@ours.network/fleet 1.2.0-nightly.5 → 1.2.0-nightly.51

package/dist/spawn.js

@@ -1,5 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { storeRoomSecret, storeTemporaryLaunch, preparePermanentAssignment } from './agent-ours/service.js';
+import { ensureWorkspace } from './rooms-tasks/workspace.js';
 import { spawn as spawnChild } from 'node:child_process';
 import { closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -321,6 +322,12 @@ export async function spawnTemp(o, binPath, launch = independentSupervisor, crea
     if (o.isolationFile)
         readIsolationFile(o.isolationFile); // fail before reserving
     const prepared = resolvedSpawn(o); // canonical validation before mutation
+    if (o.roomMemberStartup?.workspace) {
+        const workspace = o.roomMemberStartup.workspace;
+        if (prepared.role.cwd !== workspace.path)
+            throw new Error('room member cwd must equal its recorded owned workspace');
+        ensureWorkspace(workspace);
+    }
     // Retire only supervisors whose recorded owner is definitively stopped. This
     // bounded pass keeps the active roster clean without deleting old evidence.
     await reclaimStaleTempState();
@@ -351,7 +358,7 @@ async function spawnTempInner(o, preparedRole, binPath, launch, tx, onStage) {
     if (role.roomMemberStartup)
         role.roomMemberStartup = { ...role.roomMemberStartup, invite: '' };
     onStage?.('writing_role');
-    const dir = applyRole(role, { temp: true, identityGuarantee: 'unverified' });
+    const dir = applyRole(role, { temp: true, identityGuarantee: 'unverified', configPath: o.configPath });
     const provenance = buildProvenance({
         role: o.name, lifetime: 'temporary', fleetVersion: VERSION,
         settings: provenanceSettings(o, cfg.defaults, preparedRole.temporaryLoops),

package/dist/startup-readiness.d.ts

@@ -0,0 +1,13 @@
+import { type DaemonGenerationProbe } from './daemon-recovery.js';
+export declare const STARTUP_WAIT_MS = 240000;
+export declare const STARTUP_RETRY_MS = 5000;
+interface ReadinessDeps {
+    probe(env: NodeJS.ProcessEnv): Promise<DaemonGenerationProbe>;
+    now(): number;
+    sleep(ms: number): Promise<void>;
+    log(message: string): void;
+    env: NodeJS.ProcessEnv;
+}
+/** Read-only preflight: never binds identities, starts a harness or edits its ledger. */
+export declare function waitForRoleDaemon(name: string, configPath?: string, partial?: Partial<ReadinessDeps>): Promise<void>;
+export {};

package/dist/startup-readiness.js

@@ -0,0 +1,38 @@
+import { agentDir } from './paths.js';
+import { findRole, loadConfig } from './config.js';
+import { resolveConfigPath } from './runner.js';
+import { probeDaemonGeneration } from './daemon-recovery.js';
+export const STARTUP_WAIT_MS = 240_000;
+export const STARTUP_RETRY_MS = 5_000;
+/** Read-only preflight: never binds identities, starts a harness or edits its ledger. */
+export async function waitForRoleDaemon(name, configPath, partial = {}) {
+    const deps = {
+        probe: env => probeDaemonGeneration(((url, init) => globalThis.fetch(url, {
+            ...init, signal: AbortSignal.timeout(10_000),
+        })), env),
+        now: Date.now,
+        sleep: ms => new Promise(resolve => setTimeout(resolve, ms)),
+        log: message => process.stderr.write(message + '\n'),
+        env: process.env,
+        ...partial,
+    };
+    const path = resolveConfigPath(agentDir(name), configPath);
+    const role = findRole(loadConfig(path), name);
+    const env = { ...deps.env, ...role.env };
+    const deadline = deps.now() + STARTUP_WAIT_MS;
+    let lastReason = '';
+    while (deps.now() < deadline) {
+        const result = await deps.probe(env);
+        if (result.state === 'ready') {
+            deps.log(`[${name}] daemon ready; starting supervised agent`);
+            return;
+        }
+        // Only structured diagnostic codes, never endpoint responses or credentials.
+        const reason = /^[A-Z][A-Z0-9_]*$/.test(result.reason) ? result.reason : 'DAEMON_UNAVAILABLE';
+        if (reason !== lastReason)
+            deps.log(`[${name}] waiting for configured daemon: ${reason}`);
+        lastReason = reason;
+        await deps.sleep(Math.min(STARTUP_RETRY_MS, Math.max(0, deadline - deps.now())));
+    }
+    throw new Error(`Daemon not ready (${lastReason}); service manager will retry startup`);
+}

package/dist/subscriptions/cli.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Thin adapters over the official CLIs. Nothing here reads or returns a token
+ * value: credentials stay in files the CLIs own, and secrets typed by the user
+ * (a Claude paste code) travel only over a child's stdin, never argv or logs.
+ */
+export interface SubscriptionBinaries {
+    claude: string;
+    codex: string;
+    /** `script(1)`, used to give `claude auth login` the terminal it expects. */
+    script: string;
+}
+export declare const defaultBinaries: () => SubscriptionBinaries;
+/**
+ * Child env for a profile helper: explicit home for added profiles, the CLI
+ * default otherwise. Every credential selector either CLI honours is removed,
+ * so a helper can only ever see the profile's own login.
+ */
+export declare function profileEnv(homeVar: string, profileId: string, home: string, base?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export interface ClaudeStatus {
+    loggedIn: boolean;
+    email?: string;
+    plan?: string;
+    org?: string;
+    authMethod?: string;
+}
+/** `claude auth status --json` (documented: exit 0 when logged in, 1 otherwise). */
+export declare function claudeAuthStatus(bin: string, env: NodeJS.ProcessEnv, timeoutMs?: number): Promise<ClaudeStatus>;
+/**
+ * Login expiry timestamps from the Claude credentials file. Field names are
+ * observed (Claude Code 2.1.x), not a documented contract, so absence is normal.
+ * Only the two numbers are kept; the parsed object is discarded immediately.
+ */
+export declare function claudeLoginExpiry(home: string): {
+    accessExpiresAt?: number;
+    refreshExpiresAt?: number;
+};
+/** Minimal stdio JSON-RPC client for `codex app-server` (the supported transport). */
+export declare class CodexAppServer {
+    private readonly child;
+    private id;
+    private buffer;
+    private readonly pending;
+    private readonly listeners;
+    private closed;
+    private constructor();
+    static start(bin: string, env: NodeJS.ProcessEnv, initializeTimeoutMs?: number): Promise<CodexAppServer>;
+    call<T = unknown>(method: string, params: unknown, timeoutMs?: number): Promise<T>;
+    onNotification(fn: (method: string, params: unknown) => void): () => void;
+    close(): void;
+    private onData;
+}
+/** One-shot use of an app-server for a profile. */
+export declare function withCodex<T>(bin: string, env: NodeJS.ProcessEnv, fn: (s: CodexAppServer) => Promise<T>, initializeTimeoutMs?: number): Promise<T>;
+/** What a Codex runtime offers the account it is signed in to. An empty list is an answer; unknown is not. */
+export type OfferedModels = {
+    state: 'known';
+    models: string[];
+} | {
+    state: 'unknown';
+    reason: string;
+};
+/**
+ * Ask this Codex executable, with this profile's environment, which models it offers (`model/list`,
+ * the call the ACP adapter itself uses). Nothing is inferred when it does not answer.
+ */
+export declare function codexOfferedModels(bin: string, env: NodeJS.ProcessEnv, budgetMs?: number): Promise<OfferedModels>;
+export interface UsageWindow {
+    id: string;
+    label: string;
+    usedPercent: number;
+    windowMins?: number;
+    resetsAt?: string;
+}
+interface CodexWindow {
+    usedPercent?: number;
+    windowDurationMins?: number | null;
+    resetsAt?: number | null;
+}
+interface CodexSnapshot {
+    limitId?: string | null;
+    limitName?: string | null;
+    primary?: CodexWindow | null;
+    secondary?: CodexWindow | null;
+}
+/** Flatten `account/rateLimits/read` into display windows. */
+export declare function codexUsageWindows(result: {
+    rateLimits?: CodexSnapshot;
+    rateLimitsByLimitId?: Record<string, CodexSnapshot | undefined> | null;
+}): UsageWindow[];
+export declare function windowName(mins?: number): string;
+export {};

package/dist/subscriptions/cli.js

@@ -0,0 +1,223 @@
+import { spawn } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { CONFLICTING_AUTH_ENV } from './launch.js';
+import { DEFAULT_PROFILE_ID } from './store.js';
+export const defaultBinaries = () => ({
+    claude: process.env.OURS_FLEET_CLAUDE_BIN ?? 'claude',
+    codex: process.env.OURS_FLEET_CODEX_BIN ?? 'codex',
+    script: 'script',
+});
+/**
+ * Child env for a profile helper: explicit home for added profiles, the CLI
+ * default otherwise. Every credential selector either CLI honours is removed,
+ * so a helper can only ever see the profile's own login.
+ */
+export function profileEnv(homeVar, profileId, home, base = process.env) {
+    const env = { ...base, BROWSER: 'true', NO_COLOR: '1' };
+    for (const key of [...CONFLICTING_AUTH_ENV.claude, ...CONFLICTING_AUTH_ENV.codex, 'ANTHROPIC_BASE_URL', 'OPENAI_BASE_URL'])
+        delete env[key];
+    if (profileId !== DEFAULT_PROFILE_ID)
+        env[homeVar] = home;
+    return env;
+}
+/** `claude auth status --json` (documented: exit 0 when logged in, 1 otherwise). */
+export function claudeAuthStatus(bin, env, timeoutMs = 20_000) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(bin, ['auth', 'status', '--json'], { env, stdio: ['ignore', 'pipe', 'ignore'] });
+        let out = '';
+        const timer = setTimeout(() => { child.kill('SIGKILL'); reject(new Error('claude auth status timed out')); }, timeoutMs);
+        child.stdout.on('data', d => { out += d; if (out.length > 64 * 1024)
+            child.kill('SIGKILL'); });
+        child.once('error', error => { clearTimeout(timer); reject(error); });
+        child.once('close', code => {
+            clearTimeout(timer);
+            let parsed = {};
+            try {
+                parsed = JSON.parse(out);
+            }
+            catch { /* non-JSON: rely on exit code */ }
+            const str = (v) => typeof v === 'string' && v ? v.slice(0, 120) : undefined;
+            resolve({
+                loggedIn: code === 0 && parsed.loggedIn !== false,
+                email: str(parsed.email), plan: str(parsed.subscriptionType), org: str(parsed.orgName),
+                authMethod: str(parsed.authMethod),
+            });
+        });
+    });
+}
+/**
+ * Login expiry timestamps from the Claude credentials file. Field names are
+ * observed (Claude Code 2.1.x), not a documented contract, so absence is normal.
+ * Only the two numbers are kept; the parsed object is discarded immediately.
+ */
+export function claudeLoginExpiry(home) {
+    try {
+        const oauth = JSON.parse(readFileSync(join(home, '.credentials.json'), 'utf8')).claudeAiOauth;
+        const num = (v) => typeof v === 'number' && Number.isFinite(v) ? v : undefined;
+        return { accessExpiresAt: num(oauth?.expiresAt), refreshExpiresAt: num(oauth?.refreshTokenExpiresAt) };
+    }
+    catch {
+        return {};
+    }
+}
+/** Minimal stdio JSON-RPC client for `codex app-server` (the supported transport). */
+export class CodexAppServer {
+    child;
+    id = 0;
+    buffer = '';
+    pending = new Map();
+    listeners = new Set();
+    closed = false;
+    constructor(child) {
+        this.child = child;
+        child.stdout.on('data', chunk => this.onData(String(chunk)));
+        child.stdin.on('error', () => { });
+        child.stderr.resume();
+        child.once('close', () => {
+            this.closed = true;
+            for (const p of this.pending.values())
+                p.reject(new Error('codex app-server exited'));
+            this.pending.clear();
+        });
+    }
+    static async start(bin, env, initializeTimeoutMs = 20_000) {
+        const child = spawn(bin, ['app-server'], { env, stdio: ['pipe', 'pipe', 'pipe'] });
+        await new Promise((resolve, reject) => { child.once('spawn', resolve); child.once('error', reject); });
+        const server = new CodexAppServer(child);
+        // A server that does not answer is not handed out, so nobody else can close it: end it here.
+        try {
+            await server.call('initialize', { clientInfo: { name: 'ours-fleet', title: 'Ours Fleet', version: '1' } }, initializeTimeoutMs);
+        }
+        catch (error) {
+            server.close();
+            throw error;
+        }
+        child.stdin.write(`${JSON.stringify({ method: 'initialized' })}\n`);
+        return server;
+    }
+    call(method, params, timeoutMs = 20_000) {
+        if (this.closed)
+            return Promise.reject(new Error('codex app-server exited'));
+        const id = ++this.id;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => { this.pending.delete(id); reject(new Error(`${method} timed out`)); }, timeoutMs);
+            this.pending.set(id, {
+                resolve: v => { clearTimeout(timer); resolve(v); },
+                reject: e => { clearTimeout(timer); reject(e); },
+            });
+            this.child.stdin.write(`${JSON.stringify({ id, method, params })}\n`);
+        });
+    }
+    onNotification(fn) {
+        this.listeners.add(fn);
+        return () => this.listeners.delete(fn);
+    }
+    close() {
+        if (!this.closed)
+            this.child.kill();
+    }
+    onData(chunk) {
+        this.buffer += chunk;
+        for (let i = this.buffer.indexOf('\n'); i >= 0; i = this.buffer.indexOf('\n')) {
+            const line = this.buffer.slice(0, i).trim();
+            this.buffer = this.buffer.slice(i + 1);
+            if (!line)
+                continue;
+            let message;
+            try {
+                message = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            if (typeof message.id === 'number' && this.pending.has(message.id) && !message.method) {
+                const p = this.pending.get(message.id);
+                this.pending.delete(message.id);
+                if (message.error)
+                    p.reject(Object.assign(new Error(String(message.error.message ?? 'codex error').slice(0, 300)), { rpcCode: message.error.code }));
+                else
+                    p.resolve(message.result);
+            }
+            else if (message.method) {
+                for (const fn of this.listeners)
+                    fn(message.method, message.params);
+            }
+        }
+    }
+}
+/** One-shot use of an app-server for a profile. */
+export async function withCodex(bin, env, fn, initializeTimeoutMs) {
+    const server = await CodexAppServer.start(bin, env, initializeTimeoutMs);
+    try {
+        return await fn(server);
+    }
+    finally {
+        server.close();
+    }
+}
+/**
+ * Ask this Codex executable, with this profile's environment, which models it offers (`model/list`,
+ * the call the ACP adapter itself uses). Nothing is inferred when it does not answer.
+ */
+export async function codexOfferedModels(bin, env, budgetMs = 30_000) {
+    // One budget for the whole question: onboarding waits for this answer.
+    const deadline = Date.now() + budgetMs;
+    const left = () => Math.max(1, deadline - Date.now());
+    try {
+        return await withCodex(bin, env, async (server) => {
+            const models = [];
+            let cursor = null;
+            while (Date.now() < deadline) {
+                const answer = await server.call('model/list', { cursor, limit: null }, left());
+                if (!Array.isArray(answer?.data))
+                    return { state: 'unknown', reason: 'Codex did not return a model list' };
+                for (const model of answer.data)
+                    if (model && typeof model.id === 'string' && model.id && model.hidden !== true)
+                        models.push(model.id);
+                cursor = typeof answer.nextCursor === 'string' && answer.nextCursor ? answer.nextCursor : null;
+                if (!cursor)
+                    return { state: 'known', models: [...new Set(models)] };
+            }
+            return { state: 'unknown', reason: 'Codex did not finish listing its models in time' };
+        }, left());
+    }
+    catch (error) {
+        return { state: 'unknown', reason: error instanceof Error ? error.message : String(error) };
+    }
+}
+/** Flatten `account/rateLimits/read` into display windows. */
+export function codexUsageWindows(result) {
+    const snapshots = result.rateLimitsByLimitId && Object.keys(result.rateLimitsByLimitId).length
+        ? Object.entries(result.rateLimitsByLimitId) : [['codex', result.rateLimits]];
+    const windows = [];
+    for (const [limitId, snap] of snapshots) {
+        if (!snap)
+            continue;
+        for (const [slot, w] of [['primary', snap.primary], ['secondary', snap.secondary]]) {
+            if (!w || typeof w.usedPercent !== 'number')
+                continue;
+            windows.push({
+                id: `${limitId}:${slot}`,
+                label: `${snap.limitName ?? limitId} · ${windowName(w.windowDurationMins ?? undefined)}`,
+                usedPercent: w.usedPercent,
+                windowMins: w.windowDurationMins ?? undefined,
+                resetsAt: typeof w.resetsAt === 'number' ? new Date(w.resetsAt * 1000).toISOString() : undefined,
+            });
+        }
+    }
+    return windows;
+}
+export function windowName(mins) {
+    if (!mins)
+        return 'window';
+    if (mins === 300)
+        return '5h';
+    if (mins === 10_080)
+        return 'weekly';
+    if (mins % 1440 === 0)
+        return `${mins / 1440}d`;
+    if (mins % 60 === 0)
+        return `${mins / 60}h`;
+    return `${mins}m`;
+}

package/dist/subscriptions/launch.d.ts

@@ -0,0 +1,37 @@
+import { type SubscriptionPin, type SubscriptionProvider } from './store.js';
+/** The subscription provider a harness authenticates with, if Fleet manages it. */
+export declare function providerForHarness(harness: string): SubscriptionProvider | undefined;
+/** Env var that selects the CLI home for each provider. */
+export declare const HOME_ENV: Record<SubscriptionProvider, string>;
+/**
+ * Credential sources that would silently outrank the fleet-wide active profile
+ * (see Claude Code's documented authentication precedence and Codex's
+ * API-key login). While a non-default profile is active they are refused.
+ */
+export declare const CONFLICTING_AUTH_ENV: Record<SubscriptionProvider, string[]>;
+/** Claude managed-settings file (Linux), which outranks user settings. */
+export declare const CLAUDE_MANAGED_SETTINGS = "/etc/claude-code/managed-settings.json";
+/**
+ * Competing Claude credential sources declared in settings files: an `env`
+ * block entry from CONFLICTING_AUTH_ENV, or an `apiKeyHelper`. Settings are
+ * shared into profiles, so they can silently outrank a profile's login.
+ */
+export declare function claudeSettingsAuthSources(home: string, managed?: string): string[];
+export interface LaunchPin {
+    pin: SubscriptionPin;
+    /** Added to the harness child env last. Empty for the adopted default. */
+    env: Record<string, string>;
+    /** Host path the sandbox must mount read-write, if any. */
+    writablePath?: string;
+}
+/**
+ * Resolve the provider's active profile for a launch and record it in the
+ * agent's state dir. Resolution happens once, here: a later switch never
+ * changes what this session uses.
+ */
+export declare function pinSubscriptionForLaunch(role: {
+    name: string;
+    harness: string;
+    env?: Record<string, string>;
+    auth_proxy?: unknown;
+}, stateDir: string, inherited?: NodeJS.ProcessEnv, now?: () => Date): LaunchPin | undefined;

package/dist/subscriptions/launch.js

@@ -0,0 +1,93 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { FleetError } from '../application/errors.js';
+import { DEFAULT_PROFILE_ID, profileHome, readSubscriptionState, writePin, } from './store.js';
+/** The subscription provider a harness authenticates with, if Fleet manages it. */
+export function providerForHarness(harness) {
+    if (harness === 'claude-code')
+        return 'claude';
+    if (harness === 'codex')
+        return 'codex';
+    return undefined;
+}
+/** Env var that selects the CLI home for each provider. */
+export const HOME_ENV = {
+    claude: 'CLAUDE_CONFIG_DIR',
+    codex: 'CODEX_HOME',
+};
+/**
+ * Credential sources that would silently outrank the fleet-wide active profile
+ * (see Claude Code's documented authentication precedence and Codex's
+ * API-key login). While a non-default profile is active they are refused.
+ */
+export const CONFLICTING_AUTH_ENV = {
+    claude: [
+        'CLAUDE_CONFIG_DIR', 'ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN', 'CLAUDE_CODE_OAUTH_TOKEN',
+        'CLAUDE_CODE_OAUTH_REFRESH_TOKEN', 'CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR',
+        'CLAUDE_CODE_USE_BEDROCK', 'CLAUDE_CODE_USE_VERTEX', 'CLAUDE_CODE_USE_FOUNDRY', 'ANTHROPIC_PROFILE',
+        'ANTHROPIC_FEDERATION_RULE_ID', 'ANTHROPIC_ORGANIZATION_ID', 'ANTHROPIC_IDENTITY_TOKEN_FILE',
+    ],
+    codex: ['CODEX_HOME', 'OPENAI_API_KEY', 'CODEX_API_KEY'],
+};
+/** Claude managed-settings file (Linux), which outranks user settings. */
+export const CLAUDE_MANAGED_SETTINGS = '/etc/claude-code/managed-settings.json';
+/**
+ * Competing Claude credential sources declared in settings files: an `env`
+ * block entry from CONFLICTING_AUTH_ENV, or an `apiKeyHelper`. Settings are
+ * shared into profiles, so they can silently outrank a profile's login.
+ */
+export function claudeSettingsAuthSources(home, managed = CLAUDE_MANAGED_SETTINGS) {
+    const found = [];
+    for (const file of [join(home, 'settings.json'), managed]) {
+        let settings;
+        try {
+            settings = JSON.parse(readFileSync(file, 'utf8'));
+        }
+        catch {
+            continue;
+        }
+        for (const key of CONFLICTING_AUTH_ENV.claude)
+            if (settings?.env && typeof settings.env === 'object' && key in settings.env)
+                found.push(`${key} (${file})`);
+        if (settings?.apiKeyHelper)
+            found.push(`apiKeyHelper (${file})`);
+    }
+    return found;
+}
+/**
+ * Resolve the provider's active profile for a launch and record it in the
+ * agent's state dir. Resolution happens once, here: a later switch never
+ * changes what this session uses.
+ */
+export function pinSubscriptionForLaunch(role, stateDir, inherited = process.env, now = () => new Date()) {
+    const provider = providerForHarness(role.harness);
+    // A loopback auth proxy supplies credentials itself; it is not managed here.
+    if (!provider || role.auth_proxy)
+        return undefined;
+    const profileId = readSubscriptionState().providers[provider].activeProfileId;
+    const pin = { provider, profileId, pinnedAt: now().toISOString() };
+    if (profileId === DEFAULT_PROFILE_ID) {
+        // The adopted default launches exactly as before; credential env that points
+        // elsewhere is recorded so the panel can say this session is not managed.
+        const unmanaged = CONFLICTING_AUTH_ENV[provider].filter(key => role.env?.[key] !== undefined || inherited[key]);
+        if (unmanaged.length)
+            pin.unmanaged = unmanaged;
+        writePin(stateDir, pin);
+        return { pin, env: {} };
+    }
+    const conflicts = CONFLICTING_AUTH_ENV[provider].filter(key => role.env?.[key] !== undefined || (key !== HOME_ENV[provider] && inherited[key]));
+    if (conflicts.length) {
+        throw new FleetError('invalid_request', `role '${role.name}': ${conflicts.join(', ')} would bypass the active ${provider} subscription profile; ` +
+            'remove it from the role env / supervisor environment or switch back to the default profile');
+    }
+    const home = profileHome(provider, profileId);
+    if (provider === 'claude') {
+        const settings = claudeSettingsAuthSources(home);
+        if (settings.length) {
+            throw new FleetError('invalid_request', `role '${role.name}': Claude settings declare ${settings.join(', ')}, which would bypass the active subscription profile`);
+        }
+    }
+    pin.home = home;
+    writePin(stateDir, pin);
+    return { pin, env: { [HOME_ENV[provider]]: home }, writablePath: home };
+}

package/dist/subscriptions/login.d.ts

@@ -0,0 +1,75 @@
+import { type SubscriptionBinaries } from './cli.js';
+import type { SubscriptionProvider } from './store.js';
+/**
+ * A short-lived, browser-owned login. The URL comes from the official CLI and
+ * is shown only if its origin is on the provider's allowlist; the user's code
+ * goes to the CLI's stdin exactly once and is never stored.
+ */
+export type LoginState = 'starting' | 'awaiting_user' | 'verifying' | 'succeeded' | 'failed' | 'cancelled' | 'expired';
+export interface LoginView {
+    loginId: string;
+    provider: SubscriptionProvider;
+    kind: 'paste_code' | 'device_code';
+    state: LoginState;
+    url?: string;
+    /** Device code to type at `url`; only exposed while the user still needs it. */
+    userCode?: string;
+    expiresAt: string;
+    error?: string;
+}
+export declare const LOGIN_TTL_MS: number;
+export declare const LOGIN_URL_ALLOWLIST: Record<SubscriptionProvider, string[]>;
+export declare function allowedLoginUrl(provider: SubscriptionProvider, raw: string): string | undefined;
+export interface LoginHandle {
+    view(): LoginView;
+    /** Browser session that started the login; only it may act on it. */
+    readonly owner: string;
+    submitCode(code: string): void;
+    cancel(): void;
+    /** Resolves when the CLI has finished (success or not). */
+    readonly done: Promise<boolean>;
+}
+declare abstract class BaseLogin implements LoginHandle {
+    readonly provider: SubscriptionProvider;
+    readonly owner: string;
+    readonly kind: LoginView['kind'];
+    readonly loginId: string;
+    readonly expiresAt: number;
+    state: LoginState;
+    url?: string;
+    userCode?: string;
+    error?: string;
+    done: Promise<boolean>;
+    protected finish: (ok: boolean) => void;
+    private readonly timer;
+    constructor(provider: SubscriptionProvider, owner: string, kind: LoginView['kind'], now?: number);
+    view(): LoginView;
+    abstract submitCode(code: string): void;
+    protected abstract stop(): void;
+    cancel(): void;
+    protected end(state: LoginState, error?: string): void;
+    /** Called by the service after verifying the new home. */
+    complete(ok: boolean, error?: string): void;
+}
+/** `claude auth login` inside script(1): prints an authorize URL, then reads a paste code. */
+export declare class ClaudeLogin extends BaseLogin {
+    private child?;
+    private output;
+    private submitted;
+    /** Resolves with the CLI exit status once it exits. */
+    exited: Promise<number | null>;
+    constructor(owner: string, bins: SubscriptionBinaries, home: string, profileId: string);
+    submitCode(code: string): void;
+    protected stop(): void;
+}
+/** Codex device-code login through the app-server's supported account API. */
+export declare class CodexDeviceLogin extends BaseLogin {
+    private server?;
+    private codexLoginId?;
+    /** Resolves true when the app-server reports a successful login. */
+    completed: Promise<boolean>;
+    constructor(owner: string, bins: SubscriptionBinaries, home: string, profileId: string);
+    submitCode(): void;
+    protected stop(): void;
+}
+export {};