shadok-ai 0.17.7 → 0.17.8

package/README.md

@@ -487,6 +487,20 @@ is never shown. It is valid for about a year; re-run the card (or `/mttoken`)
 before it expires. The shell path still works as a fallback: `claude setup-token`
 and store the result as the vault secret `MT_CLAUDE_OAUTH_TOKEN`.
 
+**Connectors: token vs login.** That token can only make model requests — it
+does **not** carry your claude.ai **Connectors** (Slack, Google Workspace,
+Microsoft 365, Atlassian, …). If you want agents to use your connectors, switch
+the instance's **agent auth mode** to **login**: instead of the token, each OS
+user (the shared *commons* user, plus each private group's user) does a one-time
+`claude auth login` from the cockpit, into its own home, and its agents then see
+the connectors. The trade-off is lifetime: a login lasts about a **month** (vs a
+year for the token) and is **per user**, so the cockpit shows a status row per
+user and reminds you to reconnect before each lapses. The default stays
+**token** — nothing changes until an admin switches. A login is never shared
+across OS users (Claude rewrites the credential single-owner on refresh), which
+is why each user logs in separately. Design:
+`docs/superpowers/specs/2026-11-04-connectors-via-global-login-design.md`.
+
 Telegram stays single-owner, and there are no
 disk quotas yet. Design: `docs/superpowers/specs/2026-10-29-multi-tenant-scoped-isolation-design.md`.
 

package/dist/agent-login.d.ts

@@ -0,0 +1,36 @@
+/** The credential file a login writes, under the user's own home. */
+export declare function credPathForHome(home: string): string;
+/**
+ * Whether `home` holds a login, and when it lapses — the two facts the cockpit
+ * needs for the per-user status row. NEVER returns the token value; reads only
+ * `refreshToken` presence and `refreshTokenExpiresAt` (~1 month).
+ */
+export declare function agentLoginInfo(home: string): {
+    loggedIn: boolean;
+    expiresAt: number | null;
+};
+export declare function agentLoginPending(user: string): boolean;
+export declare function cancelAgentLogin(user: string): void;
+/**
+ * Start `claude auth login --claudeai` as `user` (HOME `home`) in a detached
+ * tmux pane and resolve the OAuth URL. Reuses a live flow that already printed a
+ * URL (a reload must not kill the link the operator is looking at — each flow
+ * carries its own PKCE challenge).
+ */
+export declare function startAgentLogin(user: string, home: string): Promise<{
+    url: string;
+} | {
+    error: string;
+}>;
+/**
+ * Submit the pasted code for `user`'s login. Types it into the masked box, waits
+ * for it to land, presses Enter, then watches for SUCCESS (a fresh credential
+ * file in the user's home) or the invalid-code refusal. The credential is never
+ * read for its contents, logged, or returned.
+ */
+export declare function submitAgentLoginCode(user: string, code: string): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+}>;

package/dist/agent-login.js

@@ -0,0 +1,240 @@
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { claudeCommand } from "./claude-bin.js";
+import { tmuxAvailable, tmuxHasSession, tmuxKillSession } from "./tmux.js";
+import { dropArgv } from "./osusers.js";
+import { parseSetupTokenUrl, parseSetupTokenOutcome } from "./setup-token.js";
+/**
+ * In-cockpit `claude auth login --claudeai` for a SINGLE OS user, in `login`
+ * auth mode (`config.agentAuth === "login"`). Unlike `setup-token.ts` (which
+ * mints the server-owned long-lived token and runs as the server user), this
+ * drives an interactive subscription login AS a dropped user (`main`, or a
+ * private group's `sk-*`), so the credential lands in THAT user's own
+ * `~/.claude/.credentials.json` and that user's agents get the account's
+ * claude.ai connectors.
+ *
+ * Why per-user and never shared across users: `claude` refreshes the on-disk
+ * credential by write-new-then-rename, leaving it owned by the refresher in mode
+ * 600 — so a credential shared between DIFFERENT OS users locks the others out on
+ * the first refresh (measured, ledger `[45be]`/`[2d5c]`). Same-user agents share
+ * one login natively (one uid, one real file); that is all we rely on.
+ *
+ * Mechanics mirror `setup-token.ts`: a detached tmux pane (a real TTY for the
+ * CLI's `isatty` gate; `capture-pane -p` reads already-rendered text), the pane
+ * set wide so the ~350-char URL never wraps, and the SAME OAuth screens — so the
+ * URL and invalid-code parsers are reused from there. The difference is success
+ * detection: there is no token on screen; success is the credential FILE
+ * appearing in the user's home (an observed fact, invariant 27). The credential
+ * value is never read for its contents, logged, or returned.
+ *
+ * Design: docs/superpowers/specs/2026-11-04-connectors-via-global-login-design.md
+ */
+/** The OAuth URL expires anyway; a child holding the session forever is worse. */
+const FLOW_IDLE_MS = 10 * 60_000;
+/** Wide enough that the ~350-char authorize URL never wraps. */
+const PANE_COLS = 400;
+const PANE_ROWS = 50;
+/** One flow per OS user; the tmux session name is derived from the user. */
+function sessionFor(user) {
+    return `sk-login-${user}`;
+}
+/** The credential file a login writes, under the user's own home. */
+export function credPathForHome(home) {
+    return path.join(home, ".claude", ".credentials.json");
+}
+/**
+ * Whether `home` holds a login, and when it lapses — the two facts the cockpit
+ * needs for the per-user status row. NEVER returns the token value; reads only
+ * `refreshToken` presence and `refreshTokenExpiresAt` (~1 month).
+ */
+export function agentLoginInfo(home) {
+    try {
+        const d = JSON.parse(fs.readFileSync(credPathForHome(home), "utf8"));
+        const o = d.claudeAiOauth ?? d;
+        return {
+            loggedIn: !!o.refreshToken,
+            expiresAt: typeof o.refreshTokenExpiresAt === "number" ? o.refreshTokenExpiresAt : null,
+        };
+    }
+    catch {
+        return { loggedIn: false, expiresAt: null };
+    }
+}
+const flows = new Map();
+function tmux(args, input) {
+    return execFileSync("tmux", args, {
+        encoding: "utf8",
+        input,
+        timeout: 10_000,
+        maxBuffer: 8 * 1024 * 1024,
+        stdio: ["pipe", "pipe", "ignore"],
+    });
+}
+function capture(session) {
+    try {
+        return tmux(["capture-pane", "-t", session, "-p"]);
+    }
+    catch {
+        return "";
+    }
+}
+function sleep(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+/** mtime of the credential file in ms, or 0 if absent/unreadable. */
+function credMtime(home) {
+    try {
+        return fs.statSync(credPathForHome(home)).mtimeMs;
+    }
+    catch {
+        return 0;
+    }
+}
+export function agentLoginPending(user) {
+    const f = flows.get(user);
+    return !!f && !f.ended && tmuxHasSession(sessionFor(user));
+}
+export function cancelAgentLogin(user) {
+    const f = flows.get(user);
+    if (f)
+        clearTimeout(f.timer);
+    tmuxKillSession(sessionFor(user));
+    flows.delete(user);
+}
+/**
+ * Start `claude auth login --claudeai` as `user` (HOME `home`) in a detached
+ * tmux pane and resolve the OAuth URL. Reuses a live flow that already printed a
+ * URL (a reload must not kill the link the operator is looking at — each flow
+ * carries its own PKCE challenge).
+ */
+export async function startAgentLogin(user, home) {
+    const session = sessionFor(user);
+    const live = flows.get(user);
+    if (live && !live.ended && live.url && tmuxHasSession(session))
+        return { url: live.url };
+    cancelAgentLogin(user);
+    if (!tmuxAvailable())
+        return { error: "tmux is not available on this host — it is required to run the login" };
+    // Drop to the target user (setpriv) and run the login. `env` unsets any
+    // inherited CLAUDE*/CLAUDECODE/AI_AGENT vars (a parent token or child-session
+    // marker must not reach this login) and sets the user's own HOME so the
+    // credential lands in that home; BROWSER is neutralised so the CLI never opens
+    // a tab on the server. Each token single-quoted for the shell tmux runs.
+    const bin = claudeCommand();
+    const drop = dropArgv(user, bin, ["auth", "login", "--claudeai"]);
+    const unset = Object.keys(process.env)
+        .filter((k) => /^(CLAUDE|CLAUDECODE|AI_AGENT)/.test(k))
+        .flatMap((k) => ["-u", k]);
+    const cmd = [
+        "env",
+        ...unset,
+        `HOME=${home}`,
+        `USER=${user}`,
+        `LOGNAME=${user}`,
+        "TERM=xterm-256color",
+        "BROWSER=/usr/bin/true",
+        drop.cmd,
+        ...drop.argv,
+    ]
+        .map((a) => `'${String(a).replace(/'/g, "'\\''")}'`)
+        .join(" ");
+    try {
+        tmuxKillSession(session);
+        tmux(["new-session", "-d", "-s", session, "-x", String(PANE_COLS), "-y", String(PANE_ROWS), cmd]);
+    }
+    catch (e) {
+        return { error: "could not start the login: " + (e instanceof Error ? e.message : String(e)) };
+    }
+    const f = {
+        user,
+        home,
+        url: null,
+        ended: false,
+        priorMtime: credMtime(home),
+        timer: setTimeout(() => cancelAgentLogin(user), FLOW_IDLE_MS),
+    };
+    flows.set(user, f);
+    const deadline = Date.now() + 30_000;
+    while (Date.now() < deadline) {
+        if (flows.get(user) !== f || f.ended)
+            return { error: "the login ended before printing a URL" };
+        if (!tmuxHasSession(session)) {
+            cancelAgentLogin(user);
+            return { error: "the login ended before printing a URL" };
+        }
+        const url = parseSetupTokenUrl(capture(session));
+        if (url) {
+            f.url = url;
+            return { url };
+        }
+        await sleep(300);
+    }
+    cancelAgentLogin(user);
+    return { error: "the login printed no URL within 30s" };
+}
+/**
+ * Submit the pasted code for `user`'s login. Types it into the masked box, waits
+ * for it to land, presses Enter, then watches for SUCCESS (a fresh credential
+ * file in the user's home) or the invalid-code refusal. The credential is never
+ * read for its contents, logged, or returned.
+ */
+export async function submitAgentLoginCode(user, code) {
+    const session = sessionFor(user);
+    const f = flows.get(user);
+    if (!f || f.ended || !tmuxHasSession(session))
+        return { ok: false, error: "no login is in progress for this user — start one first" };
+    const trimmed = code.trim();
+    if (!trimmed)
+        return { ok: false, error: "empty code" };
+    clearTimeout(f.timer);
+    f.timer = setTimeout(() => cancelAgentLogin(user), FLOW_IDLE_MS);
+    try {
+        tmux(["send-keys", "-t", session, "-l", "--", trimmed]);
+    }
+    catch {
+        return { ok: false, error: "the login ended — start a new one and try again" };
+    }
+    const entered = Date.now() + 4_000;
+    while (Date.now() < entered) {
+        const line = capture(session).split("\n").find((l) => /Paste code here/i.test(l)) ?? "";
+        if (/Paste code here[^>]*>\s*\S/i.test(line))
+            break;
+        await sleep(200);
+    }
+    try {
+        tmux(["send-keys", "-t", session, "Enter"]);
+    }
+    catch {
+        return { ok: false, error: "the login ended — start a new one and try again" };
+    }
+    const deadline = Date.now() + 30_000;
+    while (Date.now() < deadline) {
+        // Success is the credential file appearing (or being rewritten) — a fresh
+        // mtime beats the one captured at start. We never read its contents.
+        if (credMtime(f.home) > f.priorMtime) {
+            cancelAgentLogin(user);
+            return { ok: true };
+        }
+        if (parseSetupTokenOutcome(capture(session)) === "invalid-code") {
+            try {
+                tmux(["send-keys", "-t", session, "Enter"]); // back to the paste prompt
+            }
+            catch {
+                /* session gone — the next submit reports it */
+            }
+            return { ok: false, error: "Invalid code. Please make sure the full code was copied." };
+        }
+        if (!tmuxHasSession(session)) {
+            f.ended = true;
+            cancelAgentLogin(user);
+            // The pane can exit right after writing the credential; re-check the file.
+            return credMtime(f.home) > f.priorMtime
+                ? { ok: true }
+                : { ok: false, error: "the login ended — start a new one and try again" };
+        }
+        await sleep(300);
+    }
+    return { ok: false, error: "the login did not complete within 30s" };
+}
+//# sourceMappingURL=agent-login.js.map

package/dist/agent-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-login.js","sourceRoot":"","sources":["../src/agent-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,kFAAkF;AAClF,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC;AACjC,gEAAgE;AAChE,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,4EAA4E;AAC5E,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,YAAY,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC;QAC/B,OAAO;YACL,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;YAC1B,SAAS,EAAE,OAAO,CAAC,CAAC,qBAAqB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI;SACxF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;AACH,CAAC;AAYD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;AAEtC,SAAS,IAAI,CAAC,IAAc,EAAE,KAAc;IAC1C,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE;QAChC,QAAQ,EAAE,MAAM;QAChB,KAAK;QACL,OAAO,EAAE,MAAM;QACf,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;QAC1B,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;KAClC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,qEAAqE;AACrE,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC;QAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC7B,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAClC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,IAAY;IAEZ,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IACzF,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,aAAa,EAAE;QAClB,OAAO,EAAE,KAAK,EAAE,sEAAsE,EAAE,CAAC;IAE3F,wEAAwE;IACxE,8EAA8E;IAC9E,wEAAwE;IACxE,+EAA+E;IAC/E,yEAAyE;IACzE,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;SACnC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SACtD,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG;QACV,KAAK;QACL,GAAG,KAAK;QACR,QAAQ,IAAI,EAAE;QACd,QAAQ,IAAI,EAAE;QACd,WAAW,IAAI,EAAE;QACjB,qBAAqB;QACrB,uBAAuB;QACvB,IAAI,CAAC,GAAG;QACR,GAAG,IAAI,CAAC,IAAI;KACb;SACE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;SACnD,IAAI,CAAC,GAAG,CAAC,CAAC;IAEb,IAAI,CAAC;QACH,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACpG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,6BAA6B,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,CAAC;IAED,MAAM,CAAC,GAAS;QACd,IAAI;QACJ,IAAI;QACJ,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC;QAC3B,KAAK,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;KAC9D,CAAC;IACF,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEnB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;QAChG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;QAC5D,CAAC;QACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACjD,IAAI,GAAG,EAAE,CAAC;YACR,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;YACZ,OAAO,EAAE,GAAG,EAAE,CAAC;QACjB,CAAC;QACD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,IAAY;IAEZ,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yDAAyD,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAExD,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;IAEjE,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;IACjF,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;IACnC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxF,IAAI,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM;QACpD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;IACjF,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,0EAA0E;QAC1E,qEAAqE;QACrE,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC;YACrC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;YAChE,IAAI,CAAC;gBACH,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,2BAA2B;YAC1E,CAAC;YAAC,MAAM,CAAC;gBACP,+CAA+C;YACjD,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0DAA0D,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC;YACf,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACvB,2EAA2E;YAC3E,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU;gBACrC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;QAC9E,CAAC;QACD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;AACvE,CAAC"}

package/dist/config.d.ts

@@ -77,6 +77,19 @@ export interface Config {
      * name and palette.
      */
     cockpitMuted?: Record<string, boolean>;
+    /**
+     * Per launch-directory agent auth mode (multi-tenant only), keyed by absolute
+     * cwd. `"token"` (default, absent) = the ~1-year `setup-token`
+     * (`MT_CLAUDE_OAUTH_TOKEN`) injected into every dropped agent — no claude.ai
+     * connectors. `"login"` = no token injection; each OS user (commons `main` +
+     * each private group's `sk-*`) does its own interactive `claude auth login`
+     * once into its OWN home, so agents get the account's connectors (~1 month,
+     * per-user reconnect). Cross-user credential sharing is never used (the refresh
+     * rewrite is single-owner, see the design doc); only same-user agents share a
+     * login, which they do natively. Takes effect at an agent's next (re)spawn.
+     * Design: docs/superpowers/specs/2026-11-04-connectors-via-global-login-design.md
+     */
+    agentAuth?: Record<string, "token" | "login">;
     /**
      * Per launch-directory two-factor sign-in (a passkey after the password),
      * keyed by absolute cwd. Absent = off. Turned on from the Users panel, under
@@ -128,6 +141,17 @@ export declare function mutedForCwd(cfg: Config, cwd: string): boolean;
  * removes the entry — the default is "not muted", stored as absent.
  */
 export declare function setMutedForCwd(cfg: Config, cwd: string, on: boolean): void;
+/**
+ * This instance's agent auth mode: `"login"` only when explicitly set, else
+ * `"token"` (the default and today's behaviour). Any unknown value reads as
+ * `"token"` — a malformed config never silently switches auth.
+ */
+export declare function agentAuthForCwd(cfg: Config, cwd: string): "token" | "login";
+/**
+ * Set (or clear) this directory's agent auth mode and persist. `"token"` (the
+ * default) removes the entry, so the instance falls back to it.
+ */
+export declare function setAgentAuthForCwd(cfg: Config, cwd: string, mode: "token" | "login"): void;
 /** The model backend chosen for the instance launched in `cwd`, or null. */
 export declare function backendForCwd(cfg: Config, cwd: string): ConfiguredBackend | null;
 /** Set (or clear, with null) that backend and persist. */

package/dist/config.js

@@ -90,6 +90,26 @@ export function setMutedForCwd(cfg, cwd, on) {
         delete cfg.cockpitMuted[cwd];
     saveConfig(cfg);
 }
+/**
+ * This instance's agent auth mode: `"login"` only when explicitly set, else
+ * `"token"` (the default and today's behaviour). Any unknown value reads as
+ * `"token"` — a malformed config never silently switches auth.
+ */
+export function agentAuthForCwd(cfg, cwd) {
+    return cfg.agentAuth?.[cwd] === "login" ? "login" : "token";
+}
+/**
+ * Set (or clear) this directory's agent auth mode and persist. `"token"` (the
+ * default) removes the entry, so the instance falls back to it.
+ */
+export function setAgentAuthForCwd(cfg, cwd, mode) {
+    cfg.agentAuth ??= {};
+    if (mode === "login")
+        cfg.agentAuth[cwd] = "login";
+    else
+        delete cfg.agentAuth[cwd];
+    saveConfig(cfg);
+}
 /** The model backend chosen for the instance launched in `cwd`, or null. */
 export function backendForCwd(cfg, cwd) {
     return cfg.modelBackend?.[cwd] ?? null;

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAkG7B,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AAChE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AACzD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;AAEzD,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,qCAAqC;AACzE,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,GAAW,EAAE,KAAoB;IAC3E,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACjC,UAAU,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,GAAW,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC3F,IAAI,GAAG,CAAC,kBAAkB;QAAE,OAAO,GAAG,CAAC,kBAAkB,CAAC;IAC1D,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AACnC,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,GAAW,EAAE,KAAa;IACpE,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,GAAG,CAAC,YAAY,KAAK,EAAE,CAAC;IACxB,IAAI,CAAC;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;QAC5B,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAClC,UAAU,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAE/F,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,IAAK,cAAoC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,GAAW,EAAE,KAAa;IACpE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/B,GAAG,CAAC,YAAY,KAAK,EAAE,CAAC;IACxB,IAAI,CAAC,IAAI,CAAC,KAAK,OAAO,IAAK,cAAoC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;QAClG,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAClC,UAAU,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,OAAO,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,GAAW,EAAE,EAAW;IAClE,GAAG,CAAC,YAAY,KAAK,EAAE,CAAC;IACxB,IAAI,EAAE;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;;QAChC,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAClC,UAAU,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,GAAW;IACpD,OAAO,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AACzC,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,GAAW,EAAE,CAA2B;IACpF,GAAG,CAAC,YAAY,KAAK,EAAE,CAAC;IACxB,IAAI,CAAC;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;QAC5B,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAClC,UAAU,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,GAAW;IACtD,OAAO,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,GAAW,EAAE,EAAW;IACtE,GAAG,CAAC,SAAS,KAAK,EAAE,CAAC;IACrB,IAAI,EAAE;QAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;;QAC7B,OAAO,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,UAAU,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AASD,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,GAAW,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC3F,MAAM,MAAM,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAG,GAAG,CAAC,sBAAsB,CAAC;IAC5C,MAAM,YAAY,GAAG,QAAQ;QAC3B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QAC1D,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO;QACL,KAAK;QACL,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI;QAC3C,YAAY;KACb,CAAC;AACJ,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,GAAW,EAAE,KAAoB,EAAE,WAAoB;IACrG,MAAM,IAAI,GAAW;QACnB,GAAG,GAAG;QACN,MAAM,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE;QACzB,eAAe,EAAE,EAAE,GAAG,GAAG,CAAC,eAAe,EAAE;QAC3C,eAAe,EAAE,EAAE,GAAG,GAAG,CAAC,eAAe,EAAE;KAC5C,CAAC;IACF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,CAAC,MAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,eAAgB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;IAC5E,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,eAAgB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;IACtF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAChE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,GAAW,EAAE,WAAoB;IAC/E,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,WAAW;QAAE,OAAO;IAC5D,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,KAAK,GAAG,gBAAgB,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;QAAE,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC;IAC/E,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACjC,OAAO,GAAG,CAAC,aAAa,CAAC,CAAC,2BAA2B;IACrD,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,0BAA0B;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AA+G7B,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AAChE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AACzD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;AAEzD,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,qCAAqC;AACzE,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,GAAW,EAAE,KAAoB;IAC3E,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACjC,UAAU,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,GAAW,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC3F,IAAI,GAAG,CAAC,kBAAkB;QAAE,OAAO,GAAG,CAAC,kBAAkB,CAAC;IAC1D,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AACnC,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,GAAW,EAAE,KAAa;IACpE,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,GAAG,CAAC,YAAY,KAAK,EAAE,CAAC;IACxB,IAAI,CAAC;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;QAC5B,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAClC,UAAU,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAE/F,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,IAAK,cAAoC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,GAAW,EAAE,KAAa;IACpE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/B,GAAG,CAAC,YAAY,KAAK,EAAE,CAAC;IACxB,IAAI,CAAC,IAAI,CAAC,KAAK,OAAO,IAAK,cAAoC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;QAClG,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAClC,UAAU,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,OAAO,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,GAAW,EAAE,EAAW;IAClE,GAAG,CAAC,YAAY,KAAK,EAAE,CAAC;IACxB,IAAI,EAAE;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;;QAChC,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAClC,UAAU,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,GAAW;IACtD,OAAO,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,GAAW,EAAE,IAAuB;IAClF,GAAG,CAAC,SAAS,KAAK,EAAE,CAAC;IACrB,IAAI,IAAI,KAAK,OAAO;QAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;;QAC9C,OAAO,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,UAAU,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,GAAW;IACpD,OAAO,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AACzC,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,GAAW,EAAE,CAA2B;IACpF,GAAG,CAAC,YAAY,KAAK,EAAE,CAAC;IACxB,IAAI,CAAC;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;QAC5B,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAClC,UAAU,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,GAAW;IACtD,OAAO,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,GAAW,EAAE,EAAW;IACtE,GAAG,CAAC,SAAS,KAAK,EAAE,CAAC;IACrB,IAAI,EAAE;QAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;;QAC7B,OAAO,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,UAAU,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AASD,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,GAAW,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC3F,MAAM,MAAM,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IAClD,MAAM,QAAQ,GAAG,GAAG,CAAC,sBAAsB,CAAC;IAC5C,MAAM,YAAY,GAAG,QAAQ;QAC3B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QAC1D,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO;QACL,KAAK;QACL,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI;QAC3C,YAAY;KACb,CAAC;AACJ,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,GAAW,EAAE,KAAoB,EAAE,WAAoB;IACrG,MAAM,IAAI,GAAW;QACnB,GAAG,GAAG;QACN,MAAM,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE;QACzB,eAAe,EAAE,EAAE,GAAG,GAAG,CAAC,eAAe,EAAE;QAC3C,eAAe,EAAE,EAAE,GAAG,GAAG,CAAC,eAAe,EAAE;KAC5C,CAAC;IACF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,CAAC,MAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,eAAgB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;IAC5E,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,eAAgB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;IACtF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAChE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,GAAW,EAAE,WAAoB;IAC/E,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,WAAW;QAAE,OAAO;IAC5D,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,KAAK,GAAG,gBAAgB,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;QAAE,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC;IAC/E,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACjC,OAAO,GAAG,CAAC,aAAa,CAAC,CAAC,2BAA2B;IACrD,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,0BAA0B;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC"}

package/dist/server.js

@@ -22,6 +22,7 @@ import { PtyPilot } from "./session.js";
 import { ensureClaudeHome, ensureProjectTrusted, getDefaultModel, setDefaultModel, parseClaudeVersion, seedPlan, settingsPlan, } from "./claude-home.js";
 import { authStatus, cancelLogin, invalidateAuthStatus, startLogin, submitLoginCode } from "./claude-auth.js";
 import { startSetupToken, submitSetupTokenCode, cancelSetupToken } from "./setup-token.js";
+import { startAgentLogin, submitAgentLoginCode, cancelAgentLogin, agentLoginPending, agentLoginInfo, } from "./agent-login.js";
 import { readTokenExpiry } from "./claude-creds.js";
 import { starCount } from "./stars.js";
 import { announceFirstAgent, countMainChannels, ensureFirstAgent, firstAgentStatus, settleFirstAgent, } from "./first-agent.js";
@@ -58,7 +59,7 @@ import { ledgerFileFor, scopeVisible, recordIntoTable, saveLedger, mintLedgerId,
 import { rowKind } from "../context/ledger-skill/ledger-core.mjs";
 import { linkRefusal, markAgentPrompt, notificationText, } from "./kinship.js";
 import { talkVerdict, talkLetter } from "./talk.js";
-import { loadConfig, saveConfig, telegramConfig, applyTelegramPatch, titleForCwd, setTitleForCwd, themeForCwd, setThemeForCwd, mutedForCwd, setMutedForCwd, twoFactorForCwd, setTwoFactorForCwd, backendForCwd, setBackendForCwd, } from "./config.js";
+import { loadConfig, saveConfig, telegramConfig, applyTelegramPatch, titleForCwd, setTitleForCwd, themeForCwd, setThemeForCwd, mutedForCwd, setMutedForCwd, agentAuthForCwd, setAgentAuthForCwd, twoFactorForCwd, setTwoFactorForCwd, backendForCwd, setBackendForCwd, } from "./config.js";
 import { secretsFor, secretsForProfile, secretNamesForProfile, secretNames, setSecret, deleteSecret, setSecretSharing, setSecretProfiles, secretWriteVerdict, secretWriteDecision, secretOwnerGroup, visibleSecrets, RESERVED_SECRET_NAMES, MT_CLAUDE_OAUTH_TOKEN_NAME, longLivedTokenInfo, loadVault, recordOrigin, originProfile, } from "./secrets.js";
 import { recordSecretAudit, readSecretAudit, filterAudit, spawnActor, httpActor, profileSecretDiff, } from "./secret-audit.js";
 import { getProfile, profileArgs, permissionModeArgs, isPermissionMode, isEffortLevel, mcpServersVerdict, envVarsNote, seedDefaultProfiles, migrateToTracking, seedTweakProfile, loadProfiles, upsertProfile, removeProfile, promptEditVerdict, secretAttachVerdict, READONLY_DENY, TWEAK_PROFILE_NAME, promptOrigin, effectiveProfile, shippedProfile, } from "./profiles.js";
@@ -1756,6 +1757,79 @@ app.delete("/mt-token", (req, res) => {
     cancelSetupToken();
     res.json({ ok: true });
 });
+// --- Per-user subscription LOGIN ("login" auth mode, src/agent-login.ts) ----
+// The alternative to the injected token: in "login" mode each OS user (commons
+// `main` + each private/restricted group's own user) does its own interactive
+// `claude auth login`, so its agents get the account's claude.ai connectors. A
+// login is per-user because `claude`'s refresh rewrite is single-owner — it
+// cannot be shared across OS users (see the connectors-via-global-login design).
+// Same admin+browser+multi-tenant gate as /mt-token.
+/** The OS users that each need their own login: commons + every group that has
+ *  its own OS user (private/restricted). Deduped; mono-tenant yields none. */
+function loginUsers() {
+    const out = [];
+    const commons = commonsOsUser({ migrated: groupsMigrated, mode: DEPLOYMENT_MODE });
+    if (commons)
+        out.push({ user: commons, home: agentStateHome(commons), label: "commons" });
+    for (const g of loadGroups()) {
+        const u = osUserFor(g);
+        if (u && !out.some((x) => x.user === u))
+            out.push({ user: u, home: agentStateHome(u), label: g.name || g.id });
+    }
+    return out;
+}
+app.get("/agent-login", (req, res) => {
+    if (!mtTokenGate(req, res))
+        return;
+    const mode = agentAuthForCwd(loadConfig(), process.cwd());
+    const users = loginUsers().map(({ user, home, label }) => {
+        const info = agentLoginInfo(home);
+        return { user, label, loggedIn: info.loggedIn, expiresAt: info.expiresAt, pending: agentLoginPending(user) };
+    });
+    res.json({ mode, users });
+});
+app.post("/agent-login/mode", (req, res) => {
+    if (!mtTokenGate(req, res))
+        return;
+    const want = req.body?.mode === "login" ? "login" : "token";
+    const cfg = loadConfig();
+    const changed = agentAuthForCwd(cfg, process.cwd()) !== want;
+    setAgentAuthForCwd(cfg, process.cwd(), want);
+    // The auth wiring is a spawn-time decision — restart agents so it lands at once.
+    if (changed)
+        restartAllSessions();
+    res.json({ mode: want, restarted: changed });
+});
+app.post("/agent-login/start", async (req, res) => {
+    if (!mtTokenGate(req, res))
+        return;
+    const user = typeof req.body?.user === "string" ? req.body.user : "";
+    const target = loginUsers().find((u) => u.user === user);
+    if (!target)
+        return res.status(400).json({ error: "unknown user" });
+    const r = await startAgentLogin(target.user, target.home);
+    if ("error" in r)
+        return res.status(502).json(r);
+    res.json(r); // {url}
+});
+app.post("/agent-login/code", async (req, res) => {
+    if (!mtTokenGate(req, res))
+        return;
+    const user = typeof req.body?.user === "string" ? req.body.user : "";
+    const code = typeof req.body?.code === "string" ? req.body.code : "";
+    if (!loginUsers().some((u) => u.user === user))
+        return res.status(400).json({ error: "unknown user" });
+    const r = await submitAgentLoginCode(user, code);
+    res.status(r.ok ? 200 : 400).json(r); // {ok} — never the credential
+});
+app.delete("/agent-login", (req, res) => {
+    if (!mtTokenGate(req, res))
+        return;
+    const user = typeof req.body?.user === "string" ? req.body.user : "";
+    if (user)
+        cancelAgentLogin(user);
+    res.json({ ok: true });
+});
 // --- Model backend (src/backend.ts) ---------------------------------------
 // The instance-wide source for every agent's backend variables: the backend
 // chosen in the cockpit if any, else shadok's own environment. Read on every
@@ -4932,8 +5006,15 @@ group) {
         ensureAgentSshKey(user, home);
     }
     // Isolated groups share the subscription token, injected in the forced-last
-    // env layer. Mono-tenant (no user) reads and passes nothing.
-    const oauthToken = user
+    // env layer — but ONLY in "token" auth mode. In "login" mode the server
+    // injects NO token: `CLAUDE_CODE_OAUTH_TOKEN` outranks (and suppresses) a
+    // subscription login, and that login is exactly what carries the claude.ai
+    // connectors this mode exists for. The agent then authenticates from its own
+    // home's `claude auth login` credential (one per OS user; see src/agent-login.ts
+    // and the connectors-via-global-login design). Mono-tenant (no user) passes
+    // nothing either way.
+    const authMode = agentAuthForCwd(loadConfig(), process.cwd());
+    const oauthToken = user && authMode === "token"
         ? secretsFor([MT_CLAUDE_OAUTH_TOKEN_NAME], MAIN_GROUP_ID)[MT_CLAUDE_OAUTH_TOKEN_NAME]
         : undefined;
     return USE_TMUX