@rubytech/create-maxy-code 0.1.394 → 0.1.396

package/dist/__tests__/darwin-service-env-path.test.js

@@ -0,0 +1,29 @@
+// Acceptance gate for the darwin `.env` PATH line.
+//
+// The launchd wrapper sources `.env` and every MCP child (including the ones
+// `claude` spawns itself from a plugin `PLUGIN.md` `mcp: command: node`)
+// inherits this PATH. On the migrated Mac the only `node` is nvm's, off the
+// bare launchd PATH, so a bare `node server.js` fails ENOENT and the plugin's
+// graph-write tools never register. buildDarwinServiceEnvPath prepends the
+// resolved node bin dir and `~/.local/bin` (uv) so `node` and `uvx` both
+// resolve at runtime. The channel MCPs (Task 1402) pin NODE_BIN directly;
+// this covers the plugin/graph half of the same PATH root cause.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { buildDarwinServiceEnvPath } from "../port-resolution.js";
+test("prepends the nvm node dir and ~/.local/bin ahead of the Homebrew prefixes, ending in $PATH", () => {
+    const path = buildDarwinServiceEnvPath("/Users/neo/.nvm/versions/node/v20.11.0/bin/node", "/Users/neo");
+    assert.equal(path, "/Users/neo/.nvm/versions/node/v20.11.0/bin:/Users/neo/.local/bin:/opt/homebrew/bin:/usr/local/bin:$PATH");
+});
+test("node dir is the first segment so a bare `node` resolves to the pinned interpreter first", () => {
+    const path = buildDarwinServiceEnvPath("/opt/homebrew/bin/node", "/Users/me");
+    assert.equal(path.split(":")[0], "/opt/homebrew/bin");
+});
+test("includes the account home's ~/.local/bin so the graph-cypher `uvx` resolves", () => {
+    const path = buildDarwinServiceEnvPath("/usr/local/bin/node", "/Users/alice");
+    assert.ok(path.includes(":/Users/alice/.local/bin:"), path);
+});
+test("keeps the existing $PATH expansion as the final segment", () => {
+    const path = buildDarwinServiceEnvPath("/usr/local/bin/node", "/Users/me");
+    assert.ok(path.endsWith(":$PATH"), path);
+});

package/dist/index.js

@@ -5,7 +5,7 @@ import { registerSpecialistAgentsAt, SpecialistSymlinkCollision } from "./specia
 import { seedBypassPermissionsSettings, assertBypassPermissionsSeed } from "./permissions-seed.js";
 import { resolve, join, dirname } from "node:path";
 import { randomBytes } from "node:crypto";
-import { resolveInstallPortFromFs, buildMaxyUnitFile, buildClaudeSessionManagerUnitFile, buildClaudePtysSliceUnitFile, buildCloudflaredSliceUnitFile } from "./port-resolution.js";
+import { resolveInstallPortFromFs, buildMaxyUnitFile, buildClaudeSessionManagerUnitFile, buildClaudePtysSliceUnitFile, buildCloudflaredSliceUnitFile, buildDarwinServiceEnvPath } from "./port-resolution.js";
 import { buildHeartbeatCronBlock, mergeHeartbeatBlock } from "./cron-registration.js";
 import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
 import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
@@ -3319,6 +3319,9 @@ function installServiceDarwin() {
     // installer's own shell resolves.
     const nodeProbe = spawnSync("command", ["-v", "node"], { encoding: "utf-8", shell: true });
     const nodeBin = (nodeProbe.stdout ?? "").trim() || "/usr/local/bin/node";
+    // Task 1404 — the darwin `.env` PATH, computed once and reused for both the
+    // PATH env value and the install log so the two can never drift.
+    const darwinServiceEnvPath = buildDarwinServiceEnvPath(nodeBin, process.env.HOME ?? "/");
     const envPath = join(persistDir, ".env");
     try {
         let envContent = "";
@@ -3347,7 +3350,15 @@ function installServiceDarwin() {
             // against the bare launchd PATH and Homebrew prefixes get prepended for
             // every spawned descendant (claude-session-manager, MCP plugin spawns,
             // route-level spawn('claude', ...)). Task 386.
-            ["PATH", "/opt/homebrew/bin:/usr/local/bin:$PATH"],
+            //
+            // Task 1404 — also prepend the resolved node bin dir and ~/.local/bin.
+            // The plugin MCP servers `claude` spawns itself from a PLUGIN.md
+            // `mcp: command: node` inherit this PATH; when the only node is nvm's
+            // (off the Homebrew prefixes) a bare `node server.js` fails ENOENT and
+            // the graph-write tools never register. buildDarwinServiceEnvPath makes
+            // `node` resolve (node bin dir) and the graph-cypher `uvx` resolve
+            // (~/.local/bin). Channel MCPs pin NODE_BIN separately (Task 1402).
+            ["PATH", darwinServiceEnvPath],
         ]) {
             const re = new RegExp(`^${key}=.*$`, "m");
             if (re.test(envContent)) {
@@ -3381,7 +3392,7 @@ function installServiceDarwin() {
                 envContent = envContent.trimEnd() + (envContent.length > 0 ? "\n" : "") + `NODE_BIN=${nodeBin}\n`;
         }
         writeFileSync(envPath, envContent);
-        logFile(`  .env: DISPLAY_MODE=${DISPLAY_MODE}, EMBED_MODEL=${EMBED_MODEL}, EMBED_DIMENSIONS=${EMBED_DIMS}, NEO4J_URI=bolt://localhost:${NEO4J_PORT}, PORT=${PORT}, MAXY_UI_INTERNAL_PORT=${PORT} (darwin-collapsed), CLAUDE_SESSION_MANAGER_PORT=${BRAND.claudeSessionManagerPort}, HOSTNAME=0.0.0.0, ACCOUNT_ID=${installAccountId.slice(0, 8)}…, CLAUDE_CONFIG_DIR=${persistDir}/.claude, CLAUDE_BIN=${canonicalClaude ?? "unresolved(PATH)"}, NODE_BIN=${nodeBin}`);
+        logFile(`  .env: DISPLAY_MODE=${DISPLAY_MODE}, EMBED_MODEL=${EMBED_MODEL}, EMBED_DIMENSIONS=${EMBED_DIMS}, NEO4J_URI=bolt://localhost:${NEO4J_PORT}, PORT=${PORT}, MAXY_UI_INTERNAL_PORT=${PORT} (darwin-collapsed), CLAUDE_SESSION_MANAGER_PORT=${BRAND.claudeSessionManagerPort}, HOSTNAME=0.0.0.0, ACCOUNT_ID=${installAccountId.slice(0, 8)}…, CLAUDE_CONFIG_DIR=${persistDir}/.claude, CLAUDE_BIN=${canonicalClaude ?? "unresolved(PATH)"}, NODE_BIN=${nodeBin}, PATH=${darwinServiceEnvPath}`);
     }
     catch (err) {
         console.error(`  WARNING: failed to write .env to ${envPath}: ${err instanceof Error ? err.message : String(err)}`);

package/dist/port-resolution.js

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import os from "node:os";
 const PORT_RE = /^PORT=(\d+)/m;
 const ENV_PORT_RE = /^Environment=PORT=(\d+)/m;
@@ -224,3 +224,18 @@ Before=shutdown.target
 WantedBy=default.target
 `;
 }
+/** The darwin `.env` PATH line. launchd hands the brand server a bare PATH
+ *  (`/usr/bin:/bin:/usr/sbin:/sbin`) and the wrapper sources `.env` so every
+ *  descendant inherits this value — including the plugin MCP servers `claude`
+ *  spawns itself from a `PLUGIN.md` `mcp: command: node`. When the only `node`
+ *  is nvm's (off the Homebrew prefixes), a bare `node server.js` fails ENOENT
+ *  and the plugin's graph-write tools never register. Prepending the resolved
+ *  node bin dir makes bare `node` resolve; prepending `~/.local/bin` makes the
+ *  graph-cypher `uvx` resolve. The Homebrew prefixes and the sourced-time
+ *  `$PATH` expansion are retained. Channel MCPs pin NODE_BIN separately
+ *  (Task 1402); this covers the plugin/graph half of the same root cause. */
+export function buildDarwinServiceEnvPath(nodeBin, home) {
+    const nodeDir = dirname(nodeBin);
+    const localBin = join(home, ".local", "bin");
+    return `${nodeDir}:${localBin}:/opt/homebrew/bin:/usr/local/bin:$PATH`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.394",
+  "version": "0.1.396",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/services/claude-session-manager/dist/claude-host-creds.d.ts

@@ -1,11 +1,8 @@
-/** Max time (ms) a spawned claude waits for the host to finish refreshing an
- *  expiring token before erroring. The host heartbeat refreshes proactively
- *  inside the 5-minute expiry window, so an in-flight refresh at spawn time is
- *  rare; 30s is a generous ceiling that never wedges a spawn. */
-export declare const HOST_AUTH_REFRESH_TIMEOUT_MS = "30000";
-/** Mutate `env` in place to enable claude's host-managed credentials-file mode
- *  when running on darwin, then return it. No-op on every other platform.
- *  `claudeConfigDir` is the brand's `.claude` dir; the credentials file is its
- *  `.credentials.json` child. */
-export declare function applyHostCredsEnv(env: NodeJS.ProcessEnv, claudeConfigDir: string, platform?: NodeJS.Platform): NodeJS.ProcessEnv;
+/** Mutate `env` in place to authenticate a darwin-spawned claude against the
+ *  platform's credentials FILE, then return it. No-op on every other platform and
+ *  when `claudeConfigDir` is empty. `claudeConfigDir` is the brand's `.claude`
+ *  dir; the credentials file is its `.credentials.json` child (the same path
+ *  auth-health reads). When `logger` is passed, emits one `op=spawn-hostcreds`
+ *  line recording what was resolved and whether a token was applied. */
+export declare function applyHostCredsEnv(env: NodeJS.ProcessEnv, claudeConfigDir: string, platform?: NodeJS.Platform, logger?: (line: string) => void): NodeJS.ProcessEnv;
 //# sourceMappingURL=claude-host-creds.d.ts.map

package/payload/platform/services/claude-session-manager/dist/claude-host-creds.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude-host-creds.d.ts","sourceRoot":"","sources":["../src/claude-host-creds.ts"],"names":[],"mappings":"AAsBA;;;iEAGiE;AACjE,eAAO,MAAM,4BAA4B,UAAU,CAAA;AAEnD;;;iCAGiC;AACjC,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,eAAe,EAAE,MAAM,EACvB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAAC,UAAU,CAMnB"}
+{"version":3,"file":"claude-host-creds.d.ts","sourceRoot":"","sources":["../src/claude-host-creds.ts"],"names":[],"mappings":"AAmCA;;;;;wEAKwE;AACxE,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,eAAe,EAAE,MAAM,EACvB,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC9B,MAAM,CAAC,UAAU,CA4BnB"}

package/payload/platform/services/claude-session-manager/dist/claude-host-creds.js

@@ -1,37 +1,66 @@
-// Task 1395 gap 1 — macOS credential-store bridge.
+// Task 1406 — macOS credential-store bridge (supersedes the Task 1395 gap-1
+// wiring, which was inert on CLI v2.1.201).
 //
-// On macOS the `claude` CLI stores its OAuth token in the login Keychain,
-// while this platform reads and refreshes the token from a FILE
-// (`<CLAUDE_CONFIG_DIR>/.credentials.json`, the same path the UI server's
-// readCredentials()/writeOAuthCredentials() own). Left alone the two never
-// meet: auth-health reads an empty file and reports `missing` forever.
+// On macOS the `claude` CLI stores its OAuth token in the login Keychain, while
+// this platform reads and refreshes the token from a FILE
+// (`<CLAUDE_CONFIG_DIR>/.credentials.json`, the path the UI server's
+// readCredentials()/writeOAuthCredentials() own). Left alone the two never meet:
+// the child authenticates against a stale/empty Keychain and its first API turn
+// prints `Not logged in · Please run /login`, even though platform auth-health
+// reads the FILE and reports `ok`.
 //
-// `claude` exposes a host-managed credentials-file mode: point
-// CLAUDE_CODE_HOST_CREDS_FILE at that file and the spawned claude reads/writes
-// the token there instead of the Keychain, and — crucially — does NOT run its
-// own refresh, waiting up to CLAUDE_CODE_HOST_AUTH_REFRESH_TIMEOUT_MS for the
-// host (this platform's auth-health heartbeat) to refresh an expiring token.
-// That keeps a single refresh owner and no double-refresh race.
+// Task 1395 tried to bridge this by pointing CLAUDE_CODE_HOST_CREDS_FILE at the
+// credentials file. Reading the shipped CLI v2.1.201, that env var does NOT mean
+// "read OAuth creds from here". It engages a host-orchestration handoff only when
+// CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST is also truthy, and it expects the file to
+// be the CLI's internal `{procStart:<number>, env:{…}}` shape — not the
+// `{claudeAiOauth:{…}}` OAuth blob. The platform set neither the companion flag
+// nor that shape, so the CLI ignored the file and fell back to the Keychain. The
+// wiring was a no-op.
 //
-// Darwin-only: on Linux `claude` already defaults to the same file under
-// CLAUDE_CONFIG_DIR, so setting host-creds mode there would needlessly switch
-// refresh ownership. The regression boundary is that Linux stays byte-for-byte
-// unchanged.
+// The correct darwin bridge injects the access token directly. CLAUDE_CODE_OAUTH_TOKEN
+// is a first-class auth source ("ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN,
+// CLAUDE_CODE_OAUTH_TOKEN, or WIF env vars … required") and is honoured on the
+// `--remote-control` session path (only the background-task spawn path scrubs it
+// on macOS). Read at spawn time from the same file auth-health keeps fresh, so
+// the child always carries the current token and the host stays the single
+// refresh owner — the intent Task 1395 aimed for.
+//
+// Darwin-only. On Linux `claude` already reads/refreshes the same file under
+// CLAUDE_CONFIG_DIR, so no env change is needed there; the regression boundary is
+// that the Linux env is byte-for-byte unchanged and no extra file read happens.
+import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-/** Max time (ms) a spawned claude waits for the host to finish refreshing an
- *  expiring token before erroring. The host heartbeat refreshes proactively
- *  inside the 5-minute expiry window, so an in-flight refresh at spawn time is
- *  rare; 30s is a generous ceiling that never wedges a spawn. */
-export const HOST_AUTH_REFRESH_TIMEOUT_MS = '30000';
-/** Mutate `env` in place to enable claude's host-managed credentials-file mode
- *  when running on darwin, then return it. No-op on every other platform.
- *  `claudeConfigDir` is the brand's `.claude` dir; the credentials file is its
- *  `.credentials.json` child. */
-export function applyHostCredsEnv(env, claudeConfigDir, platform = process.platform) {
-    if (platform === 'darwin' && claudeConfigDir) {
-        env.CLAUDE_CODE_HOST_CREDS_FILE = join(claudeConfigDir, '.credentials.json');
-        env.CLAUDE_CODE_HOST_AUTH_REFRESH_TIMEOUT_MS = HOST_AUTH_REFRESH_TIMEOUT_MS;
+/** Mutate `env` in place to authenticate a darwin-spawned claude against the
+ *  platform's credentials FILE, then return it. No-op on every other platform and
+ *  when `claudeConfigDir` is empty. `claudeConfigDir` is the brand's `.claude`
+ *  dir; the credentials file is its `.credentials.json` child (the same path
+ *  auth-health reads). When `logger` is passed, emits one `op=spawn-hostcreds`
+ *  line recording what was resolved and whether a token was applied. */
+export function applyHostCredsEnv(env, claudeConfigDir, platform = process.platform, logger) {
+    if (platform !== 'darwin' || !claudeConfigDir)
+        return env;
+    const credsFile = join(claudeConfigDir, '.credentials.json');
+    const fileExists = existsSync(credsFile);
+    let expiresAt = null;
+    let tokenApplied = false;
+    if (fileExists) {
+        try {
+            const parsed = JSON.parse(readFileSync(credsFile, 'utf8'));
+            const oauth = parsed.claudeAiOauth;
+            if (typeof oauth?.expiresAt === 'number')
+                expiresAt = oauth.expiresAt;
+            if (typeof oauth?.accessToken === 'string' && oauth.accessToken.length > 0) {
+                env.CLAUDE_CODE_OAUTH_TOKEN = oauth.accessToken;
+                tokenApplied = true;
+            }
+        }
+        catch {
+            // Malformed/unreadable file: leave the child unauthenticated rather than
+            // throw and wedge the spawn. tokenApplied stays false; the logger records it.
+        }
     }
+    logger?.(`[spawn] op=spawn-hostcreds platform=darwin credsFile=${credsFile} fileExists=${fileExists} expiresAt=${expiresAt ?? 'none'} configDir=${claudeConfigDir} tokenApplied=${tokenApplied}`);
     return env;
 }
 //# sourceMappingURL=claude-host-creds.js.map

package/payload/platform/services/claude-session-manager/dist/claude-host-creds.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-host-creds.js","sourceRoot":"","sources":["../src/claude-host-creds.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,EAAE;AACF,0EAA0E;AAC1E,gEAAgE;AAChE,0EAA0E;AAC1E,2EAA2E;AAC3E,uEAAuE;AACvE,EAAE;AACF,+DAA+D;AAC/D,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,gEAAgE;AAChE,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,+EAA+E;AAC/E,aAAa;AAEb,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC;;;iEAGiE;AACjE,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAA;AAEnD;;;iCAGiC;AACjC,MAAM,UAAU,iBAAiB,CAC/B,GAAsB,EACtB,eAAuB,EACvB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,QAAQ,IAAI,eAAe,EAAE,CAAC;QAC7C,GAAG,CAAC,2BAA2B,GAAG,IAAI,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAA;QAC5E,GAAG,CAAC,wCAAwC,GAAG,4BAA4B,CAAA;IAC7E,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"claude-host-creds.js","sourceRoot":"","sources":["../src/claude-host-creds.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,4CAA4C;AAC5C,EAAE;AACF,gFAAgF;AAChF,0DAA0D;AAC1D,qEAAqE;AACrE,iFAAiF;AACjF,gFAAgF;AAChF,+EAA+E;AAC/E,mCAAmC;AACnC,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,kFAAkF;AAClF,kFAAkF;AAClF,wEAAwE;AACxE,gFAAgF;AAChF,iFAAiF;AACjF,sBAAsB;AACtB,EAAE;AACF,uFAAuF;AACvF,0EAA0E;AAC1E,+EAA+E;AAC/E,iFAAiF;AACjF,+EAA+E;AAC/E,2EAA2E;AAC3E,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,kFAAkF;AAClF,gFAAgF;AAEhF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC;;;;;wEAKwE;AACxE,MAAM,UAAU,iBAAiB,CAC/B,GAAsB,EACtB,eAAuB,EACvB,WAA4B,OAAO,CAAC,QAAQ,EAC5C,MAA+B;IAE/B,IAAI,QAAQ,KAAK,QAAQ,IAAI,CAAC,eAAe;QAAE,OAAO,GAAG,CAAA;IAEzD,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAA;IAC5D,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;IACxC,IAAI,SAAS,GAAkB,IAAI,CAAA;IACnC,IAAI,YAAY,GAAG,KAAK,CAAA;IACxB,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAExD,CAAA;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAA;YAClC,IAAI,OAAO,KAAK,EAAE,SAAS,KAAK,QAAQ;gBAAE,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;YACrE,IAAI,OAAO,KAAK,EAAE,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3E,GAAG,CAAC,uBAAuB,GAAG,KAAK,CAAC,WAAW,CAAA;gBAC/C,YAAY,GAAG,IAAI,CAAA;YACrB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,8EAA8E;QAChF,CAAC;IACH,CAAC;IAED,MAAM,EAAE,CACN,wDAAwD,SAAS,eAAe,UAAU,cAAc,SAAS,IAAI,MAAM,cAAc,eAAe,iBAAiB,YAAY,EAAE,CACxL,CAAA;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAe3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AA6BzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAyFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAkCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAwJD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA2wFpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAe3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AA8BzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAyFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAkCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAwJD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAoxFpD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -45,7 +45,7 @@ import { createRcChildLog } from './rc-child-log.js';
 import { extractVoiceSection } from './system-prompt.js';
 import { readJsonlSession } from './jsonl-enumerator.js';
 import { computeMetering } from './session-metering.js';
-import { claudeStateRoot, projectSlugForCwd, jsonlPathForSessionId, sidecarPathForSessionId, permissionModeLogPathForSessionId, findExistingJsonlForSessionId, slugForExistingJsonl, jsonlPathForSlug, sidecarPathForSlug, detectRemoteControlSlug, classifyBindBlocker, } from './jsonl-path.js';
+import { claudeStateRoot, projectSlugForCwd, jsonlPathForSessionId, sidecarPathForSessionId, permissionModeLogPathForSessionId, findExistingJsonlForSessionId, slugForExistingJsonl, jsonlPathForSlug, sidecarPathForSlug, detectRemoteControlSlug, classifyBindBlocker, classifyChildAuth, } from './jsonl-path.js';
 import { basename, dirname, join } from 'node:path';
 import { validateUserTitle } from './user-title-store.js';
 import { credentialsPathForConfigDir, snapshotAuthForFailureReason } from './auth-snapshot.js';
@@ -2773,6 +2773,8 @@ export function buildHttpApp(deps) {
             brandedNeo4jUri: process.env.NEO4J_URI ?? '',
             brandedNeo4jPassword: process.env.NEO4J_PASSWORD ?? '',
             sliceToken,
+            // Task 1406 — surface this child's darwin host-creds resolution (op=spawn-hostcreds).
+            logger: deps.logger,
         });
         // Task 983 — account-resolved lifeline, emitted before the child starts so a
         // grep on one sessionId shows where the spawn landed. requested==resolved
@@ -3232,6 +3234,13 @@ export function buildHttpApp(deps) {
         const waitedMs = Date.now() - start;
         const outcome = bridgeSessionId ? 'bound' : 'timeout';
         const reason = outcome === 'bound' ? null : 'pid-bind-timeout';
+        // Task 1406 — derive the child's first-turn auth verdict. A bound child
+        // authenticated; an unbound child that printed `Not logged in` is the
+        // file-healthy-but-child-unauthenticated signature this task closes. Emitted
+        // for both outcomes so a grep on one sessionId shows the child-side result
+        // next to the platform-side auth-health, making the divergence visible.
+        const childAuth = outcome === 'bound' ? 'bound' : classifyChildAuth(bindBuf);
+        deps.logger(`[rc-spawn] op=child-auth result=${childAuth} sessionId=${sessionId ?? 'none'}`);
         if (outcome === 'bound') {
             deps.logger(`[rc-spawn] op=resume-bound sessionId=${sessionId ?? 'none'} slug=${bridgeSessionId} via=${via} ms=${waitedMs}`);
         }