aegis-desktop 1.0.10 → 1.0.13

package/lib/auto.js

@@ -12,13 +12,17 @@
  * BACKGROUND. desktop/main.js and desktop/preload.js both stated an absolute
  * rule when the queue shipped: "NOTHING DRAINS UNLESS THE USER ASKED. There is
  * no interval, no drain at startup, and no drain-on-idle anywhere in this
- * file." That rule was right when the only trigger was a click, and it is still
- * the behaviour of a default install — but it made "queue a task and walk away"
- * impossible, which is the one thing an unattended queue is FOR. The user asked
- * for both automations explicitly (option A of that discussion), so the rule
- * becomes a DEFAULT rather than an absolute, in the only way that keeps the
- * original sentence true: an explicit, persisted, default-off switch, and a
- * tick that does nothing unless it is armed.
+ * file." A click was the only trigger, which made "queue a task and walk away"
+ * impossible — the one thing an unattended queue is FOR. The user asked for the
+ * automation (twice: "autonomous queue", then "work in the background
+ * instead"), so both switches now DEFAULT ON and the sidebar card that used to
+ * gate them is hidden: draining and sealing happen with nothing on screen.
+ *
+ * What keeps that safe is not an off-by-default — it is the guards below, which
+ * are unchanged and all of them skips rather than drains: an empty queue, a
+ * drain already in flight, another host holding the lock, and a switch turned
+ * off since the last tick (re-read EVERY tick, so off stops the very next one,
+ * whoever wrote it: the settings file, the CLI, a hand edit).
  *
  * There are exactly two automations, because there are exactly two acts in the
  * app that are irreversible-ish and cost something:

package/lib/fingerprint.js

@@ -94,12 +94,43 @@ function slug(value, max = 80) {
  * @param {object} o
  * @param {string} o.dir  the app's data directory (userData in a package)
  * @param {object} [o.env] process env, injectable for tests
+ * @param {() => string} [o.getVaultBackend] reads the live preference
+ *   ('aegiscloud' | 'drive' | 'off', desktop/lib/settings.js's
+ *   vaultBackendConfig) — a function, not a value, so a change made in
+ *   Settings while the app is running reaches the very next vault call with
+ *   no restart, the same contract getConfirmMode's gate already keeps.
  */
-function createFingerprintService({ dir, env } = {}) {
+function createFingerprintService({ dir, env, getVaultBackend } = {}) {
   if (!dir) throw new Error('aegis-desktop: createFingerprintService needs a data dir');
   // One store: the shared modules read AEGIS_HOME and nothing else.
   const scope = { ...(env || process.env), AEGIS_HOME: (env || process.env).AEGIS_HOME || dir };
 
+  /** `true` only when the user has explicitly turned sync off — not when no
+   *  preference has been recorded yet, which must keep resolving to whatever
+   *  record-vault.js's own default is. */
+  function vaultDisabled() {
+    return typeof getVaultBackend === 'function' && getVaultBackend() === 'off';
+  }
+
+  /**
+   * `scope`, with the vault backend layered on top of it when a preference
+   * names one. 'aegiscloud' and an absent preference both fall through to
+   * `scope` unchanged — client/record-vault.js's own DEFAULT_BACKEND is
+   * already 'aegiscloud', so there is nothing to add for either case. 'drive'
+   * is the one preference that actually changes the destination: it asks the
+   * rclone adapter for the `gdrive` remote (the user's own Google Drive,
+   * configured by them — see client/record-vault.js's DEFAULT_REMOTE). 'off'
+   * is handled by `vaultDisabled()` before this is ever called, not here.
+   */
+  function vaultScope() {
+    if (typeof getVaultBackend === 'function' && getVaultBackend() === 'drive') {
+      return { ...scope, AEGIS_VAULT_BACKEND: 'rclone', AEGIS_VAULT_REMOTE: scope.AEGIS_VAULT_REMOTE || 'gdrive' };
+    }
+    return scope;
+  }
+
+  const VAULT_OFF_ERROR = 'the vault is turned off — turn it back on (Google Drive or AE) in Settings to publish or inspect it';
+
   const recordPath = (record, session) =>
     path.join(dir, 'fingerprints', `${slug(session)}.${String(record.createdAt).replace(/[:.]/g, '-')}.json`);
 
@@ -110,7 +141,22 @@ function createFingerprintService({ dir, env } = {}) {
         const { fp, authorship, vault } = load();
         const key = authorship.resolveKey({ argv: [], env: scope });
         const history = path.join(authorship.dataDir(scope), 'history.jsonl');
-        const target = vault.vaultTarget(scope);
+        if (vaultDisabled()) {
+          return {
+            ok: true,
+            configured: Boolean(key.secret),
+            keySource: key.source,
+            keyPath: key.path,
+            keyFingerprint: key.secret ? fp.keyFingerprint(key.secret) : null,
+            publicKey: key.public,
+            defaultKeyPath: authorship.defaultKeyPath(scope),
+            historyPath: history,
+            historyPresent: fs.existsSync(history),
+            dataDir: authorship.dataDir(scope),
+            vault: { backend: 'off', remote: null, root: null, recordsDir: null },
+          };
+        }
+        const target = vault.vaultTarget(vaultScope());
         return {
           ok: true,
           configured: Boolean(key.secret),
@@ -125,7 +171,12 @@ function createFingerprintService({ dir, env } = {}) {
           // Where a publish goes, so the panel can say it before the user asks
           // for one — and so a misconfigured root is visible, not discovered by
           // a record landing in the wrong folder.
-          vault: { remote: target.remote, root: target.root, recordsDir: `${target.root}/${vault.RECORDS_DIR}` },
+          vault: {
+            backend: target.backend,
+            remote: target.remote,
+            root: target.root,
+            recordsDir: target.backend === vault.BACKEND_CLOUD ? vault.CLOUD_PREFIX : `${target.root}/${vault.RECORDS_DIR}`,
+          },
         };
       } catch (e) {
         return { ok: false, error: (e && e.message) || String(e) };
@@ -155,7 +206,7 @@ function createFingerprintService({ dir, env } = {}) {
      * session carry the same behaviour digest — and the same AI digest, from the
      * same turns.
      */
-    mint({ history = null, session = null, turns = null, label = null, account = null,
+    async mint({ history = null, session = null, turns = null, label = null, account = null,
           model = null, tools = null, codeRoots = null, codeDirty = null, out = null,
           createdAt = null, publish = false, aiSecret = undefined, aiModel = null } = {}) {
       try {
@@ -196,11 +247,15 @@ function createFingerprintService({ dir, env } = {}) {
         let vault = null;
         let vaultError = null;
         if (publish) {
-          try {
-            const key = authorship.resolveKey({ argv: [], env: scope });
-            vault = load().vault.publish({ file, argv: [], env: scope, secret: key.secret });
-          } catch (e) {
-            vaultError = (e && e.message) || String(e);
+          if (vaultDisabled()) {
+            vaultError = VAULT_OFF_ERROR;
+          } else {
+            try {
+              const key = authorship.resolveKey({ argv: [], env: scope });
+              vault = await load().vault.publish({ file, argv: [], env: vaultScope(), secret: key.secret });
+            } catch (e) {
+              vaultError = (e && e.message) || String(e);
+            }
           }
         }
         return {
@@ -225,13 +280,14 @@ function createFingerprintService({ dir, env } = {}) {
      * preferred path is the file, because the sha256 in the anchor is then about
      * the bytes on disk rather than a re-serialisation of them.
      */
-    publish({ file = null, record = null, dryRun = false } = {}) {
+    async publish({ file = null, record = null, dryRun = false } = {}) {
+      if (vaultDisabled()) return { ok: false, error: VAULT_OFF_ERROR };
       try {
         const { authorship, vault } = load();
         const key = authorship.resolveKey({ argv: [], env: scope });
         return {
           ok: true,
-          ...vault.publish({ file, record, argv: [], env: scope, secret: key.secret, dryRun }),
+          ...(await vault.publish({ file, record, argv: [], env: vaultScope(), secret: key.secret, dryRun })),
         };
       } catch (e) {
         return { ok: false, error: (e && e.message) || String(e) };
@@ -246,22 +302,24 @@ function createFingerprintService({ dir, env } = {}) {
      * sealed it has moved on" are three different situations and a single
      * boolean would flatten them into one that hides the interesting case.
      */
-    anchor({ file = null, record = null, anchor = null } = {}) {
+    async anchor({ file = null, record = null, anchor = null } = {}) {
+      if (vaultDisabled()) return { ok: false, error: VAULT_OFF_ERROR };
       try {
         const { authorship, vault } = load();
         if (!file && !record && !anchor) return { ok: false, error: 'anchor needs a record or an anchor' };
         const key = authorship.resolveKey({ argv: [], env: scope });
-        return { ok: true, ...vault.checkAnchor({ file, record, anchor, argv: [], env: scope, key }) };
+        return { ok: true, ...(await vault.checkAnchor({ file, record, anchor, argv: [], env: vaultScope(), key })) };
       } catch (e) {
         return { ok: false, error: (e && e.message) || String(e) };
       }
     },
 
     /** What is in the vault. */
-    vaultList() {
+    async vaultList() {
+      if (vaultDisabled()) return { ok: false, error: VAULT_OFF_ERROR };
       try {
         const { vault } = load();
-        return { ok: true, ...vault.list({ argv: [], env: scope }) };
+        return { ok: true, ...(await vault.list({ argv: [], env: vaultScope() })) };
       } catch (e) {
         return { ok: false, error: (e && e.message) || String(e) };
       }
@@ -272,11 +330,12 @@ function createFingerprintService({ dir, env } = {}) {
      * already there before publishing was restricted. A finding is a fact about
      * the vault, not about this app, so it is returned rather than acted on.
      */
-    vaultAudit() {
+    async vaultAudit() {
+      if (vaultDisabled()) return { ok: false, error: VAULT_OFF_ERROR };
       try {
         const { authorship, vault } = load();
         const key = authorship.resolveKey({ argv: [], env: scope });
-        return { ok: true, ...vault.audit({ argv: [], env: scope, secret: key.secret || null }) };
+        return { ok: true, ...(await vault.audit({ argv: [], env: vaultScope(), secret: key.secret || null })) };
       } catch (e) {
         return { ok: false, error: (e && e.message) || String(e) };
       }

package/lib/google-connect.js

@@ -0,0 +1,171 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
+// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
+// Conveying a modified copy, or running one as a network service, owes the
+// corresponding source under this licence (§5/§13) — see LICENSING.md.
+'use strict';
+
+/**
+ * google-connect.js — the desktop's Google identity + Drive flow.
+ *
+ * Two distinct steps, run in this order because the second depends on the
+ * first having actually landed:
+ *
+ *   1. Sign in with Google (`client/google-signin.js`'s local round-trip) —
+ *      replaces this machine's saved AEGIS key with the one tied to that
+ *      Google identity, exactly as `aegiscode connect` already does for the
+ *      CLI (cli/src/connect.js). Desktop never had this wiring before this
+ *      file; the only Google sign-in that existed anywhere in this product
+ *      was the CLI's.
+ *   2. Connect Drive (`client/drive-connect.js`, which opens `/connect/drive`
+ *      in the system browser and polls `/api/drive/token`) — grants the
+ *      `drive.file` scope to WHICHEVER Google identity that browser's
+ *      consent screen uses. That is only the SAME account as step 1 if step
+ *      1 ran first on this machine: `/connect/drive`'s callback resolves an
+ *      account purely by Google identity, with no notion of "the account
+ *      this machine's API key already belongs to" — so connecting Drive
+ *      before signing in attaches the tokens to a DIFFERENT account than the
+ *      one this machine will poll, and the poll just times out. `connectDrive`
+ *      refuses outright when this machine has no key at all, but cannot
+ *      detect "has a key, but it is an anonymous one" — that failure still
+ *      surfaces, just later, as a timeout with the right wording.
+ *
+ * Electron-free and fully injected — same shape as `account-key.js` next to
+ * it — so the whole flow runs under a test with a stub `aegis` client, a
+ * stub `googleSignIn`/`driveConnect`/`driveUpload`, and no browser, window or
+ * network.
+ */
+
+function createGoogleConnect({
+  aegis,
+  credentials,
+  persistKey,
+  openUrl,
+  googleSignIn,
+  driveConnect,
+  driveUpload,
+  onAccountChange,
+}) {
+  let signInInFlight = null;
+  let connectInFlight = null;
+  let lastSyncAt = null;
+  let lastSyncError = null;
+
+  /** Sign this machine in with Google, replacing whatever key it had. */
+  function signInWithGoogle() {
+    if (!signInInFlight) {
+      signInInFlight = (async () => {
+        try {
+          // Everything from here on (binding the local callback server,
+          // opening the browser, waiting for the round-trip) can fail, and
+          // every caller of this module — the IPC handler in main.js chief
+          // among them — is promised `{ ok, … }`/`{ ok: false, error }`,
+          // never a rejection. One try covers the whole flow instead of only
+          // the `session.wait()` half of it.
+          let session;
+          try {
+            session = await googleSignIn.startGoogleSignIn({ apiBase: aegis.apiBase });
+          } catch (e) {
+            return { ok: false, error: `could not start the local sign-in server — ${(e && e.message) || e}` };
+          }
+          const opened = Boolean(openUrl(session.url));
+          let result;
+          try {
+            result = await session.wait();
+          } catch (e) {
+            return { ok: false, opened, url: session.url, error: (e && e.message) || String(e) };
+          }
+          // Live client first: the very next call this process makes (e.g.
+          // the renderer asking for drive status right after this resolves)
+          // must see the new identity, not whatever key this process started
+          // with.
+          aegis.setApiKey(result.apiKey);
+          persistKey(result.apiKey);
+          if (result.memoryToken && credentials && typeof credentials.saveMemoryToken === 'function') {
+            try {
+              credentials.saveMemoryToken(result.memoryToken);
+            } catch {
+              /* best-effort — the account key itself is already saved */
+            }
+          }
+          if (typeof onAccountChange === 'function') onAccountChange();
+          return { ok: true, opened, url: session.url, username: result.username || null };
+        } finally {
+          signInInFlight = null;
+        }
+      })();
+    }
+    return signInInFlight;
+  }
+
+  /** Open `/connect/drive` and wait for this account to show connected. */
+  function connectDrive() {
+    if (!aegis.apiKey) {
+      return Promise.resolve({
+        ok: false,
+        error: 'sign in with Google first — this device has no AEGIS account key yet',
+      });
+    }
+    if (!connectInFlight) {
+      connectInFlight = (async () => {
+        try {
+          const url = driveConnect.driveConnectUrl(aegis.apiBase);
+          const opened = Boolean(openUrl(url));
+          try {
+            const status = await driveConnect.waitForDriveConnected(aegis);
+            return { ok: true, opened, url, connected: status.connected, email: status.email };
+          } catch (e) {
+            return { ok: false, opened, url, error: (e && e.message) || String(e) };
+          }
+        } finally {
+          connectInFlight = null;
+        }
+      })();
+    }
+    return connectInFlight;
+  }
+
+  /** A one-shot read: signed in, and if so, is Drive connected. */
+  async function status() {
+    if (!aegis.apiKey) return { signedIn: false, connected: false, email: null };
+    const s = await driveConnect.driveStatus(aegis);
+    return { signedIn: true, ...s };
+  }
+
+  /** Pull this account's AEGIS cloud memory and back it up to Drive. */
+  async function syncMemoryNow() {
+    try {
+      const tokenInfo = await aegis.driveToken();
+      if (!tokenInfo || !tokenInfo.connected || !tokenInfo.access_token) {
+        throw new Error('Google Drive is not connected yet');
+      }
+      const pulled = await aegis.memoryPull(0);
+      const entries = (pulled && pulled.entries) || [];
+      const content = JSON.stringify({ exportedAt: new Date().toISOString(), entries }, null, 2);
+      const result = await driveUpload.uploadMemoryBackup(tokenInfo.access_token, content);
+      lastSyncAt = Date.now();
+      lastSyncError = null;
+      return {
+        ok: true,
+        count: entries.length,
+        fileId: result.fileId,
+        webViewLink: result.webViewLink,
+        updated: result.updated,
+        lastSyncAt,
+      };
+    } catch (e) {
+      lastSyncError = (e && e.message) || String(e);
+      return { ok: false, error: lastSyncError, lastSyncAt };
+    }
+  }
+
+  return {
+    signInWithGoogle,
+    connectDrive,
+    status,
+    syncMemoryNow,
+    state: () => ({ lastSyncAt, lastSyncError }),
+  };
+}
+
+module.exports = { createGoogleConnect };

package/lib/local/claude-pro.js

@@ -116,6 +116,23 @@ function claudeOAuthToken(env) {
  */
 const SHADOWING_ENV_VARS = Object.freeze(['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN']);
 
+/**
+ * Whether `value` is shaped like an Anthropic console API key.
+ *
+ * Deliberately a SHAPE test, not a validity test. This process cannot know
+ * whether a key is live without spending it, so it does not try: it answers
+ * only "could this possibly be the console credential that is allowed to
+ * outrank a subscription". Anthropic console keys are `sk-ant-`-prefixed. The
+ * check is case-sensitive and anchored, because that is the literal the vendor
+ * uses — a case-insensitive match would accept `SK-ANT-` junk.
+ *
+ * @param {string} value
+ * @returns {boolean}
+ */
+function isAnthropicConsoleKey(value) {
+  return typeof value === 'string' && /^sk-ant-[A-Za-z0-9_-]{8,}$/.test(value.trim());
+}
+
 /**
  * The env for one `claude` child, with a shadowing value that cannot be a
  * credential removed.
@@ -151,28 +168,69 @@ const SHADOWING_ENV_VARS = Object.freeze(['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_T
  * value that provably cannot be a key is dropped, and the drop is REPORTED
  * rather than silent (see `envDroppedLine`).
  *
+ * ── the second rule: a length floor is not a shape (measured, 2026-10-21) ───
+ *
+ * The floor above answers "is this too short to be anything?" and nothing more.
+ * A 35-character value that is NOT an Anthropic console key clears it, still
+ * wins the CLI's precedence, and still takes the plan down — so the floor alone
+ * reproduced the original bug one paste later. Measured state that produced it:
+ *
+ *   ~/.aegiscode/.env held ANTHROPIC_API_KEY=<35 chars, not sk-ant-*>
+ *   ~/.claude/.credentials.json held a valid `claudeAiOauth` for plan `pro`
+ *   `aegiscode -p "say hi" --json`
+ *     → {"text":"Invalid API key · Fix external API key","model":"sonnet",
+ *        "tokens":0,"balance_eur":1.54}          exit 0, in 2.3 s
+ *
+ * and the child was spawned with the stale value present (`ANTHROPIC_LEN=35`,
+ * observed by a fake `claude` on PATH). Unsetting the variable in the SHELL did
+ * not help either: this host loads `~/.aegiscode/.env` into `process.env`
+ * itself, so the file is an input no caller can undo.
+ *
+ * So when a subscription IS present, only a value shaped like an Anthropic
+ * console key may shadow it. That is the narrowest rule that keeps the promise
+ * the old comment made — "a user who set one deliberately is asking for the
+ * pay-per-token path" — while refusing a value that provably is not one. With
+ * no subscription there is nothing to shadow and no opinion is taken: any value
+ * clearing the floor passes, exactly as before.
+ *
  * @param {object} [baseEnv] the caller's env bag
  * @param {string} [token]   a `CLAUDE_CODE_OAUTH_TOKEN` to hand the child
- * @returns {{env: object, dropped: Array<{name: string, length: number}>}}
+ * @param {{hasSubscription?: boolean}} [opts] whether a subscription is present
+ *   (see the second rule above); absent means "assume not", which keeps every
+ *   pre-existing caller and test on the old behaviour.
+ * @returns {{env: object, dropped: Array<{name: string, length: number, reason: string}>}}
  */
-function childEnvPlan(baseEnv, token) {
+function childEnvPlan(baseEnv, token, opts) {
   const env = { ...(baseEnv || {}) };
   const dropped = [];
   const usable = envFileLib && typeof envFileLib.credentialLooksUsable === 'function'
     ? envFileLib.credentialLooksUsable
     : null;
+  // Only a present subscription can be shadowed, so it is the only case that
+  // earns the stricter shape rule (see the docstring's second section).
+  const hasSubscription = !!(opts && opts.hasSubscription);
   // A host whose env module predates the floor keeps today's behaviour (the
   // variable passes through): a second copy of the floor here is the drift
   // client/env-file.js exists to prevent.
   if (usable) {
     for (const name of SHADOWING_ENV_VARS) {
       const value = env[name];
-      if (typeof value !== 'string' || usable(value)) continue;
+      if (typeof value !== 'string') continue;
+      // Two independent reasons to refuse, and they are reported apart because
+      // they mean different things to the user: too short is junk, while a
+      // well-formed value that is not a console key is a key for something
+      // else that would silently outrank the plan they are paying for.
+      let reason = null;
+      if (!usable(value)) reason = 'too-short';
+      else if (hasSubscription && name === 'ANTHROPIC_API_KEY' && !isAnthropicConsoleKey(value)) {
+        reason = 'not-a-console-key';
+      }
+      if (!reason) continue;
       delete env[name];
       // A variable set to '' shadows nothing worth reporting — it is removed
       // (harmless) but the user is not told about a value they never gave.
       const length = value.trim().length;
-      if (length > 0) dropped.push({ name, length });
+      if (length > 0) dropped.push({ name, length, reason });
     }
   }
   if (token) env.CLAUDE_CODE_OAUTH_TOKEN = token;
@@ -183,20 +241,51 @@ function childEnvPlan(baseEnv, token) {
 function envDroppedLine(dropped) {
   const list = Array.isArray(dropped) ? dropped : [];
   if (!list.length) return null;
-  const names = list.map((d) => `${d.name} (${d.length} character${d.length === 1 ? '' : 's'})`).join(', ');
-  return `aegis: not passed to the claude child — ${names}: too short to be a credential, and the CLI would have spent it instead of your subscription`;
+  const shaped = list.filter((d) => d && d.reason === 'not-a-console-key');
+  const short = list.filter((d) => !d || d.reason !== 'not-a-console-key');
+  const parts = [];
+  if (short.length) {
+    const names = short.map((d) => `${d.name} (${d.length} character${d.length === 1 ? '' : 's'})`).join(', ');
+    parts.push(`${names}: too short to be a credential, and the CLI would have spent it instead of your subscription`);
+  }
+  if (shaped.length) {
+    const names = shaped.map((d) => `${d.name} (${d.length} characters)`).join(', ');
+    parts.push(
+      `${names}: not an Anthropic console key (\`sk-ant-\`), and the CLI would have spent it instead of your subscription`
+    );
+  }
+  return `aegis: not passed to the claude child — ${parts.join('; ')}`;
 }
 
-/** The shadowing value in `env` that cannot be a credential, if any (see above). */
-function shadowingValue(env) {
+/**
+ * The shadowing value in `env` that cannot be spent as the credential the CLI
+ * would take it for, if any (see the two rules in `childEnvPlan`).
+ *
+ * This must agree with `childEnvPlan` exactly: a status surface that says "no
+ * shadowing value" while the child is in fact being handed one is worse than no
+ * report at all. Both reasons are therefore reported, and each carries the same
+ * `reason` tag the drop report uses so the two lines cannot drift apart.
+ *
+ * @param {object} env
+ * @param {{hasSubscription?: boolean}} [opts]
+ * @returns {{name: string, length: number, reason: string}|null}
+ */
+function shadowingValue(env, opts) {
   const bag = env || {};
   const usable = envFileLib && typeof envFileLib.credentialLooksUsable === 'function'
     ? envFileLib.credentialLooksUsable
     : null;
   if (!usable) return null;
+  const hasSubscription = !!(opts && opts.hasSubscription);
   for (const name of SHADOWING_ENV_VARS) {
     const value = bag[name];
-    if (typeof value === 'string' && !usable(value)) return { name, length: value.trim().length };
+    if (typeof value !== 'string') continue;
+    let reason = null;
+    if (!usable(value)) reason = 'too-short';
+    else if (hasSubscription && name === 'ANTHROPIC_API_KEY' && !isAnthropicConsoleKey(value)) {
+      reason = 'not-a-console-key';
+    }
+    if (reason) return { name, length: value.trim().length, reason };
   }
   return null;
 }
@@ -264,7 +353,30 @@ function claudeProStatus(opts) {
   // child is fixed regardless (childEnvPlan); this reports it so a status
   // surface can say why, rather than leaving `apiKeySource: ANTHROPIC_API_KEY`
   // to be discovered from `claude auth status` by hand.
-  out.shadowed = shadowingValue(env);
+  // A SUBSCRIPTION — the thing a stray `ANTHROPIC_API_KEY` would outrank — is an
+  // `oauth` plan or a `CLAUDE_CODE_OAUTH_TOKEN` handed to the child. A
+  // `credentials.json` holding a plain API key is not: there is no plan there to
+  // shadow, so the strict shape rule must not fire and drop the user's own key.
+  // This is computed once and published, so the report and the child env read
+  // ONE answer instead of each deciding for itself.
+  out.subscriptionPresent = out.loggedIn && out.kind !== 'apikey';
+  // The stricter rule only applies when a subscription is present, so the
+  // subscription this function just resolved is the same input the child env
+  // gets. Passing it here is what keeps `shadowed` and the drop report agreeing.
+  out.shadowed = shadowingValue(env, { hasSubscription: out.subscriptionPresent });
+  // "Can this host serve a `pro` turn at all?" is NOT the same question as
+  // "is there a subscription to shadow?" (above). A pin is phantom only when
+  // nothing usable survives to the child, and a bare API key in
+  // `credentials.json` (`kind: 'apikey'`) is a route with no plan behind it —
+  // so `subscriptionPresent` excludes it deliberately, while callability must
+  // count it. Answered by running the SAME planner the child env comes from, so
+  // this cannot disagree with what `claude` is actually handed: a variable the
+  // planner drops is not a credential, whatever it looks like in `env`.
+  const plan = childEnvPlan(env, null, { hasSubscription: out.subscriptionPresent });
+  out.credentialPresent = out.loggedIn
+    || typeof plan.env.ANTHROPIC_API_KEY === 'string'
+    || typeof plan.env.ANTHROPIC_AUTH_TOKEN === 'string'
+    || typeof plan.env.CLAUDE_CODE_OAUTH_TOKEN === 'string';
   return out;
 }
 
@@ -633,7 +745,18 @@ function runClaudePro(opts, deps) {
     // "API key: he" and the subscription is unreachable — see childEnvPlan.
     const baseEnv = o.env || process.env;
     const token = claudeOAuthToken(baseEnv);
-    const plan = childEnvPlan(baseEnv, token);
+    // Whether a subscription is present decides whether a non-console
+    // `ANTHROPIC_API_KEY` may shadow it (childEnvPlan's second rule). It is read
+    // from the same credential file `claudeProStatus` reports on, and a failure
+    // to read it must NOT weaken the child's env: an unreadable file means "no
+    // subscription proven", which is the old behaviour, not a crash mid-turn.
+    let hasSubscription = false;
+    try {
+      hasSubscription = !!claudeProStatus({ env: baseEnv }).subscriptionPresent;
+    } catch {
+      /* unprovable subscription → the floor-only rule, exactly as before */
+    }
+    const plan = childEnvPlan(baseEnv, token, { hasSubscription });
     const childEnv = plan.env;
     const droppedLine = envDroppedLine(plan.dropped);
     if (droppedLine && o.onDelta) {