synabun 2.0.5 → 2.0.9

package/neural-interface/lib/claude-accounts.js

@@ -10,13 +10,24 @@
 // resources are symlinked back to ~/.claude so skills/commands/settings stay in
 // sync; identity-bearing files stay isolated.
 //
-// The `default` account is the ambient ~/.claude and never gets an env override.
+// Default follows CLAUDE_CONFIG_DIR when set, otherwise ~/.claude.
+//
+// One account, two credentials, one mode (docs/claude-sidepanel.md → Claude
+// accounts). Each account can hold a Claude subscription login (Claude Code's
+// own OAuth, inside that account's config directory) and an API key (SynaBun's
+// `.synabun-api-key` file in the same directory). Its mode, "subscription" or
+// "apiKey", decides what its sessions use; when only one credential exists,
+// that one is the mode. describe() is the one reading of an account's state:
+// the account list, the panel's sign-in screens, its composer picker, the
+// Assistant's brain picker, the catalog and worker dispatch all show it.
+// launchFor() is the one place a Claude Code process gets its credential.
 
 import {
-  copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, symlinkSync, writeFileSync,
+  existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync,
 } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { homedir } from 'node:os';
+import { readClaudeProfileApiKey, saveClaudeProfileApiKey, clearClaudeProfileApiKey } from './claude-profile-api-key.js';
 
 export const DEFAULT_ACCOUNT_ID = 'default';
 // `rules` carries SynaBun's rules file (rules/synabun.md) to accounts created
@@ -26,6 +37,18 @@ export const SHARED_LINKS = ['settings.json', 'CLAUDE.md', 'rules', 'commands',
 export const ISOLATED_ITEMS = ['.credentials.json', '.claude.json', 'projects', 'todos', 'history.jsonl', 'statsig', 'shell-snapshots', 'plans'];
 const CLAUDE_JSON_WHITELIST = ['mcpServers', 'theme', 'editorMode', 'preferredNotifChannel', 'autoUpdates', 'verbose'];
 
+export const CLAUDE_AUTH_MODES = Object.freeze(['subscription', 'apiKey']);
+// Everything inherited from the server's own environment that would decide a
+// Claude Code process's credential or backend. Removed from every account
+// launch: the account and its mode decide, never what SynaBun was started with.
+export const CLAUDE_CREDENTIAL_ENV = Object.freeze([
+  'ANTHROPIC_API_KEY', 'ANTHROPIC_API_KEY_FILE_DESCRIPTOR', 'ANTHROPIC_AUTH_TOKEN',
+  'CLAUDE_CODE_OAUTH_TOKEN', 'CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR',
+  'CLAUDE_CODE_USE_BEDROCK', 'CLAUDE_CODE_USE_VERTEX', 'CLAUDE_CODE_USE_FOUNDRY',
+]);
+// A subscription check older than this is asked again when the list is read.
+const STATUS_MAX_AGE_MS = 5 * 60_000;
+
 export class ClaudeAccountError extends Error {
   constructor(code, message, status = 400) {
     super(message);
@@ -49,11 +72,22 @@ function sanitizeLabel(value, fallback = 'Claude account') {
   const label = String(value || '').replace(/[\r\n\t]/g, ' ').trim().slice(0, 80);
   return label || fallback;
 }
+const text = (value, max = 200) => (typeof value === 'string' && value.trim() ? value.trim().slice(0, max) : null);
+
+/**
+ * Claude Code's global config file (`.claude.json`, where `oauthAccount` lives)
+ * for a config directory. An explicit CLAUDE_CONFIG_DIR keeps it inside that
+ * directory; the ambient default keeps it in the home directory, next to
+ * ~/.claude rather than inside it (the CLI's own layout).
+ */
+export function claudeGlobalConfigFile(configDir, { ambient = false, homeDir = homedir() } = {}) {
+  return ambient ? resolve(homeDir, '.claude.json') : resolve(configDir, '.claude.json');
+}
 
 /** Read the OAuth identity Claude Code records after login. */
-export function readClaudeIdentity(configDir) {
-  if (!configDir) return null;
-  const data = readJson(resolve(configDir, '.claude.json'), null);
+export function readClaudeIdentity(configDir, file = null) {
+  if (!configDir && !file) return null;
+  const data = readJson(file || resolve(configDir, '.claude.json'), null);
   const account = data?.oauthAccount;
   if (!account || typeof account !== 'object') return null;
   return {
@@ -63,58 +97,312 @@ export function readClaudeIdentity(configDir) {
   };
 }
 
+/** What an API key is shown as: never the key, never its prefix. */
+export function apiKeyHint(key) {
+  return typeof key === 'string' && key.length >= 8 ? `…${key.slice(-4)}` : null;
+}
+
+/**
+ * The mode an account's sessions use, from its stored choice and the
+ * credentials it holds. `subscription` is true (signed in), false (confirmed
+ * signed out) or null (not known yet). A stored key with an unconfirmed
+ * subscription keeps the key unless the user chose the subscription; both
+ * present with no choice keeps the key, which is what SynaBun did before modes.
+ */
+export function resolveClaudeAuth({ preferredMode = null, hasKey = false, subscription = null } = {}) {
+  const preferred = CLAUDE_AUTH_MODES.includes(preferredMode) ? preferredMode : null;
+  let mode = null;
+  if (hasKey && subscription === true) mode = preferred || 'apiKey';
+  else if (hasKey) mode = preferred === 'subscription' && subscription !== false ? 'subscription' : 'apiKey';
+  else if (subscription !== false) mode = 'subscription';
+  const signedIn = mode === 'apiKey' ? true : mode === 'subscription' ? subscription : false;
+  return { mode, signedIn, switchable: hasKey && subscription === true };
+}
+
+/** A launch environment applied to a base: inherited credentials out, the account's in. */
+export function applyClaudeLaunchEnv(base, launch) {
+  const env = { ...(base || {}) };
+  for (const key of launch?.unset || CLAUDE_CREDENTIAL_ENV) delete env[key];
+  return Object.assign(env, launch?.env || {});
+}
+
 export function createClaudeAccounts({
   dataHome,
   homeDir = homedir(),
+  env = process.env,
   accountsRoot = null,
   log = () => {},
   now = Date.now,
   pollIntervalMs = 2000,
+  // async (id) => Claude Code's own `auth status --json` for that account
+  // ({ loggedIn, email, orgName, subscriptionType, authMethod }), or null.
+  readNativeStatus = null,
+  statusTimeoutMs = 20_000,
 } = {}) {
   if (!dataHome) throw new Error('createClaudeAccounts requires dataHome');
   const registryPath = resolve(dataHome, 'data', 'claude-accounts.json');
-  const defaultHome = resolve(homeDir, '.claude');
+  const configDir = env.CLAUDE_CONFIG_DIR;
+  const defaultHome = resolve(configDir || resolve(homeDir, '.claude'));
+  const defaultConfigFile = claudeGlobalConfigFile(defaultHome, { ambient: !configDir, homeDir });
   const root = accountsRoot || resolve(homeDir, '.claude-accounts');
+  // id → the last answer of Claude Code's own status check (never a credential).
+  const nativeStatus = new Map();
+  const refreshing = new Map();
+  const listeners = new Set();
+  let nativeReader = typeof readNativeStatus === 'function' ? readNativeStatus : null;
 
+  function configFileOf(id, home) { return id === DEFAULT_ACCOUNT_ID ? defaultConfigFile : resolve(home, '.claude.json'); }
   function defaultAccount() {
-    const identity = readClaudeIdentity(defaultHome);
+    const identity = readClaudeIdentity(defaultHome, defaultConfigFile);
     return { id: DEFAULT_ACCOUNT_ID, label: 'Default', email: identity?.email || null, organization: identity?.organization || null, home: defaultHome, builtin: true, createdAt: null };
   }
   function load() {
     const data = readJson(registryPath, null);
     const accounts = Array.isArray(data?.accounts) ? data.accounts.filter((row) => row?.id && row.id !== DEFAULT_ACCOUNT_ID) : [];
-    return { accounts, defaultId: DEFAULT_ACCOUNT_ID };
+    const defaults = data?.default && typeof data.default === 'object' ? data.default : {};
+    return { accounts, defaultId: DEFAULT_ACCOUNT_ID, default: defaults };
+  }
+  function save(data) {
+    writeJsonAtomic(registryPath, { accounts: data.accounts, defaultId: DEFAULT_ACCOUNT_ID, default: data.default || {}, updatedAt: new Date(now()).toISOString() });
+  }
+  function storedMode(data, id) {
+    const mode = id === DEFAULT_ACCOUNT_ID ? data.default?.authMode : data.accounts.find((row) => row.id === id)?.authMode;
+    return CLAUDE_AUTH_MODES.includes(mode) ? mode : null;
   }
-  function save(data) { writeJsonAtomic(registryPath, { accounts: data.accounts, defaultId: DEFAULT_ACCOUNT_ID, updatedAt: new Date(now()).toISOString() }); }
 
-  function list() {
+  // Terminal login needs only registry metadata, without reading CLI identity files.
+  function profileFor(id) {
+    if (id === DEFAULT_ACCOUNT_ID) return { id, home: defaultHome };
+    return load().accounts.find(row => row.id === id) || null;
+  }
+  function keyHome(id) {
+    const row = profileFor(id);
+    if (!row || row.id !== id) throw new ClaudeAccountError('ACCOUNT_NOT_FOUND', 'Unknown Claude account', 404);
+    return row.home;
+  }
+  function readApiKey(id) { return readClaudeProfileApiKey(keyHome(id)); }
+  function saveApiKey(id, key) {
+    saveClaudeProfileApiKey(keyHome(id), key);
+    // A key just pasted is what the user wants this account to use.
+    writeMode(id, 'apiKey');
+    emit(id);
+  }
+  function clearApiKey(id) {
+    clearClaudeProfileApiKey(keyHome(id));
     const data = load();
-    const rows = data.accounts.map((row) => {
-      const identity = readClaudeIdentity(row.home);
-      return { ...row, email: identity?.email || row.email || null, organization: identity?.organization || row.organization || null, builtin: false, loggedIn: !!identity?.email };
-    });
-    const base = defaultAccount();
-    return [{ ...base, loggedIn: !!base.email }, ...rows];
+    if (storedMode(data, id) === 'apiKey') writeMode(id, null, data);
+    emit(id);
   }
-  function listForClient() {
-    return list().map(({ id, label, email, organization, builtin, loggedIn, createdAt }) => ({ id, label, email, organization, isDefault: id === DEFAULT_ACCOUNT_ID, builtin, loggedIn, createdAt }));
+  // The key itself only for a launch; everything else sees whether one is there.
+  function keyState(id) {
+    try {
+      const key = readApiKey(id);
+      return key ? { present: true, hint: apiKeyHint(key), error: null, key } : { present: false, hint: null, error: null, key: null };
+    } catch (error) {
+      if (error?.code === 'ACCOUNT_NOT_FOUND') throw error;
+      return { present: false, hint: null, error: 'unreadable', key: null };
+    }
+  }
+  function fileChangedSince(file, at) {
+    try { return statSync(file).mtimeMs > at; } catch { return false; }
+  }
+  function subscriptionOf(id, home) {
+    const file = configFileOf(id, home);
+    const status = nativeStatus.get(id);
+    // Claude Code rewrites its global config when it signs in or out, so a file
+    // newer than the last check outranks that check until it is asked again.
+    if (status && !fileChangedSince(file, status.wall)) {
+      return {
+        signedIn: status.loggedIn, email: status.email, organization: status.organization,
+        plan: status.plan, method: status.method, checkedAt: status.checkedAt, checked: true,
+      };
+    }
+    // Its own record of an OAuth login, if any: a login is likely, its absence proves nothing.
+    const identity = readClaudeIdentity(home, file);
+    const signedIn = identity?.email ? true : status?.loggedIn === false ? false : null;
+    return {
+      signedIn, email: identity?.email || null, organization: identity?.organization || null,
+      plan: identity?.email && status?.loggedIn ? status.plan : null, method: identity?.email ? 'claude.ai' : null,
+      checkedAt: status?.checkedAt || null, checked: false,
+    };
   }
-  function get(id) {
+  function describeProfile(profile, data = load()) {
+    const id = profile.id;
+    const isDefault = id === DEFAULT_ACCOUNT_ID;
+    const base = isDefault ? defaultAccount() : profile;
+    const key = keyState(id);
+    const subscription = subscriptionOf(id, base.home);
+    const preferredMode = storedMode(data, id);
+    const auth = resolveClaudeAuth({ preferredMode, hasKey: key.present, subscription: subscription.signedIn });
+    const identity = auth.mode === 'apiKey' ? key.hint : auth.mode === 'subscription' ? (subscription.email || subscription.organization) : null;
+    const row = {
+      id, provider: 'claude', label: isDefault ? 'Default' : sanitizeLabel(base.label, 'Claude account'), home: base.home,
+      isDefault, builtin: isDefault, createdAt: base.createdAt || null,
+      mode: auth.mode, preferredMode, signedIn: auth.signedIn, switchable: auth.switchable, identity: identity || null,
+      subscription: { signedIn: subscription.signedIn, email: subscription.email, organization: subscription.organization, plan: subscription.plan, method: subscription.method, checked: subscription.checked, checkedAt: subscription.checkedAt },
+      apiKey: { present: key.present, hint: key.hint, error: key.error },
+      // The fields older panels read, from the same state.
+      loggedIn: auth.signedIn,
+      email: auth.mode === 'subscription' ? subscription.email : null,
+      organization: auth.mode === 'subscription' ? subscription.organization : null,
+      authMethod: auth.mode === 'apiKey' ? 'apiKey' : auth.mode === 'subscription' && subscription.signedIn ? (subscription.method || 'claude.ai') : null,
+      // Kept in the registry for older readers; the live record wins.
+      registryEmail: isDefault ? null : profile.email || null,
+    };
+    return { row, key: key.key };
+  }
+  function describe(id) {
     const wanted = sanitizeId(id) || DEFAULT_ACCOUNT_ID;
-    if (wanted === DEFAULT_ACCOUNT_ID) return { ...defaultAccount(), loggedIn: !!defaultAccount().email };
-    return list().find((row) => row.id === wanted) || null;
+    const data = load();
+    const profile = wanted === DEFAULT_ACCOUNT_ID ? { id: DEFAULT_ACCOUNT_ID, home: defaultHome } : data.accounts.find((row) => row.id === wanted);
+    if (!profile) return null;
+    return describeProfile(profile, data).row;
+  }
+  function list() {
+    const data = load();
+    return [{ id: DEFAULT_ACCOUNT_ID, home: defaultHome }, ...data.accounts].map((profile) => describeProfile(profile, data).row);
+  }
+  function clientRow(row) {
+    const { home, registryEmail, ...rest } = row;
+    return rest;
   }
+  function listForClient() { return list().map(clientRow); }
+  function describeForClient(id) { const row = describe(id); return row ? clientRow(row) : null; }
+  function get(id) { return describe(id); }
   const find = get;
   function homeFor(id) {
-    const account = get(id);
-    if (!account || account.id === DEFAULT_ACCOUNT_ID) return null;
-    return account.home;
+    const wanted = sanitizeId(id);
+    if (!wanted || wanted === DEFAULT_ACCOUNT_ID) return null;
+    return profileFor(wanted)?.home || null;
   }
   function envFor(id) {
+    // Native auth strips ambient config/auth variables before applying this
+    // account's environment. Restore Default's explicit config location too.
+    if (id === DEFAULT_ACCOUNT_ID && configDir) return { CLAUDE_CONFIG_DIR: defaultHome };
     const home = homeFor(id);
     return home ? { CLAUDE_CONFIG_DIR: home } : {};
   }
 
+  /**
+   * How a Claude Code process runs under an account: `unset` the inherited
+   * credential variables, then add `env` (its config directory and, in API-key
+   * mode, its key). `env` can carry a secret: pass it to the spawn only, never
+   * to a log, a response, an event or a file.
+   */
+  function launchFor(id) {
+    const wanted = typeof id === 'string' && id ? id : DEFAULT_ACCOUNT_ID;
+    const data = load();
+    const profile = wanted === DEFAULT_ACCOUNT_ID ? { id: DEFAULT_ACCOUNT_ID, home: defaultHome } : data.accounts.find((row) => row.id === wanted);
+    if (!profile || !profile.home) {
+      return { ok: false, accountId: wanted, code: 'account_unavailable', message: 'That Claude account is no longer set up in SynaBun.' };
+    }
+    const { row, key } = describeProfile(profile, data);
+    const launchEnv = {};
+    if (wanted !== DEFAULT_ACCOUNT_ID) launchEnv.CLAUDE_CONFIG_DIR = profile.home;
+    else if (configDir) launchEnv.CLAUDE_CONFIG_DIR = defaultHome;
+    if (row.mode === 'apiKey' && key) launchEnv.ANTHROPIC_API_KEY = key;
+    return {
+      ok: true, accountId: wanted, label: row.label, mode: row.mode, signedIn: row.signedIn, identity: row.identity,
+      env: launchEnv, unset: [...CLAUDE_CREDENTIAL_ENV],
+    };
+  }
+
+  /** Why an account cannot run a session now ('' when it can, or when that is not known yet). */
+  function unusableReason(id) {
+    const row = describe(id);
+    if (!row) return 'That Claude account is no longer set up in SynaBun.';
+    if (row.apiKey.error && row.mode !== 'subscription') return `The API key saved for ${row.label} cannot be read. Save it again.`;
+    if (row.signedIn === false) return `${row.label} is signed out. Sign in with Claude or add an API key to it first.`;
+    return '';
+  }
+
+  function writeMode(id, mode, data = load()) {
+    if (id === DEFAULT_ACCOUNT_ID) {
+      data.default = { ...(data.default || {}) };
+      if (mode) data.default.authMode = mode; else delete data.default.authMode;
+    } else {
+      const account = data.accounts.find((row) => row.id === id);
+      if (!account) throw new ClaudeAccountError('ACCOUNT_NOT_FOUND', `Claude account not found: ${id}`, 404);
+      if (mode) account.authMode = mode; else delete account.authMode;
+    }
+    save(data);
+  }
+  /** Choose what an account's sessions use. The chosen credential must be there. */
+  function setMode(id, mode) {
+    const wanted = sanitizeId(id) || DEFAULT_ACCOUNT_ID;
+    if (!CLAUDE_AUTH_MODES.includes(mode)) throw new ClaudeAccountError('MODE_INVALID', 'Choose "subscription" or "apiKey".', 400);
+    const row = describe(wanted);
+    if (!row) throw new ClaudeAccountError('ACCOUNT_NOT_FOUND', `Claude account not found: ${id}`, 404);
+    if (mode === 'apiKey' && !row.apiKey.present) throw new ClaudeAccountError('MODE_NEEDS_CREDENTIAL', `Add an API key to ${row.label} first.`, 409);
+    if (mode === 'subscription' && row.subscription.signedIn === false) throw new ClaudeAccountError('MODE_NEEDS_CREDENTIAL', `Sign in to ${row.label} with Claude first.`, 409);
+    writeMode(wanted, mode);
+    emit(wanted);
+    return describe(wanted);
+  }
+
+  /** Remember what Claude Code said about an account's own login. */
+  function noteNativeStatus(id, status) {
+    if (!status || typeof status.loggedIn !== 'boolean') return;
+    nativeStatus.set(id, {
+      loggedIn: status.loggedIn,
+      email: status.loggedIn ? text(status.email) : null,
+      organization: status.loggedIn ? text(status.orgName ?? status.organization) : null,
+      plan: status.loggedIn ? text(status.subscriptionType ?? status.plan, 40) : null,
+      method: status.loggedIn ? text(status.authMethod ?? status.method, 40) : null,
+      checkedAt: now(),
+      // Compared with the config file's modification time: the clock files use.
+      wall: Date.now(),
+    });
+  }
+  function forgetNativeStatus(id) { nativeStatus.delete(id); }
+  function setNativeStatusReader(reader) { nativeReader = typeof reader === 'function' ? reader : null; }
+  function signature(row) { return row ? JSON.stringify([row.label, row.mode, row.signedIn, row.identity, row.subscription.signedIn, row.subscription.email, row.subscription.plan, row.apiKey.present, row.apiKey.hint, row.preferredMode]) : ''; }
+  function checkOne(id) {
+    if (refreshing.has(id)) return refreshing.get(id);
+    const job = (async () => {
+      let timer;
+      try {
+        const status = await Promise.race([
+          Promise.resolve().then(() => nativeReader(id)),
+          new Promise((_, reject) => { timer = setTimeout(() => reject(new Error('timeout')), statusTimeoutMs); timer.unref?.(); }),
+        ]);
+        if (status && typeof status.loggedIn === 'boolean' && profileFor(id)) noteNativeStatus(id, status);
+      } catch (error) {
+        log('claude-accounts', `status check failed for ${id}: ${String(error?.message || error).slice(0, 120)}`);
+      } finally { clearTimeout(timer); refreshing.delete(id); }
+    })();
+    refreshing.set(id, job);
+    return job;
+  }
+  /**
+   * Ask Claude Code for the subscription state of these accounts (all by
+   * default): `force` asks again, otherwise only an answer older than
+   * `maxAgeMs` or none at all. Listeners hear about every account that changed.
+   */
+  async function refreshStatus(ids = null, { force = false, maxAgeMs = STATUS_MAX_AGE_MS } = {}) {
+    if (!nativeReader) return list();
+    const wanted = (Array.isArray(ids) ? ids : [DEFAULT_ACCOUNT_ID, ...load().accounts.map((row) => row.id)]).filter((id) => profileFor(id));
+    const before = new Map(wanted.map((id) => [id, signature(describe(id))]));
+    await Promise.all(wanted.map((id) => {
+      const known = nativeStatus.get(id);
+      if (!force && known && now() - known.checkedAt < maxAgeMs && !stale(id, maxAgeMs)) return null;
+      return checkOne(id);
+    }));
+    for (const id of wanted) if (before.get(id) !== signature(describe(id))) emit(id);
+    return list();
+  }
+  function stale(id, maxAgeMs = STATUS_MAX_AGE_MS) {
+    const known = nativeStatus.get(id);
+    if (!known || now() - known.checkedAt >= maxAgeMs) return true;
+    const profile = profileFor(id);
+    return !!profile && fileChangedSince(configFileOf(id, profile.home), known.wall);
+  }
+
+  function subscribe(listener) { listeners.add(listener); return () => listeners.delete(listener); }
+  function emit(accountId, extra = {}) {
+    for (const listener of [...listeners]) { try { listener({ accountId, ...extra }); } catch {} }
+  }
+
   function linkShared(home) {
     const linked = [];
     for (const name of SHARED_LINKS) {
@@ -136,15 +424,17 @@ export function createClaudeAccounts({
   function seedClaudeJson(home) {
     const target = resolve(home, '.claude.json');
     if (existsSync(target)) return false;
-    const source = readJson(resolve(defaultHome, '.claude.json'), {}) || {};
+    // Only shared preferences from Default's global config; never its login.
+    const source = readJson(defaultConfigFile, {}) || {};
     const seeded = { hasCompletedOnboarding: true };
     for (const key of CLAUDE_JSON_WHITELIST) if (source[key] !== undefined) seeded[key] = source[key];
     writeJsonAtomic(target, seeded);
     return true;
   }
   function seedHome(id) {
-    const account = get(id);
-    if (!account || account.id === DEFAULT_ACCOUNT_ID) throw new ClaudeAccountError('ACCOUNT_NOT_FOUND', `Claude account not found: ${id}`, 404);
+    const wanted = sanitizeId(id);
+    const account = wanted && wanted !== DEFAULT_ACCOUNT_ID ? profileFor(wanted) : null;
+    if (!account) throw new ClaudeAccountError('ACCOUNT_NOT_FOUND', `Claude account not found: ${id}`, 404);
     mkdirSync(resolve(account.home, 'projects'), { recursive: true });
     mkdirSync(resolve(account.home, 'todos'), { recursive: true });
     const linked = linkShared(account.home);
@@ -156,10 +446,14 @@ export function createClaudeAccounts({
     const data = load();
     const id = `cacct-${now().toString(36)}${Math.floor(Math.random() * 1296).toString(36).padStart(2, '0')}`;
     const account = { id, label: sanitizeLabel(label, `Claude ${data.accounts.length + 2}`), email: null, organization: null, home: resolve(root, id), createdAt: new Date(now()).toISOString() };
+    if (label && String(label).trim()) account.labelCustom = true;
     data.accounts.push(account);
     save(data);
     const seeded = seedHome(id);
-    return { ...account, isDefault: false, builtin: false, loggedIn: false, seeded };
+    // A directory made a moment ago holds no login: nothing to ask Claude Code.
+    noteNativeStatus(id, { loggedIn: false });
+    emit(id, { created: true });
+    return { ...describe(id), seeded };
   }
   function rename(id, label) {
     const wanted = sanitizeId(id);
@@ -168,7 +462,9 @@ export function createClaudeAccounts({
     const account = data.accounts.find((row) => row.id === wanted);
     if (!account) throw new ClaudeAccountError('ACCOUNT_NOT_FOUND', `Claude account not found: ${id}`, 404);
     account.label = sanitizeLabel(label, account.label);
+    account.labelCustom = true;
     save(data);
+    emit(wanted);
     return get(wanted);
   }
   function remove(id, { inUse = () => null } = {}) {
@@ -181,9 +477,11 @@ export function createClaudeAccounts({
     if (reason) throw new ClaudeAccountError('ACCOUNT_IN_USE', typeof reason === 'string' ? reason : `Claude account ${wanted} is in use`, 409);
     const [account] = data.accounts.splice(index, 1);
     save(data);
+    nativeStatus.delete(wanted);
     if (account.home && resolve(account.home).startsWith(resolve(root))) {
       try { rmSync(account.home, { recursive: true, force: true }); } catch (error) { log('claude-accounts', `remove home failed: ${error?.message || error}`); }
     }
+    emit(wanted, { removed: true });
     return { ok: true, removed: account.id };
   }
   function recordIdentity(id) {
@@ -201,6 +499,16 @@ export function createClaudeAccounts({
     }
     return { ...account, ...identity };
   }
+  /** A subscription sign-in just finished: it is what the account uses from now on. */
+  function noteSubscriptionSignIn(id, status = null) {
+    const wanted = sanitizeId(id) || DEFAULT_ACCOUNT_ID;
+    if (!profileFor(wanted)) return null;
+    if (status) noteNativeStatus(wanted, status);
+    if (wanted !== DEFAULT_ACCOUNT_ID) recordIdentity(wanted);
+    writeMode(wanted, 'subscription');
+    emit(wanted);
+    return describe(wanted);
+  }
   /** Poll for the OAuth identity to appear after a login terminal was opened. */
   function watchLogin(id, { onLogin = () => {}, onTimeout = () => {}, timeoutMs = 10 * 60_000 } = {}) {
     const started = now();
@@ -223,8 +531,11 @@ export function createClaudeAccounts({
   }
 
   return {
-    registryPath, defaultHome, root,
-    list, listForClient, get, find, homeFor, envFor, create, rename, remove, seedHome, recordIdentity, watchLogin, loginCommand,
-    readIdentity: (id) => readClaudeIdentity(id === DEFAULT_ACCOUNT_ID ? defaultHome : homeFor(id)),
+    registryPath, defaultHome, defaultConfigFile, root,
+    list, listForClient, describe, describeForClient, profileFor, readApiKey, saveApiKey, clearApiKey, get, find, homeFor, envFor,
+    launchFor, unusableReason, setMode, noteNativeStatus, forgetNativeStatus, noteSubscriptionSignIn, setNativeStatusReader,
+    refreshStatus, stale, subscribe,
+    create, rename, remove, seedHome, recordIdentity, watchLogin, loginCommand,
+    readIdentity: (id) => (id === DEFAULT_ACCOUNT_ID ? readClaudeIdentity(defaultHome, defaultConfigFile) : readClaudeIdentity(homeFor(id))),
   };
 }

package/neural-interface/lib/claude-agent-bridge.js

@@ -1,3 +1,5 @@
+import { redactProviderSecrets } from './provider-panel-api-key-auth.js';
+import { applyClaudeLaunchEnv, CLAUDE_CREDENTIAL_ENV } from './claude-accounts.js';
 import { claudeStallSeconds } from './claude-stall-policy.js';
 import { detectProject as memoryProject } from '../../mcp-server/dist/config.js';
 // ── Claude Agent SDK bridge for the Claude sidepanel (claude-skin) ──
@@ -223,7 +225,7 @@ const _allSessions = new Set();
 
 function _orphanKey(wid, sid) { return sid ? `${wid}:${sid}` : wid; }
 
-function log(...args) { console.log('[claude-sdk]', ...args); }
+function log(...args) { console.log('[claude-sdk]', ...args.map(redactProviderSecrets)); }
 
 // Panel sessions, a temporary chat (lib/claude-temporary.js): the plan files
 // Claude Code wrote for one that still have to be removed. path → { plansDirs,
@@ -415,6 +417,7 @@ export class ClaudeSession {
   // ── wire helpers ──────────────────────────────────────────────────────────
 
   send(data) {
+    data = redactProviderSecrets(data);
     if (this.destroyed) return;
     if (this.orphanBuffer) {
       // High-volume deltas are not buffered while detached — full assistant
@@ -451,6 +454,7 @@ export class ClaudeSession {
   // without a prompt: the first real ensureQuery() adopts it if the session's
   // configuration is still the one it was started with.
   ensureQuery({ warm = false } = {}) {
+    if (this._authChanging) { this._startRefused = { code: 'auth_changing', message: 'Sign-in is changing. Try again.' }; return null; }
     if (this.q) return this.q;
     // Panel sessions under a named Claude account: every process start checks
     // the account again (a message, a recreation after a stall, a lost-session
@@ -480,6 +484,16 @@ export class ClaudeSession {
       return null;
     }
     let accountEnv = null;
+    if (!this.panel && typeof this.opts.claudeAccountId === 'string' && this.opts.claudeAccountId && this.opts.claudeAccountId !== 'default'
+      && typeof deps.claudeAccountLaunch === 'function') {
+      let launch = null;
+      try { launch = deps.claudeAccountLaunch(this.opts.claudeAccountId); } catch { launch = null; }
+      if (!launch?.ok) {
+        this._startRefused = { code: 'account_unavailable', message: ACCOUNT_UNAVAILABLE };
+        log(`session create refused: the account "${this.opts.claudeAccountId}" is no longer set up`);
+        return null;
+      }
+    }
     if (this.panel && this.accountId) {
       accountEnv = this._accountEnvOf(this.accountId);
       if (!accountEnv) {
@@ -609,9 +623,24 @@ export class ClaudeSession {
       abortController: this.abortController,
       stderr: (text) => {
         const t = String(text || '').trim();
-        if (t) this.send({ type: 'stderr', text: t });
+        // Raw diagnostic chunks can split a credential. API-key sessions use
+        // the SDK's structured errors instead of forwarding raw stderr.
+        if (t && !this._usesProfileApiKey) this.send({ type: 'stderr', text: t });
       },
     };
+    // The account decides the credential (lib/claude-accounts.js launchFor()):
+    // every inherited credential variable is removed, then the account's own
+    // config directory and, in API-key mode, its key are added. Subscription
+    // mode adds no key, so Claude Code uses the login in that directory. No
+    // other account's key, and nothing SynaBun was started with, reaches it.
+    const launch = this._launchFor(accountEnv);
+    this._usesProfileApiKey = !!launch?.env?.ANTHROPIC_API_KEY;
+    this._credentialMode = launch?.mode || null; // what the process was given: 'subscription' | 'apiKey'
+    if (launch) options.env = applyClaudeLaunchEnv(options.env, launch);
+    // On Windows, the Git Bash the host names for this process (lib/git-bash/: SynaBun's own copy on a PC without
+    // one); without it Claude Code has no Bash tool and runs the hooks in PowerShell. Panel tabs and the brain.
+    if (typeof deps?.childEnv === 'function') options.env = deps.childEnv(options.env);
+
     if (Array.isArray(sessionOpts.disallowedTools) && sessionOpts.disallowedTools.length) options.disallowedTools = [...sessionOpts.disallowedTools];
     if (this.panel) {
       // The process is launched able to take Bypass, so the tab's mode control
@@ -920,6 +949,29 @@ export class ClaudeSession {
     return env;
   }
 
+  // The launch of the account this session runs under (the host's
+  // claudeAccountLaunch(), lib/claude-accounts.js launchFor()), or null when
+  // the session names none: panel sessions always do ('' = the default
+  // account); any other session only when it was given `claudeAccountId` (the
+  // Assistant's brain). A host without claudeAccountLaunch gets what it had:
+  // the named account's directory and the profile key, nothing stripped for
+  // a default account without a key.
+  _launchFor(accountEnv) {
+    const named = this.panel ? (this.accountId || 'default') : (typeof this.opts.claudeAccountId === 'string' && this.opts.claudeAccountId ? this.opts.claudeAccountId : null);
+    if (!named) return null;
+    if (typeof deps.claudeAccountLaunch === 'function') {
+      let launch = null;
+      try { launch = deps.claudeAccountLaunch(named); } catch { launch = null; }
+      if (launch?.ok) return launch;
+      return null;
+    }
+    if (!this.panel) return null;
+    let key = null;
+    try { key = deps.claudeAccountApiKey?.(named) || null; } catch { key = null; }
+    if (!accountEnv && !key) return null;
+    return { ok: true, accountId: named, mode: key ? 'apiKey' : 'subscription', env: { ...(accountEnv || {}), ...(key ? { ANTHROPIC_API_KEY: key } : {}) }, unset: [...CLAUDE_CREDENTIAL_ENV] };
+  }
+
   // A start ensureQuery() refused (see there): tell the tab why and close the
   // turn it is waiting on. False when the last start was not refused.
   _announceRefusedStart() {
@@ -1383,6 +1435,11 @@ export class ClaudeSession {
         }
         return;
       }
+      case 'rate_limit_event': {
+        try { deps?.accountRateLimit?.(this.panel ? this.accountId || 'default' : this.opts.claudeAccountId || 'default', m.rate_limit_info); } catch {}
+        this.sendEvent(m);
+        return;
+      }
       case 'result': {
         this._flushDeltas();
         this._handleResult(m);
@@ -1645,7 +1702,7 @@ export class ClaudeSession {
           this.sendEvent({
             type: 'system', subtype: 'session_info',
             info: {
-              account: r.account || null,
+              account: this._usesProfileApiKey ? { authMethod: 'apiKey' } : r.account || null,
               outputStyle: r.output_style || '',
               availableOutputStyles: Array.isArray(r.available_output_styles) ? r.available_output_styles : [],
               models: Array.isArray(r.models) ? r.models : [],
@@ -3128,6 +3185,28 @@ export class ClaudeSession {
   }
 }
 
+// Credentials are fixed in the CLI environment. Retire only this account's
+// idle panel processes before changing its key; hold starts until storage/logout
+// finishes. Other accounts and non-panel SDK callers are unaffected.
+// (The Assistant's brain names its account with `claudeAccountId`: retired the same way.)
+const sessionAccountOf = (s) => (s.panel ? (s.accountId || 'default') : (typeof s.opts?.claudeAccountId === 'string' && s.opts.claudeAccountId ? s.opts.claudeAccountId : null));
+export async function withPanelAccountAuthChange(accountId, change) {
+  const sessions = [..._allSessions].filter(s => !s.destroyed && sessionAccountOf(s) === accountId);
+  if (sessions.some(s => s.inTurn || s.pendingTurns || s.pendingPerms.size || s._hasPendingWork() || s._authChanging)) {
+    throw Object.assign(new Error('Finish or stop this account’s work before changing sign-in.'), { status: 409 });
+  }
+  for (const session of sessions) session._authChanging = true;
+  try {
+    await Promise.all(sessions.map(session => session._endQuery({ graceful: false })));
+    return await change();
+  } finally { for (const session of sessions) session._authChanging = false; }
+}
+
+/** Whether a live session (a panel tab's, the Assistant brain's) runs under this account. */
+export function accountInUse(accountId) {
+  return [..._allSessions].some(s => !s.destroyed && sessionAccountOf(s) === accountId);
+}
+
 // ── connection layer ─────────────────────────────────────────────────────────
 
 export function createClaudeBridge(ws) {
@@ -3216,6 +3295,14 @@ export function isSessionLive(sessionId) {
   return [..._allSessions].some(s => !s.destroyed && s.sessionId === sessionId && !!s.q);
 }
 
+// How many side-panel sessions are working (a turn, a question, background tasks
+// or crons, a sign-in change): the desktop app waits for them before it restarts
+// into an update (GET /api/system/activity). The Assistant's brain counts there itself.
+export function panelSessionsWorking() {
+  return [..._allSessions].filter(s => s.panel && !s.destroyed
+    && (s.inTurn || s.pendingTurns || s.pendingPerms.size || s._hasPendingWork() || s._authChanging)).length;
+}
+
 export function shutdownAllBridges() {
   for (const session of [..._allSessions]) {
     try { session.destroy(); } catch {}