@fitlab-ai/agent-infra 0.9.2 → 0.9.4

package/lib/agent-clients/adapters/claude-code-sandbox.ts

@@ -0,0 +1,295 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import type {
+  AgentClientSandboxHook,
+  SandboxHookCreateContext,
+  SandboxHookEnterContext
+} from '../../sandbox/tool-types.ts';
+import {
+  formatCredentialWarnings,
+  formatRemaining,
+  hasClaudeProviderAuth,
+  inspectClaudeKeychainStatus,
+  prepareClaudeCredentials,
+  reconcileClaudeCredentials,
+  redactCommandError,
+  validateClaudeCredentialsEnvOverride
+} from './claude-code-credentials.ts';
+
+type JsonObject = Record<string, unknown>;
+
+function readHostJsonSafe(filePath: string): JsonObject | null {
+  if (!filePath || !fs.existsSync(filePath)) return null;
+  try {
+    const parsed = JSON.parse(fs.readFileSync(filePath, 'utf8')) as unknown;
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+      ? parsed as JsonObject
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+const CLAUDE_SETTINGS_INHERIT_TOP_LEVEL_KEYS = [
+  'model',
+  'fallbackModel',
+  'availableModels',
+  'modelOverrides',
+  'enforceAvailableModels',
+  'advisorModel',
+  'apiKeyHelper',
+  'effortLevel'
+];
+
+function isJsonObjectRecord(value: unknown): value is JsonObject {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function mergeMissingStringEnvFields(target: JsonObject, source: JsonObject): boolean {
+  if (!isJsonObjectRecord(source.env)) return false;
+  if (Object.hasOwn(target, 'env') && !isJsonObjectRecord(target.env)) return false;
+
+  let targetEnv = target.env as JsonObject | undefined;
+  let changed = false;
+  for (const [key, value] of Object.entries(source.env)) {
+    if (typeof value !== 'string' || value === '') continue;
+    if (!targetEnv) {
+      targetEnv = {};
+      target.env = targetEnv;
+    }
+    if (!Object.hasOwn(targetEnv, key)) {
+      targetEnv[key] = value;
+      changed = true;
+    }
+  }
+  return changed;
+}
+
+function mergeMissingTopLevelSettings(target: JsonObject, source: JsonObject): boolean {
+  let changed = false;
+  for (const key of CLAUDE_SETTINGS_INHERIT_TOP_LEVEL_KEYS) {
+    if (!Object.hasOwn(source, key) || Object.hasOwn(target, key)) continue;
+    const value = source[key];
+    if (value === null || value === undefined || value === '') continue;
+    target[key] = value;
+    changed = true;
+  }
+  return changed;
+}
+
+function requireCreateContext(
+  context: SandboxHookCreateContext | undefined,
+  hookId: string
+): SandboxHookCreateContext {
+  if (!context) throw new Error(`${hookId} requires create context`);
+  return context;
+}
+
+function requireEnterContext(
+  context: SandboxHookEnterContext | undefined,
+  hookId: string
+): SandboxHookEnterContext {
+  if (!context) throw new Error(`${hookId} requires enter context`);
+  return context;
+}
+
+export function ensureClaudeOnboarding(toolDir: string, hostHomeDir?: string): void {
+  const claudeJsonPath = path.join(toolDir, '.claude.json');
+  let data: JsonObject & {
+    hasCompletedOnboarding?: boolean;
+    projects?: Record<string, { hasTrustDialogAccepted?: boolean }>;
+    model?: string;
+  } = {};
+  if (fs.existsSync(claudeJsonPath)) {
+    try {
+      data = JSON.parse(fs.readFileSync(claudeJsonPath, 'utf8')) as typeof data;
+    } catch {
+      // Malformed JSON is replaced with a valid managed sandbox baseline.
+    }
+  }
+  let changed = false;
+  if (!data.hasCompletedOnboarding) {
+    data.hasCompletedOnboarding = true;
+    changed = true;
+  }
+  if (!data.projects) {
+    data.projects = {};
+    changed = true;
+  }
+  if (!data.projects['/workspace']) {
+    data.projects['/workspace'] = {};
+    changed = true;
+  }
+  if (!data.projects['/workspace'].hasTrustDialogAccepted) {
+    data.projects['/workspace'].hasTrustDialogAccepted = true;
+    changed = true;
+  }
+  if (hostHomeDir) {
+    const hostClaudeJson = readHostJsonSafe(path.join(hostHomeDir, '.claude.json'));
+    if (
+      hostClaudeJson
+      && typeof hostClaudeJson.model === 'string'
+      && hostClaudeJson.model !== ''
+      && !Object.hasOwn(data, 'model')
+    ) {
+      data.model = hostClaudeJson.model;
+      changed = true;
+    }
+    if (hostClaudeJson) {
+      for (const key of Object.keys(hostClaudeJson)) {
+        if (
+          /^unpin.*LaunchEffort$/.test(key)
+          && hostClaudeJson[key] === true
+          && !Object.hasOwn(data, key)
+        ) {
+          data[key] = true;
+          changed = true;
+        }
+      }
+    }
+  }
+  if (changed) fs.writeFileSync(claudeJsonPath, JSON.stringify(data, null, 4), 'utf8');
+}
+
+export function ensureClaudeSettings(toolDir: string, hostHomeDir?: string): void {
+  const settingsPath = path.join(toolDir, 'settings.json');
+  let data: JsonObject & { skipDangerousModePermissionPrompt?: boolean } = {};
+  if (fs.existsSync(settingsPath)) {
+    try {
+      data = JSON.parse(fs.readFileSync(settingsPath, 'utf8')) as typeof data;
+    } catch {
+      // Malformed JSON is replaced with a valid managed sandbox baseline.
+    }
+  }
+  let changed = false;
+  if (data.skipDangerousModePermissionPrompt !== true) {
+    data.skipDangerousModePermissionPrompt = true;
+    changed = true;
+  }
+  if (hostHomeDir) {
+    const hostSettings = readHostJsonSafe(path.join(hostHomeDir, '.claude', 'settings.json'));
+    if (hostSettings) {
+      changed = mergeMissingStringEnvFields(data, hostSettings) || changed;
+      changed = mergeMissingTopLevelSettings(data, hostSettings) || changed;
+    }
+  }
+  if (changed) fs.writeFileSync(settingsPath, JSON.stringify(data, null, 4), 'utf8');
+}
+
+export function formatCredentialSyncStatus(
+  result: ReturnType<typeof reconcileClaudeCredentials>,
+  isTTY = process.stderr.isTTY,
+  providerAuthAvailable = false
+): string | null {
+  if (providerAuthAvailable && (result.status === 'STALE_ACCESS' || result.status === 'MISSING')) return null;
+  if (result.status === 'STALE_ACCESS') {
+    return 'Warning: Claude Code credentials on host appear stale. Run "ai sandbox refresh" or "claude /login" to renew.\n';
+  }
+  if (result.status === 'MISSING') {
+    return 'Warning: Claude Code credentials missing on host. Run "claude /login" to authenticate.\n';
+  }
+  if (result.status === 'KEYCHAIN_WRITE_FAILED') {
+    return `Warning: A sandbox refresh produced newer credentials but host Keychain write failed (${formatCredentialWarnings(result.warnings)}). Run "ai sandbox refresh" again or "claude /status" on the host to retry.\n`;
+  }
+  if (result.status === 'KEYCHAIN_LOCKED' || result.status === 'KEYCHAIN_ERROR') {
+    return 'Warning: Host keychain is unavailable; Claude credential sync skipped. Run "ai sandbox refresh" for details.\n';
+  }
+  if (result.status === 'OK' && result.authoritative !== 'host') {
+    const message = `Synced Claude Code credentials from sandbox refresh back to host (expires in ${formatRemaining(result.expiresAt)})`;
+    return isTTY ? `\x1b[2m${message}\x1b[0m\n` : `${message}\n`;
+  }
+  if (result.status === 'OK' && result.filesWritten.length > 0) {
+    const message = `Synced Claude Code credentials from host Keychain (expires in ${formatRemaining(result.expiresAt)})`;
+    return isTTY ? `\x1b[2m${message}\x1b[0m\n` : `${message}\n`;
+  }
+  return null;
+}
+
+const claudeCodeCredentialPreflightHook: AgentClientSandboxHook = {
+  id: 'claude-code-credential-preflight',
+  phase: 'prepare',
+  run: async ({ create }) => {
+    const { hostHome, hostEnv, project, resolvedTools } = requireCreateContext(
+      create,
+      'claude-code-credential-preflight'
+    );
+    try {
+      validateClaudeCredentialsEnvOverride(hostEnv);
+      const outcome = prepareClaudeCredentials(
+        hostHome,
+        project,
+        [...resolvedTools],
+        undefined,
+        undefined,
+        (home) => inspectClaudeKeychainStatus(home, undefined, { envFn: () => ({ ...hostEnv }) })
+      );
+      if (outcome.status === 'SKIPPED') {
+        return {
+          status: 'warning',
+          message: 'Claude Code credentials not found on host - creating this sandbox WITHOUT Claude Code credentials.\n'
+            + '  Claude Code is still installed in the image but will not be authenticated.\n'
+            + '  To enable it: run "claude" once on the host to complete login, then re-run "ai sandbox create".'
+        };
+      }
+      return { status: 'ready' };
+    } catch (error) {
+      return {
+        status: 'fatal',
+        message: redactCommandError(error instanceof Error ? error.message : 'unknown credential error')
+      };
+    }
+  }
+};
+
+const claudeCodeBeforeContainerCreateHook: AgentClientSandboxHook = {
+  id: 'claude-code-before-container-create',
+  phase: 'before-container-create',
+  run: async ({ create }) => {
+    const { hostHome, resolvedTools } = requireCreateContext(
+      create,
+      'claude-code-before-container-create'
+    );
+    const claudeCodeEntry = resolvedTools.find(({ tool }) => tool.id === 'claude-code');
+    if (claudeCodeEntry) {
+      ensureClaudeOnboarding(claudeCodeEntry.dir, hostHome);
+      ensureClaudeSettings(claudeCodeEntry.dir, hostHome);
+    }
+    return { status: 'ready' };
+  }
+};
+
+const claudeCodeBeforeEnterHook: AgentClientSandboxHook = {
+  id: 'claude-code-before-enter',
+  phase: 'before-enter',
+  run: async ({ enter }) => {
+    const { hostHome, hostEnv } = requireEnterContext(enter, 'claude-code-before-enter');
+    try {
+      validateClaudeCredentialsEnvOverride(hostEnv);
+    } catch (error) {
+      return {
+        status: 'fatal',
+        message: redactCommandError(error instanceof Error ? error.message : 'invalid credentials override')
+      };
+    }
+    try {
+      const providerAuthAvailable = hasClaudeProviderAuth(hostHome);
+      const result = reconcileClaudeCredentials(hostHome, { envFn: () => ({ ...hostEnv }) });
+      const message = formatCredentialSyncStatus(result, process.stderr.isTTY, providerAuthAvailable);
+      return {
+        status: 'ready',
+        ...(message === null ? {} : { message })
+      };
+    } catch (error) {
+      return {
+        status: 'warning',
+        message: `Failed to sync Claude Code credentials: ${redactCommandError(error instanceof Error ? error.message : 'unknown error')}`
+      };
+    }
+  }
+};
+
+export {
+  claudeCodeBeforeContainerCreateHook,
+  claudeCodeBeforeEnterHook,
+  claudeCodeCredentialPreflightHook
+};

package/lib/agent-clients/adapters/claude-code.ts

@@ -1,5 +1,10 @@
 import { defineAgentClientAdapter } from '../adapter.ts';
 import { hostJoin } from '../../sandbox/engines/wsl2-paths.ts';
+import {
+  claudeCodeBeforeContainerCreateHook,
+  claudeCodeBeforeEnterHook,
+  claudeCodeCredentialPreflightHook
+} from './claude-code-sandbox.ts';
 
 const claudeCodeAdapter = defineAgentClientAdapter({
   id: 'claude-code',
@@ -11,13 +16,22 @@ const claudeCodeAdapter = defineAgentClientAdapter({
     commands: { level: 'integrated' },
     hooks: { level: 'integrated' },
     subagents: { level: 'experimental' },
-    orchestration: { level: 'experimental' },
+    orchestration: { level: 'unsupported' },
     sandbox: { level: 'integrated' },
     verification: { level: 'compatible' }
   },
+  modelSelection: {
+    kind: 'interactive-only',
+    command: '/model',
+    guidance: 'Use the host model picker for the complete model and reasoning-effort catalog.'
+  },
+  delegationEvidence: {
+    actualModel: 'unavailable',
+    actualReasoningEffort: 'unavailable'
+  },
   project: {
     ownedPathPrefixes: ['.claude/'],
-    managed: ['.claude/commands/', '.claude/agents/'],
+    managed: ['.claude/commands/', '.claude/agents/', '.claude/rules/'],
     merged: ['.claude/settings.json'],
     ejected: [],
     seedCommands: [{
@@ -26,9 +40,18 @@ const claudeCodeAdapter = defineAgentClientAdapter({
         'zh-CN': '.claude/commands/update-agent-infra.zh-CN.md'
       },
       target: '.claude/commands/update-agent-infra.md'
-    }]
+    }],
+    customCommand: {
+      target: '.claude/commands/${skillName}.md',
+      frontmatter: {},
+      includeUsage: true,
+      inheritDisableModelInvocation: true
+    }
   },
   sandbox: {
+    image: {
+      dockerfileFragment: 'claude-code'
+    },
     createTool: ({ home, project }) => ({
       id: 'claude-code',
       name: 'Claude Code',
@@ -63,7 +86,11 @@ const claudeCodeAdapter = defineAgentClientAdapter({
       { name: 'claude-yolo', command: 'claude --dangerously-skip-permissions; tput ed' },
       { name: 'cy', command: 'claude --dangerously-skip-permissions; tput ed' }
     ],
-    hooks: []
+    hooks: [
+      claudeCodeCredentialPreflightHook,
+      claudeCodeBeforeContainerCreateHook,
+      claudeCodeBeforeEnterHook
+    ]
   }
 });
 

package/lib/agent-clients/adapters/codex.ts

@@ -19,6 +19,15 @@ const codexAdapter = defineAgentClientAdapter({
     sandbox: { level: 'integrated' },
     verification: { level: 'compatible' }
   },
+  modelSelection: {
+    kind: 'interactive-only',
+    command: '/model',
+    guidance: 'Use the host model picker for the complete model and reasoning-effort catalog.'
+  },
+  delegationEvidence: {
+    actualModel: 'unavailable',
+    actualReasoningEffort: 'unavailable'
+  },
   project: {
     ownedPathPrefixes: ['.codex/'],
     managed: ['.codex/hooks.json', '.codex/agents/'],

package/lib/agent-clients/adapters/index.ts

@@ -2,14 +2,14 @@ import { AGENT_CLIENT_IDS } from '../types.ts';
 import type { AgentClientAdapter } from '../adapter.ts';
 import { claudeCodeAdapter } from './claude-code.ts';
 import { codexAdapter } from './codex.ts';
-import { geminiCliAdapter } from './gemini-cli.ts';
+import { antigravityCliAdapter } from './antigravity-cli.ts';
 import { opencodeAdapter } from './opencode.ts';
 
 const adaptersById = new Map(
   [
     claudeCodeAdapter,
     codexAdapter,
-    geminiCliAdapter,
+    antigravityCliAdapter,
     opencodeAdapter
   ].map((adapter) => [adapter.id, adapter])
 );

package/lib/agent-clients/adapters/opencode-sandbox.ts

@@ -0,0 +1,136 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+import type {
+  AgentClientSandboxHook,
+  AgentClientSandboxRecoveryCheck
+} from '../../sandbox/tool-types.ts';
+
+type JsonObject = Record<string, unknown>;
+
+function readJsonObject(filePath: string): JsonObject | null {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(filePath, 'utf8')) as unknown;
+    return parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)
+      ? parsed as JsonObject
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+function resolveXdgRoot(value: string | undefined, fallback: string): string {
+  return typeof value === 'string' && value !== '' && path.isAbsolute(value)
+    ? value
+    : fallback;
+}
+
+function ensureOpenCodeSandboxState(
+  toolDir: string,
+  hostHome: string,
+  hostEnv: Readonly<NodeJS.ProcessEnv> = {}
+): void {
+  const canonicalConfigDir = path.join(toolDir, '.xdg', 'config', 'opencode');
+  const canonicalStateDir = path.join(toolDir, '.xdg', 'state', 'opencode');
+  const canonicalConfigPath = path.join(canonicalConfigDir, 'opencode.json');
+  const legacyConfigPath = path.join(toolDir, 'opencode.json');
+  fs.mkdirSync(canonicalConfigDir, { recursive: true });
+  fs.mkdirSync(canonicalStateDir, { recursive: true });
+
+  if (!fs.existsSync(canonicalConfigPath) && fs.existsSync(legacyConfigPath)) {
+    fs.copyFileSync(legacyConfigPath, canonicalConfigPath, fs.constants.COPYFILE_EXCL);
+  }
+
+  const hostConfigRoot = resolveXdgRoot(
+    hostEnv.XDG_CONFIG_HOME,
+    path.join(hostHome, '.config')
+  );
+  const hostConfig = readJsonObject(
+    path.join(hostConfigRoot, 'opencode', 'opencode.json')
+  );
+  if (!hostConfig) {
+    return;
+  }
+
+  let sandboxConfig: JsonObject = {};
+  if (fs.existsSync(canonicalConfigPath)) {
+    const existing = readJsonObject(canonicalConfigPath);
+    if (!existing) {
+      return;
+    }
+    sandboxConfig = existing;
+  }
+
+  let changed = false;
+  for (const key of ['model', 'small_model']) {
+    if (Object.hasOwn(sandboxConfig, key)) {
+      continue;
+    }
+    const value = hostConfig[key];
+    if (typeof value === 'string' && value !== '') {
+      sandboxConfig[key] = value;
+      changed = true;
+    }
+  }
+  if (changed) {
+    fs.writeFileSync(canonicalConfigPath, JSON.stringify(sandboxConfig, null, 2), 'utf8');
+  }
+}
+
+const opencodeBeforeContainerCreateHook: AgentClientSandboxHook = {
+  id: 'opencode-before-container-create',
+  phase: 'before-container-create',
+  async run(context) {
+    const create = context.create;
+    const entry = create?.resolvedTools.find(({ tool }) => tool.id === 'opencode');
+    if (!create || !entry) {
+      return {
+        status: 'fatal',
+        message: 'OpenCode sandbox hook requires its resolved tool state.'
+      };
+    }
+    ensureOpenCodeSandboxState(entry.dir, create.hostHome, create.hostEnv);
+    return { status: 'ready' };
+  }
+};
+
+const opencodeRecoveryChecks: readonly AgentClientSandboxRecoveryCheck[] = [
+  {
+    id: 'command-available',
+    probe: { script: 'command -v "$1"', args: ['opencode'] },
+    finding: {
+      repairKind: 'hard-failure',
+      message: 'OpenCode is not available on PATH inside the sandbox.'
+    }
+  },
+  {
+    id: 'config-writable',
+    probe: {
+      script: 'probe="$1/.agent-infra-opencode-config-$$"; trap \'rm -f -- "$probe"\' EXIT; : > "$probe"',
+      args: ['/home/devuser/.local/share/opencode/.xdg/config/opencode']
+    },
+    finding: {
+      repairKind: 'permissions',
+      message: 'OpenCode config directory is not writable by devuser.',
+      path: '/home/devuser/.local/share/opencode/.xdg/config/opencode'
+    }
+  },
+  {
+    id: 'state-writable',
+    probe: {
+      script: 'probe="$1/.agent-infra-opencode-state-$$"; trap \'rm -f -- "$probe"\' EXIT; : > "$probe"',
+      args: ['/home/devuser/.local/share/opencode/.xdg/state/opencode']
+    },
+    finding: {
+      repairKind: 'permissions',
+      message: 'OpenCode state directory is not writable by devuser.',
+      path: '/home/devuser/.local/share/opencode/.xdg/state/opencode'
+    }
+  }
+];
+
+export {
+  ensureOpenCodeSandboxState,
+  opencodeBeforeContainerCreateHook,
+  opencodeRecoveryChecks
+};

package/lib/agent-clients/adapters/opencode.ts

@@ -1,5 +1,9 @@
 import { defineAgentClientAdapter } from '../adapter.ts';
 import { hostJoin } from '../../sandbox/engines/wsl2-paths.ts';
+import {
+  opencodeBeforeContainerCreateHook,
+  opencodeRecoveryChecks
+} from './opencode-sandbox.ts';
 
 const YOLO_PERMISSION = '{"*":"allow","read":"allow","bash":"allow","edit":"allow","webfetch":"allow","external_directory":"allow","doom_loop":"allow"}';
 
@@ -17,6 +21,15 @@ const opencodeAdapter = defineAgentClientAdapter({
     sandbox: { level: 'integrated' },
     verification: { level: 'compatible' }
   },
+  modelSelection: {
+    kind: 'interactive-only',
+    command: '/models',
+    guidance: 'Use the host model picker for the complete model and reasoning-effort catalog.'
+  },
+  delegationEvidence: {
+    actualModel: 'unavailable',
+    actualReasoningEffort: 'unavailable'
+  },
   project: {
     ownedPathPrefixes: ['.opencode/'],
     managed: ['.opencode/commands/'],
@@ -28,9 +41,17 @@ const opencodeAdapter = defineAgentClientAdapter({
         'zh-CN': '.opencode/commands/update-agent-infra.zh-CN.md'
       },
       target: '.opencode/commands/update-agent-infra.md'
-    }]
+    }],
+    customCommand: {
+      target: '.opencode/commands/${skillName}.md',
+      frontmatter: { agent: 'general', subtask: false },
+      argumentsToken: '$ARGUMENTS'
+    }
   },
   sandbox: {
+    image: {
+      dotfilesExclusions: ['.config/opencode']
+    },
     createTool: ({ home }) => ({
       id: 'opencode',
       name: 'OpenCode',
@@ -40,7 +61,9 @@ const opencodeAdapter = defineAgentClientAdapter({
       versionCmd: 'opencode --version',
       setupHint: 'Configure OpenCode credentials inside the container before first use.',
       envVars: {
-        OPENCODE_CONFIG: '/home/devuser/.local/share/opencode/opencode.json'
+        XDG_DATA_HOME: '/home/devuser/.local/share',
+        XDG_CONFIG_HOME: '/home/devuser/.local/share/opencode/.xdg/config',
+        XDG_STATE_HOME: '/home/devuser/.local/share/opencode/.xdg/state'
       },
       hostLiveMounts: [
         {
@@ -59,7 +82,8 @@ const opencodeAdapter = defineAgentClientAdapter({
         command: `OPENCODE_PERMISSION='${YOLO_PERMISSION}' opencode; tput ed`
       }
     ],
-    hooks: []
+    hooks: [opencodeBeforeContainerCreateHook],
+    recoveryChecks: opencodeRecoveryChecks
   }
 });
 

package/lib/agent-clients/adapters/runtimes/claude-code.dockerfile

@@ -0,0 +1,65 @@
+RUN cat > /usr/local/bin/cc-token-status <<'SCRIPT' && chmod +x /usr/local/bin/cc-token-status
+#!/bin/sh
+set -eu
+
+SETTINGS_FILE="/home/devuser/.claude/settings.json"
+if [ -r "$SETTINGS_FILE" ] && jq -e '
+  def has_nonempty($v):
+    if ($v | type) == "string" then ($v | gsub("^\\s+|\\s+$"; "") | length) > 0 else false end;
+  (if type == "object" then . else {} end) as $settings
+  | (if ($settings.env | type) == "object" then $settings.env else {} end) as $env
+  | has_nonempty($env.ANTHROPIC_AUTH_TOKEN)
+    or has_nonempty($env.ANTHROPIC_API_KEY)
+    or has_nonempty($settings.apiKeyHelper)
+' "$SETTINGS_FILE" >/dev/null 2>&1; then
+  exit 0
+fi
+
+CRED_FILE="/home/devuser/.claude/.credentials.json"
+[ -r "$CRED_FILE" ] || exit 0
+
+EXPIRES_MS=$(jq -r '(.claudeAiOauth.expiresAt // .expiresAt) // empty' "$CRED_FILE" 2>/dev/null || true)
+case "$EXPIRES_MS" in
+  ''|*[!0-9]*) exit 0 ;;
+esac
+
+NOW_MS=$(($(date +%s) * 1000))
+DIFF_MS=$((EXPIRES_MS - NOW_MS))
+DIFF_S=$((DIFF_MS / 1000))
+
+DIM='#[fg=colour245]'
+YELLOW='#[fg=yellow]'
+YELLOW_BOLD='#[fg=yellow,bold]'
+RED_BOLD='#[fg=red,bold]'
+RED_REV='#[fg=red,reverse]'
+RESET='#[default]'
+
+if [ "$DIFF_S" -le 0 ]; then
+  ELAPSED=$(( -DIFF_S ))
+  M=$((ELAPSED / 60))
+  printf '%sClaude Code auth EXPIRED %dm ago%s' "$RED_REV" "$M" "$RESET"
+elif [ "$DIFF_S" -lt 60 ]; then
+  printf '%sClaude Code auth expires in %ds%s' "$RED_BOLD" "$DIFF_S" "$RESET"
+elif [ "$DIFF_S" -lt 300 ]; then
+  M=$((DIFF_S / 60))
+  S=$((DIFF_S % 60))
+  printf '%sClaude Code auth expires in %dm %ds%s' "$RED_BOLD" "$M" "$S" "$RESET"
+elif [ "$DIFF_S" -lt 1800 ]; then
+  M=$((DIFF_S / 60))
+  printf '%sClaude Code auth expires in %dm%s' "$YELLOW_BOLD" "$M" "$RESET"
+elif [ "$DIFF_S" -lt 3600 ]; then
+  M=$((DIFF_S / 60))
+  printf '%sClaude Code auth expires in %dm%s' "$YELLOW" "$M" "$RESET"
+else
+  TOTAL_M=$((DIFF_S / 60))
+  H=$((TOTAL_M / 60))
+  M=$((TOTAL_M % 60))
+  printf '%sClaude Code auth expires in %dh %dm%s' "$DIM" "$H" "$M" "$RESET"
+fi
+SCRIPT
+
+RUN test -s /usr/local/bin/cc-token-status && test -x /usr/local/bin/cc-token-status
+
+RUN printf '%s\n' \
+      "set -g status-right '#(/usr/local/bin/cc-token-status) | %H:%M'" \
+    >> /etc/tmux.conf