@bridge4dev/runner 0.65.1 → 0.66.0

package/dist/adapters/claude.js

@@ -13,6 +13,7 @@ import { percentFromUtilization, RATE_WINDOW_MINUTES, rateWindowKey } from './ra
 import { AgentTaskTray } from './agent-tasks.js';
 import { applyUsagePercentages, lastUsageRows, readUsageRows } from './claude-usage.js';
 import { assertClaudeInstalled, claudeExecutableOption, sessionClaudePath, } from '../agent-binary.js';
+import { noteSessionAccount, refreshAccountIdentity, releaseSessionAccount, resolveSessionAccount, currentHomeOrgId, usageSignature, withAccountHome, } from '../claude-homes.js';
 /** Same 2KB the SDK keeps: enough for the CLI's last words, not a log sink. */
 const STDERR_TAIL_LIMIT = 2048;
 import { answerSummary, answerValue, discussMessage, invalidationMessage, mirrorOptions, newAskId, MAX_OPTIONS, MAX_QUESTIONS, OPTION_TEXT_LIMIT, QUESTION_TEXT_LIMIT, } from './questions.js';
@@ -101,8 +102,18 @@ export function scrubbedEnv() {
  * and there is nothing left for `IS_SANDBOX` to weaken. In every other mode the
  * scrub stands, which is what the comment on `ENV_ALLOWLIST` has always meant.
  */
-function agentEnv(mode, sessionId) {
-    const env = scrubbedEnv();
+export function agentEnv(mode, sessionId, account = { kind: 'machine', home: null }) {
+    /**
+     * The account's home (#422 S1 item 4) – HERE, in the session's environment, and
+     * never in the daemon's (К1): the daemon's environment is also what the verdict
+     * and `doctor` would read, and a variable there turns every verdict green.
+     *
+     * For a saved account the operator's `CLAUDE_CODE_OAUTH_TOKEN` comes OUT: the
+     * CLI ranks it above every login file, so with it left in, switching accounts
+     * would change nothing under a green verdict (К14). For the machine login the
+     * environment is exactly what it was before #422.
+     */
+    const env = withAccountHome(scrubbedEnv(), account);
     if (mode === 'full' && process.getuid?.() === 0)
         env['IS_SANDBOX'] = '1';
     /**
@@ -480,8 +491,30 @@ class ClaudeSession {
         this.beginTurnFacts();
     }
     events = this.output;
+    /**
+     * The account this process runs under, captured at its start and kept to its
+     * end (#422 R14, R16): the limits it measures, the refusal it may meet and the
+     * account its card names all belong to THIS account, whatever the machine is
+     * switched to meanwhile.
+     */
+    account;
+    accountId;
+    /** Started on the operator's token: its limits go out unsigned (see the constructor). */
+    onOperatorToken;
     constructor(spec, queryFn) {
         this.spec = spec;
+        const account = resolveSessionAccount();
+        // A machine-login session that runs on a TOKEN is not the account of the
+        // credentials file: `claude auth status` is asked without the token, so the
+        // identity on file names the file's login, and this session's card and its
+        // limits would carry somebody else's name (found by the independent check of
+        // S1). Such a session keeps only the row id – unsigned, as before #422.
+        this.onOperatorToken =
+            account.kind === 'machine' && Boolean(process.env['CLAUDE_CODE_OAUTH_TOKEN']);
+        this.account = this.onOperatorToken
+            ? { id: account.id, kind: account.kind, home: null }
+            : account;
+        this.accountId = this.account.id;
         // Refused rather than honoured, and BEFORE anything is built from it: on a
         // STRICT workspace `full` would launch the CLI in `bypassPermissions`, and
         // there layer 1 is never consulted — the manager's shield would be spent by
@@ -522,7 +555,7 @@ class ClaudeSession {
         this.mcpConfigFile = mcpConfigFile;
         const options = {
             cwd: spec.cwd,
-            env: agentEnv(this.mode, spec.sessionId),
+            env: agentEnv(this.mode, spec.sessionId, this.account),
             // Empty while `USE_BUNDLED_CLAUDE` — the SDK keeps resolving its own
             // bundled binary, exactly as before. After C3 this pins the system
             // `claude`, which is the file the card measures and the button installs.
@@ -615,7 +648,17 @@ class ClaudeSession {
                     ? { mcpServers }
                     : {}),
         };
-        this.q = queryFn({ prompt: this.input, options });
+        // Registered before the process exists, released when it is gone
+        // (`consume`'s finally): `forget` refuses an account a live process writes
+        // into, and a replaced login's old home waits for exactly these to end.
+        noteSessionAccount(spec.sessionId, this.account.id);
+        try {
+            this.q = queryFn({ prompt: this.input, options });
+        }
+        catch (error) {
+            releaseSessionAccount(spec.sessionId);
+            throw error;
+        }
         void this.consume();
         // Ticket #119 / QA-114 MAJOR-3: if the protected file could not be written,
         // say so where a person will see it, not only in journald.
@@ -897,12 +940,25 @@ class ClaudeSession {
     refreshUsage() {
         if (this.stopped)
             return;
-        if (this.absorbUsageReading(lastUsageRows()))
+        // THIS session's account (#422 R16): the reading is keyed by its
+        // subscription, measured under its home, and signed by what that home says
+        // right after – never whatever the machine is switched to now.
+        const account = {
+            id: this.account.id,
+            home: this.account.home,
+            ...(this.account.orgId ? { orgId: this.account.orgId } : {}),
+        };
+        if (this.absorbUsageReading(lastUsageRows(account)))
             this.emitRateLimits();
         const binary = sessionClaudePath();
         if (!binary)
             return;
-        void readUsageRows({ binary })
+        void readUsageRows({
+            binary,
+            account,
+            env: withAccountHome({ ...process.env }, this.account),
+            sign: () => usageSignature(this.account),
+        })
             .then((reading) => {
             if (this.stopped)
                 return;
@@ -913,6 +969,48 @@ class ClaudeSession {
     }
     /** The measurement already folded in, so an older one cannot undo a newer event. */
     usageAppliedAtMs = 0;
+    /**
+     * The CLI's own signature on the last reading folded in (#422 §8). Only ever
+     * this session's account: a reading signed by another subscription never
+     * reaches `absorbUsageReading`'s fold.
+     */
+    usageAccountUuid;
+    /**
+     * The subscription of a session that could not name one at start: the first
+     * signed reading measured under its home, and never overwritten. Taken from
+     * every reading instead, it moved with the home – a terminal login into
+     * another subscription re-based a running session onto it, and the latch below
+     * never saw a change (found by the second independent check of S2).
+     */
+    firstReadingOrgId;
+    /** Latched: this home was signed in to another subscription while the session ran. */
+    signedInElsewhere = false;
+    /**
+     * Has somebody signed this session's home in to a different subscription?
+     *
+     * «Log in again» on the machine row, or `claude auth login` in a terminal,
+     * rewrites the home the session reads by PATH, and the CLI process moves onto
+     * the new login at its next token refresh (gotcha 531). From then on its
+     * figures are the new subscription's, and signing them with the one captured at
+     * start would put B's percentages under A's name – exactly what the signature
+     * exists to prevent (found by the independent check of S2). The frame then goes
+     * unsigned, as before #422, until the process ends.
+     */
+    homeSignedInElsewhere() {
+        if (this.signedInElsewhere)
+            return true;
+        const captured = this.signatureOrgId();
+        if (!captured)
+            return false;
+        const now = currentHomeOrgId(this.account.home);
+        if (now !== undefined && now !== captured) {
+            this.signedInElsewhere = true;
+            log.info('claude: the session home was signed in to another subscription – limits unsigned', {
+                sessionId: this.spec.sessionId,
+            });
+        }
+        return this.signedInElsewhere;
+    }
     /**
      * Fold a `/usage` reading into this session's window map.
      *
@@ -936,6 +1034,23 @@ class ClaudeSession {
     absorbUsageReading(reading) {
         if (!reading || reading.rows.length === 0)
             return false;
+        // Somebody else's figures (#422 S1 item 5): a reading signed by a different
+        // subscription than this session's never lands in its windows. Unsigned on
+        // either side is taken as before – that is every pre-#422 reading.
+        const own = this.signatureOrgId();
+        if (reading.orgId && own && reading.orgId !== own)
+            return false;
+        // A session that could not name its subscription takes the first signed
+        // reading as its own – but only one of the subscription its home names NOW.
+        // The machine's cache can still hold a reading from the home's previous
+        // login (a terminal sign-in is not seen by `forgetClaudeUsage`), and fixing
+        // that as the signature refused every fresh reading for the rest of the
+        // session (found by the check of the second fix round of S2).
+        if (reading.orgId && !own) {
+            const homeNow = currentHomeOrgId(this.account.home);
+            if (homeNow !== undefined && homeNow !== reading.orgId)
+                return false;
+        }
         const fresh = reading.measuredAtMs > this.usageAppliedAtMs;
         const before = this.rateLimitsFingerprint();
         // A percentage proves a plan as surely as the event does.
@@ -949,8 +1064,16 @@ class ClaudeSession {
         }
         if (fresh)
             this.usageAppliedAtMs = reading.measuredAtMs;
+        if (reading.accountUuid)
+            this.usageAccountUuid = reading.accountUuid;
+        if (reading.orgId && !own)
+            this.firstReadingOrgId = reading.orgId;
         return this.rateLimitsFingerprint() !== before;
     }
+    /** The subscription this session signs with: captured at start, else its first signed reading. */
+    signatureOrgId() {
+        return this.account.orgId ?? this.firstReadingOrgId;
+    }
     rateLimitsFingerprint() {
         return JSON.stringify([this.rateLimitsAvailable, [...this.rateLimitWindows.values()]]);
     }
@@ -961,9 +1084,20 @@ class ClaudeSession {
         return blocked;
     }
     emitRateLimits(blocked = null) {
+        // Signed by THIS session's account (#422 §8, S2 item 4): the windows come
+        // from its own stream and from readings measured under its own home. The
+        // subscription is the one captured at start; a session that could not name
+        // it borrows the reading's, which was measured in the very same home. A
+        // session on the operator's token signs nothing: the home's file names the
+        // file's login, not the token's (the constructor's note).
+        const unsigned = this.onOperatorToken || this.homeSignedInElsewhere();
+        const orgId = unsigned ? undefined : this.signatureOrgId();
+        const accountUuid = unsigned ? undefined : this.usageAccountUuid;
         this.emit({
             type: 'rate_limits',
             limits: {
+                ...(accountUuid ? { accountUuid } : {}),
+                ...(orgId ? { orgId } : {}),
                 blocked,
                 available: this.rateLimitsAvailable,
                 planType: this.ratePlanType,
@@ -1204,12 +1338,24 @@ class ClaudeSession {
             currentMode: this.mode,
             ...(this.model ? { currentModel: this.model } : {}),
             ...(this.effort ? { currentEffort: this.effort } : {}),
-            ...(account
+            // What the live CLI says first, what the runner last read about the home
+            // second; plus WHICH of the machine's accounts this is (#422 §8), which
+            // only the runner knows. No block at all when neither side knows anything
+            // – exactly as before.
+            ...(account || this.account.email
                 ? {
                     account: {
-                        ...(account.email ? { email: account.email } : {}),
-                        ...(account.organization ? { organization: account.organization } : {}),
-                        ...(account.subscriptionType ? { plan: account.subscriptionType } : {}),
+                        id: this.account.id,
+                        ...((account?.email ?? this.account.email)
+                            ? { email: account?.email ?? this.account.email }
+                            : {}),
+                        ...((account?.organization ?? this.account.orgName)
+                            ? { organization: account?.organization ?? this.account.orgName }
+                            : {}),
+                        ...((account?.subscriptionType ?? this.account.plan)
+                            ? { plan: account?.subscriptionType ?? this.account.plan }
+                            : {}),
+                        ...(this.account.orgId ? { orgId: this.account.orgId } : {}),
                     },
                 }
                 : {}),
@@ -2502,6 +2648,7 @@ class ClaudeSession {
             // the path that catches a session which died before the CLI ever
             // answered.
             this.removeMcpConfig();
+            releaseSessionAccount(this.spec.sessionId);
             this.stopped = true;
             this.input.end();
             this.output.end();
@@ -2735,7 +2882,20 @@ export class ClaudeAdapter {
          */
         if (this.queryFn === query)
             assertClaudeInstalled();
-        return new ClaudeSession(spec, this.queryFn);
+        const session = new ClaudeSession(spec, this.queryFn);
+        /**
+         * Who the home is, asked once when nobody knows or the home says it changed
+         * (#422 R14 c) – in the background, after the session is on its way. The
+         * next session and the account list get the answer; this one keeps what it
+         * started with.
+         *
+         * Only for the real SDK, for the reason above: an injected `query` is a test,
+         * and a test must not run `claude auth status` against this machine's login.
+         */
+        if (this.queryFn === query) {
+            void refreshAccountIdentity(session.accountId).catch(() => undefined);
+        }
+        return session;
     }
 }
 //# sourceMappingURL=claude.js.map

package/dist/adapters/types.d.ts

@@ -87,9 +87,17 @@ export interface CommandOption {
     argumentHint?: string;
 }
 export interface AgentAccountInfo {
+    /**
+     * Which of the machine's accounts THIS session started under (#422 §8) –
+     * `machine` or a saved account's id. Kept to the session's end: switching the
+     * machine does not move a running session.
+     */
+    id?: string;
     email?: string;
     organization?: string;
     plan?: string;
+    /** The subscription key (D19) – what the limits panel matches figures against. */
+    orgId?: string;
 }
 export interface McpServerStatusInfo {
     name: string;
@@ -197,6 +205,15 @@ export interface AgentRateLimits {
         key: AgentRateLimitWindow['key'];
         resetsAt: string | null;
     } | null;
+    /**
+     * Whose figures these are (#422 §8) – the account the session runs under.
+     * `orgId` is the subscription key (`claude auth status`), `accountUuid` the
+     * signature the CLI itself writes next to a `/usage` reading. Both optional:
+     * a session nobody could identify sends none, and so does every runner from
+     * before #422 – the panel then draws exactly as it did (R12).
+     */
+    accountUuid?: string;
+    orgId?: string;
 }
 /** Everything the dashboard needs to render agent controls, live from the agent. */
 export interface AgentCapabilities {
@@ -727,6 +744,11 @@ export type InterruptOutcome =
 export interface AgentSession {
     /** Ends when the underlying agent process is gone. */
     events: AsyncIterable<AgentEvent>;
+    /**
+     * The account this session's process runs under (#422) – what a refusal or a
+     * successful turn is attributed to (R14). Absent: the machine login.
+     */
+    readonly accountId?: string;
     answerPermission(requestId: string, allow: boolean, note?: string): void;
     /**
      * Answer (or discuss) an open question. Returns false when the ask is no

package/dist/agent-auth.d.ts

@@ -1,7 +1,83 @@
 export declare function agentAuthPath(): string;
+/**
+ * Who a Claude home last said it was – the answer of `claude auth status` in it.
+ *
+ * Kept on disk (#422 R14) so a restarted runner does not forget whose numbers a
+ * usage reading is and whom `auth_status` names as active. Not a verdict on the
+ * login: `auth status` says `loggedIn: true` over a dead credential, which is why
+ * the verdict stays with the credentials file.
+ */
+export interface ClaudeIdentity {
+    email?: string;
+    /** The subscription key (D19, R1): one subscription – one row. */
+    orgId?: string;
+    orgName?: string;
+    /** `subscriptionType` – `max`, `pro`, … */
+    plan?: string;
+    /** When this identity was read, ISO. */
+    at: string;
+}
+/** One saved Claude login of this machine (#422). Files live in its home, not here. */
+export interface ClaudeAccountRecord {
+    id: string;
+    addedAt: string;
+    lastSeenIdentity?: ClaudeIdentity;
+    /**
+     * A session under this account was refused (D2): the row is marked, never
+     * removed. Read against the credentials file – a file written after the mark
+     * (the CLI refreshed, somebody signed in again) outranks it.
+     */
+    loginExpiredAt?: string;
+}
+/** What the runner remembers about the machine row itself – it has no record of its own. */
+export interface ClaudeMachineRecord {
+    lastSeenIdentity?: ClaudeIdentity;
+    /**
+     * A refusal held against the token this runner captured (`claudeOauthToken`)
+     * – set only when the refused session actually ran with that token. It
+     * replaces the old «discard the token after a refusal», which erased the whole
+     * file and with it every saved account (#422 S1 item 3).
+     */
+    loginExpiredAt?: string;
+}
+export interface AgentAuthFile {
+    claudeOauthToken?: string;
+    /**
+     * When `claudeOauthToken` was stored – the token's age, and ONLY that. Every
+     * other write leaves it alone, or saving an account would make a
+     * months-old token look freshly captured.
+     */
+    updatedAt?: string;
+    claudeAccounts?: ClaudeAccountRecord[];
+    /** Absent means the machine login – the pre-#422 file reads exactly as before. */
+    claudeActiveAccount?: string;
+    claudeMachine?: ClaudeMachineRecord;
+}
+/** Everything this runner keeps in `agent-auth.json`, read forgivingly. */
+export declare function readAgentAuth(): AgentAuthFile;
+/**
+ * Change some fields of the file and keep every other one.
+ *
+ * Read → change → write, never «write what I know». The two writers this file
+ * had before #422 wrote the WHOLE file (`storeClaudeToken`) or deleted it
+ * (`clearStoredClaudeToken`), and with a list of accounts beside the token either
+ * would have erased every saved login's record on its way past (S1 item 3).
+ *
+ * A file that exists but cannot be parsed is moved aside, not overwritten: it may
+ * be the only record of which home belongs to which account, and «unreadable»
+ * must not quietly become «empty». A file that cannot be READ (EACCES) throws –
+ * writing over something we could not look at is the same mistake.
+ *
+ * Synchronous from read to rename, so two changes inside this process cannot
+ * interleave. Same write-then-rename as the config, 0600.
+ */
+export declare function updateAgentAuth(change: (file: AgentAuthFile) => void): AgentAuthFile;
 /** The token we hold for Claude, or null once it is too old to trust. */
 export declare function storedClaudeToken(): string | null;
+/** When the stored token was captured, in ms – null without one. */
+export declare function storedClaudeTokenAtMs(): number | null;
 export declare function storeClaudeToken(token: string): void;
+/** Drop the stored token – and nothing else: the accounts beside it stay (#422). */
 export declare function clearStoredClaudeToken(): void;
 /**
  * Put a stored token into this process's environment, unless the operator
@@ -15,6 +91,17 @@ export declare function clearStoredClaudeToken(): void;
  * Returns true when it applied one.
  */
 export declare function applyStoredClaudeToken(): boolean;
+/**
+ * Was a session refused with the token this runner captured – after it was
+ * captured? A token stored after the refusal is newer evidence and outranks it.
+ * A token with no readable capture date is judged by the mark alone.
+ */
+export declare function storedClaudeTokenRefused(): boolean;
+/**
+ * The daemon's environment carries exactly the token this runner captured – so
+ * a machine-login session refused now was refused WITH it.
+ */
+export declare function environmentCarriesStoredToken(): boolean;
 /**
  * The OAuth token `claude setup-token` printed, reassembled out of pty output.
  *