windows-development-sandbox 1.17.0 → 1.18.0

package/dist/host/profile/accounts.js

@@ -1,20 +1,23 @@
-// Several Claude logins for the sandbox. Each account is a saved copy of Claude's .credentials.json plus the
-// `oauthAccount` block of .claude.json, kept in host-only storage (<storage>\accounts, never mapped into a sandbox)
-// and encrypted with Windows DPAPI (host/secrets): only the name, e-mail and date are readable in the file. Accounts
+// Several Claude logins for the sandbox. Each account is a saved copy of Claude's .credentials.json (a subscription) or
+// an Anthropic API key (one a Console login made, or one you gave), plus the `oauthAccount` block of .claude.json, kept
+// in host-only storage (<storage>\accounts, never mapped into a sandbox) and encrypted with Windows DPAPI
+// (host/secrets): only the name, e-mail, date, kind and a key's last 4 characters are readable in the file. Accounts
 // saved before that were plain; they are encrypted the first time they are read.
-// Switching writes them into the sandbox's persistent Claude state; when the sandbox is running the agent is then
-// restarted in place with --continue so the conversation carries on.
+// Switching writes them into the sandbox's persistent Claude state, where Claude itself keeps that kind of login
+// (claude-login.ts); when the sandbox is running the agent is then restarted in place with --continue so the
+// conversation carries on.
 import fs from 'node:fs';
 import path from 'node:path';
 import { z } from 'zod';
 import { isSafeFileName } from '../../shared/paths/index.js';
 import { JsonFile } from '../../shared/io/index.js';
 import { storageOf } from '../storage/index.js';
-import { errMsg, fail, fileExists } from '../../core/util/index.js';
+import { errMsg, fail, fileExists, isLink } from '../../core/util/index.js';
 import { SecretStore } from '../secrets/index.js';
 import { PluginShare } from './plugin-share.js';
-import { clearAccountCaches, emailOf, MAX_STATE_BYTES, readLogin, sandboxClaudeDir, readUntrusted, sandboxLogin, writeSandboxJson, } from './claude-login.js';
+import { apiKeyProblem, clearAccountCaches, dropSubscription, emailOf, keyState, LOGIN_KINDS, maskApiKey, MAX_STATE_BYTES, readLogin, sandboxClaudeDir, readUntrusted, sandboxLogin, subscriptionState, writeSandboxJson, } from './claude-login.js';
 const NAME = /^[A-Za-z0-9_-]{1,40}$/;
+/** A plain file from before accounts were encrypted (always a subscription). */
 const AccountSchema = z.object({
     name: z.string().regex(NAME),
     savedAt: z.string().max(64),
@@ -26,15 +29,27 @@ const IndexSchema = z.object({
     default: z.string().regex(NAME).optional(),
     active: z.record(z.string().max(200), z.string().regex(NAME)).optional(),
 });
-/** On disk: the readable details and the sealed login ({ credentials, oauthAccount }). */
+/** On disk: the readable details and the sealed login ({ credentials, oauthAccount, apiKey }). */
 const SealedSchema = z.object({
     name: z.string().regex(NAME),
     savedAt: z.string().max(64),
     email: z.string().max(200).nullable(),
+    /** Missing in accounts saved before keys could be: a subscription. */
+    kind: z.enum(LOGIN_KINDS).optional(),
+    keyHint: z
+        .string()
+        .regex(/^sk-ant-\.\.\.[A-Za-z0-9_-]{4}$/)
+        .optional(),
     sealed: z.string().max(200000),
 });
 const StoredSchema = z.union([SealedSchema, AccountSchema]);
 const isSealed = (s) => 'sealed' in s;
+/** What the sealed part holds. */
+const LoginSchema = z.object({
+    credentials: z.unknown(),
+    oauthAccount: z.unknown(),
+    apiKey: z.string().max(512).optional(),
+});
 export function accountsDir(storageRoot) {
     return path.join(storageRoot, 'accounts');
 }
@@ -95,18 +110,40 @@ export class AccountStore {
         return new JsonFile(StoredSchema, path.join(accountsDir(this.storageRoot), name + '.json'));
     }
     seal(account) {
-        const { name, savedAt, email, credentials, oauthAccount } = account;
-        return { name, savedAt, email, sealed: this.secrets.sealJson({ credentials, oauthAccount }) };
+        const { name, savedAt, email, kind, keyHint, credentials, oauthAccount, apiKey } = account;
+        return {
+            name,
+            savedAt,
+            email,
+            kind,
+            ...(keyHint ? { keyHint } : {}),
+            sealed: this.secrets.sealJson({ credentials, oauthAccount, ...(apiKey ? { apiKey } : {}) }),
+        };
     }
     store(name, login) {
-        const account = { name, savedAt: new Date().toISOString(), email: emailOf(login.oauthAccount), ...login };
+        const account = {
+            name,
+            savedAt: new Date().toISOString(),
+            email: emailOf(login.oauthAccount),
+            keyHint: login.apiKey ? maskApiKey(login.apiKey) : null,
+            ...login,
+        };
         this.file(name).write(this.seal(account));
         return account;
     }
-    /** The saved account's name, date and e-mail (nothing is decrypted). */
+    /** The saved account's name, date, e-mail and kind (nothing is decrypted). */
     meta(name) {
         const stored = validName(name) ? this.file(name).read() : null;
-        return stored ? { name: stored.name, savedAt: stored.savedAt, email: stored.email } : null;
+        if (!stored)
+            return null;
+        const sealed = isSealed(stored) ? stored : null;
+        return {
+            name: stored.name,
+            savedAt: stored.savedAt,
+            email: stored.email,
+            kind: sealed?.kind ?? 'subscription',
+            keyHint: sealed?.keyHint ?? null,
+        };
     }
     /**
      * The saved account with its login decrypted. A plain file from an older version is encrypted on the spot (it stays
@@ -117,16 +154,29 @@ export class AccountStore {
         if (!stored)
             return null;
         if (isSealed(stored)) {
-            const login = this.secrets.openJson(stored.sealed);
-            return { name: stored.name, savedAt: stored.savedAt, email: stored.email, ...login };
+            const login = LoginSchema.parse(this.secrets.openJson(stored.sealed));
+            const kind = stored.kind ?? 'subscription';
+            if (kind !== 'subscription' && (login.apiKey === undefined || apiKeyProblem(login.apiKey) !== null))
+                fail('The saved account "' + name + '" holds no usable API key.', 'Remove it and save the key again.');
+            return {
+                name: stored.name,
+                savedAt: stored.savedAt,
+                email: stored.email,
+                kind,
+                keyHint: stored.keyHint ?? null,
+                credentials: login.credentials,
+                oauthAccount: login.oauthAccount,
+                ...(kind === 'subscription' ? {} : { apiKey: login.apiKey }),
+            };
         }
+        const plain = { ...stored, kind: 'subscription', keyHint: null };
         try {
-            this.file(name).write(this.seal(stored));
+            this.file(name).write(this.seal(plain));
         }
         catch {
             // Could not encrypt now (DPAPI unavailable): the old plain file stays and is tried again next time.
         }
-        return stored;
+        return plain;
     }
     /** Encrypts every account still saved as plain text (older versions); returns how many it did. */
     sealLegacy() {
@@ -171,22 +221,39 @@ export class AccountStore {
             isDefault: a.name === def,
             isActive: a.name === active,
             savedAt: a.savedAt,
+            kind: a.kind,
+            keyHint: a.keyHint,
         }));
     }
-    /** Saves the sandbox's current login (or this PC's, with fromHost) under `name`. */
-    save(dataPath, name, fromHost) {
+    /**
+     * Saves the sandbox's current login (or this PC's, with fromHost) under `name`, whichever kind it is (`how.keyOnly`:
+     * only an API key; `how.envKey`: this PC's ANTHROPIC_API_KEY when nothing else is found).
+     */
+    save(dataPath, name, fromHost, how = {}) {
         assertName(name);
         const source = fromHost ?? sandboxLogin(dataPath);
-        const account = this.store(name, readLogin(source.claudeDir, source.globalStateFile));
-        if (!fromHost)
+        return this.keep(dataPath, name, readLogin(source.claudeDir, source.globalStateFile, how), !fromHost);
+    }
+    /** Saves an API key you gave (typed in) under `name`. */
+    saveApiKey(dataPath, name, apiKey) {
+        assertName(name);
+        const key = apiKey.trim();
+        const problem = apiKeyProblem(key);
+        if (problem)
+            fail('That is not an Anthropic API key.', problem);
+        return this.keep(dataPath, name, { kind: 'api-key', credentials: null, oauthAccount: null, apiKey: key }, false);
+    }
+    keep(dataPath, name, login, fromSandbox) {
+        const account = this.store(name, login);
+        if (fromSandbox)
             setActive(dataPath, name);
         if (!this.defaultName())
             this.setDefault(name);
         return account;
     }
     /**
-     * Makes `name` the sandbox's login. Claude refreshes (rotates) tokens while it runs, so the outgoing account's
-     * current tokens are saved back first; otherwise its stored refresh token could already be invalid.
+     * Makes `name` the sandbox's login. Claude refreshes (rotates) subscription tokens while it runs, so the outgoing
+     * subscription's current tokens are saved back first; otherwise its stored refresh token could already be invalid.
      */
     activate(dataPath, name) {
         const account = this.read(name) ??
@@ -196,9 +263,12 @@ export class AccountStore {
                     .join(', ') || 'none yet; save one with sandbox account save <name>'));
         const { claudeDir, globalStateFile } = sandboxLogin(dataPath);
         const outgoing = this.activeFor(dataPath);
-        if (outgoing && outgoing !== name && this.meta(outgoing) && fileExists(path.join(claudeDir, '.credentials.json'))) {
+        if (outgoing && outgoing !== name && this.meta(outgoing)?.kind === 'subscription') {
             try {
-                this.store(outgoing, readLogin(claudeDir, globalStateFile));
+                const current = readLogin(claudeDir, globalStateFile);
+                // Only a subscription is saved back over a subscription (a key login made inside would not be one).
+                if (current.kind === 'subscription')
+                    this.store(outgoing, current);
             }
             catch {
                 /* nothing usable to save back */
@@ -206,10 +276,20 @@ export class AccountStore {
         }
         fs.mkdirSync(claudeDir, { recursive: true });
         clearAccountCaches(claudeDir);
-        writeSandboxJson(path.join(claudeDir, '.credentials.json'), account.credentials);
         const state = readUntrusted(globalStateFile, MAX_STATE_BYTES);
-        if (account.oauthAccount && (state || !fileExists(globalStateFile)))
-            writeSandboxJson(globalStateFile, { ...(state ?? {}), oauthAccount: account.oauthAccount });
+        // A state file that is there but cannot be read (too big, not JSON) is not replaced: it holds the projects' state.
+        const writable = state !== null || !fileExists(globalStateFile) || isLink(globalStateFile);
+        if (account.kind === 'subscription') {
+            writeSandboxJson(path.join(claudeDir, '.credentials.json'), account.credentials);
+            if (writable && (account.oauthAccount || typeof state?.primaryApiKey === 'string'))
+                writeSandboxJson(globalStateFile, subscriptionState(state ?? {}, account.oauthAccount));
+        }
+        else {
+            if (!writable)
+                fail("The sandbox's Claude state (" + globalStateFile + ') cannot be read, so the API key cannot be put in.', 'Delete that file (Claude makes a new one), then switch again.');
+            dropSubscription(claudeDir);
+            writeSandboxJson(globalStateFile, keyState(state ?? {}, account.apiKey ?? '', account.oauthAccount));
+        }
         this.shareStep(dataPath, claudeDir);
         setActive(dataPath, name);
         return account;

package/dist/host/profile/claude-login.d.ts

@@ -1,7 +1,25 @@
+/** subscription: claude.ai OAuth; console: the key a Console login made; api-key: a key you gave. */
+export type LoginKind = 'subscription' | 'console' | 'api-key';
+export declare const LOGIN_KINDS: readonly ["subscription", "console", "api-key"];
 export interface Login {
+    readonly kind: LoginKind;
+    /** The text of .credentials.json (a subscription); null for a key. */
     readonly credentials: unknown;
     readonly oauthAccount: unknown;
+    /** The API key (console and api-key). */
+    readonly apiKey?: string;
 }
+/** How a login is looked for. */
+export interface CaptureOptions {
+    /** Only an API key (skip a subscription found next to it). */
+    readonly keyOnly?: boolean;
+    /** ANTHROPIC_API_KEY of this PC: the last place looked at (--from-host only). */
+    readonly envKey?: string | null;
+}
+/** What is wrong with a typed or found API key, or null when it has the right shape. Never quotes the key. */
+export declare function apiKeyProblem(key: string): string | null;
+/** The most of a key that is ever shown: sk-ant-...abcd. */
+export declare function maskApiKey(key: string): string;
 export interface LoginFiles {
     readonly claudeDir: string;
     readonly globalStateFile: string;
@@ -12,8 +30,20 @@ export declare function sandboxClaudeDir(dataPath: string): string;
 export declare function emailOf(oauthAccount: unknown): string | null;
 /** Reads a JSON file that may be sandbox-written: no links, size-capped. */
 export declare function readUntrusted(file: string, max: number): unknown;
-/** The login currently in a Claude config folder (+ its global state file). */
-export declare function readLogin(claudeDir: string, globalStateFile: string): Login;
+/**
+ * The login currently in a Claude config folder (+ its global state file), whichever kind it is: a subscription first
+ * (Claude uses it over a key), then a Console or API key in `primaryApiKey`, then `envKey`.
+ */
+export declare function readLogin(claudeDir: string, globalStateFile: string, how?: CaptureOptions): Login;
+/** The sandbox's .claude.json for a subscription: no `primaryApiKey` (Claude would ask about it), its e-mail block. */
+export declare function subscriptionState(state: Record<string, unknown>, oauthAccount: unknown): Record<string, unknown>;
+/** The sandbox's .claude.json for a key: the key where a Console login keeps it, approved, with its e-mail block. */
+export declare function keyState(state: Record<string, unknown>, apiKey: string, oauthAccount: unknown): Record<string, unknown>;
+/**
+ * Takes the subscription out of the sandbox's .credentials.json (Claude would use it over the key); the rest of the
+ * file (MCP server logins) stays. A file that cannot be read holds no login worth keeping and goes.
+ */
+export declare function dropSubscription(claudeDir: string): void;
 /** The sandbox's Claude login files (refuses when the data folder holds a link on the way). */
 export declare function sandboxLogin(dataPath: string): LoginFiles;
 /** Replaces a file that may be a sandbox-planted link instead of writing through it. */

package/dist/host/profile/claude-login.js

@@ -1,10 +1,43 @@
-// A Claude login as files: .credentials.json plus the `oauthAccount` block of .claude.json. The sandbox's copies are
-// guest-written: read without following links and size-capped; links are replaced, never written through.
+// A Claude login as files. Claude Code keeps three kinds (checked against Claude Code 2.1.296):
+// - a subscription (/login with Claude Pro, Max, Team ...): `claudeAiOauth` in .credentials.json;
+// - a Console login (/login with a Claude Console account): Claude makes an API key and keeps it as `primaryApiKey` in
+//   .claude.json (not in .credentials.json), with the last 20 characters in `customApiKeyResponses.approved`;
+// - an API key of your own (ANTHROPIC_API_KEY): goes where a Console key goes, so Claude uses it without asking.
+// Plus the `oauthAccount` block of .claude.json (the e-mail). Claude uses a subscription over a `primaryApiKey`, so a
+// key login goes in with no `claudeAiOauth` next to it, and a subscription goes in with no `primaryApiKey`.
+// The sandbox's copies are guest-written: read without following links and size-capped; links are replaced, never
+// written through. A key read from the sandbox must have the shape of an API key.
 import fs from 'node:fs';
 import path from 'node:path';
 import { assertTestWritable } from '../test-guard.js';
 import { hostDataFolder, hostDataRoot } from '../storage/index.js';
 import { assertNoLinks, fail, fileExists, isLink, removeLink, tryReadJson, writeJson } from '../../core/util/index.js';
+export const LOGIN_KINDS = ['subscription', 'console', 'api-key'];
+/** sk-ant-api03-...: a normal Anthropic API key (letters, digits, - and _, which is what Claude Code accepts). */
+const API_KEY = /^sk-ant-api\d{2}-[A-Za-z0-9_-]{20,400}$/;
+/** What is wrong with a typed or found API key, or null when it has the right shape. Never quotes the key. */
+export function apiKeyProblem(key) {
+    if (API_KEY.test(key))
+        return null;
+    if (key.startsWith('sk-ant-oat'))
+        return 'That is a Claude subscription token (from claude setup-token), not an API key. Save the subscription login instead.';
+    if (key.startsWith('sk-ant-admin'))
+        return 'That is an Admin key: it cannot run Claude. Make an API key instead.';
+    return 'An Anthropic API key starts with sk-ant-api and has only letters, digits, - and _ (copy it from the Claude Console).';
+}
+/** The most of a key that is ever shown: sk-ant-...abcd. */
+export function maskApiKey(key) {
+    return 'sk-ant-...' + key.slice(-4);
+}
+/** What Claude Code records in customApiKeyResponses for a key it may use (its last 20 characters). */
+function approvalOf(key) {
+    return key.trim().slice(-20);
+}
+/** A subscription login: .credentials.json with a `claudeAiOauth` block. */
+function hasSubscription(credentials) {
+    const oauth = credentials?.claudeAiOauth;
+    return typeof oauth === 'object' && oauth !== null;
+}
 const MAX_LOGIN_BYTES = 1024 * 1024;
 /** .claude.json holds per-project state and can be large; still capped so a hostile file cannot exhaust memory. */
 export const MAX_STATE_BYTES = 256 * 1024 * 1024;
@@ -21,16 +54,75 @@ export function emailOf(oauthAccount) {
 export function readUntrusted(file, max) {
     return fileExists(file) && !isLink(file) && fs.statSync(file).size <= max ? tryReadJson(file) : null;
 }
-/** The login currently in a Claude config folder (+ its global state file). */
-export function readLogin(claudeDir, globalStateFile) {
+/**
+ * The login currently in a Claude config folder (+ its global state file), whichever kind it is: a subscription first
+ * (Claude uses it over a key), then a Console or API key in `primaryApiKey`, then `envKey`.
+ */
+export function readLogin(claudeDir, globalStateFile, how = {}) {
     const credentials = readUntrusted(path.join(claudeDir, '.credentials.json'), MAX_LOGIN_BYTES);
-    if (!credentials || typeof credentials !== 'object')
-        fail('No Claude login found in ' + claudeDir + '.', 'Sign in to Claude first (inside the sandbox, or on this PC with --from-host), then save it again.');
+    const state = readUntrusted(globalStateFile, MAX_STATE_BYTES);
+    const oauthAccount = state?.oauthAccount ?? null;
+    if (!how.keyOnly && hasSubscription(credentials))
+        return { kind: 'subscription', credentials, oauthAccount };
+    const managed = typeof state?.primaryApiKey === 'string' ? state.primaryApiKey.trim() : null;
+    if (managed !== null && apiKeyProblem(managed) === null)
+        return { kind: oauthAccount ? 'console' : 'api-key', credentials: null, oauthAccount, apiKey: managed };
+    const envKey = how.envKey?.trim();
+    if (envKey && apiKeyProblem(envKey) === null)
+        return { kind: 'api-key', credentials: null, oauthAccount: null, apiKey: envKey };
+    return how.keyOnly
+        ? fail('No Claude API key found in ' + claudeDir + (how.envKey === undefined ? '.' : ' or in ANTHROPIC_API_KEY.'), 'Sign in to Claude with a Claude Console account first, or save a key you type: sandbox account save <name> --api-key')
+        : fail('No Claude login found in ' + claudeDir + '.', 'Sign in to Claude first (inside the sandbox, or on this PC with --from-host), then save it again.');
+}
+/** customApiKeyResponses with `add` approved, or `remove` taken off the approved list (Claude's own shape). */
+function approvals(state, change) {
+    const given = (state.customApiKeyResponses ?? {});
+    const strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === 'string') : [];
+    const add = change.add === undefined ? undefined : approvalOf(change.add);
+    const remove = change.remove === undefined ? undefined : approvalOf(change.remove);
+    if (add === undefined && !strings(given.approved).includes(remove ?? ''))
+        return state;
+    const approved = strings(given.approved).filter((k) => k !== add && k !== remove);
     return {
-        credentials,
-        oauthAccount: readUntrusted(globalStateFile, MAX_STATE_BYTES)?.oauthAccount ?? null,
+        ...state,
+        customApiKeyResponses: {
+            approved: add === undefined ? approved : [...approved, add],
+            rejected: strings(given.rejected).filter((k) => k !== add),
+        },
     };
 }
+/** The sandbox's .claude.json for a subscription: no `primaryApiKey` (Claude would ask about it), its e-mail block. */
+export function subscriptionState(state, oauthAccount) {
+    const { primaryApiKey, ...rest } = state;
+    const cleaned = typeof primaryApiKey === 'string' ? approvals(rest, { remove: primaryApiKey }) : rest;
+    return oauthAccount ? { ...cleaned, oauthAccount } : cleaned;
+}
+/** The sandbox's .claude.json for a key: the key where a Console login keeps it, approved, with its e-mail block. */
+export function keyState(state, apiKey, oauthAccount) {
+    const { primaryApiKey, oauthAccount: _outgoing, ...rest } = state;
+    const cleaned = typeof primaryApiKey === 'string' ? approvals(rest, { remove: primaryApiKey }) : rest;
+    return { ...approvals(cleaned, { add: apiKey }), primaryApiKey: apiKey, ...(oauthAccount ? { oauthAccount } : {}) };
+}
+/**
+ * Takes the subscription out of the sandbox's .credentials.json (Claude would use it over the key); the rest of the
+ * file (MCP server logins) stays. A file that cannot be read holds no login worth keeping and goes.
+ */
+export function dropSubscription(claudeDir) {
+    const file = path.join(claudeDir, '.credentials.json');
+    assertTestWritable(file);
+    if (isLink(file))
+        return removeLink(file);
+    if (!fs.existsSync(file))
+        return;
+    const credentials = readUntrusted(file, MAX_LOGIN_BYTES);
+    if (typeof credentials !== 'object' || credentials === null || Array.isArray(credentials))
+        return fs.rmSync(file, { force: true });
+    const { claudeAiOauth: _login, ...rest } = credentials;
+    if (Object.keys(rest).length)
+        writeSandboxJson(file, rest);
+    else
+        fs.rmSync(file, { force: true });
+}
 /** The sandbox's Claude login files (refuses when the data folder holds a link on the way). */
 export function sandboxLogin(dataPath) {
     assertNoLinks(hostDataRoot(dataPath), sandboxClaudeDir(dataPath));

package/dist/host/profile/index.d.ts

@@ -6,4 +6,4 @@ export { toRegFile, type RegValue } from './reg-file.js';
 export { AccountStore, accountsDir, type Account, type AccountMeta, type AccountRow } from './accounts.js';
 export { PluginShare, PLUGIN_SETTING_KEYS, MAX_PLUGIN_FILES, MAX_PLUGIN_BYTES } from './plugin-share.js';
 export { AgentAccountStore } from './agent-accounts.js';
-export { sandboxClaudeDir } from './claude-login.js';
+export { apiKeyProblem, maskApiKey, sandboxClaudeDir, type LoginKind } from './claude-login.js';

package/dist/host/profile/index.js

@@ -6,4 +6,4 @@ export { toRegFile } from './reg-file.js';
 export { AccountStore, accountsDir } from './accounts.js';
 export { PluginShare, PLUGIN_SETTING_KEYS, MAX_PLUGIN_FILES, MAX_PLUGIN_BYTES } from './plugin-share.js';
 export { AgentAccountStore } from './agent-accounts.js';
-export { sandboxClaudeDir } from './claude-login.js';
+export { apiKeyProblem, maskApiKey, sandboxClaudeDir } from './claude-login.js';

package/dist/host/secrets/launch-secrets.js

@@ -14,6 +14,7 @@ export function writeSecrets(dataPath, id, secrets) {
         !secrets.vpn &&
         !secrets.wireguardConfig &&
         !secrets.githubToken &&
+        !Object.keys(secrets.serviceAccounts ?? {}).length &&
         !secrets.liveFoldersKey;
     if (empty)
         return null;