@bridge4dev/runner 0.65.1 → 0.67.0

package/dist/adapters/claude.d.ts

@@ -1,8 +1,37 @@
 import { query } from '@anthropic-ai/claude-agent-sdk';
-import { type AgentAdapter, type AgentQuestion, type AgentSession, type SessionSpec } from './types.js';
+import { type AgentAdapter, type AgentMode, type AgentQuestion, type AgentSession, type SessionSpec } from './types.js';
+import { type SessionAccount } from '../claude-homes.js';
 export declare function truncate(text: string, limit?: number): string;
 /** Exported for the one-shot commit-message run (session 14), same rules. */
 export declare function scrubbedEnv(): Record<string, string>;
+/**
+ * The one env var the allowlist above refuses, added back for exactly one mode
+ * (ticket #156).
+ *
+ * The CLI's own guard, read out of the binary verbatim:
+ *
+ * ```js
+ * if (t === "bypassPermissions" || r) {
+ *   if (typeof process.getuid === "function" && process.getuid() === 0
+ *       && process.env.IS_SANDBOX !== "1" && !Z.CLAUDE_CODE_BUBBLEWRAP)
+ *     console.error("--dangerously-skip-permissions cannot be used with root/sudo privileges …"),
+ *     process.exit(1)
+ * }
+ * ```
+ *
+ * The runner's default install is root (`install.sh`), so on an ordinary
+ * machine «Unrestricted» did not degrade — it killed the session at launch with
+ * exit code 1. On the machine this was found on it happened to start, because
+ * `~/.claude/settings.json` carries `env: { IS_SANDBOX: "1" }` and this adapter
+ * loads user settings; that is a hole in the scrub covering a bug, not a fix.
+ *
+ * The condition here is the CLI's own, no wider: `full` AND uid 0. It is safe
+ * precisely where it is applied — `bypassPermissions` is the mode in which the
+ * SDK never calls `canUseTool` (it says so itself), so layer 1 is already inert
+ * and there is nothing left for `IS_SANDBOX` to weaken. In every other mode the
+ * scrub stands, which is what the comment on `ENV_ALLOWLIST` has always meant.
+ */
+export declare function agentEnv(mode: AgentMode, sessionId: string, account?: Pick<SessionAccount, 'kind' | 'home'>): Record<string, string>;
 /**
  * The whole `AskUserQuestion` payload, not just its first line.
  *

package/dist/adapters/claude.js

@@ -13,6 +13,7 @@ import { percentFromUtilization, RATE_WINDOW_MINUTES, rateWindowKey } from './ra
 import { AgentTaskTray } from './agent-tasks.js';
 import { applyUsagePercentages, lastUsageRows, readUsageRows } from './claude-usage.js';
 import { assertClaudeInstalled, claudeExecutableOption, sessionClaudePath, } from '../agent-binary.js';
+import { noteSessionAccount, refreshAccountIdentity, releaseSessionAccount, resolveSessionAccount, currentHomeOrgId, usageSignature, withAccountHome, } from '../claude-homes.js';
 /** Same 2KB the SDK keeps: enough for the CLI's last words, not a log sink. */
 const STDERR_TAIL_LIMIT = 2048;
 import { answerSummary, answerValue, discussMessage, invalidationMessage, mirrorOptions, newAskId, MAX_OPTIONS, MAX_QUESTIONS, OPTION_TEXT_LIMIT, QUESTION_TEXT_LIMIT, } from './questions.js';
@@ -101,8 +102,18 @@ export function scrubbedEnv() {
  * and there is nothing left for `IS_SANDBOX` to weaken. In every other mode the
  * scrub stands, which is what the comment on `ENV_ALLOWLIST` has always meant.
  */
-function agentEnv(mode, sessionId) {
-    const env = scrubbedEnv();
+export function agentEnv(mode, sessionId, account = { kind: 'machine', home: null }) {
+    /**
+     * The account's home (#422 S1 item 4) – HERE, in the session's environment, and
+     * never in the daemon's (К1): the daemon's environment is also what the verdict
+     * and `doctor` would read, and a variable there turns every verdict green.
+     *
+     * For a saved account the operator's `CLAUDE_CODE_OAUTH_TOKEN` comes OUT: the
+     * CLI ranks it above every login file, so with it left in, switching accounts
+     * would change nothing under a green verdict (К14). For the machine login the
+     * environment is exactly what it was before #422.
+     */
+    const env = withAccountHome(scrubbedEnv(), account);
     if (mode === 'full' && process.getuid?.() === 0)
         env['IS_SANDBOX'] = '1';
     /**
@@ -480,8 +491,30 @@ class ClaudeSession {
         this.beginTurnFacts();
     }
     events = this.output;
+    /**
+     * The account this process runs under, captured at its start and kept to its
+     * end (#422 R14, R16): the limits it measures, the refusal it may meet and the
+     * account its card names all belong to THIS account, whatever the machine is
+     * switched to meanwhile.
+     */
+    account;
+    accountId;
+    /** Started on the operator's token: its limits go out unsigned (see the constructor). */
+    onOperatorToken;
     constructor(spec, queryFn) {
         this.spec = spec;
+        const account = resolveSessionAccount();
+        // A machine-login session that runs on a TOKEN is not the account of the
+        // credentials file: `claude auth status` is asked without the token, so the
+        // identity on file names the file's login, and this session's card and its
+        // limits would carry somebody else's name (found by the independent check of
+        // S1). Such a session keeps only the row id – unsigned, as before #422.
+        this.onOperatorToken =
+            account.kind === 'machine' && Boolean(process.env['CLAUDE_CODE_OAUTH_TOKEN']);
+        this.account = this.onOperatorToken
+            ? { id: account.id, kind: account.kind, home: null }
+            : account;
+        this.accountId = this.account.id;
         // Refused rather than honoured, and BEFORE anything is built from it: on a
         // STRICT workspace `full` would launch the CLI in `bypassPermissions`, and
         // there layer 1 is never consulted — the manager's shield would be spent by
@@ -522,7 +555,7 @@ class ClaudeSession {
         this.mcpConfigFile = mcpConfigFile;
         const options = {
             cwd: spec.cwd,
-            env: agentEnv(this.mode, spec.sessionId),
+            env: agentEnv(this.mode, spec.sessionId, this.account),
             // Empty while `USE_BUNDLED_CLAUDE` — the SDK keeps resolving its own
             // bundled binary, exactly as before. After C3 this pins the system
             // `claude`, which is the file the card measures and the button installs.
@@ -615,7 +648,17 @@ class ClaudeSession {
                     ? { mcpServers }
                     : {}),
         };
-        this.q = queryFn({ prompt: this.input, options });
+        // Registered before the process exists, released when it is gone
+        // (`consume`'s finally): `forget` refuses an account a live process writes
+        // into, and a replaced login's old home waits for exactly these to end.
+        noteSessionAccount(spec.sessionId, this.account.id);
+        try {
+            this.q = queryFn({ prompt: this.input, options });
+        }
+        catch (error) {
+            releaseSessionAccount(spec.sessionId);
+            throw error;
+        }
         void this.consume();
         // Ticket #119 / QA-114 MAJOR-3: if the protected file could not be written,
         // say so where a person will see it, not only in journald.
@@ -897,12 +940,25 @@ class ClaudeSession {
     refreshUsage() {
         if (this.stopped)
             return;
-        if (this.absorbUsageReading(lastUsageRows()))
+        // THIS session's account (#422 R16): the reading is keyed by its
+        // subscription, measured under its home, and signed by what that home says
+        // right after – never whatever the machine is switched to now.
+        const account = {
+            id: this.account.id,
+            home: this.account.home,
+            ...(this.account.orgId ? { orgId: this.account.orgId } : {}),
+        };
+        if (this.absorbUsageReading(lastUsageRows(account)))
             this.emitRateLimits();
         const binary = sessionClaudePath();
         if (!binary)
             return;
-        void readUsageRows({ binary })
+        void readUsageRows({
+            binary,
+            account,
+            env: withAccountHome({ ...process.env }, this.account),
+            sign: () => usageSignature(this.account),
+        })
             .then((reading) => {
             if (this.stopped)
                 return;
@@ -913,6 +969,48 @@ class ClaudeSession {
     }
     /** The measurement already folded in, so an older one cannot undo a newer event. */
     usageAppliedAtMs = 0;
+    /**
+     * The CLI's own signature on the last reading folded in (#422 §8). Only ever
+     * this session's account: a reading signed by another subscription never
+     * reaches `absorbUsageReading`'s fold.
+     */
+    usageAccountUuid;
+    /**
+     * The subscription of a session that could not name one at start: the first
+     * signed reading measured under its home, and never overwritten. Taken from
+     * every reading instead, it moved with the home – a terminal login into
+     * another subscription re-based a running session onto it, and the latch below
+     * never saw a change (found by the second independent check of S2).
+     */
+    firstReadingOrgId;
+    /** Latched: this home was signed in to another subscription while the session ran. */
+    signedInElsewhere = false;
+    /**
+     * Has somebody signed this session's home in to a different subscription?
+     *
+     * «Log in again» on the machine row, or `claude auth login` in a terminal,
+     * rewrites the home the session reads by PATH, and the CLI process moves onto
+     * the new login at its next token refresh (gotcha 531). From then on its
+     * figures are the new subscription's, and signing them with the one captured at
+     * start would put B's percentages under A's name – exactly what the signature
+     * exists to prevent (found by the independent check of S2). The frame then goes
+     * unsigned, as before #422, until the process ends.
+     */
+    homeSignedInElsewhere() {
+        if (this.signedInElsewhere)
+            return true;
+        const captured = this.signatureOrgId();
+        if (!captured)
+            return false;
+        const now = currentHomeOrgId(this.account.home);
+        if (now !== undefined && now !== captured) {
+            this.signedInElsewhere = true;
+            log.info('claude: the session home was signed in to another subscription – limits unsigned', {
+                sessionId: this.spec.sessionId,
+            });
+        }
+        return this.signedInElsewhere;
+    }
     /**
      * Fold a `/usage` reading into this session's window map.
      *
@@ -936,6 +1034,23 @@ class ClaudeSession {
     absorbUsageReading(reading) {
         if (!reading || reading.rows.length === 0)
             return false;
+        // Somebody else's figures (#422 S1 item 5): a reading signed by a different
+        // subscription than this session's never lands in its windows. Unsigned on
+        // either side is taken as before – that is every pre-#422 reading.
+        const own = this.signatureOrgId();
+        if (reading.orgId && own && reading.orgId !== own)
+            return false;
+        // A session that could not name its subscription takes the first signed
+        // reading as its own – but only one of the subscription its home names NOW.
+        // The machine's cache can still hold a reading from the home's previous
+        // login (a terminal sign-in is not seen by `forgetClaudeUsage`), and fixing
+        // that as the signature refused every fresh reading for the rest of the
+        // session (found by the check of the second fix round of S2).
+        if (reading.orgId && !own) {
+            const homeNow = currentHomeOrgId(this.account.home);
+            if (homeNow !== undefined && homeNow !== reading.orgId)
+                return false;
+        }
         const fresh = reading.measuredAtMs > this.usageAppliedAtMs;
         const before = this.rateLimitsFingerprint();
         // A percentage proves a plan as surely as the event does.
@@ -949,8 +1064,16 @@ class ClaudeSession {
         }
         if (fresh)
             this.usageAppliedAtMs = reading.measuredAtMs;
+        if (reading.accountUuid)
+            this.usageAccountUuid = reading.accountUuid;
+        if (reading.orgId && !own)
+            this.firstReadingOrgId = reading.orgId;
         return this.rateLimitsFingerprint() !== before;
     }
+    /** The subscription this session signs with: captured at start, else its first signed reading. */
+    signatureOrgId() {
+        return this.account.orgId ?? this.firstReadingOrgId;
+    }
     rateLimitsFingerprint() {
         return JSON.stringify([this.rateLimitsAvailable, [...this.rateLimitWindows.values()]]);
     }
@@ -961,9 +1084,20 @@ class ClaudeSession {
         return blocked;
     }
     emitRateLimits(blocked = null) {
+        // Signed by THIS session's account (#422 §8, S2 item 4): the windows come
+        // from its own stream and from readings measured under its own home. The
+        // subscription is the one captured at start; a session that could not name
+        // it borrows the reading's, which was measured in the very same home. A
+        // session on the operator's token signs nothing: the home's file names the
+        // file's login, not the token's (the constructor's note).
+        const unsigned = this.onOperatorToken || this.homeSignedInElsewhere();
+        const orgId = unsigned ? undefined : this.signatureOrgId();
+        const accountUuid = unsigned ? undefined : this.usageAccountUuid;
         this.emit({
             type: 'rate_limits',
             limits: {
+                ...(accountUuid ? { accountUuid } : {}),
+                ...(orgId ? { orgId } : {}),
                 blocked,
                 available: this.rateLimitsAvailable,
                 planType: this.ratePlanType,
@@ -1204,12 +1338,24 @@ class ClaudeSession {
             currentMode: this.mode,
             ...(this.model ? { currentModel: this.model } : {}),
             ...(this.effort ? { currentEffort: this.effort } : {}),
-            ...(account
+            // What the live CLI says first, what the runner last read about the home
+            // second; plus WHICH of the machine's accounts this is (#422 §8), which
+            // only the runner knows. No block at all when neither side knows anything
+            // – exactly as before.
+            ...(account || this.account.email
                 ? {
                     account: {
-                        ...(account.email ? { email: account.email } : {}),
-                        ...(account.organization ? { organization: account.organization } : {}),
-                        ...(account.subscriptionType ? { plan: account.subscriptionType } : {}),
+                        id: this.account.id,
+                        ...((account?.email ?? this.account.email)
+                            ? { email: account?.email ?? this.account.email }
+                            : {}),
+                        ...((account?.organization ?? this.account.orgName)
+                            ? { organization: account?.organization ?? this.account.orgName }
+                            : {}),
+                        ...((account?.subscriptionType ?? this.account.plan)
+                            ? { plan: account?.subscriptionType ?? this.account.plan }
+                            : {}),
+                        ...(this.account.orgId ? { orgId: this.account.orgId } : {}),
                     },
                 }
                 : {}),
@@ -2502,6 +2648,7 @@ class ClaudeSession {
             // the path that catches a session which died before the CLI ever
             // answered.
             this.removeMcpConfig();
+            releaseSessionAccount(this.spec.sessionId);
             this.stopped = true;
             this.input.end();
             this.output.end();
@@ -2735,7 +2882,20 @@ export class ClaudeAdapter {
          */
         if (this.queryFn === query)
             assertClaudeInstalled();
-        return new ClaudeSession(spec, this.queryFn);
+        const session = new ClaudeSession(spec, this.queryFn);
+        /**
+         * Who the home is, asked once when nobody knows or the home says it changed
+         * (#422 R14 c) – in the background, after the session is on its way. The
+         * next session and the account list get the answer; this one keeps what it
+         * started with.
+         *
+         * Only for the real SDK, for the reason above: an injected `query` is a test,
+         * and a test must not run `claude auth status` against this machine's login.
+         */
+        if (this.queryFn === query) {
+            void refreshAccountIdentity(session.accountId).catch(() => undefined);
+        }
+        return session;
     }
 }
 //# sourceMappingURL=claude.js.map

package/dist/adapters/codex-home.d.ts

@@ -1,24 +1,90 @@
 export type CodexAuthMode = 'link' | 'own';
 export interface CodexHome {
     path: string;
-    /** How the home is authenticated — reported in notices, not a secret. */
-    auth: 'linked' | 'own' | 'missing';
+    /**
+     * How the home is authenticated — reported in notices, not a secret.
+     * `account` – a saved login is linked (`accountId`); `own` – a real file the
+     * runner could not move into the store and keeps using where it is.
+     */
+    auth: 'linked' | 'account' | 'own' | 'missing';
+    /** The saved login the home is set to – present with `account`, and with `missing` under it. */
+    accountId?: string;
 }
 export declare function codexHomePath(): string;
+/** Where the saved Codex logins live – inside the one home, beside what they share. */
+export declare function codexAccountsDir(home?: string): string;
+/** The directory of one saved login. Throws on anything that is not an account id. */
+export declare function codexAccountDir(id: string, home?: string): string;
+/** The login file of one saved account. */
+export declare function codexAccountAuthFile(id: string, home?: string): string;
+/** The machine login of Codex – the host user's own file, never written by DevBridge (R13). */
+export declare function hostCodexAuthFile(homedir?: string): string;
 /**
- * Throwaway home for a device-code login. The flow runs here and is promoted
- * into the real home only on success, so an abandoned or timed-out sign-in
- * cannot destroy a credential that was working.
+ * Throwaway homes for device-code logins, one per attempt. The flow runs there
+ * and its login is moved into the store only on success, so an abandoned or
+ * timed-out sign-in cannot destroy a credential that was working.
  */
 export declare function stagingCodexHomePath(): string;
+/**
+ * `[codex] auth` as the machine's owner WROTE it – `undefined` when the key is
+ * not in `config.toml`. Set once at daemon start.
+ *
+ * Only a mode that is really written may be forced, and even then not over a
+ * saved login (S4 item 2): the runner used to pass `link` by default from three
+ * places – the daemon start, every session start and the minute probe – and each
+ * of them would have undone a switch of account within a minute (К4).
+ */
+export declare function configureCodexAuth(mode: CodexAuthMode | undefined): void;
+export declare function configuredCodexAuth(): CodexAuthMode | undefined;
+/** Which saved login the home is set to, if any – the mark, read only. */
+export declare function markedCodexAccount(home?: string): string | null;
+/** Who a Codex login is, read locally from its own file – never a token. */
+export interface CodexIdentity {
+    email?: string;
+    /** `tokens.account_id` – the key of a Codex subscription (plan §8, S4 item 5). */
+    orgId?: string;
+    /** `chatgpt_plan_type` – `plus`, `pro`, `team`, … */
+    plan?: string;
+}
+export interface CodexCredential {
+    /**
+     * `ok` – a login the CLI can use; `expired` – a login past its date with no
+     * refresh token; `missing` – no file; `unreadable` – a file that is not a login
+     * (torn, hand-edited); `unknown` – we could not look (EACCES).
+     */
+    status: 'ok' | 'expired' | 'missing' | 'unreadable' | 'unknown';
+    /** A ChatGPT login (tokens) or an API key – only for a file that is a login. */
+    kind?: 'chatgpt' | 'apikey';
+    identity: CodexIdentity;
+    /** Only when the access token's own date is the login's date (no refresh token). */
+    expiresAt?: string;
+    /** Last write of the file, whole ms – a refusal mark older than this no longer holds. */
+    writtenMs?: number;
+}
+/**
+ * Read a Codex login file without letting a token out of this function.
+ *
+ * The identity comes from the claims of `id_token`, decoded locally (S4 item 8):
+ * `email`, and under `https://api.openai.com/auth` the plan and the ChatGPT
+ * account; `tokens.account_id` first for the key, the claim when it is absent. An
+ * internal file of the CLI (§11): whatever cannot be read is simply not there –
+ * no identity is invented, and a row without a key merges with nothing.
+ *
+ * The verdict is the pre-S4 one (`readCodexCredential`): a refresh token means
+ * the CLI renews the access token on its own, so only a lone access token past
+ * its `exp` is `expired`.
+ */
+export declare function readCodexCredentialFile(file: string): CodexCredential;
 /**
  * Create (or refresh) the runner's CODEX_HOME and return it.
  *
- * `auth: 'link'` (default) symlinks the host user's `~/.codex/auth.json` so the
- * runner uses their ChatGPT subscription and — importantly — shares one
- * credential store with their own CLI, so a token refresh on either side keeps
- * both working. `auth: 'own'` leaves the home unauthenticated until a
- * device-code login writes into it, which is the choice for full isolation.
+ * `link` (the default when nothing else is decided) symlinks the host user's
+ * `~/.codex/auth.json` so the runner uses their ChatGPT subscription and —
+ * importantly — shares one credential store with their own CLI, so a token
+ * refresh on either side keeps both working. `own` leaves the home
+ * unauthenticated until a device-code login is stored for it, which is the
+ * choice for full isolation. A saved login (`account:<id>`) is kept whatever
+ * the configured mode says (S4 item 2).
  *
  * A home under the OS temp dir still works, but codex then refuses to install
  * its helper binaries ("Refusing to create helper binaries under temporary
@@ -35,6 +101,9 @@ export declare function ensureCodexHome(options?: {
  * it only answers "is the credential still where we left it, and if not, can we
  * put it back". This is what makes a credential disappearing under a running
  * daemon self-healing instead of permanent.
+ *
+ * Forces nothing it was not told to by the machine's owner (S4 item 2): with no
+ * `[codex] auth` in `config.toml` the mark decides, and a saved login stays.
  */
 export declare function repairCodexAuth(options?: {
     auth?: CodexAuthMode;
@@ -42,20 +111,73 @@ export declare function repairCodexAuth(options?: {
 }): CodexHome;
 /**
  * Drop a linked auth.json so a device-code login writes our own file instead.
- *
- * Only ever called AFTER a login has actually succeeded in the staging home —
- * never as a pre-step. Detaching first meant an abandoned or timed-out sign-in
- * left the server permanently "not signed in", recoverable only by restarting
- * the daemon.
+ * Never a real credential: only a symlink is removed.
  */
 export declare function detachLinkedAuth(dir?: string): void;
+export interface StoredCodexLogin {
+    id: string;
+    /** The saved row whose login this one replaced – the same subscription (D19). */
+    replaced?: string;
+}
+/**
+ * Move a login file into the store (§8 `agent_account_login_code` for Codex, S4
+ * items 4 and 5) – by rename, and one subscription, one row.
+ *
+ * A known `account_id` that a saved row already has REPLACES that row's login:
+ * the row keeps its id (refusal marks and a live session are keyed by it, R15)
+ * and its `addedAt` becomes now – the date is that of the login the row holds,
+ * and a second sign-in of the same subscription must change something the
+ * window can see (S3 hands this over: `deviceSignInResult`). An unknown key
+ * merges with nothing. The machine row takes no part: it is the host's own file.
+ *
+ * The record is written BEFORE the file moves, so a failure never leaves a login
+ * nobody can list or forget; a move that fails takes its new record back.
+ */
+export declare function storeCodexLogin(source: string, options: {
+    activate: boolean;
+    home?: string;
+    replaceActive?: boolean;
+}): StoredCodexLogin;
 /**
- * Promote a credential produced by a staging login into the real home, and
- * record that this home now owns its own login.
+ * Make a row the one the home uses: the mark first, then the link.
+ *
+ * In that order on purpose – a daemon that dies between the two leaves a mark
+ * the next repair finishes (it points the link where the mark says), never a
+ * link that the next repair would undo.
+ *
+ * A real file in place of the link is dealt with FIRST (§8 `activate`, S4 item
+ * 7): the CLI may have refreshed the login in use a moment ago, and repointing
+ * over it would throw that token away.
+ */
+export declare function markActiveCodexLogin(id: string, dir?: string): void;
+export declare function setCodexActiveLogin(id: string, dir?: string): CodexHome;
+/**
+ * A fresh throwaway home for one device-code sign-in (config only, no credential).
+ *
+ * One directory per attempt, and every other one is removed first: only one
+ * sign-in runs on a machine at a time (the relay cancels the previous one before
+ * it gets here), and the pre-S4 runner kept a single fixed staging home that was
+ * never cleaned up – on this machine it had lain there since 01.08.2026.
  */
-export declare function adoptLoginResult(stagingDir: string, dir?: string): boolean;
-/** Seed a throwaway home for the device-code flow (config only, no credential). */
 export declare function prepareStagingHome(): string;
-/** Remove the staging home whatever the outcome — it may hold a credential. */
-export declare function discardStagingHome(): void;
+/** Remove one sign-in's home whatever the outcome — it may hold a credential. */
+export declare function discardStagingHome(dir: string): void;
+/**
+ * Remove every sign-in home – at daemon start (nothing can be signing in yet)
+ * and before a new sign-in. Includes the fixed-path staging home of runners
+ * before S4.
+ */
+export declare function discardAbandonedCodexStagingHomes(): number;
+/**
+ * A device-code sign-in in `stagingDir` finished: its login becomes a saved
+ * account – by rename, deduplicated by subscription – and the one in use (R15).
+ * The staging home is removed either way.
+ *
+ * `replaceActive` – the sign-in came through the one-login window, where it has
+ * always meant «this login from now on»: it takes the place of the login in use
+ * rather than adding a row (D27, for an organization without several logins).
+ */
+export declare function adoptLoginResult(stagingDir: string, options?: {
+    replaceActive?: boolean;
+}): StoredCodexLogin;
 //# sourceMappingURL=codex-home.d.ts.map