@prohost/cli 0.6.0 → 0.7.0

package/dist/agent/run.js

@@ -25,9 +25,12 @@
 import os from 'node:os';
 import { spawnSync } from 'node:child_process';
 import WebSocket from 'ws';
+import { HarnessAccount } from './account_runtime.js';
+import { EVENT_AGENT_CONFIG_UPDATED, machineId } from './accounts.js';
 import { completeRun, describeFailure, isIdempotencyInFlight, postReply } from './api.js';
 import { MAX_SALVAGE_CHARS, claudeCommand, isClaudeExec, looksLikeResumeFailure, readClaudeStream, writeMcpConfig, } from './claude.js';
 import { APPS_FEATURE, MCP_API_KEY_ENV_VAR, PLUGINS_DISABLED_OVERRIDE, codexBinary, codexCommand, codexMcpInventoryFlag, codexProfileName, codexShellSyntax, extraMcpEntries, isCodexExec, isolateConfiguredServers, listMcpServers, mcpServersOverride, prohostMcpEntry, looksLikeCodexResumeFailure, parseCodexOutput, } from './codex.js';
+import { ToolEventQueue } from './events.js';
 import { EXTRA_MCP_FILENAME, loadExtraMcpServers } from './extras.js';
 import { MCP_SERVER_NAME, MCP_TOOL_PATTERN } from './mcp.js';
 import { EVENT_AGENT_RUN_REQUESTED, EVENT_MENTION_CREATED, EVENT_MESSAGE_TEAM_CHAT, RUN_ERROR_CANCELLED_BY_USER, eventData, heartbeatPathFor, parseRunRequest, } from './contract.js';
@@ -257,6 +260,13 @@ function buildRuntime(options, log) {
             model,
         };
     }
+    const account = new HarnessAccount({
+        runtime: brain === 'claude' ? 'claude_code' : 'codex',
+        env: options.env,
+        initialLabel: options.credentials.account,
+        binary: brain === 'claude' ? (options.exec.trim().split(/\s+/)[0] ?? 'claude') : codexBinary(options.exec),
+        run: options.accountCommandRunner,
+    });
     const mcpUrl = options.credentials.mcp_url;
     let announced = '';
     const announce = (lines) => {
@@ -294,7 +304,7 @@ function buildRuntime(options, log) {
                 };
             }
         }
-        : codexMcpEntryProvider(options, log, workdir);
+        : codexMcpEntryProvider(options, log, workdir, () => account.spawnEnv());
     const tools = mcpUrl ? `, ProhostAI tools prepared per run as ${MCP_SERVER_NAME}` : '';
     const where = workdir ? ` (workspace: ${workdir})` : '';
     log(brain === 'claude'
@@ -310,7 +320,28 @@ function buildRuntime(options, log) {
             'access, on instructions from your workspace. Use --safe-tools to gate them.'
         : `${timestamp()} ⚙ --safe-tools: tools are permission-gated; anything needing ` +
             'approval will not run (nobody is at a terminal to approve it).');
-    return { workdir, sessions, brain, prepareMcp, skipPermissions, runtimeName, observe, model };
+    // The account is resolved before anything is prepared or spawned, and its
+    // environment rides every spawn of this run. A missing account fails the
+    // run closed, the same way an unprovable MCP boundary does.
+    const prepareWithAccount = () => {
+        const resolved = account.resolveForSpawn();
+        if (!resolved.ok)
+            return { mcpWired: false, error: resolved.error };
+        const prepared = prepareMcp();
+        return { ...prepared, execEnv: { ...account.spawnEnv(), ...prepared.execEnv } };
+    };
+    log(`${timestamp()} ⚙ account: ${account.label()}`);
+    return {
+        workdir,
+        sessions,
+        brain,
+        prepareMcp: prepareWithAccount,
+        skipPermissions,
+        runtimeName,
+        observe,
+        model,
+        account,
+    };
 }
 /**
  * The `runtime` a status frame names. A plain command is `custom` unless it is
@@ -328,11 +359,12 @@ function runtimeNameFor(brain, exec) {
  * Idle capacity source for the detected brain: the agent CLI itself, asked
  * through its own protocol so its own login answers. `plain` has none.
  */
-function defaultQuotaProvider(brain, exec) {
+function defaultQuotaProvider(brain, exec, env) {
     if (brain === 'claude')
-        return claudeQuotaProvider({ binary: exec.trim().split(/\s+/)[0] ?? 'claude' });
-    if (brain === 'codex')
-        return codexQuotaProvider({ binary: codexBinary(exec), clientVersion: CLI_VERSION });
+        return claudeQuotaProvider({ binary: exec.trim().split(/\s+/)[0] ?? 'claude', env });
+    if (brain === 'codex') {
+        return codexQuotaProvider({ binary: codexBinary(exec), clientVersion: CLI_VERSION, env });
+    }
     return undefined;
 }
 /**
@@ -342,12 +374,12 @@ function defaultQuotaProvider(brain, exec) {
  * extras file is the operator's live grant list. Fresh reads make both a new
  * configured server and a revoked extra visible to the very next run.
  */
-export function codexMcpEntryProvider(options, log, workdir) {
+export function codexMcpEntryProvider(options, log, workdir, accountEnv) {
     let announced = '';
     return () => {
         const extras = loadExtraMcpServers({ env: options.env });
         const lines = extras.warnings.map((warning) => `${timestamp()} ! ${warning}`);
-        const prepared = codexMcpEntries(options, extras.servers, (line) => lines.push(line), workdir);
+        const prepared = codexMcpEntries(options, extras.servers, (line) => lines.push(line), workdir, accountEnv?.());
         const said = lines.join('\n');
         if (said !== announced) {
             for (const line of lines)
@@ -362,12 +394,15 @@ export function codexMcpEntryProvider(options, log, workdir) {
  * verified switches that keep the operator's own servers out. Preparation is
  * fail-closed: an unprovable boundary never reaches an unsandboxed agent.
  */
-function codexMcpEntries(options, extraServers, log, workdir) {
+function codexMcpEntries(options, extraServers, log, workdir, accountEnv) {
     const fail = (detail) => {
         log(`${timestamp()} ! ${detail}`);
         return { mcpWired: false, error: detail };
     };
-    const probe = options.probeImpl ?? defaultProbe;
+    // Every probe asks the same CODEX_HOME the run will use — the MCP servers to
+    // isolate live in that account's config.toml, not the default one.
+    const baseProbe = options.probeImpl ?? defaultProbe;
+    const probe = (command, cwd) => accountEnv && Object.keys(accountEnv).length > 0 ? baseProbe(command, cwd, accountEnv) : baseProbe(command, cwd);
     if (codexShellSyntax(options.exec)) {
         return fail('--exec uses shell quoting, expansion, glob, comment, escape, or control syntax that the Codex ' +
             'isolation verifier cannot tokenize safely; use a plain argv-shaped Codex command');
@@ -493,10 +528,11 @@ function codexMcpEntries(options, extraServers, log, workdir) {
  * `cwd` must match the eventual run exactly, because Codex loads trusted
  * project `.codex/config.toml` layers from there.
  */
-function defaultProbe(command, cwd) {
+function defaultProbe(command, cwd, env) {
     const result = spawnSync(command, {
         shell: true,
         cwd,
+        ...(env ? { env: { ...process.env, ...env } } : {}),
         encoding: 'utf8',
         // Generous for a config read, short enough that a wedged binary delays
         // a run rather than wedging the daemon.
@@ -532,7 +568,12 @@ function partialStdout(tail) {
  * tell a failed turn from a successful one. A plain command's behaviour here is
  * byte-for-byte what it was before this function existed.
  */
-async function runTurn(run, prompt, options, runtime, mcp, control, log) {
+async function runTurn(run, prompt, options, runtime, mcp, control, log, 
+/**
+ * Where the streaming brain's tool-call events go, if anywhere. Only the
+ * Claude Code reader produces any; absent, they are simply never collected.
+ */
+toolEvents) {
     // `--timeout` is a ceiling on the run, not on each attempt: the retry below
     // must not let one run take twice what the operator allowed. Both attempts
     // share one deadline, which costs the retry nothing in practice — a rejected
@@ -590,6 +631,9 @@ async function runTurn(run, prompt, options, runtime, mcp, control, log) {
         const activity = reader.activity();
         if (activity)
             control.report(activity);
+        // The heartbeat line above is unchanged for older servers; the events are
+        // the richer channel a newer server renders beneath it.
+        toolEvents?.push(reader.drainToolEvents());
     };
     /**
      * Undo an eagerly recorded Claude session after an ordinary failed turn.
@@ -746,7 +790,7 @@ async function runTurn(run, prompt, options, runtime, mcp, control, log) {
         const output = parseCodexOutput(result.stdout);
         // Codex's `--json` stream carries neither model nor limits; its rollout
         // file for this thread does.
-        runtime.observe(readCodexObservation(output.sessionId, { ...process.env, ...options.env }));
+        runtime.observe(readCodexObservation(output.sessionId, { ...process.env, ...options.env, ...runtime.account?.spawnEnv() }));
         reportDenials(output.denials);
         if (!output.ok) {
             return {
@@ -764,6 +808,10 @@ async function runTurn(run, prompt, options, runtime, mcp, control, log) {
     // crash banner, a `claude` that ignored `--output-format` — is a failure, and
     // the whole-output parser is what says so in words.
     const parsed = (stream ?? readClaudeStream()).finish(result.stdout);
+    // `finish` handles a trailing event with no newline after it; a tool event
+    // in that tail is real and must not be lost to the drain timing.
+    if (stream)
+        toolEvents?.push(stream.drainToolEvents());
     reportDenials(parsed.denials);
     if (!parsed.ok) {
         forgetRecordedSession();
@@ -809,7 +857,21 @@ async function handleRun(run, options, runtime, api, log, sleep, control) {
         timeoutMs: options.timeoutMs ?? DEFAULT_EXEC_TIMEOUT_MS,
         idleTimeoutMs: options.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS,
     });
-    const result = await runTurn(run, prompt, options, runtime, mcp, control, log);
+    // Tool-call narration for the thread. A dry run makes no writes, so it gets
+    // no path and every event is dropped; so does a server that advertised none.
+    const toolEvents = new ToolEventQueue({
+        api,
+        path: options.dryRun ? undefined : run.events_path,
+        log,
+        label,
+    });
+    const result = await runTurn(run, prompt, options, runtime, mcp, control, log, toolEvents);
+    // Whatever the turn did, the timeline is whole BEFORE the reply is posted or
+    // the run is closed — a completion that beats its own last tool row would
+    // leave a `calling` row on a finished run. Never rejects, and after `stop`
+    // nothing straggling can post against a run the server has closed.
+    await toolEvents.flush();
+    toolEvents.stop();
     const seconds = (result.durationMs / 1000).toFixed(1);
     // Stopped from outside. Checked before the failure branch below, because a
     // stopped run *is* a failed command — reporting it as one would put "timed
@@ -934,6 +996,9 @@ export async function runAgentHarness(options) {
     const url = options.url ?? streamUrlFor(options.credentials, DEFAULT_WS_URL);
     const metrics = newMetrics();
     const runtime = buildRuntime(options, log);
+    // Keys this computer's accounts server-side; the label above is display
+    // only. Only a runtime that reports accounts needs one.
+    const machineIdValue = runtime.account ? machineId({ ...process.env, ...options.env }) : undefined;
     // A credential file written by 0.1.0 stores a socket URL on a host that only
     // ever answers 403. Upgrading the CLI would not have fixed those installs on
     // its own — the stored value wins over the constant — so say what happened
@@ -960,8 +1025,11 @@ export async function runAgentHarness(options) {
     const status = new RuntimeStatusReporter({
         runtime: runtime.runtimeName,
         provider: options.quotaProvider === undefined
-            ? defaultQuotaProvider(runtime.brain, options.exec)
+            ? defaultQuotaProvider(runtime.brain, options.exec, () => runtime.account?.spawnEnv() ?? {})
             : (options.quotaProvider ?? undefined),
+        accounts: runtime.account
+            ? () => runtime.account.snapshot([...accepted.values()].some((entry) => entry.executing))
+            : undefined,
         // A run in flight reports fresh numbers when it ends; don't probe beside it.
         isBusy: () => [...accepted.values()].some((entry) => entry.executing),
         log,
@@ -992,9 +1060,29 @@ export async function runAgentHarness(options) {
         status.observe({
             runtime_version: version,
             model: modelFromExec(options.exec) ??
-                (runtime.brain === 'codex' ? codexConfiguredModel({ ...process.env, ...options.env }) : undefined),
+                (runtime.brain === 'codex'
+                    ? codexConfiguredModel({ ...process.env, ...options.env, ...runtime.account?.spawnEnv() })
+                    : undefined),
         });
     };
+    /**
+     * An operator picked another account in ProhostAI. Applied from the next
+     * run: the run in flight (if any) finishes on the account it started on.
+     */
+    const applyAccountPick = (key, via, requestedAt) => {
+        if (!runtime.account)
+            return false;
+        const outcome = runtime.account.apply(key, requestedAt);
+        if (!outcome.applied) {
+            log(`${timestamp()} ! account change from ProhostAI ignored (${via}): ${outcome.reason}`);
+            return false;
+        }
+        if (outcome.changed) {
+            log(`${timestamp()} ⚙ account: ${outcome.record.label} (picked in ProhostAI) — used from the next run`);
+            status.accountsChanged();
+        }
+        return true;
+    };
     let queue = Promise.resolve();
     let fatal;
     let attempt = 0;
@@ -1151,6 +1239,7 @@ export async function runAgentHarness(options) {
                     type: 'auth',
                     api_key: options.credentials.api_key,
                     machine,
+                    ...(machineIdValue ? { machine_id: machineIdValue } : {}),
                     client_version: CLI_VERSION,
                     ...(options.credentials.subscription_id
                         ? { subscription_id: options.credentials.subscription_id }
@@ -1186,6 +1275,17 @@ export async function runAgentHarness(options) {
                         `${EVENT_AGENT_RUN_REQUESTED} (exec: ${options.exec})`);
                     // Only a server that says it understands the frame gets one; an
                     // older server may treat an unknown frame type as a protocol error.
+                    // A pick made while this agent was offline: the server repeats it on
+                    // every connect until a status frame reports the agent on it.
+                    // Its `requested_at` is the newest pick's stamp — a floor for any
+                    // live pick still in flight from before this connect.
+                    const pending = f.agent_config;
+                    if (pending && typeof pending === 'object') {
+                        if (pending.account_key !== undefined) {
+                            applyAccountPick(pending.account_key, 'on connect', pending.requested_at);
+                        }
+                        runtime.account?.noteRequestedAt(pending.requested_at);
+                    }
                     if (Array.isArray(f.features) && f.features.includes(RUNTIME_STATUS_FEATURE)) {
                         primeStatus();
                         status.attach((frame) => ws.send(JSON.stringify(frame)));
@@ -1220,6 +1320,21 @@ export async function runAgentHarness(options) {
                         /* best-effort */
                     }
                 };
+                if (frame.event === EVENT_AGENT_CONFIG_UPDATED) {
+                    // It changes which subscription this machine spends, so it is held to
+                    // the same signature rule as a run.
+                    if (!verifySignature(options.credentials.webhook_secret, frame.payload, frame.signature) &&
+                        !options.allowUnverified) {
+                        metrics.signatureRejections += 1;
+                        log(`${timestamp()} ✗ rejected ${EVENT_AGENT_CONFIG_UPDATED} — signature did not verify`);
+                        ack(ACK_REJECTED);
+                        return;
+                    }
+                    const data = eventData(frame.payload);
+                    const applied = applyAccountPick(data.account_key, 'live', data.requested_at);
+                    ack(applied ? ACK_ACCEPTED : ACK_IGNORED);
+                    return;
+                }
                 if (frame.event !== EVENT_AGENT_RUN_REQUESTED) {
                     if (frame.event === EVENT_MENTION_CREATED || frame.event === EVENT_MESSAGE_TEAM_CHAT) {
                         // "runs are triggered by mentions" was wrong twice over: the gate
@@ -1332,6 +1447,10 @@ export async function runAgentHarness(options) {
                     // whole of `handleRun`, including the ten minutes of completion
                     // retries at the end of it.
                     release(run.run_id);
+                    // An account picked mid-run was held back from the status frame
+                    // until this run (on the old account) was done; report it now.
+                    if (runtime.account?.changedSinceSpawn())
+                        status.accountsChanged();
                     // Both terminal outcomes reached the completion endpoint; only then
                     // is the run settled and safe to skip on redelivery.
                     if (outcome === 'succeeded')

package/dist/agent/runtime_status.d.ts

@@ -25,6 +25,7 @@
  * shapes belong to other tools and grow without asking us.
  */
 import { spawn as nodeSpawn } from 'node:child_process';
+import type { AccountBlock } from './accounts.js';
 /** Feature name the server lists in `auth_ok.features` when it accepts the frame. */
 export declare const RUNTIME_STATUS_FEATURE = "runtime_status";
 /** Routine report cadence while connected. */
@@ -39,13 +40,20 @@ export declare const MIN_FRAME_SPACING_MS = 31000;
 export declare const QUOTA_REFRESH_AFTER_MS: number;
 /** Ceiling on one idle quota probe. */
 export declare const PROVIDER_TIMEOUT_MS = 10000;
-export type QuotaKind = 'session' | 'weekly';
+export type QuotaKind = 'session' | 'weekly' | 'weekly_model';
 export interface QuotaWindow {
     kind: QuotaKind;
     /** 0–100. */
     used_percent: number;
-    /** ISO-8601. */
-    resets_at: string;
+    /**
+     * ISO-8601, or `null` for a window whose usage is known but which has not
+     * started — Claude's 5-hour window after five idle hours. Reported as such
+     * rather than dropped: "0%, starts on next use" is an answer, a missing
+     * window is not.
+     */
+    resets_at: string | null;
+    /** The model a `weekly_model` window is scoped to, e.g. `Fable`. */
+    model_label?: string;
 }
 /** What one source managed to learn. Every field is optional; absent means "didn't learn it". */
 export interface RuntimeObservation {
@@ -68,7 +76,17 @@ export declare function parseVersion(stdout: string): string | undefined;
  * The field is marked internal upstream, so an unexpected shape yields nothing.
  */
 export declare function fromClaudeRateLimitInfo(info: unknown): QuotaWindow[];
-/** Windows from a `get_usage` control response (0–100, ISO strings). */
+/**
+ * Windows from a `get_usage` control response (0–100, ISO strings).
+ *
+ * A window with a usage but a `null` reset is kept, with `resets_at: null` —
+ * that is how an idle account's 5-hour window reads, and dropping it is what
+ * left paired agents showing a weekly window and nothing else (B3).
+ *
+ * Per-model weekly windows come from `rate_limits.limits[]` rows of kind
+ * `weekly_scoped` (classified on `kind`, as the schema asks, never on a
+ * label), falling back to `model_scoped[]`.
+ */
 export declare function fromClaudeGetUsage(usage: unknown): QuotaWindow[];
 /** `get_usage.subscription_type` → display label; `undefined` for anything else. */
 export declare function claudePlanLabel(subscriptionType: unknown): string | undefined;
@@ -129,6 +147,8 @@ export declare function claudeQuotaProvider(options: {
     binary: string;
     spawnImpl?: SpawnFn;
     timeoutMs?: number;
+    /** Account environment, read at each probe so a switch applies to the next one. */
+    env?: () => NodeJS.ProcessEnv;
 }): QuotaProvider;
 /** Codex's `account/rateLimits/read` over `codex app-server` stdio JSON-RPC. */
 export declare function codexQuotaProvider(options: {
@@ -136,12 +156,42 @@ export declare function codexQuotaProvider(options: {
     clientVersion: string;
     spawnImpl?: SpawnFn;
     timeoutMs?: number;
+    /** Account environment, read at each probe so a switch applies to the next one. */
+    env?: () => NodeJS.ProcessEnv;
 }): QuotaProvider;
+/**
+ * Fold new windows into the ones already known, one KIND at a time.
+ *
+ * Sources see different slices: a run's `rate_limit_event` carries only the
+ * 5-hour and weekly windows (and omits one whose reset has passed), while the
+ * idle `get_usage` probe also carries the per-model weekly ones. Replacing the
+ * whole list with whatever arrived last is how a stream event used to erase
+ * the windows it simply didn't mention. A kind the observation names replaces
+ * every window of that kind; a kind it doesn't name is kept.
+ */
+export declare function mergeWindows(known: QuotaWindow[] | undefined, observed: QuotaWindow[]): QuotaWindow[];
+/** What the harness knows about accounts on this machine, for the frame. */
+export interface AccountsSnapshot {
+    /** The account this agent runs on. */
+    current?: AccountBlock;
+    /**
+     * Every account on the machine, identity and sign-in state only. Omitted
+     * when the list would be partial: the server treats it as authoritative
+     * and would forget whatever it doesn't name.
+     */
+    all?: AccountBlock[];
+}
 export interface RuntimeStatusReporterOptions {
     /** `claude_code` | `codex` | `goose` | `custom`. */
     runtime: string;
     /** Idle quota source; omit for a runtime that has none. */
     provider?: QuotaProvider;
+    /**
+     * Accounts on this machine and which one this agent uses. Re-read on the
+     * same cadence as the idle quota probe (it asks each login whether it is
+     * signed in), and straight away after {@link RuntimeStatusReporter.accountsChanged}.
+     */
+    accounts?: () => Promise<AccountsSnapshot | undefined>;
     /** A run is executing — it will bring fresh numbers, so don't probe beside it. */
     isBusy?: () => boolean;
     now?: () => number;
@@ -170,9 +220,25 @@ export declare class RuntimeStatusReporter {
     private cancelPending;
     private cancelTick;
     private refreshing;
+    private accountGeneration;
+    private accounts;
+    private accountsObservedAt;
     constructor(options: RuntimeStatusReporterOptions);
     /** Merge what a source learned. Absent fields keep their previous value. */
     observe(observation: RuntimeObservation | undefined): void;
+    /**
+     * Record the accounts snapshot. Moving to another account drops what was
+     * known about the previous one's capacity and plan — they describe a
+     * different subscription — and asks for fresh numbers straight away.
+     */
+    setAccounts(snapshot: AccountsSnapshot | undefined, options?: {
+        quiet?: boolean;
+    }): void;
+    /**
+     * The account choice changed (an operator picked one in ProhostAI): re-read
+     * accounts and capacity on the next tick rather than in fifteen minutes.
+     */
+    accountsChanged(): void;
     /** The model to report on a run's completion, when nothing more specific is known. */
     model(): string | undefined;
     /** Start reporting on a socket that advertised the feature. */