brindle 0.3.14__tar.gz → 0.3.16__tar.gz

{brindle-0.3.14 → brindle-0.3.16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brindle
-Version: 0.3.14
+Version: 0.3.16
 Summary: Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges
 Project-URL: Homepage, https://pawdelta.com/brindle/
 Project-URL: Documentation, https://pawdelta.com/brindle/docs/recommended-use
@@ -94,7 +94,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.3.14`). A session started before an upgrade keeps
+session shows it too (`brindle 0.3.16`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start

{brindle-0.3.14 → brindle-0.3.16}/README.md

@@ -63,7 +63,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.3.14`). A session started before an upgrade keeps
+session shows it too (`brindle 0.3.16`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start

{brindle-0.3.14 → brindle-0.3.16}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "brindle"
-version = "0.3.14"
+version = "0.3.16"
 description = "Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges"
 readme = "README.md"
 requires-python = ">=3.11"

{brindle-0.3.14 → brindle-0.3.16}/src/brindle/agents.py

@@ -134,7 +134,9 @@ PERMISSION_GUIDANCE = (
     "Never `cd` into or read from the main checkout ({root}): it isn't yours, and it "
     "pauses you for approval. This worktree is already your isolated copy: don't create "
     "or enter another one (no EnterWorktree, no `git worktree add`). Write files with your Edit and Write tools, never with "
-    "shell heredocs or scripts, and don't write to /tmp."
+    "shell heredocs or scripts, and don't write to /tmp.\n"
+    "Waiting: to wait on something (your supervisor, a long command), wait for brindle's "
+    "messages or use the Monitor tool; don't poll with short cron loops."
 )
 
 
@@ -501,6 +503,10 @@ def _open_window(db: DB, agent: Agent, ws: Workspace, name: str, argv: list[str]
     server = tmux.current_server()
     db.update_agent(agent.id, tmux_window=target, tmux_server=server)
     agent.tmux_window, agent.tmux_server = target, server
+    if get_provider(agent.provider).startup_prompts and not agent.headless:
+        from brindle import prompt_answer
+
+        prompt_answer.launched(db, agent)
     if watch_pane:
         try:
             _ensure_sidebar(db, root_of(db, agent.id), ws, target)
@@ -881,11 +887,9 @@ def _launch(db: DB, agent: Agent, ws: Workspace, *, prompt: str | None,
             env={**base, **agent_env(ws, agent.id)},
         )
     else:
-        accepted = provider.after_launch(target)
-        if accepted:
-            ready(db, agent.id)
-            from brindle import launch_health
-            launch_health.accepted(db, agent)
+        from brindle import prompt_answer
+
+        prompt_answer.finish_launch(db, agent)
 
 
 def _prepare_launch_health(db: DB, agent: Agent, ws: Workspace, profile, m=_UNREAD,
@@ -1468,6 +1472,10 @@ def _send_message(db: DB, agent: Agent, body: str, sender_id: str | None) -> str
                    server=server_of(agent))
         return "delivered"
     message_id = db.enqueue(agent.id, text, sender_id)
+    from brindle import login_pause
+
+    if login_pause.holding(db, agent.id):
+        return "queued"  # its session waits on an expired cloud login
     if _deliver_to_inbox(db, agent, message_id, text, sender_id):
         return "delivered"
     reconcile(db, agent)
@@ -1559,10 +1567,13 @@ def flush(db: DB, agent_id: str) -> bool:
     something was delivered."""
     from brindle import inbox
     from brindle import launch_health
+    from brindle import login_pause
 
     agent = db.get_agent(agent_id)
     if agent is None or agent.headless:
         return False  # its runner takes messages from the inbox itself
+    if login_pause.holding(db, agent_id):
+        return False  # its session waits on an expired cloud login; resuming flushes it
     if inbox.usable(agent):
         delivered = False
         while (msg := db.pop_pending(agent_id)) is not None:
@@ -1759,6 +1770,7 @@ def wait_for_result(db: DB, agent_id: str, timeout: float, poll: float = 2.0) ->
         if agent.result is not None:
             return agent.result
         if not is_alive(agent):
+            _note_reviewer_end(db, agent)
             screen = ""
             try:
                 screen = tmux.capture(agent.tmux_window, lines=40, server=server_of(agent))
@@ -1885,8 +1897,25 @@ def pause_worker(db: DB, agent: Agent) -> None:
     db.set_status(agent.id, "paused")
 
 
+def _note_reviewer_end(db: DB, agent: Agent, ws: Workspace | None = None) -> None:
+    if agent.mode != "review" or agent.result is not None:
+        return
+    ws = ws or db.get_workspace(agent.workspace_id)
+    if ws is None:
+        return
+    from brindle import learning
+    from brindle.config import RepoConfig, load_repo_config
+
+    try:
+        cfg = load_repo_config(ws.repo_root)
+    except ValueError:
+        cfg = RepoConfig()
+    learning.note_reviewer(db, cfg, agent, ws)
+
+
 def kill(db: DB, agent_id: str) -> None:
     agent = get(db, agent_id)
+    _note_reviewer_end(db, agent)
     _stop(db, agent)
     db.delete_agent(agent.id)
 
@@ -1898,6 +1927,7 @@ def close(db: DB, agent_id: str, panes: dict[str, bool] | None = None) -> Agent:
     lists it, and a paused session can still be continued (which shows it
     again). Returns the agent as it was before closing."""
     agent = get(db, agent_id)
+    _note_reviewer_end(db, agent)
     if is_alive(agent, panes) and owns_pane(db, agent):
         _stop(db, agent)
         db.set_status(agent.id, "done" if agent.result is not None else "paused")
@@ -2045,8 +2075,10 @@ def default_review_profile(cfg: RepoConfig, worker: Agent | None, db: DB | None
     if _local_reviewer_available():
         candidates.append("reviewer-local")
     candidates = list(dict.fromkeys(candidates))
+    files, weight = learning._task_files(db, worker, repo_root) if worker else ((), None)
     pick, _ = learning.choose_why(db, cfg, repo_root, task, candidates=candidates,
-                                  default=cfg.reviewer)
+                                  default=cfg.reviewer, files=list(files) or None,
+                                  weight=weight)
     return pick or cfg.reviewer
 
 
@@ -2629,6 +2661,12 @@ def handle_hook(db: DB, agent_id: str, event: str, payload: dict) -> dict | None
     agent = db.get_agent(agent_id)
     if agent is None:
         return None
+    # A hook runs only once the session is going, so its launch is past any
+    # startup prompt: a menu on its pane from now on is the agent's own (a
+    # question for the user), which no sweep may answer.
+    from brindle import prompt_answer
+
+    prompt_answer.settled(db, agent)
     if event == "codex-permission-request":
         # Session/status writes are bookkeeping, never prerequisites for
         # returning a policy decision (especially a deny).
@@ -2652,8 +2690,11 @@ def handle_hook(db: DB, agent_id: str, event: str, payload: dict) -> dict | None
 
     if event in ("prompt-submit", "pre-tool", "tool-done") and agent.unreported_noted:
         # It's working again, so a later stop without a result is a new one
-        # its supervisor should hear about (see tell_parent_unreported).
-        db.update_agent(agent_id, unreported_noted=None)
+        # its supervisor should hear about (see tell_parent_unreported). A
+        # tool call alone isn't proof: agy resumes briefly each time it polls
+        # a running command, so only a prompt or a long-enough gap counts.
+        if event == "prompt-submit" or unreported_note_expired(agent):
+            db.update_agent(agent_id, unreported_noted=None)
 
     if event == "session-start":
         from brindle import inbox
@@ -2764,7 +2805,8 @@ def handle_hook(db: DB, agent_id: str, event: str, payload: dict) -> dict | None
                 # No Stop hook can remind it to report, and no hook says when
                 # it resumes: every turn it ends without a result is a stop
                 # its supervisor hears about.
-                db.update_agent(agent_id, unreported_noted=None)
+                if unreported_note_expired(agent):
+                    db.update_agent(agent_id, unreported_noted=None)
                 tell_parent_unreported(db, db.get_agent(agent_id) or agent)
             if db.pending_count(agent_id) and not agent.headless:
                 flush(db, agent_id)
@@ -2803,6 +2845,7 @@ def handle_hook(db: DB, agent_id: str, event: str, payload: dict) -> dict | None
         if is_auth or is_model:
             db.set_status(agent_id, "failed")
             db.clear_permission_requests(agent_id)
+            _note_reviewer_end(db, agent)
             from brindle import providers, autopilot as pilot
             if is_auth:
                 providers.invalidate_signed_in(agent.provider)
@@ -2889,11 +2932,19 @@ def agent_for_session(db: DB, session_id: object) -> str | None:
     return matches[-1].id if matches else None
 
 
+UNREPORTED_REALERT_SECONDS = 600
+
+
+def unreported_note_expired(agent: Agent) -> bool:
+    """Whether the stop alert recorded in ``unreported_noted`` (the time it
+    was sent) is old enough that a new stop deserves its own alert."""
+    noted = agent.unreported_noted
+    return not noted or time.time() - noted > UNREPORTED_REALERT_SECONDS
+
+
 def command_running(db: DB, agent: Agent) -> bool:
     """Whether a command the agent started (possibly in the background) is
     still running under it. Never raises: when unsure, it says no."""
-    if agent.provider != "claude":
-        return False
     try:
         from brindle import procs
 
@@ -2905,6 +2956,102 @@ def command_running(db: DB, agent: Agent) -> bool:
         return False
 
 
+TRANSCRIPT_ACTIVE_SECONDS = 45
+REOPEN_VERDICT_PROMPT = (
+    "Submit your verdict now: call the brindle `submit_review` tool with "
+    "`approved` and `summary` based on what you have already read."
+)
+
+
+def transcript_file(agent: Agent) -> str | None:
+    """The path to ``agent``'s own recorded transcript or rollout file, if one
+    exists on disk; None when the agent has no recorded session."""
+    if agent.transcript_path and os.path.isfile(agent.transcript_path):
+        return agent.transcript_path
+    ref = (agent.session_ref or "").strip()
+    if not ref:
+        return None
+    if agent.provider == "claude":
+        import glob
+
+        config = os.environ.get("CLAUDE_CONFIG_DIR") or os.path.expanduser("~/.claude")
+        found = glob.glob(os.path.join(glob.escape(config), "projects", "*", f"{glob.escape(ref)}.jsonl"))
+        return found[0] if found else None
+    if agent.provider == "codex":
+        from brindle import usage
+
+        rollout = usage.find_codex_rollout(ref, None, agent.created_at)
+        return str(rollout) if rollout and rollout.is_file() else None
+    if agent.provider == "antigravity":
+        candidate = os.path.expanduser(
+            f"~/.gemini/antigravity-cli/brain/{ref}/.system_generated/logs/transcript.jsonl"
+        )
+        return candidate if os.path.isfile(candidate) else None
+    if agent.provider == "native":
+        return ref if os.path.isfile(ref) else None
+    return None
+
+
+def transcript_active(agent: Agent, now: float | None = None) -> bool:
+    """Whether ``agent`` wrote to its transcript within
+    ``TRANSCRIPT_ACTIVE_SECONDS``. Never raises: when unsure, it says no."""
+    try:
+        path = transcript_file(agent)
+        if not path:
+            return False
+        now = time.time() if now is None else now
+        return now - os.stat(path).st_mtime < TRANSCRIPT_ACTIVE_SECONDS
+    except Exception:  # noqa: BLE001
+        return False
+
+
+def recorded_session(agent: Agent) -> str | None:
+    """The CLI session id recorded for ``agent`` itself, if its provider can
+    resume that conversation; None when no resumable session was recorded.
+    Never guesses from the working directory (``--continue``, ``resume --last``),
+    since a reviewer shares its worker's worktree."""
+    provider = get_provider(agent.provider)
+    ref = (agent.session_ref or "").strip()
+    if not ref and agent.provider == "claude" and agent.transcript_path:
+        if os.path.isfile(agent.transcript_path):
+            return Path(agent.transcript_path).stem
+    if not ref:
+        return None
+    if agent.provider == "claude" and agent.transcript_path and os.path.isfile(agent.transcript_path):
+        return ref
+    return ref if provider.can_resume(ref) else None
+
+
+def reopen_reviewer(db: DB, agent: Agent, ws: Workspace,
+                    prompt: str = REOPEN_VERDICT_PROMPT) -> bool:
+    """Resume a stalled reviewer once with a short verdict prompt: send the
+    prompt as a message if the reviewer's process is still alive (or keep an
+    already-queued reminder in flight), or reopen its own recorded CLI session
+    if the process exited. Returns True if resumed or queued, False when it has
+    no live pane or recorded session of its own."""
+    if not os.path.isdir(ws.path):
+        return False
+    if is_alive(agent):
+        if db.pending_count(agent.id) > 0:
+            try:
+                flush(db, agent.id)
+            except tmux.TmuxError:
+                db.set_status(agent.id, "idle", only_if="processing")
+            return True
+        try:
+            return send_message(db, agent.id, prompt) in ("delivered", "queued")
+        except (AgentError, tmux.TmuxError):
+            db.set_status(agent.id, "idle", only_if="processing")
+            return False
+    ref = recorded_session(agent)
+    if not ref:
+        return False
+    if agent.dismissed_at is not None:
+        db.update_agent(agent.id, dismissed_at=None)
+    _launch(db, agent, ws, prompt=prompt, resume=ref, watch_pane=False, background_setup=True)
+    return True
+
+
 def tell_parent_unreported(db: DB, agent: Agent) -> bool:
     """A worker stopped again after being reminded to report, still without a
     result. It won't be reminded again on its own, and its supervisor has
@@ -2914,6 +3061,7 @@ def tell_parent_unreported(db: DB, agent: Agent) -> bool:
     if agent.mode not in FORWARDING_MODES or not agent.parent_id:
         return False  # a synchronous handoff's caller is still waiting on it
     if db.get_agent(agent.parent_id) is None:
+        _note_reviewer_end(db, agent)
         return False
     ws = db.get_workspace(agent.workspace_id)
     if agent.mode == "review" and ws is not None and os.path.isdir(ws.path):
@@ -2923,17 +3071,18 @@ def tell_parent_unreported(db: DB, agent: Agent) -> bool:
             return False  # its verdict for the current commit is already recorded
     if agent.unreported_noted:
         return False  # the supervisor was told about this stop; cleared once it resumes
-    if command_running(db, agent):
+    if command_running(db, agent) or (is_alive(agent) and transcript_active(agent)):
         # Its turn ended while a long or background command (a test run) is
-        # still going: it isn't stopped, and the command finishing wakes it.
-        # Not marked noted, so a real stop later still gets its one alert.
+        # still going, or it is still writing to its transcript: it isn't
+        # stopped. Not marked noted, so a real stop later still gets its alert.
         return False
-    db.update_agent(agent.id, unreported_noted=1)
+    db.update_agent(agent.id, unreported_noted=int(time.time()))
     if agent.mode == "review" and ws is not None:
         from brindle import pipeline
 
         if pipeline.on_reviewer_unreported(db, get(db, agent.id), ws):
-            return True  # a fallback reviewer took over, or the supervisor was told
+            return True  # resumed, a fallback reviewer took over, or the supervisor was told
+    _note_reviewer_end(db, agent, ws)
     where =f" (branch `{ws.branch}`, workspace {ws.id})" if ws else ""
     tool = "submit_review" if agent.mode == "review" else "report_result"
     who = "Reviewer" if agent.mode == "review" else "Worker"

{brindle-0.3.14 → brindle-0.3.16}/src/brindle/autopilot.py

@@ -151,6 +151,10 @@ Acting on what you find:
 - Once you've laid out a plan, start it in the same turn. Don't end with
   "shall I start?" or wait for a "yes" or "go": if a step needs a decision
   only the user can make, ask that question and carry on with the rest.
+- To wait for workers, checks or anything else brindle runs, wait for
+  brindle's messages (they wake you) or use the Monitor tool; don't poll with
+  short cron loops, which spend turns and keep running while brindle has
+  paused the session (an expired cloud login, say).
 - Format your own verbose outputs or message transcripts in collapsible
   `<details><summary>Title</summary>...</details>` blocks so they are not
   sprawling in the chat UI."""
@@ -1501,8 +1505,10 @@ def on_stop(db: DB, agent: Agent, payload: dict) -> dict | None:
     ap = db.get_autopilot(agent.id)
     if ap is None or not ap.enabled or not ap.goal:
         return None
-    from brindle import agents
+    from brindle import agents, login_pause
 
+    if login_pause.paused(db, agent.id):
+        return None  # only the person can renew the login; a nudge would just fail
     if ap.state == "auditing":
         if ap.auditor_id:
             auditor = db.get_agent(ap.auditor_id)

{brindle-0.3.14 → brindle-0.3.16}/src/brindle/cli.py

@@ -2608,14 +2608,20 @@ def after_launch_cmd(agent_id: str, token: Optional[str] = typer.Option(None)) -
         return
     a = db.get_agent(agent_id)
     if a and a.tmux_window and a.status not in ("paused", "done") and a.result is None:
+        from brindle import prompt_answer
+
+        prompt_answer.bind(db, a)
         accepted = get_provider(a.provider).after_launch(a.tmux_window)
         if not launch_health.current(db, agent_id, token):
             return
         if accepted:
+            prompt_answer.settled(db, a)
             agents.ready(db, agent_id)
             # Carry the observed launch token into the delivery CAS.
             a._launch_health_token = token
             launch_health.accepted(db, a)
+        else:
+            prompt_answer.report_blocked(db, a)
         launch_health.inspect(db, agent_id, wait=False, token=token)
 
 

brindle-0.3.16/src/brindle/cloud_login.py

@@ -0,0 +1,225 @@
+"""Cloud login state, read without calling the model.
+
+``status(provider)`` says whether the Bedrock, Vertex or Foundry login is still
+good, when it lapses, and the one command that renews it. It reads the CLIs'
+own credential files (AWS SSO cache, Azure CLI token cache) and, for Google,
+whose application-default credentials hold only a refresh token, asks gcloud
+for an access token. Token values are never logged or returned.
+"""
+
+from __future__ import annotations
+
+import configparser
+import hashlib
+import json
+import os
+import subprocess
+import time
+import urllib.parse
+import urllib.request
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Mapping
+
+from brindle import model_access
+
+CLI_TIMEOUT = 15.0
+
+_FLAGS = {"bedrock": "CLAUDE_CODE_USE_BEDROCK", "vertex": "CLAUDE_CODE_USE_VERTEX",
+          "foundry": "CLAUDE_CODE_USE_FOUNDRY"}
+
+
+@dataclass(frozen=True)
+class LoginStatus:
+    ok: bool
+    expires_at: float | None
+    refresh_cmd: str
+    note: str
+    # The login lapsed and the CLI couldn't renew it: only ``refresh_cmd`` (the
+    # person) can. False for a login that is fine, missing or undetermined.
+    expired: bool = False
+
+
+def provider_from_env(env: Mapping[str, str] | None = None) -> str | None:
+    """The cloud provider whose ``CLAUDE_CODE_USE_*`` flag is on, or None."""
+    env = os.environ if env is None else env
+    for provider, flag in _FLAGS.items():
+        if str(env.get(flag, "")).strip().lower() in ("1", "true", "yes", "on"):
+            return provider
+    return None
+
+
+def _epoch(value) -> float | None:
+    """A timestamp as epoch seconds: a number, a numeric string or ISO 8601."""
+    if isinstance(value, (int, float)) and not isinstance(value, bool):
+        return float(value)
+    if not isinstance(value, str) or not value.strip():
+        return None
+    try:
+        return float(value)
+    except ValueError:
+        pass
+    try:
+        dt = datetime.fromisoformat(value.strip().replace("UTC", "Z").replace("Z", "+00:00"))
+    except ValueError:
+        return None
+    if dt.tzinfo is None:
+        dt = dt.replace(tzinfo=timezone.utc)
+    return dt.timestamp()
+
+
+def _json_files(paths) -> list:
+    out = []
+    for p in paths:
+        try:
+            out.append(json.loads(Path(p).read_text(encoding="utf-8")))
+        except (OSError, ValueError):
+            continue
+    return out
+
+
+def _from_expiry(expires_at: float | None, refresh_cmd: str, now: float, missing: str) -> LoginStatus:
+    if expires_at is None:
+        return LoginStatus(False, None, refresh_cmd, missing)
+    if expires_at <= now:
+        return LoginStatus(False, expires_at, refresh_cmd, "login expired", expired=True)
+    return LoginStatus(True, expires_at, refresh_cmd, "logged in")
+
+
+def _aws_token_key(profile: str, config_path: Path) -> str | None:
+    """What the SSO cache file name is the SHA-1 of for ``profile``: its
+    sso_session name, or (legacy config) its sso_start_url; None when the
+    profile doesn't use SSO."""
+    cp = configparser.RawConfigParser()
+    try:
+        cp.read(config_path, encoding="utf-8")
+    except (OSError, configparser.Error):
+        return None
+    section = "default" if profile == "default" else f"profile {profile}"
+    if not cp.has_section(section):
+        return None
+    return cp.get(section, "sso_session", fallback=None) or cp.get(
+        section, "sso_start_url", fallback=None)
+
+
+def _aws(env: Mapping[str, str], home: Path, now: float) -> LoginStatus:
+    profile = env.get("AWS_PROFILE") or env.get("AWS_DEFAULT_PROFILE") or "default"
+    refresh = f"aws sso login --profile {profile}"
+    config = Path(env.get("AWS_CONFIG_FILE") or home / ".aws" / "config")
+    key = _aws_token_key(profile, config)
+    if key is None:
+        return LoginStatus(False, None, refresh, f"AWS profile {profile} is not an SSO profile")
+    token = home / ".aws" / "sso" / "cache" / (hashlib.sha1(key.strip().encode()).hexdigest() + ".json")
+    data = (_json_files([token]) or [None])[0]
+    expires = _epoch(data.get("expiresAt")) if isinstance(data, dict) and data.get("accessToken") else None
+    return _from_expiry(expires, refresh, now, "no AWS SSO login found for this profile")
+
+
+def _full_env(env: Mapping[str, str] | None) -> dict[str, str] | None:
+    """The environment for a CLI call: the supplied one over the ambient one,
+    or None (inherit) when the caller supplied none."""
+    return None if env is None else {**os.environ, **env}
+
+
+def _azure_expiry(token: dict) -> float | None:
+    exp = _epoch(token.get("expires_on"))
+    if exp is not None:
+        return exp
+    try:   # "expiresOn" is a naive local time
+        return datetime.fromisoformat(str(token.get("expiresOn")).strip()).timestamp()
+    except ValueError:
+        return None
+
+
+def _azure(run, env, now: float) -> LoginStatus:
+    refresh = "az login"
+    try:
+        proc = run(["az", "account", "get-access-token", "--output", "json"],
+                   capture_output=True, text=True, timeout=CLI_TIMEOUT, env=_full_env(env))
+    except subprocess.TimeoutExpired:
+        return LoginStatus(False, None, refresh, "az timed out fetching an access token")
+    except OSError:
+        return LoginStatus(False, None, refresh, "az is not installed")
+    if proc.returncode == 0:
+        try:
+            token = json.loads(proc.stdout or "")
+        except ValueError:
+            token = None
+        exp = _azure_expiry(token) if isinstance(token, dict) else None
+        if exp is not None:
+            return _from_expiry(exp, refresh, now, "")
+    if model_access.expired_login(f"{proc.stdout or ''}\n{proc.stderr or ''}") is not None:
+        return LoginStatus(False, None, refresh, "login expired", expired=True)
+    return LoginStatus(False, None, refresh, "no Azure CLI login found")
+
+
+def tokeninfo_expiry(token: str, timeout: float = CLI_TIMEOUT) -> float | None:
+    """Seconds the Google access ``token`` has left, from Google's tokeninfo
+    endpoint (the token goes in the POST body, never a URL), or None."""
+    req = urllib.request.Request("https://oauth2.googleapis.com/tokeninfo",
+                                 data=urllib.parse.urlencode({"access_token": token}).encode())
+    try:
+        with urllib.request.urlopen(req, timeout=timeout) as r:   # noqa: S310 - fixed https URL
+            return float(json.load(r)["expires_in"])
+    except (OSError, ValueError, KeyError, TypeError):
+        return None
+
+
+def _google(run, env, now: float, expiry) -> LoginStatus:
+    refresh = "gcloud auth application-default login"
+    try:
+        proc = run(["gcloud", "auth", "application-default", "print-access-token"],
+                   capture_output=True, text=True, timeout=CLI_TIMEOUT, env=_full_env(env))
+    except subprocess.TimeoutExpired:
+        return LoginStatus(False, None, refresh, "gcloud timed out refreshing the access token")
+    except OSError:
+        return LoginStatus(False, None, refresh, "gcloud is not installed")
+    token = (proc.stdout or "").strip()
+    if proc.returncode == 0 and token:
+        left = expiry(token)
+        if left is None:
+            return LoginStatus(True, None, refresh, "logged in; token expiry unknown")
+        return LoginStatus(True, now + left, refresh, "logged in")
+    if model_access.expired_login(f"{proc.stdout or ''}\n{proc.stderr or ''}") is not None:
+        return LoginStatus(False, None, refresh, "login expired (invalid_grant)", expired=True)
+    return LoginStatus(False, None, refresh, "gcloud could not produce an access token")
+
+
+def status(provider: str | None = None, *, env: Mapping[str, str] | None = None,
+           home: str | Path | None = None, now: float | None = None,
+           run=subprocess.run, expiry=tokeninfo_expiry) -> LoginStatus:
+    """The login state for ``provider`` (bedrock, vertex or foundry; by default
+    the one the environment's ``CLAUDE_CODE_USE_*`` flag selects)."""
+    supplied = env
+    env = os.environ if env is None else {**os.environ, **env}
+    provider = provider or provider_from_env(env)
+    home = Path(home) if home is not None else Path.home()
+    now = time.time() if now is None else now
+    if provider == "bedrock":
+        return _aws(env, home, now)
+    if provider == "vertex":
+        return _google(run, supplied, now, expiry)
+    if provider == "foundry":
+        return _azure(run, supplied, now)
+    return LoginStatus(True, None, "", "no cloud provider selected")
+
+
+def refresh(provider: str | None = None, *, env: Mapping[str, str] | None = None,
+            home: str | Path | None = None, now: float | None = None,
+            run=subprocess.run, expiry=tokeninfo_expiry) -> LoginStatus:
+    """Renew the login without the person where the CLI can, and return the
+    status after. Asking gcloud or az for an access token (as ``status`` does)
+    renews it from the stored refresh token; the AWS CLI renews an SSO token
+    from its sso-session refresh token on any call. What needs a browser
+    (invalid_rapt, a lapsed SSO session) stays ``expired``."""
+    full = os.environ if env is None else {**os.environ, **env}
+    provider = provider or provider_from_env(full)
+    if provider == "bedrock":
+        profile = full.get("AWS_PROFILE") or full.get("AWS_DEFAULT_PROFILE") or "default"
+        try:
+            run(["aws", "sts", "get-caller-identity", "--profile", profile, "--output", "json"],
+                capture_output=True, text=True, timeout=CLI_TIMEOUT, env=_full_env(env))
+        except (subprocess.TimeoutExpired, OSError):
+            pass    # the cache then still says what the login is
+    return status(provider, env=env, home=home, now=now, run=run, expiry=expiry)