@fitlab-ai/agent-infra 0.9.3 → 0.9.5

package/dist/lib/agent-clients/adapters/codex-lifecycle/evidence.js

@@ -0,0 +1,163 @@
+function createCodexLifecycleState(cliVersion) {
+    if (!cliVersion.trim())
+        throw new Error('Codex CLI version is required');
+    return Object.freeze({
+        schemaVersion: 1,
+        cliVersion,
+        status: 'empty',
+        spawn: null,
+        child: null,
+        thread: null,
+        settings: null,
+        reroute: null,
+        terminal: null,
+        stop: null,
+        startEvidence: null,
+        stopEvidence: null,
+        error: null
+    });
+}
+function invalid(state, code, message) {
+    return Object.freeze({
+        ...state,
+        status: 'invalid',
+        startEvidence: null,
+        stopEvidence: null,
+        error: Object.freeze({ code, message })
+    });
+}
+function same(left, right) {
+    return JSON.stringify(left) === JSON.stringify(right);
+}
+function requiredStrings(event) {
+    return Object.entries(event).every(([key, value]) => key === 'forkedFromId'
+        || (typeof value !== 'string' || value.trim() !== ''));
+}
+function derive(state) {
+    const { spawn, child, thread, settings, reroute, terminal, stop } = state;
+    if (spawn && child && (spawn.sessionId !== child.sessionId
+        || spawn.nativeAgent !== child.nativeAgent)) {
+        return invalid(state, 'CODEX_EVIDENCE_IDENTITY_MISMATCH', 'hook spawn and child identity do not match');
+    }
+    if (child && thread && child.childThreadId !== thread.childThreadId) {
+        return invalid(state, 'CODEX_EVIDENCE_IDENTITY_MISMATCH', 'hook and App Server child identity do not match');
+    }
+    if (spawn && thread && (thread.parentThreadId !== spawn.sessionId
+        || thread.sourceParentThreadId !== spawn.sessionId)) {
+        return invalid(state, 'CODEX_EVIDENCE_PARENT_MISMATCH', 'App Server parent identity does not match the spawning session');
+    }
+    if (thread?.forkedFromId !== null && thread?.forkedFromId !== undefined) {
+        return invalid(state, 'CODEX_EVIDENCE_FORK_FORBIDDEN', 'forked child threads are not fresh lifecycle evidence');
+    }
+    if (settings && child && settings.childThreadId !== child.childThreadId) {
+        return invalid(state, 'CODEX_EVIDENCE_IDENTITY_MISMATCH', 'resolved settings belong to a different child');
+    }
+    if (reroute && child && reroute.childThreadId !== child.childThreadId) {
+        return invalid(state, 'CODEX_EVIDENCE_IDENTITY_MISMATCH', 'model reroute belongs to a different child');
+    }
+    if (spawn?.requestedModel && settings && spawn.requestedModel !== settings.model) {
+        if (!reroute
+            || reroute.fromModel !== spawn.requestedModel
+            || reroute.toModel !== settings.model
+            || !reroute.reason.trim()) {
+            return invalid(state, 'CODEX_EVIDENCE_MODEL_UNEXPLAINED', 'resolved model differs without a matching host reroute');
+        }
+    }
+    if (spawn?.requestedReasoningEffort
+        && settings
+        && spawn.requestedReasoningEffort !== settings.reasoningEffort) {
+        return invalid(state, 'CODEX_EVIDENCE_EFFORT_UNEXPLAINED', 'resolved reasoning effort differs without structured host evidence');
+    }
+    if (terminal && terminal.status !== 'completed') {
+        return invalid(state, 'CODEX_EVIDENCE_TERMINAL_INVALID', `child turn ended as '${terminal.status}'`);
+    }
+    if (terminal && child && terminal.childThreadId !== child.childThreadId) {
+        return invalid(state, 'CODEX_EVIDENCE_IDENTITY_MISMATCH', 'terminal event belongs to a different child');
+    }
+    if (stop && child && (stop.sessionId !== child.sessionId
+        || stop.turnId !== child.turnId
+        || stop.childThreadId !== child.childThreadId
+        || stop.nativeAgent !== child.nativeAgent)) {
+        return invalid(state, 'CODEX_EVIDENCE_IDENTITY_MISMATCH', 'hook stop identity does not match the child');
+    }
+    let startEvidence = null;
+    if (spawn && child && thread && settings) {
+        startEvidence = Object.freeze({
+            schemaVersion: 1,
+            cliVersion: state.cliVersion,
+            parentThreadId: spawn.sessionId,
+            parentTurnId: spawn.turnId,
+            spawnToolUseId: spawn.toolUseId,
+            childThreadId: child.childThreadId,
+            nativeAgent: child.nativeAgent,
+            spawnMode: 'fresh',
+            actualModel: Object.freeze({ value: settings.model, source: 'codex-app-server-settings' }),
+            actualReasoningEffort: Object.freeze({ value: settings.reasoningEffort, source: 'codex-app-server-settings' }),
+            modelFallbackReason: reroute?.reason ?? null,
+            reasoningEffortFallbackReason: null,
+            hookDefinitionHash: spawn.hookDefinitionHash
+        });
+    }
+    let stopEvidence = null;
+    if (startEvidence && terminal?.status === 'completed' && stop) {
+        stopEvidence = Object.freeze({
+            schemaVersion: 1,
+            childThreadId: startEvidence.childThreadId,
+            turnId: terminal.turnId,
+            terminalStatus: 'completed',
+            hookStopObserved: true
+        });
+    }
+    const status = stopEvidence
+        ? 'stop-ready'
+        : terminal
+            ? 'observed-terminal'
+            : startEvidence
+                ? 'start-ready'
+                : child
+                    ? 'observed-child'
+                    : spawn
+                        ? 'observed-spawn'
+                        : 'empty';
+    return Object.freeze({ ...state, status, startEvidence, stopEvidence, error: null });
+}
+function reduceCodexLifecycleEvent(state, event) {
+    if (state.status === 'invalid' || state.status === 'expired')
+        return state;
+    if (!requiredStrings(event)) {
+        return invalid(state, 'CODEX_EVIDENCE_FIELD_MISSING', 'lifecycle event contains an empty required field');
+    }
+    const key = {
+        'hook-spawn': 'spawn',
+        'hook-child': 'child',
+        'app-thread': 'thread',
+        'app-settings': 'settings',
+        'app-reroute': 'reroute',
+        'app-terminal': 'terminal',
+        'hook-stop': 'stop'
+    }[event.type];
+    const existing = state[key];
+    if (existing) {
+        if (same(existing, event))
+            return state;
+        return invalid(state, 'CODEX_EVIDENCE_REPLAY_CONFLICT', `conflicting '${event.type}' event`);
+    }
+    return derive(Object.freeze({ ...state, [key]: Object.freeze({ ...event }) }));
+}
+function expireCodexLifecycleState(state) {
+    if (!['observed-spawn', 'observed-child', 'start-ready', 'observed-terminal'].includes(state.status)) {
+        return state;
+    }
+    return Object.freeze({
+        ...state,
+        status: 'expired',
+        startEvidence: null,
+        stopEvidence: null,
+        error: Object.freeze({
+            code: 'CODEX_EVIDENCE_EXPIRED',
+            message: 'Codex lifecycle evidence expired before completion'
+        })
+    });
+}
+export { createCodexLifecycleState, expireCodexLifecycleState, reduceCodexLifecycleEvent };
+//# sourceMappingURL=evidence.js.map

package/dist/lib/agent-clients/adapters/codex-lifecycle/store.js

@@ -0,0 +1,211 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createCodexLifecycleState, expireCodexLifecycleState, reduceCodexLifecycleEvent } from './evidence.js';
+const LOCK_RETRY_MS = 10;
+const LOCK_TIMEOUT_MS = 1_000;
+const LOCK_STALE_MS = 30_000;
+function digest(value) {
+    return crypto.createHash('sha256').update(value).digest('hex');
+}
+function readRecord(file) {
+    const value = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (value.schemaVersion !== 1
+        || !Number.isSafeInteger(value.revision)
+        || value.revision < 1
+        || !value.state
+        || value.state.schemaVersion !== 1) {
+        throw new Error(`Codex lifecycle record '${path.basename(file)}' is invalid`);
+    }
+    return value;
+}
+function recordFiles(root) {
+    if (!fs.existsSync(root))
+        return [];
+    return fs.readdirSync(root)
+        .filter((name) => /^[a-f0-9]{64}\.json$/.test(name))
+        .map((name) => path.join(root, name));
+}
+function writeRecord(file, record, expectedRevision) {
+    const temp = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
+    fs.writeFileSync(temp, `${JSON.stringify(record, null, 2)}\n`, {
+        encoding: 'utf8',
+        flag: 'wx',
+        mode: 0o600
+    });
+    try {
+        const actualRevision = fs.existsSync(file) ? readRecord(file).revision : 0;
+        if (actualRevision !== expectedRevision) {
+            throw new Error(`Codex lifecycle revision changed from ${expectedRevision} to ${actualRevision}`);
+        }
+        fs.renameSync(temp, file);
+        fs.chmodSync(file, 0o600);
+    }
+    finally {
+        if (fs.existsSync(temp))
+            fs.unlinkSync(temp);
+    }
+}
+function createCodexLifecycleStore(options) {
+    const root = options.root ?? path.join(process.cwd(), '.agents', 'workspace', '.runtime', 'codex-lifecycle');
+    const now = options.now ?? (() => new Date().toISOString());
+    fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+    fs.chmodSync(root, 0o700);
+    function withWriteLock(operation) {
+        const lock = path.join(root, '.write.lock');
+        const deadline = Date.now() + LOCK_TIMEOUT_MS;
+        let descriptor = null;
+        while (descriptor === null) {
+            try {
+                descriptor = fs.openSync(lock, 'wx', 0o600);
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+                try {
+                    if (Date.now() - fs.statSync(lock).mtimeMs > LOCK_STALE_MS) {
+                        fs.unlinkSync(lock);
+                        continue;
+                    }
+                }
+                catch (lockError) {
+                    if (lockError.code === 'ENOENT')
+                        continue;
+                    throw lockError;
+                }
+                if (Date.now() >= deadline)
+                    throw new Error('Codex lifecycle store is busy');
+                Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, LOCK_RETRY_MS);
+            }
+        }
+        try {
+            return operation();
+        }
+        finally {
+            fs.closeSync(descriptor);
+            fs.unlinkSync(lock);
+        }
+    }
+    function findByChild(childThreadId) {
+        return recordFiles(root).filter((file) => {
+            const child = readRecord(file).state.child;
+            return child?.childThreadId === childThreadId;
+        });
+    }
+    function locate(event) {
+        if (event.type === 'hook-spawn') {
+            return path.join(root, `${digest(`${event.sessionId}\0${event.turnId}\0${event.toolUseId}`)}.json`);
+        }
+        if (event.type === 'hook-child') {
+            const matches = recordFiles(root).filter((file) => {
+                const state = readRecord(file).state;
+                return state.spawn?.sessionId === event.sessionId
+                    && state.spawn.nativeAgent === event.nativeAgent
+                    && (!state.child || state.child.childThreadId === event.childThreadId);
+            });
+            if (matches.length !== 1) {
+                throw new Error(matches.length === 0
+                    ? 'Codex lifecycle parent session and agent correlation was not found'
+                    : 'Codex lifecycle parent session and agent correlation is ambiguous');
+            }
+            return matches[0];
+        }
+        const matches = findByChild(event.childThreadId);
+        if (matches.length !== 1) {
+            throw new Error(matches.length === 0
+                ? `Codex lifecycle child '${event.childThreadId}' was not found`
+                : `Codex lifecycle child '${event.childThreadId}' is ambiguous`);
+        }
+        return matches[0];
+    }
+    function apply(event) {
+        return withWriteLock(() => {
+            const file = locate(event);
+            const current = fs.existsSync(file)
+                ? readRecord(file)
+                : Object.freeze({
+                    schemaVersion: 1,
+                    revision: 0,
+                    state: createCodexLifecycleState(options.cliVersion),
+                    consumer: null,
+                    consumedAt: null,
+                    updatedAt: now()
+                });
+            if (current.consumer)
+                throw new Error(`Codex lifecycle evidence was already consumed by '${current.consumer}'`);
+            const nextState = reduceCodexLifecycleEvent(current.state, event);
+            const next = Object.freeze({
+                schemaVersion: 1,
+                revision: current.revision + 1,
+                state: nextState,
+                consumer: null,
+                consumedAt: null,
+                updatedAt: now()
+            });
+            writeRecord(file, next, current.revision);
+            return Object.freeze({ path: file, revision: next.revision, state: next.state });
+        });
+    }
+    function read(childThreadId) {
+        const matches = findByChild(childThreadId);
+        if (matches.length !== 1)
+            throw new Error(`Codex lifecycle child '${childThreadId}' was not found uniquely`);
+        return readRecord(matches[0]);
+    }
+    function consume(childThreadId, consumer, expectedHookDefinitionHash) {
+        if (!consumer.trim())
+            throw new Error('Codex lifecycle consumer is required');
+        return withWriteLock(() => {
+            const matches = findByChild(childThreadId);
+            if (matches.length !== 1)
+                throw new Error(`Codex lifecycle child '${childThreadId}' was not found uniquely`);
+            const file = matches[0];
+            const current = readRecord(file);
+            if (current.consumer)
+                throw new Error(`Codex lifecycle evidence was already consumed by '${current.consumer}'`);
+            if (current.state.status !== 'stop-ready')
+                throw new Error('Codex lifecycle evidence is not stop-ready');
+            if (expectedHookDefinitionHash
+                && current.state.startEvidence?.hookDefinitionHash !== expectedHookDefinitionHash)
+                throw new Error('Codex lifecycle hook definition hash is stale');
+            const next = Object.freeze({
+                ...current,
+                revision: current.revision + 1,
+                consumer,
+                consumedAt: now(),
+                updatedAt: now()
+            });
+            writeRecord(file, next, current.revision);
+            return next;
+        });
+    }
+    function expireBefore(cutoff) {
+        return withWriteLock(() => {
+            let changed = 0;
+            for (const file of recordFiles(root)) {
+                const current = readRecord(file);
+                if (current.updatedAt >= cutoff)
+                    continue;
+                if (current.consumer || ['invalid', 'expired', 'stop-ready'].includes(current.state.status)) {
+                    fs.unlinkSync(file);
+                    changed += 1;
+                    continue;
+                }
+                const expiredState = expireCodexLifecycleState(current.state);
+                if (expiredState === current.state)
+                    continue;
+                writeRecord(file, Object.freeze({
+                    ...current,
+                    revision: current.revision + 1,
+                    state: expiredState,
+                    updatedAt: now()
+                }), current.revision);
+                changed += 1;
+            }
+            return changed;
+        });
+    }
+    return Object.freeze({ root, apply, consume, expireBefore, read });
+}
+export { createCodexLifecycleStore };
+//# sourceMappingURL=store.js.map

package/dist/lib/agent-clients/adapters/codex.js

@@ -21,8 +21,8 @@ const codexAdapter = defineAgentClientAdapter({
         guidance: 'Use the host model picker for the complete model and reasoning-effort catalog.'
     },
     delegationEvidence: {
-        actualModel: 'unavailable',
-        actualReasoningEffort: 'unavailable'
+        actualModel: 'app-server',
+        actualReasoningEffort: 'app-server'
     },
     project: {
         ownedPathPrefixes: ['.codex/'],

package/dist/lib/agent-clients/adapters/opencode-sandbox.js

@@ -0,0 +1,108 @@
+import fs from 'node:fs';
+import path from 'node:path';
+function readJsonObject(filePath) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+        return parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function resolveXdgRoot(value, fallback) {
+    return typeof value === 'string' && value !== '' && path.isAbsolute(value)
+        ? value
+        : fallback;
+}
+function ensureOpenCodeSandboxState(toolDir, hostHome, hostEnv = {}) {
+    const canonicalConfigDir = path.join(toolDir, '.xdg', 'config', 'opencode');
+    const canonicalStateDir = path.join(toolDir, '.xdg', 'state', 'opencode');
+    const canonicalConfigPath = path.join(canonicalConfigDir, 'opencode.json');
+    const legacyConfigPath = path.join(toolDir, 'opencode.json');
+    fs.mkdirSync(canonicalConfigDir, { recursive: true });
+    fs.mkdirSync(canonicalStateDir, { recursive: true });
+    if (!fs.existsSync(canonicalConfigPath) && fs.existsSync(legacyConfigPath)) {
+        fs.copyFileSync(legacyConfigPath, canonicalConfigPath, fs.constants.COPYFILE_EXCL);
+    }
+    const hostConfigRoot = resolveXdgRoot(hostEnv.XDG_CONFIG_HOME, path.join(hostHome, '.config'));
+    const hostConfig = readJsonObject(path.join(hostConfigRoot, 'opencode', 'opencode.json'));
+    if (!hostConfig) {
+        return;
+    }
+    let sandboxConfig = {};
+    if (fs.existsSync(canonicalConfigPath)) {
+        const existing = readJsonObject(canonicalConfigPath);
+        if (!existing) {
+            return;
+        }
+        sandboxConfig = existing;
+    }
+    let changed = false;
+    for (const key of ['model', 'small_model']) {
+        if (Object.hasOwn(sandboxConfig, key)) {
+            continue;
+        }
+        const value = hostConfig[key];
+        if (typeof value === 'string' && value !== '') {
+            sandboxConfig[key] = value;
+            changed = true;
+        }
+    }
+    if (changed) {
+        fs.writeFileSync(canonicalConfigPath, JSON.stringify(sandboxConfig, null, 2), 'utf8');
+    }
+}
+const opencodeBeforeContainerCreateHook = {
+    id: 'opencode-before-container-create',
+    phase: 'before-container-create',
+    async run(context) {
+        const create = context.create;
+        const entry = create?.resolvedTools.find(({ tool }) => tool.id === 'opencode');
+        if (!create || !entry) {
+            return {
+                status: 'fatal',
+                message: 'OpenCode sandbox hook requires its resolved tool state.'
+            };
+        }
+        ensureOpenCodeSandboxState(entry.dir, create.hostHome, create.hostEnv);
+        return { status: 'ready' };
+    }
+};
+const opencodeRecoveryChecks = [
+    {
+        id: 'command-available',
+        probe: { script: 'command -v "$1"', args: ['opencode'] },
+        finding: {
+            repairKind: 'hard-failure',
+            message: 'OpenCode is not available on PATH inside the sandbox.'
+        }
+    },
+    {
+        id: 'config-writable',
+        probe: {
+            script: 'probe="$1/.agent-infra-opencode-config-$$"; trap \'rm -f -- "$probe"\' EXIT; : > "$probe"',
+            args: ['/home/devuser/.local/share/opencode/.xdg/config/opencode']
+        },
+        finding: {
+            repairKind: 'permissions',
+            message: 'OpenCode config directory is not writable by devuser.',
+            path: '/home/devuser/.local/share/opencode/.xdg/config/opencode'
+        }
+    },
+    {
+        id: 'state-writable',
+        probe: {
+            script: 'probe="$1/.agent-infra-opencode-state-$$"; trap \'rm -f -- "$probe"\' EXIT; : > "$probe"',
+            args: ['/home/devuser/.local/share/opencode/.xdg/state/opencode']
+        },
+        finding: {
+            repairKind: 'permissions',
+            message: 'OpenCode state directory is not writable by devuser.',
+            path: '/home/devuser/.local/share/opencode/.xdg/state/opencode'
+        }
+    }
+];
+export { ensureOpenCodeSandboxState, opencodeBeforeContainerCreateHook, opencodeRecoveryChecks };
+//# sourceMappingURL=opencode-sandbox.js.map

package/dist/lib/agent-clients/adapters/opencode.js

@@ -1,5 +1,6 @@
 import { defineAgentClientAdapter } from '../adapter.js';
 import { hostJoin } from '../../sandbox/engines/wsl2-paths.js';
+import { opencodeBeforeContainerCreateHook, opencodeRecoveryChecks } from './opencode-sandbox.js';
 const YOLO_PERMISSION = '{"*":"allow","read":"allow","bash":"allow","edit":"allow","webfetch":"allow","external_directory":"allow","doom_loop":"allow"}';
 const opencodeAdapter = defineAgentClientAdapter({
     id: 'opencode',
@@ -35,9 +36,17 @@ const opencodeAdapter = defineAgentClientAdapter({
                     'zh-CN': '.opencode/commands/update-agent-infra.zh-CN.md'
                 },
                 target: '.opencode/commands/update-agent-infra.md'
-            }]
+            }],
+        customCommand: {
+            target: '.opencode/commands/${skillName}.md',
+            frontmatter: { agent: 'general', subtask: false },
+            argumentsToken: '$ARGUMENTS'
+        }
     },
     sandbox: {
+        image: {
+            dotfilesExclusions: ['.config/opencode']
+        },
         createTool: ({ home }) => ({
             id: 'opencode',
             name: 'OpenCode',
@@ -47,7 +56,9 @@ const opencodeAdapter = defineAgentClientAdapter({
             versionCmd: 'opencode --version',
             setupHint: 'Configure OpenCode credentials inside the container before first use.',
             envVars: {
-                OPENCODE_CONFIG: '/home/devuser/.local/share/opencode/opencode.json'
+                XDG_DATA_HOME: '/home/devuser/.local/share',
+                XDG_CONFIG_HOME: '/home/devuser/.local/share/opencode/.xdg/config',
+                XDG_STATE_HOME: '/home/devuser/.local/share/opencode/.xdg/state'
             },
             hostLiveMounts: [
                 {
@@ -66,7 +77,8 @@ const opencodeAdapter = defineAgentClientAdapter({
                 command: `OPENCODE_PERMISSION='${YOLO_PERMISSION}' opencode; tput ed`
             }
         ],
-        hooks: []
+        hooks: [opencodeBeforeContainerCreateHook],
+        recoveryChecks: opencodeRecoveryChecks
     }
 });
 export { opencodeAdapter };

package/dist/lib/agent-clients/adapters/runtimes/claude-code.dockerfile

@@ -0,0 +1,65 @@
+RUN cat > /usr/local/bin/cc-token-status <<'SCRIPT' && chmod +x /usr/local/bin/cc-token-status
+#!/bin/sh
+set -eu
+
+SETTINGS_FILE="/home/devuser/.claude/settings.json"
+if [ -r "$SETTINGS_FILE" ] && jq -e '
+  def has_nonempty($v):
+    if ($v | type) == "string" then ($v | gsub("^\\s+|\\s+$"; "") | length) > 0 else false end;
+  (if type == "object" then . else {} end) as $settings
+  | (if ($settings.env | type) == "object" then $settings.env else {} end) as $env
+  | has_nonempty($env.ANTHROPIC_AUTH_TOKEN)
+    or has_nonempty($env.ANTHROPIC_API_KEY)
+    or has_nonempty($settings.apiKeyHelper)
+' "$SETTINGS_FILE" >/dev/null 2>&1; then
+  exit 0
+fi
+
+CRED_FILE="/home/devuser/.claude/.credentials.json"
+[ -r "$CRED_FILE" ] || exit 0
+
+EXPIRES_MS=$(jq -r '(.claudeAiOauth.expiresAt // .expiresAt) // empty' "$CRED_FILE" 2>/dev/null || true)
+case "$EXPIRES_MS" in
+  ''|*[!0-9]*) exit 0 ;;
+esac
+
+NOW_MS=$(($(date +%s) * 1000))
+DIFF_MS=$((EXPIRES_MS - NOW_MS))
+DIFF_S=$((DIFF_MS / 1000))
+
+DIM='#[fg=colour245]'
+YELLOW='#[fg=yellow]'
+YELLOW_BOLD='#[fg=yellow,bold]'
+RED_BOLD='#[fg=red,bold]'
+RED_REV='#[fg=red,reverse]'
+RESET='#[default]'
+
+if [ "$DIFF_S" -le 0 ]; then
+  ELAPSED=$(( -DIFF_S ))
+  M=$((ELAPSED / 60))
+  printf '%sClaude Code auth EXPIRED %dm ago%s' "$RED_REV" "$M" "$RESET"
+elif [ "$DIFF_S" -lt 60 ]; then
+  printf '%sClaude Code auth expires in %ds%s' "$RED_BOLD" "$DIFF_S" "$RESET"
+elif [ "$DIFF_S" -lt 300 ]; then
+  M=$((DIFF_S / 60))
+  S=$((DIFF_S % 60))
+  printf '%sClaude Code auth expires in %dm %ds%s' "$RED_BOLD" "$M" "$S" "$RESET"
+elif [ "$DIFF_S" -lt 1800 ]; then
+  M=$((DIFF_S / 60))
+  printf '%sClaude Code auth expires in %dm%s' "$YELLOW_BOLD" "$M" "$RESET"
+elif [ "$DIFF_S" -lt 3600 ]; then
+  M=$((DIFF_S / 60))
+  printf '%sClaude Code auth expires in %dm%s' "$YELLOW" "$M" "$RESET"
+else
+  TOTAL_M=$((DIFF_S / 60))
+  H=$((TOTAL_M / 60))
+  M=$((TOTAL_M % 60))
+  printf '%sClaude Code auth expires in %dh %dm%s' "$DIM" "$H" "$M" "$RESET"
+fi
+SCRIPT
+
+RUN test -s /usr/local/bin/cc-token-status && test -x /usr/local/bin/cc-token-status
+
+RUN printf '%s\n' \
+      "set -g status-right '#(/usr/local/bin/cc-token-status) | %H:%M'" \
+    >> /etc/tmux.conf

package/dist/lib/agent-clients/registry.js

@@ -71,7 +71,15 @@ function createAgentClientManifest() {
         ownedPathPrefixes: Object.freeze([...adapter.project.ownedPathPrefixes]),
         managed: Object.freeze([...adapter.project.managed]),
         merged: Object.freeze([...adapter.project.merged]),
-        ejected: Object.freeze([...adapter.project.ejected])
+        ejected: Object.freeze([...adapter.project.ejected]),
+        ...(adapter.project.customCommand === undefined
+            ? {}
+            : {
+                customCommand: Object.freeze({
+                    ...adapter.project.customCommand,
+                    frontmatter: Object.freeze({ ...adapter.project.customCommand.frontmatter })
+                })
+            })
     })));
 }
 export { AGENT_CLIENT_REGISTRY, createAgentClientManifest, getAgentClientAdapter, getAgentClientCapability, getAgentClientDelegationEvidence, getAgentClientModelSelection, listAgentClientAdapters, listEnabledAgentClientAdapters, listEnabledAgentClientAdaptersByCapability, listInstalledAgentClientAdapters };