@kendoo.agentdesk/agentdesk 0.34.0 → 0.34.1

package/CHANGELOG.md

@@ -8,6 +8,11 @@ All user-facing changes to AgentDesk. Each entry is tagged:
 
 Internal refactors, infrastructure changes, and architectural notes are not listed here.
 
+## [0.34.1] — 2026-09-21
+
+### Fixed
+- `[CLI]` The Claude login check before a session now sends one tiny real request instead of trusting `claude auth status`. An expired or revoked login fails the session before INTAKE and names the profile to reconnect (for example `CLAUDE_CONFIG_DIR=<profile> claude auth login`), instead of surfacing as a 401 from inside the first phase. Set `AGENTDESK_SKIP_AUTH_PROBE=1` to skip the probe.
+
 ## [0.34.0] — 2026-09-21
 
 ### Added

package/README.md

@@ -294,7 +294,7 @@ Run `npm run test:sdk-leadership` to check Jane's decisions against supplied rep
 
 Sessions started from the dashboard with an updated daemon can be paused and resumed in the same conversation and workspace. Use **Pause / check workers**, or enter a correction and choose **Pause & save**. Instructions are saved immediately; **Verify & resume** becomes available after the previous workers have stopped and released the workspace. A quarantined workspace remains blocked until its workers exit.
 
-Resume restores the original task, discovered tracker task ID, pending phase, saved findings, user corrections, token totals, and recorded external actions. Corrections trigger replanning against the existing work. Access is checked again before continuing; a failed login check preserves both the checkpoint and the pending correction. For a revoked model login, reconnect Claude on the daemon computer using the same account profile, then choose **Verify & resume**. Session controls require the session owner and a connected daemon that supports recovery; older sessions need a separate continuation.
+Resume restores the original task, discovered tracker task ID, pending phase, saved findings, user corrections, token totals, and recorded external actions. Corrections trigger replanning against the existing work. Access is checked again before continuing; a failed login check preserves both the checkpoint and the pending correction. For a revoked model login, reconnect Claude on the daemon computer using the same account profile, then choose **Verify & resume**. Before every session the engine checks that login with one tiny real request; an expired or revoked login stops the session before intake and names the profile to reconnect. Session controls require the session owner and a connected daemon that supports recovery; older sessions need a separate continuation.
 
 A missing phase handoff gets one repair attempt using the preserved findings with execution tools disabled. If repair fails, or required tracker access is denied during intake or planning, work pauses for intervention. Recognized external write commands are fingerprinted before dispatch and exact repeats are blocked. An uncertain result must be reconciled with the provider before continuing. This is a conservative replay guard, not general deduplication of equivalent commands or arbitrary scripts.
 

package/cli/engine/claude-auth.mjs

@@ -11,6 +11,7 @@
 
 import { execFile } from "child_process";
 import { createRequire } from "node:module";
+import { homedir } from "os";
 import { dirname, join } from "path";
 import { stripParentSessionVars } from "./env.mjs";
 
@@ -36,6 +37,26 @@ export const CLAUDE_LOGIN_HINT = [
   "  • or add ANTHROPIC_API_KEY=<key> to the project's .env.",
 ].join("\n");
 
+// The profile a standalone child will authenticate with: the one `claude auth
+// status` reports, else the selected CLAUDE_CONFIG_DIR, else the default.
+export function profileInUse(env = {}, status = null) {
+  return status?.configDirectory || env.CLAUDE_CONFIG_DIR || "~/.claude (default profile)";
+}
+
+// The hint names the profile and the exact login command for it, because a
+// machine with several profiles can be logged in everywhere except the one
+// the daemon runs with.
+export function loginHint(profile) {
+  const isDefault = !profile.startsWith("/") || profile === join(homedir(), ".claude");
+  const login = isDefault ? "claude auth login" : `CLAUDE_CONFIG_DIR=${profile} claude auth login`;
+  return `${CLAUDE_LOGIN_HINT}\nProfile in use: ${profile} — reconnect it on the daemon machine with \`${login}\`.`;
+}
+
+// Probe error text that means the stored login itself cannot be used (as
+// opposed to a transient API problem, which must not block a session).
+const AUTH_FAILURE = /authenticat|oauth|\b401\b|not logged in|invalid api key|api key/i;
+const PROBE_ARGS = ["-p", "Reply with exactly: OK", "--max-turns", "1", "--output-format", "json"];
+
 function run(exec, bin, args, env, timeoutMs) {
   return new Promise(resolve => {
     exec(bin, args, { env, timeout: timeoutMs, maxBuffer: 1 << 20 }, (err, stdout, stderr) => {
@@ -44,14 +65,29 @@ function run(exec, bin, args, env, timeoutMs) {
   });
 }
 
-// Returns { ok, method, detail, hint? }.
+// `claude auth status` only reports that credentials exist; it does not use
+// them. An expired or revoked OAuth token passes it and then fails the first
+// real request from inside INTAKE. One tiny real request settles it up front.
+async function probeLogin(exec, bin, env, timeoutMs) {
+  const { err, stdout } = await run(exec, bin, PROBE_ARGS, env, timeoutMs);
+  let result = null;
+  try { result = JSON.parse(stdout); } catch {}
+  if (result && typeof result === "object") {
+    if (result.is_error) return { verdict: "error", message: String(result.result || result.subtype || "error result") };
+    return { verdict: "ok" };
+  }
+  return { verdict: "inconclusive", message: err?.message || (stdout ? "unexpected probe output" : "no output") };
+}
+
+// Returns { ok, method, detail, hint?, warning? }.
 //   env  — the environment the session child will get (dotenv + sandbox applied)
 //   exec — injectable for tests (child_process.execFile signature)
-export async function checkClaudeAuth({ env = process.env, exec = execFile, timeoutMs = 10000 } = {}) {
+export async function checkClaudeAuth({ env = process.env, exec = execFile, timeoutMs = 10000, probeTimeoutMs = 30000 } = {}) {
   if (env.ANTHROPIC_API_KEY) return { ok: true, method: "api-key", detail: "ANTHROPIC_API_KEY" };
 
   const bin = claudeBinary(env);
-  const { err, stdout } = await run(exec, bin, ["auth", "status"], stripParentSessionVars(env), timeoutMs);
+  const childEnv = stripParentSessionVars(env);
+  const { err, stdout } = await run(exec, bin, ["auth", "status"], childEnv, timeoutMs);
 
   if (err && !stdout) {
     const detail = err.code === "ENOENT"
@@ -65,8 +101,19 @@ export async function checkClaudeAuth({ env = process.env, exec = execFile, time
     return { ok: false, method: "unknown", detail: "unexpected output from `claude auth status`", hint: CLAUDE_LOGIN_HINT };
   }
 
-  if (status.loggedIn === true) {
-    return { ok: true, method: status.authMethod || "oauth", detail: status.email || status.authMethod || "logged in" };
+  const profile = profileInUse(env, status);
+  if (status.loggedIn !== true) return { ok: false, method: "none", detail: `not logged in (profile: ${profile})`, hint: loginHint(profile) };
+
+  const method = status.authMethod || "oauth";
+  const detail = status.email || method;
+  if (env.AGENTDESK_SKIP_AUTH_PROBE === "1") return { ok: true, method, detail };
+
+  const probe = await probeLogin(exec, bin, childEnv, probeTimeoutMs);
+  if (probe.verdict === "ok") return { ok: true, method, detail };
+  if (probe.verdict === "error" && AUTH_FAILURE.test(probe.message)) {
+    return { ok: false, method, detail: `Claude login for ${profile} cannot be used: ${probe.message}`, hint: loginHint(profile) };
   }
-  return { ok: false, method: "none", detail: "not logged in", hint: CLAUDE_LOGIN_HINT };
+  // A transient API problem or an odd CLI answer is not a login failure:
+  // let the session start and say what the probe saw.
+  return { ok: true, method, detail, warning: `login probe ${probe.verdict === "error" ? "failed" : "inconclusive"} (${probe.message}) — continuing` };
 }

package/cli/engine/session.mjs

@@ -220,6 +220,7 @@ async function executeSession({
   const auth = await authCheck({ env: buildChildEnv({ dotenv }) });
   abortSignal?.throwIfAborted();
   if (!auth.ok) return failStart("CLAUDE_NOT_LOGGED_IN", `${auth.detail}.\n${auth.hint || ""}`.trim());
+  if (auth.warning) emit({ type: "agent:message", agent: "Jane", tag: "SAY", message: `Claude login check: ${auth.warning}.` });
   emit({ type: "session:recovery", recovery: { state: "running", kind: "resume", message: "Access checked; continuing the saved task.", ready: false } });
 
   const sandbox = createScratchHome({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kendoo.agentdesk/agentdesk",
-  "version": "0.34.0",
+  "version": "0.34.1",
   "description": "AI team orchestrator for Claude Code — run collaborative agent sessions from your terminal",
   "type": "module",
   "bin": {