airaknit 1.1.2-rc.9

package/src/server/claude-pty/auth.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, test } from "bun:test"
+import { verifyPtyAuth } from "./auth"
+
+describe("verifyPtyAuth", () => {
+  test("error when no oauthToken supplied", async () => {
+    const result = await verifyPtyAuth({ env: {} })
+    expect(result.ok).toBe(false)
+    if (!result.ok) {
+      expect(result.error).toContain("OAuth pool token")
+    }
+  })
+
+  test("ok when oauthToken supplied", async () => {
+    const result = await verifyPtyAuth({ env: {}, oauthToken: "sk-ant-oat-abc" })
+    expect(result.ok).toBe(true)
+  })
+
+  test("empty oauthToken does not satisfy auth", async () => {
+    const result = await verifyPtyAuth({ env: {}, oauthToken: "" })
+    expect(result.ok).toBe(false)
+  })
+
+  test("ANTHROPIC_API_KEY in parent env does not block when oauthToken supplied (stripped by buildPtyEnv)", async () => {
+    const result = await verifyPtyAuth({
+      env: { ANTHROPIC_API_KEY: "sk-x" },
+      oauthToken: "sk-ant-oat-abc",
+    })
+    expect(result.ok).toBe(true)
+  })
+
+  test("ANTHROPIC_API_KEY alone never satisfies auth — OAuth token still required", async () => {
+    const result = await verifyPtyAuth({ env: { ANTHROPIC_API_KEY: "sk-x" } })
+    expect(result.ok).toBe(false)
+    if (!result.ok) {
+      expect(result.error).toContain("OAuth pool token")
+    }
+  })
+})

package/src/server/claude-pty/auth.ts

@@ -0,0 +1,32 @@
+export type VerifyPtyAuthResult =
+  | { ok: true }
+  | { ok: false; error: string }
+
+/**
+ * Checks the spawn-time auth preconditions for PTY mode.
+ *
+ * PTY mode is OAuth-only by construction: it NEVER uses an API key. The
+ * OAuth-pool token is the sole supported auth path — supply a non-empty
+ * `oauthToken` arg and the driver injects it via `CLAUDE_CODE_OAUTH_TOKEN`.
+ * No on-disk credentials file (`~/.claude/.credentials.json`) and no local
+ * `claude /login` keychain path is consulted.
+ *
+ * `ANTHROPIC_API_KEY` in the parent environment is NOT a failure: the
+ * driver's `buildPtyEnv` unconditionally deletes it from the spawned child
+ * env, so the CLI can never fall back to API billing. Rejecting the spawn
+ * outright (the old behaviour) only forced operators to manually unset a
+ * harmless env var; the strip already guarantees subscription billing.
+ */
+export async function verifyPtyAuth(args: {
+  env: NodeJS.ProcessEnv
+  oauthToken?: string | null
+}): Promise<VerifyPtyAuthResult> {
+  void args.env
+  if (typeof args.oauthToken === "string" && args.oauthToken.length > 0) {
+    return { ok: true }
+  }
+  return {
+    ok: false,
+    error: "No OAuth pool token supplied. PTY mode is OAuth-only and requires an OAuth-pool token configured in Tinkaria settings; API keys and the local `claude /login` keychain path are not used.",
+  }
+}

package/src/server/claude-pty/claude-session-registry.adapter.ts

@@ -0,0 +1,81 @@
+import { readFile } from "node:fs/promises"
+import path from "node:path"
+
+/**
+ * Mirror of the per-PID file Claude Code itself writes on every spawn under
+ * `${homeDir}/.claude/sessions/<pid>.json` (claude-code source:
+ * src/utils/concurrentSessions.ts `registerSession`). Reading this file is
+ * the only race-free way for a supervisor to discover the session UUID
+ * claude assigned to a TUI spawn — `--session-id` is honored but only in
+ * non-resume flows, and the UUID is otherwise never emitted to PTY stdout
+ * before the first prompt commit.
+ *
+ * Claude removes the file on graceful exit; a crashed claude leaves it
+ * behind, which is harmless for our use case because we always look up by
+ * the live child PID we just spawned.
+ */
+export interface ClaudeSessionRegistryEntry {
+  pid: number
+  sessionId: string
+  cwd: string
+  kind: string
+  startedAt: number
+}
+
+export function computeClaudeSessionFilePath(homeDir: string, pid: number): string {
+  return path.join(homeDir, ".claude", "sessions", `${pid}.json`)
+}
+
+export async function readClaudeSessionByPid(
+  homeDir: string,
+  pid: number,
+): Promise<ClaudeSessionRegistryEntry | null> {
+  const filePath = computeClaudeSessionFilePath(homeDir, pid)
+  let raw: string
+  try {
+    raw = await readFile(filePath, "utf8")
+  } catch {
+    return null
+  }
+  let parsed: Partial<ClaudeSessionRegistryEntry>
+  try {
+    parsed = JSON.parse(raw) as Partial<ClaudeSessionRegistryEntry>
+  } catch {
+    return null
+  }
+  if (
+    typeof parsed.pid !== "number"
+    || !Number.isFinite(parsed.pid)
+    || typeof parsed.sessionId !== "string"
+    || parsed.sessionId.length === 0
+  ) {
+    return null
+  }
+  return {
+    pid: parsed.pid,
+    sessionId: parsed.sessionId,
+    cwd: typeof parsed.cwd === "string" ? parsed.cwd : "",
+    kind: typeof parsed.kind === "string" ? parsed.kind : "",
+    startedAt: typeof parsed.startedAt === "number" ? parsed.startedAt : 0,
+  }
+}
+
+export interface AwaitClaudeSessionForPidArgs {
+  homeDir: string
+  pid: number
+  timeoutMs: number
+  pollIntervalMs?: number
+}
+
+export async function awaitClaudeSessionForPid(
+  args: AwaitClaudeSessionForPidArgs,
+): Promise<ClaudeSessionRegistryEntry | null> {
+  const interval = args.pollIntervalMs ?? 20
+  const deadline = Date.now() + args.timeoutMs
+  for (;;) {
+    const entry = await readClaudeSessionByPid(args.homeDir, args.pid)
+    if (entry && entry.pid === args.pid) return entry
+    if (Date.now() >= deadline) return null
+    await new Promise((resolve) => setTimeout(resolve, interval))
+  }
+}

package/src/server/claude-pty/claude-session-registry.test.ts

@@ -0,0 +1,149 @@
+import { describe, expect, test } from "bun:test"
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs"
+import { tmpdir } from "node:os"
+import path from "node:path"
+import {
+  awaitClaudeSessionForPid,
+  computeClaudeSessionFilePath,
+  readClaudeSessionByPid,
+} from "./claude-session-registry.adapter"
+
+function makeHome(): string {
+  return mkdtempSync(path.join(tmpdir(), "kanna-csr-"))
+}
+
+function writeEntry(homeDir: string, pid: number, body: Record<string, unknown>) {
+  const dir = path.join(homeDir, ".claude", "sessions")
+  mkdirSync(dir, { recursive: true })
+  writeFileSync(path.join(dir, `${pid}.json`), JSON.stringify(body), "utf8")
+}
+
+describe("computeClaudeSessionFilePath", () => {
+  test("joins homeDir + .claude/sessions/<pid>.json", () => {
+    expect(computeClaudeSessionFilePath("/tmp/h", 4242)).toBe("/tmp/h/.claude/sessions/4242.json")
+  })
+})
+
+describe("readClaudeSessionByPid", () => {
+  test("returns parsed entry when file exists with required fields", async () => {
+    const home = makeHome()
+    try {
+      writeEntry(home, 1234, {
+        pid: 1234,
+        sessionId: "abc-uuid",
+        cwd: "/some/cwd",
+        kind: "interactive",
+        startedAt: 1000,
+      })
+      const entry = await readClaudeSessionByPid(home, 1234)
+      expect(entry).toEqual({
+        pid: 1234,
+        sessionId: "abc-uuid",
+        cwd: "/some/cwd",
+        kind: "interactive",
+        startedAt: 1000,
+      })
+    } finally {
+      rmSync(home, { recursive: true, force: true })
+    }
+  })
+
+  test("returns null when file is missing", async () => {
+    const home = makeHome()
+    try {
+      const entry = await readClaudeSessionByPid(home, 9999)
+      expect(entry).toBeNull()
+    } finally {
+      rmSync(home, { recursive: true, force: true })
+    }
+  })
+
+  test("returns null when sessionId is missing or empty", async () => {
+    const home = makeHome()
+    try {
+      writeEntry(home, 1, { pid: 1, sessionId: "" })
+      expect(await readClaudeSessionByPid(home, 1)).toBeNull()
+      writeEntry(home, 2, { pid: 2 })
+      expect(await readClaudeSessionByPid(home, 2)).toBeNull()
+    } finally {
+      rmSync(home, { recursive: true, force: true })
+    }
+  })
+
+  test("returns null on malformed JSON", async () => {
+    const home = makeHome()
+    try {
+      const dir = path.join(home, ".claude", "sessions")
+      mkdirSync(dir, { recursive: true })
+      writeFileSync(path.join(dir, "55.json"), "not-json", "utf8")
+      expect(await readClaudeSessionByPid(home, 55)).toBeNull()
+    } finally {
+      rmSync(home, { recursive: true, force: true })
+    }
+  })
+})
+
+describe("awaitClaudeSessionForPid", () => {
+  test("returns immediately when file already exists", async () => {
+    const home = makeHome()
+    try {
+      writeEntry(home, 77, { pid: 77, sessionId: "uuid-77" })
+      const entry = await awaitClaudeSessionForPid({
+        homeDir: home,
+        pid: 77,
+        timeoutMs: 200,
+        pollIntervalMs: 5,
+      })
+      expect(entry?.sessionId).toBe("uuid-77")
+    } finally {
+      rmSync(home, { recursive: true, force: true })
+    }
+  })
+
+  test("polls until file appears within timeout", async () => {
+    const home = makeHome()
+    try {
+      setTimeout(() => writeEntry(home, 88, { pid: 88, sessionId: "uuid-88" }), 40)
+      const entry = await awaitClaudeSessionForPid({
+        homeDir: home,
+        pid: 88,
+        timeoutMs: 500,
+        pollIntervalMs: 5,
+      })
+      expect(entry?.sessionId).toBe("uuid-88")
+    } finally {
+      rmSync(home, { recursive: true, force: true })
+    }
+  })
+
+  test("returns null after timeout", async () => {
+    const home = makeHome()
+    try {
+      const entry = await awaitClaudeSessionForPid({
+        homeDir: home,
+        pid: 99,
+        timeoutMs: 50,
+        pollIntervalMs: 5,
+      })
+      expect(entry).toBeNull()
+    } finally {
+      rmSync(home, { recursive: true, force: true })
+    }
+  })
+
+  test("rejects mismatched pid in registry payload", async () => {
+    const home = makeHome()
+    try {
+      writeEntry(home, 100, { pid: 999, sessionId: "wrong-pid" })
+      const entry = await awaitClaudeSessionForPid({
+        homeDir: home,
+        pid: 100,
+        timeoutMs: 30,
+        pollIntervalMs: 5,
+      })
+      expect(entry).toBeNull()
+    } finally {
+      rmSync(home, { recursive: true, force: true })
+    }
+  })
+})