@gotcos/glasses-server 6.79.1 → 6.80.0

package/server/lib/claude-bridge.ts

@@ -64,6 +64,14 @@ import { claudeSupportsSessionName } from './claude-cli-support.js'
 import { applyTurnRequestEnv, createTurnRequestBinding, spawnWithTurnRequest } from './turn-request.js'
 import { STEER_REAPER_MS, STEER_SETTLE_MS, SteerTracker, composeFirstContent, encodeUserLine, steerClock, type SteerPort } from './claude-steer.js'
 import { randomUUID } from 'node:crypto'
+// Key lanes K1 P3 (plan v4 7): Lane B Claude. Every use below sits behind `options.keyProfile`;
+// without one, argv, env, session keys and the pre-warm handoff are the b7c620e ones.
+import { profilePreference } from '../../shared/key-preference.js'
+import type { AnswerKeyFields, KeyKind, KeyProfile, RelayTurnHandle } from './key-relay-contract.js'
+import { applyLaneBClaudeEnv, LANE_B_COPY, laneBClaudePreflight, laneBRelay } from './lane-b-env.js'
+import { recordKeyedSession } from './keyed-sessions.js'
+import { getSharedKeyMeter } from './key-relay-meter.js'
+import { claudeKeySecretsGuardArgs } from './key-secrets-guard.js'
 
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
 
@@ -117,9 +125,19 @@ function cliSessionKey(cosSessionId: string, model: ClaudeModelPreference): stri
   return `${cosSessionId}:${model}`
 }
 
+/** Key lanes (plan v4 7.1): a keyed turn's CLI session is its own key, never `${sid}:${tier}`. */
+export function keyedCliSessionKey(cosSessionId: string, tier: ClaudeModelPreference, profileId: string): string {
+  return `${cosSessionId}:${tier}:p:${profileId}`
+}
+
 function getAnyCliSessionId(cosSessionId: string): string | undefined {
   for (const [key, cliId] of cliSessionMap) {
-    if (key === cosSessionId || key.startsWith(`${cosSessionId}:`)) return cliId
+    if (key === cosSessionId || key.startsWith(`${cosSessionId}:`)) {
+      // Key lanes: a keyed CLI session is never handed out here (handoff, health, Continue). Only
+      // the keyed turn itself reaches it, through its own exact key.
+      if (key.includes(':p:', cosSessionId.length)) continue
+      return cliId
+    }
   }
   return undefined
 }
@@ -235,6 +253,7 @@ export async function preWarmCLI(): Promise<void> {
       '--output-format', 'stream-json',
       '--verbose',
       ...claudePermissionArgs(getClaudeTrustMode(), null),
+      ...claudeKeySecretsGuardArgs(),
       '--system-prompt', buildPrewarmSystemPrompt(),
     ], {
       stdio: ['pipe', 'pipe', 'pipe'],
@@ -324,6 +343,12 @@ export interface ModelRunMetadata {
   ollamaRunId?: string
   outputAttachments?: MediaAttachmentRef[]
   outputImageStats?: RunOutputImageCollectionStats
+  /** Key lanes (plan v4 3.1): present only on a keyed turn. The `model` beside it is then the timeout tier. */
+  keyLane?: AnswerKeyFields
+  /** Key lanes (P11): what this keyed answer cost on the key, settled by the relay. Keyed turns only. */
+  usd?: number
+  /** Key lanes (P5): the direct lane's run ledger id. Direct turns only. */
+  directRunId?: string
 }
 
 /** Public-safe provider launch metadata for durable job coordination. It
@@ -417,6 +442,17 @@ export interface CallOptions {
    * 6.77.0 one. A dispatch never steers.
    */
   steer?: SteerPort
+  /**
+   * Key lanes K1 (plan v4 7): run this turn on a saved key profile (Lane B Claude) through the
+   * loopback relay. The profile's timeoutTier sets the timeouts and its model goes on `--model`;
+   * the `model` argument is ignored. Absent, every argument, env name, session key and stdin
+   * byte is the b7c620e one. Refused (onError, nothing spawned) when lanes are not active, the
+   * profile is off or not a Claude profile, its key is gone, a Claude settings file would bypass
+   * the relay, no relay is registered, or this is a dispatch.
+   */
+  keyProfile?: KeyProfile
+  /** Key lanes (QA U9): run this one profile turn without binding the session to the profile. */
+  keyTurnOnly?: boolean
 }
 
 export async function callClaudeStreaming(
@@ -431,6 +467,25 @@ export async function callClaudeStreaming(
 ): Promise<string> {
   // Get or create session
   const sid = getOrCreateSession(sessionId)
+  // Key lanes: every check a keyed turn needs runs here, before history, the run ledger or a
+  // process. A refusal ends the turn with its lens line; the subscription is never the fallback.
+  const keyProfile = options?.keyProfile
+  let keyKind: KeyKind | null = null
+  if (keyProfile) {
+    const preflight = laneBClaudePreflight({
+      profile: keyProfile,
+      dispatch: !!options?.dispatch,
+      cwd: resolveProviderWorkDir({ scriptsDir: COS_SCRIPTS_DIR }),
+    })
+    if (!preflight.ok) {
+      await callbacks.onError(preflight.message)
+      return sid
+    }
+    keyKind = preflight.keyKind
+  }
+  const keyLane: AnswerKeyFields | null = keyProfile && keyKind
+    ? { lane: 'key', credential: { kind: keyKind, ref: keyProfile.keyRef, profileId: keyProfile.id } }
+    : null
   const history = getHistory(sid)
   const session = getSessionRaw(sid)
   const contextBreaks = session?.contextBreaks ?? []
@@ -439,14 +494,16 @@ export async function callClaudeStreaming(
 
   // Resolve model: per-message > session preference > public-server default.
   const sessionModel = getSessionModel(sid)
-  const resolvedModel: ClaudeModelPreference = model
-    ?? (sessionModel && isClaudeModel(sessionModel) ? sessionModel : DEFAULT_MODEL)
+  const resolvedModel: ClaudeModelPreference = keyProfile ? keyProfile.timeoutTier : (model
+    ?? (sessionModel && isClaudeModel(sessionModel) ? sessionModel : DEFAULT_MODEL))
   const resolvedEffort = options?.effort
   const cliEffortFlag = resolvedEffort ? resolveCliEffortFlag(resolvedEffort) : getClaudeEffortLevel()
 
   // Notify client immediately — model is known before any async work
   // Pass existing CLI session ID if resuming (new sessions get it after first result)
-  const resolvedCliKey = cliSessionKey(sid, resolvedModel)
+  const resolvedCliKey = keyProfile ? keyedCliSessionKey(sid, resolvedModel, keyProfile.id) : cliSessionKey(sid, resolvedModel)
+  // A keyed exchange is stamped with its profile (P6 persists it by syntax), never with the tier.
+  const exchangeModel = keyProfile ? profilePreference(keyProfile.id) as unknown as ModelPreference : resolvedModel
   let existingCliSession = options?.dispatch ? undefined : cliSessionMap.get(resolvedCliKey)
   // 6.58.2: decided before the pre-warmed session below stands in: a COS session that has no
   // Claude session of its own yet starts one here, and only that one may be named.
@@ -454,6 +511,7 @@ export async function callClaudeStreaming(
   callbacks.onStart?.(resolvedModel, sid, existingCliSession, {
     clientJobId: options?.clientJobId,
     generation: options?.generation,
+    ...(keyLane ? { keyLane } : {}),
   })
 
   // Phase: context loading (skipped in lightweight mode)
@@ -531,7 +589,7 @@ export async function callClaudeStreaming(
     globalMsgNum,
     inboundAttachments,
     exchangeProvenance,
-    resolvedModel,
+    exchangeModel,
   )
 
   // Vision queries need the Read tool to see the image files
@@ -559,7 +617,8 @@ export async function callClaudeStreaming(
   // 6.58.2: nor does a named New session (COS Control Work). The warmed session opens with the
   // boot prompt "ready" under the glasses prompt; a session someone will open in the Claude app
   // under its task's name starts clean.
-  if (!options?.dispatch && !options?.sessionName && !existingCliSession && preWarmedCliSessionId && resolvedModel === DEFAULT_MODEL) {
+  // Key lanes: a keyed turn never takes the warmed subscription session.
+  if (!options?.dispatch && !options?.sessionName && !existingCliSession && preWarmedCliSessionId && resolvedModel === DEFAULT_MODEL && !keyProfile) {
     // Only the default model consumes the pre-warmed session.
     // Hey Even (Haiku) cold-starts its own session to avoid model contamination.
     existingCliSession = preWarmedCliSessionId
@@ -582,6 +641,8 @@ export async function callClaudeStreaming(
     '--system-prompt', systemPrompt,
     ...(options?.dispatch ? [] : mcpConfigArgs),
   ]
+  // Key lanes (plan 7.1): a keyed turn names the profile slug on --model (never ANTHROPIC_MODEL, no [1m]).
+  if (keyProfile) args[2] = keyProfile.model
 
   // Full and lightweight paths share the same explicit MCP selector contract.
   if (options?.dispatch) {
@@ -599,6 +660,9 @@ export async function callClaudeStreaming(
   } else {
     args.push(...claudePermissionArgs(getClaudeTrustMode(), tools), '--include-partial-messages')
   }
+  // QA B1: deny the key secrets dir while lanes are on and a key is saved ([] otherwise). A keyed
+  // turn's layer also forces agent teams off over any settings file (canary R12).
+  args.push(...claudeKeySecretsGuardArgs(keyProfile ? { laneB: true } : {}))
 
   if (existingCliSession) {
     // Resume prior CLI session — reuses cached context, avoids cold start
@@ -625,6 +689,33 @@ export async function callClaudeStreaming(
     ? Math.max(defaultWallMax, WALL_MAX_DEEP_EFFORT_MS)
     : defaultWallMax
   const wallMax = isExtendedQuery(query) ? Math.max(WALL_MAX_EXTENDED_MS, effortWallMax) : effortWallMax
+  // Key lanes: one nonce per turn from the relay (P2 contract), then the child env points at it.
+  // Only the child's copy is written. A relay that cannot issue ends the turn before spawn.
+  let keyTurn: RelayTurnHandle | null = null
+  const keyTurnId = keyProfile ? options?.turnId ?? randomUUID() : null
+  if (keyProfile) {
+    try {
+      const relay = await laneBRelay()
+      keyTurn = await relay.issueTurn({
+        keyRef: keyProfile.keyRef,
+        profileId: keyProfile.id,
+        turnId: keyTurnId!,
+        sessionId: sid,
+        engine: 'claude',
+        allowedModel: keyProfile.model,
+      }, { wallMaxMs: wallMax })
+      applyLaneBClaudeEnv(env, { origin: keyTurn.origin, nonce: keyTurn.nonce, slug: keyProfile.model, profileId: keyProfile.id })
+    } catch (err) {
+      keyTurn?.revoke('cancel')
+      outputImagePublisher?.cleanup()
+      cleanupModelImageInputs(imageInputs)
+      removeExchange(sid, pendingUserExchange)
+      console.error(`[claude-bridge] key relay refused the turn: ${err instanceof Error ? err.message.slice(0, 200) : 'unknown'}`)
+      await callbacks.onError(LANE_B_COPY.relayUnavailable)
+      return sid
+    }
+  }
+  const keyAuditFields = keyProfile && keyKind ? { profile: keyProfile.id, lane: 'key' as const, credentialKind: keyKind } : {}
   const startTime = Date.now()
   // 6.78.0 steer (P7 S7): the wall clock's start on the monotonic steer clock, next to the
   // wall timer it describes, so the coordinator's cut-off reads the same clock after a sleep.
@@ -639,7 +730,7 @@ export async function callClaudeStreaming(
     wallMaxMs: wallMax,
     query: fullQuery,
     effortLevel: resolvedEffort ?? getClaudeEffortLevel(),
-    cliModelId: resolveClaudeCliModelId(resolvedModel),
+    cliModelId: keyProfile ? keyProfile.model : resolveClaudeCliModelId(resolvedModel),
   })
 
   // Ultracode is a CLI-only orchestration keyword; history/chat keeps the
@@ -699,6 +790,7 @@ export async function callClaudeStreaming(
    * CLI session mapping is dropped so the next Ask starts a fresh session.
    */
   function abandonUncoveredSteers() {
+    keyTurn?.revoke('steer_abort')
     steerStdinEnded = true
     steerPort!.close()
     if (cliSessionMap.delete(resolvedCliKey)) scheduleCliSessionSave()
@@ -791,7 +883,7 @@ export async function callClaudeStreaming(
       globalMsgNum,
       undefined,
       exchangeProvenance,
-      resolvedModel,
+      exchangeModel,
     )
     if (imagePaths.length > 0) {
       replaceLastExchangeWithSummary(sid, query, text, imagePaths.length)
@@ -827,6 +919,8 @@ export async function callClaudeStreaming(
     // Token audit — log every completed claude -p call
     const totalMs = Date.now() - startTime
     const inputEstimate = systemPrompt.length + fullQuery.length + contextPrompt.length
+    // Key lanes (P11): this turn's settled spend on the key. Keyed turns only.
+    const keyUsdFields = keyTurnId ? { usd: Math.round(getSharedKeyMeter().turnSettledUsd(keyTurnId) * 1e6) / 1e6 } : {}
     logTokenAudit({
       source: options?.lightweight ? 'g2-voice' : 'g2-query',
       model: resolvedModel,
@@ -834,6 +928,8 @@ export async function callClaudeStreaming(
       outputChars: text.length,
       durationMs: totalMs,
       caller: options?.lightweight ? 'voice_query' : 'full_query',
+      ...keyAuditFields,
+      ...keyUsdFields,
     })
 
     finishClaudeRun(run.runId, {
@@ -849,6 +945,7 @@ export async function callClaudeStreaming(
       generation: options?.generation,
       ...(outputAttachments.length > 0 ? { outputAttachments } : {}),
       ...(outputImageStats && outputImageStats.published > 0 ? { outputImageStats } : {}),
+      ...(keyLane ? { keyLane, ...keyUsdFields } : {}),
     })
     if (terminalOwned === false) return
 
@@ -901,6 +998,7 @@ export async function callClaudeStreaming(
   }
 
   function handleAbort() {
+    keyTurn?.revoke('cancel')
     void terminateForTerminal('client disconnect', result => finalizeError(
         'claude-bridge: client disconnected before Claude completed.',
         result.code,
@@ -1022,6 +1120,9 @@ export async function callClaudeStreaming(
         // recorded as before, so the finished job names the session the result names.
         if (!nativeSessionAnnounced && !options?.dispatch && typeof event.session_id === 'string' && event.session_id) {
           nativeSessionAnnounced = true
+          // Key lanes (plan 7.3): recorded before any answer text, so Continue, Fork, attach and
+          // handoff refuse this transcript from the moment it exists.
+          if (keyProfile) recordKeyedSession({ id: event.session_id, engine: 'claude', profileId: keyProfile.id, cosSessionId: sid })
           updateClaudeRun(run.runId, { cliSessionId: event.session_id })
           callbacks.onNativeSession?.({ cliSessionId: event.session_id })
         }
@@ -1112,6 +1213,7 @@ export async function callClaudeStreaming(
           }
           // Capture CLI session ID for future --resume (avoids cold start on next query)
           if (event.session_id && !options?.dispatch) {
+            if (keyProfile) recordKeyedSession({ id: event.session_id, engine: 'claude', profileId: keyProfile.id, cosSessionId: sid })
             cliSessionMap.set(resolvedCliKey, event.session_id)
             scheduleCliSessionSave()
             updateClaudeRun(run.runId, { cliSessionId: event.session_id })
@@ -1160,6 +1262,7 @@ export async function callClaudeStreaming(
 
   proc.on('close', (code) => {
     childClosed = true
+    keyTurn?.childClosed()
     if (steerReaper) clearTimeout(steerReaper)
     steerPort?.close()
     if (terminationRequested) return
@@ -1196,6 +1299,7 @@ export async function callClaudeStreaming(
   })
 
   proc.on('error', (err) => {
+    keyTurn?.revoke('child_close')
     if (terminationRequested) return
     finalizeError(`claude-bridge: ${err.message}`, null)
   })

package/server/lib/claude-settings-guard.ts

@@ -0,0 +1,94 @@
+// Key lanes K1 P3 (plan v4 7.2, W17): the Claude settings-layer check before a keyed spawn.
+//
+// Claude Code applies the `env` block of its settings files over the process environment, and an
+// `apiKeyHelper` hands it a credential of its own. Either would point a keyed turn somewhere other
+// than the loopback relay, so the meter and the cap would not see it (or the user's other
+// credential would pay for it). Before a profile spawn the three files the CLI reads for this
+// working directory are checked; any `ANTHROPIC_*` or `CLAUDE_CODE_USE_*` name in `env`, or an
+// `apiKeyHelper`, refuses the profile with a line that names it.
+//
+// Read only on a keyed turn. Never writes, never creates, never reads a value aloud: the refusal
+// names the setting, not what it is set to. A file that does not parse is skipped, because the CLI
+// cannot apply a file it cannot parse either.
+import { existsSync, readFileSync, statSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+export const CLAUDE_SETTINGS_REFUSED_ENV = /^(ANTHROPIC_|CLAUDE_CODE_USE_|CLAUDE_CODE_OAUTH_TOKEN$|AWS_BEARER_TOKEN_BEDROCK$)/
+
+/** QA W4 / G7: the managed (enterprise) settings files Claude Code reads above every user file. */
+export const CLAUDE_MANAGED_SETTINGS_FILES: readonly string[] = [
+  '/Library/Application Support/ClaudeCode/managed-settings.json',
+  '/etc/claude-code/managed-settings.json',
+]
+
+export interface ClaudeSettingsRefusal {
+  /** The file that sets it. */
+  file: string
+  /** The env name, or `apiKeyHelper`. */
+  name: string
+  message: string
+}
+
+export function claudeSettingsFiles(input: { cwd: string; home?: string; env?: NodeJS.ProcessEnv; managed?: readonly string[] }): string[] {
+  const home = input.home ?? homedir()
+  const env = input.env ?? process.env
+  // QA W4 / G7: CLAUDE_CONFIG_DIR moves the user settings; both places are checked.
+  const configDir = typeof env.CLAUDE_CONFIG_DIR === 'string' && env.CLAUDE_CONFIG_DIR.trim() ? env.CLAUDE_CONFIG_DIR.trim() : null
+  return [
+    ...(input.managed ?? CLAUDE_MANAGED_SETTINGS_FILES),
+    ...(configDir ? [join(configDir, 'settings.json')] : []),
+    join(home, '.claude', 'settings.json'),
+    join(input.cwd, '.claude', 'settings.json'),
+    join(input.cwd, '.claude', 'settings.local.json'),
+  ]
+}
+
+function readSettings(file: string): Record<string, unknown> | null {
+  try {
+    if (!existsSync(file) || !statSync(file).isFile()) return null
+    const parsed = JSON.parse(readFileSync(file, 'utf8'))
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed as Record<string, unknown> : null
+  } catch {
+    return null
+  }
+}
+
+export function claudeSettingsRefusalMessage(name: string): string {
+  return `A Claude settings file sets ${name}. Remove it to use a key.`
+}
+
+/**
+ * Canary R12: names a settings file may set that do not bypass the relay but that a keyed run
+ * must not inherit. They are not refused (MU's own project file sets one); the keyed run's flag
+ * layer forces them off, and this reports which file set them so the log says so.
+ */
+export const CLAUDE_SETTINGS_WATCHED_ENV: readonly string[] = ['CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS']
+
+export function claudeSettingsWatched(input: { cwd: string; home?: string; env?: NodeJS.ProcessEnv; managed?: readonly string[] }): Array<{ file: string; name: string }> {
+  const out: Array<{ file: string; name: string }> = []
+  for (const file of claudeSettingsFiles(input)) {
+    const env = readSettings(file)?.env
+    if (!env || typeof env !== 'object' || Array.isArray(env)) continue
+    for (const name of CLAUDE_SETTINGS_WATCHED_ENV) if (Object.prototype.hasOwnProperty.call(env, name)) out.push({ file, name })
+  }
+  return out
+}
+
+/** The first setting that would bypass the relay, or null when a keyed spawn may go ahead. */
+export function claudeSettingsRefusal(input: { cwd: string; home?: string; env?: NodeJS.ProcessEnv; managed?: readonly string[] }): ClaudeSettingsRefusal | null {
+  for (const file of claudeSettingsFiles(input)) {
+    const settings = readSettings(file)
+    if (!settings) continue
+    if (settings.apiKeyHelper !== undefined && settings.apiKeyHelper !== null && settings.apiKeyHelper !== '') {
+      return { file, name: 'apiKeyHelper', message: claudeSettingsRefusalMessage('apiKeyHelper') }
+    }
+    const env = settings.env
+    if (env && typeof env === 'object' && !Array.isArray(env)) {
+      for (const name of Object.keys(env).sort()) {
+        if (CLAUDE_SETTINGS_REFUSED_ENV.test(name)) return { file, name, message: claudeSettingsRefusalMessage(name) }
+      }
+    }
+  }
+  return null
+}

package/server/lib/claude-steer.ts

@@ -21,7 +21,9 @@
 //   SteerTracker          sent and covered uuids; what a result means (finish, wait, steering off)
 //   steerCutoffMs         how close to a deadline a steer is refused as too late
 //   resolveRunModel       the model a run will use, exactly as model-router resolves it
+//   steerProviderFor      the steer gate's provider; a key-profile job is `profile_session`
 import { DEFAULT_MODEL, isCodexModel, isCursorModel, isOllamaModel, normalizeModelPreference, type ModelPreference } from '../../shared/model-preference.js'
+import { parsePreference } from '../../shared/key-preference.js'
 
 /** Quiet after a result that left a steer uncovered, before stdin is closed (plan P4). */
 export const STEER_SETTLE_MS = 20_000
@@ -257,3 +259,28 @@ export function providerOfModel(model: ModelPreference): QueryProvider {
   if (isCursorModel(model)) return 'cursor'
   return isCodexModel(model) ? 'codex' : 'claude'
 }
+
+export type SteerProviderVerdict =
+  | { kind: 'provider'; provider: QueryProvider }
+  | { kind: 'profile_session'; profileId: string }
+
+/**
+ * Key lanes K1 (plan 5.2): the explicit guard in front of resolveRunModel / providerOfModel,
+ * which stay CLOSED. A job whose request names `profile:<id>`, or that names no model in a
+ * session bound to one, is a `profile_session`; the caller asks the profile's engine whether it
+ * steers. Without this guard both fall through to the Claude default and a Codex profile's job
+ * would be offered Claude steering. With no profile anywhere the verdict is exactly
+ * `providerOfModel(resolveRunModel(model, sessionModel, envDefault))`. The session binding is read
+ * only when nothing else names the model, as model-router does.
+ */
+export function steerProviderFor(
+  model: unknown,
+  sessionModel: ModelPreference | null | undefined,
+  envDefault: unknown,
+  sessionBinding: () => unknown,
+): SteerProviderVerdict {
+  const requested = parsePreference(model)
+  const bound = requested ?? (sessionModel == null ? parsePreference(sessionBinding()) : undefined)
+  if (bound?.kind === 'profile') return { kind: 'profile_session', profileId: bound.id }
+  return { kind: 'provider', provider: providerOfModel(resolveRunModel(model, sessionModel, envDefault)) }
+}