niahere 0.5.6 → 0.5.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "niahere",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "description": "A personal AI assistant daemon — chat, scheduled jobs, persona system, extensible via skills.",
   "type": "module",
   "scripts": {

package/src/agent/auth.ts

@@ -2,6 +2,8 @@ import { existsSync, readFileSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
 import type { ProviderName } from "./models";
+import { resolveClaudeCredential } from "./credentials";
+import { getConfig } from "../utils/config";
 
 /**
  * Provider sign-in state, read from whatever each CLI stores on disk.
@@ -43,6 +45,17 @@ const defaultReader: AuthReader = {
   env: (k) => process.env[k],
 };
 
+/** Config is optional here: a health check must never fail because config is
+ *  unreadable, it must say so. */
+function credentialConfig(): { anthropic_oauth_token: string | null; anthropic_api_key: string | null } {
+  try {
+    const c = getConfig();
+    return { anthropic_oauth_token: c.anthropic_oauth_token, anthropic_api_key: c.anthropic_api_key };
+  } catch {
+    return { anthropic_oauth_token: null, anthropic_api_key: null };
+  }
+}
+
 export function claudeCredentialsPath(): string {
   return join(homedir(), ".claude", ".credentials.json");
 }
@@ -62,8 +75,16 @@ function ago(ms: number): string {
 export function claudeAuthStatus(now: number = Date.now(), reader: AuthReader = defaultReader): AuthStatus {
   const base = { provider: "claude" as const };
 
-  if (reader.env("ANTHROPIC_API_KEY")) {
-    return { ...base, state: "ok", detail: "API key (no expiry)" };
+  // Ask the same resolver the backend uses. Reading the environment here while
+  // the backend also reads config meant the check could report one credential
+  // while a different one served the turn — the exact ambiguity this exists to
+  // remove.
+  const credential = resolveClaudeCredential(credentialConfig(), reader.env);
+  if (credential.kind === "oauth_token") {
+    return { ...base, state: "ok", detail: "configured oauth token (subscription, no refresh needed)" };
+  }
+  if (credential.kind === "api_key") {
+    return { ...base, state: "ok", detail: "configured API key (metered — billed per token)" };
   }
 
   const path = claudeCredentialsPath();
@@ -97,7 +118,11 @@ export function claudeAuthStatus(now: number = Date.now(), reader: AuthReader =
     return { ...status, state: "stale", detail: `access token lapsed ${ago(now - access)} ago, renewable${plan}` };
   }
   if (access !== undefined) {
-    return { ...status, state: "ok", detail: `valid for ${ago(access - now)}${plan}` };
+    return {
+      ...status,
+      state: "ok",
+      detail: `Claude Code login, valid for ${ago(access - now)}${plan} — renewed only when the CLI is used here`,
+    };
   }
   return { ...status, state: "unknown", detail: "credentials file carries no expiry" };
 }

package/src/agent/backends/claude-normalize.ts

@@ -90,6 +90,7 @@ function attribute(modelUsage: unknown): Record<string, unknown> | undefined {
  * stay backend-agnostic.
  */
 export class SdkNormalizer implements Normalizer {
+  private apiKeySource: string | undefined;
   private accumulatedThinking = "";
   private lastThinkingLine = "";
 
@@ -97,6 +98,10 @@ export class SdkNormalizer implements Normalizer {
     const msg = message as any;
 
     if (msg.type === "system" && msg.subtype === "init") {
+      // apiKeySource names which credential served the session ('oauth' is
+      // Claude Code's own login). Recording it is what makes a silent switch
+      // of credential visible after the fact.
+      if (typeof msg.apiKeySource === "string") this.apiKeySource = msg.apiKeySource;
       return [{ type: "session", backendSessionId: msg.session_id }];
     }
 
@@ -211,6 +216,7 @@ export class SdkNormalizer implements Normalizer {
           terminal_reason: msg.terminal_reason,
           session_id: msg.session_id,
           subtype: msg.subtype,
+          api_key_source: this.apiKeySource,
           usage: msg.usage,
           model_usage: attribute(msg.modelUsage),
         },

package/src/agent/backends/claude.ts

@@ -11,6 +11,7 @@ import { MessageStream } from "../message-stream";
 import { getSdkSkillsSetting } from "../../core/skills";
 import { getSdkHooks } from "../../core/sdk-hooks";
 import { getConfig } from "../../utils/config";
+import { resolveClaudeCredential, credentialEnv } from "../credentials";
 import { sleep } from "../../utils/retry";
 
 /** The shape of the SDK `query()` handle the session consumes. Injected so the
@@ -106,6 +107,14 @@ class ClaudeSession implements AgentSession {
       // same cwd; jobs always run with a unique id and never auto-continued.
       if (this.ctx.interactive) options.continue = false;
     }
+    // Hand the CLI a credential Nia owns when one is configured. Without this
+    // it inherits ~/.claude/.credentials.json, which only refreshes when a
+    // human runs `claude` on this machine — the coupling that had Nia
+    // answering as codex for sixteen days.
+    const credential = resolveClaudeCredential(getConfig());
+    if (credential.envVar) {
+      options.env = credentialEnv(credential, process.env as Record<string, string>);
+    }
     if (this.ctx.outputSchema) options.outputFormat = { type: "json_schema", schema: this.ctx.outputSchema };
     if (this.ctx.mcpServers) options.mcpServers = this.ctx.mcpServers;
     if (this.ctx.subagents && Object.keys(this.ctx.subagents).length > 0) options.agents = this.ctx.subagents;

package/src/agent/credentials.ts

@@ -0,0 +1,77 @@
+import type { Config } from "../types/config";
+
+/**
+ * Which Claude credential the daemon should use, and where it came from.
+ *
+ * Nia used to have no answer to this: it inherited whatever `claude` had last
+ * written to `~/.claude/.credentials.json`, refreshed by a human opening a
+ * terminal on the same machine. When that stopped, Nia answered as codex for
+ * sixteen days and nothing said why. A credential the daemon is handed
+ * explicitly is one it can report on, and one that does not lapse because
+ * nobody logged in today.
+ */
+
+export type CredentialKind = "oauth_token" | "api_key" | "claude_code_login";
+
+export interface ClaudeCredential {
+  kind: CredentialKind;
+  /** The variable the CLI reads it from. Absent for the inherited login. */
+  envVar?: "CLAUDE_CODE_OAUTH_TOKEN" | "ANTHROPIC_API_KEY";
+  value?: string;
+  /**
+   * `subscription` rides the plan. `metered` bills per token — worth saying out
+   * loud, because Nia has run $552 in a week and that is an invoice on the API.
+   */
+  billing: "subscription" | "metered";
+}
+
+/** Every variable a credential could occupy, so switching never leaves a stale one behind. */
+const TOKEN_VARS = ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"] as const;
+
+const clean = (v: unknown): string | undefined => {
+  const s = typeof v === "string" ? v.trim() : "";
+  return s.length > 0 ? s : undefined;
+};
+
+export type EnvLookup = (key: string) => string | undefined;
+
+/**
+ * Config first, then the ambient environment, then Claude Code's own login.
+ * Config wins so the daemon is not at the mercy of whatever shell launched it.
+ */
+export function resolveClaudeCredential(
+  config: Pick<Config, "anthropic_oauth_token" | "anthropic_api_key">,
+  env: EnvLookup = (k) => process.env[k],
+): ClaudeCredential {
+  const oauth = clean(config.anthropic_oauth_token) ?? clean(env("CLAUDE_CODE_OAUTH_TOKEN"));
+  if (oauth) {
+    return { kind: "oauth_token", envVar: "CLAUDE_CODE_OAUTH_TOKEN", value: oauth, billing: "subscription" };
+  }
+  const key = clean(config.anthropic_api_key) ?? clean(env("ANTHROPIC_API_KEY"));
+  if (key) {
+    return { kind: "api_key", envVar: "ANTHROPIC_API_KEY", value: key, billing: "metered" };
+  }
+  return { kind: "claude_code_login", billing: "subscription" };
+}
+
+/**
+ * The environment for the spawned CLI. The base is passed through — it still
+ * needs PATH and HOME — with exactly one credential variable set, and any other
+ * cleared so a removed credential stops working immediately rather than at the
+ * next restart.
+ */
+export function credentialEnv(credential: ClaudeCredential, base: Record<string, string>): Record<string, string> {
+  const env: Record<string, string> = {};
+  for (const [k, v] of Object.entries(base)) {
+    if ((TOKEN_VARS as readonly string[]).includes(k)) continue;
+    env[k] = v;
+  }
+  if (credential.envVar && credential.value) env[credential.envVar] = credential.value;
+  return env;
+}
+
+export function describeCredential(credential: ClaudeCredential): string {
+  if (credential.kind === "oauth_token") return "configured oauth token (subscription, long-lived)";
+  if (credential.kind === "api_key") return "configured API key (metered, billed per token)";
+  return "Claude Code's own login (refreshed by whoever last used the CLI here)";
+}

package/src/types/config.ts

@@ -112,6 +112,11 @@ export interface Config {
   activeHours: { start: string; end: string };
   database_url: string;
   log_level: string;
+  /** Long-lived token from `claude setup-token`. Preferred: it keeps the
+   *  subscription and does not depend on anyone logging in on this machine. */
+  anthropic_oauth_token: string | null;
+  /** Metered per-token billing — a different bill from the subscription. */
+  anthropic_api_key: string | null;
   gemini_api_key: string | null;
   sessionFinalization: SessionFinalizationConfig;
   channels: ChannelsConfig;

package/src/utils/config.ts

@@ -15,6 +15,8 @@ const DEFAULTS: Config = {
   activeHours: { start: "00:00", end: "23:59" },
   database_url: DEFAULT_DATABASE_URL,
   log_level: "info",
+  anthropic_oauth_token: null,
+  anthropic_api_key: null,
   gemini_api_key: null,
   sessionFinalization: {
     enabled: true,
@@ -129,6 +131,11 @@ export function loadConfig(): Config {
   const log_level = process.env.LOG_LEVEL || (typeof raw.log_level === "string" ? raw.log_level : DEFAULTS.log_level);
 
   // Gemini API key — env var overrides config
+  const anthropic_oauth_token =
+    process.env.CLAUDE_CODE_OAUTH_TOKEN ||
+    (typeof raw.anthropic_oauth_token === "string" ? raw.anthropic_oauth_token : null);
+  const anthropic_api_key =
+    process.env.ANTHROPIC_API_KEY || (typeof raw.anthropic_api_key === "string" ? raw.anthropic_api_key : null);
   const gemini_api_key =
     process.env.GEMINI_API_KEY || (typeof raw.gemini_api_key === "string" ? raw.gemini_api_key : null);
 
@@ -256,6 +263,8 @@ export function loadConfig(): Config {
     activeHours: { start, end },
     database_url,
     log_level,
+    anthropic_oauth_token,
+    anthropic_api_key,
     gemini_api_key,
     sessionFinalization,
     channels: {