@rubytech/create-maxy-code 0.1.395 → 0.1.396

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.395",
+  "version": "0.1.396",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/services/claude-session-manager/dist/claude-host-creds.d.ts

@@ -1,11 +1,8 @@
-/** Max time (ms) a spawned claude waits for the host to finish refreshing an
- *  expiring token before erroring. The host heartbeat refreshes proactively
- *  inside the 5-minute expiry window, so an in-flight refresh at spawn time is
- *  rare; 30s is a generous ceiling that never wedges a spawn. */
-export declare const HOST_AUTH_REFRESH_TIMEOUT_MS = "30000";
-/** Mutate `env` in place to enable claude's host-managed credentials-file mode
- *  when running on darwin, then return it. No-op on every other platform.
- *  `claudeConfigDir` is the brand's `.claude` dir; the credentials file is its
- *  `.credentials.json` child. */
-export declare function applyHostCredsEnv(env: NodeJS.ProcessEnv, claudeConfigDir: string, platform?: NodeJS.Platform): NodeJS.ProcessEnv;
+/** Mutate `env` in place to authenticate a darwin-spawned claude against the
+ *  platform's credentials FILE, then return it. No-op on every other platform and
+ *  when `claudeConfigDir` is empty. `claudeConfigDir` is the brand's `.claude`
+ *  dir; the credentials file is its `.credentials.json` child (the same path
+ *  auth-health reads). When `logger` is passed, emits one `op=spawn-hostcreds`
+ *  line recording what was resolved and whether a token was applied. */
+export declare function applyHostCredsEnv(env: NodeJS.ProcessEnv, claudeConfigDir: string, platform?: NodeJS.Platform, logger?: (line: string) => void): NodeJS.ProcessEnv;
 //# sourceMappingURL=claude-host-creds.d.ts.map

package/payload/platform/services/claude-session-manager/dist/claude-host-creds.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude-host-creds.d.ts","sourceRoot":"","sources":["../src/claude-host-creds.ts"],"names":[],"mappings":"AAsBA;;;iEAGiE;AACjE,eAAO,MAAM,4BAA4B,UAAU,CAAA;AAEnD;;;iCAGiC;AACjC,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,eAAe,EAAE,MAAM,EACvB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAAC,UAAU,CAMnB"}
+{"version":3,"file":"claude-host-creds.d.ts","sourceRoot":"","sources":["../src/claude-host-creds.ts"],"names":[],"mappings":"AAmCA;;;;;wEAKwE;AACxE,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,eAAe,EAAE,MAAM,EACvB,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC9B,MAAM,CAAC,UAAU,CA4BnB"}

package/payload/platform/services/claude-session-manager/dist/claude-host-creds.js

@@ -1,37 +1,66 @@
-// Task 1395 gap 1 — macOS credential-store bridge.
+// Task 1406 — macOS credential-store bridge (supersedes the Task 1395 gap-1
+// wiring, which was inert on CLI v2.1.201).
 //
-// On macOS the `claude` CLI stores its OAuth token in the login Keychain,
-// while this platform reads and refreshes the token from a FILE
-// (`<CLAUDE_CONFIG_DIR>/.credentials.json`, the same path the UI server's
-// readCredentials()/writeOAuthCredentials() own). Left alone the two never
-// meet: auth-health reads an empty file and reports `missing` forever.
+// On macOS the `claude` CLI stores its OAuth token in the login Keychain, while
+// this platform reads and refreshes the token from a FILE
+// (`<CLAUDE_CONFIG_DIR>/.credentials.json`, the path the UI server's
+// readCredentials()/writeOAuthCredentials() own). Left alone the two never meet:
+// the child authenticates against a stale/empty Keychain and its first API turn
+// prints `Not logged in · Please run /login`, even though platform auth-health
+// reads the FILE and reports `ok`.
 //
-// `claude` exposes a host-managed credentials-file mode: point
-// CLAUDE_CODE_HOST_CREDS_FILE at that file and the spawned claude reads/writes
-// the token there instead of the Keychain, and — crucially — does NOT run its
-// own refresh, waiting up to CLAUDE_CODE_HOST_AUTH_REFRESH_TIMEOUT_MS for the
-// host (this platform's auth-health heartbeat) to refresh an expiring token.
-// That keeps a single refresh owner and no double-refresh race.
+// Task 1395 tried to bridge this by pointing CLAUDE_CODE_HOST_CREDS_FILE at the
+// credentials file. Reading the shipped CLI v2.1.201, that env var does NOT mean
+// "read OAuth creds from here". It engages a host-orchestration handoff only when
+// CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST is also truthy, and it expects the file to
+// be the CLI's internal `{procStart:<number>, env:{…}}` shape — not the
+// `{claudeAiOauth:{…}}` OAuth blob. The platform set neither the companion flag
+// nor that shape, so the CLI ignored the file and fell back to the Keychain. The
+// wiring was a no-op.
 //
-// Darwin-only: on Linux `claude` already defaults to the same file under
-// CLAUDE_CONFIG_DIR, so setting host-creds mode there would needlessly switch
-// refresh ownership. The regression boundary is that Linux stays byte-for-byte
-// unchanged.
+// The correct darwin bridge injects the access token directly. CLAUDE_CODE_OAUTH_TOKEN
+// is a first-class auth source ("ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN,
+// CLAUDE_CODE_OAUTH_TOKEN, or WIF env vars … required") and is honoured on the
+// `--remote-control` session path (only the background-task spawn path scrubs it
+// on macOS). Read at spawn time from the same file auth-health keeps fresh, so
+// the child always carries the current token and the host stays the single
+// refresh owner — the intent Task 1395 aimed for.
+//
+// Darwin-only. On Linux `claude` already reads/refreshes the same file under
+// CLAUDE_CONFIG_DIR, so no env change is needed there; the regression boundary is
+// that the Linux env is byte-for-byte unchanged and no extra file read happens.
+import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-/** Max time (ms) a spawned claude waits for the host to finish refreshing an
- *  expiring token before erroring. The host heartbeat refreshes proactively
- *  inside the 5-minute expiry window, so an in-flight refresh at spawn time is
- *  rare; 30s is a generous ceiling that never wedges a spawn. */
-export const HOST_AUTH_REFRESH_TIMEOUT_MS = '30000';
-/** Mutate `env` in place to enable claude's host-managed credentials-file mode
- *  when running on darwin, then return it. No-op on every other platform.
- *  `claudeConfigDir` is the brand's `.claude` dir; the credentials file is its
- *  `.credentials.json` child. */
-export function applyHostCredsEnv(env, claudeConfigDir, platform = process.platform) {
-    if (platform === 'darwin' && claudeConfigDir) {
-        env.CLAUDE_CODE_HOST_CREDS_FILE = join(claudeConfigDir, '.credentials.json');
-        env.CLAUDE_CODE_HOST_AUTH_REFRESH_TIMEOUT_MS = HOST_AUTH_REFRESH_TIMEOUT_MS;
+/** Mutate `env` in place to authenticate a darwin-spawned claude against the
+ *  platform's credentials FILE, then return it. No-op on every other platform and
+ *  when `claudeConfigDir` is empty. `claudeConfigDir` is the brand's `.claude`
+ *  dir; the credentials file is its `.credentials.json` child (the same path
+ *  auth-health reads). When `logger` is passed, emits one `op=spawn-hostcreds`
+ *  line recording what was resolved and whether a token was applied. */
+export function applyHostCredsEnv(env, claudeConfigDir, platform = process.platform, logger) {
+    if (platform !== 'darwin' || !claudeConfigDir)
+        return env;
+    const credsFile = join(claudeConfigDir, '.credentials.json');
+    const fileExists = existsSync(credsFile);
+    let expiresAt = null;
+    let tokenApplied = false;
+    if (fileExists) {
+        try {
+            const parsed = JSON.parse(readFileSync(credsFile, 'utf8'));
+            const oauth = parsed.claudeAiOauth;
+            if (typeof oauth?.expiresAt === 'number')
+                expiresAt = oauth.expiresAt;
+            if (typeof oauth?.accessToken === 'string' && oauth.accessToken.length > 0) {
+                env.CLAUDE_CODE_OAUTH_TOKEN = oauth.accessToken;
+                tokenApplied = true;
+            }
+        }
+        catch {
+            // Malformed/unreadable file: leave the child unauthenticated rather than
+            // throw and wedge the spawn. tokenApplied stays false; the logger records it.
+        }
     }
+    logger?.(`[spawn] op=spawn-hostcreds platform=darwin credsFile=${credsFile} fileExists=${fileExists} expiresAt=${expiresAt ?? 'none'} configDir=${claudeConfigDir} tokenApplied=${tokenApplied}`);
     return env;
 }
 //# sourceMappingURL=claude-host-creds.js.map

package/payload/platform/services/claude-session-manager/dist/claude-host-creds.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-host-creds.js","sourceRoot":"","sources":["../src/claude-host-creds.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,EAAE;AACF,0EAA0E;AAC1E,gEAAgE;AAChE,0EAA0E;AAC1E,2EAA2E;AAC3E,uEAAuE;AACvE,EAAE;AACF,+DAA+D;AAC/D,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,gEAAgE;AAChE,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,+EAA+E;AAC/E,aAAa;AAEb,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC;;;iEAGiE;AACjE,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAA;AAEnD;;;iCAGiC;AACjC,MAAM,UAAU,iBAAiB,CAC/B,GAAsB,EACtB,eAAuB,EACvB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,QAAQ,IAAI,eAAe,EAAE,CAAC;QAC7C,GAAG,CAAC,2BAA2B,GAAG,IAAI,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAA;QAC5E,GAAG,CAAC,wCAAwC,GAAG,4BAA4B,CAAA;IAC7E,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"claude-host-creds.js","sourceRoot":"","sources":["../src/claude-host-creds.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,4CAA4C;AAC5C,EAAE;AACF,gFAAgF;AAChF,0DAA0D;AAC1D,qEAAqE;AACrE,iFAAiF;AACjF,gFAAgF;AAChF,+EAA+E;AAC/E,mCAAmC;AACnC,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,kFAAkF;AAClF,kFAAkF;AAClF,wEAAwE;AACxE,gFAAgF;AAChF,iFAAiF;AACjF,sBAAsB;AACtB,EAAE;AACF,uFAAuF;AACvF,0EAA0E;AAC1E,+EAA+E;AAC/E,iFAAiF;AACjF,+EAA+E;AAC/E,2EAA2E;AAC3E,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,kFAAkF;AAClF,gFAAgF;AAEhF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC;;;;;wEAKwE;AACxE,MAAM,UAAU,iBAAiB,CAC/B,GAAsB,EACtB,eAAuB,EACvB,WAA4B,OAAO,CAAC,QAAQ,EAC5C,MAA+B;IAE/B,IAAI,QAAQ,KAAK,QAAQ,IAAI,CAAC,eAAe;QAAE,OAAO,GAAG,CAAA;IAEzD,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAA;IAC5D,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;IACxC,IAAI,SAAS,GAAkB,IAAI,CAAA;IACnC,IAAI,YAAY,GAAG,KAAK,CAAA;IACxB,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAExD,CAAA;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAA;YAClC,IAAI,OAAO,KAAK,EAAE,SAAS,KAAK,QAAQ;gBAAE,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;YACrE,IAAI,OAAO,KAAK,EAAE,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3E,GAAG,CAAC,uBAAuB,GAAG,KAAK,CAAC,WAAW,CAAA;gBAC/C,YAAY,GAAG,IAAI,CAAA;YACrB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,8EAA8E;QAChF,CAAC;IACH,CAAC;IAED,MAAM,EAAE,CACN,wDAAwD,SAAS,eAAe,UAAU,cAAc,SAAS,IAAI,MAAM,cAAc,eAAe,iBAAiB,YAAY,EAAE,CACxL,CAAA;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAe3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AA6BzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAyFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAkCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAwJD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA2wFpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAe3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AA8BzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAyFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAkCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAwJD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAoxFpD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -45,7 +45,7 @@ import { createRcChildLog } from './rc-child-log.js';
 import { extractVoiceSection } from './system-prompt.js';
 import { readJsonlSession } from './jsonl-enumerator.js';
 import { computeMetering } from './session-metering.js';
-import { claudeStateRoot, projectSlugForCwd, jsonlPathForSessionId, sidecarPathForSessionId, permissionModeLogPathForSessionId, findExistingJsonlForSessionId, slugForExistingJsonl, jsonlPathForSlug, sidecarPathForSlug, detectRemoteControlSlug, classifyBindBlocker, } from './jsonl-path.js';
+import { claudeStateRoot, projectSlugForCwd, jsonlPathForSessionId, sidecarPathForSessionId, permissionModeLogPathForSessionId, findExistingJsonlForSessionId, slugForExistingJsonl, jsonlPathForSlug, sidecarPathForSlug, detectRemoteControlSlug, classifyBindBlocker, classifyChildAuth, } from './jsonl-path.js';
 import { basename, dirname, join } from 'node:path';
 import { validateUserTitle } from './user-title-store.js';
 import { credentialsPathForConfigDir, snapshotAuthForFailureReason } from './auth-snapshot.js';
@@ -2773,6 +2773,8 @@ export function buildHttpApp(deps) {
             brandedNeo4jUri: process.env.NEO4J_URI ?? '',
             brandedNeo4jPassword: process.env.NEO4J_PASSWORD ?? '',
             sliceToken,
+            // Task 1406 — surface this child's darwin host-creds resolution (op=spawn-hostcreds).
+            logger: deps.logger,
         });
         // Task 983 — account-resolved lifeline, emitted before the child starts so a
         // grep on one sessionId shows where the spawn landed. requested==resolved
@@ -3232,6 +3234,13 @@ export function buildHttpApp(deps) {
         const waitedMs = Date.now() - start;
         const outcome = bridgeSessionId ? 'bound' : 'timeout';
         const reason = outcome === 'bound' ? null : 'pid-bind-timeout';
+        // Task 1406 — derive the child's first-turn auth verdict. A bound child
+        // authenticated; an unbound child that printed `Not logged in` is the
+        // file-healthy-but-child-unauthenticated signature this task closes. Emitted
+        // for both outcomes so a grep on one sessionId shows the child-side result
+        // next to the platform-side auth-health, making the divergence visible.
+        const childAuth = outcome === 'bound' ? 'bound' : classifyChildAuth(bindBuf);
+        deps.logger(`[rc-spawn] op=child-auth result=${childAuth} sessionId=${sessionId ?? 'none'}`);
         if (outcome === 'bound') {
             deps.logger(`[rc-spawn] op=resume-bound sessionId=${sessionId ?? 'none'} slug=${bridgeSessionId} via=${via} ms=${waitedMs}`);
         }