@code-yeongyu/senpi 2026.8.14 → 2026.8.17

package/dist/core/cursor-exec-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor-exec-bridge.js","sourceRoot":"","sources":["../../src/core/cursor-exec-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAEN,yBAAyB,EACzB,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EAEvB,qBAAqB,GACrB,MAAM,uBAAuB,CAAC;AAuB/B,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,QAAgB,EAAE,IAAY;IACtE,OAAO;QACN,IAAI,EAAE,YAAY;QAClB,UAAU;QACV,QAAQ;QACR,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,QAAgB;IACxD,OAAO;QACN,IAAI,EAAE,YAAY;QAClB,UAAU;QACV,QAAQ;QACR,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACzB,OAAgC,EAChC,QAAgB,EAChB,UAAkB,EAClB,IAA6B;IAE7B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,QAAQ,oCAAoC,CAAC,CAAC;IACjG,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,oCAAoC;IACpC,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAkB;QAC/B,IAAI,EAAE,UAAU;QAChB,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,SAAS;KACpB,CAAC;IAEF,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7F,IAAI,CAAC;QACJ,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,SAAS,QAAQ,iCAAiC,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACnD,IAAI,EAAE,WAAW;YACjB,UAAU;YACV,QAAQ;YACR,KAAK,EAAE,MAAM;SACb,CAAC,CAAC;QACH,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,IAAI,4BAA4B,CAAC;YACjE,OAAO,CAAC,SAAS,EAAE,CAAC;gBACnB,IAAI,EAAE,oBAAoB;gBAC1B,UAAU;gBACV,QAAQ;gBACR,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE;gBAC1E,OAAO,EAAE,IAAI;aACb,CAAC,CAAC;YACH,OAAO,WAAW,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QAC7F,MAAM,UAAU,GAAsB;YACrC,IAAI,EAAE,YAAY;YAClB,UAAU;YACV,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC;QACF,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAClG,OAAO,UAAU,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,EAAE,oBAAoB;YAC1B,UAAU;YACV,QAAQ;YACR,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE;YAC1E,OAAO,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;AACF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAgC;IACtE,OAAO;QACN,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CACpB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE;YAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;SACjB,CAAC;QAEH,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAEpG,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CACpB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE;YAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS;YAC5B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS;YAC5B,UAAU,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SAC5D,CAAC;QAEH,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CACrB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE;YAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,UAAU,EAAE,CAAC;SACtF,CAAC;QAEH,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CACrB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE;YAC7C,OAAO,EAAE,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,IAAI,SAAS,CAAC;YACpF,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SACpE,CAAC;QAEH,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC;YAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,QAAQ,qCAAqC,CAAC,CAAC;YACvG,CAAC;YACD,OAAO,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACtB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrF,kEAAkE;YAClE,mEAAmE;YACnE,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACnE,OAAO,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CACtB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE;YAC7C,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YAC1B,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;SAC3C,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CACtB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE;YAC7C,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;SACxF,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CACvB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE;YAC9C,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;SAC1B,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CACtB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE;YAC7C,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YAC1B,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS;YACjC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YAC5D,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACtD,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YAC1B,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;SACrC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CACtB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE;YAC7C,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YAC1B,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS;YACjC,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;SACrC,CAAC;QAEH,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CACpB,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE;YAC3C,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YACpC,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;SACrC,CAAC;KACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * Cursor exec-channel → local tool bridge.\n *\n * Cursor's agent protocol executes tools server-drivenly: mid-stream, the\n * server sends exec frames and blocks until the client answers in band. The\n * `cursor-agent` API dispatches those frames onto this bridge, which maps\n * each frame's args onto the session's real tools (`read`, `bash`, `edit`,\n * `write`, `grep`, `find`, `ls`, plus MCP/extension tools by name) and runs\n * them through the same wrapped `AgentTool.execute` path model-issued calls\n * use — so approvals, sandboxing, truncation, and rendering behavior stay\n * identical.\n *\n * The arg translations here MUST mirror the display blocks the API\n * synthesizes (`synthesizeCursorExecToolCall` call sites): the transcript\n * shows one operation, so a different one must not run.\n */\n\nimport type { AgentEvent, AgentTool, AgentToolCall } from \"@earendil-works/pi-agent-core\";\nimport {\n\ttype CursorExecHandlers,\n\tcomposeCursorShellCommand,\n\tcursorPiLimit,\n\tcursorPiLsPath,\n\tcursorPiReadArgs,\n\tcursorPiTimeout,\n\tomitUndefinedCursorArgs,\n\ttype ToolResultMessage,\n\tvalidateToolArguments,\n} from \"@earendil-works/pi-ai\";\nimport type { ToolCallEvent, ToolCallEventResult } from \"./extensions/types.ts\";\n\nexport interface CursorExecBridgeOptions {\n\t/**\n\t * Resolve an executable tool by name. Backed by the session's full tool\n\t * registry (builtin + extension tools), not only the active set: Cursor\n\t * drives its native tools (read/bash/grep/ls/write) over the exec channel\n\t * regardless of which tools the request advertised.\n\t */\n\tgetTool: (name: string) => AgentTool | undefined;\n\t/**\n\t * Surface tool lifecycle events to the host UI. Bridge-run tools bypass\n\t * the agent loop's executor, so without these the live tool card for a\n\t * synthesized call never resolves.\n\t */\n\temitEvent?: (event: AgentEvent) => void;\n\t/** Run the session's vetoable extension preflight before tool execution. */\n\tpreflightToolCall?: (event: ToolCallEvent) => Promise<ToolCallEventResult | undefined>;\n\t/** Abort signal for in-flight bridge executions (the active run's signal). */\n\tgetAbortSignal?: () => AbortSignal | undefined;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction errorResult(toolCallId: string, toolName: string, text: string): ToolResultMessage {\n\treturn {\n\t\trole: \"toolResult\",\n\t\ttoolCallId,\n\t\ttoolName,\n\t\tcontent: [{ type: \"text\", text }],\n\t\tisError: true,\n\t\ttimestamp: Date.now(),\n\t};\n}\n\nfunction emptyResult(toolCallId: string, toolName: string): ToolResultMessage {\n\treturn {\n\t\trole: \"toolResult\",\n\t\ttoolCallId,\n\t\ttoolName,\n\t\tcontent: [{ type: \"text\", text: \"\" }],\n\t\tisError: false,\n\t\ttimestamp: Date.now(),\n\t};\n}\n\nasync function executeTool(\n\toptions: CursorExecBridgeOptions,\n\ttoolName: string,\n\ttoolCallId: string,\n\targs: Record<string, unknown>,\n): Promise<ToolResultMessage> {\n\tconst tool = options.getTool(toolName);\n\tif (!tool) {\n\t\treturn errorResult(toolCallId, toolName, `Tool \"${toolName}\" is not available in this session`);\n\t}\n\n\t// Exec-frame translators write forms like `path: args.path || undefined`;\n\t// a present `undefined` fails schema validation on optional fields even\n\t// though omitting the key is valid.\n\tconst cleanArgs = omitUndefinedCursorArgs(args);\n\tconst toolCall: AgentToolCall = {\n\t\ttype: \"toolCall\",\n\t\tid: toolCallId,\n\t\tname: toolName,\n\t\targuments: cleanArgs,\n\t};\n\n\tlet params: unknown;\n\ttry {\n\t\tparams = validateToolArguments(tool, toolCall);\n\t\tif (tool.prepareArguments) {\n\t\t\tparams = tool.prepareArguments(params);\n\t\t}\n\t} catch (error) {\n\t\treturn errorResult(toolCallId, toolName, error instanceof Error ? error.message : String(error));\n\t}\n\n\toptions.emitEvent?.({ type: \"tool_execution_start\", toolCallId, toolName, args: cleanArgs });\n\ttry {\n\t\tif (!isRecord(params)) {\n\t\t\tthrow new Error(`Tool \"${toolName}\" prepared non-object arguments`);\n\t\t}\n\t\tconst preflight = await options.preflightToolCall?.({\n\t\t\ttype: \"tool_call\",\n\t\t\ttoolCallId,\n\t\t\ttoolName,\n\t\t\tinput: params,\n\t\t});\n\t\tif (preflight?.block) {\n\t\t\tconst message = preflight.reason || \"Tool execution was blocked\";\n\t\t\toptions.emitEvent?.({\n\t\t\t\ttype: \"tool_execution_end\",\n\t\t\t\ttoolCallId,\n\t\t\t\ttoolName,\n\t\t\t\tresult: { content: [{ type: \"text\", text: message }], details: undefined },\n\t\t\t\tisError: true,\n\t\t\t});\n\t\t\treturn errorResult(toolCallId, toolName, message);\n\t\t}\n\t\tconst result = await tool.execute(toolCallId, params, options.getAbortSignal?.(), undefined);\n\t\tconst toolResult: ToolResultMessage = {\n\t\t\trole: \"toolResult\",\n\t\t\ttoolCallId,\n\t\t\ttoolName,\n\t\t\tcontent: result.content ?? [],\n\t\t\tdetails: result.details,\n\t\t\tusage: result.usage,\n\t\t\tisError: false,\n\t\t\ttimestamp: Date.now(),\n\t\t};\n\t\toptions.emitEvent?.({ type: \"tool_execution_end\", toolCallId, toolName, result, isError: false });\n\t\treturn toolResult;\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\toptions.emitEvent?.({\n\t\t\ttype: \"tool_execution_end\",\n\t\t\ttoolCallId,\n\t\t\ttoolName,\n\t\t\tresult: { content: [{ type: \"text\", text: message }], details: undefined },\n\t\t\tisError: true,\n\t\t});\n\t\treturn errorResult(toolCallId, toolName, message);\n\t}\n}\n\n/**\n * Build the exec handlers passed to the `cursor-agent` API through the agent\n * loop config. Handlers return bare `ToolResultMessage`s; the API derives the\n * wire protobuf answer from them and pairs the transcript result.\n *\n * Deliberately absent handlers (the API answers with a typed refusal):\n * - `delete`: senpi has no delete tool and the bridge must not mutate the\n *   filesystem outside the tool/approval path.\n * - `diagnostics`: no LSP tool in this fork.\n * - `mcpApprovalPreflight`: approval decisions cannot be resolved without an\n *   interactive prompt, so smart-mode probes are conservatively refused.\n */\nexport function createCursorExecBridge(options: CursorExecBridgeOptions): CursorExecHandlers {\n\treturn {\n\t\tread: async (args) =>\n\t\t\texecuteTool(options, \"read\", args.toolCallId, {\n\t\t\t\tpath: args.path,\n\t\t\t\toffset: args.offset,\n\t\t\t\tlimit: args.limit,\n\t\t\t}),\n\n\t\tls: async (args) => executeTool(options, \"ls\", args.toolCallId, { path: cursorPiLsPath(args.path) }),\n\n\t\tgrep: async (args) =>\n\t\t\texecuteTool(options, \"grep\", args.toolCallId, {\n\t\t\t\tpattern: args.pattern,\n\t\t\t\tpath: args.path || undefined,\n\t\t\t\tglob: args.glob || undefined,\n\t\t\t\tignoreCase: args.caseInsensitive === true ? true : undefined,\n\t\t\t}),\n\n\t\twrite: async (args) =>\n\t\t\texecuteTool(options, \"write\", args.toolCallId, {\n\t\t\t\tpath: args.path,\n\t\t\t\tcontent: args.fileText ?? new TextDecoder().decode(args.fileBytes ?? new Uint8Array()),\n\t\t\t}),\n\n\t\tshell: async (args) =>\n\t\t\texecuteTool(options, \"bash\", args.toolCallId, {\n\t\t\t\tcommand: composeCursorShellCommand(args.command, args.workingDirectory || undefined),\n\t\t\t\ttimeout: args.timeout && args.timeout > 0 ? args.timeout : undefined,\n\t\t\t}),\n\n\t\tmcp: async (call) => {\n\t\t\tconst toolName = call.toolName || call.name;\n\t\t\tconst tool = options.getTool(toolName);\n\t\t\tif (!tool) {\n\t\t\t\treturn errorResult(call.toolCallId, toolName, `Tool \"${toolName}\" is not registered in this session`);\n\t\t\t}\n\t\t\treturn executeTool(options, toolName, call.toolCallId, call.args);\n\t\t},\n\n\t\tpiRead: async (call) => {\n\t\t\tconst readArgs = cursorPiReadArgs(call.args.path, call.args.offset, call.args.limit);\n\t\t\t// A present `limit: 0` reads zero lines; answer with empty output\n\t\t\t// without running the tool rather than degrading into a full read.\n\t\t\tif (readArgs === null) return emptyResult(call.toolCallId, \"read\");\n\t\t\treturn executeTool(options, \"read\", call.toolCallId, readArgs);\n\t\t},\n\n\t\tpiBash: async (call) =>\n\t\t\texecuteTool(options, \"bash\", call.toolCallId, {\n\t\t\t\tcommand: call.args.command,\n\t\t\t\ttimeout: cursorPiTimeout(call.args.timeout),\n\t\t\t}),\n\n\t\tpiEdit: async (call) =>\n\t\t\texecuteTool(options, \"edit\", call.toolCallId, {\n\t\t\t\tpath: call.args.path,\n\t\t\t\tedits: call.args.edits.map((edit) => ({ oldText: edit.oldText, newText: edit.newText })),\n\t\t\t}),\n\n\t\tpiWrite: async (call) =>\n\t\t\texecuteTool(options, \"write\", call.toolCallId, {\n\t\t\t\tpath: call.args.path,\n\t\t\t\tcontent: call.args.content,\n\t\t\t}),\n\n\t\tpiGrep: async (call) =>\n\t\t\texecuteTool(options, \"grep\", call.toolCallId, {\n\t\t\t\tpattern: call.args.pattern,\n\t\t\t\tpath: call.args.path || undefined,\n\t\t\t\tglob: call.args.glob || undefined,\n\t\t\t\tignoreCase: call.args.ignoreCase === true ? true : undefined,\n\t\t\t\tliteral: call.args.literal === true ? true : undefined,\n\t\t\t\tcontext: call.args.context,\n\t\t\t\tlimit: cursorPiLimit(call.args.limit),\n\t\t\t}),\n\n\t\tpiFind: async (call) =>\n\t\t\texecuteTool(options, \"find\", call.toolCallId, {\n\t\t\t\tpattern: call.args.pattern,\n\t\t\t\tpath: call.args.path || undefined,\n\t\t\t\tlimit: cursorPiLimit(call.args.limit),\n\t\t\t}),\n\n\t\tpiLs: async (call) =>\n\t\t\texecuteTool(options, \"ls\", call.toolCallId, {\n\t\t\t\tpath: cursorPiLsPath(call.args.path),\n\t\t\t\tlimit: cursorPiLimit(call.args.limit),\n\t\t\t}),\n\t};\n}\n"]}

package/dist/core/experimental.d.ts

@@ -1,2 +1,6 @@
 export declare function areExperimentalFeaturesEnabled(): boolean;
+export declare function getExperimentalToolSampling(): {
+    readonly type: "json_schema";
+    readonly strict: "prefer";
+} | undefined;
 //# sourceMappingURL=experimental.d.ts.map

package/dist/core/experimental.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"experimental.d.ts","sourceRoot":"","sources":["../../src/core/experimental.ts"],"names":[],"mappings":"AACA,wBAAgB,8BAA8B,IAAI,OAAO,CAExD"}
+{"version":3,"file":"experimental.d.ts","sourceRoot":"","sources":["../../src/core/experimental.ts"],"names":[],"mappings":"AAGA,wBAAgB,8BAA8B,IAAI,OAAO,CAExD;AAED,wBAAgB,2BAA2B;;;cAE1C"}

package/dist/core/experimental.js

@@ -1,5 +1,9 @@
 import { envValue } from "./brand.js";
+const PREFER_STRICT_TOOL_SAMPLING = { type: "json_schema", strict: "prefer" };
 export function areExperimentalFeaturesEnabled() {
     return envValue("EXPERIMENTAL") === "1";
 }
+export function getExperimentalToolSampling() {
+    return areExperimentalFeaturesEnabled() ? PREFER_STRICT_TOOL_SAMPLING : undefined;
+}
 //# sourceMappingURL=experimental.js.map

package/dist/core/experimental.js.map

@@ -1 +1 @@
-{"version":3,"file":"experimental.js","sourceRoot":"","sources":["../../src/core/experimental.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,MAAM,UAAU,8BAA8B;IAC7C,OAAO,QAAQ,CAAC,cAAc,CAAC,KAAK,GAAG,CAAC;AACzC,CAAC","sourcesContent":["import { envValue } from \"./brand.ts\";\nexport function areExperimentalFeaturesEnabled(): boolean {\n\treturn envValue(\"EXPERIMENTAL\") === \"1\";\n}\n"]}
+{"version":3,"file":"experimental.js","sourceRoot":"","sources":["../../src/core/experimental.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,MAAM,2BAA2B,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAW,CAAC;AACvF,MAAM,UAAU,8BAA8B;IAC7C,OAAO,QAAQ,CAAC,cAAc,CAAC,KAAK,GAAG,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,2BAA2B;IAC1C,OAAO,8BAA8B,EAAE,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,SAAS,CAAC;AACnF,CAAC","sourcesContent":["import { envValue } from \"./brand.ts\";\n\nconst PREFER_STRICT_TOOL_SAMPLING = { type: \"json_schema\", strict: \"prefer\" } as const;\nexport function areExperimentalFeaturesEnabled(): boolean {\n\treturn envValue(\"EXPERIMENTAL\") === \"1\";\n}\n\nexport function getExperimentalToolSampling() {\n\treturn areExperimentalFeaturesEnabled() ? PREFER_STRICT_TOOL_SAMPLING : undefined;\n}\n"]}

package/dist/core/export-html/template.js

@@ -314,18 +314,40 @@
       }
 
       /**
-       * Parse a skill block from message text.
-       * Returns null if the text doesn't contain a skill block.
-       * Matches the format: <skill name="..." location="...">\n...\n</skill>\n\nuser message
+       * Parse a current or legacy skill invocation from message text.
+       * Kept in sync with core/agent-session.ts for standalone HTML exports.
        */
       function parseSkillBlock(text) {
-        const match = text.match(/^<skill name="([^"]+)" location="([^"]+)">\n([\s\S]*?)\n<\/skill>(?:\n\n([\s\S]+))?$/);
-        if (!match) return null;
+        const instructionPattern =
+          /^The user explicitly invoked the "([^"]+)" skill\. Follow the instructions in <skill-instruction> as binding for this request, while respecting higher-priority instructions\.\n\n<skill-instruction name="([^"]+)" location="([^"]+)">\n([\s\S]*?)\n<\/skill-instruction>/;
+        const instructionMatch = text.match(instructionPattern);
+        if (instructionMatch) {
+          if (instructionMatch[1] !== instructionMatch[2]) return null;
+          let remainder = text.slice(instructionMatch[0].length);
+          while (remainder.startsWith("\n\nThe user explicitly invoked the ")) {
+            const chainedMatch = remainder.slice(2).match(instructionPattern);
+            if (!chainedMatch || chainedMatch[1] !== chainedMatch[2]) return null;
+            remainder = remainder.slice(chainedMatch[0].length + 2);
+          }
+          const requestMatch = remainder.match(/^\n\n<user-request>\n([\s\S]*?)\n<\/user-request>$/);
+          if (remainder && !requestMatch) return null;
+          return {
+            name: instructionMatch[1],
+            location: instructionMatch[3],
+            content: instructionMatch[4],
+            userMessage: requestMatch?.[1].trim() || undefined,
+          };
+        }
+
+        const legacyMatch = text.match(
+          /^<skill name="([^"]+)" location="([^"]+)">\n([\s\S]*?)\n<\/skill>(?:\n\n([\s\S]+))?$/,
+        );
+        if (!legacyMatch) return null;
         return {
-          name: match[1],
-          location: match[2],
-          content: match[3],
-          userMessage: match[4]?.trim() || undefined,
+          name: legacyMatch[1],
+          location: legacyMatch[2],
+          content: legacyMatch[3],
+          userMessage: legacyMatch[4]?.trim() || undefined,
         };
       }
 

package/dist/core/extensions/builtin/claude-sdk-oauth/auth-environment.d.ts

@@ -0,0 +1,4 @@
+export declare function hasRequestOauthToken(requestEnvironment: Record<string, string> | undefined): boolean;
+export declare function mergeRequestAuthEnvironment(hostEnvironment: NodeJS.ProcessEnv, requestEnvironment: Record<string, string> | undefined): NodeJS.ProcessEnv;
+export declare function stripManagedAuthEnvironment(parent: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+//# sourceMappingURL=auth-environment.d.ts.map

package/dist/core/extensions/builtin/claude-sdk-oauth/auth-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-environment.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/auth-environment.ts"],"names":[],"mappings":"AAIA,wBAAgB,oBAAoB,CAAC,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAAG,OAAO,CAIpG;AAED,wBAAgB,2BAA2B,CAC1C,eAAe,EAAE,MAAM,CAAC,UAAU,EAClC,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GACpD,MAAM,CAAC,UAAU,CASnB;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAkBxF"}

package/dist/core/extensions/builtin/claude-sdk-oauth/auth-environment.js

@@ -0,0 +1,30 @@
+function isClaudeOauthTokenName(name) {
+    return name === "CLAUDE_CODE_OAUTH_TOKEN" || /^CLAUDE_CODE_OAUTH_TOKEN_\d+$/.test(name);
+}
+export function hasRequestOauthToken(requestEnvironment) {
+    return Object.entries(requestEnvironment ?? {}).some(([name, value]) => isClaudeOauthTokenName(name) && Boolean(value));
+}
+export function mergeRequestAuthEnvironment(hostEnvironment, requestEnvironment) {
+    const environment = { ...hostEnvironment };
+    const requestTokens = Object.entries(requestEnvironment ?? {}).filter(([name]) => isClaudeOauthTokenName(name));
+    if (requestTokens.length === 0)
+        return environment;
+    for (const name of Object.keys(environment)) {
+        if (isClaudeOauthTokenName(name))
+            delete environment[name];
+    }
+    for (const [name, value] of requestTokens)
+        environment[name] = value;
+    return environment;
+}
+export function stripManagedAuthEnvironment(parent) {
+    const { ANTHROPIC_API_KEY: _apiKey, ANTHROPIC_AUTH_TOKEN: _authToken, ANTHROPIC_BASE_URL: _gateway, ANTHROPIC_CUSTOM_HEADERS: _customHeaders, CLAUDE_CODE_OAUTH_TOKEN: _oauthToken, CLAUDE_CODE_USE_BEDROCK: _bedrock, CLAUDE_CODE_USE_FOUNDRY: _foundry, CLAUDE_CODE_USE_GATEWAY: _gatewayMode, CLAUDE_CODE_USE_VERTEX: _vertex, ...environment } = parent;
+    for (const name of Object.keys(environment)) {
+        if (/^CLAUDE_CODE_OAUTH_TOKEN_\d+$/.test(name))
+            delete environment[name];
+        if (name.startsWith("SENPI_"))
+            delete environment[name];
+    }
+    return environment;
+}
+//# sourceMappingURL=auth-environment.js.map

package/dist/core/extensions/builtin/claude-sdk-oauth/auth-environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-environment.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/auth-environment.ts"],"names":[],"mappings":"AAAA,SAAS,sBAAsB,CAAC,IAAY;IAC3C,OAAO,IAAI,KAAK,yBAAyB,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,kBAAsD;IAC1F,OAAO,MAAM,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,CACnD,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAC1C,eAAkC,EAClC,kBAAsD;IAEtD,MAAM,WAAW,GAAG,EAAE,GAAG,eAAe,EAAE,CAAC;IAC3C,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;IAChH,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,IAAI,sBAAsB,CAAC,IAAI,CAAC;YAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,aAAa;QAAE,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACrE,OAAO,WAAW,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAyB;IACpE,MAAM,EACL,iBAAiB,EAAE,OAAO,EAC1B,oBAAoB,EAAE,UAAU,EAChC,kBAAkB,EAAE,QAAQ,EAC5B,wBAAwB,EAAE,cAAc,EACxC,uBAAuB,EAAE,WAAW,EACpC,uBAAuB,EAAE,QAAQ,EACjC,uBAAuB,EAAE,QAAQ,EACjC,uBAAuB,EAAE,YAAY,EACrC,sBAAsB,EAAE,OAAO,EAC/B,GAAG,WAAW,EACd,GAAG,MAAM,CAAC;IACX,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC","sourcesContent":["function isClaudeOauthTokenName(name: string): boolean {\n\treturn name === \"CLAUDE_CODE_OAUTH_TOKEN\" || /^CLAUDE_CODE_OAUTH_TOKEN_\\d+$/.test(name);\n}\n\nexport function hasRequestOauthToken(requestEnvironment: Record<string, string> | undefined): boolean {\n\treturn Object.entries(requestEnvironment ?? {}).some(\n\t\t([name, value]) => isClaudeOauthTokenName(name) && Boolean(value),\n\t);\n}\n\nexport function mergeRequestAuthEnvironment(\n\thostEnvironment: NodeJS.ProcessEnv,\n\trequestEnvironment: Record<string, string> | undefined,\n): NodeJS.ProcessEnv {\n\tconst environment = { ...hostEnvironment };\n\tconst requestTokens = Object.entries(requestEnvironment ?? {}).filter(([name]) => isClaudeOauthTokenName(name));\n\tif (requestTokens.length === 0) return environment;\n\tfor (const name of Object.keys(environment)) {\n\t\tif (isClaudeOauthTokenName(name)) delete environment[name];\n\t}\n\tfor (const [name, value] of requestTokens) environment[name] = value;\n\treturn environment;\n}\n\nexport function stripManagedAuthEnvironment(parent: NodeJS.ProcessEnv): NodeJS.ProcessEnv {\n\tconst {\n\t\tANTHROPIC_API_KEY: _apiKey,\n\t\tANTHROPIC_AUTH_TOKEN: _authToken,\n\t\tANTHROPIC_BASE_URL: _gateway,\n\t\tANTHROPIC_CUSTOM_HEADERS: _customHeaders,\n\t\tCLAUDE_CODE_OAUTH_TOKEN: _oauthToken,\n\t\tCLAUDE_CODE_USE_BEDROCK: _bedrock,\n\t\tCLAUDE_CODE_USE_FOUNDRY: _foundry,\n\t\tCLAUDE_CODE_USE_GATEWAY: _gatewayMode,\n\t\tCLAUDE_CODE_USE_VERTEX: _vertex,\n\t\t...environment\n\t} = parent;\n\tfor (const name of Object.keys(environment)) {\n\t\tif (/^CLAUDE_CODE_OAUTH_TOKEN_\\d+$/.test(name)) delete environment[name];\n\t\tif (name.startsWith(\"SENPI_\")) delete environment[name];\n\t}\n\treturn environment;\n}\n"]}

package/dist/core/extensions/builtin/claude-sdk-oauth/auth-lane.d.ts

@@ -20,6 +20,8 @@ export type AuthenticatedQueryInput = {
     query: SdkQuery;
     buildOptions: (lane: ClaudeSdkOauthTokenInjection) => Options;
     providerSettings: ClaudeSdkOauthProviderSettings;
+    /** Effective request auth environment; overrides the host for account discovery and SDK spawn. */
+    env?: Record<string, string>;
     signal?: AbortSignal;
     sessionId?: string;
     /** Request-scoped CLI pin; takes precedence over persistent settings and account pins. */

package/dist/core/extensions/builtin/claude-sdk-oauth/auth-lane.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-lane.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/auth-lane.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAM7D,OAAO,EACN,KAAK,WAAW,EAOhB,KAAK,aAAa,EAClB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,KAAK,yBAAyB,EAAyB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAGlH,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,KAAK,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAElG,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAEvE,eAAO,MAAM,kBAAkB,QAAa,CAAC;AAU7C,KAAK,gBAAgB,GAAG;IACvB,WAAW,EAAE,MAAM,eAAe,CAAC;IACnC,GAAG,EAAE,MAAM,MAAM,CAAC,UAAU,CAAC;IAC7B,WAAW,EAAE,MAAM,MAAM,CAAC;IAC1B,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,SAAS,EAAE,aAAa,CAAC;CACzB,CAAC;AAiBF,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAElF;AAED,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,YAAY,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAEnE,MAAM,MAAM,uBAAuB,GAAG;IACrC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1C,KAAK,EAAE,QAAQ,CAAC;IAChB,YAAY,EAAE,CAAC,IAAI,EAAE,4BAA4B,KAAK,OAAO,CAAC;IAC9D,gBAAgB,EAAE,8BAA8B,CAAC;IACjD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0FAA0F;IAC1F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;IAChD,aAAa,CAAC,EAAE,CACf,KAAK,EAAE,yBAAyB,KAC5B,iBAAiB,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;CAC5E,CAAC;AAmDF,wBAAgB,oBAAoB,CACnC,QAAQ,EAAE,8BAA8B,EACxC,QAAQ,EAAE,SAAS,WAAW,EAAE,GAC9B,4BAA4B,CAE9B;AAmFD,2GAA2G;AAC3G,wBAAuB,iBAAiB,CAAC,KAAK,EAAE,uBAAuB,GAAG,cAAc,CAAC,UAAU,CAAC,CAwDnG"}
+{"version":3,"file":"auth-lane.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/auth-lane.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAM7D,OAAO,EACN,KAAK,WAAW,EAMhB,KAAK,aAAa,EAClB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,KAAK,yBAAyB,EAAyB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAKlH,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,KAAK,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAElG,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAEvE,eAAO,MAAM,kBAAkB,QAAa,CAAC;AAE7C,KAAK,gBAAgB,GAAG;IACvB,WAAW,EAAE,MAAM,eAAe,CAAC;IACnC,GAAG,EAAE,MAAM,MAAM,CAAC,UAAU,CAAC;IAC7B,WAAW,EAAE,MAAM,MAAM,CAAC;IAC1B,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,SAAS,EAAE,aAAa,CAAC;CACzB,CAAC;AAiBF,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAElF;AAED,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,YAAY,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAEnE,MAAM,MAAM,uBAAuB,GAAG;IACrC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1C,KAAK,EAAE,QAAQ,CAAC;IAChB,YAAY,EAAE,CAAC,IAAI,EAAE,4BAA4B,KAAK,OAAO,CAAC;IAC9D,gBAAgB,EAAE,8BAA8B,CAAC;IACjD,kGAAkG;IAClG,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0FAA0F;IAC1F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;IAChD,aAAa,CAAC,EAAE,CACf,KAAK,EAAE,yBAAyB,KAC5B,iBAAiB,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;CAC5E,CAAC;AAUF,wBAAgB,oBAAoB,CACnC,QAAQ,EAAE,8BAA8B,EACxC,QAAQ,EAAE,SAAS,WAAW,EAAE,GAC9B,4BAA4B,CAE9B;AAuFD,2GAA2G;AAC3G,wBAAuB,iBAAiB,CAAC,KAAK,EAAE,uBAAuB,GAAG,cAAc,CAAC,UAAU,CAAC,CAwDnG"}

package/dist/core/extensions/builtin/claude-sdk-oauth/auth-lane.js

@@ -1,25 +1,17 @@
-import { chmodSync, mkdirSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
 import { loadAnthropicOAuth } from "@earendil-works/pi-ai/oauth";
 import { getAgentDir } from "../../../../config.js";
 import { AuthStorage } from "../../../auth-storage.js";
 import { emitProviderAccountFailover, emitProviderAccountsChanged } from "./account-events.js";
 import { CLAUDE_SDK_OAUTH_PROVIDER_ID } from "./account-management.js";
-import { assertValidAccountName, emptyCredential, envSlotToken, listAccounts, refreshSlot, } from "./accounts.js";
+import { emptyCredential, envSlotToken, listAccounts, refreshSlot, } from "./accounts.js";
 import { selectAccount } from "./affinity.js";
 import { createAttemptMessages } from "./auth-attempt.js";
+import { hasRequestOauthToken, mergeRequestAuthEnvironment, stripManagedAuthEnvironment } from "./auth-environment.js";
+import { writeConfigDirCredential } from "./config-dir-credentials.js";
 import { classifySdkError } from "./errors.js";
 import { runFailover } from "./failover.js";
 export { CLAUDE_SDK_OAUTH_PROVIDER_ID } from "./account-management.js";
 export const EXPIRING_WITHIN_MS = 5 * 60_000;
-const CLI_OAUTH_SCOPES = [
-    "org:create_api_key",
-    "user:profile",
-    "user:inference",
-    "user:sessions:claude_code",
-    "user:mcp_servers",
-    "user:file_upload",
-];
 async function refreshWithAnthropicOAuth(refresh, signal) {
     const oauth = await loadAnthropicOAuth();
     const credential = await oauth.refresh({ type: "oauth", access: "", refresh, expires: 0 }, signal);
@@ -39,52 +31,27 @@ export function overrideAuthLaneBoundary(override) {
 export function resetAuthLaneBoundary() {
     activeBoundary = defaultBoundary;
 }
-function managedEnvironment(parent) {
-    const { ANTHROPIC_API_KEY: _apiKey, ANTHROPIC_AUTH_TOKEN: _authToken, ANTHROPIC_BASE_URL: _gateway, ANTHROPIC_CUSTOM_HEADERS: _customHeaders, CLAUDE_CODE_OAUTH_TOKEN: _oauthToken, CLAUDE_CODE_USE_BEDROCK: _bedrock, CLAUDE_CODE_USE_FOUNDRY: _foundry, CLAUDE_CODE_USE_GATEWAY: _gatewayMode, CLAUDE_CODE_USE_VERTEX: _vertex, ...environment } = parent;
-    for (const name of Object.keys(environment)) {
-        if (/^CLAUDE_CODE_OAUTH_TOKEN_\d+$/.test(name))
-            delete environment[name];
-        if (name.startsWith("SENPI_"))
-            delete environment[name];
-    }
-    return environment;
-}
-function configDirectory(slot) {
-    assertValidAccountName(slot.name);
-    return join(activeBoundary.getAgentDir(), "claude-sdk-oauth-accounts", slot.name);
-}
-function writeConfigCredentials(directory, slot, access) {
-    mkdirSync(directory, { recursive: true, mode: 0o700 });
-    chmodSync(directory, 0o700);
-    writeFileSync(join(directory, ".credentials.json"), JSON.stringify({
-        claudeAiOauth: {
-            accessToken: access,
-            refreshToken: slot.refresh,
-            expiresAt: slot.expires,
-            scopes: CLI_OAUTH_SCOPES,
-        },
-    }), { encoding: "utf8", mode: 0o600 });
-}
 export function resolveEffectiveLane(settings, accounts) {
     return settings.tokenInjection ?? (accounts.length > 0 ? "oauth-slots" : "ambient");
 }
-async function managedPool(settings) {
+async function managedPool(settings, requestEnvironment) {
     const store = activeBoundary.createStore();
     let credential = await store.read(CLAUDE_SDK_OAUTH_PROVIDER_ID);
-    const environment = activeBoundary.env();
+    const environment = mergeRequestAuthEnvironment(activeBoundary.env(), requestEnvironment);
     let accounts = listAccounts(credential ?? emptyCredential(), (name) => environment[name]);
     if (!credential && accounts.length > 0) {
         credential = await store.modify(CLAUDE_SDK_OAUTH_PROVIDER_ID, async () => emptyCredential());
         accounts = listAccounts(credential ?? emptyCredential(), (name) => environment[name]);
     }
-    const lane = resolveEffectiveLane(settings, accounts);
+    const configuredLane = resolveEffectiveLane(settings, accounts);
+    const lane = configuredLane === "config-dir" && hasRequestOauthToken(requestEnvironment) ? "oauth-slots" : configuredLane;
     if (lane === "ambient" || accounts.length === 0)
         return undefined;
     const stored = credential?.type === "oauth" ? credential : undefined;
-    return { accounts, lane, pinnedAccount: settings.pinnedAccount ?? stored?.pinned, store };
+    return { accounts, environment, lane, pinnedAccount: settings.pinnedAccount ?? stored?.pinned, store };
 }
 async function prepareSlot(pool, selected, signal) {
-    const environment = activeBoundary.env();
+    const environment = pool.environment;
     const slot = selected;
     if (slot.source !== "env" && activeBoundary.now() >= slot.expires - EXPIRING_WITHIN_MS) {
         try {
@@ -103,11 +70,10 @@ async function prepareSlot(pool, selected, signal) {
     const access = slot.source === "env" ? envSlotToken((name) => environment[name], slot.name) : slot.access;
     if (!access)
         throw new Error("authentication_failed: selected OAuth token is unavailable");
-    const childEnvironment = managedEnvironment(environment);
+    const childEnvironment = stripManagedAuthEnvironment(environment);
     if (pool.lane === "oauth-slots")
         return { ...childEnvironment, CLAUDE_CODE_OAUTH_TOKEN: access };
-    const directory = configDirectory(slot);
-    writeConfigCredentials(directory, slot, access);
+    const directory = writeConfigDirCredential(activeBoundary.getAgentDir(), slot, access);
     return { ...childEnvironment, CLAUDE_CONFIG_DIR: directory };
 }
 function sdkFailure(message) {
@@ -136,10 +102,10 @@ function visibleSdkMessage(message) {
 /** Resolves managed OAuth immediately before each subprocess spawn and retries only pre-delta failures. */
 export async function* queryWithAuthLane(input) {
     const signal = input.signal ?? new AbortController().signal;
-    const pool = await managedPool(input.providerSettings);
+    const pool = await managedPool(input.providerSettings, input.env);
     if (!pool) {
         const options = input.buildOptions("ambient");
-        const parentEnvironment = activeBoundary.env();
+        const parentEnvironment = mergeRequestAuthEnvironment(activeBoundary.env(), input.env);
         const ambientEnvironment = { ...parentEnvironment };
         for (const name of Object.keys(ambientEnvironment)) {
             if (name.startsWith("SENPI_"))

package/dist/core/extensions/builtin/claude-sdk-oauth/auth-lane.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-lane.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/auth-lane.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAEN,sBAAsB,EAEtB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,WAAW,GAEX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAkC,qBAAqB,EAA0B,MAAM,mBAAmB,CAAC;AAClH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAI5C,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAEvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,MAAM,CAAC;AAC7C,MAAM,gBAAgB,GAAG;IACxB,oBAAoB;IACpB,cAAc;IACd,gBAAgB;IAChB,2BAA2B;IAC3B,kBAAkB;IAClB,kBAAkB;CACT,CAAC;AAUX,KAAK,UAAU,yBAAyB,CAAC,OAAe,EAAE,MAAmB;IAC5E,MAAM,KAAK,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACnG,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;AAChG,CAAC;AAED,MAAM,eAAe,GAAqB;IACzC,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE;IACvC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG;IACtB,WAAW;IACX,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IACrB,SAAS,EAAE,yBAAyB;CACpC,CAAC;AACF,IAAI,cAAc,GAAG,eAAe,CAAC;AAErC,MAAM,UAAU,wBAAwB,CAAC,QAAmC;IAC3E,cAAc,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,QAAQ,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,qBAAqB;IACpC,cAAc,GAAG,eAAe,CAAC;AAClC,CAAC;AA0BD,SAAS,kBAAkB,CAAC,MAAyB;IACpD,MAAM,EACL,iBAAiB,EAAE,OAAO,EAC1B,oBAAoB,EAAE,UAAU,EAChC,kBAAkB,EAAE,QAAQ,EAC5B,wBAAwB,EAAE,cAAc,EACxC,uBAAuB,EAAE,WAAW,EACpC,uBAAuB,EAAE,QAAQ,EACjC,uBAAuB,EAAE,QAAQ,EACjC,uBAAuB,EAAE,YAAY,EACrC,sBAAsB,EAAE,OAAO,EAC/B,GAAG,WAAW,EACd,GAAG,MAAM,CAAC;IACX,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,IAAiB;IACzC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,2BAA2B,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAiB,EAAE,IAAiB,EAAE,MAAc;IACnF,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5B,aAAa,CACZ,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,EACpC,IAAI,CAAC,SAAS,CAAC;QACd,aAAa,EAAE;YACd,WAAW,EAAE,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,OAAO;YAC1B,SAAS,EAAE,IAAI,CAAC,OAAO;YACvB,MAAM,EAAE,gBAAgB;SACxB;KACD,CAAC,EACF,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CACjC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,QAAwC,EACxC,QAAgC;IAEhC,OAAO,QAAQ,CAAC,cAAc,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACrF,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAwC;IAClE,MAAM,KAAK,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC;IACzC,IAAI,QAAQ,GAAG,YAAY,CACzB,UAAmD,IAAI,eAAe,EAAE,EACzE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAC3B,CAAC;IACF,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,UAAU,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;QAC7F,QAAQ,GAAG,YAAY,CACrB,UAAuC,IAAI,eAAe,EAAE,EAC7D,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAC3B,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,MAAM,GAAG,UAAU,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAE,UAAuC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3F,CAAC;AAED,KAAK,UAAU,WAAW,CACzB,IAAiB,EACjB,QAAqB,EACrB,MAAmB;IAEnB,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC;IACtB,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,cAAc,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,GAAG,kBAAkB,EAAE,CAAC;QACxF,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,WAAW,CAClC,IAAI,CAAC,KAAK,EACV,4BAA4B,EAC5B,IAAI,CAAC,IAAI,EACT,cAAc,CAAC,SAAS,EACxB,MAAM,EACN,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,OAAO,GAAG,kBAAkB,CACjE,CAAC;YACF,MAAM,UAAU,GAAG,SAAS,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAE,SAAsC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrG,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,IAAI,eAAe,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAC9F,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAC3C,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC7E,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC;QACrD,CAAC;IACF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAC1G,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC3F,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,EAAE,GAAG,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC;IACjG,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACxC,sBAAsB,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAChD,OAAO,EAAE,GAAG,gBAAgB,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,OAAmB;IACtC,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACxE,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,QAAQ,IAAI,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,MAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,uEAAuE;QACvE,4CAA4C;QAC5C,MAAM,MAAM,GACX,iBAAiB,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5G,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAmB;IAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,kEAAkE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACpG,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,iBAAiB,CAAC,KAA8B;IACtE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,iBAAiB,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,kBAAkB,GAAuC,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACxF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,CAAC,GAAG,GAAG,kBAAkB,CAAC;QACjC,KAAK,CAAC,CAAC,MAAM,qBAAqB,CAAC,KAAK,EAAE;YACzC,WAAW,EAAE,SAAS;YACtB,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,SAAS;YACnB,OAAO;SACP,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IACD,KAAK,CAAC,CAAC,WAAW,CAAC;QAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACtB,aAAa,CAAC,QAAQ,EAAE;YACvB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa;YACxD,GAAG,EAAE,cAAc,CAAC,GAAG,EAAE;SACzB,CAAC;QACH,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC;YAClE,OAAO,CAAC,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACpD,OAAO,qBAAqB,CAAC,KAAK,EAAE;gBACnC,WAAW,EAAE,IAAI,CAAC,IAAI;gBACtB,QAAQ;gBACR,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,OAAO;aACP,CAAC,CAAC;QACJ,CAAC;QACD,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,4BAA4B;QACxC,GAAG,EAAE,cAAc,CAAC,GAAG;QACvB,cAAc,EAAE,UAAU;QAC1B,cAAc,EAAE,iBAAiB;QACjC,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EAAE;YACxD,2BAA2B,CAAC,4BAA4B,CAAC,CAAC;YAC1D,IAAI,WAAW,EAAE,CAAC;gBACjB,2BAA2B,CAC1B,4BAA4B,EAC5B,OAAO,CAAC,IAAI,EACZ,WAAW,CAAC,IAAI,EAChB,cAAc,CAAC,IAAI,CACnB,CAAC;YACH,CAAC;QACF,CAAC;KACD,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import { chmodSync, mkdirSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport type { CredentialStore } from \"@earendil-works/pi-ai\";\nimport { loadAnthropicOAuth } from \"@earendil-works/pi-ai/oauth\";\nimport { getAgentDir } from \"../../../../config.ts\";\nimport { AuthStorage } from \"../../../auth-storage.ts\";\nimport { emitProviderAccountFailover, emitProviderAccountsChanged } from \"./account-events.ts\";\nimport { CLAUDE_SDK_OAUTH_PROVIDER_ID } from \"./account-management.ts\";\nimport {\n\ttype AccountSlot,\n\tassertValidAccountName,\n\ttype ClaudeSdkOauthCredential,\n\temptyCredential,\n\tenvSlotToken,\n\tlistAccounts,\n\trefreshSlot,\n\ttype SlotRefresher,\n} from \"./accounts.ts\";\nimport { selectAccount } from \"./affinity.ts\";\nimport { type AuthenticatedAttemptInput, createAttemptMessages, type RetainableAttempt } from \"./auth-attempt.ts\";\nimport { classifySdkError } from \"./errors.ts\";\nimport { runFailover } from \"./failover.ts\";\nimport type { Options, SDKMessage, SdkQuery } from \"./sdk-boundary.ts\";\nimport type { ClaudeSdkOauthProviderSettings, ClaudeSdkOauthTokenInjection } from \"./settings.ts\";\n\nexport { CLAUDE_SDK_OAUTH_PROVIDER_ID } from \"./account-management.ts\";\n\nexport const EXPIRING_WITHIN_MS = 5 * 60_000;\nconst CLI_OAUTH_SCOPES = [\n\t\"org:create_api_key\",\n\t\"user:profile\",\n\t\"user:inference\",\n\t\"user:sessions:claude_code\",\n\t\"user:mcp_servers\",\n\t\"user:file_upload\",\n] as const;\n\ntype AuthLaneBoundary = {\n\tcreateStore: () => CredentialStore;\n\tenv: () => NodeJS.ProcessEnv;\n\tgetAgentDir: () => string;\n\tnow: () => number;\n\trefresher: SlotRefresher;\n};\n\nasync function refreshWithAnthropicOAuth(refresh: string, signal: AbortSignal) {\n\tconst oauth = await loadAnthropicOAuth();\n\tconst credential = await oauth.refresh({ type: \"oauth\", access: \"\", refresh, expires: 0 }, signal);\n\treturn { access: credential.access, refresh: credential.refresh, expires: credential.expires };\n}\n\nconst defaultBoundary: AuthLaneBoundary = {\n\tcreateStore: () => AuthStorage.create(),\n\tenv: () => process.env,\n\tgetAgentDir,\n\tnow: () => Date.now(),\n\trefresher: refreshWithAnthropicOAuth,\n};\nlet activeBoundary = defaultBoundary;\n\nexport function overrideAuthLaneBoundary(override: Partial<AuthLaneBoundary>): void {\n\tactiveBoundary = { ...activeBoundary, ...override };\n}\n\nexport function resetAuthLaneBoundary(): void {\n\tactiveBoundary = defaultBoundary;\n}\n\nexport type { AuthenticatedAttemptInput } from \"./auth-attempt.ts\";\n\nexport type AuthenticatedQueryInput = {\n\tprompt: Parameters<SdkQuery>[0][\"prompt\"];\n\tquery: SdkQuery;\n\tbuildOptions: (lane: ClaudeSdkOauthTokenInjection) => Options;\n\tproviderSettings: ClaudeSdkOauthProviderSettings;\n\tsignal?: AbortSignal;\n\tsessionId?: string;\n\t/** Request-scoped CLI pin; takes precedence over persistent settings and account pins. */\n\tpinnedAccount?: string;\n\tonQuery?: (query: ReturnType<SdkQuery>) => void;\n\tcreateAttempt?: (\n\t\tinput: AuthenticatedAttemptInput,\n\t) => RetainableAttempt<SDKMessage> | Promise<RetainableAttempt<SDKMessage>>;\n};\n\ntype ManagedPool = {\n\taccounts: AccountSlot[];\n\tlane: Exclude<ClaudeSdkOauthTokenInjection, \"ambient\">;\n\tpinnedAccount?: string;\n\tstore: CredentialStore;\n};\n\nfunction managedEnvironment(parent: NodeJS.ProcessEnv): Record<string, string | undefined> {\n\tconst {\n\t\tANTHROPIC_API_KEY: _apiKey,\n\t\tANTHROPIC_AUTH_TOKEN: _authToken,\n\t\tANTHROPIC_BASE_URL: _gateway,\n\t\tANTHROPIC_CUSTOM_HEADERS: _customHeaders,\n\t\tCLAUDE_CODE_OAUTH_TOKEN: _oauthToken,\n\t\tCLAUDE_CODE_USE_BEDROCK: _bedrock,\n\t\tCLAUDE_CODE_USE_FOUNDRY: _foundry,\n\t\tCLAUDE_CODE_USE_GATEWAY: _gatewayMode,\n\t\tCLAUDE_CODE_USE_VERTEX: _vertex,\n\t\t...environment\n\t} = parent;\n\tfor (const name of Object.keys(environment)) {\n\t\tif (/^CLAUDE_CODE_OAUTH_TOKEN_\\d+$/.test(name)) delete environment[name];\n\t\tif (name.startsWith(\"SENPI_\")) delete environment[name];\n\t}\n\treturn environment;\n}\n\nfunction configDirectory(slot: AccountSlot): string {\n\tassertValidAccountName(slot.name);\n\treturn join(activeBoundary.getAgentDir(), \"claude-sdk-oauth-accounts\", slot.name);\n}\n\nfunction writeConfigCredentials(directory: string, slot: AccountSlot, access: string): void {\n\tmkdirSync(directory, { recursive: true, mode: 0o700 });\n\tchmodSync(directory, 0o700);\n\twriteFileSync(\n\t\tjoin(directory, \".credentials.json\"),\n\t\tJSON.stringify({\n\t\t\tclaudeAiOauth: {\n\t\t\t\taccessToken: access,\n\t\t\t\trefreshToken: slot.refresh,\n\t\t\t\texpiresAt: slot.expires,\n\t\t\t\tscopes: CLI_OAUTH_SCOPES,\n\t\t\t},\n\t\t}),\n\t\t{ encoding: \"utf8\", mode: 0o600 },\n\t);\n}\n\nexport function resolveEffectiveLane(\n\tsettings: ClaudeSdkOauthProviderSettings,\n\taccounts: readonly AccountSlot[],\n): ClaudeSdkOauthTokenInjection {\n\treturn settings.tokenInjection ?? (accounts.length > 0 ? \"oauth-slots\" : \"ambient\");\n}\n\nasync function managedPool(settings: ClaudeSdkOauthProviderSettings): Promise<ManagedPool | undefined> {\n\tconst store = activeBoundary.createStore();\n\tlet credential = await store.read(CLAUDE_SDK_OAUTH_PROVIDER_ID);\n\tconst environment = activeBoundary.env();\n\tlet accounts = listAccounts(\n\t\t(credential as ClaudeSdkOauthCredential | undefined) ?? emptyCredential(),\n\t\t(name) => environment[name],\n\t);\n\tif (!credential && accounts.length > 0) {\n\t\tcredential = await store.modify(CLAUDE_SDK_OAUTH_PROVIDER_ID, async () => emptyCredential());\n\t\taccounts = listAccounts(\n\t\t\t(credential as ClaudeSdkOauthCredential) ?? emptyCredential(),\n\t\t\t(name) => environment[name],\n\t\t);\n\t}\n\tconst lane = resolveEffectiveLane(settings, accounts);\n\tif (lane === \"ambient\" || accounts.length === 0) return undefined;\n\tconst stored = credential?.type === \"oauth\" ? (credential as ClaudeSdkOauthCredential) : undefined;\n\treturn { accounts, lane, pinnedAccount: settings.pinnedAccount ?? stored?.pinned, store };\n}\n\nasync function prepareSlot(\n\tpool: ManagedPool,\n\tselected: AccountSlot,\n\tsignal: AbortSignal,\n): Promise<Record<string, string | undefined>> {\n\tconst environment = activeBoundary.env();\n\tconst slot = selected;\n\tif (slot.source !== \"env\" && activeBoundary.now() >= slot.expires - EXPIRING_WITHIN_MS) {\n\t\ttry {\n\t\t\tconst refreshed = await refreshSlot(\n\t\t\t\tpool.store,\n\t\t\t\tCLAUDE_SDK_OAUTH_PROVIDER_ID,\n\t\t\t\tslot.name,\n\t\t\t\tactiveBoundary.refresher,\n\t\t\t\tsignal,\n\t\t\t\t(expires) => activeBoundary.now() >= expires - EXPIRING_WITHIN_MS,\n\t\t\t);\n\t\t\tconst credential = refreshed?.type === \"oauth\" ? (refreshed as ClaudeSdkOauthCredential) : undefined;\n\t\t\tconst updated = listAccounts(credential ?? emptyCredential(), (name) => environment[name]).find(\n\t\t\t\t(candidate) => candidate.name === slot.name,\n\t\t\t);\n\t\t\tif (!updated) throw new Error(\"selected account disappeared during refresh\");\n\t\t\tObject.assign(slot, updated);\n\t\t} catch (error) {\n\t\t\tconst detail = error instanceof Error ? error.message : String(error);\n\t\t\tthrow new Error(`authentication_failed: ${detail}`);\n\t\t}\n\t}\n\tconst access = slot.source === \"env\" ? envSlotToken((name) => environment[name], slot.name) : slot.access;\n\tif (!access) throw new Error(\"authentication_failed: selected OAuth token is unavailable\");\n\tconst childEnvironment = managedEnvironment(environment);\n\tif (pool.lane === \"oauth-slots\") return { ...childEnvironment, CLAUDE_CODE_OAUTH_TOKEN: access };\n\tconst directory = configDirectory(slot);\n\twriteConfigCredentials(directory, slot, access);\n\treturn { ...childEnvironment, CLAUDE_CONFIG_DIR: directory };\n}\n\nfunction sdkFailure(message: SDKMessage): unknown | undefined {\n\tif (message.type === \"assistant\" && message.error) return message.error;\n\tif (message.type === \"result\" && message.subtype !== \"success\") {\n\t\tconst errors = \"errors\" in message && Array.isArray(message.errors) ? (message.errors as unknown[]) : [];\n\t\tif (errors.length > 0) return new Error(String(errors[0]));\n\t\t// `subtype` alone is too coarse to classify: a subscription limit and an\n\t\t// ordinary tool failure both arrive as \"error_during_execution\". The SDK\n\t\t// carries the real cause in `terminal_reason` (e.g. \"blocking_limit\"), so\n\t\t// append it — otherwise classifySdkError() scores every result error as\n\t\t// non-retryable \"other\", the exhausted account is never blocked, and a\n\t\t// multi-account pool never rotates past it.\n\t\tconst reason =\n\t\t\t\"terminal_reason\" in message && typeof message.terminal_reason === \"string\" ? message.terminal_reason : \"\";\n\t\treturn new Error(reason ? `Claude Code ${message.subtype}: ${reason}` : `Claude Code ${message.subtype}`);\n\t}\n\treturn undefined;\n}\n\nfunction visibleSdkMessage(message: SDKMessage): boolean {\n\tif (message.type !== \"stream_event\") return false;\n\treturn /^(?:content_block_start|content_block_delta|content_block_stop)$/.test(message.event.type);\n}\n\n/** Resolves managed OAuth immediately before each subprocess spawn and retries only pre-delta failures. */\nexport async function* queryWithAuthLane(input: AuthenticatedQueryInput): AsyncGenerator<SDKMessage> {\n\tconst signal = input.signal ?? new AbortController().signal;\n\tconst pool = await managedPool(input.providerSettings);\n\tif (!pool) {\n\t\tconst options = input.buildOptions(\"ambient\");\n\t\tconst parentEnvironment = activeBoundary.env();\n\t\tconst ambientEnvironment: Record<string, string | undefined> = { ...parentEnvironment };\n\t\tfor (const name of Object.keys(ambientEnvironment)) {\n\t\t\tif (name.startsWith(\"SENPI_\")) delete ambientEnvironment[name];\n\t\t}\n\t\toptions.env = ambientEnvironment;\n\t\tyield* await createAttemptMessages(input, {\n\t\t\taccountName: \"ambient\",\n\t\t\taccounts: [],\n\t\t\tauthLane: \"ambient\",\n\t\t\toptions,\n\t\t});\n\t\treturn;\n\t}\n\tyield* runFailover({\n\t\taccounts: pool.accounts,\n\t\tselectFn: (accounts) =>\n\t\t\tselectAccount(accounts, {\n\t\t\t\tsessionId: input.sessionId,\n\t\t\t\tpinnedAccount: input.pinnedAccount ?? pool.pinnedAccount,\n\t\t\t\tnow: activeBoundary.now(),\n\t\t\t}),\n\t\trunAttempt: async (slot) => {\n\t\t\tconst options = input.buildOptions(pool.lane);\n\t\t\tconst accounts = pool.accounts.map((account) => ({ ...account }));\n\t\t\toptions.env = await prepareSlot(pool, slot, signal);\n\t\t\treturn createAttemptMessages(input, {\n\t\t\t\taccountName: slot.name,\n\t\t\t\taccounts,\n\t\t\t\tauthLane: pool.lane,\n\t\t\t\toptions,\n\t\t\t});\n\t\t},\n\t\tclassify: classifySdkError,\n\t\tstore: pool.store,\n\t\tproviderId: CLAUDE_SDK_OAUTH_PROVIDER_ID,\n\t\tnow: activeBoundary.now,\n\t\terrorFromEvent: sdkFailure,\n\t\tisVisibleDelta: visibleSdkMessage,\n\t\tonFailover: ({ account, nextAccount, classification }) => {\n\t\t\temitProviderAccountsChanged(CLAUDE_SDK_OAUTH_PROVIDER_ID);\n\t\t\tif (nextAccount) {\n\t\t\t\temitProviderAccountFailover(\n\t\t\t\t\tCLAUDE_SDK_OAUTH_PROVIDER_ID,\n\t\t\t\t\taccount.name,\n\t\t\t\t\tnextAccount.name,\n\t\t\t\t\tclassification.kind,\n\t\t\t\t);\n\t\t\t}\n\t\t},\n\t});\n}\n"]}
+{"version":3,"file":"auth-lane.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/auth-lane.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAGN,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,WAAW,GAEX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAkC,qBAAqB,EAA0B,MAAM,mBAAmB,CAAC;AAClH,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACvH,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAI5C,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAEvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,MAAM,CAAC;AAU7C,KAAK,UAAU,yBAAyB,CAAC,OAAe,EAAE,MAAmB;IAC5E,MAAM,KAAK,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACnG,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;AAChG,CAAC;AAED,MAAM,eAAe,GAAqB;IACzC,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE;IACvC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG;IACtB,WAAW;IACX,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IACrB,SAAS,EAAE,yBAAyB;CACpC,CAAC;AACF,IAAI,cAAc,GAAG,eAAe,CAAC;AAErC,MAAM,UAAU,wBAAwB,CAAC,QAAmC;IAC3E,cAAc,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,QAAQ,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,qBAAqB;IACpC,cAAc,GAAG,eAAe,CAAC;AAClC,CAAC;AA6BD,MAAM,UAAU,oBAAoB,CACnC,QAAwC,EACxC,QAAgC;IAEhC,OAAO,QAAQ,CAAC,cAAc,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACrF,CAAC;AAED,KAAK,UAAU,WAAW,CACzB,QAAwC,EACxC,kBAA2C;IAE3C,MAAM,KAAK,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,2BAA2B,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAC1F,IAAI,QAAQ,GAAG,YAAY,CACzB,UAAmD,IAAI,eAAe,EAAE,EACzE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAC3B,CAAC;IACF,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,UAAU,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;QAC7F,QAAQ,GAAG,YAAY,CACrB,UAAuC,IAAI,eAAe,EAAE,EAC7D,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAC3B,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAChE,MAAM,IAAI,GACT,cAAc,KAAK,YAAY,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC;IAC9G,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,MAAM,GAAG,UAAU,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAE,UAAuC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACxG,CAAC;AAED,KAAK,UAAU,WAAW,CACzB,IAAiB,EACjB,QAAqB,EACrB,MAAmB;IAEnB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC;IACtB,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,cAAc,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,GAAG,kBAAkB,EAAE,CAAC;QACxF,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,WAAW,CAClC,IAAI,CAAC,KAAK,EACV,4BAA4B,EAC5B,IAAI,CAAC,IAAI,EACT,cAAc,CAAC,SAAS,EACxB,MAAM,EACN,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,OAAO,GAAG,kBAAkB,CACjE,CAAC;YACF,MAAM,UAAU,GAAG,SAAS,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAE,SAAsC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrG,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,IAAI,eAAe,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAC9F,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAC3C,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC7E,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC;QACrD,CAAC;IACF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAC1G,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC3F,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,EAAE,GAAG,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC;IACjG,MAAM,SAAS,GAAG,wBAAwB,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACvF,OAAO,EAAE,GAAG,gBAAgB,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,OAAmB;IACtC,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACxE,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,QAAQ,IAAI,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,MAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,uEAAuE;QACvE,4CAA4C;QAC5C,MAAM,MAAM,GACX,iBAAiB,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5G,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAmB;IAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,kEAAkE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACpG,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,iBAAiB,CAAC,KAA8B;IACtE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,iBAAiB,GAAG,2BAA2B,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACvF,MAAM,kBAAkB,GAAuC,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACxF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,CAAC,GAAG,GAAG,kBAAkB,CAAC;QACjC,KAAK,CAAC,CAAC,MAAM,qBAAqB,CAAC,KAAK,EAAE;YACzC,WAAW,EAAE,SAAS;YACtB,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,SAAS;YACnB,OAAO;SACP,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IACD,KAAK,CAAC,CAAC,WAAW,CAAC;QAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACtB,aAAa,CAAC,QAAQ,EAAE;YACvB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa;YACxD,GAAG,EAAE,cAAc,CAAC,GAAG,EAAE;SACzB,CAAC;QACH,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC;YAClE,OAAO,CAAC,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACpD,OAAO,qBAAqB,CAAC,KAAK,EAAE;gBACnC,WAAW,EAAE,IAAI,CAAC,IAAI;gBACtB,QAAQ;gBACR,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,OAAO;aACP,CAAC,CAAC;QACJ,CAAC;QACD,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,4BAA4B;QACxC,GAAG,EAAE,cAAc,CAAC,GAAG;QACvB,cAAc,EAAE,UAAU;QAC1B,cAAc,EAAE,iBAAiB;QACjC,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EAAE;YACxD,2BAA2B,CAAC,4BAA4B,CAAC,CAAC;YAC1D,IAAI,WAAW,EAAE,CAAC;gBACjB,2BAA2B,CAC1B,4BAA4B,EAC5B,OAAO,CAAC,IAAI,EACZ,WAAW,CAAC,IAAI,EAChB,cAAc,CAAC,IAAI,CACnB,CAAC;YACH,CAAC;QACF,CAAC;KACD,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { CredentialStore } from \"@earendil-works/pi-ai\";\nimport { loadAnthropicOAuth } from \"@earendil-works/pi-ai/oauth\";\nimport { getAgentDir } from \"../../../../config.ts\";\nimport { AuthStorage } from \"../../../auth-storage.ts\";\nimport { emitProviderAccountFailover, emitProviderAccountsChanged } from \"./account-events.ts\";\nimport { CLAUDE_SDK_OAUTH_PROVIDER_ID } from \"./account-management.ts\";\nimport {\n\ttype AccountSlot,\n\ttype ClaudeSdkOauthCredential,\n\temptyCredential,\n\tenvSlotToken,\n\tlistAccounts,\n\trefreshSlot,\n\ttype SlotRefresher,\n} from \"./accounts.ts\";\nimport { selectAccount } from \"./affinity.ts\";\nimport { type AuthenticatedAttemptInput, createAttemptMessages, type RetainableAttempt } from \"./auth-attempt.ts\";\nimport { hasRequestOauthToken, mergeRequestAuthEnvironment, stripManagedAuthEnvironment } from \"./auth-environment.ts\";\nimport { writeConfigDirCredential } from \"./config-dir-credentials.ts\";\nimport { classifySdkError } from \"./errors.ts\";\nimport { runFailover } from \"./failover.ts\";\nimport type { Options, SDKMessage, SdkQuery } from \"./sdk-boundary.ts\";\nimport type { ClaudeSdkOauthProviderSettings, ClaudeSdkOauthTokenInjection } from \"./settings.ts\";\n\nexport { CLAUDE_SDK_OAUTH_PROVIDER_ID } from \"./account-management.ts\";\n\nexport const EXPIRING_WITHIN_MS = 5 * 60_000;\n\ntype AuthLaneBoundary = {\n\tcreateStore: () => CredentialStore;\n\tenv: () => NodeJS.ProcessEnv;\n\tgetAgentDir: () => string;\n\tnow: () => number;\n\trefresher: SlotRefresher;\n};\n\nasync function refreshWithAnthropicOAuth(refresh: string, signal: AbortSignal) {\n\tconst oauth = await loadAnthropicOAuth();\n\tconst credential = await oauth.refresh({ type: \"oauth\", access: \"\", refresh, expires: 0 }, signal);\n\treturn { access: credential.access, refresh: credential.refresh, expires: credential.expires };\n}\n\nconst defaultBoundary: AuthLaneBoundary = {\n\tcreateStore: () => AuthStorage.create(),\n\tenv: () => process.env,\n\tgetAgentDir,\n\tnow: () => Date.now(),\n\trefresher: refreshWithAnthropicOAuth,\n};\nlet activeBoundary = defaultBoundary;\n\nexport function overrideAuthLaneBoundary(override: Partial<AuthLaneBoundary>): void {\n\tactiveBoundary = { ...activeBoundary, ...override };\n}\n\nexport function resetAuthLaneBoundary(): void {\n\tactiveBoundary = defaultBoundary;\n}\n\nexport type { AuthenticatedAttemptInput } from \"./auth-attempt.ts\";\n\nexport type AuthenticatedQueryInput = {\n\tprompt: Parameters<SdkQuery>[0][\"prompt\"];\n\tquery: SdkQuery;\n\tbuildOptions: (lane: ClaudeSdkOauthTokenInjection) => Options;\n\tproviderSettings: ClaudeSdkOauthProviderSettings;\n\t/** Effective request auth environment; overrides the host for account discovery and SDK spawn. */\n\tenv?: Record<string, string>;\n\tsignal?: AbortSignal;\n\tsessionId?: string;\n\t/** Request-scoped CLI pin; takes precedence over persistent settings and account pins. */\n\tpinnedAccount?: string;\n\tonQuery?: (query: ReturnType<SdkQuery>) => void;\n\tcreateAttempt?: (\n\t\tinput: AuthenticatedAttemptInput,\n\t) => RetainableAttempt<SDKMessage> | Promise<RetainableAttempt<SDKMessage>>;\n};\n\ntype ManagedPool = {\n\taccounts: AccountSlot[];\n\tenvironment: NodeJS.ProcessEnv;\n\tlane: Exclude<ClaudeSdkOauthTokenInjection, \"ambient\">;\n\tpinnedAccount?: string;\n\tstore: CredentialStore;\n};\n\nexport function resolveEffectiveLane(\n\tsettings: ClaudeSdkOauthProviderSettings,\n\taccounts: readonly AccountSlot[],\n): ClaudeSdkOauthTokenInjection {\n\treturn settings.tokenInjection ?? (accounts.length > 0 ? \"oauth-slots\" : \"ambient\");\n}\n\nasync function managedPool(\n\tsettings: ClaudeSdkOauthProviderSettings,\n\trequestEnvironment?: Record<string, string>,\n): Promise<ManagedPool | undefined> {\n\tconst store = activeBoundary.createStore();\n\tlet credential = await store.read(CLAUDE_SDK_OAUTH_PROVIDER_ID);\n\tconst environment = mergeRequestAuthEnvironment(activeBoundary.env(), requestEnvironment);\n\tlet accounts = listAccounts(\n\t\t(credential as ClaudeSdkOauthCredential | undefined) ?? emptyCredential(),\n\t\t(name) => environment[name],\n\t);\n\tif (!credential && accounts.length > 0) {\n\t\tcredential = await store.modify(CLAUDE_SDK_OAUTH_PROVIDER_ID, async () => emptyCredential());\n\t\taccounts = listAccounts(\n\t\t\t(credential as ClaudeSdkOauthCredential) ?? emptyCredential(),\n\t\t\t(name) => environment[name],\n\t\t);\n\t}\n\tconst configuredLane = resolveEffectiveLane(settings, accounts);\n\tconst lane =\n\t\tconfiguredLane === \"config-dir\" && hasRequestOauthToken(requestEnvironment) ? \"oauth-slots\" : configuredLane;\n\tif (lane === \"ambient\" || accounts.length === 0) return undefined;\n\tconst stored = credential?.type === \"oauth\" ? (credential as ClaudeSdkOauthCredential) : undefined;\n\treturn { accounts, environment, lane, pinnedAccount: settings.pinnedAccount ?? stored?.pinned, store };\n}\n\nasync function prepareSlot(\n\tpool: ManagedPool,\n\tselected: AccountSlot,\n\tsignal: AbortSignal,\n): Promise<Record<string, string | undefined>> {\n\tconst environment = pool.environment;\n\tconst slot = selected;\n\tif (slot.source !== \"env\" && activeBoundary.now() >= slot.expires - EXPIRING_WITHIN_MS) {\n\t\ttry {\n\t\t\tconst refreshed = await refreshSlot(\n\t\t\t\tpool.store,\n\t\t\t\tCLAUDE_SDK_OAUTH_PROVIDER_ID,\n\t\t\t\tslot.name,\n\t\t\t\tactiveBoundary.refresher,\n\t\t\t\tsignal,\n\t\t\t\t(expires) => activeBoundary.now() >= expires - EXPIRING_WITHIN_MS,\n\t\t\t);\n\t\t\tconst credential = refreshed?.type === \"oauth\" ? (refreshed as ClaudeSdkOauthCredential) : undefined;\n\t\t\tconst updated = listAccounts(credential ?? emptyCredential(), (name) => environment[name]).find(\n\t\t\t\t(candidate) => candidate.name === slot.name,\n\t\t\t);\n\t\t\tif (!updated) throw new Error(\"selected account disappeared during refresh\");\n\t\t\tObject.assign(slot, updated);\n\t\t} catch (error) {\n\t\t\tconst detail = error instanceof Error ? error.message : String(error);\n\t\t\tthrow new Error(`authentication_failed: ${detail}`);\n\t\t}\n\t}\n\tconst access = slot.source === \"env\" ? envSlotToken((name) => environment[name], slot.name) : slot.access;\n\tif (!access) throw new Error(\"authentication_failed: selected OAuth token is unavailable\");\n\tconst childEnvironment = stripManagedAuthEnvironment(environment);\n\tif (pool.lane === \"oauth-slots\") return { ...childEnvironment, CLAUDE_CODE_OAUTH_TOKEN: access };\n\tconst directory = writeConfigDirCredential(activeBoundary.getAgentDir(), slot, access);\n\treturn { ...childEnvironment, CLAUDE_CONFIG_DIR: directory };\n}\n\nfunction sdkFailure(message: SDKMessage): unknown | undefined {\n\tif (message.type === \"assistant\" && message.error) return message.error;\n\tif (message.type === \"result\" && message.subtype !== \"success\") {\n\t\tconst errors = \"errors\" in message && Array.isArray(message.errors) ? (message.errors as unknown[]) : [];\n\t\tif (errors.length > 0) return new Error(String(errors[0]));\n\t\t// `subtype` alone is too coarse to classify: a subscription limit and an\n\t\t// ordinary tool failure both arrive as \"error_during_execution\". The SDK\n\t\t// carries the real cause in `terminal_reason` (e.g. \"blocking_limit\"), so\n\t\t// append it — otherwise classifySdkError() scores every result error as\n\t\t// non-retryable \"other\", the exhausted account is never blocked, and a\n\t\t// multi-account pool never rotates past it.\n\t\tconst reason =\n\t\t\t\"terminal_reason\" in message && typeof message.terminal_reason === \"string\" ? message.terminal_reason : \"\";\n\t\treturn new Error(reason ? `Claude Code ${message.subtype}: ${reason}` : `Claude Code ${message.subtype}`);\n\t}\n\treturn undefined;\n}\n\nfunction visibleSdkMessage(message: SDKMessage): boolean {\n\tif (message.type !== \"stream_event\") return false;\n\treturn /^(?:content_block_start|content_block_delta|content_block_stop)$/.test(message.event.type);\n}\n\n/** Resolves managed OAuth immediately before each subprocess spawn and retries only pre-delta failures. */\nexport async function* queryWithAuthLane(input: AuthenticatedQueryInput): AsyncGenerator<SDKMessage> {\n\tconst signal = input.signal ?? new AbortController().signal;\n\tconst pool = await managedPool(input.providerSettings, input.env);\n\tif (!pool) {\n\t\tconst options = input.buildOptions(\"ambient\");\n\t\tconst parentEnvironment = mergeRequestAuthEnvironment(activeBoundary.env(), input.env);\n\t\tconst ambientEnvironment: Record<string, string | undefined> = { ...parentEnvironment };\n\t\tfor (const name of Object.keys(ambientEnvironment)) {\n\t\t\tif (name.startsWith(\"SENPI_\")) delete ambientEnvironment[name];\n\t\t}\n\t\toptions.env = ambientEnvironment;\n\t\tyield* await createAttemptMessages(input, {\n\t\t\taccountName: \"ambient\",\n\t\t\taccounts: [],\n\t\t\tauthLane: \"ambient\",\n\t\t\toptions,\n\t\t});\n\t\treturn;\n\t}\n\tyield* runFailover({\n\t\taccounts: pool.accounts,\n\t\tselectFn: (accounts) =>\n\t\t\tselectAccount(accounts, {\n\t\t\t\tsessionId: input.sessionId,\n\t\t\t\tpinnedAccount: input.pinnedAccount ?? pool.pinnedAccount,\n\t\t\t\tnow: activeBoundary.now(),\n\t\t\t}),\n\t\trunAttempt: async (slot) => {\n\t\t\tconst options = input.buildOptions(pool.lane);\n\t\t\tconst accounts = pool.accounts.map((account) => ({ ...account }));\n\t\t\toptions.env = await prepareSlot(pool, slot, signal);\n\t\t\treturn createAttemptMessages(input, {\n\t\t\t\taccountName: slot.name,\n\t\t\t\taccounts,\n\t\t\t\tauthLane: pool.lane,\n\t\t\t\toptions,\n\t\t\t});\n\t\t},\n\t\tclassify: classifySdkError,\n\t\tstore: pool.store,\n\t\tproviderId: CLAUDE_SDK_OAUTH_PROVIDER_ID,\n\t\tnow: activeBoundary.now,\n\t\terrorFromEvent: sdkFailure,\n\t\tisVisibleDelta: visibleSdkMessage,\n\t\tonFailover: ({ account, nextAccount, classification }) => {\n\t\t\temitProviderAccountsChanged(CLAUDE_SDK_OAUTH_PROVIDER_ID);\n\t\t\tif (nextAccount) {\n\t\t\t\temitProviderAccountFailover(\n\t\t\t\t\tCLAUDE_SDK_OAUTH_PROVIDER_ID,\n\t\t\t\t\taccount.name,\n\t\t\t\t\tnextAccount.name,\n\t\t\t\t\tclassification.kind,\n\t\t\t\t);\n\t\t\t}\n\t\t},\n\t});\n}\n"]}

package/dist/core/extensions/builtin/claude-sdk-oauth/availability.d.ts

@@ -1,2 +1,19 @@
-export declare function readAmbientClaudeAuthStatus(): Promise<boolean>;
+/**
+ * Memoises the probe, which spawns the Claude binary and costs a few hundred
+ * milliseconds. Auth resolution runs per request, so an uncached probe would
+ * put that on every model call. Concurrent readers share one in-flight probe;
+ * a rejected probe is not cached.
+ */
+export declare function createAmbientAuthStatusReader(probe: () => Promise<boolean>, now?: () => number, ttlMs?: number): (signal?: AbortSignal) => Promise<boolean>;
+type ProbeChildProcess = {
+    once(event: "error" | "close", listener: (code: number | null) => void): unknown;
+    kill(signal: "SIGKILL"): unknown;
+};
+export type AmbientProbeOptions = {
+    timeoutMs?: number;
+    spawnProbe?: (command: string, args: readonly string[]) => ProbeChildProcess;
+};
+export declare function probeAmbientClaudeAuthStatus(options?: AmbientProbeOptions): Promise<boolean>;
+export declare const readAmbientClaudeAuthStatus: (signal?: AbortSignal) => Promise<boolean>;
+export {};
 //# sourceMappingURL=availability.d.ts.map

package/dist/core/extensions/builtin/claude-sdk-oauth/availability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"availability.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/availability.ts"],"names":[],"mappings":"AAGA,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,OAAO,CAAC,CAmBpE"}
+{"version":3,"file":"availability.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/availability.ts"],"names":[],"mappings":"AAaA;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC5C,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,EAC7B,GAAG,GAAE,MAAM,MAAiB,EAC5B,KAAK,GAAE,MAA8B,GACnC,CAAC,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAoB5C;AAgBD,KAAK,iBAAiB,GAAG;IACxB,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC;IACjF,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,iBAAiB,CAAC;CAC7E,CAAC;AAEF,wBAAsB,4BAA4B,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,OAAO,CAAC,CA4BtG;AAED,eAAO,MAAM,2BAA2B,YA5E3B,WAAW,KAAK,OAAO,CAAC,OAAO,CA4E0D,CAAC"}

package/dist/core/extensions/builtin/claude-sdk-oauth/availability.js

@@ -1,6 +1,61 @@
 import { spawn } from "node:child_process";
 import { defaultExecutableDeps, resolveClaudeCodeExecutable } from "./executable.js";
-export async function readAmbientClaudeAuthStatus() {
+/** Long enough to keep the probe off the per-request path, short enough that a fresh `claude login` is picked up promptly. */
+const AMBIENT_STATUS_TTL_MS = 30_000;
+/**
+ * `claude auth status` validates credentials, so it can stall on a hung network call. The probe sits
+ * on the auth path of every request, and its result is shared, so one stall would otherwise park each
+ * caller that joins it. Unavailable is the safe answer: the managed lanes still resolve.
+ */
+const AMBIENT_PROBE_TIMEOUT_MS = 10_000;
+/**
+ * Memoises the probe, which spawns the Claude binary and costs a few hundred
+ * milliseconds. Auth resolution runs per request, so an uncached probe would
+ * put that on every model call. Concurrent readers share one in-flight probe;
+ * a rejected probe is not cached.
+ */
+export function createAmbientAuthStatusReader(probe, now = Date.now, ttlMs = AMBIENT_STATUS_TTL_MS) {
+    let cached;
+    let inFlight;
+    const startProbe = () => {
+        const status = probe().then((value) => {
+            cached = { at: now(), value };
+            return value;
+        });
+        inFlight = status;
+        const clear = () => {
+            if (inFlight === status)
+                inFlight = undefined;
+        };
+        void status.then(clear, clear);
+        return status;
+    };
+    return (signal) => {
+        if (signal?.aborted)
+            return Promise.reject(signal.reason);
+        if (cached && now() - cached.at < ttlMs)
+            return Promise.resolve(cached.value);
+        return untilAborted(inFlight ?? startProbe(), signal);
+    };
+}
+/**
+ * Stops THIS caller waiting once its request is abandoned, while the shared probe runs on for the
+ * callers still waiting on it. Aborting the probe itself would cancel work another request owns.
+ */
+function untilAborted(status, signal) {
+    if (signal === undefined)
+        return status;
+    if (signal.aborted)
+        return Promise.reject(signal.reason);
+    const abortController = new AbortController();
+    const aborted = new Promise((_resolve, reject) => {
+        signal.addEventListener("abort", () => reject(signal.reason), { once: true, signal: abortController.signal });
+    });
+    return Promise.race([status, aborted]).finally(() => abortController.abort());
+}
+export async function probeAmbientClaudeAuthStatus(options = {}) {
+    const timeoutMs = options.timeoutMs ?? AMBIENT_PROBE_TIMEOUT_MS;
+    const spawnProbe = options.spawnProbe ?? ((command, args) => spawn(command, [...args], { stdio: "ignore", windowsHide: true }));
     let executable;
     try {
         executable = resolveClaudeCodeExecutable(defaultExecutableDeps());
@@ -14,11 +69,18 @@ export async function readAmbientClaudeAuthStatus() {
             if (settled)
                 return;
             settled = true;
+            clearTimeout(deadline);
             resolve(available);
         };
-        const child = spawn(executable, ["auth", "status"], { stdio: "ignore" });
+        const child = spawnProbe(executable, ["auth", "status"]);
+        const deadline = setTimeout(() => {
+            child.kill("SIGKILL");
+            finish(false);
+        }, timeoutMs);
+        deadline.unref?.();
         child.once("error", () => finish(false));
         child.once("close", (code) => finish(code === 0));
     });
 }
+export const readAmbientClaudeAuthStatus = createAmbientAuthStatusReader(probeAmbientClaudeAuthStatus);
 //# sourceMappingURL=availability.js.map

package/dist/core/extensions/builtin/claude-sdk-oauth/availability.js.map

@@ -1 +1 @@
-{"version":3,"file":"availability.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/availability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAErF,MAAM,CAAC,KAAK,UAAU,2BAA2B;IAChD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,UAAU,GAAG,2BAA2B,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,SAAkB,EAAE,EAAE;YACrC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,SAAS,CAAC,CAAC;QACpB,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import { spawn } from \"node:child_process\";\nimport { defaultExecutableDeps, resolveClaudeCodeExecutable } from \"./executable.ts\";\n\nexport async function readAmbientClaudeAuthStatus(): Promise<boolean> {\n\tlet executable: string;\n\ttry {\n\t\texecutable = resolveClaudeCodeExecutable(defaultExecutableDeps());\n\t} catch {\n\t\treturn false;\n\t}\n\n\treturn new Promise((resolve) => {\n\t\tlet settled = false;\n\t\tconst finish = (available: boolean) => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tresolve(available);\n\t\t};\n\t\tconst child = spawn(executable, [\"auth\", \"status\"], { stdio: \"ignore\" });\n\t\tchild.once(\"error\", () => finish(false));\n\t\tchild.once(\"close\", (code) => finish(code === 0));\n\t});\n}\n"]}
+{"version":3,"file":"availability.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/availability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAErF,8HAA8H;AAC9H,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAExC;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC5C,KAA6B,EAC7B,MAAoB,IAAI,CAAC,GAAG,EAC5B,QAAgB,qBAAqB;IAErC,IAAI,MAAkD,CAAC;IACvD,IAAI,QAAsC,CAAC;IAC3C,MAAM,UAAU,GAAG,GAAqB,EAAE;QACzC,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACrC,MAAM,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC;QAClB,MAAM,KAAK,GAAG,GAAG,EAAE;YAClB,IAAI,QAAQ,KAAK,MAAM;gBAAE,QAAQ,GAAG,SAAS,CAAC;QAC/C,CAAC,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC;IACf,CAAC,CAAC;IACF,OAAO,CAAC,MAAM,EAAE,EAAE;QACjB,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,KAAK;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9E,OAAO,YAAY,CAAC,QAAQ,IAAI,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,MAAwB,EAAE,MAA+B;IAC9E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACvD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/G,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;AAC/E,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,UAA+B,EAAE;IACnF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,wBAAwB,CAAC;IAChE,MAAM,UAAU,GACf,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9G,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,UAAU,GAAG,2BAA2B,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,SAAkB,EAAE,EAAE;YACrC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,OAAO,CAAC,SAAS,CAAC,CAAC;QACpB,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,CAAC;QACf,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,6BAA6B,CAAC,4BAA4B,CAAC,CAAC","sourcesContent":["import { spawn } from \"node:child_process\";\nimport { defaultExecutableDeps, resolveClaudeCodeExecutable } from \"./executable.ts\";\n\n/** Long enough to keep the probe off the per-request path, short enough that a fresh `claude login` is picked up promptly. */\nconst AMBIENT_STATUS_TTL_MS = 30_000;\n\n/**\n * `claude auth status` validates credentials, so it can stall on a hung network call. The probe sits\n * on the auth path of every request, and its result is shared, so one stall would otherwise park each\n * caller that joins it. Unavailable is the safe answer: the managed lanes still resolve.\n */\nconst AMBIENT_PROBE_TIMEOUT_MS = 10_000;\n\n/**\n * Memoises the probe, which spawns the Claude binary and costs a few hundred\n * milliseconds. Auth resolution runs per request, so an uncached probe would\n * put that on every model call. Concurrent readers share one in-flight probe;\n * a rejected probe is not cached.\n */\nexport function createAmbientAuthStatusReader(\n\tprobe: () => Promise<boolean>,\n\tnow: () => number = Date.now,\n\tttlMs: number = AMBIENT_STATUS_TTL_MS,\n): (signal?: AbortSignal) => Promise<boolean> {\n\tlet cached: { at: number; value: boolean } | undefined;\n\tlet inFlight: Promise<boolean> | undefined;\n\tconst startProbe = (): Promise<boolean> => {\n\t\tconst status = probe().then((value) => {\n\t\t\tcached = { at: now(), value };\n\t\t\treturn value;\n\t\t});\n\t\tinFlight = status;\n\t\tconst clear = () => {\n\t\t\tif (inFlight === status) inFlight = undefined;\n\t\t};\n\t\tvoid status.then(clear, clear);\n\t\treturn status;\n\t};\n\treturn (signal) => {\n\t\tif (signal?.aborted) return Promise.reject(signal.reason);\n\t\tif (cached && now() - cached.at < ttlMs) return Promise.resolve(cached.value);\n\t\treturn untilAborted(inFlight ?? startProbe(), signal);\n\t};\n}\n\n/**\n * Stops THIS caller waiting once its request is abandoned, while the shared probe runs on for the\n * callers still waiting on it. Aborting the probe itself would cancel work another request owns.\n */\nfunction untilAborted(status: Promise<boolean>, signal: AbortSignal | undefined): Promise<boolean> {\n\tif (signal === undefined) return status;\n\tif (signal.aborted) return Promise.reject(signal.reason);\n\tconst abortController = new AbortController();\n\tconst aborted = new Promise<never>((_resolve, reject) => {\n\t\tsignal.addEventListener(\"abort\", () => reject(signal.reason), { once: true, signal: abortController.signal });\n\t});\n\treturn Promise.race([status, aborted]).finally(() => abortController.abort());\n}\n\ntype ProbeChildProcess = {\n\tonce(event: \"error\" | \"close\", listener: (code: number | null) => void): unknown;\n\tkill(signal: \"SIGKILL\"): unknown;\n};\n\nexport type AmbientProbeOptions = {\n\ttimeoutMs?: number;\n\tspawnProbe?: (command: string, args: readonly string[]) => ProbeChildProcess;\n};\n\nexport async function probeAmbientClaudeAuthStatus(options: AmbientProbeOptions = {}): Promise<boolean> {\n\tconst timeoutMs = options.timeoutMs ?? AMBIENT_PROBE_TIMEOUT_MS;\n\tconst spawnProbe =\n\t\toptions.spawnProbe ?? ((command, args) => spawn(command, [...args], { stdio: \"ignore\", windowsHide: true }));\n\tlet executable: string;\n\ttry {\n\t\texecutable = resolveClaudeCodeExecutable(defaultExecutableDeps());\n\t} catch {\n\t\treturn false;\n\t}\n\n\treturn new Promise((resolve) => {\n\t\tlet settled = false;\n\t\tconst finish = (available: boolean) => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tclearTimeout(deadline);\n\t\t\tresolve(available);\n\t\t};\n\t\tconst child = spawnProbe(executable, [\"auth\", \"status\"]);\n\t\tconst deadline = setTimeout(() => {\n\t\t\tchild.kill(\"SIGKILL\");\n\t\t\tfinish(false);\n\t\t}, timeoutMs);\n\t\tdeadline.unref?.();\n\t\tchild.once(\"error\", () => finish(false));\n\t\tchild.once(\"close\", (code) => finish(code === 0));\n\t});\n}\n\nexport const readAmbientClaudeAuthStatus = createAmbientAuthStatusReader(probeAmbientClaudeAuthStatus);\n"]}

package/dist/core/extensions/builtin/claude-sdk-oauth/config-dir-credentials.d.ts

@@ -0,0 +1,3 @@
+import { type AccountSlot } from "./accounts.ts";
+export declare function writeConfigDirCredential(agentDir: string, slot: AccountSlot, access: string): string;
+//# sourceMappingURL=config-dir-credentials.d.ts.map

package/dist/core/extensions/builtin/claude-sdk-oauth/config-dir-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-dir-credentials.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/config-dir-credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,WAAW,EAA0B,MAAM,eAAe,CAAC;AAWzE,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAkBpG"}

package/dist/core/extensions/builtin/claude-sdk-oauth/config-dir-credentials.js

@@ -0,0 +1,27 @@
+import { chmodSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { assertValidAccountName } from "./accounts.js";
+const CLI_OAUTH_SCOPES = [
+    "org:create_api_key",
+    "user:profile",
+    "user:inference",
+    "user:sessions:claude_code",
+    "user:mcp_servers",
+    "user:file_upload",
+];
+export function writeConfigDirCredential(agentDir, slot, access) {
+    assertValidAccountName(slot.name);
+    const directory = join(agentDir, "claude-sdk-oauth-accounts", slot.name);
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    chmodSync(directory, 0o700);
+    writeFileSync(join(directory, ".credentials.json"), JSON.stringify({
+        claudeAiOauth: {
+            accessToken: access,
+            refreshToken: slot.refresh,
+            expiresAt: slot.expires,
+            scopes: CLI_OAUTH_SCOPES,
+        },
+    }), { encoding: "utf8", mode: 0o600 });
+    return directory;
+}
+//# sourceMappingURL=config-dir-credentials.js.map

package/dist/core/extensions/builtin/claude-sdk-oauth/config-dir-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-dir-credentials.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/config-dir-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAoB,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEzE,MAAM,gBAAgB,GAAG;IACxB,oBAAoB;IACpB,cAAc;IACd,gBAAgB;IAChB,2BAA2B;IAC3B,kBAAkB;IAClB,kBAAkB;CACT,CAAC;AAEX,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,IAAiB,EAAE,MAAc;IAC3F,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,2BAA2B,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACzE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5B,aAAa,CACZ,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,EACpC,IAAI,CAAC,SAAS,CAAC;QACd,aAAa,EAAE;YACd,WAAW,EAAE,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,OAAO;YAC1B,SAAS,EAAE,IAAI,CAAC,OAAO;YACvB,MAAM,EAAE,gBAAgB;SACxB;KACD,CAAC,EACF,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CACjC,CAAC;IACF,OAAO,SAAS,CAAC;AAClB,CAAC","sourcesContent":["import { chmodSync, mkdirSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { type AccountSlot, assertValidAccountName } from \"./accounts.ts\";\n\nconst CLI_OAUTH_SCOPES = [\n\t\"org:create_api_key\",\n\t\"user:profile\",\n\t\"user:inference\",\n\t\"user:sessions:claude_code\",\n\t\"user:mcp_servers\",\n\t\"user:file_upload\",\n] as const;\n\nexport function writeConfigDirCredential(agentDir: string, slot: AccountSlot, access: string): string {\n\tassertValidAccountName(slot.name);\n\tconst directory = join(agentDir, \"claude-sdk-oauth-accounts\", slot.name);\n\tmkdirSync(directory, { recursive: true, mode: 0o700 });\n\tchmodSync(directory, 0o700);\n\twriteFileSync(\n\t\tjoin(directory, \".credentials.json\"),\n\t\tJSON.stringify({\n\t\t\tclaudeAiOauth: {\n\t\t\t\taccessToken: access,\n\t\t\t\trefreshToken: slot.refresh,\n\t\t\t\texpiresAt: slot.expires,\n\t\t\t\tscopes: CLI_OAUTH_SCOPES,\n\t\t\t},\n\t\t}),\n\t\t{ encoding: \"utf8\", mode: 0o600 },\n\t);\n\treturn directory;\n}\n"]}