@indigoai-us/hq-cli 5.345.110 → 5.345.111

package/dist/lib/bot/run.d.ts

@@ -53,6 +53,7 @@ import { containsNoReplySentinel, type ProgressPosterOptions } from "./progress.
 import { type BotLogger } from "./log.js";
 import { type CodingToolActivity, type DetectCodingToolActivityInput } from "./coding-tool-activity.js";
 import { type BotRuntime, type RuntimeTurnInput, type RuntimeTurnResult } from "./runtime/index.js";
+import { type BotSessionScope } from "./paths.js";
 import type { VaultObjectDownloader } from "../agent-kit/attachment-download.js";
 import { type HeartbeatAgentUidSource, type HeartbeatCredsSource, type HeartbeatIdentityMismatchReporter } from "../heartbeat-identity.js";
 import { type BotState, type BotStatusFile } from "./status.js";
@@ -79,6 +80,8 @@ export declare function apiPollDelayMs(opts: {
 }): number;
 export declare const FAILURE_WINDOW_MS: number;
 export declare const FAILURE_LIMIT = 5;
+/** Resumed-session failures with the model CLI's unknown error, in a row, before the session is cleared. */
+export declare const RESUMED_UNKNOWN_ERROR_LIMIT = 2;
 export declare const MAX_ATTEMPTS_PER_MESSAGE = 3;
 export declare const THINKING_EMOJI = "\uD83D\uDC40";
 export declare const ROOM_THINKING_STATUS = "is thinking\u2026";
@@ -239,6 +242,13 @@ export interface BotHandle {
  * An item that never reaches a model turn gets a lane of its own.
  */
 export declare function inboxLaneKey(item: InboxItem, config: Pick<BotConfig, "ownerUid" | "agentUid" | "name">): string;
+/**
+ * The session an owner DM turn runs in. A Create brief job the desktop app
+ * sent as a DM gets a fresh session of its own (one per run), so it neither
+ * replays the owner's conversation nor leaves its sweep in it; every other DM
+ * resumes the sender's session.
+ */
+export declare function dmTurnSessionScope(item: Pick<InboxItem, "fromPersonUid" | "text">, ownerUid: string): BotSessionScope;
 export declare function preflightCreds(dir: string, config: BotConfig): string | null;
 export declare function runBot(deps: BotRunDeps): Promise<BotHandle>;
 /** True for a setup note the desktop app sent, not words the person typed. */

package/dist/lib/bot/run.js

@@ -72,6 +72,7 @@ import { setupKeptHereNote, setupOfferAnsweredInWordsNote, setupToolOfferAnswer,
 import { FALLBACK_CLAUDE_PERMISSION_MODE, isClaudeBypassDisabled, onPath } from "./runtime/claude.js";
 import { runRuntimeTurn, RuntimeError } from "./runtime/index.js";
 import { botAttachmentsDir, dmSessionScope, isDmSessionScope } from "./paths.js";
+import { briefJobRunId, briefJobSessionScope, isBriefJobSessionScope } from "./brief-job.js";
 import { appendDmHistory, dmHistoryHasModelThread, markDmHistoryModelTurn, readDmHistory, withRecentDmHistory } from "./dm-history.js";
 import { attachmentTurnBlock, downloadTurnAttachments } from "./attachments.js";
 import { inboxEntryAttachments } from "../agent-kit/inbox-state.js";
@@ -122,6 +123,10 @@ export function apiPollDelayMs(opts) {
 }
 export const FAILURE_WINDOW_MS = 10 * 60 * 1000;
 export const FAILURE_LIMIT = 5;
+/** Resumed-session failures with the model CLI's unknown error, in a row, before the session is cleared. */
+export const RESUMED_UNKNOWN_ERROR_LIMIT = 2;
+/** The model CLI's own message, exactly; "Unexpected token" in a stack trace is not it. */
+const RESUMED_UNKNOWN_ERROR = /an unknown error occurred \(unexpected\)/i;
 export const MAX_ATTEMPTS_PER_MESSAGE = 3;
 export const THINKING_EMOJI = "👀";
 export const ROOM_THINKING_STATUS = "is thinking…";
@@ -238,12 +243,23 @@ export const RESTARTED_REASON = "I was restarted while I was working on it";
  */
 export function inboxLaneKey(item, config) {
     if (isDmItem(item))
-        return dmSessionScope(item.fromPersonUid ?? "", config.ownerUid);
+        return dmTurnSessionScope(item, config.ownerUid);
     const target = resolveReplyTarget(item, config);
     if (target?.kind === "room" || target?.kind === "job")
         return target.sessionScope;
     return `item:${item.messageId}`;
 }
+/**
+ * The session an owner DM turn runs in. A Create brief job the desktop app
+ * sent as a DM gets a fresh session of its own (one per run), so it neither
+ * replays the owner's conversation nor leaves its sweep in it; every other DM
+ * resumes the sender's session.
+ */
+export function dmTurnSessionScope(item, ownerUid) {
+    const sender = item.fromPersonUid ?? "";
+    const runId = sender === ownerUid ? briefJobRunId(item.text) : null;
+    return runId ? briefJobSessionScope(runId) : dmSessionScope(sender, ownerUid);
+}
 class FailureWindow {
     windowMs;
     limit;
@@ -942,6 +958,7 @@ export async function runBot(deps) {
             markSignInWorks();
             // A good turn: the last recorded failure is no longer the bot's state.
             setStatus({ recentFailures: failures.count(now().getTime()), lastError: undefined });
+            resumedUnknownErrors.delete(sessionScope);
             if (turn.modelFallback) {
                 const { from, to } = turn.modelFallback;
                 log("warn", `${runtime.id} on this computer is too old for model ${from || "(its configured default)"}; this turn ran on ${to} instead. Update ${runtime.id} to use ${from || "that model"} again`);
@@ -951,7 +968,8 @@ export async function runBot(deps) {
                 setStatus({ runtimeModelFallback: null });
             }
             log("info", `model turn done in ${Math.round((now().getTime() - tTurnStart) / 1000)}s (${Math.round((tTurnStart - tReceived) / 1000)}s before it)`);
-            if (turn.sessionId) {
+            // A brief job's session is one run long; nothing resumes it.
+            if (turn.sessionId && !isBriefJobSessionScope(sessionScope)) {
                 writeBotSession(dir, {
                     v: 1,
                     runtime: config.runtime,
@@ -983,16 +1001,37 @@ export async function runBot(deps) {
         }
     };
     /** Failure bookkeeping shared by every model turn: window, health, status, log, stale session. */
+    /** Consecutive resumed-session failures with the model CLI's unknown error, per scope. */
+    const resumedUnknownErrors = new Map();
     const recordTurnFailure = (err, sessionScope) => {
         const excerpt = err instanceof RuntimeError ? err.stderrExcerpt : err instanceof Error ? err.message : String(err);
         const count = failures.record(now().getTime());
         modelHealth = count >= FAILURE_LIMIT ? "failed" : "degraded";
         setStatus({ restarts: (readStatus()?.restarts ?? 0) + 1, recentFailures: count, lastError: excerpt.slice(0, 400) });
         log("error", `model turn failed (${count}/${FAILURE_LIMIT} in window, ${classifyRuntimeError(err)}): ${excerpt}`);
-        // A resumed session that no longer exists must not poison every turn.
+        // A resumed session that no longer exists must not poison every turn: the
+        // next turn starts fresh with the recent DM history prepended. The model
+        // CLI's "An unknown error occurred (Unexpected)" (every turn of a
+        // long-lived process, 2026-10-12) is not a session error on its face, so a
+        // single one never clears anything; the session is cleared only once that
+        // error repeats on the same resumed session (RESUMED_UNKNOWN_ERROR_LIMIT
+        // in a row, the count reset by any good turn in that scope).
         const resumed = Boolean(err?.resumedSession);
-        if (resumed && /session|resume|not found/i.test(excerpt))
+        if (resumed && /session|resume|not found/i.test(excerpt)) {
             clearBotSession(dir, sessionScope);
+            resumedUnknownErrors.delete(sessionScope);
+        }
+        else if (resumed && RESUMED_UNKNOWN_ERROR.test(excerpt)) {
+            const streak = (resumedUnknownErrors.get(sessionScope) ?? 0) + 1;
+            if (streak >= RESUMED_UNKNOWN_ERROR_LIMIT) {
+                log("warn", `resumed session in ${sessionScope} failed ${streak} times in a row with the model CLI's unknown error; starting fresh next turn`);
+                clearBotSession(dir, sessionScope);
+                resumedUnknownErrors.delete(sessionScope);
+            }
+            else {
+                resumedUnknownErrors.set(sessionScope, streak);
+            }
+        }
         return { excerpt, count };
     };
     /**
@@ -1953,9 +1992,10 @@ export async function runBot(deps) {
             const block = attachmentTurnBlock(files);
             text = text ? `${text}\n\n${block}` : block;
         }
-        const sessionScope = target.kind === "room" ? target.sessionScope : dmSessionScope(target.peerUid, config.ownerUid);
+        const sessionScope = target.kind === "room" ? target.sessionScope : dmTurnSessionScope(item, config.ownerUid);
         if (target.kind === "dm") {
-            rememberDm(sessionScope, {
+            // The owner's history still records that the job was sent.
+            rememberDm(dmSessionScope(target.peerUid, config.ownerUid), {
                 role: "user",
                 from: (item.fromDisplayName ?? "").trim() || item.fromPersonUid || "someone",
                 ...(item.fromPersonUid ? { fromPersonUid: item.fromPersonUid } : {}),
@@ -2077,7 +2117,9 @@ export async function runBot(deps) {
             clearInflight(dir, id);
             attempts.delete(id);
             markSignInBroken(outcome.excerpt);
-            const conversation = markerTarget.kind === "dm" ? sessionScope : `room:${markerTarget.channelId}:${item.rootEventId ?? ""}`;
+            // One notice per DM conversation: a brief job's scope is per run, so
+            // the notice keys on the peer's DM scope, not the turn's scope.
+            const conversation = markerTarget.kind === "dm" ? dmSessionScope(markerTarget.peerUid, config.ownerUid) : `room:${markerTarget.channelId}:${item.rootEventId ?? ""}`;
             await tellSignInNeeded(conversation, (notice) => postRepair(markerTarget, notice, item.rootEventId), false, item.eventId ?? id);
             log("warn", `kept ${id} until ${runtime.id} can sign in again`);
             return; // un-acked: answered once the sign-in works
@@ -2191,8 +2233,11 @@ export async function runBot(deps) {
     const pending = new Set();
     const running = new Set();
     const canStart = () => !stopping && state === "running" && !hasPromotionHold(dir);
-    /** Job turns yield to people: one at a time, and never the last free slot. */
-    const isJobLane = (lane) => lane.startsWith("job:");
+    /**
+     * Job turns yield to people: one at a time, and never the last free slot.
+     * A brief job is a person's click, so it is scheduled like the owner's DM.
+     */
+    const isJobLane = (lane) => lane.startsWith("job:") && !isBriefJobSessionScope(lane);
     const jobLaneBudget = Math.max(1, maxParallelTurns - 1);
     const canStartJobLane = () => [...busyLanes].filter(isJobLane).length < MAX_PARALLEL_JOB_TURNS && busyLanes.size < jobLaneBudget;
     const pump = () => {

package/dist/lib/capacity/collectors/claude-oauth.d.ts

@@ -5,10 +5,26 @@
  * `Claude Code-credentials`, plus `Claude Code-credentials-<hash>` seats,
  * or the credentials JSON under ~/.claude/ on Linux). GETs
  * https://api.anthropic.com/api/oauth/usage with the oauth-2025-04-20 beta
- * header. This module does not refresh the token, write the Keychain or
- * ~/.claude, call an OAuth token endpoint, or invoke the claude CLI except
+ * header. This module does not invoke the claude CLI except
  * `claude --version` when the caller does not pass cliVersion.
  *
+ * US-014 wires in a token-refresh gate. The gate uses two seams,
+ * `defaultListLiveLanes` and `defaultListProcesses`, to decide whether a
+ * refresh is safe (no running Claude Code holds the home). Both seams
+ * FAIL CLOSED: an error, a timeout, or an unexpected JSON shape returns an
+ * error-signalling throw and the caller records `skipped-live` /
+ * `skipped-process` and does NOT rotate the refresh token.
+ *
+ * Residual blind spot on darwin: `ps -axo pid=,command=` cannot read a
+ * child process's environment, so on darwin a running `claude` process is
+ * conservatively treated as holding the DEFAULT home AND blocking any
+ * non-default home refresh. A sibling that sets `CLAUDE_CONFIG_DIR` to a
+ * different home still blocks the gate; this is the safe side of the
+ * precision/safety tradeoff. On linux `/proc/<pid>/environ` lets the gate
+ * read the per-process `CLAUDE_CONFIG_DIR`, so it only blocks the matching
+ * home. Windows and other platforms get no process gate; the lane gate is
+ * authoritative there.
+ *
  * The legacy shape (seven_day_opus populated, no limits[]) is drift.
  * observedAt is the response time. One collect appends every account's
  * readings and failures in one rebuild.
@@ -30,6 +46,17 @@ export declare const CLAUDE_OAUTH_FETCH_TIMEOUT_MS = 10000;
 export declare const CLAUDE_OAUTH_SECURITY_TIMEOUT_MS = 5000;
 export declare const CLAUDE_OAUTH_POLL_FILE = "claude-oauth-last-call.json";
 export declare const CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials";
+/** Claude Code's refresh endpoint. The URL and the client_id are the ones Claude Code itself posts. */
+export declare const CLAUDE_OAUTH_REFRESH_URL = "https://console.anthropic.com/v1/oauth/token";
+export declare const CLAUDE_OAUTH_REFRESH_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+/** Minimum gap between refresh attempts for one home when the previous attempt did not revoke. */
+export declare const CLAUDE_OAUTH_REFRESH_BACKOFF_MS: number;
+/** Minimum gap between refresh attempts for one home after an invalid_grant. */
+export declare const CLAUDE_OAUTH_REFRESH_REVOKED_BACKOFF_MS: number;
+/** Try a refresh when the token is this close to expiry, so one tick does not land on a stale token. */
+export declare const CLAUDE_OAUTH_REFRESH_PREFLIGHT_MS: number;
+export declare const CLAUDE_OAUTH_REFRESH_TIMEOUT_MS = 10000;
+export declare const CLAUDE_OAUTH_REFRESH_LAST_FILE = "claude-oauth-refresh-last.json";
 export interface ClaudeOAuthFetchInit {
     method: "GET";
     headers: Record<string, string>;
@@ -43,6 +70,21 @@ export type ClaudeOAuthFetch = (url: string, init: ClaudeOAuthFetchInit) => Prom
         get(name: string): string | null;
     };
 }>;
+export interface ClaudeOAuthRefreshFetchInit {
+    method: "POST";
+    headers: Record<string, string>;
+    body: string;
+    redirect: "manual";
+    signal?: AbortSignal;
+}
+/** Separate seam from the usage fetch: POST + body, same response shape. */
+export type ClaudeOAuthRefreshFetch = (url: string, init: ClaudeOAuthRefreshFetchInit) => Promise<{
+    status: number;
+    text: () => Promise<string>;
+    headers?: {
+        get(name: string): string | null;
+    };
+}>;
 export interface SecurityExecResult {
     status: number | null;
     stdout: string;
@@ -58,12 +100,77 @@ export interface ClaudeCredentialAccount {
     expiresAt?: number | null;
     scopes?: readonly string[] | null;
     planType?: string | null;
+    /** Opaque refresh token. Never logged, never surfaced. Passed to writeCredentials verbatim. */
+    refreshToken?: string | null;
+    /** Full parsed credential JSON. Preserved so writeCredentials can round-trip mcpOAuth and siblings. */
+    credentialDocument?: Record<string, unknown> | null;
+    /** The config dir this credential belongs to; needed to resolve the Keychain service or file path. */
+    home?: string | null;
 }
 export interface ReadClaudeCredentialsResult {
     keychain: ClaudeKeychainStatus;
     accounts: ClaudeCredentialAccount[];
 }
 export type ReadClaudeCredentials = () => ReadClaudeCredentialsResult;
+export interface WriteClaudeCredentialsRequest {
+    home: string;
+    /** macOS Keychain service name; empty on non-darwin. */
+    service: string;
+    platform: NodeJS.Platform;
+    /** The full new credential JSON object. The caller preserved sibling keys. */
+    document: Record<string, unknown>;
+    /** The refreshToken we read before POSTing to the token endpoint. Used to detect rotation races. */
+    previousRefreshToken: string | null;
+}
+export interface WriteClaudeCredentialsResult {
+    ok: boolean;
+    /** True when the on-disk refresh token no longer matches `previousRefreshToken`. */
+    raceDetected?: boolean;
+    invalidGrant?: boolean;
+    /** Human-readable, already scrubbed of tokens. */
+    error?: string;
+}
+export type WriteClaudeCredentials = (request: WriteClaudeCredentialsRequest) => Promise<WriteClaudeCredentialsResult>;
+/**
+ * One row per lane the gate must consider.
+ * - `isLive` is true for state ∈ {queued, running, awaiting_input}: a running
+ *   Claude Code may hold the home; a refresh would race and get invalid_grant.
+ * - `isAuthFailed` is true when the lane terminated with reason
+ *   `provider_auth_failed` (src/lib/lanes/watcher.ts classifies 401/403 that
+ *   way). The gate treats this as proof the account is already signed out and
+ *   records revoked without hitting the token endpoint.
+ * - `home` is the resolved per-host provider home for the account; the gate
+ *   compares it to the home being refreshed with `path.resolve` so symlinks
+ *   do not slip through. `null` is accepted only when the row is not live.
+ */
+export interface LiveLane {
+    home: string | null;
+    account: string | null;
+    provider: string;
+    state: string;
+    reason: string | null;
+    isLive: boolean;
+    isAuthFailed: boolean;
+}
+/** Fail-closed: throw on error/timeout/unexpected shape; the caller skips refresh. */
+export type ListLiveLanes = () => Promise<readonly LiveLane[]>;
+/**
+ * One row per Claude Code process the gate must consider.
+ * - `probe === "env"` means the probe read `/proc/<pid>/environ` and the
+ *   `env.CLAUDE_CONFIG_DIR` field is authoritative (undefined means default).
+ * - `probe === "command-only"` means we only saw the command line (darwin
+ *   `ps -axo pid=,command=`), with no visibility into the process env. The
+ *   gate treats such a row as a conservative blocker for every home.
+ */
+export interface ClaudeProcess {
+    pid: number;
+    env: {
+        CLAUDE_CONFIG_DIR?: string;
+    };
+    probe: "env" | "command-only";
+}
+/** Fail-closed: throw on error/timeout; the caller skips refresh. */
+export type ListProcesses = () => Promise<readonly ClaudeProcess[]>;
 export interface ClaudeOAuthCollectResult {
     readings: ReadingInput[];
     failures: ParserFailureEvent[];
@@ -99,6 +206,20 @@ export interface CollectClaudeOAuthOptions {
     }[];
     /** One-shot collect reads while the resident collector stays disabled. */
     allowDisabled?: boolean;
+    /**
+     * Writes a refreshed credential back to disk / Keychain. Default implementation uses
+     * `security add-generic-password -U` on darwin and tmp+rename at mode 0600 on linux,
+     * preserving all sibling fields (including `mcpOAuth`).
+     */
+    writeCredentials?: WriteClaudeCredentials;
+    /** Returns homes that live lanes are using. Default implementation reads `hq lanes list --json`. */
+    listLiveLanes?: ListLiveLanes;
+    /** Returns processes whose `CLAUDE_CONFIG_DIR` identifies a home. Default reads `ps -ewwo pid,command`. */
+    listProcesses?: ListProcesses;
+    /** Overrides the Claude Code refresh endpoint. Tests set this to a 127.0.0.1 stub. */
+    tokenEndpoint?: string;
+    /** Overrides the POST transport for the refresh. Default wraps `fetch` with a 10s abort. */
+    refreshFetch?: ClaudeOAuthRefreshFetch;
 }
 interface MapOptions {
     observedAt: string;
@@ -141,5 +262,107 @@ export declare function claudeSeatAccountId(seat: string, orgId: string | null):
 export declare function readInstalledClaudeVersion(readVersion?: () => string): string;
 /** Async `claude --version` for the daemon. The sync reader stays for one-shot callers. */
 export declare function readInstalledClaudeVersionAsync(): Promise<string>;
+/** Per-home record of the last refresh attempt. */
+export interface ClaudeRefreshLastEntry {
+    attemptedAt: string;
+    outcome: "refreshed" | "revoked" | "error" | "skipped-race" | "skipped-live" | "skipped-live-check-failed" | "skipped-process" | "skipped-process-check-failed" | "skipped-backoff" | "skipped-revoked";
+    revokedRefreshTokenFingerprint?: string;
+    /** Short, token-free diagnostic (never a response body). */
+    errorMessage?: string;
+    /** Fixed classification string for refresh errors; no response body is stored anywhere. */
+    errorClass?: "invalid_grant" | "revoked" | "server_error" | "timeout" | "network" | "shape";
+    httpStatus?: number | null;
+    backoffUntil?: string;
+    /** ISO expiry of the token the entry describes. Set on a successful refresh. */
+    tokenExpiresAt?: string;
+}
+export interface RevokedAccountEntry {
+    at: string;
+    fingerprint?: string;
+}
+export declare function claudeOAuthRefreshLastPath(root: string): string;
+/** Not the token: a 16 char sha256 prefix. */
+export declare function tokenFingerprint(token: string): string;
+/** Reads the last refresh outcome for a home. Exposed for the doctor command. */
+export declare function readClaudeRefreshLast(root: string, home: string): ClaudeRefreshLastEntry | null;
+/** @deprecated prefer {@link revokedMarkerForCurrentCredential}; this is the pre-fingerprint shim. */
+export declare function isAccountRevokedPersisted(root: string, accountId: string): boolean;
+/**
+ * Compare the persisted revoked marker (if any) against the refresh token the
+ * caller is about to use.
+ *
+ * - `"match"`: the marker was written for this exact refresh token. The caller
+ *   must still block (nothing has changed since the account was marked signed
+ *   out).
+ * - `"stale"`: a marker exists but the stored fingerprint does not match the
+ *   current refresh token, meaning the human signed in again and the token
+ *   rotated. The caller should clear the marker and proceed; a fresh 401 will
+ *   re-mark it.
+ * - `"none"`: no marker is persisted.
+ *
+ * A marker written by an older version carries no fingerprint. We treat that
+ * as `"stale"` so a current sign-in can recover; if the token really is still
+ * revoked the usage fetch will set a fingerprinted marker on the next 401.
+ */
+export declare function revokedMarkerForCurrentCredential(root: string, accountId: string, refreshToken: string | null | undefined): "match" | "stale" | "none";
+/**
+ * Shape of a single lane row emitted by `hq lanes list --json`.
+ * See src/commands/lanes.ts (withoutProviderHome strips `provider_home_at_spawn`
+ * from CLI output; we must consult the accounts registry to map
+ * account id -> effective_home).
+ *
+ * Note: the lane watcher writes a provider-auth-failed signal to the
+ * `terminal_reason` field (watcher.ts:~729). The `terminal_details` record
+ * carries the structured `account` and `provider` of the rejection
+ * (provider-rejection.ts:providerRejectionDetails). Lane records never
+ * surface a top-level `reason` for the auth-failed state, so this is the
+ * only shape we read.
+ */
+interface RawLaneRow {
+    state?: unknown;
+    account?: unknown;
+    provider?: unknown;
+    terminal_reason?: unknown;
+    terminal_details?: unknown;
+}
+interface RawAccountRow {
+    id?: unknown;
+    home?: unknown;
+    effective_home?: unknown;
+    auth_state?: unknown;
+    provider?: unknown;
+}
+/**
+ * Parse `hq lanes list --json` payload into typed rows.
+ * Exported for tests; fail-closed semantics live in defaultListLiveLanes.
+ */
+export declare function parseLanesListPayload(payload: unknown): readonly RawLaneRow[];
+/**
+ * Parse `hq lanes accounts list --json` payload into typed rows.
+ * Exported for tests; fail-closed semantics live in defaultListLiveLanes.
+ */
+export declare function parseAccountsListPayload(payload: unknown): readonly RawAccountRow[];
+/**
+ * Join lanes rows against accounts rows to produce LiveLane records.
+ * Exported for tests.
+ */
+export declare function buildLiveLanesFromPayloads(lanes: readonly RawLaneRow[], accounts: readonly RawAccountRow[]): readonly LiveLane[];
+/**
+ * Parse `ps -axo pid=,command=` into rows that mention the `claude` executable.
+ * Exported for tests. Returned rows carry `probe: "command-only"` so the gate
+ * knows it cannot read per-process CLAUDE_CONFIG_DIR on darwin.
+ */
+export declare function parsePsClaudeOutput(stdout: string): readonly ClaudeProcess[];
+export interface ClaudeTokenRefreshResult {
+    outcome: "refreshed" | "revoked" | "error" | "skipped-race" | "skipped-live" | "skipped-live-check-failed" | "skipped-process" | "skipped-process-check-failed" | "skipped-backoff" | "skipped-revoked";
+    newAccessToken?: string;
+    newExpiresAt?: number;
+    newRefreshToken?: string;
+    newScopes?: readonly string[] | null;
+    errorMessage?: string;
+    errorClass?: ClaudeRefreshErrorClass;
+    httpStatus?: number | null;
+}
+export type ClaudeRefreshErrorClass = "invalid_grant" | "revoked" | "server_error" | "timeout" | "network" | "shape";
 export {};
 //# sourceMappingURL=claude-oauth.d.ts.map