mtech-ai-local-runner 0.1.102 → 0.1.104

package/README.md

@@ -1,3 +1,17 @@
+## 0.1.104: the token prompt is hidden
+
+`setup --claude-token` no longer prints the pasted token. If you used it on 0.1.103, revoke that token and store a
+fresh one. Released in 0.1.104; its Local Fix receipt must be listed on the Gateway before a runner on it prepares a
+Local Fix.
+
+## 0.1.103: Claude logs in with the runner's own token
+
+Run `npx mtech-ai-local-runner@latest setup --claude-token` once and paste the token from `claude setup-token`. Local
+Claude then logs in with that token and never asks macOS for the shared Claude login, so no Keychain dialog appears
+(Work Item ab3dcddb). `setup --claude-token-reset` removes it. Without a token, Local Claude works as before.
+
+Released in 0.1.103. Its Local Fix receipt must be listed on the Gateway before a runner on it prepares a Local Fix.
+
 ## 0.1.102: provider tool activity is not verification
 
 Claude Bash and tool results now appear as bounded activity. A test result is trusted only when the Runner host supplies its verification receipt; Codex and Claude use the same boundary (Work Item 7a22026b, PR #878). The event protocol and existing Work Loop authority are unchanged.

package/dist/src/adapters/claude-code/adapter.js

@@ -1,3 +1,4 @@
+import { CLAUDE_TOKEN_FD, CLAUDE_TOKEN_FD_ENV, pathWithKeychainStub } from "../../safety/claude-runner-token.js";
 import path from "node:path";
 import { requireSecurityRequirements } from '../../safety/security-requirements.js';
 import { CLAUDE_LAUNCH_OPT_OUTS, CLAUDE_RELEASE_MODE, CLAUDE_TRANSPORT, claudeCanonicalSha256 } from '../../safety/claude-release.js';
@@ -64,8 +65,9 @@ export function claudeLaunchSettings(hookCommand) {
     return { hooks: { PreToolUse: [{ matcher: "*", hooks: [{ type: "command", command: hookCommand }] }] } };
 }
 /** The allowlisted environment, the documented opt-outs and the encoded hook policy; nothing else of the runner's environment reaches the CLI. */
-export function claudeLaunchEnv(env, hookPolicy) {
-    return { ...allowlistedEnv(env), ...CLAUDE_LAUNCH_OPT_OUTS, [HOOK_POLICY_ENV_VAR]: encodeHookPolicy(hookPolicy) };
+export function claudeLaunchEnv(env, hookPolicy, runnerToken = false) {
+    return { ...allowlistedEnv(env), ...CLAUDE_LAUNCH_OPT_OUTS, [HOOK_POLICY_ENV_VAR]: encodeHookPolicy(hookPolicy),
+        ...(runnerToken ? { [CLAUDE_TOKEN_FD_ENV]: CLAUDE_TOKEN_FD } : {}) };
 }
 /** The one stream-json user message line written to the CLI's stdin. */
 export function claudeUserInput(text) {
@@ -201,7 +203,13 @@ export class ClaudeCodeAdapter {
                 resumeSessionId: ctx.resumeSessionId,
                 toolInventory,
             });
-            const env = claudeLaunchEnv(this.options.env, hookPolicy);
+            const claudeToken = await this.options.claudeToken?.() ?? null;
+            const env = claudeLaunchEnv(this.options.env, hookPolicy, claudeToken !== null);
+            if (claudeToken !== null) {
+                if (!this.options.keychainStub)
+                    throw new Error("CLAUDE_KEYCHAIN_STUB_UNAVAILABLE");
+                env.PATH = pathWithKeychainStub(await this.options.keychainStub(), env.PATH);
+            }
             await this.options.assertCurrentInputs?.();
             if (this.cancelled)
                 throw new Error('adapter startup cancelled');
@@ -209,6 +217,7 @@ export class ClaudeCodeAdapter {
             const handle = this.options.processHost.spawn(this.options.binaryPath ?? "claude", args, {
                 cwd,
                 env,
+                ...(claudeToken === null ? {} : { secretFd3: claudeToken }),
             });
             this.handle = handle;
             if (this.cancelled)

package/dist/src/adapters/claude-code/runtime-options.js

@@ -1,3 +1,4 @@
+import { ClaudeRunnerTokenStore, ensureClaudeKeychainStub } from '../../safety/claude-runner-token.js';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { mkdir, realpath, rm } from 'node:fs/promises';
@@ -68,8 +69,9 @@ export function createClaudeCodeAdapterOptions(input) {
     env.TMPDIR = path.join(control, 'tmp');
     if (env.CLAUDE_CONFIG_DIR && !path.isAbsolute(env.CLAUDE_CONFIG_DIR))
         throw new Error('Claude account configuration path must be absolute');
+    const tokenStore = new ClaudeRunnerTokenStore({ stateRoot: state });
     return {
-        processHost: new NodeProcessGroupHost(), worktreeRoot: checkout, jobId: input.jobId, get securityPolicy() { return securityPolicy; },
+        processHost: new NodeProcessGroupHost(), worktreeRoot: checkout, jobId: input.jobId, claudeToken: () => tokenStore.load(), keychainStub: () => ensureClaudeKeychainStub(state), get securityPolicy() { return securityPolicy; },
         ...(input.securityHost ? { prepareSecurity: async (ctx) => {
                 try {
                     if (disposed || !ctx.securityBinding || !account)

package/dist/src/cli.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { runClaudeTokenCommand } from "./commands/claude-token.js";
 import { adapterStatus } from './adapters/status.js';
 import { recoverLocalFixPublication } from './publication/recovery.js';
 import { loadInstalledLocalFixHost } from './publication/installed-host.js';
@@ -240,6 +241,11 @@ export async function main(argv, env, io = {}) {
             if (config.mode === "setup") {
                 if (process.platform !== "darwin")
                     throw new Error("Local runner daemon setup requires macOS");
+                const tokenResult = await runClaudeTokenCommand({ argv: argv.slice(1), stateRoot: config.stateRoot });
+                if (tokenResult) {
+                    stdout(JSON.stringify(tokenResult));
+                    return 0;
+                }
                 const requestedIntegrations = parseSetupIntegrations(argv.slice(1));
                 if (requestedIntegrations === null)
                     throw new Error("--integrations takes claude, codex or claude,codex");

package/dist/src/commands/claude-release.js

@@ -5,11 +5,14 @@ import { lstat, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { packagedHookCommandParts } from '../safety/hook-command.js';
 import { measureCommandFile } from '../safety/registered-command-integrity.js';
 import { hostClaudePlatform, parseClaudeSyncRelease } from '../safety/claude-release.js';
-import { privateDirectory, verifyClaudeCodeSignature } from '../safety/claude-release-copy.js';
+import { privateDirectory, verifyClaudeCodeSignature, verifyClaudeReleaseCopy } from '../safety/claude-release-copy.js';
+import { claudeProbeEnv, claudeTokenAuthStatus } from '../safety/claude-production-host.js';
+import { ClaudeRunnerTokenStore, ensureClaudeKeychainStub, pathWithKeychainStub } from '../safety/claude-runner-token.js';
 import { fetchClaudeReleaseForReview } from '../safety/claude-review-fetch.js';
 import { runClaudeReviewCampaign } from '../safety/claude-review-campaign.js';
-import { CLAUDE_AUTH_OBSERVATION_MAX_BYTES, CLAUDE_REVIEW_EVIDENCE_FILE, claudeReleaseCandidate, claudeReviewEvidenceSha256, parseClaudeAuthObservation } from '../safety/claude-review-evidence.js';
+import { CLAUDE_AUTH_OBSERVATION_MAX_BYTES, CLAUDE_AUTH_OBSERVATION_VERSION, CLAUDE_REVIEW_EVIDENCE_FILE, claudeReleaseCandidate, claudeReviewEvidenceSha256, parseClaudeAuthObservation } from '../safety/claude-review-evidence.js';
 export const CLAUDE_RELEASE_USAGE = 'Usage: mtec-ai-local-runner claude-release fetch --version <version> --platform <darwin-arm64|darwin-x64> --out <dir>\n'
+    + '       mtec-ai-local-runner claude-release observe --version <version> --platform <platform> --sha256 <sha256> --model <id> [--model <id> ...] --decision <uuid> --state-root <dir> --out <dir>\n'
     + '       mtec-ai-local-runner claude-release review --binary <path> --version <version> --platform <platform> --sha256 <sha256> --model <id> [--model <id> ...] --out <dir> [--auth-observation <file>] [--tool-inventory local-tools-v3]';
 function flags(argv, single, repeated = []) {
     const values = new Map();
@@ -65,6 +68,49 @@ export async function runClaudeReleaseCommand(argv, io) {
             return failed(error);
         }
     }
+    if (argv[0] === 'observe') {
+        const f = flags(argv.slice(1), ['version', 'platform', 'sha256', 'decision', 'state-root', 'out'], ['model']);
+        if (!f || !['version', 'platform', 'sha256', 'decision', 'state-root', 'out', 'model'].every(name => f.has(name)))
+            return usage();
+        try {
+            const release = { version: one(f, 'version'), platform: one(f, 'platform'), binary_sha256: one(f, 'sha256') }, models = [...f.get('model')];
+            const decision = one(f, 'decision'), stateRoot = one(f, 'state-root'), out = one(f, 'out'), home = io.home ?? process.env.HOME ?? '';
+            if (!parseClaudeSyncRelease({ ...release, model_ids: models }) || !absolute(stateRoot) || !absolute(out) || !absolute(home)
+                || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(decision))
+                throw Error('CLAUDE_REVIEW_INPUT_REJECTED');
+            if (release.platform !== hostClaudePlatform())
+                throw Error('CLAUDE_REVIEW_PLATFORM_MISMATCH');
+            const binary = await (io.verifyCopy ?? verifyClaudeReleaseCopy)(home, { ...release, model_ids: models });
+            const token = await (io.tokenStore ?? new ClaudeRunnerTokenStore({ stateRoot })).load();
+            if (!token)
+                throw Error('CLAUDE_RUNNER_TOKEN_MISSING');
+            const probeEnv = claudeProbeEnv(home, process.env);
+            probeEnv.PATH = pathWithKeychainStub(await ensureClaudeKeychainStub(stateRoot), probeEnv.PATH);
+            const { code, stdout } = await (io.authStatus ?? claudeTokenAuthStatus)(binary, probeEnv, token, 10_000);
+            let parsed;
+            try {
+                parsed = JSON.parse(stdout);
+            }
+            catch {
+                parsed = undefined;
+            }
+            const status = { loggedIn: parsed?.loggedIn === true };
+            for (const key of ['authMethod', 'apiProvider'])
+                if (typeof parsed?.[key] === 'string')
+                    status[key] = parsed[key];
+            const observation = { version: CLAUDE_AUTH_OBSERVATION_VERSION, release, launch: 'runner_pinned_copy', command: 'auth status --json', credential: 'runner_token',
+                exit_code: code, auth_status: status, decision_id: decision };
+            const bytes = Buffer.from(JSON.stringify(observation));
+            const checked = parseClaudeAuthObservation(bytes, release);
+            const file = path.join(out, 'auth-observation.json');
+            await writeFile(file, bytes, { mode: 0o600, flag: 'wx' });
+            io.stdout(JSON.stringify({ ok: true, written: file, sha256: checked.sha256, auth_status: checked.observation.auth_status }));
+            return 0;
+        }
+        catch (error) {
+            return failed(error);
+        }
+    }
     if (argv[0] !== 'review')
         return usage();
     const f = flags(argv.slice(1), ['binary', 'version', 'platform', 'sha256', 'out', 'auth-observation', 'tool-inventory'], ['model']);

package/dist/src/commands/claude-token.js

@@ -0,0 +1,49 @@
+import { execFileSync } from "node:child_process";
+import readline from "node:readline";
+import { ClaudeRunnerTokenStore, normalizeClaudeRunnerToken } from "../safety/claude-runner-token.js";
+export const CLAUDE_TOKEN_FLAG = "--claude-token";
+export const CLAUDE_TOKEN_RESET_FLAG = "--claude-token-reset";
+/** Reads pasted lines without ever writing them back: readline gets no output stream and runs as a non-terminal, and
+ * terminal echo is off while it reads. Lines are joined, so a wrapped paste is fine; an empty line ends the input. */
+export async function readHiddenLines(input, output, prompt, setEcho = () => undefined) {
+    output.write(prompt);
+    setEcho(false);
+    const rl = readline.createInterface({ input, terminal: false });
+    try {
+        let value = "";
+        for await (const raw of rl) {
+            const line = raw.replace(/\s+/g, "");
+            if (line === "" && value !== "")
+                break;
+            value += line;
+        }
+        return value;
+    }
+    finally {
+        rl.close();
+        setEcho(true);
+        output.write("\n");
+    }
+}
+export const terminalHiddenReader = {
+    isInteractive: () => process.stdin.isTTY === true,
+    readHiddenLines: prompt => readHiddenLines(process.stdin, process.stdout, prompt, on => execFileSync("/bin/stty", [on ? "echo" : "-echo"], { stdio: "inherit" })),
+};
+export async function runClaudeTokenCommand(input) {
+    const store = input.store ?? new ClaudeRunnerTokenStore({ stateRoot: input.stateRoot });
+    if (input.argv.includes(CLAUDE_TOKEN_RESET_FLAG)) {
+        await store.remove();
+        return { claudeToken: { state: "removed" } };
+    }
+    if (!input.argv.includes(CLAUDE_TOKEN_FLAG))
+        return null;
+    const reader = input.reader ?? terminalHiddenReader;
+    if (!reader.isInteractive())
+        throw new Error("CLAUDE_RUNNER_TOKEN_NEEDS_TERMINAL: run setup --claude-token in Terminal, not through a script or pipe.");
+    const pasted = await reader.readHiddenLines("Run `claude setup-token` in Terminal, then paste the token here (hidden; a wrapped paste is fine) and press Enter on an empty line: ");
+    const token = normalizeClaudeRunnerToken(pasted);
+    if (!token)
+        throw new Error("CLAUDE_RUNNER_TOKEN_INVALID: that was not a Claude token. Copy the whole token that claude setup-token printed.");
+    const storage = await store.save(token);
+    return { claudeToken: { state: "stored", storage } };
+}

package/dist/src/daemon/runtime.js

@@ -16,6 +16,7 @@ import { buildCodexJobOptions } from "../adapters/codex/runtime-options.js";
 import { AdapterRegistry } from "../adapters/registry.js";
 import { ClaudeCodePlugin } from "../adapters/claude-code/adapter.js";
 import { createClaudeCodeAdapterOptions } from "../adapters/claude-code/runtime-options.js";
+import { ClaudeRunnerTokenStore, ensureClaudeKeychainStub } from "../safety/claude-runner-token.js";
 import { WorkspaceManager } from "../workspace/workspace-manager.js";
 import { GitClient } from "../workspace/git-client.js";
 import { FileDaemonStateStore } from "../state-store.js";
@@ -47,7 +48,8 @@ export async function buildDaemon(input) {
     if (claudeParts !== 0 && claudeParts !== 3)
         throw new Error('CLAUDE_SUPPORTED_HOST_REQUIRED');
     // Claude admission (decision 9095c7a8): the compiled release host, unless a test injects the whole trusted tuple.
-    const claudeProduction = claudeParts === 0 ? createClaudeProductionHost({ home: input.env.HOME ?? '', env: input.env, fetchFn: input.fetchFn,
+    const claudeToken = new ClaudeRunnerTokenStore({ stateRoot: input.stateRoot });
+    const claudeProduction = claudeParts === 0 ? createClaudeProductionHost({ home: input.env.HOME ?? '', env: input.env, fetchFn: input.fetchFn, claudeToken: () => claudeToken.load(), keychainStub: () => ensureClaudeKeychainStub(input.stateRoot),
         report: event => { process.stderr.write(`${JSON.stringify(event)}\n`); } }) : undefined;
     const claude = {
         probe: input.claudeSupportedProbe ?? (() => claudeProduction.probe()),

package/dist/src/process/node-process-host.js

@@ -3,7 +3,10 @@ import { createInterface } from "node:readline";
 /** Spawns a real OS process; no shell is ever used, so args are never interpolated into a command string. */
 export class NodeProcessHost {
     spawn(command, args, options) {
-        const child = spawn(command, args, { cwd: options.cwd, env: options.env, shell: false });
+        const secret = options.secretFd3;
+        const child = spawn(command, args, { cwd: options.cwd, env: options.env, shell: false, stdio: secret === undefined ? "pipe" : ["pipe", "pipe", "pipe", "pipe"] });
+        if (secret !== undefined)
+            child.stdio[3].end(secret);
         const stdout = createInterface({ input: child.stdout });
         return {
             stdin: {

package/dist/src/process/owned-process-guardian.js

@@ -53,7 +53,9 @@ commands.on('data',chunk=>{
   if(!configured){
    if(message.type!=='launch'||typeof message.command!=='string'||!Array.isArray(message.args)){lost();return;}
    configured=true;
-   try{child=spawn(message.command,message.args,{cwd:message.cwd,env:message.env,shell:false,detached:true,stdio:['pipe','pipe','pipe']});}catch{send({type:'spawn_failed'});finish(0);return;}
+   const secret=typeof message.secretFd3==='string'?message.secretFd3:undefined;
+   try{child=spawn(message.command,message.args,{cwd:message.cwd,env:message.env,shell:false,detached:true,stdio:secret===undefined?['pipe','pipe','pipe']:['pipe','pipe','pipe','pipe']});}catch{send({type:'spawn_failed'});finish(0);return;}
+   if(secret!==undefined){child.stdio[3].on('error',()=>{});child.stdio[3].end(secret);}
    ready=new Promise(resolve=>{
     child.once('spawn',()=>{ownedPid=child.pid;send({type:'spawned',pid:ownedPid,parentPid:process.pid});resolve();if(orphaned)void cleanup(false,'lost');});
     child.once('error',()=>{send({type:'spawn_failed'});closed=true;resolve();void cleanup(true,'spawn_error');});

package/dist/src/safety/claude-production-host.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
-import { execFile } from 'node:child_process';
+import { execFile, spawn } from 'node:child_process';
+import { CLAUDE_TOKEN_FD, CLAUDE_TOKEN_FD_ENV, pathWithKeychainStub } from './claude-runner-token.js';
 import { lstat, realpath } from 'node:fs/promises';
 import { isDeepStrictEqual } from 'node:util';
 import { CLAUDE_CAPABILITIES } from '../adapters/discovery.js';
@@ -38,7 +39,8 @@ export const CLAUDE_LAUNCH_CONFIG = Object.freeze({ transport: CLAUDE_TRANSPORT,
     flags: Object.freeze(['--allowedTools', '--disable-slash-commands', '--include-partial-messages', '--input-format', '--mcp-config', '--model', '--name',
         '--no-chrome', '--output-format', '--permission-mode', '--print', '--setting-sources', '--settings', '--strict-mcp-config', '--tools', '--verbose']),
     conditional_flags: Object.freeze(['--max-budget-usd', '--resume', '--session-id']),
-    settings_keys: Object.freeze(['hooks.PreToolUse']), env_opt_outs: CLAUDE_LAUNCH_OPT_OUTS });
+    settings_keys: Object.freeze(['hooks.PreToolUse']), env_opt_outs: CLAUDE_LAUNCH_OPT_OUTS,
+    token_delivery: Object.freeze({ env: CLAUDE_TOKEN_FD_ENV, fd: CLAUDE_TOKEN_FD, when: 'runner_token_stored', keychain: 'runner_stub_not_found' }) });
 /** The tool inventory a listed release was reviewed with (Work Decision f43e7aa0): the one its tools_sha256 names, or
  * local-tools-v1 for an entry without it, so every job keeps the original tools until the Gateway lists another. */
 export function claudeReleaseToolInventory(release) {
@@ -68,31 +70,80 @@ export const CLAUDE_SIGNATURE_RECHECK_MS = 5 * 60_000;
  * context: the employee's HOME, USER and LOGNAME, and CLAUDE_CONFIG_DIR only when they set it (runtime-options.ts).
  * The documented Claude Code opt-outs keep the probe from updating itself or sending other traffic.
  * `timeoutMs` is a trusted in-process test seam only. */
-export function pinnedClaudeLogin(home, env, timeoutMs = CLAUDE_LOGIN_PROBE_TIMEOUT_MS) {
-    return binary => new Promise(resolve => {
-        const account = env.CLAUDE_CONFIG_DIR;
-        if (account !== undefined && !path.isAbsolute(account) || !path.isAbsolute(binary) || !path.isAbsolute(home))
-            return resolve({ authenticated: false, loginStatus: 'unknown' });
-        const childEnv = { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C', HOME: home, ...(account === undefined ? {} : { CLAUDE_CONFIG_DIR: account }),
-            DISABLE_AUTOUPDATER: '1', CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1' };
-        for (const key of ['USER', 'LOGNAME']) {
-            const value = env[key];
-            if (value !== undefined)
-                childEnv[key] = value;
-        }
-        execFile(binary, ['auth', 'status', '--json'], { encoding: 'utf8', timeout: timeoutMs, maxBuffer: 65_536, env: childEnv }, (error, stdout) => {
-            if (!error)
-                return resolve(claudeLoginFromStatus(stdout));
-            // Claude exits 1 for a known logged-out JSON answer; other failures prove nothing.
-            resolve(error.code === 1 && typeof stdout === 'string' ? claudeLoginFromStatus(stdout, true) : { authenticated: false, loginStatus: 'unknown' });
+export function pinnedClaudeLogin(home, env, timeoutMs = CLAUDE_LOGIN_PROBE_TIMEOUT_MS, claudeToken, keychainStub) {
+    return async (binary) => {
+        const token = claudeToken ? await claudeToken().catch(() => null) : null;
+        const stub = token !== null && keychainStub ? await keychainStub().catch(() => null) : null;
+        return new Promise(resolve => {
+            const account = env.CLAUDE_CONFIG_DIR;
+            if (account !== undefined && !path.isAbsolute(account) || !path.isAbsolute(binary) || !path.isAbsolute(home))
+                return resolve({ authenticated: false, loginStatus: 'unknown' });
+            const childEnv = { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C', HOME: home, ...(account === undefined ? {} : { CLAUDE_CONFIG_DIR: account }),
+                DISABLE_AUTOUPDATER: '1', CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1' };
+            for (const key of ['USER', 'LOGNAME']) {
+                const value = env[key];
+                if (value !== undefined)
+                    childEnv[key] = value;
+            }
+            if (token !== null) {
+                if (stub === null)
+                    return resolve({ authenticated: false, loginStatus: 'unknown' });
+                const probeEnv = claudeProbeEnv(home, env);
+                probeEnv.PATH = pathWithKeychainStub(stub, probeEnv.PATH);
+                return resolve(tokenLogin(binary, probeEnv, token, timeoutMs));
+            }
+            execFile(binary, ['auth', 'status', '--json'], { encoding: 'utf8', timeout: timeoutMs, maxBuffer: 65_536, env: childEnv }, (error, stdout) => {
+                if (!error)
+                    return resolve(claudeLoginFromStatus(stdout));
+                // Claude exits 1 for a known logged-out JSON answer; other failures prove nothing.
+                resolve(error.code === 1 && typeof stdout === 'string' ? claudeLoginFromStatus(stdout, true) : { authenticated: false, loginStatus: 'unknown' });
+            });
         });
+    };
+}
+/** `auth status --json` with the runner token on fd 3: it never reaches env, argv or logs, and no Keychain read is needed.
+ * A timeout, a spawn error or oversized output resolves with a null code. */
+export function claudeTokenAuthStatus(binary, env, token, timeoutMs) {
+    return new Promise(resolve => {
+        let stdout = '', done = false;
+        const finish = (code) => { if (!done) {
+            done = true;
+            clearTimeout(timer);
+            resolve({ code, stdout });
+        } };
+        const child = spawn(binary, ['auth', 'status', '--json'], { env: { ...env, [CLAUDE_TOKEN_FD_ENV]: CLAUDE_TOKEN_FD }, shell: false, stdio: ['ignore', 'pipe', 'ignore', 'pipe'] });
+        const timer = setTimeout(() => { child.kill('SIGKILL'); finish(null); }, timeoutMs);
+        const fd3 = child.stdio[3];
+        fd3.on('error', () => { });
+        fd3.end(token);
+        child.stdout.setEncoding('utf8');
+        child.stdout.on('data', (chunk) => { stdout += chunk; if (stdout.length > 65_536) {
+            child.kill('SIGKILL');
+            finish(null);
+        } });
+        child.once('error', () => finish(null));
+        child.once('close', code => finish(code));
     });
 }
+async function tokenLogin(binary, env, token, timeoutMs) {
+    const { code, stdout } = await claudeTokenAuthStatus(binary, env, token, timeoutMs);
+    return code === 0 ? claudeLoginFromStatus(stdout) : code === 1 ? claudeLoginFromStatus(stdout, true) : { authenticated: false, loginStatus: 'unknown' };
+}
+/** The probe environment the daemon uses: the employee's HOME, USER and LOGNAME and the documented opt-outs. */
+export function claudeProbeEnv(home, env) {
+    const childEnv = { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C', HOME: home, DISABLE_AUTOUPDATER: '1', CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1' };
+    for (const key of ['USER', 'LOGNAME']) {
+        const value = env[key];
+        if (value !== undefined)
+            childEnv[key] = value;
+    }
+    return childEnv;
+}
 /** Compiled Claude composition (decision 9095c7a8). The Gateway's synced release is the only one fetched or run.
  * No environment, task or saved JSON creates an admission capability. */
 export function createClaudeProductionHost(input) {
     const platform = input.platform ?? hostClaudePlatform(), now = input.now ?? Date.now, abort = new AbortController();
-    const managed = input.managedScope ?? claudeManagedScopeDeps(), login = input.login ?? pinnedClaudeLogin(input.home, input.env);
+    const managed = input.managedScope ?? claudeManagedScopeDeps(), login = input.login ?? pinnedClaudeLogin(input.home, input.env, undefined, input.claudeToken, input.keychainStub);
     const provisioner = createClaudeReleaseProvisioner({ home: input.home, platform, fetchFn: input.fetchFn, codesign: input.codesign, signal: abort.signal });
     const failures = new Map(), key = (r) => `${r.version}/${r.platform}/${r.binary_sha256}`;
     let listed = null, inflight, retryKey, pending = Promise.resolve(), closed = false;

package/dist/src/safety/claude-review-campaign.js

@@ -14,7 +14,8 @@ import { CLAUDE_LAUNCH_OPT_OUTS, CLAUDE_SIGNING_IDENTIFIER, CLAUDE_TEAM_ID, clau
 import { CLAUDE_CODE_REQUIREMENT, verifyClaudeCodeSignature } from './claude-release-copy.js';
 import { CLAUDE_LAUNCH_CONFIG } from './claude-production-host.js';
 import { CLAUDE_REVIEW_PROFILE_TEMPLATE_SHA256, CLAUDE_REVIEW_PROFILE_VERSION } from './claude-review-sandbox.js';
-import { CLAUDE_REVIEW_KEYCHAIN_READS, CLAUDE_REVIEW_KEYCHAIN_SERVICES, CLAUDE_REVIEW_PLANTED_SOURCES, createClaudeReviewLayout } from './claude-review-layout.js';
+import { CLAUDE_TOKEN_FD_ENV } from './claude-runner-token.js';
+import { CLAUDE_REVIEW_KEYCHAIN_READS, CLAUDE_REVIEW_PLANTED_SOURCES, createClaudeReviewLayout } from './claude-review-layout.js';
 import { CLAUDE_REVIEW_FAKE_KEY, CLAUDE_REVIEW_PROMPT, CLAUDE_REVIEW_PULL_REQUEST, CLAUDE_REVIEW_PULL_REQUEST_TOOL_IDS, CLAUDE_REVIEW_RUN_TIMEOUT_MS, CLAUDE_REVIEW_SLASH_PROMPT, CLAUDE_REVIEW_TOOL_IDS, CLAUDE_REVIEW_TOOL_INVENTORY, claudeReviewEnv, claudeReviewPullRequestCalls, runClaudeReview, runClaudeVersion } from './claude-review-run.js';
 import { LOCAL_PULL_REQUEST_READ_BOUNDS, PULL_REQUEST_REVIEW_INVENTORY } from './pull-request-evidence.js';
 import { CLAUDE_REVIEW_PULL_REQUEST_SCENARIO, CLAUDE_REVIEW_STAGES, buildClaudeReviewEvidence } from './claude-review-evidence.js';
@@ -80,12 +81,12 @@ export function evaluateClaudeReview(input) {
         scenario('slash_refused', { not_expanded: !!slash && hits('planted', [slash]) === 0, no_command_side_effect: !sentinel(['slash']), delivered_or_refused: delivery !== 'missing' }, { delivery }),
         scenario('source_exclusion', { outside_denied: every(scripted, r => denied(r, IDS.outside)), secret_denied: every(scripted, r => denied(r, IDS.secret)),
             no_outside_content: hits('outside') === 0, no_secret_content: hits('secret') === 0, no_implicit_source: implicit === 0 }, { runs_checked: scripted.length }),
-        scenario('fake_credentials', { fake_key_only: scripted.length > 0 && runs.every(r => messages(r).every(q => q.apiKey === CLAUDE_REVIEW_FAKE_KEY)),
-            no_authorization_header: runs.every(r => messages(r).every(q => !q.authorization)), no_credential_content: hits('credential') === 0,
-            fake_key_not_in_body: runs.every(r => r.fakeKeyInBody === 0), environment_exact: every(runs, r => isDeepStrictEqual(r.envKeys, [...input.expectedEnvKeys])),
-            keychain_reads_only: runs.every(r => r.keychainLookups.every(k => CLAUDE_REVIEW_KEYCHAIN_READS.includes(k.operation))),
-            // Each run looks up the Keychain, and only under the terminal login's services: no config-dir hash suffix.
-            keychain_service_default: runs.every(r => r.keychainLookups.length > 0 && r.keychainLookups.every(k => CLAUDE_REVIEW_KEYCHAIN_SERVICES.includes(k.service))) }, { runs_checked: runs.length, environment_keys: [...input.expectedEnvKeys] }),
+        scenario('fake_credentials', { fake_token_only: scripted.length > 0 && runs.every(r => messages(r).every(q => q.authorization === `Bearer ${CLAUDE_REVIEW_FAKE_KEY}`)),
+            no_api_key_header: runs.every(r => messages(r).every(q => q.apiKey === null)), no_credential_content: hits('credential') === 0,
+            fake_token_not_in_body: runs.every(r => r.fakeKeyInBody === 0), environment_exact: every(runs, r => isDeepStrictEqual(r.envKeys, [...input.expectedEnvKeys])),
+            // Token mode (Work Decision 17a1113b): the CLI's startup Keychain prefetch meets a stand-in that finds nothing, as the
+            // runner's own stand-in does in jobs, and it may only read; the requests above prove it then used the fd 3 token.
+            keychain_reads_only: runs.every(r => r.keychainLookups.every(k => CLAUDE_REVIEW_KEYCHAIN_READS.includes(k.operation))) }, { runs_checked: runs.length, environment_keys: [...input.expectedEnvKeys] }),
         scenario('communication_boundary', { sandboxed: every(runs, r => r.sandboxed) && input.version.sandboxed, no_unlisted_destination: runs.every(r => r.decoyConnections === 0) }, { sandboxed_runs: runs.filter(r => r.sandboxed).length + (input.version.sandboxed ? 1 : 0) }),
         scenario('cleanup', { runs_terminal: every(runs, r => r.terminal), owned_exit_confirmed: every(runs, r => r.exitConfirmed) && input.version.exitConfirmed,
             temp_removed: input.tempRemoved }, { owned_exits: runs.length + 1 }),
@@ -125,7 +126,7 @@ export async function runClaudeReviewCampaign(input) {
         await rm(layout.root, { recursive: true, force: true }).catch(() => { });
         tempRemoved = await lstat(layout.root).then(() => false, () => true);
     }
-    const launchEnvKeys = [...Object.keys(layout.env), ...Object.keys(CLAUDE_LAUNCH_OPT_OUTS), HOOK_POLICY_ENV_VAR].sort(), reviewEnvKeys = Object.keys(claudeReviewEnv('http://127.0.0.1:1')).sort();
+    const launchEnvKeys = [...Object.keys(layout.env), ...Object.keys(CLAUDE_LAUNCH_OPT_OUTS), HOOK_POLICY_ENV_VAR, CLAUDE_TOKEN_FD_ENV].sort(), reviewEnvKeys = Object.keys(claudeReviewEnv('http://127.0.0.1:1')).sort();
     const scenarios = evaluateClaudeReview({ ...(input.toolInventory ? { toolInventory: input.toolInventory } : {}), release: input.release, copySha256: sha256, copyUnchanged, version, runs, canaries: layout.canaries,
         expectedEnvKeys: [...launchEnvKeys, ...reviewEnvKeys].sort(), tempRemoved });
     return buildClaudeReviewEvidence({

package/dist/src/safety/claude-review-evidence.js

@@ -5,7 +5,7 @@ import { CLAUDE_RELEASE_GATES, claudeCanonicalSha256 } from './claude-release.js
  * a release certificate: the owner reviews it and lists the release in claude_release.php through a Gateway PR that cites
  * a Work Decision. The campaign, the gate map and this format are Runner source constants.
  */
-export const CLAUDE_REVIEW_EVIDENCE_VERSION = 'claude-release-review-evidence-v1';
+export const CLAUDE_REVIEW_EVIDENCE_VERSION = 'claude-release-review-evidence-v2';
 export const CLAUDE_REVIEW_CAMPAIGN = 'claude-release-campaign-v1';
 export const CLAUDE_REVIEW_EVIDENCE_FILE = 'claude-release-evidence.json';
 /** The only top-level key evidence_sha256 leaves out. Timestamps, temp paths, durations, the runner package version, proxy
@@ -70,9 +70,9 @@ export function claudeReleaseCandidate(evidence) {
     return { version: evidence.release.version, platform: evidence.release.platform, binary_sha256: evidence.release.binary_sha256,
         evidence_sha256: claudeReviewEvidenceSha256(evidence), model_ids: [...evidence.release.model_ids] };
 }
-export const CLAUDE_AUTH_OBSERVATION_VERSION = 'claude-auth-observation-v1';
+export const CLAUDE_AUTH_OBSERVATION_VERSION = 'claude-auth-observation-v2';
 export const CLAUDE_AUTH_OBSERVATION_MAX_BYTES = 4096;
-const OBSERVATION_KEYS = ['auth_status', 'command', 'decision_id', 'exit_code', 'keychain_prompt_shown', 'launch', 'release', 'version'];
+const OBSERVATION_KEYS = ['auth_status', 'command', 'credential', 'decision_id', 'exit_code', 'launch', 'release', 'version'];
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/, TOKEN = /^[A-Za-z0-9._-]{1,32}$/;
 const plain = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 export function parseClaudeAuthObservation(bytes, release) {
@@ -90,10 +90,10 @@ export function parseClaudeAuthObservation(bytes, release) {
         throw rejected();
     const r = value.release, s = value.auth_status;
     if (value.version !== CLAUDE_AUTH_OBSERVATION_VERSION || value.launch !== 'runner_pinned_copy' || value.command !== 'auth status --json' || value.exit_code !== 0
-        || value.keychain_prompt_shown !== false || typeof value.decision_id !== 'string' || !UUID.test(value.decision_id)
+        || value.credential !== 'runner_token' || typeof value.decision_id !== 'string' || !UUID.test(value.decision_id)
         || !plain(r) || !isDeepStrictEqual(Object.keys(r).sort(), ['binary_sha256', 'platform', 'version'])
         || r.version !== release.version || r.platform !== release.platform || r.binary_sha256 !== release.binary_sha256
-        || !plain(s) || s.loggedIn !== true || Object.keys(s).some(k => !['loggedIn', 'authMethod', 'apiProvider'].includes(k))
+        || !plain(s) || s.loggedIn !== true || s.authMethod !== 'oauth_token' || Object.keys(s).some(k => !['loggedIn', 'authMethod', 'apiProvider'].includes(k))
         || ['authMethod', 'apiProvider'].some(k => s[k] !== undefined && (typeof s[k] !== 'string' || !TOKEN.test(s[k]))))
         throw rejected();
     const observation = structuredClone(value);

package/dist/src/safety/claude-review-provider.js

@@ -84,7 +84,7 @@ export async function startClaudeReviewProvider(script) {
         if (raw.includes(script.fakeKey))
             fakeKeyInBody++;
         const apiKey = req.headers['x-api-key'];
-        const base = { step: null, model: null, toolNames: [], toolResultIds: [], apiKey: typeof apiKey === 'string' ? apiKey : null, authorization: req.headers.authorization !== undefined, firstUserText: null, canaries: hit, promptMatched: false, reminders: 0 };
+        const base = { step: null, model: null, toolNames: [], toolResultIds: [], apiKey: typeof apiKey === 'string' ? apiKey : null, authorization: typeof req.headers.authorization === 'string' ? req.headers.authorization : null, firstUserText: null, canaries: hit, promptMatched: false, reminders: 0 };
         if (url.pathname.startsWith('/planted-mcp/')) {
             keep({ ...base, kind: 'planted_mcp' });
             res.writeHead(404);

package/dist/src/safety/claude-review-run.js

@@ -13,7 +13,7 @@ import { LocalToolServer, localEndpointReadObservations } from './local-tool-ser
 import { claudeReviewProfile, claudeReviewSandboxArgs } from './claude-review-sandbox.js';
 import { startClaudeReviewDecoy, startClaudeReviewProvider } from './claude-review-provider.js';
 import { CLAUDE_REVIEW_SOURCE_FILE, plantHostileSources, reviewHomeWrites, snapshotReviewHome, takeKeychainLookups, takeSentinels } from './claude-review-layout.js';
-export const CLAUDE_REVIEW_FAKE_KEY = 'sk-ant-claude-release-review-fake-key';
+export const CLAUDE_REVIEW_FAKE_KEY = 'sk-ant-oat01-claude-release-review-fake-token-000000000000';
 export const CLAUDE_REVIEW_PROMPT = 'Offline Claude release review. Follow the scripted provider. No real project, account or model.';
 export const CLAUDE_REVIEW_SLASH_PROMPT = '/review-planted now';
 /** A review-harness bound per CLI run, not an employee job limit (RW-06). */
@@ -27,7 +27,7 @@ export const CLAUDE_REVIEW_PULL_REQUEST = Object.freeze({ repository: 'review/cl
 /** Review-only keys added to the adapter's launch environment: the scripted provider, a fake key, the provider as the HTTPS proxy
  * observer (loopback bypasses it). The opt-outs come with the launch environment itself (CLAUDE_LAUNCH_OPT_OUTS). */
 export function claudeReviewEnv(providerUrl) {
-    return { ANTHROPIC_BASE_URL: providerUrl, ANTHROPIC_API_KEY: CLAUDE_REVIEW_FAKE_KEY, HTTPS_PROXY: providerUrl, HTTP_PROXY: providerUrl, NO_PROXY: '127.0.0.1,localhost' };
+    return { ANTHROPIC_BASE_URL: providerUrl, HTTPS_PROXY: providerUrl, HTTP_PROXY: providerUrl, NO_PROXY: '127.0.0.1,localhost' };
 }
 const REVIEW_KEY = 'claude-release-review', REVIEW_SHA = '0'.repeat(40);
 const REVIEW_BINDING = Object.freeze({ jobId: REVIEW_KEY, threadId: `${REVIEW_KEY}-thread`, turnId: `${REVIEW_KEY}-turn`, generation: 1 });
@@ -146,12 +146,12 @@ export async function runClaudeReview(input) {
         // Exactly the adapter's release-mode argv (unbounded employee shape: no budget flag), environment and hook settings.
         const args = claudeLaunchArgs({ modelId: input.model, maxBudgetUsd: null, name: REVIEW_KEY, mcpConfigPath,
             settings: claudeLaunchSettings(formatHookCommand(input.hook, { worktreeRoot: layout.source })), sessionId: randomUUID(), toolInventory: inventory });
-        const env = { ...claudeLaunchEnv(layout.env, policy), ...claudeReviewEnv(provider.url) };
+        const env = { ...claudeLaunchEnv(layout.env, policy, true), ...claudeReviewEnv(provider.url) };
         envKeys = Object.keys(env).sort();
         const profile = claudeReviewProfile({ root: layout.root, cliRoot: layout.cli.root, ports: [provider.port, Number(new URL(endpoint.url).port)], readRoots: input.readRoots, deniedHome: input.deniedHome });
         const [command, argv] = input.sandbox ? claudeReviewSandboxArgs(profile, input.binary, args) : [input.binary, args];
         homeBefore = await snapshotReviewHome(layout);
-        handle = input.processHost.spawn(command, argv, { cwd: layout.cli.cwd, env });
+        handle = input.processHost.spawn(command, argv, { cwd: layout.cli.cwd, env, secretFd3: CLAUDE_REVIEW_FAKE_KEY });
         terminal = await drive(handle, claudeUserInput(prompt), input.timeoutMs);
         exitConfirmed = await confirmExit(handle);
         reads = readCounts(localEndpointReadObservations(endpoint.url, endpoint.token));

package/dist/src/safety/claude-runner-token.js

@@ -0,0 +1,74 @@
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { MacOsKeychainCredentialStore } from "../platform/macos/keychain-store.js";
+export const CLAUDE_TOKEN_FD_ENV = "CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR";
+export const CLAUDE_TOKEN_FD = "3";
+export const CLAUDE_TOKEN_KEYCHAIN_ACCOUNT = "claude-oauth-token";
+const TOKEN_FILE = "claude-oauth-token";
+const TOKEN_SHAPE = /^[A-Za-z0-9._-]{20,512}$/;
+export function normalizeClaudeRunnerToken(value) {
+    const token = value.replace(/\s+/g, "");
+    return TOKEN_SHAPE.test(token) ? token : null;
+}
+export class ClaudeRunnerTokenStore {
+    keychain;
+    file;
+    constructor(options) {
+        this.file = path.join(path.resolve(options.stateRoot), TOKEN_FILE);
+        this.keychain = options.keychain === undefined
+            ? (process.platform === "darwin" ? new MacOsKeychainCredentialStore({ account: CLAUDE_TOKEN_KEYCHAIN_ACCOUNT }) : null)
+            : options.keychain;
+    }
+    async load() {
+        const fromKeychain = this.keychain ? await this.keychain.load().catch(() => null) : null;
+        const keychainToken = fromKeychain === null ? null : normalizeClaudeRunnerToken(fromKeychain);
+        if (keychainToken)
+            return keychainToken;
+        try {
+            return normalizeClaudeRunnerToken(await readFile(this.file, "utf8"));
+        }
+        catch {
+            return null;
+        }
+    }
+    async save(value) {
+        const token = normalizeClaudeRunnerToken(value);
+        if (!token)
+            throw new Error("CLAUDE_RUNNER_TOKEN_INVALID");
+        if (this.keychain) {
+            try {
+                await this.keychain.save(token);
+                await rm(this.file, { force: true });
+                return "keychain";
+            }
+            catch {
+                // Falls through to the owner-only file.
+            }
+        }
+        await mkdir(path.dirname(this.file), { recursive: true, mode: 0o700 });
+        await writeFile(this.file, token, { mode: 0o600 });
+        await chmod(this.file, 0o600);
+        return "file";
+    }
+    async remove() {
+        await this.keychain?.remove().catch(() => undefined);
+        await rm(this.file, { force: true });
+    }
+}
+export const CLAUDE_KEYCHAIN_STUB_DIR = "claude-keychain-stub";
+export const CLAUDE_KEYCHAIN_STUB = "#!/bin/sh\necho 'security: SecKeychainSearchCopyNext: The specified item could not be found in the keychain.' >&2\nexit 44\n";
+/** The runner's stand-in `security`: in token mode it is first on the CLI's PATH, so the CLI's startup Keychain prefetch
+ * finds nothing and the shared Keychain is never consulted (Work Decision 17a1113b). */
+export async function ensureClaudeKeychainStub(stateRoot) {
+    const dir = path.join(path.resolve(stateRoot), CLAUDE_KEYCHAIN_STUB_DIR), file = path.join(dir, "security");
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    await chmod(dir, 0o700);
+    const current = await readFile(file, "utf8").catch(() => null);
+    if (current !== CLAUDE_KEYCHAIN_STUB)
+        await writeFile(file, CLAUDE_KEYCHAIN_STUB, { mode: 0o700 });
+    await chmod(file, 0o700);
+    return dir;
+}
+export function pathWithKeychainStub(stubDir, searchPath) {
+    return searchPath ? `${stubDir}:${searchPath}` : stubDir;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.102",
+  "version": "0.1.104",
   "private": false,
   "license": "UNLICENSED",
   "bin": {