@oar-sh/oar 0.9.16 → 0.9.18

package/server/services/session-worker-launch-service.mjs

@@ -14,6 +14,11 @@ import {
   isOarMcpServerDisabled,
 } from '../mcp/oar-mcp-server.mjs';
 import { WORKER_LOG_FILE_ENV } from '../../shared/worker-runtime/worker-log-file.mjs';
+import {
+  HOST_CLAUDE_SESSION_ENV_VARS,
+  hostClaudeSessionUnsetStatement,
+  withoutHostClaudeSessionVariables,
+} from '../../shared/host-claude-session-env.mjs';
 import { missingWorkingDirectoryError } from '../../shared/worker-runtime/working-directory.mjs';
 import {
   describeSpawnEnvironment,
@@ -270,6 +275,70 @@ export function applyClaudeCloudProviderEnvironment(env = {}, {
   return next;
 }
 
+/**
+ * DeepSeek: the Claude worker's runner against DeepSeek's Anthropic-compatible
+ * endpoint (server/deepseek-worker/). The key travels as DEEPSEEK_API_KEY,
+ * through the secret file under tmux, and becomes the CLI's bearer token
+ * only inside its spawn environment (deepseek-claude-backend.mjs). The worker
+ * keeps its Claude Code state in a directory of its own, which holds no
+ * Claude login.
+ */
+export function applyDeepSeekProviderEnvironment(env = {}, {
+  enabled = false,
+  model = '',
+  apiKey = '',
+  baseUrl = '',
+  configDir = '',
+} = {}) {
+  const next = { ...env };
+  if (resolveWorkerKind(next) === 'deepseek') delete next.COPILOT_WEB_RELAY_WORKER_KIND;
+  delete next.DEEPSEEK_RELAY_MODEL;
+  delete next.DEEPSEEK_API_KEY;
+  delete next.DEEPSEEK_BASE_URL;
+  delete next.DEEPSEEK_CLAUDE_CONFIG_DIR;
+  if (!enabled) return next;
+  const normalizedApiKey = normalizeText(apiKey);
+  if (!normalizedApiKey) throw new Error('deepseek-api-key-not-configured');
+  const normalizedConfigDir = normalizeText(configDir);
+  if (!normalizedConfigDir) throw new Error('deepseek-config-dir-not-configured');
+  next.COPILOT_WEB_RELAY_WORKER_KIND = 'deepseek';
+  next.DEEPSEEK_API_KEY = normalizedApiKey;
+  next.DEEPSEEK_CLAUDE_CONFIG_DIR = path.resolve(normalizedConfigDir);
+  const normalizedModel = normalizeText(model);
+  if (normalizedModel) next.DEEPSEEK_RELAY_MODEL = normalizedModel;
+  const normalizedBaseUrl = normalizeText(baseUrl);
+  if (normalizedBaseUrl) next.DEEPSEEK_BASE_URL = normalizedBaseUrl;
+  return next;
+}
+
+/**
+ * Claude API: the Claude worker's runner on an API key from the Claude
+ * Console instead of the host's subscription login
+ * (server/claude-api-worker/). The key travels as OAR_CLAUDE_API_KEY, through
+ * the secret file under tmux, and becomes the CLI's ANTHROPIC_API_KEY only
+ * inside its spawn environment (claude-api-backend.mjs). The worker shares the
+ * host's Claude Code state directory with the Claude provider: transcripts,
+ * resume and task output are found where a Claude chat's are.
+ */
+export function applyClaudeApiProviderEnvironment(env = {}, {
+  enabled = false,
+  model = '',
+  apiKey = '',
+} = {}) {
+  const next = { ...env };
+  if (resolveWorkerKind(next) === 'claude-api') delete next.COPILOT_WEB_RELAY_WORKER_KIND;
+  delete next.CLAUDE_API_RELAY_MODEL;
+  delete next.OAR_CLAUDE_API_KEY;
+  if (!enabled) return next;
+  const normalizedApiKey = normalizeText(apiKey);
+  if (!normalizedApiKey) throw new Error('claude-api-key-not-configured');
+  next.COPILOT_WEB_RELAY_WORKER_KIND = 'claude-api';
+  next.OAR_CLAUDE_API_KEY = normalizedApiKey;
+  const normalizedModel = normalizeText(model);
+  if (normalizedModel) next.CLAUDE_API_RELAY_MODEL = normalizedModel;
+  return next;
+}
+
 /**
  * The Copilot SDK engine: the same `github`/`openai` providers the extension
  * serves, run as a plain Node worker against the CLI's headless runtime.
@@ -359,6 +428,14 @@ export function isClaudeCloudWorkerEnvironment(env = {}) {
   return resolveWorkerKind(env) === 'claude-cloud';
 }
 
+export function isDeepSeekWorkerEnvironment(env = {}) {
+  return resolveWorkerKind(env) === 'deepseek';
+}
+
+export function isClaudeApiWorkerEnvironment(env = {}) {
+  return resolveWorkerKind(env) === 'claude-api';
+}
+
 export function isCopilotSdkWorkerEnvironment(env = {}) {
   return resolveWorkerKind(env) === 'copilot-sdk';
 }
@@ -403,6 +480,26 @@ export function resolveClaudeCloudWorkerScriptPath(env = {}) {
   return path.join(process.cwd(), 'server', 'claude-cloud-worker', 'claude-cloud-session-worker.mjs');
 }
 
+export function resolveDeepSeekWorkerScriptPath(env = {}) {
+  const explicit = normalizeText(env?.COPILOT_WEB_RELAY_DEEPSEEK_WORKER_PATH);
+  if (explicit) return explicit;
+  const repoRoot = normalizeText(env?.COPILOT_WEB_RELAY_ROOT);
+  if (repoRoot) return path.join(repoRoot, 'server', 'deepseek-worker', 'deepseek-session-worker.mjs');
+  const serverDir = normalizeText(env?.COPILOT_WEB_RELAY_SERVER_DIR);
+  if (serverDir) return path.join(serverDir, 'deepseek-worker', 'deepseek-session-worker.mjs');
+  return path.join(process.cwd(), 'server', 'deepseek-worker', 'deepseek-session-worker.mjs');
+}
+
+export function resolveClaudeApiWorkerScriptPath(env = {}) {
+  const explicit = normalizeText(env?.COPILOT_WEB_RELAY_CLAUDE_API_WORKER_PATH);
+  if (explicit) return explicit;
+  const repoRoot = normalizeText(env?.COPILOT_WEB_RELAY_ROOT);
+  if (repoRoot) return path.join(repoRoot, 'server', 'claude-api-worker', 'claude-api-session-worker.mjs');
+  const serverDir = normalizeText(env?.COPILOT_WEB_RELAY_SERVER_DIR);
+  if (serverDir) return path.join(serverDir, 'claude-api-worker', 'claude-api-session-worker.mjs');
+  return path.join(process.cwd(), 'server', 'claude-api-worker', 'claude-api-session-worker.mjs');
+}
+
 export function resolveCopilotSdkWorkerScriptPath(env = {}) {
   const explicit = normalizeText(env?.COPILOT_WEB_RELAY_COPILOT_SDK_WORKER_PATH);
   if (explicit) return explicit;
@@ -431,6 +528,11 @@ const NODE_WORKER_DESCRIPTORS = Object.freeze({
     resolveScriptPath: resolveCopilotSdkWorkerScriptPath,
     windowsTitle: 'Copilot SDK Worker',
   }),
+  deepseek: Object.freeze({ resolveScriptPath: resolveDeepSeekWorkerScriptPath, windowsTitle: 'DeepSeek Worker' }),
+  'claude-api': Object.freeze({
+    resolveScriptPath: resolveClaudeApiWorkerScriptPath,
+    windowsTitle: 'Claude API Worker',
+  }),
 });
 
 function resolveNodeWorkerDescriptor(env = {}) {
@@ -469,7 +571,7 @@ function buildPosixWorkerLaunchCommand(targetSessionId, env = {}, extraCliArgs =
 // Server entry shape (the CLI's own `copilot mcp add` writes the same):
 // `{ type: 'local', command, args, env, tools: ['*'], timeout }`. `timeout` is
 // the per-call limit in ms; without it the CLI cuts a tool call off at 180 s,
-// shorter than one remote_relay wait.
+// shorter than one relay_tool wait.
 
 export function resolveOarMcpServerScriptPath(env = {}, { pathImpl = path } = {}) {
   const repoRoot = normalizeText(env?.COPILOT_WEB_RELAY_ROOT);
@@ -601,17 +703,49 @@ export function getTmuxPanePid(sessionName, {
   }
 }
 
-export const WORKER_SECRET_ENV_VARS = Object.freeze(['COPILOT_PROVIDER_API_KEY', 'CURSOR_API_KEY', 'CLAUDE_CODE_OAUTH_TOKEN']);
-
-// Secrets that are not every worker's. The two API keys are put into the
-// launch environment by their own provider's applier and cleared for every
-// other one, so they need no entry. The Claude login token is different: it
-// sits in the relay's own environment (a relay run on CLAUDE_CODE_OAUTH_TOKEN
-// instead of the CLI's credentials file), so it would otherwise travel with
-// every launch. Only the Claude Cloud worker gets it: its cloud client reads
-// the login from there exactly as the relay's does (credentials.mjs).
+export const WORKER_SECRET_ENV_VARS = Object.freeze([
+  'COPILOT_PROVIDER_API_KEY',
+  'CURSOR_API_KEY',
+  'CLAUDE_CODE_OAUTH_TOKEN',
+  'DEEPSEEK_API_KEY',
+  'OAR_CLAUDE_API_KEY',
+  'ANTHROPIC_API_KEY',
+  'ANTHROPIC_AUTH_TOKEN',
+]);
+
+// Secrets that are not every worker's: each entry names the kinds that get
+// it, and every other kind has it taken out of its launch environment on
+// every path (withoutForeignWorkerSecrets), and out of the tmux shell
+// (buildTmuxWorkerShellCommand). A secret with no entry is every kind's.
+//
+// - The two API keys without an entry are put into the launch environment by
+//   their own provider's applier and cleared for every other one.
+// - The Claude login token sits in the relay's own environment (a relay run on
+//   CLAUDE_CODE_OAUTH_TOKEN instead of the CLI's credentials file), so it
+//   would otherwise travel with every launch. Only the two workers of the
+//   host's own Claude account get it: the Claude Cloud worker's client reads
+//   the login from there exactly as the relay's does (credentials.mjs), and
+//   the Claude worker's CLI prefers it to the credentials file.
+// - The DeepSeek key is put there by its own applier, but the same name could
+//   also sit in the relay's environment (a shell that exports it); it is the
+//   DeepSeek worker's alone either way.
+// - The Claude API key is the Claude API worker's alone, the same way. It
+//   travels under a name of the relay's (OAR_CLAUDE_API_KEY), never as
+//   ANTHROPIC_API_KEY: the worker's CLI is the only process that gets it under
+//   that name (claude-api-backend.mjs), and a host's ANTHROPIC_API_KEY stays
+//   what it is below, no worker's.
+// - A host's ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN are no worker's (an
+//   empty list): Claude Code prefers either to the Claude login, so a Claude
+//   chat would run, and be billed, on a key nobody chose for it, and every
+//   other kind has no use for them. A key a provider saves in the relay's
+//   settings goes to its own kind under a name of its own, with an entry
+//   here naming that kind alone.
 const WORKER_SECRET_ENV_VAR_KINDS = Object.freeze({
-  CLAUDE_CODE_OAUTH_TOKEN: Object.freeze(['claude-cloud']),
+  CLAUDE_CODE_OAUTH_TOKEN: Object.freeze(['claude', 'claude-cloud']),
+  DEEPSEEK_API_KEY: Object.freeze(['deepseek']),
+  OAR_CLAUDE_API_KEY: Object.freeze(['claude-api']),
+  ANTHROPIC_API_KEY: Object.freeze([]),
+  ANTHROPIC_AUTH_TOKEN: Object.freeze([]),
 });
 
 /**
@@ -627,6 +761,29 @@ export function workerSecretEnvVarsFor(env = {}) {
   });
 }
 
+/**
+ * The launch environment without the secrets that are another kind's. They
+ * would otherwise reach the worker on the detached and Windows paths, which
+ * hand the environment over as it is, and under tmux through the environment
+ * a tmux server started by the launch keeps as its global one.
+ */
+export function withoutForeignWorkerSecrets(env = {}) {
+  const own = new Set(workerSecretEnvVarsFor(env));
+  const next = { ...env };
+  for (const key of WORKER_SECRET_ENV_VARS) {
+    if (!own.has(key)) delete next[key];
+  }
+  return next;
+}
+
+// The host Claude Code session's variables (a relay started from inside a
+// Claude Code session) are dropped from every launch path, for every kind:
+// the names and families are in shared/host-claude-session-env.mjs, with
+// what stays and why. Under tmux the worker's command unsets them again, by
+// family too, from whatever the tmux server's environment holds
+// (buildTmuxWorkerShellCommand).
+export { HOST_CLAUDE_SESSION_ENV_VARS, withoutHostClaudeSessionVariables };
+
 export function createWorkerSecretEnvFile(env = {}, {
   fsImpl = fs,
   tempRoot = os.tmpdir(),
@@ -697,6 +854,90 @@ export function prepareWorkerLogFile(targetSessionId, launchEnv = {}, {
   }
 }
 
+// What a tmux worker is handed as `export`s in its own shell command. These
+// are the values of one launch (the kind of worker, its model, its folder),
+// so they never go into the environment tmux itself is started with: a tmux
+// server started by a launch keeps that as its global environment, and every
+// later session on the server would inherit the first launch's values where
+// its own command exports none (launchSessionCli takes them out).
+export const TMUX_WORKER_EXPORTED_ENV_VARS = Object.freeze([
+  'COPILOT_ALLOW_ALL',
+  'GITHUB_COPILOT_PROMPT_MODE_EXTENSIONS',
+  'COPILOT_WEB_RELAY_ROOT',
+  'COPILOT_WEB_RELAY_SERVER_DIR',
+  'COPILOT_WEB_RELAY_CONFIG',
+  'COPILOT_WEB_RELAY_TOOLS',
+  'COPILOT_WEB_RELAY_LOG_DIR',
+  // The Cursor worker keeps its agent stores in the relay's data dir
+  // (applyCursorProviderEnvironment).
+  'COPILOT_WEB_RELAY_DATA_DIR',
+  'COPILOT_WEB_RELAY_CLI_EXECUTABLE',
+  'COPILOT_WEB_RELAY_EXTENSION_BOOTSTRAP_PATH',
+  'COPILOT_SDK_PATH',
+  'EXTENSION_PATH',
+  'COPILOT_PROVIDER_TYPE',
+  'COPILOT_PROVIDER_BASE_URL',
+  'COPILOT_PROVIDER_WIRE_API',
+  'COPILOT_MODEL',
+  'COPILOT_WEB_RELAY_WORKER_KIND',
+  // The SDK worker's own model and BYOK context overrides. `COPILOT_MODEL`
+  // above is the extension engine's model variable and is read by the CLI's
+  // startup layer; the SDK worker takes its default model from
+  // `COPILOT_RELAY_MODEL`, matching every other Node worker's
+  // `*_RELAY_MODEL`. Without it here the model would silently drop to the
+  // runtime default on the tmux path while working on the detached path,
+  // which inherits the whole environment.
+  'COPILOT_RELAY_MODEL',
+  'COPILOT_PROVIDER_MAX_PROMPT_TOKENS',
+  'COPILOT_PROVIDER_MAX_OUTPUT_TOKENS',
+  // Without this the tmux path would fall back to ~/.claude while the relay
+  // (and the detached spawn path, which inherits the full environment) uses
+  // the override — worker and relay would read different config roots.
+  'CLAUDE_CONFIG_DIR',
+  // Same divergence, one variable over: the relay binds a resolved `claude`
+  // binary onto its own environment (cli-install-service.mjs §4.3), and the
+  // detached path inherits it for free. Without it here a bound binary would
+  // be silently dropped on the tmux path and the worker would fall back to
+  // whatever `claude` PATH happens to resolve — exactly the failure mode
+  // CLAUDE_CONFIG_DIR above was added for. GROK_CLI_COMMAND, its Grok
+  // counterpart, has always been on this list.
+  'CLAUDE_CODE_EXECUTABLE',
+  'CLAUDE_RELAY_MODEL',
+  // The Claude Cloud worker's model. Its login is not listed here: the
+  // worker reads the CLI's credentials file (CLAUDE_CONFIG_DIR above tells
+  // it where), and a relay-level CLAUDE_CODE_OAUTH_TOKEN is a secret
+  // (workerSecretEnvVarsFor), so it comes through the secret file.
+  'CLAUDE_CLOUD_RELAY_MODEL',
+  // Tests point the relay's cloud client at a fake API on this machine;
+  // the worker's client has to follow, or the relay would talk to the fake
+  // and its worker to the real API. Not a secret, and harmless as a value:
+  // shared/claude-cloud/base-url.mjs ignores everything but a loopback URL.
+  'OAR_CLAUDE_CLOUD_API_BASE_URL',
+  'CURSOR_RELAY_MODEL',
+  'CURSOR_AGENT_STORE_DIR',
+  // The DeepSeek worker's model, endpoint and Claude Code state directory.
+  // Its key is a secret (workerSecretEnvVarsFor) and comes through the file.
+  'DEEPSEEK_RELAY_MODEL',
+  'DEEPSEEK_BASE_URL',
+  'DEEPSEEK_CLAUDE_CONFIG_DIR',
+  // The Claude API worker's model; its key comes through the file like
+  // DeepSeek's. Tests point the worker's CLI at a fake Anthropic API on this
+  // machine the way they point the cloud client (shared/anthropic-api.mjs
+  // takes a loopback URL only, and so does the worker).
+  'CLAUDE_API_RELAY_MODEL',
+  'OAR_ANTHROPIC_API_BASE_URL',
+  'GROK_RELAY_MODEL',
+  'GROK_CLI_COMMAND',
+  'GROK_ALWAYS_APPROVE',
+  // The OAR MCP server kill switch (the Grok worker reads it too), and the
+  // extension engine's "it is attached" marker.
+  'OAR_MCP_SERVER',
+  'OAR_MCP_SERVER_ATTACHED',
+  'SESSION_ID',
+  'COPILOT_WORKSPACE_ROOT',
+  'INIT_CWD',
+]);
+
 export function buildTmuxWorkerShellCommand(targetSessionId, env = {}, {
   secretEnvFilePath = '',
   workerLogPath = '',
@@ -715,80 +956,41 @@ export function buildTmuxWorkerShellCommand(targetSessionId, env = {}, {
     throw new Error('worker-secret-env-file-required');
   }
   const exports = [];
-  for (const key of [
-    'COPILOT_ALLOW_ALL',
-    'GITHUB_COPILOT_PROMPT_MODE_EXTENSIONS',
-    'COPILOT_WEB_RELAY_ROOT',
-    'COPILOT_WEB_RELAY_SERVER_DIR',
-    'COPILOT_WEB_RELAY_CONFIG',
-    'COPILOT_WEB_RELAY_TOOLS',
-    'COPILOT_WEB_RELAY_LOG_DIR',
-    // The Cursor worker keeps its agent stores in the relay's data dir
-    // (applyCursorProviderEnvironment).
-    'COPILOT_WEB_RELAY_DATA_DIR',
-    'COPILOT_WEB_RELAY_CLI_EXECUTABLE',
-    'COPILOT_WEB_RELAY_EXTENSION_BOOTSTRAP_PATH',
-    'COPILOT_SDK_PATH',
-    'EXTENSION_PATH',
-    'COPILOT_PROVIDER_TYPE',
-    'COPILOT_PROVIDER_BASE_URL',
-    'COPILOT_PROVIDER_WIRE_API',
-    'COPILOT_MODEL',
-    'COPILOT_WEB_RELAY_WORKER_KIND',
-    // The SDK worker's own model and BYOK context overrides. `COPILOT_MODEL`
-    // above is the extension engine's model variable and is read by the CLI's
-    // startup layer; the SDK worker takes its default model from
-    // `COPILOT_RELAY_MODEL`, matching every other Node worker's
-    // `*_RELAY_MODEL`. Without it here the model would silently drop to the
-    // runtime default on the tmux path while working on the detached path,
-    // which inherits the whole environment.
-    'COPILOT_RELAY_MODEL',
-    'COPILOT_PROVIDER_MAX_PROMPT_TOKENS',
-    'COPILOT_PROVIDER_MAX_OUTPUT_TOKENS',
-    // Without this the tmux path would fall back to ~/.claude while the relay
-    // (and the detached spawn path, which inherits the full environment) uses
-    // the override — worker and relay would read different config roots.
-    'CLAUDE_CONFIG_DIR',
-    // Same divergence, one variable over: the relay binds a resolved `claude`
-    // binary onto its own environment (cli-install-service.mjs §4.3), and the
-    // detached path inherits it for free. Without it here a bound binary would
-    // be silently dropped on the tmux path and the worker would fall back to
-    // whatever `claude` PATH happens to resolve — exactly the failure mode
-    // CLAUDE_CONFIG_DIR above was added for. GROK_CLI_COMMAND, its Grok
-    // counterpart, has always been on this list.
-    'CLAUDE_CODE_EXECUTABLE',
-    'CLAUDE_RELAY_MODEL',
-    // The Claude Cloud worker's model. Its login is not listed here: the
-    // worker reads the CLI's credentials file (CLAUDE_CONFIG_DIR above tells
-    // it where), and a relay-level CLAUDE_CODE_OAUTH_TOKEN is a secret
-    // (workerSecretEnvVarsFor), so it comes through the secret file.
-    'CLAUDE_CLOUD_RELAY_MODEL',
-    // Tests point the relay's cloud client at a fake API on this machine;
-    // the worker's client has to follow, or the relay would talk to the fake
-    // and its worker to the real API. Not a secret, and harmless as a value:
-    // shared/claude-cloud/base-url.mjs ignores everything but a loopback URL.
-    'OAR_CLAUDE_CLOUD_API_BASE_URL',
-    'CURSOR_RELAY_MODEL',
-    'CURSOR_AGENT_STORE_DIR',
-    'GROK_RELAY_MODEL',
-    'GROK_CLI_COMMAND',
-    'GROK_ALWAYS_APPROVE',
-    // The OAR MCP server kill switch (the Grok worker reads it too), and the
-    // extension engine's "it is attached" marker.
-    'OAR_MCP_SERVER',
-    'OAR_MCP_SERVER_ATTACHED',
-    'SESSION_ID',
-    'COPILOT_WORKSPACE_ROOT',
-    'INIT_CWD',
-  ]) {
+  const exported = new Set();
+  for (const key of TMUX_WORKER_EXPORTED_ENV_VARS) {
     const value = String(launchEnv?.[key] || '').trim();
     if (!value) continue;
     exports.push(`${key}=${shellQuote(value)}`);
+    exported.add(key);
   }
+  // A new tmux session starts from the server's global environment, which is
+  // the environment the server was started with: tmux takes the environment
+  // of `new-session` only when it starts the server. So the cleaning of that
+  // environment (launchSessionCli) reaches a worker only on the first launch;
+  // a server that was started from inside a Claude Code session, or by an
+  // older relay, hands every later worker the host session's variables and
+  // the first launch's values. The command therefore unsets, before anything
+  // else, the host session's variables and every per-launch variable this
+  // launch exports no value for (unset of an absent name is a no-op in sh).
+  // With them the worker log file a relay started from inside a worker
+  // session inherited, and every secret this launch carries no value for —
+  // other kinds' and its own alike — which a tmux server started from a shell
+  // that exports them keeps: names only. The worker's own secrets come
+  // through the secret file alone, sourced after the unset, so a key the
+  // launch does carry is restored from there. A second statement then unsets
+  // every variable of the host session's families the shell holds, names a
+  // fixed list would miss included.
+  const ownSecrets = new Set(workerSecretEnvVarsFor(launchEnv));
+  const unset = [
+    ...HOST_CLAUDE_SESSION_ENV_VARS,
+    WORKER_LOG_FILE_ENV,
+    ...TMUX_WORKER_EXPORTED_ENV_VARS.filter((key) => !exported.has(key)),
+    ...WORKER_SECRET_ENV_VARS.filter((key) => !ownSecrets.has(key) || !String(launchEnv?.[key] ?? '').trim()),
+  ];
   // `sh -lc` builds PATH from the login profile, not from the relay's; the
   // relay's Node folder goes at its end when it is not on it (see
   // appendNodeDirectoryToPath).
-  const statements = exports.map((entry) => `export ${entry};`);
+  const statements = [`unset ${unset.join(' ')};`, hostClaudeSessionUnsetStatement(), ...exports.map((entry) => `export ${entry};`)];
   const nodeDirectory = resolveWorkerNodeDirectory(launchEnv);
   if (nodeDirectory) {
     const quotedDir = shellQuote(nodeDirectory);
@@ -971,10 +1173,13 @@ export async function launchSessionCli({
     workspaceRoot: launchWorkspaceRoot,
     env,
   });
-  const launchSessionEnv = {
+  // Every path below starts from this environment, so a secret that is not
+  // this kind's, and the host Claude Code session's variables, are gone
+  // before any of them sees it.
+  const launchSessionEnv = withoutHostClaudeSessionVariables(withoutForeignWorkerSecrets({
     ...appendNodeDirectoryToPath(launchEnv, resolveWorkerNodeDirectory(launchEnv, { platform }), { platform }),
     SESSION_ID: target,
-  };
+  }));
   const explain = (message) => {
     try { log?.(`worker launcher: session=${target.slice(0, 8)} ${message}`); } catch {}
   };
@@ -982,7 +1187,7 @@ export async function launchSessionCli({
   // Set per launch below, never inherited: a relay started from inside a
   // worker session would otherwise hand its workers that session's log.
   delete launchSessionEnv[WORKER_LOG_FILE_ENV];
-  // The extension engine gets the OAR MCP server (remote_relay + preview) the
+  // The extension engine gets the OAR MCP server (relay_tool + preview) the
   // node workers carry in-process; every launch path appends the same args.
   const extensionCliArgs = resolveNodeWorkerDescriptor(launchSessionEnv)
     ? []
@@ -1007,9 +1212,14 @@ export async function launchSessionCli({
     const tmuxEnv = { ...launchSessionEnv };
     delete tmuxEnv.TMUX;
     delete tmuxEnv.TMUX_PANE;
-    // What the secret file carries is in no environment tmux is started with
-    // (a tmux server started by this call would keep it as its global one).
-    for (const key of workerSecretEnvVarsFor(launchSessionEnv)) delete tmuxEnv[key];
+    // No secret is in the environment tmux is started with (a tmux server
+    // started by this call would keep it as its global one): this kind's go
+    // through the secret file, the others are already gone. Nor is anything
+    // of this launch alone (worker kind, model, folder): the shell command
+    // exports those per session.
+    for (const key of WORKER_SECRET_ENV_VARS) delete tmuxEnv[key];
+    for (const key of TMUX_WORKER_EXPORTED_ENV_VARS) delete tmuxEnv[key];
+    delete tmuxEnv.PWD;
     if (allowProcessReuse) {
       const existingPanePid = getTmuxPanePid(sessionName, { execFileSyncImpl });
       if (existingPanePid && isPidAlive(existingPanePid)) {

package/server/services/session-worker-registry-service.mjs

@@ -61,6 +61,16 @@ function normalizeStatus(value) {
 }
 
 const STEERING_HOLD_REASONS = new Set(['question', 'compaction', 'adoption', 'delivery', 'tool', 'other']);
+// What keeps a Claude worker's CLI from being released for a billing swap.
+const STEERING_RELEASE_HOLDS = new Set(['question', 'compaction', 'turn', 'background']);
+const WORKER_KIND_PATTERN = /^[a-z][a-z0-9-]{0,31}$/;
+
+// The kind a worker says it is ("claude", "claude-api", "deepseek", ...):
+// lower case, short, or null when it did not say.
+export function normalizeWorkerKind(value) {
+  const kind = String(value || '').trim().toLowerCase();
+  return WORKER_KIND_PATTERN.test(kind) ? kind : null;
+}
 const STEERING_MESSAGE_ID_MAX_LENGTH = 64;
 const STEERING_CANCELLABLE_IDS_MAX = 50;
 
@@ -122,6 +132,15 @@ export function normalizeWorkerSteeringSnapshot(raw) {
   // Only a snapshot that reports a running CLI carries the key.
   const autoCompactWindow = normalizeSteeringAutoCompactWindow(raw.autoCompactWindow);
   if (autoCompactWindow) snapshot.autoCompactWindow = autoCompactWindow;
+  // Whether the relay may replace the worker now (a Claude billing swap), and
+  // what holds it when not. Only a worker that reports it carries the keys.
+  if (typeof raw.releasable === 'boolean') {
+    snapshot.releasable = raw.releasable;
+    const hold = String(raw.releaseHold || '').trim().toLowerCase();
+    snapshot.releaseHold = !raw.releasable && STEERING_RELEASE_HOLDS.has(hold) ? hold : null;
+    const tasks = Number(raw.backgroundTaskCount);
+    snapshot.backgroundTaskCount = Number.isInteger(tasks) && tasks > 0 ? Math.min(tasks, 999) : 0;
+  }
   return snapshot;
 }
 
@@ -140,6 +159,7 @@ function sanitizeState(raw = null) {
     retryCount: toNonNegativeInt(base.retryCount, 0),
     lastError: String(base.lastError || '').trim() || null,
     steering: normalizeWorkerSteeringSnapshot(base.steering),
+    kind: normalizeWorkerKind(base.kind),
     updatedAt: normalizeTimestamp(base.updatedAt, nowIso),
     createdAt,
   };
@@ -244,7 +264,14 @@ export function createSessionWorkerRegistry() {
     // the old entry into every upsert, so without this a crashed worker's
     // hold outlived it and the composer showed it until a replacement
     // heartbeated — indefinitely, if none ever did.
-    if (existing && isWorkerReplacedOrGone(existing, next)) next.steering = null;
+    // The kind is the same: a process's own word. An upsert that does not
+    // state it keeps the known one, unless the process it described is gone.
+    const statesKind = Object.prototype.hasOwnProperty.call(rawState, 'kind');
+    if (!statesKind) next.kind = existing?.kind || null;
+    if (existing && isWorkerReplacedOrGone(existing, next)) {
+      next.steering = null;
+      if (!statesKind) next.kind = null;
+    }
     clearIndexesForSession(existing);
     bySession.set(state.sdkSessionId, next);
     updateIndexesForSession(next);

package/server/services/session-worker-websocket-service.mjs

@@ -108,6 +108,9 @@ export function createSessionWorkerWebSocketService({
   onDeliverySendFailed = async () => {},
   onWorkerSocketClosed = async () => {},
   requestWork = async () => null,
+  // A worker stated its kind ("claude", "claude-api", ...) in a hello or a
+  // ready: (sessionId, kind, pid). The registry keeps it.
+  onWorkerKind = () => {},
   // Liveness probe for a socket's worker process. A killed worker's socket
   // survives its process by an event-loop turn (the kill path blocks the loop,
   // so this service's timer runs before the socket close lands), and asking for
@@ -233,6 +236,15 @@ export function createSessionWorkerWebSocketService({
     }
   }
 
+  // The kind a hello or ready states, kept on the socket (a process does not
+  // change kind) and reported once per change.
+  function noteWorkerKind(meta, payload) {
+    const kind = String(payload?.kind || '').trim().toLowerCase();
+    if (!/^[a-z][a-z0-9-]{0,31}$/.test(kind) || meta.workerKind === kind) return;
+    meta.workerKind = kind;
+    try { onWorkerKind(meta.sessionId, kind, meta.pid); } catch {}
+  }
+
   function noteHeartbeat(meta, reason = 'worker-message') {
     if (!meta?.sessionId) return;
     try {
@@ -258,6 +270,9 @@ export function createSessionWorkerWebSocketService({
         sessionId: meta.sessionId,
         pid: meta.pid,
         reason,
+        // What this socket's worker said it is: a Claude chat's row goes only
+        // to a worker of its billing.
+        workerKind: meta.workerKind || null,
       });
       touchCli();
       if (!pending || typeof pending !== 'object') return false;
@@ -404,6 +419,7 @@ export function createSessionWorkerWebSocketService({
       if (payload.type === 'worker.hello') {
         if (!bindSocketIdentity(ws, meta, payload)) return;
         meta.lastSeenAtMs = nowMsSafe();
+        noteWorkerKind(meta, payload);
         // A worker holding deliveries (open question card, compaction) binds
         // its identity with hello but must not be handed work.
         meta.ready = payload.ready !== false;
@@ -423,6 +439,7 @@ export function createSessionWorkerWebSocketService({
       if (payload.type === 'worker.ready') {
         if (!bindSocketIdentity(ws, meta, payload)) return;
         meta.lastSeenAtMs = nowMsSafe();
+        noteWorkerKind(meta, payload);
         meta.ready = true;
         meta.lastReadyAt = nowIso();
         noteHeartbeat(meta, String(payload.reason || 'worker-ready'));