@bjoernrochel/sevro 1.0.0 → 1.1.0

package/dist/src/hosts/claude-events.js

@@ -0,0 +1,136 @@
+import { isRecord } from "../value-guards.js";
+const MAX_EVENT_STREAM_BYTES = 8 * 1024 * 1024;
+export class ClaudeEventError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ClaudeEventError";
+    }
+}
+/** Decode JSON once; consumers retain their own event validity rules. */
+export function parseClaudeEvents(stream) {
+    if (typeof stream !== "string")
+        return stream;
+    if (Buffer.byteLength(stream, "utf8") > MAX_EVENT_STREAM_BYTES)
+        throw new ClaudeEventError("Claude event stream exceeds 8 MiB");
+    return {
+        lines: stream
+            .split("\n")
+            .filter((line) => line.trim())
+            .map(parseLine),
+    };
+}
+function parseLine(line) {
+    try {
+        return { parsed: true, value: JSON.parse(line) };
+    }
+    catch (error) {
+        return { parsed: false, error };
+    }
+}
+function nonnegative(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0;
+}
+function validAssistant(value) {
+    if (!isRecord(value.message) || !Array.isArray(value.message.content))
+        return false;
+    return value.message.content.every(validAssistantBlock);
+}
+function validAssistantBlock(block) {
+    if (!isRecord(block))
+        return false;
+    if (block.type !== "tool_use" || block.name !== "Skill")
+        return true;
+    return validSkillInput(block.input);
+}
+function validSkillInput(input) {
+    if (!isRecord(input) || typeof input.skill !== "string")
+        return false;
+    return !!input.skill.split(":").at(-1)?.trim();
+}
+function validResult(value) {
+    return (typeof value.subtype === "string" &&
+        !!value.subtype.trim() &&
+        typeof value.is_error === "boolean" &&
+        typeof value.result === "string");
+}
+function validEvent(value) {
+    if (!isRecord(value))
+        return false;
+    if (value.type === "result")
+        return validResult(value);
+    if (value.type === "assistant")
+        return validAssistant(value);
+    return typeof value.type === "string";
+}
+function usage(value) {
+    if (!isRecord(value))
+        return null;
+    const inputTokens = inputUsage(value);
+    if (inputTokens === null || !nonnegative(value.output_tokens))
+        return null;
+    return { inputTokens, outputTokens: value.output_tokens };
+}
+function inputUsage(value) {
+    const counts = [
+        value.input_tokens,
+        value.cache_creation_input_tokens ?? 0,
+        value.cache_read_input_tokens ?? 0,
+    ];
+    if (!counts.every(nonnegative))
+        return null;
+    return counts.reduce((total, count) => total + count);
+}
+/** Summarize decoded events without exposing their private bodies. */
+export function summarizeClaudeEvents(stream, exitCode) {
+    const { results, malformed } = parseResultEvents(parseClaudeEvents(stream));
+    return resultSummary(results, malformed, exitCode);
+}
+function parseResultEvents(stream) {
+    const results = [];
+    let malformed = false;
+    for (const line of stream.lines) {
+        if (!line.parsed || !validEvent(line.value)) {
+            malformed = true;
+            continue;
+        }
+        if (line.value.type === "result")
+            results.push(line.value);
+    }
+    return { results, malformed };
+}
+function summarizeUsage(results, malformed) {
+    const usages = results.map((result) => usage(result.usage));
+    const validUsages = usages.filter((value) => value !== null);
+    const usageComplete = !malformed && results.length > 0 && validUsages.length === usages.length;
+    return {
+        inputTokens: usageComplete
+            ? validUsages.reduce((total, value) => total + value.inputTokens, 0)
+            : null,
+        outputTokens: usageComplete
+            ? validUsages.reduce((total, value) => total + value.outputTokens, 0)
+            : null,
+        usageComplete,
+    };
+}
+function measuredCost(results, malformed) {
+    const costs = results.map((result) => result.total_cost_usd);
+    if (malformed || results.length === 0 || !costs.every(nonnegative))
+        return null;
+    return costs.reduce((total, value) => total + value, 0);
+}
+function resultSummary(results, malformed, exitCode) {
+    const final = results.at(-1);
+    return {
+        complete: completedResults(results, malformed, exitCode),
+        finalMessage: typeof final?.result === "string" ? final.result : null,
+        costUsd: measuredCost(results, malformed),
+        ...summarizeUsage(results, malformed),
+    };
+}
+function completedResults(results, malformed, exitCode) {
+    return (!malformed &&
+        exitCode === 0 &&
+        results.length > 0 &&
+        results.every((result) => result.subtype === "success" && result.is_error === false));
+}
+//# sourceMappingURL=claude-events.js.map

package/dist/src/hosts/claude-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-events.js","sourceRoot":"","sources":["claude-events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,2BAAwB;AAC3C,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE/C,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AASD,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,MAA6B;IAC7D,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,sBAAsB;QAC5D,MAAM,IAAI,gBAAgB,CAAC,mCAAmC,CAAC,CAAC;IAClE,OAAO;QACL,KAAK,EAAE,MAAM;aACV,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC7B,GAAG,CAAC,SAAS,CAAC;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,EAAE,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,cAAc,CAAC,KAAY;IAClC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,KAAY;IAC/B,OAAO,CACL,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;QACtB,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS;QACnC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC7D,OAAO,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AACxC,CAAC;AAOD,SAAS,KAAK,CAAC,KAAc;IAC3B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,WAAW,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,UAAU,CAAC,KAAY;IAC9B,MAAM,MAAM,GAAG;QACb,KAAK,CAAC,YAAY;QAClB,KAAK,CAAC,2BAA2B,IAAI,CAAC;QACtC,KAAK,CAAC,uBAAuB,IAAI,CAAC;KACnC,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC;AACxD,CAAC;AAWD,sEAAsE;AACtE,MAAM,UAAU,qBAAqB,CACnC,MAA6B,EAC7B,QAAgB;IAEhB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,OAAO,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAoB;IAC7C,MAAM,OAAO,GAAY,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,cAAc,CAAC,OAAgB,EAAE,SAAkB;IAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAkB,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IAC7E,MAAM,aAAa,GACjB,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC;IAC3E,OAAO;QACL,WAAW,EAAE,aAAa;YACxB,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YACpE,CAAC,CAAC,IAAI;QACR,YAAY,EAAE,aAAa;YACzB,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;YACrE,CAAC,CAAC,IAAI;QACR,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB,EAAE,SAAkB;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC7D,IAAI,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,aAAa,CACpB,OAAgB,EAChB,SAAkB,EAClB,QAAgB;IAEhB,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO;QACL,QAAQ,EAAE,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;QACxD,YAAY,EAAE,OAAO,KAAK,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACrE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC;QACzC,GAAG,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAgB,EAChB,SAAkB,EAClB,QAAgB;IAEhB,OAAO,CACL,CAAC,SAAS;QACV,QAAQ,KAAK,CAAC;QACd,OAAO,CAAC,MAAM,GAAG,CAAC;QAClB,OAAO,CAAC,KAAK,CACX,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CACtE,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { isRecord } from \"../value-guards\";\nconst MAX_EVENT_STREAM_BYTES = 8 * 1024 * 1024;\n\nexport class ClaudeEventError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ClaudeEventError\";\n  }\n}\n\ntype Entry = Record<string, unknown>;\nexport type ClaudeEventLine =\n  { parsed: true; value: unknown } | { parsed: false; error: unknown };\nexport interface ClaudeEvents {\n  lines: readonly ClaudeEventLine[];\n}\n\n/** Decode JSON once; consumers retain their own event validity rules. */\nexport function parseClaudeEvents(stream: string | ClaudeEvents): ClaudeEvents {\n  if (typeof stream !== \"string\") return stream;\n  if (Buffer.byteLength(stream, \"utf8\") > MAX_EVENT_STREAM_BYTES)\n    throw new ClaudeEventError(\"Claude event stream exceeds 8 MiB\");\n  return {\n    lines: stream\n      .split(\"\\n\")\n      .filter((line) => line.trim())\n      .map(parseLine),\n  };\n}\n\nfunction parseLine(line: string): ClaudeEventLine {\n  try {\n    return { parsed: true, value: JSON.parse(line) as unknown };\n  } catch (error) {\n    return { parsed: false, error };\n  }\n}\n\nfunction nonnegative(value: unknown): value is number {\n  return typeof value === \"number\" && Number.isFinite(value) && value >= 0;\n}\n\nfunction validAssistant(value: Entry): boolean {\n  if (!isRecord(value.message) || !Array.isArray(value.message.content))\n    return false;\n  return value.message.content.every(validAssistantBlock);\n}\n\nfunction validAssistantBlock(block: unknown): boolean {\n  if (!isRecord(block)) return false;\n  if (block.type !== \"tool_use\" || block.name !== \"Skill\") return true;\n  return validSkillInput(block.input);\n}\n\nfunction validSkillInput(input: unknown): boolean {\n  if (!isRecord(input) || typeof input.skill !== \"string\") return false;\n  return !!input.skill.split(\":\").at(-1)?.trim();\n}\n\nfunction validResult(value: Entry): boolean {\n  return (\n    typeof value.subtype === \"string\" &&\n    !!value.subtype.trim() &&\n    typeof value.is_error === \"boolean\" &&\n    typeof value.result === \"string\"\n  );\n}\n\nfunction validEvent(value: unknown): value is Entry {\n  if (!isRecord(value)) return false;\n  if (value.type === \"result\") return validResult(value);\n  if (value.type === \"assistant\") return validAssistant(value);\n  return typeof value.type === \"string\";\n}\n\ninterface Usage {\n  inputTokens: number;\n  outputTokens: number;\n}\n\nfunction usage(value: unknown): Usage | null {\n  if (!isRecord(value)) return null;\n  const inputTokens = inputUsage(value);\n  if (inputTokens === null || !nonnegative(value.output_tokens)) return null;\n  return { inputTokens, outputTokens: value.output_tokens };\n}\n\nfunction inputUsage(value: Entry): number | null {\n  const counts = [\n    value.input_tokens,\n    value.cache_creation_input_tokens ?? 0,\n    value.cache_read_input_tokens ?? 0,\n  ];\n  if (!counts.every(nonnegative)) return null;\n  return counts.reduce((total, count) => total + count);\n}\n\nexport interface ClaudeEventSummary {\n  complete: boolean;\n  finalMessage: string | null;\n  inputTokens: number | null;\n  outputTokens: number | null;\n  costUsd: number | null;\n  usageComplete: boolean;\n}\n\n/** Summarize decoded events without exposing their private bodies. */\nexport function summarizeClaudeEvents(\n  stream: string | ClaudeEvents,\n  exitCode: number,\n): ClaudeEventSummary {\n  const { results, malformed } = parseResultEvents(parseClaudeEvents(stream));\n  return resultSummary(results, malformed, exitCode);\n}\n\nfunction parseResultEvents(stream: ClaudeEvents) {\n  const results: Entry[] = [];\n  let malformed = false;\n  for (const line of stream.lines) {\n    if (!line.parsed || !validEvent(line.value)) {\n      malformed = true;\n      continue;\n    }\n    if (line.value.type === \"result\") results.push(line.value);\n  }\n  return { results, malformed };\n}\n\nfunction summarizeUsage(results: Entry[], malformed: boolean) {\n  const usages = results.map((result) => usage(result.usage));\n  const validUsages = usages.filter((value): value is Usage => value !== null);\n  const usageComplete =\n    !malformed && results.length > 0 && validUsages.length === usages.length;\n  return {\n    inputTokens: usageComplete\n      ? validUsages.reduce((total, value) => total + value.inputTokens, 0)\n      : null,\n    outputTokens: usageComplete\n      ? validUsages.reduce((total, value) => total + value.outputTokens, 0)\n      : null,\n    usageComplete,\n  };\n}\n\nfunction measuredCost(results: Entry[], malformed: boolean): number | null {\n  const costs = results.map((result) => result.total_cost_usd);\n  if (malformed || results.length === 0 || !costs.every(nonnegative))\n    return null;\n  return costs.reduce((total, value) => total + value, 0);\n}\n\nfunction resultSummary(\n  results: Entry[],\n  malformed: boolean,\n  exitCode: number,\n): ClaudeEventSummary {\n  const final = results.at(-1);\n  return {\n    complete: completedResults(results, malformed, exitCode),\n    finalMessage: typeof final?.result === \"string\" ? final.result : null,\n    costUsd: measuredCost(results, malformed),\n    ...summarizeUsage(results, malformed),\n  };\n}\n\nfunction completedResults(\n  results: Entry[],\n  malformed: boolean,\n  exitCode: number,\n): boolean {\n  return (\n    !malformed &&\n    exitCode === 0 &&\n    results.length > 0 &&\n    results.every(\n      (result) => result.subtype === \"success\" && result.is_error === false,\n    )\n  );\n}\n"]}

package/dist/src/hosts/claude-keychain.js

@@ -0,0 +1,100 @@
+import { spawn } from "../runtime-process.js";
+import { existsSync } from "node:fs";
+import { MAX_CREDENTIAL_BYTES, requireBoundedCredential, } from "./claude-login-store.js";
+const SECURITY = "/usr/bin/security";
+/** `security` reports errSecItemNotFound with this exit status. */
+const ITEM_NOT_FOUND = 44;
+/** Claude Code's bound for one `security -i` command line. */
+const INTERACTIVE_LINE_LIMIT = 4032;
+const KEYCHAIN_TIMEOUT_MS = 10_000;
+function requireSecurity() {
+    if (process.platform !== "darwin" || !existsSync(SECURITY))
+        throw new Error("Claude keychain credential is unavailable");
+}
+async function boundedCredentialStream(reader) {
+    const chunks = [];
+    let size = 0;
+    for (;;) {
+        const { value, done } = await reader.read();
+        if (done)
+            break;
+        size += value.byteLength;
+        if (size > MAX_CREDENTIAL_BYTES)
+            throw new Error("Claude credential exceeds the size limit");
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks);
+}
+async function findItem(service, account) {
+    requireSecurity();
+    const proc = spawn([SECURITY, "find-generic-password", "-a", account, "-s", service, "-w"], { stdout: "pipe", stderr: "ignore" });
+    const timer = setTimeout(() => {
+        proc.kill("SIGKILL");
+    }, KEYCHAIN_TIMEOUT_MS);
+    const reader = proc.stdout.getReader();
+    try {
+        const credential = await boundedCredentialStream(reader);
+        const code = await proc.exited;
+        if (code === ITEM_NOT_FOUND)
+            return undefined;
+        if (code !== 0)
+            throw new Error("Claude keychain credential is unavailable");
+        return requireBoundedCredential(credential);
+    }
+    catch (error) {
+        proc.kill("SIGKILL");
+        await proc.exited;
+        throw new Error("Claude credential is unreadable or unavailable", {
+            cause: error,
+        });
+    }
+    finally {
+        clearTimeout(timer);
+        reader.releaseLock();
+    }
+}
+/** Mirror Claude Code's update so the secret stays off argv when it fits. */
+function updateCommand(service, account, bytes) {
+    const hex = bytes.toString("hex");
+    const line = `add-generic-password -U -a "${account}" -s "${service}" -X "${hex}"\n`;
+    return line.length <= INTERACTIVE_LINE_LIMIT
+        ? { command: [SECURITY, "-i"], stdin: Buffer.from(line) }
+        : {
+            command: [
+                SECURITY,
+                "add-generic-password",
+                "-U",
+                "-a",
+                account,
+                "-s",
+                service,
+                "-X",
+                hex,
+            ],
+            stdin: undefined,
+        };
+}
+async function updateItem(service, account, bytes) {
+    requireSecurity();
+    const { command, stdin } = updateCommand(service, account, bytes);
+    const proc = spawn(command, {
+        stdin: stdin ?? "ignore",
+        stdout: "ignore",
+        stderr: "ignore",
+    });
+    const timer = setTimeout(() => {
+        proc.kill("SIGKILL");
+    }, KEYCHAIN_TIMEOUT_MS);
+    try {
+        if ((await proc.exited) !== 0)
+            throw new Error("Claude keychain login could not be updated");
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export const claudeKeychain = {
+    read: findItem,
+    write: updateItem,
+};
+//# sourceMappingURL=claude-keychain.js.map

package/dist/src/hosts/claude-keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-keychain.js","sourceRoot":"","sources":["claude-keychain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,8BAA2B;AAC3C,OAAO,EAAE,UAAU,EAAE,gBAAgB;AACrC,OAAO,EACL,oBAAoB,EACpB,wBAAwB,GAEzB,gCAA6B;AAE9B,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AACrC,mEAAmE;AACnE,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,8DAA8D;AAC9D,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,SAAS,eAAe;IACtB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,MAA+C;IAE/C,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,SAAS,CAAC;QACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;QACzB,IAAI,IAAI,GAAG,oBAAoB;YAC7B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,OAAe,EACf,OAAe;IAEf,eAAe,EAAE,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAChB,CAAC,QAAQ,EAAE,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EACvE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CACrC,CAAC;IACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;QAC/B,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,SAAS,CAAC;QAC9C,IAAI,IAAI,KAAK,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,OAAO,wBAAwB,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,gDAAgD,EAAE;YAChE,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,aAAa,CAAC,OAAe,EAAE,OAAe,EAAE,KAAa;IACpE,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,+BAA+B,OAAO,SAAS,OAAO,SAAS,GAAG,KAAK,CAAC;IACrF,OAAO,IAAI,CAAC,MAAM,IAAI,sBAAsB;QAC1C,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACzD,CAAC,CAAC;YACE,OAAO,EAAE;gBACP,QAAQ;gBACR,sBAAsB;gBACtB,IAAI;gBACJ,IAAI;gBACJ,OAAO;gBACP,IAAI;gBACJ,OAAO;gBACP,IAAI;gBACJ,GAAG;aACJ;YACD,KAAK,EAAE,SAAS;SACjB,CAAC;AACR,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,OAAe,EACf,KAAa;IAEb,eAAe,EAAE,CAAC;IAClB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE;QAC1B,KAAK,EAAE,KAAK,IAAI,QAAQ;QACxB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAClE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC5C,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,UAAU;CAClB,CAAC","sourcesContent":["import { spawn } from \"../runtime-process\";\nimport { existsSync } from \"node:fs\";\nimport {\n  MAX_CREDENTIAL_BYTES,\n  requireBoundedCredential,\n  type ClaudeKeychain,\n} from \"./claude-login-store\";\n\nconst SECURITY = \"/usr/bin/security\";\n/** `security` reports errSecItemNotFound with this exit status. */\nconst ITEM_NOT_FOUND = 44;\n/** Claude Code's bound for one `security -i` command line. */\nconst INTERACTIVE_LINE_LIMIT = 4032;\nconst KEYCHAIN_TIMEOUT_MS = 10_000;\n\nfunction requireSecurity(): void {\n  if (process.platform !== \"darwin\" || !existsSync(SECURITY))\n    throw new Error(\"Claude keychain credential is unavailable\");\n}\n\nasync function boundedCredentialStream(\n  reader: ReadableStreamDefaultReader<Uint8Array>,\n): Promise<Buffer> {\n  const chunks: Uint8Array[] = [];\n  let size = 0;\n  for (;;) {\n    const { value, done } = await reader.read();\n    if (done) break;\n    size += value.byteLength;\n    if (size > MAX_CREDENTIAL_BYTES)\n      throw new Error(\"Claude credential exceeds the size limit\");\n    chunks.push(value);\n  }\n  return Buffer.concat(chunks);\n}\n\nasync function findItem(\n  service: string,\n  account: string,\n): Promise<Buffer | undefined> {\n  requireSecurity();\n  const proc = spawn(\n    [SECURITY, \"find-generic-password\", \"-a\", account, \"-s\", service, \"-w\"],\n    { stdout: \"pipe\", stderr: \"ignore\" },\n  );\n  const timer = setTimeout(() => {\n    proc.kill(\"SIGKILL\");\n  }, KEYCHAIN_TIMEOUT_MS);\n  const reader = proc.stdout.getReader();\n  try {\n    const credential = await boundedCredentialStream(reader);\n    const code = await proc.exited;\n    if (code === ITEM_NOT_FOUND) return undefined;\n    if (code !== 0)\n      throw new Error(\"Claude keychain credential is unavailable\");\n    return requireBoundedCredential(credential);\n  } catch (error) {\n    proc.kill(\"SIGKILL\");\n    await proc.exited;\n    throw new Error(\"Claude credential is unreadable or unavailable\", {\n      cause: error,\n    });\n  } finally {\n    clearTimeout(timer);\n    reader.releaseLock();\n  }\n}\n\n/** Mirror Claude Code's update so the secret stays off argv when it fits. */\nfunction updateCommand(service: string, account: string, bytes: Buffer) {\n  const hex = bytes.toString(\"hex\");\n  const line = `add-generic-password -U -a \"${account}\" -s \"${service}\" -X \"${hex}\"\\n`;\n  return line.length <= INTERACTIVE_LINE_LIMIT\n    ? { command: [SECURITY, \"-i\"], stdin: Buffer.from(line) }\n    : {\n        command: [\n          SECURITY,\n          \"add-generic-password\",\n          \"-U\",\n          \"-a\",\n          account,\n          \"-s\",\n          service,\n          \"-X\",\n          hex,\n        ],\n        stdin: undefined,\n      };\n}\n\nasync function updateItem(\n  service: string,\n  account: string,\n  bytes: Buffer,\n): Promise<void> {\n  requireSecurity();\n  const { command, stdin } = updateCommand(service, account, bytes);\n  const proc = spawn(command, {\n    stdin: stdin ?? \"ignore\",\n    stdout: \"ignore\",\n    stderr: \"ignore\",\n  });\n  const timer = setTimeout(() => {\n    proc.kill(\"SIGKILL\");\n  }, KEYCHAIN_TIMEOUT_MS);\n  try {\n    if ((await proc.exited) !== 0)\n      throw new Error(\"Claude keychain login could not be updated\");\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\nexport const claudeKeychain: ClaudeKeychain = {\n  read: findItem,\n  write: updateItem,\n};\n"]}

package/dist/src/hosts/claude-login-recovery.js

@@ -0,0 +1,67 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { isRecord } from "../value-guards.js";
+import { rotatedOAuth, tokenDigest } from "./claude-login.js";
+const FORMAT = "sevro.claude-login-recovery.v1";
+/** Private, per-origin recovery slot for one refreshed login. */
+export class ClaudeLoginRecovery {
+    path;
+    workRoot;
+    constructor(root, origin) {
+        const key = createHash("sha256").update(origin).digest("hex");
+        this.path = join(root, `${key}.json`);
+        this.workRoot = join(root, "work");
+    }
+    async pending() {
+        let text;
+        try {
+            text = await readFile(this.path, "utf8");
+        }
+        catch {
+            return undefined;
+        }
+        return pendingRotation(text);
+    }
+    /** Durably retain the rotation before any canonical write is attempted. */
+    async retain(replaced, rotated) {
+        const record = {
+            format: FORMAT,
+            replaces: tokenDigest(replaced.refreshToken),
+            oauth: rotatedOAuth(rotated),
+        };
+        const temporary = `${this.path}.${randomUUID()}.tmp`;
+        await writeFile(temporary, JSON.stringify(record), {
+            flag: "wx",
+            mode: 0o600,
+        });
+        await rename(temporary, this.path);
+    }
+    async discard() {
+        await rm(this.path, { force: true });
+    }
+}
+function pendingRotation(text) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    return isPendingRecord(value)
+        ? { replaces: value.replaces, oauth: value.oauth }
+        : undefined;
+}
+function isPendingRecord(value) {
+    return (isRecord(value) &&
+        value.format === FORMAT &&
+        typeof value.replaces === "string" &&
+        isRecord(value.oauth));
+}
+export async function claudeLoginRecovery(stateRoot, origin) {
+    const root = join(stateRoot, "claude-login-recovery");
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    return new ClaudeLoginRecovery(root, origin);
+}
+//# sourceMappingURL=claude-login-recovery.js.map

package/dist/src/hosts/claude-login-recovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-login-recovery.js","sourceRoot":"","sources":["claude-login-recovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,oBAAoB;AACrD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,yBAAyB;AAC1E,OAAO,EAAE,IAAI,EAAE,kBAAkB;AACjC,OAAO,EAAE,QAAQ,EAAE,2BAAwB;AAC3C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAoB,0BAAuB;AAE7E,MAAM,MAAM,GAAG,gCAAgC,CAAC;AAShD,iEAAiE;AACjE,MAAM,OAAO,mBAAmB;IACrB,IAAI,CAAS;IACb,QAAQ,CAAS;IAE1B,YAAY,IAAY,EAAE,MAAc;QACtC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,MAAM,CAAC,QAAqB,EAAE,OAAoB;QACtD,MAAM,MAAM,GAAyC;YACnD,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC5C,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC;SAC7B,CAAC;QACF,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;QACrD,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;YACjD,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;CACF;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,eAAe,CAAC,KAAK,CAAC;QAC3B,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;QAClD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,KAAK,CAAC,MAAM,KAAK,MAAM;QACvB,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CACtB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,MAAc;IAEd,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;IACtD,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,OAAO,IAAI,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC","sourcesContent":["import { createHash, randomUUID } from \"node:crypto\";\nimport { mkdir, readFile, rename, rm, writeFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { isRecord } from \"../value-guards\";\nimport { rotatedOAuth, tokenDigest, type ClaudeLogin } from \"./claude-login\";\n\nconst FORMAT = \"sevro.claude-login-recovery.v1\";\n\n/** A rotated pair retained until its canonical store verifiably holds it. */\nexport interface PendingRotation {\n  /** Digest of the refresh token the rotation consumed. */\n  replaces: string;\n  oauth: Record<string, unknown>;\n}\n\n/** Private, per-origin recovery slot for one refreshed login. */\nexport class ClaudeLoginRecovery {\n  readonly path: string;\n  readonly workRoot: string;\n\n  constructor(root: string, origin: string) {\n    const key = createHash(\"sha256\").update(origin).digest(\"hex\");\n    this.path = join(root, `${key}.json`);\n    this.workRoot = join(root, \"work\");\n  }\n\n  async pending(): Promise<PendingRotation | undefined> {\n    let text: string;\n    try {\n      text = await readFile(this.path, \"utf8\");\n    } catch {\n      return undefined;\n    }\n    return pendingRotation(text);\n  }\n\n  /** Durably retain the rotation before any canonical write is attempted. */\n  async retain(replaced: ClaudeLogin, rotated: ClaudeLogin): Promise<void> {\n    const record: PendingRotation & { format: string } = {\n      format: FORMAT,\n      replaces: tokenDigest(replaced.refreshToken),\n      oauth: rotatedOAuth(rotated),\n    };\n    const temporary = `${this.path}.${randomUUID()}.tmp`;\n    await writeFile(temporary, JSON.stringify(record), {\n      flag: \"wx\",\n      mode: 0o600,\n    });\n    await rename(temporary, this.path);\n  }\n\n  async discard(): Promise<void> {\n    await rm(this.path, { force: true });\n  }\n}\n\nfunction pendingRotation(text: string): PendingRotation | undefined {\n  let value: unknown;\n  try {\n    value = JSON.parse(text);\n  } catch {\n    return undefined;\n  }\n  return isPendingRecord(value)\n    ? { replaces: value.replaces, oauth: value.oauth }\n    : undefined;\n}\n\nfunction isPendingRecord(value: unknown): value is PendingRotation {\n  return (\n    isRecord(value) &&\n    value.format === FORMAT &&\n    typeof value.replaces === \"string\" &&\n    isRecord(value.oauth)\n  );\n}\n\nexport async function claudeLoginRecovery(\n  stateRoot: string,\n  origin: string,\n): Promise<ClaudeLoginRecovery> {\n  const root = join(stateRoot, \"claude-login-recovery\");\n  await mkdir(root, { recursive: true, mode: 0o700 });\n  return new ClaudeLoginRecovery(root, origin);\n}\n"]}

package/dist/src/hosts/claude-login-refresh.js

@@ -0,0 +1,146 @@
+import { spawn } from "../runtime-process.js";
+import { mkdir, mkdtemp, readFile, rm, stat, writeFile, } from "node:fs/promises";
+import { delimiter, join } from "node:path";
+import { parseClaudeLogin } from "./claude-login.js";
+import { MAX_CREDENTIAL_BYTES } from "./claude-login-store.js";
+/** First Claude Code release verified to provide refresh-token login. */
+export const CLAUDE_REFRESH_MINIMUM_VERSION = "2.1.284";
+const MINIMUM_VERSION = [2, 1, 284];
+const VERSION_TIMEOUT_MS = 10_000;
+const HELPER_TIMEOUT_MS = 60_000;
+/** Network settings the operator may need to reach Anthropic's token endpoint. */
+const FORWARDED_VARIABLES = [
+    "HTTPS_PROXY",
+    "https_proxy",
+    "HTTP_PROXY",
+    "http_proxy",
+    "NO_PROXY",
+    "no_proxy",
+    "NODE_EXTRA_CA_CERTS",
+    "SSL_CERT_FILE",
+];
+/**
+ * Claude resolves `security` through PATH. Refusing it makes the helper keep
+ * the rotated login in its private credential file instead of a Keychain item.
+ */
+const SECURITY_STUB = '#!/bin/sh\n[ "$1" = find-generic-password ] && exit 44\nexit 1\n';
+/**
+ * Exchange the login's refresh token with Claude Code's documented
+ * `CLAUDE_CODE_OAUTH_REFRESH_TOKEN` login in a disposable configuration.
+ * The caller owns the lock, durable writeback, and recovery.
+ */
+export async function refreshClaudeLogin(binary, login, workRoot) {
+    await requireRefreshCapableClaude(binary);
+    await mkdir(workRoot, { recursive: true, mode: 0o700 });
+    const helper = await mkdtemp(join(workRoot, "refresh-"));
+    try {
+        const paths = await prepareHelper(helper);
+        const code = await runHelper(binary, helperEnvironment(paths, login));
+        return await storedRotation(paths.config, login, code);
+    }
+    finally {
+        await rm(helper, { recursive: true, force: true });
+    }
+}
+async function requireRefreshCapableClaude(binary) {
+    const version = await claudeVersion(binary);
+    if (!version || !atLeastMinimum(version))
+        throw new Error(`Refreshing the saved Claude login requires Claude Code ${CLAUDE_REFRESH_MINIMUM_VERSION} or later`);
+}
+async function claudeVersion(binary) {
+    const proc = spawn([binary, "--version"], {
+        stdin: "ignore",
+        stdout: "pipe",
+        stderr: "ignore",
+    });
+    const timer = setTimeout(() => {
+        proc.kill("SIGKILL");
+    }, VERSION_TIMEOUT_MS);
+    try {
+        const [output, code] = await Promise.all([
+            new Response(proc.stdout).text(),
+            proc.exited,
+        ]);
+        const match = /^(\d+)\.(\d+)\.(\d+)/.exec(output.trim());
+        return code === 0 && match ? match.slice(1).map(Number) : undefined;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export function atLeastMinimum(version) {
+    for (const [index, minimum] of MINIMUM_VERSION.entries()) {
+        const part = version[index] ?? 0;
+        if (part !== minimum)
+            return part > minimum;
+    }
+    return true;
+}
+async function prepareHelper(helper) {
+    const paths = {
+        config: join(helper, "config"),
+        home: join(helper, "home"),
+        bin: join(helper, "bin"),
+    };
+    await Promise.all(Object.values(paths).map((path) => mkdir(path, { mode: 0o700 })));
+    await writeFile(join(paths.bin, "security"), SECURITY_STUB, {
+        flag: "wx",
+        mode: 0o700,
+    });
+    return paths;
+}
+function helperEnvironment(paths, login) {
+    const forwarded = Object.fromEntries(FORWARDED_VARIABLES.flatMap((name) => {
+        const value = process.env[name];
+        return value ? [[name, value]] : [];
+    }));
+    return {
+        ...forwarded,
+        PATH: [paths.bin, process.env.PATH ?? "/usr/bin:/bin"].join(delimiter),
+        HOME: paths.home,
+        TMPDIR: paths.home,
+        LANG: process.env.LANG ?? "C",
+        NO_COLOR: "1",
+        CLAUDE_CONFIG_DIR: paths.config,
+        CLAUDE_CODE_OAUTH_REFRESH_TOKEN: login.refreshToken,
+        CLAUDE_CODE_OAUTH_SCOPES: login.scopes.join(" "),
+        CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
+    };
+}
+/** Output is discarded: it is never needed and must not reach evidence. */
+async function runHelper(binary, env) {
+    const proc = spawn([binary, "auth", "login"], {
+        env,
+        cwd: env.HOME,
+        stdin: "ignore",
+        stdout: "ignore",
+        stderr: "ignore",
+    });
+    const timer = setTimeout(() => {
+        proc.kill("SIGKILL");
+    }, HELPER_TIMEOUT_MS);
+    try {
+        return await proc.exited;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** Accept only a persisted rotation; exit status alone proves nothing. */
+async function storedRotation(config, login, code) {
+    const rotated = await helperLogin(join(config, ".credentials.json"));
+    if (!rotated?.refreshToken || rotated.accessToken === login.accessToken)
+        throw new Error(`Claude could not refresh the saved login (helper exit ${String(code)}); run claude and /login if it has expired`);
+    return rotated;
+}
+async function helperLogin(path) {
+    try {
+        if ((await stat(path)).size > MAX_CREDENTIAL_BYTES)
+            return undefined;
+        return parseClaudeLogin(await readFile(path));
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=claude-login-refresh.js.map

package/dist/src/hosts/claude-login-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-login-refresh.js","sourceRoot":"","sources":["claude-login-refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,8BAA2B;AAC3C,OAAO,EACL,KAAK,EACL,OAAO,EACP,QAAQ,EACR,EAAE,EACF,IAAI,EACJ,SAAS,GACV,yBAAyB;AAC1B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAkB;AAC5C,OAAO,EAAE,gBAAgB,EAAoB,0BAAuB;AACpE,OAAO,EAAE,oBAAoB,EAAE,gCAA6B;AAE5D,yEAAyE;AACzE,MAAM,CAAC,MAAM,8BAA8B,GAAG,SAAS,CAAC;AACxD,MAAM,eAAe,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAU,CAAC;AAC7C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,kFAAkF;AAClF,MAAM,mBAAmB,GAAG;IAC1B,aAAa;IACb,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,UAAU;IACV,qBAAqB;IACrB,eAAe;CACP,CAAC;AACX;;;GAGG;AACH,MAAM,aAAa,GACjB,kEAAkE,CAAC;AAErE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,KAA6C,EAC7C,QAAgB;IAEhB,MAAM,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACtE,OAAO,MAAM,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACzD,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,MAAc;IACvD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,0DAA0D,8BAA8B,WAAW,CACpG,CAAC;AACN,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAc;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE;QACxC,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvC,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;YAChC,IAAI,CAAC,MAAM;SACZ,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAiB;IAC9C,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,GAAG,OAAO,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAc;IACzC,MAAM,KAAK,GAAG;QACZ,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC9B,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;QAC1B,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;KACzB,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CACjE,CAAC;IACF,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,aAAa,EAAE;QAC1D,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAgD,EAChD,KAA6C;IAE7C,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAClC,mBAAmB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtC,CAAC,CAAC,CACH,CAAC;IACF,OAAO;QACL,GAAG,SAAS;QACZ,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;QACtE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG;QAC7B,QAAQ,EAAE,GAAG;QACb,iBAAiB,EAAE,KAAK,CAAC,MAAM;QAC/B,+BAA+B,EAAE,KAAK,CAAC,YAAY;QACnD,wBAAwB,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAChD,wCAAwC,EAAE,GAAG;KAC9C,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,SAAS,CACtB,MAAc,EACd,GAA2B;IAE3B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAC5C,GAAG;QACH,GAAG,EAAE,GAAG,CAAC,IAAI;QACb,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,cAAc,CAC3B,MAAc,EACd,KAAkB,EAClB,IAAY;IAEZ,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACrE,MAAM,IAAI,KAAK,CACb,yDAAyD,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAClH,CAAC;IACJ,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,oBAAoB;YAAE,OAAO,SAAS,CAAC;QACrE,OAAO,gBAAgB,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["import { spawn } from \"../runtime-process\";\nimport {\n  mkdir,\n  mkdtemp,\n  readFile,\n  rm,\n  stat,\n  writeFile,\n} from \"node:fs/promises\";\nimport { delimiter, join } from \"node:path\";\nimport { parseClaudeLogin, type ClaudeLogin } from \"./claude-login\";\nimport { MAX_CREDENTIAL_BYTES } from \"./claude-login-store\";\n\n/** First Claude Code release verified to provide refresh-token login. */\nexport const CLAUDE_REFRESH_MINIMUM_VERSION = \"2.1.284\";\nconst MINIMUM_VERSION = [2, 1, 284] as const;\nconst VERSION_TIMEOUT_MS = 10_000;\nconst HELPER_TIMEOUT_MS = 60_000;\n/** Network settings the operator may need to reach Anthropic's token endpoint. */\nconst FORWARDED_VARIABLES = [\n  \"HTTPS_PROXY\",\n  \"https_proxy\",\n  \"HTTP_PROXY\",\n  \"http_proxy\",\n  \"NO_PROXY\",\n  \"no_proxy\",\n  \"NODE_EXTRA_CA_CERTS\",\n  \"SSL_CERT_FILE\",\n] as const;\n/**\n * Claude resolves `security` through PATH. Refusing it makes the helper keep\n * the rotated login in its private credential file instead of a Keychain item.\n */\nconst SECURITY_STUB =\n  '#!/bin/sh\\n[ \"$1\" = find-generic-password ] && exit 44\\nexit 1\\n';\n\n/**\n * Exchange the login's refresh token with Claude Code's documented\n * `CLAUDE_CODE_OAUTH_REFRESH_TOKEN` login in a disposable configuration.\n * The caller owns the lock, durable writeback, and recovery.\n */\nexport async function refreshClaudeLogin(\n  binary: string,\n  login: ClaudeLogin & { refreshToken: string },\n  workRoot: string,\n): Promise<ClaudeLogin> {\n  await requireRefreshCapableClaude(binary);\n  await mkdir(workRoot, { recursive: true, mode: 0o700 });\n  const helper = await mkdtemp(join(workRoot, \"refresh-\"));\n  try {\n    const paths = await prepareHelper(helper);\n    const code = await runHelper(binary, helperEnvironment(paths, login));\n    return await storedRotation(paths.config, login, code);\n  } finally {\n    await rm(helper, { recursive: true, force: true });\n  }\n}\n\nasync function requireRefreshCapableClaude(binary: string): Promise<void> {\n  const version = await claudeVersion(binary);\n  if (!version || !atLeastMinimum(version))\n    throw new Error(\n      `Refreshing the saved Claude login requires Claude Code ${CLAUDE_REFRESH_MINIMUM_VERSION} or later`,\n    );\n}\n\nasync function claudeVersion(binary: string): Promise<number[] | undefined> {\n  const proc = spawn([binary, \"--version\"], {\n    stdin: \"ignore\",\n    stdout: \"pipe\",\n    stderr: \"ignore\",\n  });\n  const timer = setTimeout(() => {\n    proc.kill(\"SIGKILL\");\n  }, VERSION_TIMEOUT_MS);\n  try {\n    const [output, code] = await Promise.all([\n      new Response(proc.stdout).text(),\n      proc.exited,\n    ]);\n    const match = /^(\\d+)\\.(\\d+)\\.(\\d+)/.exec(output.trim());\n    return code === 0 && match ? match.slice(1).map(Number) : undefined;\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\nexport function atLeastMinimum(version: number[]): boolean {\n  for (const [index, minimum] of MINIMUM_VERSION.entries()) {\n    const part = version[index] ?? 0;\n    if (part !== minimum) return part > minimum;\n  }\n  return true;\n}\n\nasync function prepareHelper(helper: string) {\n  const paths = {\n    config: join(helper, \"config\"),\n    home: join(helper, \"home\"),\n    bin: join(helper, \"bin\"),\n  };\n  await Promise.all(\n    Object.values(paths).map((path) => mkdir(path, { mode: 0o700 })),\n  );\n  await writeFile(join(paths.bin, \"security\"), SECURITY_STUB, {\n    flag: \"wx\",\n    mode: 0o700,\n  });\n  return paths;\n}\n\nfunction helperEnvironment(\n  paths: Awaited<ReturnType<typeof prepareHelper>>,\n  login: ClaudeLogin & { refreshToken: string },\n): Record<string, string> {\n  const forwarded = Object.fromEntries(\n    FORWARDED_VARIABLES.flatMap((name) => {\n      const value = process.env[name];\n      return value ? [[name, value]] : [];\n    }),\n  );\n  return {\n    ...forwarded,\n    PATH: [paths.bin, process.env.PATH ?? \"/usr/bin:/bin\"].join(delimiter),\n    HOME: paths.home,\n    TMPDIR: paths.home,\n    LANG: process.env.LANG ?? \"C\",\n    NO_COLOR: \"1\",\n    CLAUDE_CONFIG_DIR: paths.config,\n    CLAUDE_CODE_OAUTH_REFRESH_TOKEN: login.refreshToken,\n    CLAUDE_CODE_OAUTH_SCOPES: login.scopes.join(\" \"),\n    CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: \"1\",\n  };\n}\n\n/** Output is discarded: it is never needed and must not reach evidence. */\nasync function runHelper(\n  binary: string,\n  env: Record<string, string>,\n): Promise<number> {\n  const proc = spawn([binary, \"auth\", \"login\"], {\n    env,\n    cwd: env.HOME,\n    stdin: \"ignore\",\n    stdout: \"ignore\",\n    stderr: \"ignore\",\n  });\n  const timer = setTimeout(() => {\n    proc.kill(\"SIGKILL\");\n  }, HELPER_TIMEOUT_MS);\n  try {\n    return await proc.exited;\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\n/** Accept only a persisted rotation; exit status alone proves nothing. */\nasync function storedRotation(\n  config: string,\n  login: ClaudeLogin,\n  code: number,\n): Promise<ClaudeLogin> {\n  const rotated = await helperLogin(join(config, \".credentials.json\"));\n  if (!rotated?.refreshToken || rotated.accessToken === login.accessToken)\n    throw new Error(\n      `Claude could not refresh the saved login (helper exit ${String(code)}); run claude and /login if it has expired`,\n    );\n  return rotated;\n}\n\nasync function helperLogin(path: string): Promise<ClaudeLogin | undefined> {\n  try {\n    if ((await stat(path)).size > MAX_CREDENTIAL_BYTES) return undefined;\n    return parseClaudeLogin(await readFile(path));\n  } catch {\n    return undefined;\n  }\n}\n"]}

package/dist/src/hosts/claude-login-store.js

@@ -0,0 +1,124 @@
+import { createHash, randomUUID } from "node:crypto";
+import { readFile, realpath, rename, rm, stat, writeFile, } from "node:fs/promises";
+import { homedir, userInfo } from "node:os";
+import { dirname, join } from "node:path";
+export const MAX_CREDENTIAL_BYTES = 1024 * 1024;
+/** Resolve the store Claude Code itself uses for the selected login. */
+export async function claudeLoginStore(sourceFile, keychain) {
+    if (sourceFile)
+        return fileLoginStore(sourceFile, dirname(sourceFile));
+    const configRoot = claudeConfigRoot();
+    const file = join(configRoot, ".credentials.json");
+    const saved = await keychainLoginStore(configRoot, keychain).catch(async (cause) => {
+        // Claude falls back to its saved file when the Keychain cannot be read.
+        if (await savedFileExists(file))
+            return undefined;
+        throw cause;
+    });
+    if (saved)
+        return saved;
+    await requireSavedFile(file);
+    return fileLoginStore(file, configRoot);
+}
+async function savedFileExists(path) {
+    try {
+        await stat(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function claudeConfigRoot() {
+    return (process.env.CLAUDE_CONFIG_DIR || join(homedir(), ".claude")).normalize("NFC");
+}
+/** Claude keys a non-default configuration's Keychain item by its path. */
+export function claudeKeychainService() {
+    const configured = process.env.CLAUDE_CONFIG_DIR;
+    if (!configured)
+        return "Claude Code-credentials";
+    const digest = createHash("sha256")
+        .update(configured.normalize("NFC"))
+        .digest("hex");
+    return `Claude Code-credentials-${digest.substring(0, 8)}`;
+}
+export function claudeKeychainAccount() {
+    let account;
+    try {
+        account = process.env.USER || userInfo().username;
+    }
+    catch {
+        return "claude-code-user";
+    }
+    return /^[a-zA-Z0-9._-]+$/.test(account) ? account : "claude-code-user";
+}
+async function keychainLoginStore(configRoot, keychain) {
+    if (!keychain)
+        return undefined;
+    const service = claudeKeychainService();
+    const account = claudeKeychainAccount();
+    if (!(await keychain.read(service, account)))
+        return undefined;
+    return {
+        origin: `macOS Keychain item "${service}"`,
+        lockRoot: configRoot,
+        read: async () => requireStoredLogin(await keychain.read(service, account)),
+        write: (bytes) => keychain.write(service, account, bytes),
+    };
+}
+async function requireSavedFile(path) {
+    try {
+        await stat(path);
+    }
+    catch (cause) {
+        const code = cause.code;
+        throw new Error(code === "ENOENT"
+            ? "Claude saved login is unavailable; run claude and /login"
+            : "Claude saved credential is unreadable or unavailable", { cause });
+    }
+}
+function requireStoredLogin(bytes) {
+    if (!bytes)
+        throw new Error("Claude credential is unreadable or unavailable");
+    return bytes;
+}
+export function requireBoundedCredential(credential) {
+    if (credential.byteLength === 0 ||
+        credential.byteLength > MAX_CREDENTIAL_BYTES ||
+        !credential.toString("utf8").trim())
+        throw new Error("Claude credential is empty or oversized");
+    return credential;
+}
+function fileLoginStore(path, lockRoot) {
+    return {
+        origin: path,
+        lockRoot,
+        read: () => readLoginFile(path),
+        write: (bytes) => replaceLoginFile(path, bytes),
+    };
+}
+async function readLoginFile(path) {
+    try {
+        if ((await stat(path)).size > MAX_CREDENTIAL_BYTES)
+            throw new Error("oversized credential");
+        return await readFile(path);
+    }
+    catch (cause) {
+        throw new Error("Claude credential is unreadable or unavailable", {
+            cause,
+        });
+    }
+}
+/** Replace atomically so concurrent Claude readers never see a partial login. */
+async function replaceLoginFile(path, bytes) {
+    const target = await realpath(path);
+    const temporary = join(dirname(target), `.sevro-login-${randomUUID()}.tmp`);
+    try {
+        await writeFile(temporary, bytes, { flag: "wx", mode: 0o600 });
+        await rename(temporary, target);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}
+//# sourceMappingURL=claude-login-store.js.map