openmausbot 0.1.63 → 0.1.66

package/dist-server/server/config.js

@@ -216,6 +216,8 @@ const defaultModelSelectionSchema = z.object({
     effort: z.enum(EFFORT_LEVELS).optional(),
 });
 const appConfigSchema = z.object({
+    /** Verified by the dedicated domain endpoint, never a generic config patch. */
+    customDomain: z.string().optional(),
     defaultModelSelection: defaultModelSelectionSchema.optional(),
     /** CLI-only launch preferences. Never enable remote access implicitly. */
     cliStartup: z.object({
@@ -261,7 +263,7 @@ const appConfigSchema = z.object({
 const storedAppConfigSchema = appConfigSchema.extend({
     browserProfiles: storedBrowserProfilesSchema.optional(),
 });
-const appConfigPatchSchema = appConfigSchema.omit({ instances: true, mcpServers: true, cliStartup: true });
+const appConfigPatchSchema = appConfigSchema.omit({ instances: true, mcpServers: true, cliStartup: true, customDomain: true });
 const jsonObjectSchema = z.record(z.string(), z.json());
 /** Resolve a canonical profile record to its exact durable Electron
  * partition identity. Callers must never substitute the display/API id. */
@@ -511,7 +513,7 @@ export const PROVIDER_CREDENTIAL_ENV = [
 ];
 /** Merge a partial config into ~/.openmausbot/config.json (secrets never
  * echoed back — callers report configured-or-not booleans only). */
-export function saveConfig(patch) {
+export function saveConfig(patch, options = {}) {
     const p = join(DATA_DIR, "config.json");
     let disk = {};
     try {
@@ -543,6 +545,8 @@ export function saveConfig(patch) {
     // scalar, not a section: the merge loop above only walks objects
     if (checkedPatch.language !== undefined)
         disk.language = checkedPatch.language;
+    if (checkedPatch.customDomain !== undefined)
+        disk.customDomain = checkedPatch.customDomain;
     // A selection is replaced as one value, so changing engines also clears
     // an effort level omitted from the new selection.
     if (checkedPatch.defaultModelSelection !== undefined) {
@@ -573,10 +577,17 @@ export function saveConfig(patch) {
     }
     if (checkedPatch.instances) {
         const currentInstances = jsonObjectSchema.safeParse(disk.instances);
-        const diskInstances = currentInstances.success ? currentInstances.data : {};
+        const storedInstances = currentInstances.success ? currentInstances.data : {};
+        const diskInstances = options.replaceInstances ? {} : storedInstances;
         for (const [instanceId, entry] of Object.entries(checkedPatch.instances)) {
-            const current = jsonObjectSchema.safeParse(diskInstances[instanceId]);
+            const current = jsonObjectSchema.safeParse(storedInstances[instanceId]);
             const merged = current.success ? { ...current.data } : {};
+            // Replacement clears omitted known settings, but retained shadow
+            // entries keep fields understood only by a newer app or driver.
+            if (options.replaceInstances) {
+                for (const key of Object.keys(instanceConfigSchema.shape))
+                    delete merged[key];
+            }
             Object.assign(merged, entry);
             diskInstances[instanceId] = merged;
         }
@@ -590,13 +601,13 @@ export function saveConfig(patch) {
  * entry rides driver.defaultConfig(). Returns false for unknown instances
  * when the fleet is explicitly configured. The returned map must stay
  * PERSISTABLE: instanceConfigs() injects credential env into consuming
- * drivers' entries for the live fleet, so those injected keys are stripped
- * back out before the map is returned — otherwise saving an override would
+ * drivers' entries for the live fleet, so only their originally configured
+ * environment is retained — otherwise saving an override would
  * copy xai/box/opencodeGo secrets into the instances section of
  * config.json. */
 export function withInstanceCli(cfg, instanceId, cli) {
     const next = structuredClone(cfg);
-    const map = instanceConfigs(next);
+    const map = persistableInstanceConfigs(next);
     // hasOwn, not truthiness: map is a plain object literal, so
     // map["__proto__"] resolves to Object.prototype — truthy — and the
     // assignment below would poison EVERY object in the process (instanceId
@@ -616,22 +627,22 @@ export function withInstanceCli(cfg, instanceId, cli) {
         delete rest.cli;
         entry.config = Object.keys(rest).length ? rest : undefined;
     }
-    for (const e of Object.values(map)) {
-        if (!e.environment)
-            continue;
-        const injected = injectedEnvironment(next, e.driver);
-        for (const [k, v] of Object.entries(e.environment)) {
-            if (injected.get(k) === v)
-                delete e.environment[k];
-        }
-        if (!Object.keys(e.environment).length)
-            delete e.environment;
-    }
     next.instances = map;
     return { ok: true, config: next };
 }
-/** The credential env instanceConfigs() injects for one driver — shared with
- * withInstanceCli() so the inject rule and the strip rule cannot drift apart.
+/** Materialize defaults without copying injected workspace secrets to disk. */
+export function persistableInstanceConfigs(cfg) {
+    const map = instanceConfigs(cfg);
+    for (const [id, entry] of Object.entries(map)) {
+        const environment = cfg.instances?.[id]?.environment;
+        if (environment)
+            entry.environment = { ...environment };
+        else
+            delete entry.environment;
+    }
+    return map;
+}
+/** The credential env instanceConfigs() injects for one driver at runtime.
  * Each secret goes only to the driver that actually reads it: the API-key
  * Grok driver reads XAI_API_KEY, the Computer driver reads BOX_TOKEN, and
  * OpenCode reads OPENCODE_API_KEY. Every other engine brings its own

package/dist-server/server/custom-domain.js

@@ -0,0 +1,196 @@
+import { randomBytes } from "node:crypto";
+import { lookup as dnsLookup } from "node:dns/promises";
+import { request as httpsRequest } from "node:https";
+import { BlockList, isIP } from "node:net";
+import { networkInterfaces } from "node:os";
+const CHECK_TIMEOUT_MS = 8_000;
+const MAX_RESPONSE_BYTES = 16_384;
+const DESCRIPTOR_PATH = "/.well-known/openmausbot/environment";
+export const CUSTOM_DOMAIN_CHALLENGE_PATH = "/.well-known/openmausbot/domain-check/";
+export class CustomDomainError extends Error {
+    status;
+    constructor(message, status = 400) {
+        super(message);
+        this.name = "CustomDomainError";
+        this.status = status;
+    }
+}
+/** A public domain on standard HTTPS, never an invitation or arbitrary URL. */
+export function normalizeCustomDomain(raw) {
+    const value = raw.trim();
+    // Reject characters URL parsing otherwise removes or interprets as secrets.
+    // eslint-disable-next-line no-control-regex
+    if (!value || value.length > 512 || /[\s\u0000-\u001f\u007f\\?#@%]/.test(value)) {
+        throw new CustomDomainError("Enter a domain such as bots.yourcompany.com, without a path, password, or pairing code.");
+    }
+    try {
+        const url = new URL(value.includes("://") ? value : `https://${value}`);
+        const host = url.hostname.toLowerCase().replace(/\.$/, "");
+        if (url.protocol !== "https:" || url.port || url.pathname !== "/" || url.username || url.password
+            || isIP(host) || host.startsWith("[") || host.length > 253 || !host.includes(".")
+            || !host.split(".").every((part) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(part))
+            || /(?:^|\.)(?:localhost|local|internal|invalid|test)$/.test(host))
+            throw new Error("invalid origin");
+        return `https://${host}`;
+    }
+    catch {
+        throw new CustomDomainError("Use a public domain with HTTPS on port 443, without a path or pairing code.");
+    }
+}
+const excludedAddresses = new BlockList();
+for (const [address, prefix] of [
+    ["0.0.0.0", 8], ["10.0.0.0", 8], ["100.64.0.0", 10], ["127.0.0.0", 8],
+    ["169.254.0.0", 16], ["172.16.0.0", 12], ["192.0.0.0", 24], ["192.0.2.0", 24],
+    ["192.88.99.0", 24], ["192.168.0.0", 16], ["198.18.0.0", 15], ["198.51.100.0", 24],
+    ["203.0.113.0", 24], ["224.0.0.0", 4], ["240.0.0.0", 4],
+])
+    excludedAddresses.addSubnet(address, prefix, "ipv4");
+for (const [address, prefix] of [
+    ["2001::", 23], ["2001:db8::", 32], ["2002::", 16], ["3fff::", 20],
+])
+    excludedAddresses.addSubnet(address, prefix, "ipv6");
+const globalIpv6 = new BlockList();
+globalIpv6.addSubnet("2000::", 3, "ipv6");
+/** Exclude private, mapped/NAT64, multicast, documentation, and reserved ranges. */
+export function isPublicDomainAddress(address) {
+    const family = isIP(address);
+    if (family === 4)
+        return !excludedAddresses.check(address, "ipv4");
+    return family === 6 && globalIpv6.check(address, "ipv6") && !excludedAddresses.check(address, "ipv6");
+}
+/** Local interfaces only: a tunnel/CDN address or an external IP-echo service
+ * does not identify the server where the customer's HTTPS proxy runs. */
+export function customDomainIpv4(interfaces = networkInterfaces(), configured = process.env.OMB_PUBLIC_IPV4) {
+    if (configured?.trim()) {
+        const address = configured.trim();
+        return isIP(address) === 4 && isPublicDomainAddress(address) ? address : null;
+    }
+    const addresses = new Set(Object.values(interfaces).flatMap((entries) => entries ?? [])
+        .filter((entry) => !entry.internal && entry.family === "IPv4" && isPublicDomainAddress(entry.address))
+        .map((entry) => entry.address));
+    // Containers/NAT and multi-address hosts need an explicit operator choice.
+    return addresses.size === 1 ? [...addresses][0] : null;
+}
+function withAbort(promise, signal) {
+    return new Promise((resolve, reject) => {
+        const abort = () => reject(new CustomDomainError("The domain check timed out. Check DNS, HTTPS, and your reverse proxy, then try again."));
+        if (signal.aborted) {
+            abort();
+            return;
+        }
+        signal.addEventListener("abort", abort, { once: true });
+        promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+    });
+}
+function requestJson(url, address, signal) {
+    return new Promise((resolve, reject) => {
+        // Pin the validated DNS result for both requests. TLS/SNI and Host still use
+        // the original domain, so a DNS rebind cannot reach a private IP afterwards.
+        const lookup = (_hostname, options, callback) => {
+            if (options.all)
+                callback(null, [address]);
+            else
+                callback(null, address.address, address.family);
+        };
+        const request = httpsRequest(url, {
+            method: "GET", agent: false, lookup, signal, rejectUnauthorized: true,
+            headers: { Accept: "application/json", "User-Agent": "OpenMausBot-domain-check" },
+        }, (response) => {
+            // Node's HTTPS client does not follow Location redirects.
+            if (response.statusCode !== 200) {
+                response.destroy();
+                reject(new CustomDomainError("The domain did not return the OpenMausBot verification page. Check your reverse proxy; redirects are not supported."));
+                return;
+            }
+            const chunks = [];
+            let size = 0;
+            response.on("error", reject);
+            response.on("data", (chunk) => {
+                size += chunk.length;
+                if (size > MAX_RESPONSE_BYTES) {
+                    response.destroy();
+                    reject(new CustomDomainError("The domain returned an unexpected response. Check that it points to OpenMausBot."));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            response.on("end", () => {
+                try {
+                    resolve(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+                }
+                catch {
+                    reject(new CustomDomainError("The domain did not return OpenMausBot data. Check that it points to this server."));
+                }
+            });
+        });
+        request.on("error", reject);
+        request.end();
+    });
+}
+/** Verification only: callers persist the returned origin after success. The
+ * public challenge endpoint reveals no account credentials and grants no access. */
+export function createCustomDomainVerifier(dependencies) {
+    const lookup = dependencies.lookup ?? ((hostname) => dnsLookup(hostname, { all: true, verbatim: true }));
+    const request = dependencies.request ?? requestJson;
+    let inFlight = false;
+    let active = null;
+    return {
+        challenge(token) {
+            if (!active || Date.now() >= active.expiresAt || token !== active.token)
+                return null;
+            return { environmentId: dependencies.environmentId, proof: active.proof };
+        },
+        async verify(raw) {
+            const origin = normalizeCustomDomain(raw);
+            if (inFlight)
+                throw new CustomDomainError("A domain check is already running. Wait for it to finish, then try again.", 409);
+            inFlight = true;
+            const controller = new AbortController();
+            const timeoutMs = dependencies.timeoutMs ?? CHECK_TIMEOUT_MS;
+            const timer = setTimeout(() => controller.abort(), timeoutMs);
+            try {
+                let addresses;
+                try {
+                    addresses = await withAbort(lookup(new URL(origin).hostname), controller.signal);
+                }
+                catch (error) {
+                    if (error instanceof CustomDomainError)
+                        throw error;
+                    throw new CustomDomainError("The domain could not be found in DNS. Add its A or AAAA record and allow time for it to become available.");
+                }
+                if (!addresses.length || addresses.some((entry) => !isPublicDomainAddress(entry.address)
+                    || isIP(entry.address) !== entry.family)) {
+                    throw new CustomDomainError("The domain must resolve only to public internet addresses. Local, private, and reserved addresses cannot be connected here.");
+                }
+                // Prefer IPv4 where both exist; use the exact same address for proof.
+                const address = addresses.find((entry) => entry.family === 4) ?? addresses[0];
+                const descriptor = await withAbort(request(new URL(DESCRIPTOR_PATH, origin), address, controller.signal), controller.signal);
+                if (!descriptor || typeof descriptor !== "object"
+                    || Reflect.get(descriptor, "environmentId") !== dependencies.environmentId) {
+                    throw new CustomDomainError("This domain does not point to this OpenMausBot server. Check its DNS and reverse proxy configuration.");
+                }
+                active = {
+                    token: randomBytes(32).toString("hex"), proof: randomBytes(32).toString("hex"),
+                    expiresAt: Date.now() + timeoutMs,
+                };
+                const proof = await withAbort(request(new URL(`${CUSTOM_DOMAIN_CHALLENGE_PATH}${active.token}`, origin), address, controller.signal), controller.signal);
+                if (!proof || typeof proof !== "object" || Reflect.get(proof, "environmentId") !== dependencies.environmentId
+                    || Reflect.get(proof, "proof") !== active.proof) {
+                    throw new CustomDomainError("The domain could not prove it reaches this server. Forward all OpenMausBot routes through your reverse proxy and try again.");
+                }
+                return { origin, verifiedAt: new Date().toISOString() };
+            }
+            catch (error) {
+                if (error instanceof CustomDomainError)
+                    throw error;
+                throw new CustomDomainError("A secure connection to the domain could not be verified. Check its HTTPS certificate, firewall, and reverse proxy.");
+            }
+            finally {
+                clearTimeout(timer);
+                controller.abort();
+                active = null;
+                inFlight = false;
+            }
+        },
+    };
+}

package/dist-server/server/drivers/claude.js

@@ -12,7 +12,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { chmodSync, mkdtempSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { createServer as createNetServer } from "node:net";
 import { homedir, tmpdir } from "node:os";
-import { join, dirname } from "node:path";
+import { join, dirname, isAbsolute, normalize } from "node:path";
 import { DATA_DIR, stripWorkspaceCredentialEnv } from "../config.js";
 import { augmentedPath } from "../env-path.js";
 import { brokerSocketPath, describeSpawnFailure, execCli, killCliTree, spawnCli } from "../procs.js";
@@ -29,19 +29,61 @@ import { SPAWNED_PROXIES } from "../proxy-paths.js";
  * backends over time. Presence checks also accept stale credentials. The CLI's
  * own machine-readable auth command is the source of truth for every backend.
  */
-export function claudeSignedIn(cli, env, run = execCli) {
+function claudeAuthStatus(cli, env, run = execCli) {
     return new Promise((resolve) => {
-        run(cli, ["auth", "status", "--json"], { timeout: 8000, env }, (_error, stdout) => {
+        run(cli, ["auth", "status", "--json"], { timeout: 8000, maxBuffer: 65_536, env }, (_error, stdout) => {
             try {
                 const status = JSON.parse(stdout);
-                resolve(typeof status === "object" && status !== null && "loggedIn" in status && status.loggedIn === true);
+                if (!status || typeof status !== "object" || !("loggedIn" in status) || status.loggedIn !== true) {
+                    return resolve({ authenticated: false });
+                }
+                // Only display identity fields, never the CLI's full auth response.
+                const identity = status;
+                const boundedText = (value, max) => typeof value === "string" && value.trim().length > 0 && value.length <= max && !/[\p{Cc}\p{Cf}]/u.test(value)
+                    ? value.trim() : undefined;
+                const candidateEmail = boundedText(identity.email, 254);
+                const email = candidateEmail && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(candidateEmail) ? candidateEmail : undefined;
+                const organization = boundedText(identity.orgName, 160);
+                resolve({
+                    authenticated: true,
+                    ...(email || organization ? { account: { ...(email ? { email } : {}), ...(organization ? { organization } : {}) } } : {}),
+                });
             }
             catch {
-                resolve(false);
+                resolve({ authenticated: false });
             }
         });
     });
 }
+export async function claudeSignedIn(cli, env, run = execCli) {
+    return (await claudeAuthStatus(cli, env, run)).authenticated;
+}
+/** Parent-session credentials/routing that a named account must not inherit.
+ * Shared with terminal sign-in instructions so login and turns select alike. */
+export const CLAUDE_ACCOUNT_ENV_KEYS = [
+    "CLAUDE_CODE_OAUTH_TOKEN",
+    "CLAUDE_CODE_OAUTH_REFRESH_TOKEN",
+    "CLAUDE_CODE_OAUTH_SCOPES",
+    "CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR",
+    "CLAUDE_CODE_API_KEY_FILE_DESCRIPTOR",
+    "ANTHROPIC_API_KEY",
+    "ANTHROPIC_AUTH_TOKEN",
+    "ANTHROPIC_BASE_URL",
+    "ANTHROPIC_CUSTOM_HEADERS",
+    "CLAUDE_CODE_USE_BEDROCK",
+    "CLAUDE_CODE_USE_VERTEX",
+    "CLAUDE_CODE_USE_FOUNDRY",
+];
+/** Resolve the CLI's config location without changing HOME or Keychain. */
+export function resolveClaudeConfigDir(configDir, env = process.env) {
+    const home = env.HOME || env.USERPROFILE || homedir();
+    const configured = configDir?.trim() || env.CLAUDE_CONFIG_DIR?.trim() || join(home, ".claude");
+    const expanded = configured === "~" ? home : configured.startsWith("~/") ? join(home, configured.slice(2)) : configured;
+    if (!isAbsolute(expanded) || /[\p{Cc}\p{Cf}]/u.test(expanded)) {
+        throw new Error("claude: configDir must be an absolute path or start with ~/");
+    }
+    return normalize(expanded);
+}
 /** Whether a stream frame is the CLI reporting that it has no login.
  *
  * The CLI flags its own api-error frames (`error`, `is_api_error_message`);
@@ -63,8 +105,21 @@ export function claudeAuthFailure(frame, text) {
  * Keeping the probe and turn environments identical prevents setup from
  * claiming an API-key login that the turn itself would deliberately remove.
  */
-function claudeEnvironment(model, source = process.env) {
+function claudeEnvironment(model, source = process.env, configDir, instanceEnvironment = {}) {
     const env = { ...source, PATH: augmentedPath(), NPM_CONFIG_LOGLEVEL: "error" };
+    if (configDir?.trim()) {
+        env.CLAUDE_CONFIG_DIR = resolveClaudeConfigDir(configDir, env);
+        for (const key of CLAUDE_ACCOUNT_ENV_KEYS) {
+            // Explicit custom endpoint settings still work; subscription OAuth
+            // always belongs to this account's CLI-managed login, never its parent.
+            if (key.startsWith("CLAUDE_CODE_OAUTH_") || key.endsWith("_FILE_DESCRIPTOR") || !Object.hasOwn(instanceEnvironment, key)) {
+                delete env[key];
+            }
+        }
+    }
+    else if (env.CLAUDE_CONFIG_DIR) {
+        env.CLAUDE_CONFIG_DIR = resolveClaudeConfigDir(undefined, env);
+    }
     delete env.CLAUDECODE;
     delete env.CLAUDE_CODE_ENTRYPOINT;
     // The harness process may hold workspace credentials (xai/box/voice keys,
@@ -97,11 +152,6 @@ async function resolveClaudeTurnModel(model, env) {
     }
     return resolveInjectId(model, await probeLocalInjects(env)) ?? model;
 }
-function claudeConfigDir(env) {
-    if (env.CLAUDE_CONFIG_DIR)
-        return env.CLAUDE_CONFIG_DIR;
-    return join(env.HOME || env.USERPROFILE || homedir(), ".claude");
-}
 function extrasFromUnknown(value) {
     if (!Array.isArray(value))
         return [];
@@ -127,7 +177,7 @@ function extrasFromUnknown(value) {
 export function readClaudeModelCatalog(env = process.env) {
     let settings = {};
     try {
-        settings = JSON.parse(readFileSync(join(claudeConfigDir(env), "settings.json"), "utf8"));
+        settings = JSON.parse(readFileSync(join(resolveClaudeConfigDir(undefined, env), "settings.json"), "utf8"));
     }
     catch {
         return STATIC_CLAUDE_MODELS;
@@ -446,8 +496,14 @@ function decodeConfig(raw) {
     }
     const tools = decodeToolList(o.tools, "tools");
     const disallowedTools = decodeToolList(o.disallowedTools, "disallowedTools");
+    if (o.configDir !== undefined && typeof o.configDir !== "string")
+        throw new Error("claude: configDir must be a string");
+    const configDir = typeof o.configDir === "string" ? o.configDir.trim() : undefined;
+    if (configDir)
+        resolveClaudeConfigDir(configDir);
     return {
         cli: typeof o.cli === "string" ? o.cli : "claude",
+        ...(configDir ? { configDir } : {}),
         permissionMode: mode ?? "acceptEdits",
         ...(tools !== undefined ? { tools } : {}),
         ...(disallowedTools !== undefined ? { disallowedTools } : {}),
@@ -523,7 +579,8 @@ export const ClaudeDriver = {
     defaultConfig: () => decodeConfig({}),
     async create(input) {
         const { instanceId, config } = input;
-        const catalogEnv = { ...process.env, ...input.environment };
+        const environment = (model) => claudeEnvironment(model, { ...process.env, ...input.environment }, config.configDir, input.environment);
+        const catalogEnv = environment();
         let models = STATIC_CLAUDE_MODELS;
         const refreshModels = async () => {
             try {
@@ -659,7 +716,7 @@ export const ClaudeDriver = {
             if (config.disallowedTools?.length) {
                 args.push("--disallowedTools", config.disallowedTools.join(","));
             }
-            const turnEnvironment = { ...process.env, ...input.environment };
+            const turnEnvironment = environment();
             const turnModel = await resolveClaudeTurnModel(turn.model, turnEnvironment);
             const injected = applyClaudeInject({ ...turnEnvironment }, turnModel);
             if (injected.model)
@@ -762,7 +819,7 @@ export const ClaudeDriver = {
                 args.push("--mcp-config", mcpConfigPath);
                 args.push("--allowedTools", allowed.join(","));
             }
-            const env = claudeEnvironment(turnModel, turnEnvironment);
+            const env = environment(turnModel);
             // Our approvals and browser credentials expire at the user-turn
             // boundary. Native background workers cannot outlive that boundary;
             // parallel bot work must use the harness's durable delegate_bot path.
@@ -779,6 +836,7 @@ export const ClaudeDriver = {
                 cwd,
                 model: injected.model ?? null,
                 base: env.ANTHROPIC_BASE_URL ?? null,
+                configDir: env.CLAUDE_CONFIG_DIR ?? null,
             });
             // Reuse the live process when it is idle, unchanged, and is the session
             // the harness wants resumed. Anything else: close it and spawn fresh
@@ -1230,17 +1288,17 @@ export const ClaudeDriver = {
             return writeUser(s, threadId, claudeUserMessage(text, undefined));
         };
         const snapshot = async () => {
-            const env = claudeEnvironment(undefined, { ...process.env, ...input.environment });
+            const env = environment();
             const version = await new Promise((resolve) => {
                 execCli(config.cli, ["--version"], { timeout: 8000, env }, (err, stdout) => resolve(err ? null : stdout.trim()));
             });
             if (!version)
                 return { state: "unavailable", reason: `\`${config.cli}\` CLI not found` };
-            const authenticated = await claudeSignedIn(config.cli, env);
+            const auth = await claudeAuthStatus(config.cli, env);
             // claudeEnvironment strips ANTHROPIC_API_KEY, so turns run on the
             // CLI's own login (Pro/Max): the cost it reports is what the call
             // WOULD bill, not a charge
-            return { state: "available", version, authenticated, billing: "subscription" };
+            return { state: "available", version, ...auth, billing: "subscription" };
         };
         /** One-shot Claude call with the prompt on stdin, never argv. Approval
          * summaries can contain paths, commands, or secrets, so the generic
@@ -1249,7 +1307,7 @@ export const ClaudeDriver = {
         const generateReview = (prompt, signal) => new Promise((resolve, reject) => {
             const child = spawnCli(config.cli, ["-p", "--model", "claude-haiku-4-5", "--output-format", "text"], {
                 stdio: ["pipe", "pipe", "pipe"],
-                env: claudeEnvironment("claude-haiku-4-5", { ...process.env, ...input.environment }),
+                env: environment("claude-haiku-4-5"),
             });
             let stdout = "";
             let stderr = "";