@tokenfactory/acc-runner 0.40.11 → 0.40.12

package/dist/engines/account-identity.d.ts

@@ -0,0 +1,54 @@
+import type { EngineAccountIdentity, EngineAuthMode, EnginePlanHint } from "./types.js";
+/**
+ * Derive the stable synthetic account id.
+ *   - With an email: `acct:<lowercased-trimmed-email>` — the SAME login on two
+ *     hosts/channels collapses to one id, which is exactly the convergence the
+ *     broadcaster wants.
+ *   - Without an email: `host:<hostname>/<engineId>/<channel>` — stable for a
+ *     given runner install + channel, distinct across hosts, and never null.
+ */
+export declare function syntheticAccountId(args: {
+    engineId: string;
+    channel: EngineAuthMode;
+    email?: string | null;
+    hostname?: string;
+}): string;
+/**
+ * Build the HONEST "unknown-account" identity an adapter reports when it cannot
+ * introspect a real account (codex/gemini today, or claude-code in api-key mode
+ * where a bare key carries no email). Never fabricates an email or a plan.
+ */
+export declare function unknownAccountIdentity(args: {
+    engineId: string;
+    channel: EngineAuthMode;
+    planHint?: EnginePlanHint;
+    detail: string;
+    hostname?: string;
+}): EngineAccountIdentity;
+/**
+ * Build a RESOLVED account identity from an introspected email (+ optional
+ * plan). The synthetic id is email-derived so it converges across hosts.
+ */
+export declare function resolvedAccountIdentity(args: {
+    engineId: string;
+    channel: EngineAuthMode;
+    email: string;
+    planHint?: EnginePlanHint;
+    detail: string;
+}): EngineAccountIdentity;
+/**
+ * The identity used for change detection / broadcast keying. Two probes name the
+ * same account iff their `synthetic_account` matches (email-derived when known,
+ * host-derived otherwise) — so a login swap on one host, an email that appears
+ * where there was none, or a channel flip are all detected, while a plain
+ * cadence refresh that resolves the same account is a no-op.
+ */
+export declare function accountKey(identity: EngineAccountIdentity): string;
+/**
+ * True when `next` names a different account than `prev` (or there was no prior
+ * account). The broadcaster audits on `true` and last-writer-wins-skips on
+ * `false`. A plan_hint-only change (same account, upgraded plan) also counts as
+ * a change worth re-broadcasting so downstream cap logic sees the new plan.
+ */
+export declare function accountChanged(prev: EngineAccountIdentity | null, next: EngineAccountIdentity): boolean;
+//# sourceMappingURL=account-identity.d.ts.map

package/dist/engines/account-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-identity.d.ts","sourceRoot":"","sources":["../../src/engines/account-identity.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,qBAAqB,EACrB,cAAc,EACd,cAAc,EACf,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,cAAc,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CAKT;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,cAAc,CAAC;IACxB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,qBAAqB,CAYxB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,cAAc,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,qBAAqB,CAaxB;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,qBAAqB,GAAG,MAAM,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,qBAAqB,GAAG,IAAI,EAClC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAGT"}

package/dist/engines/account-identity.js

@@ -0,0 +1,93 @@
+/**
+ * AS-1 (ACCOUNT-PROBE): shared, side-effect-free helpers for the engine
+ * `accountIdentity()` surface (types.ts). Two concerns live here so every
+ * adapter (claude-code / codex / gemini) spells them identically:
+ *
+ *   1. Synthetic-account derivation — a STABLE id an engine reports so the
+ *      identity broadcaster always has a concrete participant to converge on,
+ *      even when the real account email is unintrospectable. Email-derived when
+ *      an email resolves (same login → same id across hosts); host+engine+channel
+ *      derived otherwise (an unknown-account runner is still stable + distinct
+ *      rather than a flapping null).
+ *   2. Change detection / audit — `accountChanged()` compares the last-broadcast
+ *      identity against a freshly-probed one so the last-writer-wins broadcaster
+ *      can decide whether an emit is a no-op refresh or a real login swap worth
+ *      auditing (the ajay→gaurav evidence that motivated the task).
+ *
+ * PURE by construction (the one impurity — hostname — is passed in), so the
+ * cadence + parsing logic is unit-testable without touching `os` or a clock.
+ */
+import os from "node:os";
+/**
+ * Derive the stable synthetic account id.
+ *   - With an email: `acct:<lowercased-trimmed-email>` — the SAME login on two
+ *     hosts/channels collapses to one id, which is exactly the convergence the
+ *     broadcaster wants.
+ *   - Without an email: `host:<hostname>/<engineId>/<channel>` — stable for a
+ *     given runner install + channel, distinct across hosts, and never null.
+ */
+export function syntheticAccountId(args) {
+    const email = (args.email ?? "").trim().toLowerCase();
+    if (email)
+        return `acct:${email}`;
+    const host = (args.hostname ?? os.hostname() ?? "").trim() || "unknown-host";
+    return `host:${host}/${args.engineId}/${args.channel}`;
+}
+/**
+ * Build the HONEST "unknown-account" identity an adapter reports when it cannot
+ * introspect a real account (codex/gemini today, or claude-code in api-key mode
+ * where a bare key carries no email). Never fabricates an email or a plan.
+ */
+export function unknownAccountIdentity(args) {
+    return {
+        account_email: null,
+        plan_hint: args.planHint ?? "unknown",
+        channel: args.channel,
+        synthetic_account: syntheticAccountId({
+            engineId: args.engineId,
+            channel: args.channel,
+            hostname: args.hostname,
+        }),
+        detail: args.detail,
+    };
+}
+/**
+ * Build a RESOLVED account identity from an introspected email (+ optional
+ * plan). The synthetic id is email-derived so it converges across hosts.
+ */
+export function resolvedAccountIdentity(args) {
+    const email = args.email.trim();
+    return {
+        account_email: email,
+        plan_hint: args.planHint ?? "unknown",
+        channel: args.channel,
+        synthetic_account: syntheticAccountId({
+            engineId: args.engineId,
+            channel: args.channel,
+            email,
+        }),
+        detail: args.detail,
+    };
+}
+/**
+ * The identity used for change detection / broadcast keying. Two probes name the
+ * same account iff their `synthetic_account` matches (email-derived when known,
+ * host-derived otherwise) — so a login swap on one host, an email that appears
+ * where there was none, or a channel flip are all detected, while a plain
+ * cadence refresh that resolves the same account is a no-op.
+ */
+export function accountKey(identity) {
+    return identity.synthetic_account;
+}
+/**
+ * True when `next` names a different account than `prev` (or there was no prior
+ * account). The broadcaster audits on `true` and last-writer-wins-skips on
+ * `false`. A plan_hint-only change (same account, upgraded plan) also counts as
+ * a change worth re-broadcasting so downstream cap logic sees the new plan.
+ */
+export function accountChanged(prev, next) {
+    if (!prev)
+        return true;
+    return accountKey(prev) !== accountKey(next) || prev.plan_hint !== next.plan_hint;
+}
+//# sourceMappingURL=account-identity.js.map

package/dist/engines/account-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-identity.js","sourceRoot":"","sources":["../../src/engines/account-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AAOzB;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAKlC;IACC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,KAAK;QAAE,OAAO,QAAQ,KAAK,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,cAAc,CAAC;IAC7E,OAAO,QAAQ,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAMtC;IACC,OAAO;QACL,aAAa,EAAE,IAAI;QACnB,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;QACrC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,iBAAiB,EAAE,kBAAkB,CAAC;YACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;QACF,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAMvC;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,OAAO;QACL,aAAa,EAAE,KAAK;QACpB,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;QACrC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,iBAAiB,EAAE,kBAAkB,CAAC;YACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK;SACN,CAAC;QACF,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,QAA+B;IACxD,OAAO,QAAQ,CAAC,iBAAiB,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAkC,EAClC,IAA2B;IAE3B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC;AACpF,CAAC"}

package/dist/engines/account-probe.d.ts

@@ -0,0 +1,124 @@
+/**
+ * AS-1 (ACCOUNT-PROBE): the account-probe CADENCE scheduler.
+ *
+ * Extends the engine credential probe with a WHO-am-I probe fired on four
+ * triggers so a mid-flight login swap can never go undetected (operator
+ * evidence: swapping the keychain login ajay→gaurav went undetected while the
+ * runner sat paused on the old account's reset timer):
+ *
+ *   1. startup       — one probe the moment the scheduler starts.
+ *   2. pause-tick    — every ~60s WHILE the runner is capacity-paused (the exact
+ *                      window the ajay→gaurav swap slipped through: a paused
+ *                      runner otherwise only re-probed on the 5-min heartbeat).
+ *   3. heartbeat     — every ~5min while healthy (unpaused).
+ *   4. auth-failure  — immediately after any 401/403-class engine failure
+ *                      (debounced so a burst of 401s is a single probe).
+ *
+ * Each probe result is handed to `emit` with a MONOTONIC sequence + wall-clock
+ * stamp so the identity broadcaster resolves concurrent writers last-writer-wins,
+ * and a `changed` flag so a real login swap is audited while a plain cadence
+ * refresh of the same account is a cheap no-op.
+ *
+ * FULLY injectable (probe / emit / clock / timer) so the four-trigger cadence is
+ * exercised with a fake clock — no real binary, no wall-clock sleep, no network.
+ * Wiring this scheduler onto the companion's identity broadcaster is a follow-up
+ * (companion.ts is outside this track's file scope); this module is the engine
+ * primitive that follow-up drives.
+ */
+import type { EngineAccountIdentity } from "./types.js";
+/** Which cadence trigger fired a given probe. */
+export type AccountProbeTrigger = "startup" | "pause-tick" | "heartbeat" | "auth-failure";
+/** One account-probe broadcast handed to the identity broadcaster. */
+export interface AccountProbeBroadcast {
+    /** The probed account identity. */
+    identity: EngineAccountIdentity;
+    /** Which cadence trigger produced this probe. */
+    trigger: AccountProbeTrigger;
+    /**
+     * True when this probe named a DIFFERENT account (or plan) than the last
+     * broadcast — the audit signal a login swap fires on. False on a plain
+     * same-account cadence refresh.
+     */
+    changed: boolean;
+    /** Monotonic 1-based sequence for last-writer-wins resolution on the topic. */
+    seq: number;
+    /** Wall-clock ms of the probe (from the injected clock). */
+    at: number;
+}
+/** Timer seam so the cadence is drivable by a fake clock in tests. */
+export interface ProbeTimer {
+    /** Schedule `fn` after `ms`; returns an opaque handle. */
+    setTimer(fn: () => void, ms: number): unknown;
+    /** Cancel a scheduled handle. */
+    clearTimer(handle: unknown): void;
+}
+export interface AccountProbeSchedulerDeps {
+    /** Probe the engine account. Should itself degrade to an honest `"unknown"` identity rather than throw. */
+    probe: () => Promise<EngineAccountIdentity>;
+    /** Emit a probed identity on the identity broadcaster (last-writer-wins keyed on `seq`). */
+    emit: (broadcast: AccountProbeBroadcast) => void | Promise<void>;
+    /** Healthy heartbeat cadence (ms). Default 5min. */
+    heartbeatMs?: number;
+    /** While-paused probe cadence (ms). Default 60s. */
+    pauseTickMs?: number;
+    /** Min gap between auth-failure probes (ms) so a 401 burst is one probe. Default 1s. */
+    authFailureDebounceMs?: number;
+    /** Clock (test seam). Default `Date.now`. */
+    now?: () => number;
+    /** Timer seam (test seam). Default `setTimeout`/`clearTimeout`. */
+    timer?: ProbeTimer;
+    /** Best-effort audit/log sink for detected swaps + probe errors. */
+    onLog?: (line: string) => void;
+}
+/**
+ * Drives the four-trigger account-probe cadence. Probes are SERIALIZED onto one
+ * chain so sequence numbers are strictly monotonic and two triggers never race
+ * to emit an out-of-order identity. Call `start()` to fire the startup probe and
+ * arm the recurring timer, `setPaused()` on capacity transitions, and
+ * `onAuthFailure()` from the engine failure path.
+ */
+export declare class AccountProbeScheduler {
+    private readonly deps;
+    private readonly heartbeatMs;
+    private readonly pauseTickMs;
+    private readonly authFailureDebounceMs;
+    private readonly now;
+    private readonly timer;
+    private started;
+    private stopped;
+    private paused;
+    private recurringHandle;
+    private seq;
+    private last;
+    private lastAuthFailureAt;
+    /** Serial probe chain: every probe awaits the prior one so `seq` stays ordered. */
+    private tail;
+    constructor(deps: AccountProbeSchedulerDeps);
+    /** The last identity broadcast (null before the first probe). */
+    lastIdentity(): EngineAccountIdentity | null;
+    /** Fire the startup probe and arm the recurring cadence timer. Idempotent. */
+    start(): void;
+    /**
+     * Note a capacity pause/resume transition. Re-arms the recurring timer to the
+     * matching cadence (~60s paused, ~5min healthy). A no-op when the state is
+     * unchanged, so repeated pause ticks don't reset the timer out from under
+     * themselves.
+     */
+    setPaused(paused: boolean): void;
+    /**
+     * Probe immediately after a 401/403-class engine failure — the single most
+     * likely moment the underlying login just changed. Debounced so a burst of
+     * auth failures collapses to one probe.
+     */
+    onAuthFailure(): void;
+    /** Cancel the recurring timer; in-flight probes still settle. */
+    stop(): void;
+    /** Resolve once every queued probe has settled (test seam). */
+    settle(): Promise<void>;
+    private armRecurring;
+    private onRecurringFire;
+    /** Chain a probe onto the serial tail so sequence order is guaranteed. */
+    private enqueue;
+    private runProbe;
+}
+//# sourceMappingURL=account-probe.d.ts.map

package/dist/engines/account-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-probe.d.ts","sourceRoot":"","sources":["../../src/engines/account-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAGxD,iDAAiD;AACjD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,cAAc,CAAC;AAE1F,sEAAsE;AACtE,MAAM,WAAW,qBAAqB;IACpC,mCAAmC;IACnC,QAAQ,EAAE,qBAAqB,CAAC;IAChC,iDAAiD;IACjD,OAAO,EAAE,mBAAmB,CAAC;IAC7B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,sEAAsE;AACtE,MAAM,WAAW,UAAU;IACzB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9C,iCAAiC;IACjC,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;CACnC;AAOD,MAAM,WAAW,yBAAyB;IACxC,2GAA2G;IAC3G,KAAK,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC5C,4FAA4F;IAC5F,IAAI,EAAE,CAAC,SAAS,EAAE,qBAAqB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wFAAwF;IACxF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,6CAA6C;IAC7C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,mEAAmE;IACnE,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,oEAAoE;IACpE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAiBpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAhBjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAC/C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IAEnC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,eAAe,CAAiB;IACxC,OAAO,CAAC,GAAG,CAAK;IAChB,OAAO,CAAC,IAAI,CAAsC;IAClD,OAAO,CAAC,iBAAiB,CAA4B;IACrD,mFAAmF;IACnF,OAAO,CAAC,IAAI,CAAoC;gBAEnB,IAAI,EAAE,yBAAyB;IAQ5D,iEAAiE;IACjE,YAAY,IAAI,qBAAqB,GAAG,IAAI;IAI5C,8EAA8E;IAC9E,KAAK,IAAI,IAAI;IAOb;;;;;OAKG;IACH,SAAS,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAMhC;;;;OAIG;IACH,aAAa,IAAI,IAAI;IAQrB,iEAAiE;IACjE,IAAI,IAAI,IAAI;IAQZ,+DAA+D;IACzD,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,eAAe;IAQvB,0EAA0E;IAC1E,OAAO,CAAC,OAAO;YAID,QAAQ;CA2BvB"}

package/dist/engines/account-probe.js

@@ -0,0 +1,134 @@
+import { accountChanged } from "./account-identity.js";
+const DEFAULT_TIMER = {
+    setTimer: (fn, ms) => setTimeout(fn, ms),
+    clearTimer: (h) => clearTimeout(h),
+};
+/**
+ * Drives the four-trigger account-probe cadence. Probes are SERIALIZED onto one
+ * chain so sequence numbers are strictly monotonic and two triggers never race
+ * to emit an out-of-order identity. Call `start()` to fire the startup probe and
+ * arm the recurring timer, `setPaused()` on capacity transitions, and
+ * `onAuthFailure()` from the engine failure path.
+ */
+export class AccountProbeScheduler {
+    deps;
+    heartbeatMs;
+    pauseTickMs;
+    authFailureDebounceMs;
+    now;
+    timer;
+    started = false;
+    stopped = false;
+    paused = false;
+    recurringHandle = null;
+    seq = 0;
+    last = null;
+    lastAuthFailureAt = Number.NEGATIVE_INFINITY;
+    /** Serial probe chain: every probe awaits the prior one so `seq` stays ordered. */
+    tail = Promise.resolve();
+    constructor(deps) {
+        this.deps = deps;
+        this.heartbeatMs = Math.max(1, deps.heartbeatMs ?? 5 * 60_000);
+        this.pauseTickMs = Math.max(1, deps.pauseTickMs ?? 60_000);
+        this.authFailureDebounceMs = Math.max(0, deps.authFailureDebounceMs ?? 1_000);
+        this.now = deps.now ?? Date.now;
+        this.timer = deps.timer ?? DEFAULT_TIMER;
+    }
+    /** The last identity broadcast (null before the first probe). */
+    lastIdentity() {
+        return this.last;
+    }
+    /** Fire the startup probe and arm the recurring cadence timer. Idempotent. */
+    start() {
+        if (this.started || this.stopped)
+            return;
+        this.started = true;
+        this.enqueue("startup");
+        this.armRecurring();
+    }
+    /**
+     * Note a capacity pause/resume transition. Re-arms the recurring timer to the
+     * matching cadence (~60s paused, ~5min healthy). A no-op when the state is
+     * unchanged, so repeated pause ticks don't reset the timer out from under
+     * themselves.
+     */
+    setPaused(paused) {
+        if (this.stopped || paused === this.paused)
+            return;
+        this.paused = paused;
+        if (this.started)
+            this.armRecurring();
+    }
+    /**
+     * Probe immediately after a 401/403-class engine failure — the single most
+     * likely moment the underlying login just changed. Debounced so a burst of
+     * auth failures collapses to one probe.
+     */
+    onAuthFailure() {
+        if (this.stopped || !this.started)
+            return;
+        const t = this.now();
+        if (t - this.lastAuthFailureAt < this.authFailureDebounceMs)
+            return;
+        this.lastAuthFailureAt = t;
+        this.enqueue("auth-failure");
+    }
+    /** Cancel the recurring timer; in-flight probes still settle. */
+    stop() {
+        this.stopped = true;
+        if (this.recurringHandle !== null) {
+            this.timer.clearTimer(this.recurringHandle);
+            this.recurringHandle = null;
+        }
+    }
+    /** Resolve once every queued probe has settled (test seam). */
+    async settle() {
+        await this.tail;
+    }
+    armRecurring() {
+        if (this.recurringHandle !== null) {
+            this.timer.clearTimer(this.recurringHandle);
+            this.recurringHandle = null;
+        }
+        if (this.stopped)
+            return;
+        const ms = this.paused ? this.pauseTickMs : this.heartbeatMs;
+        this.recurringHandle = this.timer.setTimer(() => this.onRecurringFire(), ms);
+    }
+    onRecurringFire() {
+        if (this.stopped)
+            return;
+        // Re-arm BEFORE the async probe so the cadence is decoupled from probe
+        // latency and stays deterministic under a fake clock.
+        this.armRecurring();
+        this.enqueue(this.paused ? "pause-tick" : "heartbeat");
+    }
+    /** Chain a probe onto the serial tail so sequence order is guaranteed. */
+    enqueue(trigger) {
+        this.tail = this.tail.then(() => this.runProbe(trigger));
+    }
+    async runProbe(trigger) {
+        let identity;
+        try {
+            identity = await this.deps.probe();
+        }
+        catch (err) {
+            this.deps.onLog?.(`[acc-runner] account probe (${trigger}) failed: ${err?.message ?? String(err)}`);
+            return;
+        }
+        const changed = accountChanged(this.last, identity);
+        const seq = ++this.seq;
+        const at = this.now();
+        if (changed && this.last) {
+            this.deps.onLog?.(`[acc-runner] account swap detected (${trigger}): ${this.last.synthetic_account} → ${identity.synthetic_account}`);
+        }
+        try {
+            await this.deps.emit({ identity, trigger, changed, seq, at });
+        }
+        catch (err) {
+            this.deps.onLog?.(`[acc-runner] account identity emit failed (${trigger}): ${err?.message ?? String(err)}`);
+        }
+        this.last = identity;
+    }
+}
+//# sourceMappingURL=account-probe.js.map

package/dist/engines/account-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-probe.js","sourceRoot":"","sources":["../../src/engines/account-probe.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AA+BvD,MAAM,aAAa,GAAe;IAChC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAkC,CAAC;CACpE,CAAC;AAqBF;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IAiBH;IAhBZ,WAAW,CAAS;IACpB,WAAW,CAAS;IACpB,qBAAqB,CAAS;IAC9B,GAAG,CAAe;IAClB,KAAK,CAAa;IAE3B,OAAO,GAAG,KAAK,CAAC;IAChB,OAAO,GAAG,KAAK,CAAC;IAChB,MAAM,GAAG,KAAK,CAAC;IACf,eAAe,GAAY,IAAI,CAAC;IAChC,GAAG,GAAG,CAAC,CAAC;IACR,IAAI,GAAiC,IAAI,CAAC;IAC1C,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACrD,mFAAmF;IAC3E,IAAI,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEhD,YAA6B,IAA+B;QAA/B,SAAI,GAAJ,IAAI,CAA2B;QAC1D,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,qBAAqB,IAAI,KAAK,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;IAC3C,CAAC;IAED,iEAAiE;IACjE,YAAY;QACV,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,8EAA8E;IAC9E,KAAK;QACH,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxB,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAe;QACvB,IAAI,IAAI,CAAC,OAAO,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO;QACnD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,aAAa;QACX,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,qBAAqB;YAAE,OAAO;QACpE,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/B,CAAC;IAED,iEAAiE;IACjE,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,IAAI,CAAC;IAClB,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;QACD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QAC7D,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;IAEO,eAAe;QACrB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,uEAAuE;QACvE,sDAAsD;QACtD,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACzD,CAAC;IAED,0EAA0E;IAClE,OAAO,CAAC,OAA4B;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,OAA4B;QACjD,IAAI,QAA+B,CAAC;QACpC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CACf,+BAA+B,OAAO,aAAc,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAC5F,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QACvB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,IAAI,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CACf,uCAAuC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAClH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CACf,8CAA8C,OAAO,MAAO,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CACpG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;IACvB,CAAC;CACF"}

package/dist/engines/claude-code-chat.d.ts

@@ -1,7 +1,7 @@
 import { type ExecaChildProcess } from "execa";
 import { type AnthropicAuthMode } from "../provider-auth.js";
 import { type ParsedChatStreamEvent } from "./chat-stream.js";
-import type { AccMcpToolBusFence, ConformantAgentEngine, EngineCapabilityMatrix, EngineStreamTurnOptions, RunnerCapacityClass } from "./types.js";
+import type { AccMcpToolBusFence, ConformantAgentEngine, EngineCapabilityMatrix, EnginePlanHint, EngineStreamTurnOptions, RunnerCapacityClass } from "./types.js";
 /**
  * Native (built-in) claude tools disabled for a chat-lane turn. The tool bus is
  * fenced to acc-mcp only, so none of claude's file/shell/web/task tools may run
@@ -67,6 +67,18 @@ export declare function parseChatStreamLine(line: string): ParsedChatStreamEvent
  *   otherwise overloaded (scheduler stops assigning turns).
  */
 export declare function classifyCapacityFromLoad(load1: number, cores: number): RunnerCapacityClass;
+/**
+ * TOLERANT parse of the claude config JSON into `{ email, plan }`. Reads
+ * `oauthAccount.emailAddress` for the email and, for the plan, the first of
+ * `oauthAccount.subscriptionType`, top-level `subscriptionType`, or
+ * `claudeAiOauth.subscriptionType` that resolves — matching the fields observed
+ * across CLI builds. Returns `{ email: null, plan: "unknown" }` for missing
+ * file / non-JSON / unexpected shape.
+ */
+export declare function parseClaudeAccountConfig(raw: string | null): {
+    email: string | null;
+    plan: EnginePlanHint;
+};
 /** Static capability declaration for the claude-code chat reference build. */
 export declare const CLAUDE_CODE_CHAT_CAPABILITIES: EngineCapabilityMatrix;
 export interface ClaudeCodeChatDeps {
@@ -83,6 +95,8 @@ export interface ClaudeCodeChatDeps {
         load1: number;
         cores: number;
     };
+    /** Read the claude config JSON for account introspection (default: reads `~/.claude.json`). */
+    readClaudeConfig?: (env?: NodeJS.ProcessEnv) => string | null;
 }
 /**
  * Build a chat-conformant claude-code engine. Composes the FROZEN batch

package/dist/engines/claude-code-chat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude-code-chat.d.ts","sourceRoot":"","sources":["../../src/engines/claude-code-chat.ts"],"names":[],"mappings":"AAiCA,OAAO,EAAS,KAAK,iBAAiB,EAAE,MAAM,OAAO,CAAC;AACtD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAkB,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EAItB,uBAAuB,EACvB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAIpB;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAgBlD,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,4BAA4B,6BAA6B,CAAC;AAEvE;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,kBAAkB,CAEtD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,MAAM,EAAE,CAmBtG;AAQD;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAAC,UAAU,CAKxE;AAgBD,YAAY,EAAE,qBAAqB,EAAE,CAAC;AAkBtC;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAoB9E;AASD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAO1F;AA4CD,8EAA8E;AAC9E,eAAO,MAAM,6BAA6B,EAAE,sBAO3C,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,iBAAiB,CAAC;IACjE,oEAAoE;IACpE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,iBAAiB,CAAC;IAC5D,2IAA2I;IAC3I,qBAAqB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,uGAAuG;IACvG,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAYD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,GAAE,kBAAuB,GAAG,qBAAqB,CAU/F;AAED,6DAA6D;AAC7D,eAAO,MAAM,oBAAoB,EAAE,qBAAoD,CAAC"}
+{"version":3,"file":"claude-code-chat.d.ts","sourceRoot":"","sources":["../../src/engines/claude-code-chat.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAS,KAAK,iBAAiB,EAAE,MAAM,OAAO,CAAC;AACtD,OAAO,EAML,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAkB,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAK9E,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EAErB,sBAAsB,EAGtB,cAAc,EAEd,uBAAuB,EACvB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAIpB;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAgBlD,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,4BAA4B,6BAA6B,CAAC;AAEvE;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,kBAAkB,CAEtD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,MAAM,EAAE,CAmBtG;AAQD;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAAC,UAAU,CAKxE;AAgBD,YAAY,EAAE,qBAAqB,EAAE,CAAC;AAkBtC;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAoB9E;AASD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAO1F;AAuDD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG;IAC5D,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,cAAc,CAAC;CACtB,CAuBA;AAmED,8EAA8E;AAC9E,eAAO,MAAM,6BAA6B,EAAE,sBAO3C,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,iBAAiB,CAAC;IACjE,oEAAoE;IACpE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,iBAAiB,CAAC;IAC5D,2IAA2I;IAC3I,qBAAqB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,uGAAuG;IACvG,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,+FAA+F;IAC/F,gBAAgB,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,KAAK,MAAM,GAAG,IAAI,CAAC;CAC/D;AAaD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,GAAE,kBAAuB,GAAG,qBAAqB,CAW/F;AAED,6DAA6D;AAC7D,eAAO,MAAM,oBAAoB,EAAE,qBAAoD,CAAC"}

package/dist/engines/claude-code-chat.js

@@ -31,11 +31,14 @@
  * `claudeCodeChatEngine` is the wired default built from the production deps.
  */
 import os from "node:os";
+import fs from "node:fs";
+import path from "node:path";
 import { execa } from "execa";
-import { resolveAuthMode, describeAuthMode, withAnthropicAuth, } from "../provider-auth.js";
+import { resolveAuthMode, describeAuthMode, withAnthropicAuth, isolatedClaudeConfigDir, claudeConfigIsolationEnabled, } from "../provider-auth.js";
 import { ACC_MCP_KEY } from "../mcp-spawn.js";
 import { claudeCodeEngine } from "./claude-code.js";
 import { streamChatTurn } from "./chat-stream.js";
+import { resolvedAccountIdentity, unknownAccountIdentity, } from "./account-identity.js";
 const BINARY = "claude";
 /**
  * Native (built-in) claude tools disabled for a chat-lane turn. The tool bus is
@@ -238,6 +241,118 @@ async function credentialProbeImpl(deps) {
         detail: `${describeAuthMode(mode)}; repo-write ${repoWrite ? "granted (full tier)" : "absent (draft-only tier)"}`,
     };
 }
+/* ------------------------------------------------------------------ *
+ * AS-1 (ACCOUNT-PROBE): claude-code account introspection.
+ *
+ * The claude CLI persists its logged-in account into the config JSON it
+ * maintains (`~/.claude.json`, or `<CLAUDE_CONFIG_DIR>/.claude.json` when the
+ * operator/isolation pins a config dir): an `oauthAccount.emailAddress` plus, on
+ * builds that store it, a subscription-type field. Reading that artifact IS the
+ * CLI's auth introspection — there is no stable `claude whoami` to spawn, and a
+ * file read is cheaper + can't be rate-limited. In api-key mode a bare key
+ * carries no email, so we honestly report `account_email: null` + `plan_hint:
+ * "api"`. The parse is TOLERANT (the codex tolerant-parser lesson): any shape
+ * drift degrades to `unknown`, never a throw.
+ * ------------------------------------------------------------------ */
+/** Map a raw claude subscription-type string to the coarse plan hint. */
+function planHintFromSubscription(raw) {
+    if (typeof raw !== "string")
+        return "unknown";
+    const v = raw.trim().toLowerCase();
+    if (v === "max" || v.startsWith("max"))
+        return "max";
+    if (v === "pro" || v.startsWith("pro"))
+        return "pro";
+    if (v === "free")
+        return "free";
+    if (v === "team")
+        return "team";
+    if (v === "enterprise" || v === "enterprise_plus")
+        return "enterprise";
+    return "unknown";
+}
+/**
+ * TOLERANT parse of the claude config JSON into `{ email, plan }`. Reads
+ * `oauthAccount.emailAddress` for the email and, for the plan, the first of
+ * `oauthAccount.subscriptionType`, top-level `subscriptionType`, or
+ * `claudeAiOauth.subscriptionType` that resolves — matching the fields observed
+ * across CLI builds. Returns `{ email: null, plan: "unknown" }` for missing
+ * file / non-JSON / unexpected shape.
+ */
+export function parseClaudeAccountConfig(raw) {
+    const s = (raw ?? "").trim();
+    if (!s.startsWith("{"))
+        return { email: null, plan: "unknown" };
+    let obj;
+    try {
+        obj = JSON.parse(s);
+    }
+    catch {
+        return { email: null, plan: "unknown" };
+    }
+    if (typeof obj !== "object" || obj === null)
+        return { email: null, plan: "unknown" };
+    const rec = obj;
+    const oauth = (typeof rec.oauthAccount === "object" && rec.oauthAccount !== null
+        ? rec.oauthAccount
+        : {});
+    const claudeAi = (typeof rec.claudeAiOauth === "object" && rec.claudeAiOauth !== null
+        ? rec.claudeAiOauth
+        : {});
+    const rawEmail = oauth.emailAddress ?? oauth.email ?? claudeAi.emailAddress;
+    const email = typeof rawEmail === "string" && rawEmail.trim() ? rawEmail.trim() : null;
+    const plan = planHintFromSubscription(oauth.subscriptionType ?? rec.subscriptionType ?? claudeAi.subscriptionType);
+    return { email, plan };
+}
+/** Resolve the config-JSON path the claude CLI is expected to maintain. */
+function claudeConfigPath(env) {
+    const explicit = (env.CLAUDE_CONFIG_DIR ?? "").trim();
+    if (explicit)
+        return path.join(explicit, ".claude.json");
+    // Mirror provider-auth's isolation: when opted in, the CLI writes under the
+    // runner-owned config dir rather than $HOME.
+    if (claudeConfigIsolationEnabled(env)) {
+        return path.join(isolatedClaudeConfigDir(env), ".claude.json");
+    }
+    return path.join(os.homedir(), ".claude.json");
+}
+/** Default introspection: read the claude config JSON, or null when absent/unreadable. */
+function defaultReadClaudeConfig(env = process.env) {
+    try {
+        return fs.readFileSync(claudeConfigPath(env), "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+async function accountIdentityImpl(deps) {
+    const channel = claudeCodeEngine.authMode; // "api-key-or-oauth"
+    const mode = deps.resolveAuth(process.env);
+    if (mode === "api-key") {
+        // A bare API key carries no email; report the billing channel honestly.
+        return unknownAccountIdentity({
+            engineId: claudeCodeEngine.id,
+            channel,
+            planHint: "api",
+            detail: "api-key channel (ANTHROPIC_API_KEY set); no consumer account email to introspect",
+        });
+    }
+    const { email, plan } = parseClaudeAccountConfig(deps.readClaudeConfig(process.env));
+    if (!email) {
+        return unknownAccountIdentity({
+            engineId: claudeCodeEngine.id,
+            channel,
+            detail: "interactive-session channel; no logged-in account found in the claude config",
+        });
+    }
+    return resolvedAccountIdentity({
+        engineId: claudeCodeEngine.id,
+        channel,
+        email,
+        planHint: plan,
+        detail: `interactive-session login ${email}${plan === "unknown" ? "" : ` (${plan})`}`,
+    });
+}
 /**
  * Default repo-write probe: `gh auth status` exit 0. A companion runner that can
  * push / open a PR authorises the `full` tier; one that only holds a model
@@ -268,6 +383,7 @@ const DEFAULT_DEPS = {
     hasInteractiveSession: async () => true,
     repoWriteProbe: defaultRepoWriteProbe,
     loadSampler: () => ({ load1: os.loadavg()[0] ?? 0, cores: os.cpus().length }),
+    readClaudeConfig: defaultReadClaudeConfig,
 };
 /**
  * Build a chat-conformant claude-code engine. Composes the FROZEN batch
@@ -285,6 +401,7 @@ export function createClaudeCodeChatEngine(deps = {}) {
         accMcpToolBusOnly,
         credentialProbe: () => credentialProbeImpl(d),
         classifyCapacity: () => classifyCapacityImpl(d),
+        accountIdentity: () => accountIdentityImpl(d),
     };
 }
 /** The wired default chat-conformant claude-code adapter. */