claude-dev-env 2.1.0 → 2.2.1

package/skills/pr-converge/reference/per-tick.md

@@ -15,29 +15,38 @@ Use on **draft PR**. Cursor Bugbot and `/bugteam` re-run after each push. Fix
 findings between rounds until back-to-back clean on same `HEAD`, then mark
 PR ready for review.
 
-Run every tick in parent harness session. Pacing lives in
-[`../workflows/schedule-wakeup-loop.md`](../workflows/schedule-wakeup-loop.md) (read before Step 4); see [Pacing
-workflow](#pacing-workflow).
+Run every tick in the parent harness session. Pacing depends on the selected
+pacer from pre-flight (`select_converge_pacer.py`):
+
+- `schedule_wakeup` — [`../workflows/schedule-wakeup-loop.md`](../workflows/schedule-wakeup-loop.md)
+- `portable` — [`../../_shared/pr-loop/portable-driver.md`](../../_shared/pr-loop/portable-driver.md)
+
+See [Pacing workflow](#pacing-workflow).
 
 Every BUGTEAM tick runs **bugteam** — never hand-rolled substitute. Fix
-protocol per [fix-protocol.md](fix-protocol.md). Pacing stays in main session via
-`ScheduleWakeup` (pre-flight aborts when absent).
+protocol per [fix-protocol.md](fix-protocol.md). Pacing stays in the main
+session (native `ScheduleWakeup` or the portable continuous driver).
 
 ## Invocation modes
 
-- **`/pr-converge`** runs one tick, then Step 4 schedules the next via
-  `ScheduleWakeup`. Omit the next wakeup only on convergence or **Stop
-  conditions**.
+- **`/pr-converge` with `pacer=schedule_wakeup`** runs one tick, then Step 4
+  schedules the next via `ScheduleWakeup`. Omit the next wakeup only on
+  convergence or **Stop conditions**.
+- **`/pr-converge` with `pacer=portable`** runs ticks continuously in-session
+  (poll waits at the same delays); write handoff at budget boundaries. See
+  the portable driver.
 
 ## Pacing workflow
 
-Read [`../workflows/schedule-wakeup-loop.md`](../workflows/schedule-wakeup-loop.md)
+When `pacer=schedule_wakeup`, read
+[`../workflows/schedule-wakeup-loop.md`](../workflows/schedule-wakeup-loop.md)
 (installed copy under `$HOME/.claude/skills/pr-converge/workflows/`) before
-Step 4. The pre-flight gate guarantees `ScheduleWakeup` is invokable; the
-workflow file specifies delays, prompts, and convergence cleanup.
+Step 4. When `pacer=portable`, read
+[`../../_shared/pr-loop/portable-driver.md`](../../_shared/pr-loop/portable-driver.md)
+and skip `ScheduleWakeup` calls.
 
 - **`/pr-converge`** (default): loops until convergence. After each tick
-  (unless converged or stopped), run **Step 4**.
+  (unless converged or stopped), run **Step 4** using the selected pacer.
 
 ## Step 1: Resolve current HEAD and PR context
 
@@ -244,8 +253,8 @@ c. Decide (three branches; match first whose predicate holds):
 
    - **Failed review (`returncode != 0`, or chain mode with null
      `served_command`):** The review did not complete a successful serve. Do
-     not set `code_review_clean_at`. Stay `phase = CODE_REVIEW`, schedule next
-     wakeup, return. A failed chain often leaves `dirty_tree` false — that is
+     not set `code_review_clean_at`. Stay `phase = CODE_REVIEW`, apply Step 4 pacer
+     (ScheduleWakeup or portable continue/poll), return. A failed chain often leaves `dirty_tree` false — that is
      not a clean stamp.
    - **Fixes applied (working tree dirty / `dirty_tree` true):** Commit the
      applied fixes in one commit → push, following the shared fix protocol
@@ -253,7 +262,7 @@ c. Decide (three branches; match first whose predicate holds):
      push-invalidated markers per [ground-rules.md](ground-rules.md) /
      [state-schema.md](state-schema.md) (all `*_clean_at`, `merge_state_status`,
      `bugbot_down`, `bugbot_acknowledged_at`, `codex_down`). Stay
-     `phase = CODE_REVIEW`, schedule next wakeup, return. Every fix push
+     `phase = CODE_REVIEW`, apply Step 4 pacer (ScheduleWakeup or portable continue/poll), return. Every fix push
      re-enters the internal passes on the new HEAD.
    - **Clean (successful serve: `returncode == 0`, chain `served_command`
      non-null when `mode == chain`, and `dirty_tree` false):** Set
@@ -318,7 +327,7 @@ d. Decide based on post-bugteam state — order matters. Check
 pushed-during-bugteam FIRST so a convergence report against a stale HEAD
 never falsely terminates:
    - **Audit pushed this tick (clean-at fields reset in step b):**
-     `phase = CODE_REVIEW`, schedule next wakeup, return. Every fix push
+     `phase = CODE_REVIEW`, apply Step 4 pacer (ScheduleWakeup or portable continue/poll), return. Every fix push
      re-enters the internal passes on the new HEAD.
    - **Convergence AND no push:** the internal passes are clean on
      `current_head`. Stamp `bugteam_clean_at = current_head`, then
@@ -328,8 +337,8 @@ never falsely terminates:
      ([`../../../_shared/pr-loop/fix-protocol.md`](../../../_shared/pr-loop/fix-protocol.md); skill deltas in [fix-protocol.md](fix-protocol.md)). Reset push-invalidated markers
      per [ground-rules.md](ground-rules.md) / [state-schema.md](state-schema.md)
      (all `*_clean_at`, `merge_state_status`, `bugbot_down`,
-     `bugbot_acknowledged_at`, `codex_down`), `phase = CODE_REVIEW`, schedule
-     next wakeup, return.
+     `bugbot_acknowledged_at`, `codex_down`), `phase = CODE_REVIEW`, apply Step 4 pacer
+     (ScheduleWakeup or portable continue/poll), return.
 
 ### `phase == BUGBOT` (terminal gate)
 
@@ -386,7 +395,7 @@ pull_request_read(owner=OWNER, repo=REPO, pullNumber=NUMBER, method="get_review_
 c. Decide (four branches; match first whose predicate holds):
    - **No bugbot review yet, OR latest review's `commit_id` ≠
      `current_head`:** Re-trigger bugbot (Step 3), set `bugbot_clean_at =
-     null`, reset `inline_lag_streak = 0`, schedule next wakeup, return to the
+     null`, reset `inline_lag_streak = 0`, apply Step 4 pacer (ScheduleWakeup or portable continue/poll), return to the
      Bugbot gate next tick.
    - **`commit_id == current_head` AND zero unaddressed inline AND review
      body clean:** Set `bugbot_clean_at = current_head`, reset
@@ -402,7 +411,7 @@ c. Decide (four branches; match first whose predicate holds):
      `state.json`: the clean-coder teammate executes the fix, writes
      `state.json`, goes idle; the next tick re-enters CODE_REVIEW on the new
      HEAD. No `state.json` (single-PR): the lead executes it, stays
-     `phase = CODE_REVIEW`. Schedule next wakeup, return.
+     `phase = CODE_REVIEW`. Apply Step 4 pacer (ScheduleWakeup or portable continue/poll), return.
 
 ### `phase == COPILOT_WAIT`
 
@@ -435,12 +444,12 @@ b. Decide (three branches; match first whose predicate holds):
      (all `*_clean_at`, `merge_state_status`, `bugbot_down`,
      `bugbot_acknowledged_at`, `codex_down`). **Set `phase = CODE_REVIEW`**
      (NOT COPILOT_WAIT) — every fix push re-enters the internal passes on the
-     new HEAD. Schedule next wakeup, return.
+     new HEAD. Apply Step 4 pacer (ScheduleWakeup or portable continue/poll), return.
    - **No Copilot review at `current_head` yet:** Increment
      `copilot_wait_count` (init 0 on COPILOT_WAIT entry; reset to 0 on
      every push and on every successful Copilot review). `>= 3` → hard
      blocker per [stop-conditions.md](stop-conditions.md). Otherwise
-     schedule next wakeup (360s), return.
+     apply Step 4 pacer (ScheduleWakeup or portable continue/poll; 360s wait), return.
 
 **Non-negotiable:** After any Copilot fix push, `phase` MUST route to
 `CODE_REVIEW`. Never cycle COPILOT_WAIT → fix → COPILOT_WAIT. The
@@ -508,8 +517,11 @@ base), never an invented commit range.
 
 ## Step 4: Loop pacing
 
-**`ScheduleWakeup` field hints** (prefer [Pacing
-workflow](#pacing-workflow)):
+Apply the pacer selected at pre-flight ([Pacing workflow](#pacing-workflow)).
+
+### `pacer=schedule_wakeup`
+
+**`ScheduleWakeup` field hints:**
 
 - `delaySeconds: 360` after bugbot re-trigger. Exception:
   BUGBOT inline-lag branch uses `delaySeconds: 90` (no re-trigger;
@@ -521,6 +533,21 @@ workflow](#pacing-workflow)):
 **On convergence:** apply **Convergence** section of
 `../workflows/schedule-wakeup-loop.md` (omit wakeups).
 
+### `pacer=portable`
+
+Do **not** call `ScheduleWakeup`. After writing state and handoff:
+
+- **Immediate work next** → continue the next tick in the same turn.
+- **Wait next** (Bugbot queued, COPILOT_WAIT with no review yet) → poll
+  in-session for the same delay (`360` default, `90` on Bugbot inline-lag),
+  then resume the same step. Honor the same hard caps as the ScheduleWakeup
+  path.
+- **Budget too low for a full tick** → stop at the tick boundary; print
+  `/pr-converge <PR URL>` and the persisted phase.
+
+Full portable rules:
+[`../../_shared/pr-loop/portable-driver.md`](../../_shared/pr-loop/portable-driver.md).
+
 ## Bugteam execution
 
 **Second audit** (BUGTEAM phase) is **always** **bugteam** skill: preflight,

package/skills/pr-converge/test_portable_pacer_gate.py

@@ -0,0 +1,67 @@
+"""Contract checks: pr-converge selects a portable pacer when ScheduleWakeup is absent."""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+SKILL_ROOT = Path(__file__).resolve().parent
+SKILL_MARKDOWN_PATH = SKILL_ROOT / "SKILL.md"
+PER_TICK_MARKDOWN_PATH = SKILL_ROOT / "reference" / "per-tick.md"
+PORTABLE_DRIVER_PATH = (
+    SKILL_ROOT.parent / "_shared" / "pr-loop" / "portable-driver.md"
+)
+
+SELECT_CONVERGE_PACER_SCRIPT = "select_converge_pacer.py"
+PACER_PORTABLE_TOKEN = "pacer=portable"
+PACER_SCHEDULE_WAKEUP_TOKEN = "pacer=schedule_wakeup"
+ABORT_ONLY_PHRASE = "pr-converge requires ScheduleWakeup; aborting"
+PORTABLE_DRIVER_DOC = "portable-driver.md"
+PORTABLE_DRIVER_LINK_PATTERN = re.compile(
+    r"\((?P<relative>(?:\.\./)+_shared/pr-loop/portable-driver\.md)\)"
+)
+
+
+def test_skill_selects_pacer_and_forbids_abort_only_schedule_wakeup() -> None:
+    skill_text = SKILL_MARKDOWN_PATH.read_text(encoding="utf-8")
+    assert SELECT_CONVERGE_PACER_SCRIPT in skill_text
+    assert PACER_PORTABLE_TOKEN in skill_text
+    assert PACER_SCHEDULE_WAKEUP_TOKEN in skill_text
+    assert PORTABLE_DRIVER_DOC in skill_text
+    assert ABORT_ONLY_PHRASE not in skill_text
+
+
+def test_skill_portable_driver_links_resolve_on_disk() -> None:
+    skill_text = SKILL_MARKDOWN_PATH.read_text(encoding="utf-8")
+    all_relative_links = PORTABLE_DRIVER_LINK_PATTERN.findall(skill_text)
+    assert all_relative_links, "SKILL.md must link portable-driver.md"
+    for each_relative_link in all_relative_links:
+        resolved_path = (SKILL_MARKDOWN_PATH.parent / each_relative_link).resolve()
+        assert resolved_path.is_file(), (
+            f"portable-driver link must resolve on disk: "
+            f"{each_relative_link} -> {resolved_path}"
+        )
+        assert resolved_path == PORTABLE_DRIVER_PATH.resolve()
+
+
+def test_per_tick_documents_both_pacers() -> None:
+    per_tick_text = PER_TICK_MARKDOWN_PATH.read_text(encoding="utf-8")
+    assert "portable" in per_tick_text
+    assert "schedule_wakeup" in per_tick_text or "ScheduleWakeup" in per_tick_text
+    assert PORTABLE_DRIVER_DOC in per_tick_text
+    assert "pacer=portable" in per_tick_text
+    assert "Do **not** call `ScheduleWakeup`" in per_tick_text or (
+        "Do not call `ScheduleWakeup`" in per_tick_text
+    )
+
+
+def test_portable_driver_protocol_exists() -> None:
+    assert PORTABLE_DRIVER_PATH.is_file()
+    portable_text = PORTABLE_DRIVER_PATH.read_text(encoding="utf-8")
+    assert "check_convergence.py" in portable_text
+    assert "invoke_code_review.py" in portable_text
+    assert "resolve_worker_spawn.py" in portable_text
+    assert "build_converge_task_list.py" in portable_text
+    assert "all_runnable_reviews_clean_same_head" in portable_text
+    assert "portable_converge_driver.py" in portable_text
+    assert "Never abort solely because" in portable_text

package/skills/pr-converge/workflows/schedule-wakeup-loop.md

@@ -1,8 +1,10 @@
 # ScheduleWakeup loop pacing (pr-converge)
 
-Load this document for converge **loop pacing**. The pre-flight in `SKILL.md`
-guarantees `ScheduleWakeup` is available before any tick runs. Shared bugbot
-/ bugteam / Fix protocol steps stay in the main `SKILL.md`.
+Load this document when pre-flight selects `pacer=schedule_wakeup`. When
+`pacer=portable`, use
+[`../../_shared/pr-loop/portable-driver.md`](../../_shared/pr-loop/portable-driver.md)
+instead. Shared bugbot / bugteam / Fix protocol steps stay in the main
+`SKILL.md`.
 
 ## Calling ScheduleWakeup
 

package/skills/usage-pause/SKILL.md

@@ -41,10 +41,10 @@ On exit 2 the script prints `{"error": ...}`. Ask the user for a manual reset ti
 
 `scripts/resolve_usage_window.py` is the source of truth for live probe behavior. Endpoint URL, header names/values, credential path and token keys, response bucket keys, stage sizing, and the weekly warn threshold all live in `scripts/usage_pause_constants/resolve_usage_window_constants.py` — read those modules for the current values; do not restate them here.
 
-In short: the resolver picks a bearer token, probes the OAuth usage endpoint the interactive `/usage` panel uses, and returns the session and weekly buckets with utilization and reset times. Token sources, in order:
+In short: the resolver picks a bearer token, probes the OAuth usage endpoint the interactive `/usage` panel uses, and returns the session and weekly buckets with utilization and reset times. Token sources depend on the host:
 
-1. The Claude Code CLI's stored OAuth access token (honored only while unexpired).
-2. The session ingress bearer token file named by `CLAUDE_SESSION_INGRESS_TOKEN_FILE` (cloud sessions).
+- **Desktop host** (the `CLAUDE_CODE_ENTRYPOINT` variable is `claude-desktop`): the resolver does not read the CLI credential file, which belongs to a different authentication session than the one the desktop app counts usage against. It uses the session ingress token when one is set, and otherwise takes the manual-override path.
+- **Every other host**: the resolver reads the Claude Code CLI's stored OAuth access token first (honored only while unexpired), then the session ingress bearer token file named by `CLAUDE_SESSION_INGRESS_TOKEN_FILE` (cloud sessions) when the credential token is unavailable.
 
 Fallbacks, in order: both token sources unavailable (expired/unreadable credential and no ingress file), a failed request, or a response with no readable session-window reset time all end in exit 2 — the manual-override ask above. The manual path works with no probe at all, so the skill functions even when both token sources are unavailable.
 
@@ -106,8 +106,9 @@ Fill each `<slot>` at schedule time: `<remaining_stage_durations>` is the tail o
 | `SKILL.md` | This flow: resolve, weekly guard, stage chain, templates |
 | `scripts/resolve_usage_window.py` | The window resolver and stage planner CLI |
 | `scripts/test_resolve_usage_window.py` | Behavioral tests for parsing, staging, token reading, extraction, CLI |
-| `scripts/usage_pause_constants/resolve_usage_window_constants.py` | Endpoint, credential keys, stage sizing, thresholds, result keys |
+| `scripts/usage_pause_constants/resolve_usage_window_constants.py` | Endpoint, credential keys, host detection, stage sizing, thresholds, result keys |
 
 ## Gotchas
 
 - The stored access token lives about 8 hours and the CLI rewrites it on its own schedule, so a mid-afternoon probe can find it expired even while the CLI itself still works. That is the designed exit-2 path: give a manual time.
+- On the desktop host the resolver never reads the CLI credential file, because that credential is a different authentication session than the one the desktop app counts usage against. With no session ingress token set, the desktop host takes the manual path: read the reset time from the interactive `/usage` panel and pass it, for example `/usage-pause 10:20pm`.

package/skills/usage-pause/scripts/resolve_usage_window.py

@@ -7,11 +7,13 @@
     {"source": "override", "reset_at": "2026-07-08T10:14:00-07:00",
      "seconds_until_reset": 4440, "stages_seconds": [3480, 960, 120], ...}
 
-With no ``--override``, the script resolves a bearer token: the Claude Code
-OAuth access token from the CLI credential file, or the session ingress token
-file when that credential is unavailable. It asks the OAuth usage endpoint for the
-``five_hour`` and ``seven_day`` windows. Exit code 2 means the probe cannot
-resolve; the caller then asks the user for a manual reset time.
+With no ``--override``, the script resolves a bearer token. On the desktop
+host it uses only the session ingress token. On every other host it reads the
+Claude Code OAuth access token from the CLI credential file, then the session
+ingress token file when that credential is unavailable. It asks the OAuth
+usage endpoint for the ``five_hour`` and ``seven_day`` windows. Exit code 2
+means the probe cannot resolve; the caller then asks the user for a manual
+reset time.
 """
 
 from __future__ import annotations
@@ -41,7 +43,9 @@ from usage_pause_constants.resolve_usage_window_constants import (
     CREDENTIALS_ACCESS_TOKEN_KEY,
     CREDENTIALS_EXPIRES_AT_KEY,
     CREDENTIALS_OAUTH_SECTION_KEY,
+    DESKTOP_ENTRYPOINT_VALUE,
     DURATION_PATTERN,
+    ENTRYPOINT_ENV_VAR,
     EPOCH_MILLISECONDS_THRESHOLD,
     EXIT_CODE_PROBE_UNAVAILABLE,
     EXIT_CODE_RESOLVED,
@@ -267,14 +271,36 @@ def read_session_ingress_token() -> str | None:
     return token_text
 
 
+def running_on_desktop_host() -> bool:
+    """Tell whether this process runs under the Claude desktop app.
+
+    ::
+
+        entrypoint is the desktop marker  ->  True
+        entrypoint is the CLI or unset    ->  False
+
+    The desktop app meters its session under a different auth session than
+    the CLI credential file, so a true answer tells the resolver to leave
+    that credential file alone.
+
+    Returns:
+        True when the entrypoint environment variable names the desktop app.
+    """
+    return os.environ.get(ENTRYPOINT_ENV_VAR) == DESKTOP_ENTRYPOINT_VALUE
+
+
 def resolve_access_token(credentials_path: Path, now: datetime) -> str | None:
     """Choose the usage-endpoint bearer token from its available sources.
 
     ::
 
-        credential file token valid   ->  the credential token
-        credential token unavailable  ->  the session ingress token
-        neither source available      ->  None
+        CLI host, credential token valid        ->  the credential token
+        CLI host, credential token unavailable   ->  the session ingress token
+        desktop host                             ->  the session ingress token
+        no source available                      ->  None
+
+    On the desktop host the CLI credential file belongs to a different auth
+    session, so it is skipped and only the session ingress token is honored.
 
     Args:
         credentials_path: The CLI credential file holding the OAuth section.
@@ -283,6 +309,8 @@ def resolve_access_token(credentials_path: Path, now: datetime) -> str | None:
     Returns:
         The bearer token for the usage endpoint, or None when no source has one.
     """
+    if running_on_desktop_host():
+        return read_session_ingress_token()
     credential_token = read_oauth_access_token(credentials_path, now)
     return credential_token or read_session_ingress_token()
 
@@ -447,6 +475,37 @@ def _describe_ingress_token_source() -> str:
     return f"the session ingress token file ({SESSION_INGRESS_TOKEN_FILE_ENV_VAR} set but empty)"
 
 
+def _no_token_error_message(credentials_path: Path) -> str:
+    """Build the no-usable-token exit-2 error, host-aware for the desktop app.
+
+    ::
+
+        desktop host  ->  names the different-session skip and the /usage remedy
+        other host    ->  names the credential path and the ingress source tried
+
+    On the desktop host the CLI credential file is never read, so the message
+    points the user at the interactive /usage panel for a manual reset time.
+
+    Args:
+        credentials_path: The CLI credential file the non-desktop message names.
+
+    Returns:
+        The error text for the no-usable-token exit-2 path.
+    """
+    if running_on_desktop_host():
+        return (
+            "on the desktop host the CLI credential file belongs to a different "
+            f"auth session and is not read, and {_describe_ingress_token_source()} "
+            "has no token; read the reset time from the interactive /usage panel "
+            "and give it manually, for example /usage-pause 10:20pm or /usage-pause 74m"
+        )
+    return (
+        "no usable bearer token from the OAuth credential file at "
+        f"{credentials_path} or {_describe_ingress_token_source()}; give a "
+        "manual reset time, for example /usage-pause 10:20pm or /usage-pause 74m"
+    )
+
+
 def _parse_arguments() -> argparse.Namespace:
     parser = argparse.ArgumentParser(
         description="Resolve the 5-hour usage window reset and plan the pause stage chain.",
@@ -503,11 +562,7 @@ def main() -> int:
     )
     access_token = resolve_access_token(credentials_path, now)
     if access_token is None:
-        return _emit_error(
-            "no usable bearer token from the OAuth credential file at "
-            f"{credentials_path} or {_describe_ingress_token_source()}; give a "
-            "manual reset time, for example /usage-pause 10:20pm or /usage-pause 74m"
-        )
+        return _emit_error(_no_token_error_message(credentials_path))
     try:
         usage_payload = _fetch_usage_payload(access_token)
     except (

package/skills/usage-pause/scripts/test_resolve_usage_window.py

@@ -18,7 +18,9 @@ SCRIPTS_DIRECTORY = Path(__file__).resolve().parent
 if str(SCRIPTS_DIRECTORY) not in sys.path:
     sys.path.insert(0, str(SCRIPTS_DIRECTORY))
 
-from usage_pause_constants.resolve_usage_window_constants import (
+from usage_pause_constants.resolve_usage_window_constants import (  # noqa: E402
+    DESKTOP_ENTRYPOINT_VALUE,
+    ENTRYPOINT_ENV_VAR,
     SESSION_INGRESS_TOKEN_FILE_ENV_VAR as INGRESS_TOKEN_FILE_ENV_VAR,
 )
 
@@ -188,8 +190,7 @@ class TestReadOauthAccessToken:
         credentials_path.write_text("{not valid json", encoding="utf-8")
         with caplog.at_level(logging.WARNING):
             assert (
-                resolver.read_oauth_access_token(credentials_path, local_now())
-                is None
+                resolver.read_oauth_access_token(credentials_path, local_now()) is None
             )
         assert any("unreadable" in each_message for each_message in caplog.messages)
 
@@ -240,7 +241,43 @@ class TestReadSessionIngressToken:
         assert INGRESS_TOKEN_FILE_ENV_VAR == "CLAUDE_SESSION_INGRESS_TOKEN_FILE"
 
 
+class TestRunningOnDesktopHost:
+    def should_be_true_when_entrypoint_names_the_desktop_app(
+        self, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        resolver = load_resolver_module()
+        monkeypatch.setenv(ENTRYPOINT_ENV_VAR, DESKTOP_ENTRYPOINT_VALUE)
+        assert resolver.running_on_desktop_host() is True
+
+    def should_be_false_when_entrypoint_names_a_non_desktop_host(
+        self, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        resolver = load_resolver_module()
+        monkeypatch.setenv(ENTRYPOINT_ENV_VAR, "cli")
+        assert resolver.running_on_desktop_host() is False
+
+    def should_be_false_when_entrypoint_is_unset(
+        self, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        resolver = load_resolver_module()
+        monkeypatch.delenv(ENTRYPOINT_ENV_VAR, raising=False)
+        assert resolver.running_on_desktop_host() is False
+
+    def should_pin_the_desktop_entrypoint_contract_to_the_literal_marker(
+        self, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        resolver = load_resolver_module()
+        monkeypatch.setenv("CLAUDE_CODE_ENTRYPOINT", "claude-desktop")
+        assert resolver.running_on_desktop_host() is True
+        assert ENTRYPOINT_ENV_VAR == "CLAUDE_CODE_ENTRYPOINT"
+        assert DESKTOP_ENTRYPOINT_VALUE == "claude-desktop"
+
+
 class TestResolveAccessToken:
+    @pytest.fixture(autouse=True)
+    def force_non_desktop_host(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.delenv(ENTRYPOINT_ENV_VAR, raising=False)
+
     def should_use_ingress_token_when_credential_file_missing(
         self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
     ) -> None:
@@ -295,6 +332,57 @@ class TestResolveAccessToken:
         assert resolver.resolve_access_token(missing_credentials, local_now()) is None
 
 
+class TestResolveAccessTokenHostAware:
+    def should_ignore_a_valid_cli_credential_token_on_the_desktop_host(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        resolver = load_resolver_module()
+        now = local_now()
+        credentials_path = tmp_path / ".credentials.json"
+        future_milliseconds = int((now + timedelta(hours=1)).timestamp() * 1000)
+        write_credentials(
+            credentials_path, future_milliseconds, access_token="cli-credential-token"
+        )
+        monkeypatch.setenv(ENTRYPOINT_ENV_VAR, DESKTOP_ENTRYPOINT_VALUE)
+        monkeypatch.delenv(INGRESS_TOKEN_FILE_ENV_VAR, raising=False)
+        chosen_token = resolver.resolve_access_token(credentials_path, now)
+        assert chosen_token != "cli-credential-token"
+        assert chosen_token is None
+
+    def should_use_the_ingress_token_over_the_cli_credential_on_the_desktop_host(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        resolver = load_resolver_module()
+        now = local_now()
+        credentials_path = tmp_path / ".credentials.json"
+        future_milliseconds = int((now + timedelta(hours=1)).timestamp() * 1000)
+        write_credentials(
+            credentials_path, future_milliseconds, access_token="cli-credential-token"
+        )
+        token_file = tmp_path / "ingress-token"
+        token_file.write_text("ingress-token-value", encoding="utf-8")
+        monkeypatch.setenv(ENTRYPOINT_ENV_VAR, DESKTOP_ENTRYPOINT_VALUE)
+        monkeypatch.setenv(INGRESS_TOKEN_FILE_ENV_VAR, str(token_file))
+        chosen_token = resolver.resolve_access_token(credentials_path, now)
+        assert chosen_token == "ingress-token-value"
+        assert chosen_token != "cli-credential-token"
+
+    def should_return_the_cli_credential_token_on_a_non_desktop_host(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        resolver = load_resolver_module()
+        now = local_now()
+        credentials_path = tmp_path / ".credentials.json"
+        future_milliseconds = int((now + timedelta(hours=1)).timestamp() * 1000)
+        write_credentials(
+            credentials_path, future_milliseconds, access_token="cli-credential-token"
+        )
+        monkeypatch.setenv(ENTRYPOINT_ENV_VAR, "cli")
+        monkeypatch.delenv(INGRESS_TOKEN_FILE_ENV_VAR, raising=False)
+        chosen_token = resolver.resolve_access_token(credentials_path, now)
+        assert chosen_token == "cli-credential-token"
+
+
 class TestExtractUsageWindows:
     def should_extract_session_and_weekly_buckets(self) -> None:
         resolver = load_resolver_module()
@@ -361,13 +449,20 @@ class TestBuildPausePlan:
 
 class TestCommandLine:
     def run_resolver(
-        self, *arguments: str, ingress_token_file: str | None = None
+        self,
+        *arguments: str,
+        ingress_token_file: str | None = None,
+        entrypoint: str | None = None,
     ) -> subprocess.CompletedProcess[str]:
         child_environment = dict(os.environ)
         if ingress_token_file is None:
             child_environment.pop(INGRESS_TOKEN_FILE_ENV_VAR, None)
         else:
             child_environment[INGRESS_TOKEN_FILE_ENV_VAR] = ingress_token_file
+        if entrypoint is None:
+            child_environment.pop(ENTRYPOINT_ENV_VAR, None)
+        else:
+            child_environment[ENTRYPOINT_ENV_VAR] = entrypoint
         return subprocess.run(
             [sys.executable, str(RESOLVER_PATH), *arguments],
             capture_output=True,
@@ -403,9 +498,7 @@ class TestCommandLine:
         assert str(missing_path) in resolved_payload["error"]
         assert f"{INGRESS_TOKEN_FILE_ENV_VAR} unset" in resolved_payload["error"]
 
-    def should_name_the_ingress_token_path_in_the_error(
-        self, tmp_path: Path
-    ) -> None:
+    def should_name_the_ingress_token_path_in_the_error(self, tmp_path: Path) -> None:
         missing_credentials = tmp_path / "absent.json"
         stale_ingress = tmp_path / "stale-ingress-token"
         completed = self.run_resolver(
@@ -429,10 +522,29 @@ class TestCommandLine:
         assert completed.returncode == 2
         resolved_payload = json.loads(completed.stdout)
         assert (
-            f"{INGRESS_TOKEN_FILE_ENV_VAR} set but empty"
-            in resolved_payload["error"]
+            f"{INGRESS_TOKEN_FILE_ENV_VAR} set but empty" in resolved_payload["error"]
         )
 
+    def should_exit_two_with_a_host_aware_error_on_the_desktop_host(
+        self, tmp_path: Path
+    ) -> None:
+        credentials_path = tmp_path / ".credentials.json"
+        future_milliseconds = int((local_now() + timedelta(hours=1)).timestamp() * 1000)
+        write_credentials(
+            credentials_path, future_milliseconds, access_token="cli-credential-token"
+        )
+        completed = self.run_resolver(
+            "--credentials-path",
+            str(credentials_path),
+            entrypoint="claude-desktop",
+        )
+        assert completed.returncode == 2
+        assert "cli-credential-token" not in completed.stdout
+        error_text = json.loads(completed.stdout)["error"]
+        assert "different auth session" in error_text
+        assert "/usage" in error_text
+        assert "/usage-pause" in error_text
+
     def should_reject_invalid_override_with_error_payload(self) -> None:
         completed = self.run_resolver("--override", "soon")
         assert completed.returncode == 2

package/skills/usage-pause/scripts/usage_pause_constants/resolve_usage_window_constants.py

@@ -1,9 +1,10 @@
 """Constants for the usage-window resolver.
 
 Groups: the OAuth usage-endpoint probe, the CLI credential file keys, the
-session ingress token file environment variable, the usage-response field
-keys, the override parse patterns, the wakeup stage sizing, the weekly warn
-threshold, the result JSON keys, the source labels, and the exit codes.
+session ingress token file environment variable, the host entrypoint
+detection, the usage-response field keys, the override parse patterns, the
+wakeup stage sizing, the weekly warn threshold, the result JSON keys, the
+source labels, and the exit codes.
 """
 
 from __future__ import annotations
@@ -24,6 +25,9 @@ CREDENTIALS_EXPIRES_AT_KEY = "expiresAt"
 SESSION_INGRESS_TOKEN_FILE_ENV_VAR = "CLAUDE_SESSION_INGRESS_TOKEN_FILE"
 MILLISECONDS_PER_SECOND = 1000
 
+ENTRYPOINT_ENV_VAR = "CLAUDE_CODE_ENTRYPOINT"
+DESKTOP_ENTRYPOINT_VALUE = "claude-desktop"
+
 FIVE_HOUR_BUCKET_KEY = "five_hour"
 SEVEN_DAY_BUCKET_KEY = "seven_day"
 UTILIZATION_KEY = "utilization"