2.2.0

Companies bring their own model key.

The claude adapter is now a tool-use loop against the Anthropic Messages API, in the server process, on the company's own API key. The agent gets the five tab tools and a finish tool that carries the result contract, and nothing else: no files, no shell. Token usage is priced per model into the run's model cost. Overloads and 5xx replies are retried.

Keys are checked against the API once, sealed with AES-256-GCM under a master key in <db>.key with the company id as additional authenticated data, hinted by their last four characters, and never returned. Claude agents hired before a key exists wait, with one needs-model-key event, and start on the next tick after a key arrives. tab company model-key sets or removes it.

The Claude Code adapter is now claude-code and only offered with --local-claude. --host-model-key runs keyless companies on the server's ANTHROPIC_API_KEY. The hosted dashboard runs with neither.

The tab tools moved to src/tools.ts, shared by the MCP server and the adapter. The dashboard script runs under a per-response CSP nonce. A Playwright suite drives the dashboard end to end in a real browser (npm run test:dashboard).

Install: npm i -g paidwithtab@2.2.0