@modelprofile.com/authswitch 9.2.0 → 10.0.1

package/ts/classes.authoritypreuse.ts

@@ -1,4 +1,5 @@
 import * as plugins from './plugins.js';
+import type { IOpenAiAccess } from './interfaces.openai.js';
 import type { IAuthSwitchPreuseOperation } from './authority-contract.js';
 import { AuthSwitchRefusal } from './authority-contract.js';
 import { AuthSwitchAuthorityBroker } from './classes.authoritybroker.js';
@@ -6,10 +7,10 @@ import { AuthSwitchAuthorityDatabase } from './classes.authoritydatabase.js';
 import type { IStoredAuthorityPreuseOperation, TStoredAuthorityPreuseProblem } from './classes.authoritymodels.js';
 import { CodexPreuse, type ICodexPreuseLifecycle } from './classes.codexpreuse.js';
 import type { IHarnessPreuseOptions, IHarnessPreuseResult } from './interfaces.harness.js';
-import { validatePreuseOptions } from './preuse.js';
+import { PreuseFailureError, PreuseLimitError, validatePreuseOptions } from './preuse.js';
 
 export interface IAuthSwitchAuthorityPreuseExecutor {
-  runAccess(credential: plugins.flexAccounts.IOpenAiChatGptAccessCredential,
+  runAccess(access: IOpenAiAccess,
     options: IHarnessPreuseOptions, lifecycle: ICodexPreuseLifecycle): Promise<IHarnessPreuseResult>;
 }
 
@@ -41,7 +42,8 @@ const hash = (value: unknown): value is string => typeof value === 'string' && /
 const publicOperation = (operation: IStoredAuthorityPreuseOperation): IAuthSwitchPreuseOperation => ({
   id: operation.id, accountId: operation.accountId, loginId: operation.grantId,
   purpose: operation.purpose, requestedModel: operation.requestedModel, model: operation.model,
-  state: operation.state, result: operation.result, problem: operation.problem,
+  state: operation.state, result: operation.result, problem: operation.problem, limit: operation.limit ?? null,
+  failure: operation.failure ?? null,
   createdAt: operation.createdAt, updatedAt: operation.updatedAt,
   finishedAt: operation.finishedAt, revision: operation.revision,
 });
@@ -204,11 +206,8 @@ export class AuthSwitchAuthorityPreuse {
       const access = await this.broker.resolveUsageAccess(context, undefined, this.minAccessValidityMs);
       signal.throwIfAborted();
       phase = operation.requestedModel === null ? 'catalog' : 'access';
-      const credential: plugins.flexAccounts.IOpenAiChatGptAccessCredential = {
-        kind: 'chatgptAccess', providerId: 'openai', accessToken: access.accessToken,
-        accountId: access.accountId, isFedrampAccount: access.isFedrampAccount,
-      };
-      const result = await this.executor.runAccess(credential,
+      const result = await this.executor.runAccess({ accessToken: access.accessToken,
+        accountId: access.accountId, isFedrampAccount: access.isFedrampAccount },
         { prompt, ...(operation.requestedModel === null ? {} : { model: operation.requestedModel }), signal },
         { beforeRequest: async model => {
           signal.throwIfAborted();
@@ -224,26 +223,40 @@ export class AuthSwitchAuthorityPreuse {
         state: 'complete', result: { inputTokens: count(result.inputTokens), outputTokens: count(result.outputTokens),
           totalTokens: count(result.totalTokens) }, problem: 'none', updatedAt: now, finishedAt: now,
         revision: prior.revision + 1, updateId }));
-    } catch {
-      await this.fail(operation.id, phase, signal);
+    } catch (error) {
+      await this.fail(operation.id, phase, signal,
+        error instanceof PreuseLimitError || error instanceof PreuseFailureError ? error : null);
     }
   }
 
-  private async fail(operationId: string, phase: 'target' | 'access' | 'catalog', signal: AbortSignal): Promise<void> {
+  /**
+   * Settles a preuse that did not complete. A limit is named: the account's usage reading stopped it before
+   * anything was sent, or the provider refused the prompt -- before its answer began, which consumed nothing and
+   * settles `refused`, or during it, which stays `outcome_unknown`. Any other stated cause of a sent request is
+   * named as its `failure`.
+   */
+  private async fail(operationId: string, phase: 'target' | 'access' | 'catalog', signal: AbortSignal,
+    stated: PreuseLimitError | PreuseFailureError | null): Promise<void> {
     let current: IStoredAuthorityPreuseOperation;
     try { current = await this.readStored(operationId); }
     catch { return; }
     if (!['preparing', 'request_may_have_started'].includes(current.state)) return;
     const marked = current.state === 'request_may_have_started';
-    const problem: TStoredAuthorityPreuseProblem = marked
-      ? this.closed ? 'authority_closing' : signal.aborted ? 'cancelled' : 'request_uncertain'
-      : this.closed ? 'authority_closing' : signal.aborted ? 'cancelled'
-        : phase === 'target' ? 'target_unavailable' : phase === 'catalog' ? 'catalog_unavailable' : 'access_unavailable';
+    const stopped = this.closed ? 'authority_closing' : signal.aborted ? 'cancelled' : null;
+    const limit = stopped === null && stated instanceof PreuseLimitError && (stated.source === 'provider') === marked
+      ? stated : null;
+    const failure = stopped === null && marked && stated instanceof PreuseFailureError ? stated.failure : null;
+    const problem: TStoredAuthorityPreuseProblem = stopped ?? (limit ? limit.limit.kind
+      : marked ? 'request_uncertain'
+        : phase === 'target' ? 'target_unavailable' : phase === 'catalog' ? 'catalog_unavailable' : 'access_unavailable');
+    const state: IStoredAuthorityPreuseOperation['state'] = !marked ? 'not_sent'
+      : limit && !limit.generationStarted ? 'refused' : 'outcome_unknown';
     const updateId = plugins.crypto.randomUUID();
     const now = new Date(this.now()).toISOString();
     try {
-      await this.database.changePreuseOperation(updateId, operationId, prior => ({ ...prior,
-        state: marked ? 'outcome_unknown' : 'not_sent', problem,
+      await this.database.changePreuseOperation(updateId, operationId, prior => ({ ...prior, state, problem,
+        ...(limit ? { limit: { ...limit.limit } } : {}),
+        ...(failure ? { failure: { ...failure } } : {}),
         updatedAt: now, finishedAt: now, revision: prior.revision + 1, updateId }));
     } catch { /* A durable request marker remains recoverable as outcome_unknown on restart. */ }
   }

package/ts/classes.authorityusage.ts

@@ -1,9 +1,10 @@
 import * as plugins from './plugins.js';
+import type { AuthSwitchOpenAiProvider } from './classes.openaiprovider.js';
+import type { IOpenAiAccountRateLimits, IOpenAiRateLimitDetails, IOpenAiRateLimitWindow } from './interfaces.openai.js';
 import type { IClaudeLogin, IClaudeStatusRead } from './classes.claudestatus.js';
 import type { IHarnessAccountStatus } from './interfaces.harness.js';
 
-type TRateLimits = plugins.flexAccounts.ISmartAiProviderAccountRateLimits;
-type TAccessCredential = plugins.flexAccounts.IOpenAiChatGptAccessCredential;
+type TRateLimits = IOpenAiAccountRateLimits;
 
 export type TAuthSwitchUsageProblem =
   | 'none' | 'unsupported' | 'access_unavailable' | 'provider_unavailable'
@@ -115,7 +116,7 @@ export interface IAuthSwitchAuthorityUsageOptions {
     action: (source: { context: IAuthSwitchUsageContext; login: IClaudeLogin;
       readContext(): Promise<IAuthSwitchUsageContext | null> }) => Promise<IAuthSwitchUsageSnapshot>): Promise<IAuthSwitchUsageSnapshot>;
   store: IAuthSwitchUsageStore;
-  provider: Pick<plugins.flexAccounts.ISmartAiProviderAdapter, 'getAccountRateLimits'>;
+  provider: Pick<AuthSwitchOpenAiProvider, 'getAccountRateLimits'>;
   now?: () => number;
   currentMaxAgeMs?: number;
   maxStaleAgeMs?: number;
@@ -199,11 +200,11 @@ const publicClaudeStatus = (source: IHarnessAccountStatus): IAuthSwitchClaudeSta
 
 /** Allowlist the provider projection before it enters a management DTO or stored usage record. */
 const publicRateLimits = (source: TRateLimits): TRateLimits => {
-  const window = (value: plugins.flexAccounts.ISmartAiProviderRateLimitWindow) => ({
+  const window = (value: IOpenAiRateLimitWindow) => ({
     usedPercent: value.usedPercent, limitWindowSeconds: value.limitWindowSeconds,
     resetAfterSeconds: value.resetAfterSeconds, resetsAt: value.resetsAt,
   });
-  const detail = (value: plugins.flexAccounts.ISmartAiProviderRateLimitDetails) => ({
+  const detail = (value: IOpenAiRateLimitDetails) => ({
     allowed: value.allowed, limitReached: value.limitReached,
     ...(value.primaryWindow ? { primaryWindow: window(value.primaryWindow) } : {}),
     ...(value.secondaryWindow ? { secondaryWindow: window(value.secondaryWindow) } : {}),
@@ -511,10 +512,8 @@ export class AuthSwitchAuthorityUsage {
   }
 
   private query(access: IAuthSwitchUsageAccess): ReturnType<IAuthSwitchAuthorityUsageOptions['provider']['getAccountRateLimits']> {
-    const credential: TAccessCredential = { kind: 'chatgptAccess', providerId: 'openai',
-      accessToken: access.accessToken, accountId: access.accountId,
-      isFedrampAccount: access.isFedrampAccount };
-    return this.options.provider.getAccountRateLimits(credential, { timeoutMs: this.policy.providerTimeoutMs });
+    return this.options.provider.getAccountRateLimits({ accessToken: access.accessToken, accountId: access.accountId,
+      isFedrampAccount: access.isFedrampAccount }, { timeoutMs: this.policy.providerTimeoutMs });
   }
 
   /** Wait for admitted reads before the daemon disposes the shared provider or database. */

package/ts/classes.claudeauthority.ts

@@ -418,7 +418,13 @@ export class ClaudeNativeAuthority {
     return publicHandoff(result.handoff);
   }
 
-  private async classify(operationId: string, session: IClaudeNativeLockedSession): Promise<IAuthSwitchClaudeNativeHandoff> {
+  /**
+   * Settles a handoff from what its native home holds. A pair that is exactly the prepared target commits only
+   * once Claude Code is proven to select it: by the switch that just wrote it (`targetProven`), or here, under
+   * this lease -- which is what a restarted daemon relies on for a write whose proof it never ran.
+   */
+  private async classify(operationId: string, session: IClaudeNativeLockedSession,
+    options: { targetProven?: boolean } = {}): Promise<IAuthSwitchClaudeNativeHandoff> {
     const context = await this.database.readClaudeHandoffContext(operationId);
     if (!context) throw new Error('Claude handoff operation is missing.');
     const handoff = context.handoff;
@@ -441,6 +447,14 @@ export class ClaudeNativeAuthority {
     if (handoff.after && samePair(observed, handoff.after)
       && sameIdentity(observed.identity, handoff.targetIdentity)
       && accessDigest === handoff.targetAccessDigest) {
+      if (!options.targetProven) {
+        try { await session.proveEffectiveLogin(await this.unsealLogin(context.incomingAccount, context.incoming)); }
+        catch (error) {
+          // The original bytes are not journaled, so an unproven write cannot be undone here; it is held apart.
+          return this.settle(operationId, 'quarantined', observed.runningEffectiveAuth, 'unsupported_effective_auth',
+            error instanceof ClaudeNativeEffectiveAuthUnsupportedError ? error.reason : null);
+        }
+      }
       return this.settle(operationId, 'committed', observed.runningEffectiveAuth);
     }
     return this.settle(operationId, 'quarantined', observed.runningEffectiveAuth, 'foreign_or_torn');
@@ -504,6 +518,14 @@ export class ClaudeNativeAuthority {
         if (!context || !sameIdentity(before.identity, context.handoff.sourceIdentity) || !before.login) {
           return this.classify(operationId, session);
         }
+        // Claude Code must be running on the outgoing login before anything is written, or nothing here says
+        // what the handoff replaces; nothing is written yet, so the reservation is simply undone.
+        try { await session.proveEffectiveLogin(before.login); }
+        catch (error) {
+          if (!(error instanceof ClaudeNativeEffectiveAuthUnsupportedError)) throw error;
+          return this.settle(operationId, 'aborted', before.runningEffectiveAuth, 'unsupported_effective_auth',
+            error.reason);
+        }
         let outgoingProof: Awaited<ReturnType<IClaudeNativeLockedSession['verifyProfileIdentity']>>;
         try { outgoingProof = await session.verifyProfileIdentity(before, context.handoff.sourceIdentity); }
         catch {
@@ -518,8 +540,20 @@ export class ClaudeNativeAuthority {
         await this.prepare(operationId, loginId, prepared.plan.before, prepared.plan.after,
           outgoingProof.accessTokenDigest, prepared.plan.profile.accessTokenDigest,
           sealedOutgoing, before.runningEffectiveAuth);
-        session.writePreparedIfCurrent(prepared.plan);
-        return this.classify(operationId, session);
+        const written = session.writePreparedIfCurrent(prepared.plan);
+        if (written.kind !== 'written') return this.classify(operationId, session);
+        // Claude Code must now select the incoming login. Whatever keeps that from being proven -- its answer,
+        // a lost lock, a failed read -- is a failed proof: the exact outgoing bytes go back while the locks are
+        // provably still held and the handoff is aborted; if they cannot, the home is quarantined.
+        try { await session.proveEffectiveLogin(incomingLogin); }
+        catch (error) {
+          const reason = error instanceof ClaudeNativeEffectiveAuthUnsupportedError ? error.reason : null;
+          let restored = false;
+          try { restored = session.restorePreparedSource(prepared.plan); } catch { restored = false; }
+          return this.settle(operationId, restored ? 'aborted' : 'quarantined', written.snapshot.runningEffectiveAuth,
+            'unsupported_effective_auth', reason);
+        }
+        return this.classify(operationId, session, { targetProven: true });
       });
     } catch {
       const outcome = await this.reconcileOperation(operationId);

package/ts/classes.claudecodelocks.ts

@@ -17,8 +17,18 @@ interface IClaudeCodeLock {
 interface IHeldLock {
   lockfilePath: string;
   release: () => Promise<void>;
+  /** After how long another process may take this lock over when its time is not renewed. */
+  stale: number;
+  /** The lock directory as it was created for this hold: a takeover removes it and creates another. */
+  identity: { device: number; inode: number; birthtimeMs: number };
 }
 
+/**
+ * How much of a lock's stale time must remain when a lease is asserted. Everything a caller does after an
+ * assertion is a synchronous file write, so no other process can find the lock stale before it completes.
+ */
+const HOLD_MARGIN_MS = 2_000;
+
 export interface IClaudeCodeLocksOptions {
   /** How long an operation waits for a lock that Claude Code holds. */
   timeoutMs?: number;
@@ -26,6 +36,12 @@ export interface IClaudeCodeLocksOptions {
 
 /** The vendor locks may be lost while an awaited database operation is in flight. */
 export interface IClaudeCodeLockLease {
+  /**
+   * Proves, at this moment, that every lock is still this hold's: its directory is the one this hold created,
+   * and its time was renewed recently enough that no other process may take it over before a synchronous write
+   * that follows completes. A lock whose renewal stalled -- an event loop blocked past its update interval --
+   * fails this even when nobody has taken it yet.
+   */
   assertHeld(): void;
 }
 
@@ -134,6 +150,16 @@ export class ClaudeCodeLocks {
     const lease: IClaudeCodeLockLease = {
       assertHeld: () => {
         if (!active || compromised) throw new ClaudeCodeLockOutcomeUnknownError(false);
+        for (const lock of held) {
+          let current: plugins.fs.Stats;
+          try { current = plugins.fs.lstatSync(lock.lockfilePath); }
+          catch { throw new ClaudeCodeLockOutcomeUnknownError(false); }
+          if (!current.isDirectory() || current.dev !== lock.identity.device || current.ino !== lock.identity.inode
+            || current.birthtimeMs !== lock.identity.birthtimeMs
+            || Date.now() - current.mtimeMs > lock.stale - HOLD_MARGIN_MS) {
+            throw new ClaudeCodeLockOutcomeUnknownError(false);
+          }
+        }
       },
     };
     const releaseAll = async (): Promise<void> => {
@@ -189,7 +215,11 @@ export class ClaudeCodeLocks {
         const release = await lockfileArg.lock(lock.file, {
           lockfilePath: lock.lockfilePath, realpath: false, stale: lock.stale, update: lock.update, onCompromised: onCompromisedArg,
         });
-        heldArg.push({ lockfilePath: lock.lockfilePath, release });
+        let created: plugins.fs.Stats;
+        try { created = plugins.fs.lstatSync(lock.lockfilePath); }
+        catch (error) { await release().catch(() => undefined); throw error; }
+        heldArg.push({ lockfilePath: lock.lockfilePath, release, stale: lock.stale,
+          identity: { device: created.dev, inode: created.ino, birthtimeMs: created.birthtimeMs } });
       } catch (error) {
         if (errorCode(error) === 'ELOCKED') return lock;
         if (requireAllArg || !lock.bestEffort) {

package/ts/classes.claudenative.ts

@@ -6,9 +6,25 @@ import { claudeRequest } from './claudehttp.js';
 import { writeSecretFileAtomically } from './helpers.js';
 import { HarnessProcesses } from './classes.harnessprocesses.js';
 
-/** The private file and lock contract verified for this Claude Code release. */
-export const CLAUDE_NATIVE_HANDOFF_VERSION = '2.1.273';
+/**
+ * The earliest Claude Code whose native file contract this adapter writes: `.credentials.json` beside
+ * `.claude.json`, and the lock protocol and live credential pickup verified for 2.1.273 (hints.md).
+ */
+export const CLAUDE_NATIVE_MINIMUM_VERSION = '2.1.273';
+/**
+ * The releases whose lock table, live credential pickup and refresh compare-and-swap were read from their own
+ * bundle (hints.md). A Claude Code session may keep running in the home a handoff writes only when it runs one
+ * of these; an installed release above the floor that is not listed is proven by `claude auth status` instead,
+ * and only while no session runs in that home.
+ */
+export const CLAUDE_NATIVE_VERIFIED_RELEASES: readonly string[] = ['2.1.273', '2.1.282'];
+/**
+ * Token files Claude Code reads at fixed paths when no descriptor variable names one (2.1.282 `KI`, `YGn`):
+ * the remote container's hand-off of an OAuth token or an API key. Either one outranks the native login.
+ */
+const REMOTE_CREDENTIAL_FILES = ['/home/claude/.claude/remote/.oauth_token', '/home/claude/.claude/remote/.api_key'] as const;
 const MAX_NATIVE_FILE_BYTES = 4 * 1024 * 1024;
+const AUTH_STATUS_TIMEOUT_MS = 4_000;
 const MAX_PROCESS_CONTEXT_BYTES = 1024 * 1024;
 const PROFILE_TIMEOUT_MS = 10_000;
 const ACCOUNT_CACHES = [
@@ -19,7 +35,8 @@ const ACCOUNT_CACHES = [
 const CREDENTIAL_OVERRIDES = [
   'CLAUDE_CODE_OAUTH_TOKEN', 'CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR', 'ANTHROPIC_API_KEY',
   'ANTHROPIC_AUTH_TOKEN', 'ANTHROPIC_PROFILE', 'CLAUDE_CODE_USE_BEDROCK',
-  'CLAUDE_CODE_USE_VERTEX', 'CLAUDE_CODE_USE_FOUNDRY', 'ANTHROPIC_BASE_URL',
+  'CLAUDE_CODE_USE_VERTEX', 'CLAUDE_CODE_USE_FOUNDRY', 'CLAUDE_CODE_USE_ANTHROPIC_AWS',
+  'CLAUDE_CODE_USE_ANTHROPIC_GOOGLE_CLOUD', 'CLAUDE_CODE_USE_MANTLE', 'ANTHROPIC_BASE_URL',
   'ANTHROPIC_FEDERATION_RULE_ID', 'ANTHROPIC_ORGANIZATION_ID',
   'ANTHROPIC_IDENTITY_TOKEN_FILE', 'ANTHROPIC_IDENTITY_TOKEN', 'ANTHROPIC_WORKSPACE_ID',
   'ANTHROPIC_UNIX_SOCKET', 'CLAUDE_CODE_REMOTE', 'CLAUDE_CODE_SIMPLE',
@@ -37,8 +54,9 @@ export class ClaudeNativeEffectiveAuthUnsupportedError extends Error {
 
   constructor(public readonly reason: TAuthSwitchClaudeProofFailure) {
     super(reason === 'unsupported_release'
-      ? `Native Claude handoff requires Claude Code ${CLAUDE_NATIVE_HANDOFF_VERSION} for every active session.`
-      : `Cannot prove that Claude Code ${CLAUDE_NATIVE_HANDOFF_VERSION} uses its native claude.ai login (${reason}).`);
+      ? `Native Claude handoff requires Claude Code ${CLAUDE_NATIVE_MINIMUM_VERSION} or newer, and a session `
+        + `running in this home must run a verified release (${CLAUDE_NATIVE_VERIFIED_RELEASES.join(', ')}).`
+      : `Cannot prove that Claude Code uses its native claude.ai login (${reason}).`);
   }
 }
 
@@ -95,6 +113,20 @@ export type TClaudeNativePrepareResult =
 
 export interface IClaudeNativeLockedSession {
   readStable(): IClaudeNativeSnapshot;
+  /**
+   * Proves that Claude Code itself selects the native login of `expected` in this home. A verified release is
+   * proven by the adapter's own reading of its selector; any other release above the floor is asked through
+   * `claude auth status --json`, which names the organization and the account's email, the only account
+   * identifiers it reports. Throws `ClaudeNativeEffectiveAuthUnsupportedError` when it cannot be proven, and
+   * `ClaudeCodeLockOutcomeUnknownError` when the locks were lost while it asked.
+   */
+  proveEffectiveLogin(expected: IClaudeNativeLogin): Promise<void>;
+  /**
+   * Writes back the exact bytes a written plan replaced, while the locks that guarded the write are still held.
+   * True once both files read back as they were; false, writing nothing, when the pair is no longer exactly
+   * what the plan wrote.
+   */
+  restorePreparedSource(plan: IClaudeNativePreparedWrite): boolean;
   verifyProfileIdentity(snapshot: IClaudeNativeSnapshot,
     expected: IClaudeNativeIdentity): Promise<IClaudeNativeProfileProof>;
   prepareWrite(input: {
@@ -115,6 +147,12 @@ export interface IClaudeNativeLockedSession {
 export interface IClaudeNativeVersionProbe {
   installedVersion(): string;
   runningContexts(): readonly IClaudeNativeRunningContext[];
+  /**
+   * What `claude auth status --json` prints under `env`, whatever its exit code, or null when it does not
+   * answer. Asynchronous on purpose: it runs while the vendor locks are held, and their renewal timers must keep
+   * running.
+   */
+  authStatus(env: NodeJS.ProcessEnv): Promise<string | null>;
 }
 
 /** Only selector keys and paths, never a process's credential values, leave the /proc reader. */
@@ -171,8 +209,30 @@ const onlyDigests = (value: IClaudeNativeDigests): IClaudeNativeDigests => ({
 });
 const preparedWrites = new WeakMap<IClaudeNativePreparedWrite, {
   session: ClaudeNativeLockedSession; credentialRaw: string; configRaw: string;
-  originalConfigRaw: Buffer | null; targetAccessToken: string;
+  originalCredentialRaw: Buffer | null; originalConfigRaw: Buffer | null; targetAccessToken: string;
 }>();
+/** A written plan's original bytes, kept until the handoff proves the write or restores them. */
+const writtenPlans = new WeakMap<IClaudeNativePreparedWrite, {
+  session: ClaudeNativeLockedSession; credentialRaw: string; configRaw: string;
+  originalCredentialRaw: Buffer; originalConfigRaw: Buffer;
+}>();
+
+const parseClaudeVersion = (value: string): [number, number, number] | null => {
+  const match = /^(\d{1,6})\.(\d{1,6})\.(\d{1,6})$/.exec(value);
+  return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
+};
+const atLeast = (version: [number, number, number], minimum: [number, number, number]): boolean => {
+  for (let index = 0; index < 3; index++) {
+    if (version[index] !== minimum[index]) return version[index] > minimum[index];
+  }
+  return true;
+};
+
+/** Which proof applies to one operation: the adapter's own selector reading, or Claude Code's own answer. */
+interface IClaudeNativeSupport {
+  runningSessions: number;
+  proof: 'verified_release' | 'auth_status';
+}
 const sameIdentity = (left: IClaudeNativeIdentity, right: IClaudeNativeIdentity): boolean =>
   left.accountUuid === right.accountUuid && left.organizationUuid === right.organizationUuid;
 
@@ -303,6 +363,15 @@ const assertNoKnownNativeLoginOverride = (env: NodeJS.ProcessEnv, processRoot?:
   for (const key of CREDENTIAL_OVERRIDES) {
     if (env[key]) throw new ClaudeNativeEffectiveAuthUnsupportedError('override');
   }
+  for (const file of REMOTE_CREDENTIAL_FILES) {
+    try {
+      plugins.fs.lstatSync(processViewPath(file, processRoot));
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') continue;
+      throw new ClaudeNativeEffectiveAuthUnsupportedError('override');
+    }
+    throw new ClaudeNativeEffectiveAuthUnsupportedError('override');
+  }
   const configDir = env.ANTHROPIC_CONFIG_DIR?.trim()
     || (env.XDG_CONFIG_HOME?.trim()
       ? plugins.path.join(env.XDG_CONFIG_HOME.trim(), 'anthropic')
@@ -504,6 +573,20 @@ class ClaudeNativeVersionProbe implements IClaudeNativeVersionProbe {
     } catch { return 'unknown'; }
   }
 
+  public authStatus(env: NodeJS.ProcessEnv): Promise<string | null> {
+    // Well inside the shortest lock renewal window (the config lock renews every 5 s); it answers in ~200 ms.
+    return new Promise(resolve => {
+      const child = plugins.childProcess.execFile(this.executable, ['auth', 'status', '--json'], {
+        encoding: 'utf8', timeout: AUTH_STATUS_TIMEOUT_MS, maxBuffer: 64 * 1024, windowsHide: true, env,
+      }, (error, stdout) => {
+        // A logged-out status still prints its JSON and exits 1; only no answer at all is null.
+        const exited = error === null || typeof error.code === 'number';
+        resolve(exited && stdout ? stdout : null);
+      });
+      child.stdin?.end();
+    });
+  }
+
   public runningContexts(): readonly IClaudeNativeRunningContext[] {
     const contexts: IClaudeNativeRunningContext[] = [];
     // Keep candidates from every mount namespace: a bind mount can expose the same inode.
@@ -597,7 +680,7 @@ export class ClaudeNativeAdapter {
     this.platform = options.platform ?? process.platform;
   }
 
-  private assertSupported(): number {
+  private assertSupported(): IClaudeNativeSupport {
     if (this.platform !== 'linux') throw new Error('Native Claude handoff requires the verified Linux file backend.');
     const home = plugins.fs.lstatSync(this.options.configDir);
     if (!home.isDirectory() || home.isSymbolicLink() || home.uid !== process.getuid?.()
@@ -621,9 +704,12 @@ export class ClaudeNativeAdapter {
     for (const file of this.settingsFiles) {
       assertSettingsSelectNative(file);
     }
-    if (this.versionProbe.installedVersion() !== CLAUDE_NATIVE_HANDOFF_VERSION) {
+    const installedText = this.versionProbe.installedVersion();
+    const installed = parseClaudeVersion(installedText);
+    if (!installed || !atLeast(installed, parseClaudeVersion(CLAUDE_NATIVE_MINIMUM_VERSION)!)) {
       throw new ClaudeNativeEffectiveAuthUnsupportedError('unsupported_release');
     }
+    const installedVerified = CLAUDE_NATIVE_VERIFIED_RELEASES.includes(installedText);
     let runningSessions = 0;
     const nativeHomeIdentity = directoryIdentity(this.options.configDir);
     const configParentIdentity = directoryIdentity(configParent);
@@ -636,7 +722,9 @@ export class ClaudeNativeAdapter {
         || !sameDirectory(running.configParentIdentity, configParentIdentity)) {
         throw new ClaudeNativeEffectiveAuthUnsupportedError('running_session');
       }
-      if (running.version !== CLAUDE_NATIVE_HANDOFF_VERSION) {
+      // A session keeps taking its own locks and picking up the swapped login while the handoff runs, so
+      // it must be a release whose lock and pickup contract was read from its bundle.
+      if (running.version === null || !CLAUDE_NATIVE_VERIFIED_RELEASES.includes(running.version)) {
         throw new ClaudeNativeEffectiveAuthUnsupportedError('unsupported_release');
       }
       if (!running.env || !running.cwd || running.hasSettingsOverride === null
@@ -650,7 +738,34 @@ export class ClaudeNativeAdapter {
       assertProjectSettingsSelectNative(running.cwd, running.processRoot);
       runningSessions++;
     }
-    return runningSessions;
+    // An installed release nobody verified is proven by its own answer, which says nothing about how a session
+    // already running would take the locks or pick up the swap; it is written only while none runs here.
+    if (!installedVerified && runningSessions > 0) {
+      throw new ClaudeNativeEffectiveAuthUnsupportedError('unsupported_release');
+    }
+    return { runningSessions, proof: installedVerified ? 'verified_release' : 'auth_status' };
+  }
+
+  /**
+   * Claude Code's own account of the login it selects in this home: `claude auth status --json` under the
+   * adapter's environment. It must be the claude.ai login of `expected`, read from this home, with no API key.
+   */
+  private async proveEffectiveLogin(expected: IClaudeNativeLogin): Promise<void> {
+    if (this.assertSupported().proof === 'verified_release') return;
+    const organizationUuid = expected.oauthAccount.organizationUuid;
+    const email = typeof expected.oauthAccount.emailAddress === 'string' ? expected.oauthAccount.emailAddress : null;
+    const raw = await this.versionProbe.authStatus(this.env);
+    let status: unknown;
+    try { status = raw === null ? null : JSON.parse(raw); } catch { status = null; }
+    if (!isRecord(status) || typeof status.loggedIn !== 'boolean' || typeof status.authMethod !== 'string') {
+      throw new ClaudeNativeEffectiveAuthUnsupportedError('unsupported_release');
+    }
+    if (status.loggedIn !== true || status.authMethod !== 'claude.ai' || status.apiProvider !== 'firstParty'
+      || (status.apiKeySource !== undefined && status.apiKeySource !== null)
+      || status.configDirectory !== this.options.configDir || status.orgId !== organizationUuid
+      || (status.email ?? null) !== email) {
+      throw new ClaudeNativeEffectiveAuthUnsupportedError('override');
+    }
   }
 
   /** The caller keeps its NoSQLDB journal and both ownership transactions inside this callback. */
@@ -659,12 +774,13 @@ export class ClaudeNativeAdapter {
     return this.locks.holdAsync(async lease => {
       this.assertSupported();
       const session = new ClaudeNativeLockedSession(this.credentialFile, this.options.configFile,
-        this.fetcher, lease, () => this.assertSupported());
+        this.fetcher, lease, () => this.assertSupported().runningSessions,
+        expected => this.proveEffectiveLogin(expected));
       const firstSnapshot = session.readStable();
       const result = await action(session);
       try {
         lease.assertHeld();
-        const afterRunningSessions = this.assertSupported();
+        const afterRunningSessions = this.assertSupported().runningSessions;
         if (firstSnapshot.runningEffectiveAuth === 'no_scoped_sessions' && afterRunningSessions > 0) {
           throw new ClaudeNativeEffectiveAuthUnsupportedError('running_session');
         }
@@ -680,7 +796,34 @@ export class ClaudeNativeAdapter {
 class ClaudeNativeLockedSession implements IClaudeNativeLockedSession {
   constructor(private readonly credentialFile: string, private readonly configFile: string,
     private readonly fetcher: typeof fetch, private readonly lease: IClaudeCodeLockLease,
-    private readonly assertSupported: () => number) {}
+    private readonly assertSupported: () => number,
+    private readonly proveEffective: (expected: IClaudeNativeLogin) => Promise<void>) {}
+
+  public async proveEffectiveLogin(expected: IClaudeNativeLogin): Promise<void> {
+    this.lease.assertHeld();
+    await this.proveEffective(expected);
+    // Asserted after the answer, before anything is decided or written on it.
+    this.lease.assertHeld();
+  }
+
+  public restorePreparedSource(plan: IClaudeNativePreparedWrite): boolean {
+    this.lease.assertHeld();
+    const written = writtenPlans.get(plan);
+    if (!written || written.session !== this) throw new Error('Claude native write plan is not held by this lease.');
+    writtenPlans.delete(plan);
+    let current: ReturnType<typeof readPair>;
+    try { current = readPair(this.credentialFile, this.configFile); } catch { return false; }
+    if (!sameRaw(current.credentialRaw, Buffer.from(written.credentialRaw))
+      || !sameRaw(current.configRaw, Buffer.from(written.configRaw))) return false;
+    this.lease.assertHeld();
+    writeSecretFileAtomically(this.credentialFile, written.originalCredentialRaw.toString('utf8'));
+    writeSecretFileAtomically(this.configFile, written.originalConfigRaw.toString('utf8'));
+    this.lease.assertHeld();
+    const restored = readPair(this.credentialFile, this.configFile);
+    return sameRaw(restored.credentialRaw, written.originalCredentialRaw)
+      && sameRaw(restored.configRaw, written.originalConfigRaw)
+      && sameDigests(digests(restored), plan.before);
+  }
 
   private observation(): IClaudeNativeDigests | null {
     try { return digests(readPair(this.credentialFile, this.configFile)); }
@@ -811,7 +954,7 @@ class ClaudeNativeLockedSession implements IClaudeNativeLockedSession {
       targetIdentity: Object.freeze({ ...input.expectedIdentity }),
       profile: Object.freeze({ ...profile }),
     });
-    preparedWrites.set(plan, { session: this, credentialRaw, configRaw,
+    preparedWrites.set(plan, { session: this, credentialRaw, configRaw, originalCredentialRaw: original.credentialRaw,
       originalConfigRaw: original.configRaw, targetAccessToken: String(target.login.claudeAiOauth.accessToken) });
     return { kind: 'prepared', plan };
   }
@@ -864,6 +1007,10 @@ class ClaudeNativeLockedSession implements IClaudeNativeLockedSession {
         || plan.profile.accessTokenDigest !== hash(String(snapshot.login.claudeAiOauth.accessToken))) {
         return { kind: 'uncertain', reason: 'native_write_or_readback_failed', observed: onlyDigests(snapshot) };
       }
+      if (prepared.originalCredentialRaw !== null && prepared.originalConfigRaw !== null) {
+        writtenPlans.set(plan, { session: this, credentialRaw: prepared.credentialRaw, configRaw: prepared.configRaw,
+          originalCredentialRaw: prepared.originalCredentialRaw, originalConfigRaw: prepared.originalConfigRaw });
+      }
       return { kind: 'written', snapshot, profile: plan.profile };
     } catch {
       return { kind: 'uncertain', reason: 'native_write_or_readback_failed', observed: this.observation() };

package/ts/classes.cli.ts

@@ -372,11 +372,11 @@ ${bold('Environment')}
     const cancel = () => { cancelled = true; void handle?.cancel().catch(() => undefined); };
     process.on('SIGINT', cancel); process.on('SIGTERM', cancel);
     try {
-      handle = await harness.beginLogin({ providerId: provider.providerId, flow: provider.flows.includes('device') ? 'device' : provider.flows[0] });
+      handle = await harness.beginLogin({ providerId: provider.providerId, flow: 'device' });
       if (cancelled) await handle.cancel();
-      else if (handle.prompt.flow === 'device') {
+      else {
         process.stdout.write(`Open ${plainText(handle.prompt.verificationUrl)}\nCode: ${plainText(handle.prompt.userCode)}\nWaiting for login. Press Ctrl+C to cancel.\n`);
-      } else process.stdout.write(`Open ${plainText(handle.prompt.authUrl)}\nWaiting for login. Press Ctrl+C to cancel.\n`);
+      }
       return this.reportOutcome((await handle.completion).outcome);
     } finally {
       process.removeListener('SIGINT', cancel); process.removeListener('SIGTERM', cancel);