@playdrop/playdrop-cli 0.12.18 → 0.12.20

package/config/client-meta.json

@@ -1,6 +1,6 @@
 {
   "version": "0.12.8",
-  "build": 11,
+  "build": 13,
   "runtimeSdkVersion": "0.12.5",
   "runtimeSdkBuild": 2,
   "clients": {

package/dist/commands/worker/runtime.d.ts

@@ -96,6 +96,7 @@ export declare function buildWorkerChildEnv(input: {
     homeDir?: string;
     codexHomeDir?: string;
     claudeConfigDir?: string;
+    playdropConfigPath?: string;
     playwrightBrowsersPath?: string;
     baseEnv?: NodeJS.ProcessEnv;
 }): NodeJS.ProcessEnv;

package/dist/commands/worker/runtime.js

@@ -712,6 +712,17 @@ function buildWorkerChildEnv(input) {
         }
         child.CLAUDE_CONFIG_DIR = claudeConfigDir;
     }
+    // Claude sessions inherit the host's real HOME and Claude config on purpose: the machine is
+    // logged in with the Claude CLI and we call it exactly as a human does. The worker never
+    // stages, copies, or refreshes Claude credentials. The agent's `playdrop` CLI is still scoped
+    // to a task session through PLAYDROP_CONFIG_PATH rather than by hijacking HOME.
+    if (input.playdropConfigPath !== undefined) {
+        const playdropConfigPath = input.playdropConfigPath.trim();
+        if (!playdropConfigPath || !node_path_1.default.isAbsolute(playdropConfigPath)) {
+            throw new Error('invalid_worker_child_playdrop_config_path');
+        }
+        child.PLAYDROP_CONFIG_PATH = playdropConfigPath;
+    }
     if (input.playwrightBrowsersPath !== undefined) {
         const playwrightBrowsersPath = input.playwrightBrowsersPath.trim();
         if (!playwrightBrowsersPath || !node_path_1.default.isAbsolute(playwrightBrowsersPath)) {

package/dist/commands/worker.d.ts

@@ -249,11 +249,9 @@ export declare function prepareClaudeRunConfig(input: {
     workspaceDir: string;
     workerUsername: string;
     envName: string;
-    sourceCredentialsPath?: string;
     playdropConfig?: ReturnType<typeof loadConfig>;
 }): Promise<{
-    homeDir: string;
-    claudeConfigDir: string;
+    playdropConfigPath: string;
 }>;
 export declare function removeAgentRunCredentials(workspaceDir: string): Promise<void>;
 export declare function removeStaleAgentRunCredentials(workerHomeDir?: string): Promise<void>;

package/dist/commands/worker.js

@@ -1958,78 +1958,32 @@ async function stageWorkerPlaydropSession(input) {
         },
     }, null, 2), { mode: 0o600 });
     await (0, promises_1.chmod)(playdropConfigPath, 0o600);
+    return playdropConfigPath;
 }
 async function prepareClaudeRunConfig(input) {
     const runRoot = node_path_1.default.join(input.workspaceDir, '.playdrop', 'claude-run');
     const homeDir = node_path_1.default.join(runRoot, 'home');
-    const claudeConfigDir = node_path_1.default.join(runRoot, 'config');
     await (0, promises_1.rm)(runRoot, { recursive: true, force: true });
     await (0, promises_1.mkdir)(runRoot, { recursive: true, mode: 0o700 });
     await (0, promises_1.chmod)(runRoot, 0o700);
     await (0, promises_1.mkdir)(homeDir, { mode: 0o700 });
-    await (0, promises_1.mkdir)(claudeConfigDir, { mode: 0o700 });
-    const configuredCredentialsPath = input.sourceCredentialsPath?.trim()
-        || node_process_1.default.env.PLAYDROP_WORKER_CLAUDE_CREDENTIALS_FILE?.trim();
-    const defaultCredentialsPath = node_path_1.default.join(node_os_1.default.homedir(), '.claude', '.credentials.json');
-    let rawCredentials;
-    if (configuredCredentialsPath) {
-        const sourceCredentialsPath = node_path_1.default.resolve(configuredCredentialsPath);
-        if (!isFile(sourceCredentialsPath)) {
-            throw new Error(`worker_claude_credentials_missing:${sourceCredentialsPath}`);
-        }
-        rawCredentials = (0, node_fs_1.readFileSync)(sourceCredentialsPath, 'utf8');
-    }
-    else if (isFile(defaultCredentialsPath)) {
-        rawCredentials = (0, node_fs_1.readFileSync)(defaultCredentialsPath, 'utf8');
-    }
-    else if (node_process_1.default.platform === 'darwin') {
-        try {
-            const result = await execFileAsync('security', [
-                'find-generic-password',
-                '-s',
-                'Claude Code-credentials',
-                '-w',
-            ], { maxBuffer: 1024 * 1024 });
-            rawCredentials = result.stdout;
-        }
-        catch {
-            throw new Error('worker_claude_credentials_missing:macos_keychain');
-        }
-    }
-    else {
-        throw new Error(`worker_claude_credentials_missing:${defaultCredentialsPath}`);
-    }
-    let credentials;
-    try {
-        credentials = JSON.parse(rawCredentials);
-    }
-    catch {
-        throw new Error('worker_claude_credentials_invalid_json');
-    }
-    const credentialObject = typeof credentials === 'object' && credentials !== null && !Array.isArray(credentials)
-        ? credentials
-        : null;
-    const oauthValue = credentialObject?.claudeAiOauth;
-    const claudeAiOauth = typeof oauthValue === 'object' && oauthValue !== null && !Array.isArray(oauthValue)
-        ? oauthValue
-        : null;
-    if (!claudeAiOauth
-        || typeof claudeAiOauth.accessToken !== 'string'
-        || !claudeAiOauth.accessToken.trim()
-        || typeof claudeAiOauth.refreshToken !== 'string'
-        || !claudeAiOauth.refreshToken.trim()) {
-        throw new Error('worker_claude_oauth_credentials_missing');
-    }
-    const stagedCredentialsPath = node_path_1.default.join(claudeConfigDir, '.credentials.json');
-    await (0, promises_1.writeFile)(stagedCredentialsPath, `${JSON.stringify({ claudeAiOauth })}\n`, { mode: 0o600 });
-    await (0, promises_1.chmod)(stagedCredentialsPath, 0o600);
-    await stageWorkerPlaydropSession({
-        homeDir,
-        workerUsername: input.workerUsername,
-        envName: input.envName,
-        playdropConfig: input.playdropConfig,
-    });
-    return { homeDir, claudeConfigDir };
+    // The worker does NOT manage Claude authentication. The host is logged in with the Claude CLI;
+    // we call `claude` and let it use the machine's own login exactly as a human would.
+    //
+    // We used to copy the OAuth credential into this per-task config dir. That is what logged the
+    // machine out: the copy refreshed on first use after the 8h access-token expiry, Anthropic
+    // rotated the refresh token (invalidating the one still in the keychain), and the refreshed
+    // credential was thrown away with the task workspace. The host was then permanently logged out.
+    // Observed twice in production (2026-07-13 19:50, 2026-07-14 13:00:23, the latter three seconds
+    // after task 449's Claude exited). Never stage, copy, or write Claude credentials here.
+    return {
+        playdropConfigPath: await stageWorkerPlaydropSession({
+            homeDir,
+            workerUsername: input.workerUsername,
+            envName: input.envName,
+            playdropConfig: input.playdropConfig,
+        }),
+    };
 }
 async function removeAgentRunCredentials(workspaceDir) {
     await Promise.all([
@@ -2124,7 +2078,7 @@ async function runCodex(input) {
     };
 }
 async function runClaude(input) {
-    const { homeDir, claudeConfigDir } = await prepareClaudeRunConfig({
+    const { playdropConfigPath } = await prepareClaudeRunConfig({
         workspaceDir: input.workspaceDir,
         workerUsername: input.workerUsername,
         envName: input.envName,
@@ -2135,7 +2089,8 @@ async function runClaude(input) {
         : null;
     let playwrightMcpConfigPath = null;
     if (input.enablePlaywrightMcp) {
-        playwrightMcpConfigPath = node_path_1.default.join(claudeConfigDir, 'playwright-mcp.json');
+        playwrightMcpConfigPath = node_path_1.default.join(input.workspaceDir, '.playdrop', 'claude-run', 'playwright-mcp.json');
+        (0, node_fs_1.mkdirSync)(node_path_1.default.dirname(playwrightMcpConfigPath), { recursive: true });
         (0, node_fs_1.writeFileSync)(playwrightMcpConfigPath, `${JSON.stringify((0, runtime_1.buildPlaywrightMcpServerConfig)(), null, 2)}\n`, 'utf8');
     }
     const result = await (0, runtime_1.runLoggedProcess)({
@@ -2157,8 +2112,7 @@ async function runClaude(input) {
             envName: input.envName,
             eventDir: input.eventDir,
             devPort: input.devPort,
-            homeDir,
-            claudeConfigDir,
+            playdropConfigPath,
             playwrightBrowsersPath: resolveWorkerPlaywrightBrowsersPath(),
         }),
         stdin: input.prompt,

package/node_modules/@playdrop/config/client-meta.json

@@ -1,6 +1,6 @@
 {
   "version": "0.12.8",
-  "build": 11,
+  "build": 13,
   "runtimeSdkVersion": "0.12.5",
   "runtimeSdkBuild": 2,
   "clients": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@playdrop/playdrop-cli",
-  "version": "0.12.18",
+  "version": "0.12.20",
   "description": "Official Playdrop CLI for publishing browser games, creator apps, and AI-generated game assets on playdrop.ai",
   "homepage": "https://www.playdrop.ai",
   "repository": {