spawnllm 0.13.3__tar.gz → 0.13.4__tar.gz

{spawnllm-0.13.3 → spawnllm-0.13.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: spawnllm
-Version: 0.13.3
+Version: 0.13.4
 Summary: Delete your subprocess wrappers around claude, codex, and gemini.
 Keywords: 
 Author: Yasyf Mohamedali

{spawnllm-0.13.3 → spawnllm-0.13.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "spawnllm"
-version = "0.13.3"
+version = "0.13.4"
 description = "Delete your subprocess wrappers around claude, codex, and gemini."
 readme = "README.md"
 license = "MIT"

{spawnllm-0.13.3 → spawnllm-0.13.4}/pyproject.toml.orig

@@ -1,7 +1,7 @@
 [project]
 name = "spawnllm"
 # Inert sentinel: the real version is set from the release tag (uv version --frozen).
-version = "0.13.3"
+version = "0.13.4"
 description = "Delete your subprocess wrappers around claude, codex, and gemini."
 readme = "README.md"
 license = "MIT"

{spawnllm-0.13.3 → spawnllm-0.13.4}/spawnllm/backends/base.py

@@ -83,6 +83,20 @@ class BackendCallError(RuntimeError):
     """
 
 
+@dataclass(frozen=True)
+class ClaudeIsolation:
+    """A seeded throwaway config home and the env a claude run adds beside it.
+
+    Attributes:
+        config_dir: Path substituted for `${isolated_config_dir}` in the plan.
+        env: Variables the run sets on the child, such as `CLAUDE_CODE_OAUTH_TOKEN`
+            carrying the claude.ai access token; never written to disk.
+    """
+
+    config_dir: str
+    env: dict[str, str]
+
+
 @dataclass(frozen=True)
 class Invocation:
     """A built CLI invocation: argv, optional stdin, and where to read the result.
@@ -382,8 +396,8 @@ class CliBackend(LlmBackend):
         """
         return self.binary
 
-    def claude_isolation(self) -> str:
-        """Return the isolated config home a claude run substitutes into `${isolated_config_dir}`."""
+    def claude_isolation(self) -> ClaudeIsolation:
+        """Return the config home a claude run substitutes into `${isolated_config_dir}` and the env it adds."""
         raise NotImplementedError
 
     def build_command(self, spec: RunSpec) -> list[str]:
@@ -422,9 +436,11 @@ class CliBackend(LlmBackend):
             argv = [tokens.get(arg, arg) for arg in plan["argv"]]
             env = plan["env"]
             if plan["needs_claude_isolation"]:
-                directory = self.claude_isolation()
-                argv = [arg.replace("${isolated_config_dir}", directory) for arg in argv]
-                env = {key: value.replace("${isolated_config_dir}", directory) for key, value in env.items()}
+                isolation = self.claude_isolation()
+                argv = [arg.replace("${isolated_config_dir}", isolation.config_dir) for arg in argv]
+                env = {
+                    key: value.replace("${isolated_config_dir}", isolation.config_dir) for key, value in env.items()
+                } | isolation.env
         except BaseException:
             for path in paths.values():
                 Path(path).unlink(missing_ok=True)
@@ -446,13 +462,16 @@ class CliBackend(LlmBackend):
             spec: The configured run; the plan gates isolation on `spec.isolated`.
 
         Returns:
-            The plan's env map with `${isolated_config_dir}` resolved, or `{}`.
+            The plan's env map with `${isolated_config_dir}` resolved plus the
+            isolation's own entries, or `{}`.
         """
         plan = self.core_plan(spec)
         if not plan["needs_claude_isolation"]:
             return plan["env"]
-        directory = self.claude_isolation()
-        return {key: value.replace("${isolated_config_dir}", directory) for key, value in plan["env"].items()}
+        isolation = self.claude_isolation()
+        return {
+            key: value.replace("${isolated_config_dir}", isolation.config_dir) for key, value in plan["env"].items()
+        } | isolation.env
 
     def accounting(self, raw: str) -> tuple[float | None, dict[str, object] | None]:
         """Return the `(cost_usd, usage)` the core's `resolve` op reads from `raw`."""

{spawnllm-0.13.3 → spawnllm-0.13.4}/spawnllm/backends/claude.py

@@ -12,7 +12,7 @@ from pathlib import Path
 from typing import TYPE_CHECKING, ClassVar
 
 from spawnllm import _core
-from spawnllm.backends.base import CliBackend
+from spawnllm.backends.base import ClaudeIsolation, CliBackend
 
 if TYPE_CHECKING:
     from spawnllm.types import ProviderName, TModel
@@ -43,7 +43,8 @@ class ClaudeCliBackend(CliBackend):
 
     The core plans the `claude -p` argv (prompt delivered over stdin, result read
     from a stdout file) and lays out the host-free config home this backend seeds
-    with only the active-account pointer and claude.ai OAuth token.
+    with only the active-account pointer; the claude.ai access token reaches the
+    child as `CLAUDE_CODE_OAUTH_TOKEN`, never as a file.
 
     Attributes:
         models: Mapping from abstract model size to a Claude model alias
@@ -63,18 +64,20 @@ class ClaudeCliBackend(CliBackend):
 
     _isolated_config_dir: str | None = None
 
-    def claude_isolation(self) -> str:
-        """Return the process-lifetime isolated config home, creating and seeding it once.
+    def claude_isolation(self) -> ClaudeIsolation:
+        """Return the isolation for one run: the process-lifetime config home and the env resolved now.
 
         The core's `claude_isolation_sources` op resolves the account pointer,
         credentials file, and Keychain service from the caller's effective config
-        home; this host reads those sources (falling back to the Keychain when the
-        credentials file is absent), hands them to `claude_isolation_seed` for the
-        exact files-and-modes to write, and materializes them into a fresh temp
-        dir removed at interpreter exit. The dir is cached on the backend.
+        home, naming no credential source when the process already carries
+        `CLAUDE_CODE_OAUTH_TOKEN`; this host reads those sources (falling back to
+        the Keychain when the credentials file is absent) and hands them to
+        `claude_isolation_seed` for the exact files-and-modes to write and the env
+        to set. The files land in a fresh temp dir removed at interpreter exit,
+        created on the first call and cached on the backend; the env is resolved
+        on every call so a renewed Keychain token reaches the next run, and it
+        only ever lives in memory.
         """
-        if self._isolated_config_dir is not None:
-            return self._isolated_config_dir
         sources = _core.dispatch(
             "claude_isolation_sources",
             {
@@ -84,21 +87,23 @@ class ClaudeCliBackend(CliBackend):
                     "claude_config_dir_env": os.environ.get("CLAUDE_CONFIG_DIR") or None,
                     "claude_securestorage_config_dir_env": os.environ.get("CLAUDE_SECURESTORAGE_CONFIG_DIR"),
                     "claude_code_custom_oauth_url_env": os.environ.get("CLAUDE_CODE_CUSTOM_OAUTH_URL"),
+                    "claude_code_oauth_token_env": os.environ.get("CLAUDE_CODE_OAUTH_TOKEN"),
                 }
             },
         )
         account_json = read_file_opt(sources["account_path"])
-        credentials_json = read_file_opt(sources["credentials_path"])
+        credentials_json = read_file_opt(sources["credentials_path"]) if sources["credentials_path"] else None
         if credentials_json is None and sources["keychain_service"] is not None:
             credentials_json = keychain_credentials(sources["keychain_service"])
         seed = _core.dispatch(
             "claude_isolation_seed", {"account_json": account_json, "credentials_json": credentials_json}
         )
-        config_dir = Path(tempfile.mkdtemp(prefix="spawnllm-claude-config-"))
-        for file in seed["files"]:
-            fd = os.open(config_dir / file["name"], os.O_WRONLY | os.O_CREAT | os.O_EXCL, int(file["mode"], 8))
-            with os.fdopen(fd, "w") as handle:
-                handle.write(file["content"])
-        atexit.register(shutil.rmtree, config_dir, ignore_errors=True)
-        self._isolated_config_dir = str(config_dir)
-        return self._isolated_config_dir
+        if self._isolated_config_dir is None:
+            config_dir = Path(tempfile.mkdtemp(prefix="spawnllm-claude-config-"))
+            for file in seed["files"]:
+                fd = os.open(config_dir / file["name"], os.O_WRONLY | os.O_CREAT | os.O_EXCL, int(file["mode"], 8))
+                with os.fdopen(fd, "w") as handle:
+                    handle.write(file["content"])
+            atexit.register(shutil.rmtree, config_dir, ignore_errors=True)
+            self._isolated_config_dir = str(config_dir)
+        return ClaudeIsolation(self._isolated_config_dir, seed["env"])