CB-539: let a worker profile run on the subscription, explicitly

Add a per-profile subscription: true opt-in that lets a claude-code worker run on the operator's Claude subscription when there is no off-subscription endpoint for it (e.g. sonnet on ccs). When set, the launcher injects neither ANTHROPIC_BASE_URL nor ANTHROPIC_AUTH_TOKEN and skips SubscriptionGuard's base_url requirement for that profile only, logging a WARN naming the profile. subscription: true alongside a baseUrl is refused as contradictory. The default (absent/false) keeps today's hard refusal unchanged; every other profile stays allowlist-checked and SubscriptionGuard is untouched.
2026-08-13 08:37:45 +02:00
parent 793f2e7157
commit 73f6b12dd8
4 changed files with 167 additions and 8 deletions
@@ -119,6 +119,15 @@ public record BridgedConfig(
     *                       each adapter drives only its own kind. Normalised to lower-case; blank ⇒ the
     *                       default. It selects the adapter, not the transport — placement, tabs, cwd, and
     *                       the readiness gate are kind-independent and stay in the shared base.
+     * @param subscription  {@code true} to run this profile's workers on the operator's Claude
+     *                       subscription, on purpose (CB-539). When set, the launcher neither requires
+     *                       nor injects {@code ANTHROPIC_BASE_URL} / {@code ANTHROPIC_AUTH_TOKEN}, and the
+     *                       {@code SubscriptionGuard} base_url requirement is skipped <em>for this
+     *                       profile only</em>. Absent/{@code false} (the default) keeps today's hard
+     *                       refusal: a claude-code profile with no base_url may not spawn, because
+     *                       spawning one would bill the subscription. Mutually exclusive with
+     *                       {@code baseUrl} — setting both is a configuration error (the two state
+     *                       opposite intents).
     */
    @JsonIgnoreProperties(ignoreUnknown = true)
    public record Worker(String profile, String baseUrl, String model,
@@ -130,7 +139,8 @@ public record BridgedConfig(
                         String kind,
                         Map<String, String> env,
                         Float weight,
-                         Integer maxLoad) {
+                         Integer maxLoad,
+                         Boolean subscription) {

        /** Peer kind spawned by {@link dev.ltms.bridged.worker.ClaudeCodeLauncher} (the default). */
        public static final String KIND_CLAUDE_CODE = "claude-code";
@@ -163,6 +173,7 @@ public record BridgedConfig(
            env = (env == null) ? Map.of() : Map.copyOf(env);
            weight = (weight == null || weight <= 0.0f) ? 1.0f : weight;
            maxLoad = (maxLoad == null || maxLoad <= 0) ? null : maxLoad;
+            subscription = (subscription != null && subscription) ? Boolean.TRUE : Boolean.FALSE;
        }

        /**
@@ -175,7 +186,7 @@ public record BridgedConfig(
                      String placement, String workspace, String tabLabel, String mcpUrl,
                      String cwd, List<String> parityOverlay) {
            this(profile, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
-                    mcpUrl, cwd, parityOverlay, null, null, null, null, null, null);
+                    mcpUrl, cwd, parityOverlay, null, null, null, null, null, null, null);
        }

        /**
@@ -187,7 +198,7 @@ public record BridgedConfig(
                      String placement, String workspace, String tabLabel, String mcpUrl,
                      String cwd, List<String> parityOverlay, String gitTokenEnv, String gitHostEnv) {
            this(profile, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
-                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, null, null, null, null);
+                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, null, null, null, null, null);
        }

        /**
@@ -200,13 +211,13 @@ public record BridgedConfig(
                      String cwd, List<String> parityOverlay, String gitTokenEnv, String gitHostEnv,
                      String kind) {
            this(profile, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
-                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, null, null, null);
+                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, null, null, null, null);
        }

        /** A copy with {@code profile} set — used to default a profile to its {@code workers} key. */
        public Worker withProfile(String p) {
            return new Worker(p, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
-                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, env, weight, maxLoad);
+                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, env, weight, maxLoad, subscription);
        }

        /** True when this profile is served by the Claude Code adapter (the default kind). */
@@ -219,6 +230,29 @@ public record BridgedConfig(
            return KIND_OPENCODE.equals(kind);
        }

+        /**
+         * True when this profile runs on the operator's Claude subscription, on purpose (CB-539).
+         * Absent/{@code false} (the default) keeps the hard refusal: a claude-code profile with no
+         * base_url may not spawn, because doing so would bill the subscription.
+         */
+        public boolean isSubscription() {
+            return Boolean.TRUE.equals(subscription);
+        }
+
+        /**
+         * Backward-compatible constructor without the CB-539 subscription flag — the worker stays on
+         * the off-subscription boundary (the default). Keeps pre-CB-539 call sites (and any YAML
+         * that omits the flag) compiling and behaving identically.
+         */
+        public Worker(String profile, String baseUrl, String model,
+                      String configDir, String tokenEnv, List<String> argv,
+                      String placement, String workspace, String tabLabel, String mcpUrl,
+                      String cwd, List<String> parityOverlay, String gitTokenEnv, String gitHostEnv,
+                      String kind, Map<String, String> env, Float weight, Integer maxLoad) {
+            this(profile, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
+                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, env, weight, maxLoad, null);
+        }
+
        /** True when this profile's workers are granted a forge token to open their own PR (CB-302). */
        public boolean hasGitToken() {
            return gitTokenEnv != null && !gitTokenEnv.isBlank();
@@ -6,6 +6,8 @@ import dev.ltms.bridged.herdr.Agent;
 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.WorkspaceControl;
 import dev.ltms.bridged.peer.Capability;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;

 import java.util.EnumSet;
 import java.util.List;
@@ -36,6 +38,8 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
    /** Label prefix for this adapter's herdr agent names (drives naming + orphan reap). */
    private static final String NAME_PREFIX = "claude";

+    private static final Logger log = LoggerFactory.getLogger(ClaudeCodeLauncher.class);
+
    private final SubscriptionGuard guard;

    /**
@@ -116,14 +120,36 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     */
    @Override
    protected Launch buildLaunch(BridgedConfig.Worker cfg) {
+        // CB-539: a profile may deliberately opt into the subscription (subscription: true) when no
+        // off-subscription endpoint exists for it — e.g. `sonnet` on `ccs`. That profile gets no
+        // ANTHROPIC_BASE_URL/AUTH_TOKEN (there is nothing to point them at) and the guard's base_url
+        // requirement is skipped FOR IT ONLY. Every other profile keeps the hard boundary below.
+        boolean onSubscription = cfg.isSubscription();
        String baseUrl = cfg.baseUrl();
-        guard.assertWorker(baseUrl); // hard stop before we spawn anything
+
+        if (onSubscription) {
+            // NO SILENT CONTRADICTION: subscription:true + a baseUrl state opposite intents; refuse
+            // loudly rather than pick a winner.
+            if (baseUrl != null && !baseUrl.isBlank()) {
+                throw new IllegalStateException("profile '" + cfg.profile()
+                        + "' sets both subscription: true and a baseUrl ('" + baseUrl + "') — the two "
+                        + "are contradictory: a subscription profile must not point at an endpoint. "
+                        + "Drop baseUrl, or drop subscription: true.");
+            }
+            // Visible without anyone going looking for it: this worker bills the subscription.
+            log.warn("spawning profile '{}' on the Claude subscription (subscription: true) — this "
+                    + "worker WILL bill the operator's subscription", cfg.profile());
+        } else {
+            guard.assertWorker(baseUrl); // hard stop before we spawn anything
+        }

        Map<String, String> workerEnv = baseEnv(cfg);
-        workerEnv.put("ANTHROPIC_BASE_URL", baseUrl);
+        if (!onSubscription) {
+            workerEnv.put("ANTHROPIC_BASE_URL", baseUrl);
+            putIfPresent(workerEnv, "ANTHROPIC_AUTH_TOKEN", env.apply(cfg.tokenEnv()));
+        }
        putIfPresent(workerEnv, "ANTHROPIC_MODEL", cfg.model());
        putIfPresent(workerEnv, "CLAUDE_CONFIG_DIR", cfg.configDir());
-        putIfPresent(workerEnv, "ANTHROPIC_AUTH_TOKEN", env.apply(cfg.tokenEnv()));
        applyGitToken(workerEnv, cfg);

        return new Launch(workerEnv, argvWithModel(argvWithBridge(cfg), cfg));