `confirmSignedIn` always agreed
+     * with itself), and there was no way to get back to «signed out» short of
+     * deleting a file nobody documents. Read below, after the file has had its
+     * say — and read from disk rather than from the environment, so `doctor` (a
+     * different process, which never applied it) gives the same verdict as the
+     * daemon.
+     */
+    const fallbackToken = () => storedClaudeToken()
+        ? {
+            status: 'ok',
+            detail: 'signed in with a long-lived token stored on this server',
+        }
+        : null;
     const file = path.join(homedir, '.claude', '.credentials.json');
     let raw;
     try {
@@ -236,7 +443,7 @@ export async function claudeAuthStatus(homedir = os.homedir()) {
         // sends the user re-authenticating a credential that is sitting right
         // there (the same mistake #121 is about, one layer down).
         if (code === 'ENOENT' || code === 'ENOTDIR') {
-            return { status: 'missing', detail: 'No Claude login on this server' };
+            return fallbackToken() ?? { status: 'missing', detail: 'No Claude login on this server' };
         }
         // No `log.warn` here: this probe is on a 60-second timer since #121, and a
         // machine with EACCES on that file would write the same line forever.
@@ -273,7 +480,7 @@ export async function claudeAuthStatus(homedir = os.homedir()) {
     // Nothing recognisable in the blob at all — no token, not even a date. That
     // is «never signed in here», and it must offer the button that fixes it.
     if (!hasAccess && !hasRefresh && accessExpiry === undefined) {
-        return { status: 'missing', detail: 'No subscription login found' };
+        return fallbackToken() ?? { status: 'missing', detail: 'No subscription login found' };
     }
     // A date we can read outranks the token beside it (the pre-#121 contract, and
     // the reason a dated-but-token-less fixture still reads as expired); with no
@@ -292,11 +499,11 @@ export async function claudeAuthStatus(homedir = os.homedir()) {
     const effectiveExpiry = refreshLive ? refreshExpiry : accessExpiry;
     const expiresAt = effectiveExpiry === undefined ? undefined : new Date(effectiveExpiry).toISOString();
     if (!accessLive && !refreshLive) {
-        return {
+        return (fallbackToken() ?? {
             status: 'expired',
             ...(expiresAt ? { expiresAt } : {}),
             detail: 'the stored login has expired',
-        };
+        });
     }
     return {
         status: 'ok',
@@ -324,6 +531,14 @@ const authFailures = new Map();
 export function noteAgentAuthFailure(agent) {
     authFailures.set(agent, Date.now());
     log.warn('auth-relay: agent sign-in refused during a session', { agent });
+    // A refusal is the only authority on a revoked credential, and a token we
+    // captured ourselves has no other expiry we can see. Keeping it would let a
+    // dead login outlive the evidence: the failure marker times out after 15
+    // minutes and the panel would go green again over the same dead token.
+    if (agent === 'claude' && storedClaudeToken()) {
+        clearStoredClaudeToken();
+        log.warn('auth-relay: discarded the stored Claude token after a refusal');
+    }
 }
 /** The agent just worked — whatever was wrong with the sign-in is not. */
 export function clearAgentAuthFailure(agent) {

package/dist/environment.d.ts

@@ -77,6 +77,20 @@ export interface AgentConfigContour {
     plugins: boolean;
     codexDir: boolean;
     codexConfig: boolean;
+    /**
+     * MCP servers an agent session in this home will actually see, and the ones
+     * that are configured but invisible to it.
+     *
+     * Both numbers, because the difference IS the bug. `claude mcp add` defaults
+     * to LOCAL scope, which stores the server under
+     * `~/.claude.json → projects["<cwd>"].mcpServers` — keyed by the directory it
+     * was added from. Runner sessions work in a per-session git worktree, so that
+     * key never matches and the servers are simply absent. On a live machine this
+     * read as «the agent lost Playwright and Context7», and the only cure was
+     * moving them to user scope (the top-level `mcpServers`).
+     */
+    mcpUserScope: number;
+    mcpProjectScope: number;
 }
 export declare function agentConfigContour(home?: string): AgentConfigContour;
 /**
@@ -116,6 +130,7 @@ export interface ToolCheck {
     /** Set when the tool is there but this user cannot use it. */
     problem?: string;
 }
+export declare function whichExecutable(name: string): string | null;
 /**
  * Node, as THIS user sees it.
  *

package/dist/environment.js

@@ -114,6 +114,27 @@ export async function addSafeDirectory(repoPath) {
         timeout: 10_000,
     });
 }
+/**
+ * Count MCP servers in the CLI's own config file, by scope.
+ *
+ * Reads `~/.claude.json` directly rather than shelling out to `claude mcp
+ * list`: this is a diagnostic that must work when the CLI is missing, and it
+ * must not spend ~300 MB and a second of a doctor run to answer.
+ */
+function countMcpServers(home) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(home, '.claude.json'), 'utf8'));
+        const user = Object.keys(parsed.mcpServers ?? {}).length;
+        let project = 0;
+        for (const entry of Object.values(parsed.projects ?? {})) {
+            project += Object.keys(entry?.mcpServers ?? {}).length;
+        }
+        return { user, project };
+    }
+    catch {
+        return { user: 0, project: 0 };
+    }
+}
 function countAllowRules(file) {
     try {
         const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
@@ -152,6 +173,7 @@ export function agentConfigContour(home = os.homedir()) {
     const localSettings = path.join(claudeDir, 'settings.local.json');
     const commandsDir = path.join(claudeDir, 'commands');
     const codexDir = path.join(home, '.codex');
+    const mcp = countMcpServers(home);
     return {
         home,
         claudeDir: fs.existsSync(claudeDir),
@@ -166,6 +188,8 @@ export function agentConfigContour(home = os.homedir()) {
         plugins: fs.existsSync(path.join(claudeDir, 'plugins')),
         codexDir: fs.existsSync(codexDir),
         codexConfig: fs.existsSync(path.join(codexDir, 'config.toml')),
+        mcpUserScope: mcp.user,
+        mcpProjectScope: mcp.project,
     };
 }
 /**
@@ -266,7 +290,7 @@ export function knownWorkspacePaths() {
         return [];
     }
 }
-function whichExecutable(name) {
+export function whichExecutable(name) {
     for (const dir of (process.env['PATH'] ?? '').split(path.delimiter).filter(Boolean)) {
         const candidate = path.join(dir, name);
         try {