agl 40.4.0 → 40.5.1

package/ts_authswitch/classes.authorityusage.ts

@@ -8,6 +8,9 @@ import { authSwitchCombineUsageObservations, authSwitchObservedUsage,
   type TAuthSwitchUsageObservation } from './authority-usageheaders.js';
 import { usageWindowPeriod } from './accounts.js';
 import type { IAuthSwitchTokenUsage } from './authority-usagetokens.js';
+import { authSwitchSpendPeriod, type IAuthSwitchSpendReading } from './authority-spend.js';
+import type { IAuthSwitchSpendAnswer, TAuthSwitchPaymentProblemCause as TCause } from './authority-contract.js';
+import { authSwitchPaymentProblemHeld } from './authority-subscription.js';
 import { AuthSwitchUsageEstimator, authSwitchRolledOpenAiLimits, type IAuthSwitchUsageEstimateState,
   type IAuthSwitchUsageEstimatorOptions, type TAuthSwitchEstimateBasis } from './classes.authorityusageestimate.js';
 
@@ -16,12 +19,12 @@ type TRateLimits = IOpenAiAccountRateLimits;
 /**
  * Why a usage reading is missing or incomplete. `held_in_container`: the Claude login runs in a registered container
  * home, whose files are the container's; the authority reads its usage again once the login is moved out. `pending`:
- * the account's first read has not finished yet.
+ * the account's first read has not finished yet. `spend_unavailable`: an API key's spend ledger could not be read.
  */
 export type TAuthSwitchUsageProblem =
   | 'none' | 'unsupported' | 'access_unavailable' | 'provider_unavailable'
   | 'provider_rejected' | 'profile_unavailable' | 'usage_unavailable'
-  | 'context_changed' | 'expired' | 'held_in_container' | 'pending';
+  | 'context_changed' | 'expired' | 'held_in_container' | 'pending' | 'spend_unavailable';
 
 export interface IAuthSwitchNativeUsageSource {
   homeId: string;
@@ -69,10 +72,18 @@ export interface IAuthSwitchClaudeStatus {
   rateLimit: { retryAt: string | null } | null;
 }
 
-export type TAuthSwitchUsageReading =
+/** A usage reading the authority reads from a provider for a subscription sign-in, and stores between its runs. */
+export type TAuthSwitchProviderUsageReading =
   | { kind: 'openai'; rateLimits: TRateLimits }
   | { kind: 'anthropic'; status: IAuthSwitchClaudeStatus };
 
+/**
+ * A login's usage reading: a subscription sign-in's, as its provider stated it, or an API key's monthly spend
+ * (`spend`), which the authority answers from what AGL's inference proxy reported and never reads from a provider.
+ */
+export type TAuthSwitchUsageReading = TAuthSwitchProviderUsageReading
+  | { kind: 'spend'; spend: IAuthSwitchSpendReading };
+
 export interface IAuthSwitchUsageAccess {
   accessToken: string;
   accountId: string;
@@ -96,10 +107,33 @@ export interface IAuthSwitchUsageAccess {
 export interface IAuthSwitchPaymentProblem {
   at: string;
   subscription: IClaudeSubscription | null;
+  /**
+   * What the provider refused for (`TAuthSwitchPaymentProblemCause`), present only for `spend_cap` and `quota`, which
+   * only an API key's login is held with; absent, the cause is `billing`, on a Claude login and an API key alike. A
+   * problem with a cause has no subscription.
+   */
+  cause?: Exclude<TAuthSwitchPaymentProblemCause, 'billing'>;
+  /**
+   * When a `spend_cap` lifts by itself: the end of the month in UTC `at` falls in (`authSwitchSpendPeriod(at).end`),
+   * present exactly for that cause; once it passed the problem holds nothing (`authSwitchPaymentProblemHeld`). Every
+   * other problem holds until it is cleared: a Claude login's by a read, an API key's by a re-check (`usage.recheck`).
+   */
+  until?: string;
 }
 
 /**
- * How a re-check's read went (`AuthSwitchAuthorityUsage.recheck`): `healthy` -- the profile was found, the sign-in
+ * Why a provider refused inference on an API key for money, as AGL's inference proxy read the refusal: `billing`, the
+ * organization's billing (Anthropic HTTP 402 `billing_error`, and every Claude sign-in's payment problem); `spend_cap`,
+ * the monthly spend cap of the key's usage tier, which lifts at 00:00 UTC on the first of the next month (Anthropic 429
+ * `enforced_spend_limit_reached`); `quota`, the organization's or project's credit or spend limit (OpenAI 429
+ * `insufficient_quota`).
+ */
+export type TAuthSwitchPaymentProblemCause = 'billing' | 'spend_cap' | 'quota';
+
+/**
+ * How a re-check went (`AuthSwitchAuthorityUsage.recheck`). `cleared`: the login is an API key, whose hold a re-check
+ * lifts without asking the provider, which states no billing or quota on a model list; the next request shows whether the
+ * provider takes the key again. Every other outcome is a Claude login's read: `healthy` -- the profile was found, the sign-in
  * accepted and the identity matched -- clears a payment problem; every other outcome clears nothing. `credential_rejected`:
  * Anthropic rejected the sign-in, renewed too. `token_unusable`: no access token usable for a profile read (it could not
  * be resolved, is not fresh enough, or lacks the `user:profile` scope). `profile_missing`: the profile read failed or its
@@ -108,7 +142,7 @@ export interface IAuthSwitchPaymentProblem {
  * lies ahead.
  */
 export type TAuthSwitchRecheckOutcome = 'healthy' | 'credential_rejected' | 'token_unusable' | 'profile_missing'
-  | 'mismatch' | 'read_failed';
+  | 'mismatch' | 'read_failed' | 'cleared';
 
 /** A re-check's answer: the usage the authority holds once its read finished, and how that read went. */
 export interface IAuthSwitchUsageRecheck {
@@ -120,7 +154,7 @@ export interface IAuthSwitchUsageRecheck {
 export interface IAuthSwitchStoredUsage {
   context: IAuthSwitchUsageContext;
   updateId: string;
-  reading: TAuthSwitchUsageReading | null;
+  reading: TAuthSwitchProviderUsageReading | null;
   observedAt: string | null;
   currentUntil: string | null;
   staleUntil: string | null;
@@ -262,6 +296,15 @@ export interface IAuthSwitchAuthorityUsageOptions {
   estimate?: IAuthSwitchUsageEstimatorOptions;
   /** Where the reader's notes go, one line each: standard error, the service's journal, unless set. */
   log?: (lineArg: string) => void;
+  /**
+   * An API key's spend ledger: its month's reading at `nowArg`, and a spend report recorded in one transaction
+   * (`AuthSwitchAuthorityDatabase.readSpend`, `.recordSpend`). Without it the authority answers no key's usage.
+   */
+  spend?: {
+    read(accountId: string, loginId: string, nowArg: number): Promise<IAuthSwitchSpendReading>;
+    record(accountId: string, loginId: string, answers: readonly IAuthSwitchSpendAnswer[],
+      nowArg: number): Promise<IAuthSwitchSpendReading>;
+  };
 }
 
 /** What a client that served requests on a login reports about the account: see `report`. */
@@ -345,6 +388,15 @@ const usable = (context: IAuthSwitchUsageContext): boolean =>
         || (context.owner === 'claude_native' && context.nativeSource !== null
           && context.grantState === 'native'))));
 
+/** An API key of its account's provider, held or removed: its spend is recorded either way. */
+const apiKeyOfAccount = (context: IAuthSwitchUsageContext): boolean => context.workspaceId === 'api-key'
+  && ((context.providerId === 'anthropic' && context.purpose === 'anthropic_api_key')
+    || (context.providerId === 'openai' && context.purpose === 'openai_api_key'));
+
+/** An API key's login the authority holds: a key nothing else renews. Its usage is its spend ledger. */
+const apiKeyLogin = (context: IAuthSwitchUsageContext): boolean => apiKeyOfAccount(context) && context.owner === 'daemon'
+  && context.nativeSource === null;
+
 /** A login read through Claude Code's own home: its context names the home only once that home is opened for a read. */
 const native = (context: IAuthSwitchUsageContext): boolean => context.providerId === 'anthropic'
   && context.purpose === 'claude_host_native' && context.owner === 'claude_native' && context.grantState === 'native';
@@ -664,7 +716,8 @@ export class AuthSwitchAuthorityUsage {
    * carries it. Refused for any login but a Claude login the authority renews, and for one with no usage record of its
    * sign-in yet, which the proxy never routed to. The provider is not asked.
    */
-  public reportPaymentProblem(accountId: string, loginId: string, observedAt: string): Promise<IAuthSwitchUsageSnapshot> {
+  public reportPaymentProblem(accountId: string, loginId: string, observedAt: string,
+    cause: TCause = 'billing'): Promise<IAuthSwitchUsageSnapshot> {
     if (this.closed) return Promise.reject(new Error('Authority usage helper is closed.'));
     return this.admit((async () => {
       if (!/^[a-f0-9]{64}$/.test(accountId) || !/^[a-f0-9]{64}$/.test(loginId) || !Number.isFinite(Date.parse(observedAt))) {
@@ -672,9 +725,21 @@ export class AuthSwitchAuthorityUsage {
       }
       for (let attempt = 1; ; attempt++) {
         const context = await this.currentContext(accountId, loginId);
+        if (context && context.accountId === accountId && context.loginId === loginId && !context.removed
+          && apiKeyLogin(context) && context.grantState === 'ready') {
+          if (await this.holdApiKey(context, observedAt, cause)) return this.spendAnswer(context);
+          if (attempt >= paymentProblemWriteAttempts) {
+            throw new AuthSwitchRefusal('account_changed',
+              'The key\'s record kept changing, so its payment problem was not written; report it again.');
+          }
+          continue;
+        }
         if (!context || context.accountId !== accountId || context.loginId !== loginId || !paymentProblemLogin(context)) {
           throw new AuthSwitchRefusal('login_unavailable',
-            'Only a Claude login the account service renews is held with a payment problem.');
+            'Only a Claude login the account service renews, or an API key it holds, is held with a payment problem.');
+        }
+        if (cause !== 'billing') {
+          throw new AuthSwitchRefusal('login_unavailable', 'A Claude login is held only for a billing error.');
         }
         const stored = await this.options.store.read(accountId, loginId);
         const held = stored && authSwitchSameUsageSource(context, stored.context) ? stored : null;
@@ -714,9 +779,13 @@ export class AuthSwitchAuthorityUsage {
         throw new Error('Invalid authority usage identity.');
       }
       const context = await this.currentContext(accountId, loginId);
+      if (context && context.accountId === accountId && context.loginId === loginId && !context.removed
+        && apiKeyLogin(context)) {
+        return this.clearApiKey(context);
+      }
       if (!context || context.accountId !== accountId || context.loginId !== loginId
         || context.providerId !== 'anthropic' || context.purpose !== 'claude_host_native') {
-        throw new AuthSwitchRefusal('login_unavailable', 'Only a Claude login is re-checked.');
+        throw new AuthSwitchRefusal('login_unavailable', 'Only a Claude login or an API key is re-checked.');
       }
       const key = this.key(accountId, loginId);
       await this.answer(accountId, loginId, null);
@@ -737,6 +806,97 @@ export class AuthSwitchAuthorityUsage {
     })());
   }
 
+  /**
+   * Records what answers relayed on an API key's login cost (`authswitch.authority.usage.spend`) and answers the key's
+   * usage once the report committed. A removed key's spend is recorded too; its usage then answers unavailable.
+   */
+  public recordSpend(accountId: string, loginId: string,
+    answers: readonly IAuthSwitchSpendAnswer[]): Promise<IAuthSwitchUsageSnapshot> {
+    if (this.closed) return Promise.reject(new Error('Authority usage helper is closed.'));
+    return this.admit((async () => {
+      if (!/^[a-f0-9]{64}$/.test(accountId) || !/^[a-f0-9]{64}$/.test(loginId)) {
+        throw new Error('Invalid authority usage identity.');
+      }
+      const context = await this.currentContext(accountId, loginId);
+      const spend = this.options.spend;
+      if (!spend || !context || context.accountId !== accountId || context.loginId !== loginId || !apiKeyOfAccount(context)) {
+        throw new AuthSwitchRefusal('login_unavailable', 'Only an API key\'s login records spend.');
+      }
+      await spend.record(accountId, loginId, answers, this.now());
+      return this.answer(accountId, loginId, null);
+    })());
+  }
+
+  /**
+   * An API key's usage: its month's spend from the ledger, current as of now, which stays current until the month ends
+   * or a report or a limit change moves it, and the payment problem it is held with, while it holds.
+   */
+  private async spendAnswer(context: IAuthSwitchUsageContext): Promise<IAuthSwitchUsageSnapshot> {
+    const { accountId, loginId } = context;
+    if (context.removed || !this.options.spend) {
+      return this.unavailable(accountId, loginId, context.removed ? 'access_unavailable' : 'unsupported');
+    }
+    const now = this.now();
+    let spend: IAuthSwitchSpendReading;
+    let held: IAuthSwitchStoredUsage | null;
+    try {
+      [spend, held] = await Promise.all([this.options.spend.read(accountId, loginId, now),
+        this.options.store.read(accountId, loginId)]);
+    } catch {
+      this.log('Authswitch could not read an API key\'s spend; the key is answered without a reading.');
+      return this.unavailable(accountId, loginId, 'spend_unavailable');
+    }
+    const paymentProblem = held && authSwitchSameUsageSource(context, held.context) && held.paymentProblem
+      && authSwitchPaymentProblemHeld(held.paymentProblem, now) ? held.paymentProblem : undefined;
+    const readAt = timestamp(now);
+    return { accountId, loginId, state: 'current', reading: { kind: 'spend', spend }, observedAt: readAt, readAt,
+      currentUntil: spend.resetAt, staleUntil: spend.resetAt, lastAttemptAt: null, nextAttemptAt: null,
+      lastReadError: null, problem: 'none', ...(paymentProblem ? { paymentProblem } : {}) };
+  }
+
+  /**
+   * Holds an API key with a payment problem on its usage record, which holds nothing else: when it was seen -- a time
+   * ahead of the authority's clock counts as now -- and its cause; `billing` is written as no cause, and a `spend_cap`
+   * lifts at the end of the month it was seen in. False when another write of the record landed first.
+   */
+  private async holdApiKey(context: IAuthSwitchUsageContext, observedAt: string, cause: TCause): Promise<boolean> {
+    const stored = await this.options.store.read(context.accountId, context.loginId);
+    const held = stored && authSwitchSameUsageSource(context, stored.context) ? stored : null;
+    const now = this.now();
+    const at = timestamp(Math.min(Date.parse(observedAt), now));
+    const paymentProblem: IAuthSwitchPaymentProblem = cause === 'spend_cap'
+      ? { at, subscription: null, cause, until: authSwitchSpendPeriod(Date.parse(at)).end }
+      : cause === 'quota' ? { at, subscription: null, cause } : { at, subscription: null };
+    const next: IAuthSwitchStoredUsage = { context, updateId: plugins.crypto.randomUUID(), reading: null,
+      observedAt: null, currentUntil: null, staleUntil: null, lastAttemptAt: at, nextAttemptAt: at, failures: 0,
+      problem: 'none', paymentProblem };
+    return this.options.store.publishIfCurrent(context, held && sameContext(context, held.context) ? held.updateId : null,
+      next);
+  }
+
+  /**
+   * A re-check of an API key: lifts the payment problem it is held with, without asking the provider, whose model list
+   * states no billing or quota; the next request shows whether the provider takes the key again.
+   */
+  private async clearApiKey(context: IAuthSwitchUsageContext): Promise<IAuthSwitchUsageRecheck> {
+    for (let attempt = 1; ; attempt++) {
+      const stored = await this.options.store.read(context.accountId, context.loginId);
+      const held = stored && authSwitchSameUsageSource(context, stored.context) && stored.paymentProblem ? stored : null;
+      if (!held) return { usage: await this.spendAnswer(context), outcome: 'cleared' };
+      // A record without the member: the store's transition drops a problem the draft does not hold.
+      const { paymentProblem: _lifted, ...rest } = held;
+      const next: IAuthSwitchStoredUsage = { ...rest, context, updateId: plugins.crypto.randomUUID() };
+      if (await this.options.store.publishIfCurrent(context, sameContext(context, held.context) ? held.updateId : null,
+        next)) {
+        return { usage: await this.spendAnswer(context), outcome: 'cleared' };
+      }
+      if (attempt >= paymentProblemWriteAttempts) {
+        throw new AuthSwitchRefusal('account_changed', 'The key\'s record kept changing, so its hold was not lifted; '
+          + 're-check it again.');
+      }
+    }
+  }
+
   /** Logs a Claude subscription status the first time this run reads it, up to `maximumLoggedSubscriptionStatuses`. */
   private noteSubscriptionStatus(statusArg: string | null): void {
     if (statusArg === null || this.subscriptionStatusesCapped || this.loggedSubscriptionStatuses.has(statusArg)) return;
@@ -774,6 +934,7 @@ export class AuthSwitchAuthorityUsage {
     if (context.accountId !== accountId || context.loginId !== loginId) {
       return this.unavailable(accountId, loginId, 'context_changed');
     }
+    if (apiKeyLogin(context)) return this.spendAnswer(context);
     if (!readable(context)) {
       this.unschedule(accountId, loginId);
       return this.unavailable(accountId, loginId,
@@ -999,7 +1160,7 @@ export class AuthSwitchAuthorityUsage {
       previous = latest && sameContext(context, latest.context) ? latest : null;
       held = latest && authSwitchSameUsageSource(context, latest.context) ? latest : null;
     };
-    let reading: TAuthSwitchUsageReading | null = null;
+    let reading: TAuthSwitchProviderUsageReading | null = null;
     /** Whether the read stated the account's windows: only then is it a reading the schedule waits a full slot after. */
     let windowsRead = false;
     let rateLimited = false;

package/ts_authswitch/classes.claudenative.ts

@@ -14,11 +14,20 @@ export const CLAUDE_NATIVE_MINIMUM_VERSION = '2.1.273';
 /**
  * The releases whose lock table, live credential pickup and native-login selector were read from their own bundle
  * (native-contracts.md). The usage of an adopted home's login is read from the home only while every Claude Code
- * session running there runs one of these or a later release than the newest of them, which is read as that one
- * (`claudeNativeReleaseReadsAsVerified`, owner ruling 2026-10-22, AGL-685); an installed release between the floor and
- * the newest that is not listed is read from only while no session runs in that home.
+ * session running there runs one of these or a release from `CLAUDE_NATIVE_READ_AS_VERIFIED_FROM` on
+ * (`claudeNativeReleaseReadsAsVerified`, owner ruling 2026-10-22, AGL-685); an installed release below that line that
+ * is not listed is read from only while no session runs in that home. The controller's verified release (2.1.306,
+ * AGL-686) and its fleet floor (2.1.282) are listed. 2.1.288, the release AGL's own Claude chats run through the Agent
+ * SDK, had these items read from the SDK's binary (AGL-688) and is listed for the usage read only: the fleet never ran
+ * it, so it is never the fleet's floor or the verified release.
  */
-export const CLAUDE_NATIVE_VERIFIED_RELEASES: readonly string[] = ['2.1.273', '2.1.282'];
+export const CLAUDE_NATIVE_VERIFIED_RELEASES: readonly string[] = ['2.1.273', '2.1.282', '2.1.288', '2.1.306'];
+/**
+ * The line from which the usage read takes any release, listed or not, as verified (owner ruling 2026-10-22, AGL-685):
+ * the controller's fleet floor (`claudeCodeFleetFloor`), which a test holds equal to it. It does not move when a newer
+ * release is verified.
+ */
+export const CLAUDE_NATIVE_READ_AS_VERIFIED_FROM = '2.1.282';
 /**
  * The releases whose credential custody contract was read from their own bundle (native-contracts.md): the OAuth
  * refresh lock and its legacy twin, the credential store's write lock and the global config lock; the store read
@@ -126,7 +135,8 @@ export class ClaudeNativeEffectiveAuthUnsupportedError extends Error {
     public readonly sessions: readonly IClaudeNativeRefusedSession[] = []) {
     super((reason === 'unsupported_release'
       ? `Reading Claude Code's own login requires Claude Code ${CLAUDE_NATIVE_MINIMUM_VERSION} or newer, and a session `
-        + `running in this home must run a verified release (${CLAUDE_NATIVE_VERIFIED_RELEASES.join(', ')}) or a newer one.`
+        + `running in this home must run a verified release (${CLAUDE_NATIVE_VERIFIED_RELEASES.join(', ')}) or any release `
+        + `from ${CLAUDE_NATIVE_READ_AS_VERIFIED_FROM} on.`
       : `Cannot prove that Claude Code uses its native claude.ai login (${reason}).`)
       + (sessions.length ? ` Refused: ${sessions.map(describeClaudeNativeRefusedSession).join('; ')}.` : ''));
   }
@@ -179,6 +189,10 @@ export interface IClaudeNativeRunningContext {
   /** The Agent SDK version whose platform package holds its executable, for an Agent SDK binary only. */
   agentSdkVersion?: string;
   env: NodeJS.ProcessEnv | null;
+  /**
+   * Its working directory as its own root sees it; null when that cannot be resolved -- deleted under it, for one -- so
+   * nothing that needs it (a relative home or store, its project settings) can be proven.
+   */
   cwd: string | null;
   hasSettingsOverride: boolean | null;
   /** The selected native home as seen through this process's mount namespace. */
@@ -251,17 +265,15 @@ const atLeast = (version: [number, number, number], minimum: [number, number, nu
 const claudeBuildPattern = /^(\d{1,6})\.(\d{1,6})\.(\d{1,6})(?:-[0-9a-f]{1,64})?$/;
 /**
  * Whether a session of this build is read like a verified release when its home's login is read for usage: a listed
- * release, or a build of a release no older than the newest listed one, which is read as that one. A hashed build is
- * ordered by its release. Custody never uses this: it matches whole build names (`CLAUDE_NATIVE_CUSTODY_RELEASES`).
+ * release, or a build of a release from `CLAUDE_NATIVE_READ_AS_VERIFIED_FROM` on. A hashed build is ordered by its
+ * release. Custody never uses this: it matches whole build names (`CLAUDE_NATIVE_CUSTODY_RELEASES`).
  */
 export const claudeNativeReleaseReadsAsVerified = (build: string | null): boolean => {
   if (build === null) return false;
   if (CLAUDE_NATIVE_VERIFIED_RELEASES.includes(build)) return true;
   const match = claudeBuildPattern.exec(build);
   if (!match) return false;
-  const newest = CLAUDE_NATIVE_VERIFIED_RELEASES.map(release => parseClaudeVersion(release)!)
-    .reduce((left, right) => atLeast(left, right) ? left : right);
-  return atLeast([Number(match[1]), Number(match[2]), Number(match[3])], newest);
+  return atLeast([Number(match[1]), Number(match[2]), Number(match[3])], parseClaudeVersion(CLAUDE_NATIVE_READ_AS_VERIFIED_FROM)!);
 };
 
 /**
@@ -458,10 +470,15 @@ export const claudeNativeCredentialStoreDirectory = (env: NodeJS.ProcessEnv): st
     ? plugins.path.join(env.HOME, '.claude').normalize('NFC') : null;
 };
 
+/**
+ * An environment selects this home and keeps its credential store there too: a store elsewhere
+ * (`CLAUDE_SECURESTORAGE_CONFIG_DIR`) selects another login, so it is refused as an override.
+ */
 const assertNativeHome = (env: NodeJS.ProcessEnv, configDir: string): void => {
-  const selected = selectedNativeHome(env);
-  if (!selected || !plugins.path.isAbsolute(selected) || plugins.path.normalize(selected) !== configDir) {
-    throw new ClaudeNativeEffectiveAuthUnsupportedError('override');
+  for (const selected of [selectedNativeHome(env), claudeNativeCredentialStoreDirectory(env)]) {
+    if (!selected || !plugins.path.isAbsolute(selected) || plugins.path.normalize(selected) !== configDir) {
+      throw new ClaudeNativeEffectiveAuthUnsupportedError('override');
+    }
   }
 };
 
@@ -695,10 +712,24 @@ class ClaudeNativeVersionProbe implements IClaudeNativeVersionProbe {
   }
 }
 
+/**
+ * The working directory `/proc/<pid>/cwd` names, when that path is the very directory the process works in as its own
+ * root sees it; null otherwise, as for a directory deleted under the process, which the link names `<path> (deleted)`.
+ */
+const resolvedProcessCwd = (pid: number, root: string): string | null => {
+  try {
+    const cwd = plugins.fs.readlinkSync(`/proc/${pid}/cwd`);
+    return plugins.path.isAbsolute(cwd) && sameDirectory(directoryIdentity(`/proc/${pid}/cwd`),
+      directoryIdentity(processViewPath(cwd, root))) ? cwd : null;
+  } catch { return null; }
+};
+
 /**
  * Every Claude Code process of this user, the home it selects and the directory of its credential store, resolved
  * through its own mount namespace (`/proc/<pid>/root`), so a process in a container that bind-mounts a home is matched to
- * that home's inode. A live process whose context cannot be read is listed with unknown fields rather than skipped.
+ * that home's inode. A live process whose context cannot be read is listed with unknown fields rather than skipped. A
+ * working directory that cannot be resolved leaves `cwd` unknown and only what depends on it: a home or store the
+ * process names by an absolute path is still resolved under its root, one named by a relative path is not.
  */
 export const scanClaudeRunningContexts = (): readonly IClaudeNativeRunningContext[] => {
   const contexts: IClaudeNativeRunningContext[] = [];
@@ -725,20 +756,18 @@ export const scanClaudeRunningContexts = (): readonly IClaudeNativeRunningContex
       }
       mountNamespace = plugins.fs.readlinkSync(`/proc/${running.pid}/ns/mnt`);
       env = selectorEnvironment(readProcessContext(`/proc/${running.pid}/environ`));
-      cwd = plugins.fs.readlinkSync(`/proc/${running.pid}/cwd`);
       const root = `/proc/${running.pid}/root`;
       processRoot = root;
-      if (!plugins.path.isAbsolute(cwd) || !sameDirectory(
-        directoryIdentity(`/proc/${running.pid}/cwd`),
-        directoryIdentity(processViewPath(cwd, root)))) {
-        throw new Error('Claude process working directory cannot be resolved in its mount namespace.');
-      }
+      cwd = resolvedProcessCwd(running.pid, root);
       // A directory the process names, as it sees it: an absolute path under its own root, a relative one under its cwd.
       const processDirectory = (selected: string | null, name: string): IClaudeNativeDirectoryIdentity => {
         if (!selected) throw new Error(`Claude process ${name} is unknown.`);
         if (plugins.path.isAbsolute(selected) && plugins.path.normalize(selected) !== selected) {
           throw new Error(`Claude process ${name} path is ambiguous.`);
         }
+        if (!plugins.path.isAbsolute(selected) && cwd === null) {
+          throw new Error(`Claude process ${name} is relative to a working directory that cannot be resolved.`);
+        }
         return directoryIdentity(plugins.path.isAbsolute(selected)
           ? processViewPath(selected, root)
           // Preserve the proc magic symlink before `..` is resolved by the target's VFS.
@@ -908,8 +937,8 @@ export class ClaudeNativeAdapter {
 
   /**
    * The whole support check of reading the login Claude Code selects in the home: the home's custody, and the proof
-   * that Claude Code selects its native login there -- for the daemon's own environment and settings and for every
-   * process running on the home.
+   * that Claude Code selects its native login there -- for the daemon's own environment (its home and its credential
+   * store are both this home) and settings, and for every process running on the home.
    */
   private assertSupported(): IClaudeNativeSupport {
     this.assertHomeDirectories();

package/ts_authswitch/classes.claudesignin.ts

@@ -1,6 +1,6 @@
 import * as plugins from './plugins.js';
-import { AuthSwitchRefusal, authSwitchClaudeSignInArguments,
-  type IAuthSwitchClaudeSignInOperation } from './authority-contract.js';
+import { AuthSwitchRefusal, authSwitchClaudeSignInArguments, authSwitchClaudeSignInHoldersText,
+  type IAuthSwitchClaudeSignInHolder, type IAuthSwitchClaudeSignInOperation } from './authority-contract.js';
 import type { AuthSwitchGrantImport, IAuthSwitchImportClaudeTokens } from './classes.authorityimport.js';
 import type { IAuthSwitchSecretCodec } from './classes.authoritysecrets.js';
 import { canonicalContainerDirectory, ClaudeContainerHome, discardContainerPair, inspectClaudeContainerDirectory,
@@ -38,6 +38,20 @@ const isUuid = (value: string): boolean => /^[a-f0-9-]{36}$/.test(value);
 const shellWord = (value: string): string => `'${value.replaceAll('\'', '\'\\\'\'')}'`;
 const finished = (state: IAuthSwitchClaudeSignInOperation['state']): boolean =>
   state !== 'pending' && state !== 'committing';
+/**
+ * How much earlier than a sign-in's home a process must have started, by the process table, to be proven older than
+ * it: `ps` names the start to the whole second, cut down, from a boot time the kernel also keeps to the whole second, so
+ * a process may have started up to two seconds after the moment the table names. The rest is room for clock slew.
+ */
+const startedBeforeMarginMs = 5_000;
+const startedBefore = (startedAt: string | null, madeAtMs: number): boolean => {
+  const started = startedAt === null ? Number.NaN : Date.parse(startedAt);
+  return Number.isFinite(started) && started + startedBeforeMarginMs <= madeAtMs;
+};
+const sameHolders = (left: readonly IAuthSwitchClaudeSignInHolder[] | null,
+  right: readonly IAuthSwitchClaudeSignInHolder[] | null): boolean =>
+  left === null || right === null ? left === right : left.length === right.length && left.every((holder, index) =>
+    holder.pid === right[index]!.pid && holder.startedAt === right[index]!.startedAt && holder.reason === right[index]!.reason);
 
 interface IClaudeSignIn {
   operation: IAuthSwitchClaudeSignInOperation;
@@ -51,7 +65,8 @@ interface IClaudeSignIn {
 
 /**
  * Claude sign-ins: Claude Code signs in to a home the daemon made for that one sign-in, and the daemon imports the
- * login it finds there once no Claude Code process runs on the home any more, then removes the home.
+ * login it finds there once no Claude Code process may still run on the home, then removes the home. Until then the
+ * sign-in names the processes that hold it (`heldBy`).
  *
  * The home is the daemon's own, below a directory of its user that no one else can write, and it is touched only by
  * descriptor, as a container home is (`ClaudeContainerHome`): a home replaced by a link cannot redirect a read or the
@@ -103,12 +118,17 @@ export class ClaudeSignInAuthority {
     const directory = plugins.path.join(this.options.directory, operationId);
     const { parent, leaf } = inspectClaudeContainerDirectory(directory, this.owner);
     if (leaf !== null) throw new Error('A Claude sign-in home already exists for this operation.');
-    ClaudeContainerHome.open(directory, parent, { create: true, owner: this.owner }).close();
+    // Read before the home is made, so no process that started after it can seem to have started before it.
     const now = this.now();
+    ClaudeContainerHome.open(directory, parent, { create: true, owner: this.owner }).close();
     const signIn: IClaudeSignIn = {
       operation: { id: operationId, state: 'pending',
+        // The credential store is pinned to the home as well: one an inherited CLAUDE_SECURESTORAGE_CONFIG_DIR names
+        // would take the new login, over whatever login it holds, and the home would never get it.
         prompt: { flow: 'terminal', directory,
-          command: `CLAUDE_CONFIG_DIR=${shellWord(directory)} claude ${authSwitchClaudeSignInArguments.join(' ')}` },
+          command: `CLAUDE_CONFIG_DIR=${shellWord(directory)} CLAUDE_SECURESTORAGE_CONFIG_DIR=${shellWord(directory)} `
+            + `claude ${authSwitchClaudeSignInArguments.join(' ')}` },
+        heldBy: null,
         result: null, error: null, createdAt: new Date(now).toISOString(), updatedAt: new Date(now).toISOString(),
         expiresAt: new Date(now + signInWindowMs).toISOString(), finishedAt: null, revision: 1 },
       directory, parent, timer: null, commit: null,
@@ -189,14 +209,13 @@ export class ClaudeSignInAuthority {
     }, this.pollIntervalMs);
   }
 
-  /** Looks once for the login: imports it when it is there and no Claude Code runs on the home, else waits on. */
+  /**
+   * Looks once for the login: imports it when it is there and nothing holds it (`holders`), else waits on, keeping in
+   * `heldBy` what holds it. At `expiresAt` it ends instead and imports nothing, saying whether a login had arrived and
+   * what held it.
+   */
   private poll(signIn: IClaudeSignIn): void {
     if (this.closed || signIn.operation.state !== 'pending') return;
-    if (this.now() >= Date.parse(signIn.operation.expiresAt)) {
-      this.end(signIn, 'failed', 'No Claude login arrived within fifteen minutes, so nothing was added. Start a new '
-        + 'sign-in.');
-      return;
-    }
     let read: { pair: IClaudeContainerPair; identity: IClaudeContainerDirectoryIdentity | null } | null = null;
     try {
       const home = ClaudeContainerHome.open(signIn.directory, signIn.parent, { create: false, owner: this.owner });
@@ -210,29 +229,59 @@ export class ClaudeSignInAuthority {
       return;
     }
     const { pair, identity } = read;
-    let ready: boolean;
-    try {
-      // A process whose home or credential store is the sign-in home, or unknown, may still write the login there.
-      ready = pair.credentialRaw !== null && identity !== null && !this.runningContexts().some(context =>
-        context.nativeHomeIdentity === null || context.credentialStoreIdentity === null
-        || sameContainerDirectory(context.nativeHomeIdentity, identity)
-        || sameContainerDirectory(context.credentialStoreIdentity, identity));
-    } catch {
+    let holders: IAuthSwitchClaudeSignInHolder[] | null = null;
+    if (pair.credentialRaw !== null && identity !== null) {
+      try { holders = this.holders(identity, Date.parse(signIn.operation.createdAt)); }
+      catch {
+        discardContainerPair(pair);
+        this.end(signIn, 'failed', 'The authority could not tell whether Claude Code still runs on the sign-in home, '
+          + 'so nothing was added. Start a new sign-in.');
+        return;
+      }
+    }
+    if (this.now() >= Date.parse(signIn.operation.expiresAt)) {
       discardContainerPair(pair);
-      this.end(signIn, 'failed', 'The authority could not tell whether Claude Code still runs on the sign-in home, '
-        + 'so nothing was added. Start a new sign-in.');
+      this.end(signIn, 'failed', holders === null
+        ? 'No Claude login arrived within fifteen minutes, so nothing was added. Start a new sign-in.'
+        : holders.length > 0
+          ? 'A Claude login arrived but was not added: until the sign-in ended, fifteen minutes after it started, these '
+            + `Claude Code processes kept it from being imported: ${authSwitchClaudeSignInHoldersText(holders)}. Start a `
+            + 'new sign-in once they have ended.'
+          : 'A Claude login arrived only as the sign-in ended, fifteen minutes after it started, so it was not added. '
+            + 'Start a new sign-in.');
       return;
     }
-    if (!ready) {
+    if (holders === null || holders.length > 0) {
       discardContainerPair(pair);
+      if (!sameHolders(signIn.operation.heldBy, holders)) this.change(signIn, { heldBy: holders });
       this.schedule(signIn);
       return;
     }
     signIn.commit = this.commit(signIn, pair);
   }
 
+  /**
+   * The Claude Code processes that keep a login in the home `identity` from being imported, as the process table lists
+   * them: each whose home or credential store is the home, so it may still write the login there, and each whose home
+   * or store is unknown, unless it provably started before the home was made at `madeAtMs`. A process's settings are
+   * fixed when it starts, and the home's name was random until it was made, so an older process cannot name it.
+   */
+  private holders(identity: IClaudeContainerDirectoryIdentity, madeAtMs: number): IAuthSwitchClaudeSignInHolder[] {
+    const holders: IAuthSwitchClaudeSignInHolder[] = [];
+    for (const context of this.runningContexts()) {
+      const reason: IAuthSwitchClaudeSignInHolder['reason'] | null =
+        (context.nativeHomeIdentity !== null && sameContainerDirectory(context.nativeHomeIdentity, identity))
+          || (context.credentialStoreIdentity !== null && sameContainerDirectory(context.credentialStoreIdentity, identity))
+          ? 'on_home'
+          : (context.nativeHomeIdentity === null || context.credentialStoreIdentity === null)
+            && !startedBefore(context.startedAt, madeAtMs) ? 'uninspectable' : null;
+      if (reason !== null) holders.push({ pid: context.pid, startedAt: context.startedAt, reason });
+    }
+    return holders;
+  }
+
   private async commit(signIn: IClaudeSignIn, pair: IClaudeContainerPair): Promise<void> {
-    this.change(signIn, { state: 'committing', prompt: null });
+    this.change(signIn, { state: 'committing', prompt: null, heldBy: null });
     try {
       const result = await this.grants.importClaudeSignIn({ directory: signIn.directory,
         credentialRaw: pair.credentialRaw!, configRaw: pair.configRaw });
@@ -259,7 +308,8 @@ export class ClaudeSignInAuthority {
     signIn.timer = null;
     try { this.removeHome(signIn.parent, plugins.path.basename(signIn.directory)); }
     catch { /* The sign-in is over whatever the removal did; the next start removes a home that stayed. */ }
-    this.change(signIn, { state, prompt: null, error, result, finishedAt: new Date(this.now()).toISOString() });
+    this.change(signIn, { state, prompt: null, heldBy: null, error, result,
+      finishedAt: new Date(this.now()).toISOString() });
   }
 
   private change(signIn: IClaudeSignIn, patch: Partial<IAuthSwitchClaudeSignInOperation>): void {