@bridge4dev/runner 0.65.1 → 0.67.0

package/dist/agent-auth.js

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { log } from './log.js';
 import { configDir } from './paths.js';
 /**
  * A Claude login this runner owns, for the one CLI that cannot store one.
@@ -40,17 +41,235 @@ export function agentAuthPath() {
  * Eleven months keeps it inside the token's own life while still expiring.
  */
 const TOKEN_MAX_AGE_MS = 334 * 24 * 60 * 60 * 1000;
+const isObject = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+const shortString = (value, max) => typeof value === 'string' && value.length > 0 && value.length <= max ? value : undefined;
+const isoString = (value) => {
+    const text = shortString(value, 40);
+    return text !== undefined && Number.isFinite(Date.parse(text)) ? text : undefined;
+};
+function readIdentity(value) {
+    if (!isObject(value))
+        return undefined;
+    const at = isoString(value['at']);
+    if (!at)
+        return undefined;
+    const email = shortString(value['email'], 320);
+    const orgId = shortString(value['orgId'], 100);
+    const orgName = shortString(value['orgName'], 200);
+    const plan = shortString(value['plan'], 60);
+    return {
+        ...(email ? { email } : {}),
+        ...(orgId ? { orgId } : {}),
+        ...(orgName ? { orgName } : {}),
+        ...(plan ? { plan } : {}),
+        at,
+    };
+}
+/** A list of account records, each read on its own: one unreadable entry drops only itself. */
+function parseRecords(entries) {
+    const seen = new Set();
+    return entries.flatMap((entry) => {
+        if (!isObject(entry))
+            return [];
+        const id = shortString(entry['id'], 64);
+        const addedAt = isoString(entry['addedAt']);
+        if (!id || !addedAt || seen.has(id))
+            return [];
+        seen.add(id);
+        const identity = readIdentity(entry['lastSeenIdentity']);
+        const expiredAt = isoString(entry['loginExpiredAt']);
+        return [
+            {
+                id,
+                addedAt,
+                ...(identity ? { lastSeenIdentity: identity } : {}),
+                ...(expiredAt ? { loginExpiredAt: expiredAt } : {}),
+            },
+        ];
+    });
+}
+/**
+ * The file as it was written, field by field.
+ *
+ * Forgiving one level down, like every JSON this project stores (CLAUDE.md: never
+ * `.strict()` on stored JSON): a record we cannot read is dropped, not the file.
+ * A person can edit this file, and a pre-#422 runner never wrote the new fields –
+ * both have to read as a working machine login, not as «signed out» (К7).
+ */
+function parse(raw) {
+    if (!isObject(raw))
+        return {};
+    const file = {};
+    if (typeof raw['claudeOauthToken'] === 'string')
+        file.claudeOauthToken = raw['claudeOauthToken'];
+    if (typeof raw['updatedAt'] === 'string')
+        file.updatedAt = raw['updatedAt'];
+    if (Array.isArray(raw['claudeAccounts']))
+        file.claudeAccounts = parseRecords(raw['claudeAccounts']);
+    if (Array.isArray(raw['codexAccounts']))
+        file.codexAccounts = parseRecords(raw['codexAccounts']);
+    const active = shortString(raw['claudeActiveAccount'], 64);
+    if (active)
+        file.claudeActiveAccount = active;
+    if (isObject(raw['claudeMachine'])) {
+        const identity = readIdentity(raw['claudeMachine']['lastSeenIdentity']);
+        const expiredAt = isoString(raw['claudeMachine']['loginExpiredAt']);
+        file.claudeMachine = {
+            ...(identity ? { lastSeenIdentity: identity } : {}),
+            ...(expiredAt ? { loginExpiredAt: expiredAt } : {}),
+        };
+    }
+    return file;
+}
+const KNOWN_KEYS = new Set([
+    'claudeOauthToken',
+    'updatedAt',
+    'claudeAccounts',
+    'claudeActiveAccount',
+    'claudeMachine',
+    'codexAccounts',
+]);
+const RECORD_KEYS = new Set(['id', 'addedAt', 'lastSeenIdentity', 'loginExpiredAt']);
+const MACHINE_KEYS = new Set(['lastSeenIdentity', 'loginExpiredAt']);
+const IDENTITY_KEYS = new Set(['email', 'orgId', 'orgName', 'plan', 'at']);
+/** The fields of `raw` this runner does not know – to be written back untouched. */
+function unknownFields(raw, known) {
+    if (!isObject(raw))
+        return {};
+    return Object.fromEntries(Object.entries(raw).filter(([key]) => !known.has(key)));
+}
+/** A known object written over the unknown fields the same object had on disk. */
+function mergeObject(raw, known, keys, identityRaw) {
+    if (!known)
+        return undefined;
+    const merged = { ...unknownFields(raw, keys), ...known };
+    const identity = known.lastSeenIdentity;
+    if (identity)
+        merged['lastSeenIdentity'] = { ...unknownFields(identityRaw, IDENTITY_KEYS), ...identity };
+    return merged;
+}
+/** The lists of account records – both agents keep theirs in the same shape (#422 S4). */
+const RECORD_LISTS = new Set(['claudeAccounts', 'codexAccounts']);
+/**
+ * One list of records as it is to be written: every record this runner knows,
+ * over the unknown fields the same record had on disk, followed by the records it
+ * could not read at all. `undefined` – the list is not written.
+ */
+function mergeRecordList(original, list, known) {
+    const rawAccounts = Array.isArray(original[list]) ? original[list] : [];
+    const rawById = new Map(rawAccounts.filter(isObject).map((entry) => [String(entry['id']), entry]));
+    const readable = new Set((parse(original)[list] ?? []).map((record) => record.id));
+    const accounts = (known ?? []).map((record) => {
+        const rawEntry = rawById.get(record.id);
+        return mergeObject(rawEntry, record, RECORD_KEYS, isObject(rawEntry) ? rawEntry['lastSeenIdentity'] : undefined);
+    });
+    const unreadable = rawAccounts.filter((entry) => !isObject(entry) || !readable.has(String(entry['id'])));
+    if (accounts.length + unreadable.length === 0)
+        return undefined;
+    if (!known && unreadable.length === 0)
+        return undefined;
+    return [...accounts, ...unreadable];
+}
+/**
+ * The file to write: what this runner knows, over everything a newer runner put
+ * there – at the top level, inside each account record and its identity, and
+ * whole records this runner could not read at all (a newer id format must not
+ * lose its home's record on the first write after a downgrade).
+ */
+function withForeignFields(original, known) {
+    const body = unknownFields(original, KNOWN_KEYS);
+    for (const [key, value] of Object.entries(known)) {
+        if (value === undefined || RECORD_LISTS.has(key))
+            continue;
+        if (key === 'claudeMachine')
+            continue;
+        body[key] = value;
+    }
+    for (const list of RECORD_LISTS) {
+        const records = mergeRecordList(original, list, known[list]);
+        if (records)
+            body[list] = records;
+    }
+    if (known.claudeMachine) {
+        const rawMachine = original['claudeMachine'];
+        body['claudeMachine'] = mergeObject(rawMachine, known.claudeMachine, MACHINE_KEYS, isObject(rawMachine) ? rawMachine['lastSeenIdentity'] : undefined);
+    }
+    return body;
+}
 function read() {
     try {
-        const parsed = JSON.parse(fs.readFileSync(agentAuthPath(), 'utf8'));
-        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
-            return {};
-        return parsed;
+        return parse(JSON.parse(fs.readFileSync(agentAuthPath(), 'utf8')));
     }
     catch {
         return {};
     }
 }
+/** Everything this runner keeps in `agent-auth.json`, read forgivingly. */
+export function readAgentAuth() {
+    return read();
+}
+/**
+ * Change some fields of the file and keep every other one.
+ *
+ * Read → change → write, never «write what I know». The two writers this file
+ * had before #422 wrote the WHOLE file (`storeClaudeToken`) or deleted it
+ * (`clearStoredClaudeToken`), and with a list of accounts beside the token either
+ * would have erased every saved login's record on its way past (S1 item 3).
+ *
+ * A file that exists but cannot be parsed is moved aside, not overwritten: it may
+ * be the only record of which home belongs to which account, and «unreadable»
+ * must not quietly become «empty». A file that cannot be READ (EACCES) throws –
+ * writing over something we could not look at is the same mistake.
+ *
+ * Synchronous from read to rename, so two changes inside this process cannot
+ * interleave. Same write-then-rename as the config, 0600.
+ */
+export function updateAgentAuth(change) {
+    const dir = configDir();
+    const target = agentAuthPath();
+    let current = {};
+    // What a NEWER runner wrote and this one does not know – kept as it is, so a
+    // downgrade followed by a login does not erase what the upgrade recorded.
+    let original = {};
+    let raw = null;
+    try {
+        raw = fs.readFileSync(target, 'utf8');
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    if (raw !== null) {
+        try {
+            const parsed = JSON.parse(raw);
+            if (!isObject(parsed))
+                throw new Error('not an object');
+            current = parse(parsed);
+            original = parsed;
+        }
+        catch {
+            const aside = `${target}.unreadable-${Date.now()}`;
+            fs.renameSync(target, aside);
+            log.warn('agent-auth: the file could not be parsed – moved aside, starting a new one', {
+                aside,
+            });
+        }
+    }
+    change(current);
+    const body = withForeignFields(original, current);
+    if (Object.keys(body).length === 0) {
+        fs.rmSync(target, { force: true });
+        return current;
+    }
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    // A torn file here reads as «signed out» and sends somebody through the whole
+    // login again.
+    const tmp = path.join(dir, `.agent-auth.${process.pid}.tmp`);
+    fs.writeFileSync(tmp, `${JSON.stringify(body, null, 2)}\n`, { mode: FILE_MODE });
+    fs.renameSync(tmp, target);
+    fs.chmodSync(target, FILE_MODE);
+    return current;
+}
 /** The token we hold for Claude, or null once it is too old to trust. */
 export function storedClaudeToken() {
     const file = read();
@@ -62,23 +281,30 @@ export function storedClaudeToken() {
         return null;
     return value;
 }
+/** When the stored token was captured, in ms – null without one. */
+export function storedClaudeTokenAtMs() {
+    const file = read();
+    if (typeof file.claudeOauthToken !== 'string' || !file.claudeOauthToken)
+        return null;
+    const stamped = typeof file.updatedAt === 'string' ? Date.parse(file.updatedAt) : NaN;
+    return Number.isFinite(stamped) ? stamped : null;
+}
 export function storeClaudeToken(token) {
-    const dir = configDir();
-    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const file = agentAuthPath();
-    // Same write-then-rename as the config: a torn file here reads as «signed
-    // out» and sends somebody through the whole login again.
-    const tmp = path.join(dir, `.agent-auth.${process.pid}.tmp`);
-    fs.writeFileSync(tmp, `${JSON.stringify({ claudeOauthToken: token, updatedAt: new Date().toISOString() }, null, 2)}\n`, { mode: FILE_MODE });
-    fs.renameSync(tmp, file);
-    fs.chmodSync(file, FILE_MODE);
+    updateAgentAuth((file) => {
+        file.claudeOauthToken = token;
+        file.updatedAt = new Date().toISOString();
+    });
 }
+/** Drop the stored token – and nothing else: the accounts beside it stay (#422). */
 export function clearStoredClaudeToken() {
     try {
-        fs.rmSync(agentAuthPath(), { force: true });
+        updateAgentAuth((file) => {
+            delete file.claudeOauthToken;
+            delete file.updatedAt;
+        });
     }
     catch {
-        /* nothing to clear */
+        /* nothing to clear, or nothing we may touch */
     }
 }
 /**
@@ -98,9 +324,41 @@ export function applyStoredClaudeToken() {
     const token = storedClaudeToken();
     if (!token)
         return false;
+    // A token a session was refused with stays on disk (#422, D2), but it is not
+    // put back into the environment: there it would outrank a fresh
+    // `~/.claude/.credentials.json` for every session, on every daemon start,
+    // until somebody found this file by hand.
+    if (storedClaudeTokenRefused())
+        return false;
     process.env['CLAUDE_CODE_OAUTH_TOKEN'] = token;
     return true;
 }
+/**
+ * Was a session refused with the token this runner captured – after it was
+ * captured? A token stored after the refusal is newer evidence and outranks it.
+ * A token with no readable capture date is judged by the mark alone.
+ */
+export function storedClaudeTokenRefused() {
+    const file = read();
+    if (!file.claudeOauthToken)
+        return false;
+    const marked = file.claudeMachine?.loginExpiredAt;
+    if (!marked)
+        return false;
+    const markedMs = Date.parse(marked);
+    if (!Number.isFinite(markedMs))
+        return false;
+    const capturedMs = typeof file.updatedAt === 'string' ? Date.parse(file.updatedAt) : NaN;
+    return !Number.isFinite(capturedMs) || capturedMs <= markedMs;
+}
+/**
+ * The daemon's environment carries exactly the token this runner captured – so
+ * a machine-login session refused now was refused WITH it.
+ */
+export function environmentCarriesStoredToken() {
+    const token = storedClaudeToken();
+    return !!token && process.env['CLAUDE_CODE_OAUTH_TOKEN'] === token;
+}
 /**
  * The OAuth token `claude setup-token` printed, reassembled out of pty output.
  *

package/dist/auth-relay.d.ts

@@ -1,4 +1,5 @@
 import { type RelayAgentName } from './agent-registry.js';
+import { type AccountCard } from './claude-homes.js';
 /**
  * The agents the login relay can drive — the registry's wire alphabet (Р15).
  *
@@ -18,6 +19,23 @@ export interface LoginCodeResult {
     ok: boolean;
     detail?: string;
 }
+/** Where a sign-in through the account commands lands (#422 §8). */
+export type AccountLoginTarget = 'machine' | 'saved';
+/**
+ * `agent_account_login_code` – the row that signed in, or why not.
+ *
+ * A wrong code is an answer, not an exception, exactly as in the old flow: the
+ * CLI usually asks again, and the relay stays alive for the corrected code.
+ */
+export type AccountLoginCodeResult = {
+    ok: true;
+    account: AccountCard;
+    active: string;
+    replaced?: string;
+} | {
+    ok: false;
+    detail: string;
+};
 export interface AgentAuthStatus {
     /**
      * `missing` — never signed in here (or the CLI is not installed).
@@ -31,6 +49,16 @@ export interface AgentAuthStatus {
     status: 'ok' | 'expired' | 'missing' | 'unknown';
     expiresAt?: string;
     detail?: string;
+    /**
+     * Which account this verdict is about (#422 §8) – the one the next session
+     * starts under. Identity from what the runner last read, never from a CLI call
+     * in the poll (R14). Optional on the wire: an older API strips it.
+     */
+    activeAccount?: {
+        id: string;
+        email?: string;
+        orgId?: string;
+    };
 }
 /**
  * Rejoin a secret the pty split across lines, so the masker can see it.
@@ -60,9 +88,48 @@ export declare class AuthRelay {
     constructor(commands?: Record<RelayAgent, string>, deps?: AuthRelayDeps);
     /** Start (or restart) a login flow and wait until the sign-in URL appears. */
     start(agent: RelayAgent): Promise<LoginStartResult>;
+    /**
+     * `agent_account_login_start` for Claude (#422 §8, R2).
+     *
+     * `saved` signs in inside a fresh staging home (`CLAUDE_CONFIG_DIR`), which
+     * becomes a saved account only when the code is accepted – the machine's own
+     * login is not touched by it at all. `machine` is today's sign-in into
+     * `~/.claude`, the one legitimate way to write that file, pressed by a person.
+     *
+     * Either way the CLI runs WITHOUT the operator's `CLAUDE_CODE_OAUTH_TOKEN`
+     * (and API keys): the CLI puts that variable above every login file, so a
+     * sign-in started with it could report the token's blind identity instead of
+     * the account that just signed in.
+     *
+     * No `setup-token` fallback for `saved`: that command stores nothing in a home
+     * (it prints an inference-only token, D1), so a «saved account» made from it
+     * would be a row with no login. `machine` keeps the fallback it always had.
+     */
+    startAccountLogin(target: AccountLoginTarget, agent?: RelayAgent): Promise<LoginStartResult>;
+    /** The CLI and the pty helper are both there – or a sentence saying which is not. */
+    private assertCanRun;
     private startWith;
     /** Paste the confirmation code back into the waiting CLI (Claude flow). */
     submitCode(agent: RelayAgent, code: string): Promise<LoginCodeResult>;
+    /**
+     * `agent_account_login_code` – finish a sign-in the account commands started.
+     *
+     * `saved`: the staging home is adopted by rename – one subscription, one row,
+     * the signed-in row active (`adoptLoginResult`, R15). `machine`: the same
+     * check the old door makes, then the machine login becomes active and its
+     * identity is asked once, so the answer names who ACTUALLY signed in (§2:
+     * «Signed in as B, not A») rather than who the machine was before.
+     */
+    submitAccountCode(code: string): Promise<AccountLoginCodeResult>;
+    /**
+     * Write the code, wait for the CLI's answer.
+     *
+     * `{ raw }` – the CLI exited 0 and the relay is released (its staging home, if
+     * any, is kept for the caller to adopt). Anything else is the answer to hand
+     * back: a non-zero exit or a timeout ends the sign-in; a line saying «invalid»
+     * keeps it alive, because the CLI usually asks again.
+     */
+    private exchangeCode;
     /**
      * The CLI exited 0 — but is the machine actually signed in?
      *
@@ -73,47 +140,68 @@ export declare class AuthRelay {
      */
     private confirmSignedIn;
     cancel(): void;
+    /**
+     * End THIS sign-in: its process, its slot if it still holds it, its staging
+     * home. A loop driving an older sign-in must never end a newer one that took
+     * the slot meanwhile – with `cancel()` in its place, two starts close together
+     * killed each other, and a stale code exchange killed the newer start (found by
+     * the independent check of S2).
+     */
+    private abandon;
+    /** Stop driving a relay: its process, its timer, its slot. Its staging home stays. */
+    private release;
+    /** A sign-in that will not be adopted leaves nothing behind (§8, S2 item 2). */
+    private discardStaging;
 }
 /**
- * Claude: the subscription login is recorded in the CLI's own credentials file.
- * The RUNNER reads it (its own host user's file) — the agent itself is still
- * denied this path by layer-1 policy.
+ * Claude: the verdict on the account the next session starts under (#422 R14).
  *
- * `expiresAt` is NOT the login. It is the expiry of a short-lived access token
- * (~8 hours on a live file), and next to it sits `refreshToken` with
- * `refreshTokenExpiresAt` ~26 days out, which the CLI spends silently on its
- * next run. Judging the login by `expiresAt` alone is why every server nobody
- * had touched since the morning reported "login expired — re-login needed"
- * over a login that was good for another three weeks (#121). Codex has carried
- * exactly this guard since day one (`readCodexCredential`); Claude did not.
+ * The machine login – the pre-#422 rule word for word: the operator's variable,
+ * then `~/.claude/.credentials.json`, then a token this runner captured. A
+ * saved account – ONLY its own credentials file: a session under it has the
+ * operator's token taken out of its environment, so letting the variable or the
+ * captured token answer here would paint a green verdict over a switch that
+ * does not work (#121, К14). Nothing here runs a CLI; the file judge and its
+ * reasons live in `claude-homes.ts` so the account list reads the same lines.
  *
- * Deliberately NOT asking the CLI. `claude auth status --json` looks like an
- * arbiter and is not one: measured live (SDK binary 2.1.218), it answers
- * `loggedIn: true` for a credential whose access token has expired AND which
- * carries no refresh token at all — i.e. for a genuinely dead login. It never
- * leaves the machine, so it cannot see a server-side revocation either. It
- * would have cost a ~800 ms / ~300 MB subprocess per poll under `MemoryMax=2G`
- * (gotcha #100) and echoed the account's e-mail and org name to every member of
- * the organization, in exchange for no truth at all. A revoked login is caught
- * instead by `noteAgentAuthFailure` below — from a real refusal, not a guess.
+ * The RUNNER reads these files (its own host user's) — the agent itself is still
+ * denied these paths by layer-1 policy.
+ *
+ * `account: 'machine'` asks about the machine login whatever is active – what the
+ * sign-in relay needs after writing `~/.claude`.
  */
-export declare function claudeAuthStatus(homedir?: string): Promise<AgentAuthStatus>;
-/** A session just failed to authenticate as this agent. */
-export declare function noteAgentAuthFailure(agent: RelayAgent): void;
-/** The agent just worked — whatever was wrong with the sign-in is not. */
-export declare function clearAgentAuthFailure(agent: RelayAgent): void;
+export declare function claudeAuthStatus(homedir?: string, options?: {
+    account?: 'active' | 'machine';
+}): Promise<AgentAuthStatus>;
 /**
- * Is a refusal still being held against this agent?
+ * A session just failed to authenticate as this agent – under this account.
+ *
+ * `accountId` is the account the SESSION started under (R14), not whatever the
+ * machine has active now. Nothing is deleted any more (#422 S1 item 3, D2): the
+ * old code threw a captured Claude token away on the spot, and that meant
+ * erasing the file the saved accounts are listed in. A Claude refusal is kept as
+ * a mark on the row instead – it outlives a daemon restart, and a login written
+ * after it (a refresh, a new sign-in) outranks it.
+ */
+export declare function noteAgentAuthFailure(agent: RelayAgent, accountId?: string): void;
+/** The agent just worked under this account — whatever was wrong with its sign-in is not. */
+export declare function clearAgentAuthFailure(agent: RelayAgent, accountId?: string): void;
+/**
+ * Is a refusal still being held against this agent (and account)?
  *
  * Exported so the wiring in `supervisor.ts` can be pinned by a test without
  * shelling out to the agent CLIs: this predicate IS the mechanism the panel's
  * demotion reads, and three unguarded lines were carrying it (QA-117 M6).
  */
-export declare function agentAuthFailureActive(agent: RelayAgent): boolean;
+export declare function agentAuthFailureActive(agent: RelayAgent, accountId?: string): boolean;
 /**
  * Codex reports its own login state via an exit code (0 signed in / 1 not).
  * Probed against the RUNNER's home: the host user can be signed in while our
  * isolated home is not, and it is ours that sessions use.
+ *
+ * About the login new sessions start under (#422 S4): the machine login through
+ * the link, or the saved login the link points at – named in `activeAccount`,
+ * read locally from the file, no CLI for it (R14).
  */
 export declare function codexAuthStatus(): Promise<AgentAuthStatus>;
 export declare function agentAuthStatuses(): Promise<{