switchroom 0.19.1 → 0.19.3

package/telegram-plugin/gateway/auth-add-flow.ts

@@ -67,10 +67,15 @@ import {
   parseSetupTokenUrl,
   readTokenFromCredentialsFile,
 } from '../../src/auth/manager.js'
+import { PRE_PASTE_RULES } from '../../src/auth/via-claude.js'
 import type {
   AddAccountCredentials,
   AnthropicAddAccountCredentials,
 } from '../../src/auth/broker/client.js'
+import { isAuthAdmin, runReaddPrecheck } from './auth-command.js'
+import type { ParsedAuthCommand } from './auth-command.js'
+import { getAuthBrokerClient } from './auth-broker-client.js'
+import { chatKey } from './chat-key.js'
 
 /* ── Injectable tmux ops (mirrors makeTmuxRunner in src/agents/inject.ts) ─── */
 
@@ -103,6 +108,19 @@ export interface AuthAddTmuxOps {
    * the session has ended.
    */
   send(socket: string, session: string, text: string): void
+  /**
+   * `tmux -L <socket> send-keys -t <session> <key>` — a SINGLE key-name
+   * dispatch (e.g. `Enter`), with NO `-l` literal prefix and NO pane
+   * capture. Used for:
+   *   - pre-paste picker choreography (theme / login-method Enters) during
+   *     the URL-poll phase, before any secret is on the pane; and
+   *   - blind post-paste Enter dispatches to advance past Enter-gated
+   *     "Logged in / Security notes" screens in the via-claude picker flow.
+   * It reads nothing from the pane, so it can never leak the echoed code —
+   * this is the deterministic replacement for via-claude's capture-driven
+   * post-paste dispatch (see prb-safety.md).
+   */
+  sendKey(socket: string, session: string, key: string): void
   /** `tmux -L <socket> has-session -t <session>` — returns true if alive. */
   hasSession(socket: string, session: string): boolean
   /** `tmux -L <socket> kill-session -t <session>` — best-effort. */
@@ -151,6 +169,12 @@ export function makeAuthAddTmuxOps(tmuxBin = 'tmux'): AuthAddTmuxOps {
         stdio: ['pipe', 'pipe', 'pipe'],
       })
     },
+    sendKey(socket, session, key) {
+      // Single key-name dispatch, no -l literal prefix, no capture.
+      execFileSync(tmuxBin, ['-L', socket, 'send-keys', '-t', session, key], {
+        stdio: ['pipe', 'pipe', 'pipe'],
+      })
+    },
     hasSession(socket, session) {
       try {
         execFileSync(tmuxBin, ['-L', socket, 'has-session', '-t', session], {
@@ -184,6 +208,20 @@ export function makeAuthAddTmuxOps(tmuxBin = 'tmux'): AuthAddTmuxOps {
  * TTL matches `REAUTH_INTERCEPT_TTL_MS` (10 minutes); the reaper sweep
  * in gateway.ts walks both maps each minute.
  */
+/**
+ * Which credential minter drives the flow.
+ *
+ *   - `'via-claude'` (DEFAULT): spawn the bare `claude` login picker, which
+ *     mints the broad scope set (`org:create_api_key user:profile
+ *     user:inference user:sessions:claude_code user:mcp_servers
+ *     user:file_upload`) that `server:` mode agents require at boot. This is
+ *     the default because `claude setup-token` tokens carry only
+ *     `user:inference` and are REFUSED by server: agents (via-claude.ts:9-17).
+ *   - `'setup-token'`: spawn `claude setup-token` (narrow `user:inference`).
+ *     Kept for completeness / legacy narrow-scope adds.
+ */
+export type AuthAddMode = 'via-claude' | 'setup-token'
+
 export interface PendingAuthAddFlow {
   label: string
   scratchDir: string
@@ -192,6 +230,21 @@ export interface PendingAuthAddFlow {
   /** tmux session name (`auth-add-<label>-<hex>`). */
   tmuxSession: string
   startedAt: number
+  /**
+   * True when this flow re-authenticates an EXISTING account label in place
+   * (`/auth readd`) — threaded to `addAccountViaBroker(..., { replace: true })`
+   * so the broker overwrites the stored credentials instead of rejecting the
+   * duplicate. Absent/false is a fresh add. Set by the gateway dispatch.
+   */
+  replace?: boolean
+  /**
+   * Minter mode this flow was started in. `submitAccountAuthCode` reads it to
+   * decide whether to dispatch blind post-paste Enter key-presses (via-claude
+   * picker screens) — setup-token exits after the code so needs none.
+   * Optional for back-compat with callers/tests that construct flows directly;
+   * absent is treated as `'via-claude'` (the default minter).
+   */
+  mode?: AuthAddMode
 }
 export const pendingAuthAddFlows = new Map<string, PendingAuthAddFlow>()
 
@@ -299,6 +352,8 @@ export interface StartAccountAuthSessionResult {
   scratchDir: string
   tmuxSocket: string
   tmuxSession: string
+  /** The minter mode the session was started in. */
+  mode: AuthAddMode
 }
 
 /**
@@ -343,6 +398,11 @@ export async function startAccountAuthSession(
     agentName?: string
     /** Override the claude binary name (tests). */
     claudeBinary?: string
+    /**
+     * Credential minter. Defaults to `'via-claude'` (broad scope) — see
+     * {@link AuthAddMode}. Pass `'setup-token'` for the narrow-scope minter.
+     */
+    mode?: AuthAddMode
   } = {},
 ): Promise<StartAccountAuthSessionResult> {
   if (process.env.SWITCHROOM_TMUX_SUPERVISOR !== '1' && !opts.tmuxOps) {
@@ -353,10 +413,14 @@ export async function startAccountAuthSession(
   }
 
   const home = opts.home ?? homedir()
-  const urlTimeoutMs = opts.urlTimeoutMs ?? 12_000
+  // 30s (was 12s): the via-claude login picker adds keystroke-choreography
+  // latency (theme + login-method Enters) before the URL renders, and an
+  // unloaded VM can be slow. via-claude's own default is 20s; 30s is generous.
+  const urlTimeoutMs = opts.urlTimeoutMs ?? 30_000
   const agentName = opts.agentName ?? process.env.SWITCHROOM_AGENT_NAME ?? 'gateway'
   const tmux = opts.tmuxOps ?? makeAuthAddTmuxOps(opts.tmuxBin)
   const binary = opts.claudeBinary ?? 'claude'
+  const mode: AuthAddMode = opts.mode ?? 'via-claude'
 
   const scratchDir = pickScratchDir(label, home)
   mkdirSync(scratchDir, { recursive: true, mode: 0o700 })
@@ -391,20 +455,31 @@ export async function startAccountAuthSession(
   if (process.env.CLAUDE_CONFIG_DIR) sessionEnv['CLAUDE_CONFIG_DIR'] = scratchDir // always override
   if (process.env.XDG_CONFIG_HOME) sessionEnv['XDG_CONFIG_HOME'] = process.env.XDG_CONFIG_HOME
 
+  // Command: bare `claude` for the broad-scope login picker (via-claude), or
+  // `claude setup-token` for the narrow-scope minter.
+  const sessionCmd = mode === 'via-claude' ? binary : binary + ' setup-token'
+  const minterLabel = mode === 'via-claude' ? 'claude login' : 'claude setup-token'
   try {
-    tmux.newSession(tmuxSocket, tmuxSession, sessionEnv, binary + ' setup-token')
+    tmux.newSession(tmuxSocket, tmuxSession, sessionEnv, sessionCmd)
   } catch (err) {
     cleanScratchDir(scratchDir)
-    throw new Error(`Failed to start tmux session for claude setup-token: ${(err as Error).message}`)
+    throw new Error(`Failed to start tmux session for ${minterLabel}: ${(err as Error).message}`)
   }
 
   // Poll capture-pane every 500ms up to the URL timeout.
+  //
+  // In via-claude mode we ALSO dispatch the pre-paste picker choreography
+  // (theme picker → Enter, login-method picker → Enter) each tick, at most
+  // once per rule. This runs BEFORE any secret is on the pane, so capturing
+  // here is safe. parseSetupTokenUrl matches both the claude.ai/oauth and
+  // claude.com/cai/oauth shapes, which is exactly the URL the picker renders.
+  const preFired = new Set<string>()
   const loginUrl = await new Promise<string>((resolve, reject) => {
     const deadline = setTimeout(() => {
       clearInterval(ticker)
       tmux.killSession(tmuxSocket, tmuxSession)
       cleanScratchDir(scratchDir)
-      reject(new Error(`claude setup-token did not print an OAuth URL within ${urlTimeoutMs}ms`))
+      reject(new Error(`${minterLabel} did not print an OAuth URL within ${urlTimeoutMs}ms`))
     }, urlTimeoutMs)
 
     const ticker = setInterval(() => {
@@ -414,9 +489,20 @@ export async function startAccountAuthSession(
         clearTimeout(deadline)
         clearInterval(ticker)
         cleanScratchDir(scratchDir)
-        reject(new Error('claude setup-token exited before printing OAuth URL'))
+        reject(new Error(`${minterLabel} exited before printing OAuth URL`))
         return
       }
+      if (mode === 'via-claude') {
+        for (const rule of PRE_PASTE_RULES) {
+          if (preFired.has(rule.name)) continue
+          if (rule.match.test(pane)) {
+            preFired.add(rule.name)
+            // The pre-paste rules dispatch bare key-names (Enter); use the
+            // single-key primitive, not the literal-code `send`.
+            for (const key of rule.keys) tmux.sendKey(tmuxSocket, tmuxSession, key)
+          }
+        }
+      }
       const url = parseSetupTokenUrl(pane)
       if (url) {
         clearTimeout(deadline)
@@ -427,7 +513,7 @@ export async function startAccountAuthSession(
     }, 500)
   })
 
-  return { loginUrl, scratchDir, tmuxSocket, tmuxSession }
+  return { loginUrl, scratchDir, tmuxSocket, tmuxSession, mode }
 }
 
 /**
@@ -456,11 +542,24 @@ export async function submitAccountAuthCode(
     pollIntervalMs?: number
     pollTimeoutMs?: number
     tmuxOps?: AuthAddTmuxOps
+    /**
+     * Blind post-paste Enter schedule (ms after the code paste) for the
+     * via-claude picker flow: advances past the Enter-gated "Logged in /
+     * Security notes" screens WITHOUT ever capturing the pane (the echoed
+     * code is a secret — see prb-safety.md). Defaults derive from
+     * `flow.mode`: via-claude → `[1500, 3000, 5000]`, setup-token → `[]`
+     * (setup-token exits after the code, so no screens to dismiss). Pass an
+     * explicit array to override (tests use tight schedules).
+     */
+    blindEnterDelaysMs?: number[]
   } = {},
 ): Promise<AddAccountCredentials> {
   const pollIntervalMs = opts.pollIntervalMs ?? 250
   const pollTimeoutMs = opts.pollTimeoutMs ?? 300_000
   const tmux = opts.tmuxOps ?? makeAuthAddTmuxOps()
+  const mode: AuthAddMode = flow.mode ?? 'via-claude'
+  const blindEnterDelaysMs =
+    opts.blindEnterDelaysMs ?? (mode === 'via-claude' ? [1500, 3000, 5000] : [])
 
   const credentialsPath = join(flow.scratchDir, '.credentials.json')
 
@@ -475,11 +574,29 @@ export async function submitAccountAuthCode(
     )
   }
 
+  // Blind post-paste Enter schedule (via-claude picker). Absolute deadlines;
+  // each fires at most once. NEVER reads the pane — sendKey only writes.
+  const pasteAt = Date.now()
+  const blindEnters = blindEnterDelaysMs.map((d) => ({ at: pasteAt + d, fired: false }))
+
   // Poll filesystem + session liveness only — no capture-pane.
   const deadline = Date.now() + pollTimeoutMs
   while (Date.now() < deadline) {
     await new Promise((r) => setTimeout(r, pollIntervalMs))
 
+    // Dispatch any due blind Enters (best-effort; a dead session just throws
+    // and we swallow it — the fs poll below is the real success signal).
+    for (const be of blindEnters) {
+      if (!be.fired && Date.now() >= be.at) {
+        be.fired = true
+        try {
+          tmux.sendKey(flow.tmuxSocket, flow.tmuxSession, 'Enter')
+        } catch {
+          // best-effort — session may have already exited on success
+        }
+      }
+    }
+
     if (existsSync(credentialsPath)) {
       const token = readTokenFromCredentialsFile(credentialsPath)
       if (token) {
@@ -529,3 +646,95 @@ export function cancelAccountAuthSession(
   tmux.killSession(flow.tmuxSocket, flow.tmuxSession)
   cleanScratchDir(flow.scratchDir)
 }
+
+/**
+ * `/auth add`, `/auth readd`, `/auth add --replace`, and `/auth cancel`
+ * dispatch. Extracted verbatim from gateway.ts (switchroom#2996 ratchet) —
+ * behavior identical. Gateway-routed because it drives a scratch-dir-backed
+ * `claude setup-token` tmux/OAuth lifecycle the broker client can't model.
+ *
+ * `reply` sends an HTML message to the originating chat; `escapeHtml` is the
+ * gateway's Telegram-HTML escaper. Admin authority is passed through as
+ * `isAdmin` (the gateway sources it from the agent's own `admin`/`root` flag).
+ */
+export async function handleAuthAddOrCancel(opts: {
+  parsed: Extract<ParsedAuthCommand, { kind: 'add' | 'cancel' }>
+  isAdmin: boolean
+  currentAgent: string
+  chatId: string
+  threadId: number | null
+  reply: (text: string) => Promise<unknown>
+  escapeHtml: (text: string) => string
+}): Promise<void> {
+  const { parsed, isAdmin, currentAgent, chatId, threadId, reply, escapeHtml } = opts
+  if (!isAuthAdmin({ isAdmin })) {
+    await reply(
+      `**Not authorized.** \`/auth ${parsed.kind}\` is admin-only.\n` +
+        `Set \`admin: true\` on this agent in switchroom.yaml to unlock ` +
+        `(the same flag that gates \`/agents\`, \`/restart\`, ` +
+        `\`/update\` etc.).`,
+    )
+    return
+  }
+  // PR3 supergroup-mode: key auth-add flows by (chat, thread) so
+  // separate flows in two topics of one supergroup can't collide.
+  // In DM chats message_thread_id is undefined → key collapses to
+  // `chatId:_`, identical to today's behavior.
+  const authAddKey = chatKey(chatId, threadId) as string
+  if (parsed.kind === 'cancel') {
+    const existing = pendingAuthAddFlows.get(authAddKey)
+    if (!existing) {
+      await reply("_No pending \`/auth add\` flow in this chat._")
+      return
+    }
+    cancelAccountAuthSession(existing)
+    pendingAuthAddFlows.delete(authAddKey)
+    await reply("Cancelled.")
+    return
+  }
+  // parsed.kind === 'add'
+  if (pendingAuthAddFlows.has(authAddKey)) {
+    await reply(
+      "_An \`/auth add\` flow is already in progress for this chat. " +
+        "Finish the paste, or send \`/auth cancel\` to abort._",
+    )
+    return
+  }
+  // Precheck against broker state (readd requires the label to exist; a
+  // fresh add requires it NOT to): fail fast before spinning up a tmux/OAuth
+  // flow. Best-effort — a broker-unreachable case returns null and
+  // addAccountViaBroker enforces.
+  const precheckErr = await runReaddPrecheck(
+    () => getAuthBrokerClient(currentAgent),
+    parsed.label,
+    parsed.replace,
+  )
+  if (precheckErr) {
+    await reply(precheckErr)
+    return
+  }
+  try {
+    const { loginUrl, scratchDir, tmuxSocket, tmuxSession, mode } = await startAccountAuthSession(parsed.label)
+    pendingAuthAddFlows.set(authAddKey, {
+      label: parsed.label,
+      scratchDir,
+      tmuxSocket,
+      tmuxSession,
+      startedAt: Date.now(),
+      replace: parsed.replace,
+      mode,
+    })
+    const verbNoun = parsed.replace ? 'Re-authenticating account' : 'Adding account'
+    await reply(
+      `**${verbNoun}** \`${parsed.label}\`\n\n` +
+        `1. Open this URL on your phone:\n${loginUrl}\n\n` +
+        `2. Log into Anthropic, copy the code Claude shows.\n` +
+        `3. Paste it back here.\n\n` +
+        `Send \`/auth cancel\` to abort.`,
+    )
+  } catch (err) {
+    await reply(
+      `**/auth ${parsed.replace ? 'readd' : 'add'} failed:** ${escapeHtml((err as Error)?.message ?? String(err))}`,
+    )
+  }
+}

package/telegram-plugin/gateway/auth-command.ts

@@ -44,7 +44,19 @@ export type ParsedAuthCommand =
   | { kind: 'list' }
   | { kind: 'use'; label: string }
   | { kind: 'rotate' }
-  | { kind: 'add'; label: string }
+  | {
+      kind: 'add'
+      label: string
+      /**
+       * Re-auth an EXISTING account label in place (broker `addAccount(...,
+       * replace=true)`). Set by the `/auth readd <label>` verb (and
+       * `/auth add <label> --replace`). Plain `/auth add` leaves it false —
+       * the broker rejects a duplicate label, which is the desired guard for
+       * a fresh add. `/auth readd` is the path to widen scope on the 3 pooled
+       * accounts without renaming them.
+       */
+      replace: boolean
+    }
   | { kind: 'cancel' }
   | {
       kind: 'provider-add'
@@ -149,12 +161,25 @@ export function parseAuthCommand(text: string): ParsedAuthCommand | null {
       if (!label) return { kind: 'help', reason: 'Usage: /auth use <label>' }
       return { kind: 'use', label }
     }
-    case 'add': {
-      const label = parts[1]
-      if (!label) return { kind: 'help', reason: 'Usage: /auth add <label>' }
+    case 'add':
+    case 'readd': {
+      // `readd` is `add` with replace=true; `add --replace` is the same.
+      const positional = parts.slice(1).filter((t) => !t.startsWith('--'))
+      const flags = new Set(
+        parts.slice(1).filter((t) => t.startsWith('--')).map((t) => t.toLowerCase()),
+      )
+      const label = positional[0]
+      const usage = verb === 'readd' ? 'Usage: /auth readd <label>' : 'Usage: /auth add <label>'
+      if (!label) return { kind: 'help', reason: usage }
       const err = validateAuthAddLabel(label)
       if (err) return { kind: 'help', reason: err }
-      return { kind: 'add', label }
+      for (const f of flags) {
+        if (f !== '--replace') {
+          return { kind: 'help', reason: `Unknown flag \`${codeSpanSafe(f)}\` for \`/auth ${verb}\`.` }
+        }
+      }
+      const replace = verb === 'readd' || flags.has('--replace')
+      return { kind: 'add', label, replace }
     }
     case 'cancel':
       return { kind: 'cancel' }
@@ -451,6 +476,7 @@ export async function handleAuthCommand(
         `  \`/auth use <label>\` — admin: swap the fleet to <label>\n` +
         `  \`/auth rotate\` — admin: cycle to next non-exhausted fallback\n` +
         `  \`/auth add <label>\` — admin: OAuth-add a new Anthropic account from chat\n` +
+        `  \`/auth readd <label>\` — admin: re-auth an EXISTING account in place (widen scope)\n` +
         `  \`/auth google add <email>\` — admin: Telegram-native Google account add/re-auth\n` +
         `  \`/auth microsoft add <email>\` — admin: Telegram-native Microsoft account add/re-auth\n` +
         `  \`/auth cancel\` — abort an \`/auth add\` or provider add in progress\n` +
@@ -819,6 +845,113 @@ function isAdmin(ctx: AuthCommandContext): boolean {
   return ctx.isAdmin === true
 }
 
+/**
+ * The scope every `server:` mode agent needs from a pooled account for
+ * fable/Claude 7-day usage reporting. Absence is the whole reason
+ * `/auth readd` exists (setup-token tokens can't carry it).
+ */
+export const REQUIRED_USAGE_SCOPE = 'user:profile'
+
+/**
+ * Precheck for the gateway `/auth add`/`readd` dispatch. Returns a
+ * user-facing error string when the request is incoherent against current
+ * broker state, else null.
+ *
+ *   - `readd` (replace=true) of a label that does NOT exist → error (there's
+ *     nothing to re-auth; the operator wants `/auth add`).
+ *   - plain `add` (replace=false) of a label that ALREADY exists → error
+ *     (the broker would reject the duplicate anyway; fail fast with a clear
+ *     message pointing at `/auth readd`).
+ *
+ * Kept pure so it's unit-testable without a live broker.
+ */
+export function readdPrecheckError(
+  label: string,
+  replace: boolean,
+  labelExists: boolean,
+): string | null {
+  if (replace && !labelExists) {
+    return (
+      `**/auth readd:** no account named \`${codeSpanSafe(label)}\` to re-auth. ` +
+      `Run \`/auth show\` for the current list, or \`/auth add ${codeSpanSafe(label)}\` to add it fresh.`
+    )
+  }
+  if (!replace && labelExists) {
+    return (
+      `**/auth add:** \`${codeSpanSafe(label)}\` already exists. ` +
+      `Use \`/auth readd ${codeSpanSafe(label)}\` to re-authenticate it in place (e.g. to widen scope).`
+    )
+  }
+  return null
+}
+
+/**
+ * Broker-backed precheck for the `/auth add` / `/auth readd` chat verb.
+ * Resolves a broker client (via the caller-supplied getter), queries live
+ * account state, and returns the {@link readdPrecheckError} message (or null
+ * when the request is valid) so the gateway can fail fast before spinning up
+ * a tmux/OAuth flow.
+ *
+ * Best-effort by design: if the broker is unreachable (getter returns null or
+ * `listState` throws) this returns null and lets `addAccountViaBroker` enforce
+ * existence at add time. Kept here — beside `readdPrecheckError` — so the
+ * gateway carries only a thin call site (switchroom#2996 line-ratchet: no new
+ * inline bodies in gateway.ts).
+ */
+export async function runReaddPrecheck(
+  getClient: () => Promise<AuthBrokerClient | null>,
+  label: string,
+  replace: boolean,
+): Promise<string | null> {
+  try {
+    const client = await getClient()
+    if (!client) return null
+    const state = await client.listState()
+    const exists = state.accounts.some((a) => a.label === label)
+    return readdPrecheckError(label, replace, exists)
+  } catch {
+    // broker unreachable — skip precheck; addAccountViaBroker enforces.
+    return null
+  }
+}
+
+/**
+ * Render the "granted scopes" tail for a successful `/auth add`/`readd`.
+ * Reads the scopes STRUCTURALLY from `credentials.claudeAiOauth.scopes`
+ * (never scraped from the pane). Returns the text plus a `warn` flag set
+ * when {@link REQUIRED_USAGE_SCOPE} is absent, so the caller can surface a
+ * loud warning at add time instead of a silent `/usage` failure later.
+ */
+export function formatGrantedScopesReply(scopes: string[] | undefined): {
+  text: string
+  hasUsageScope: boolean
+} {
+  const list = Array.isArray(scopes) ? scopes.filter((s) => typeof s === 'string') : []
+  const hasUsageScope = list.includes(REQUIRED_USAGE_SCOPE)
+  if (list.length === 0) {
+    return {
+      text:
+        `\n⚠️ **No scopes reported** on the new token — could not confirm \`${REQUIRED_USAGE_SCOPE}\`. ` +
+        `7-day usage reporting may not work. Re-run \`/auth readd\` if usage is missing.`,
+      hasUsageScope: false,
+    }
+  }
+  const rendered = list.map((s) => `\`${codeSpanSafe(s)}\``).join(', ')
+  if (hasUsageScope) {
+    return {
+      text: `\nGranted scopes: ${rendered}\n✓ \`${REQUIRED_USAGE_SCOPE}\` present — 7-day usage reporting is unlocked.`,
+      hasUsageScope: true,
+    }
+  }
+  return {
+    text:
+      `\nGranted scopes: ${rendered}\n` +
+      `⚠️ **\`${REQUIRED_USAGE_SCOPE}\` is MISSING** — 7-day usage reporting will not work for this account. ` +
+      `This usually means the narrow \`setup-token\` minter was used. Re-run \`/auth readd <label>\` with the broad login to fix.`,
+    hasUsageScope: false,
+  }
+}
+
 /**
  * Choose the next account `auth rotate` should set active. Walks
  * `fallback_order` starting *after* the currently-active label,