@cloudcli-ai/cloudcli 1.37.2 → 1.37.4

package/server/modules/providers/tests/claude-auth.test.ts

@@ -5,6 +5,7 @@ import path from 'node:path';
 import test from 'node:test';
 
 import { ClaudeProviderAuth } from '@/modules/providers/list/claude/claude-auth.provider.js';
+import type { ProviderAuthStatus, ProviderAuthSubscriptionOverride } from '@/shared/types.js';
 
 // checkCredentials() is private, but unlike getStatus() it never shells out to the
 // `claude` CLI — it only reads env vars and ~/.claude files. Calling it directly
@@ -15,11 +16,29 @@ type CheckCredentialsResult = {
   email: string | null;
   method: string | null;
   error?: string;
+  subscriptionOverride?: ProviderAuthSubscriptionOverride;
 };
 
 const checkCredentials = (auth: ClaudeProviderAuth): Promise<CheckCredentialsResult> =>
   (auth as unknown as { checkCredentials: () => Promise<CheckCredentialsResult> }).checkCredentials();
 
+// getStatus() is the public API the route serves, but it first shells out to
+// `claude --version`. Stubbing checkInstalled() lets the test cover the mapping
+// from checkCredentials() to the wire shape without the CLI.
+const getStatusWithCliInstalled = (auth: ClaudeProviderAuth): Promise<ProviderAuthStatus> => {
+  (auth as unknown as { checkInstalled: () => boolean }).checkInstalled = () => true;
+  return auth.getStatus();
+};
+
+const validSubscriptionCredentials = (email?: string) => ({
+  claudeAiOauth: {
+    accessToken: 'valid-token',
+    refreshToken: 'live-refresh-token',
+    expiresAt: Date.now() + 60 * 60 * 1000,
+  },
+  ...(email ? { email } : {}),
+});
+
 const ENV_KEYS = ['CLAUDE_CODE_OAUTH_TOKEN', 'ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN'] as const;
 
 const withEnv = async (
@@ -136,6 +155,64 @@ test('checkCredentials: no CLAUDE_CODE_OAUTH_TOKEN, expired credentials file rep
   });
 });
 
+test('checkCredentials: expired access token with a live refresh token is still authenticated', async () => {
+  await withTempHome(async (homeDir) => {
+    await writeCredentialsFile(homeDir, {
+      claudeAiOauth: {
+        accessToken: 'stale-token',
+        refreshToken: 'live-refresh-token',
+        expiresAt: 1_000_000_000_000,
+        refreshTokenExpiresAt: Date.now() + 30 * 24 * 60 * 60 * 1000,
+      },
+      email: 'someone@example.com',
+    });
+
+    await withEnv({}, async () => {
+      const status = await checkCredentials(new ClaudeProviderAuth());
+      assert.equal(status.authenticated, true);
+      assert.equal(status.method, 'credentials_file');
+      assert.equal(status.email, 'someone@example.com');
+    });
+  });
+});
+
+test('checkCredentials: expired access token with a refresh token that has no recorded expiry is authenticated', async () => {
+  await withTempHome(async (homeDir) => {
+    await writeCredentialsFile(homeDir, {
+      claudeAiOauth: {
+        accessToken: 'stale-token',
+        refreshToken: 'live-refresh-token',
+        expiresAt: 1_000_000_000_000,
+      },
+    });
+
+    await withEnv({}, async () => {
+      const status = await checkCredentials(new ClaudeProviderAuth());
+      assert.equal(status.authenticated, true);
+      assert.equal(status.method, 'credentials_file');
+    });
+  });
+});
+
+test('checkCredentials: expired access token with an expired refresh token reports not authenticated', async () => {
+  await withTempHome(async (homeDir) => {
+    await writeCredentialsFile(homeDir, {
+      claudeAiOauth: {
+        accessToken: 'stale-token',
+        refreshToken: 'stale-refresh-token',
+        expiresAt: 1_000_000_000_000,
+        refreshTokenExpiresAt: 1_000_000_000_000,
+      },
+    });
+
+    await withEnv({}, async () => {
+      const status = await checkCredentials(new ClaudeProviderAuth());
+      assert.equal(status.authenticated, false);
+      assert.match(status.error ?? '', /expired/i);
+    });
+  });
+});
+
 test('checkCredentials: ANTHROPIC_API_KEY takes precedence over CLAUDE_CODE_OAUTH_TOKEN', async () => {
   await withTempHome(async () => {
     await withEnv(
@@ -148,3 +225,134 @@ test('checkCredentials: ANTHROPIC_API_KEY takes precedence over CLAUDE_CODE_OAUT
     );
   });
 });
+
+// Issue #568: Claude Code silently prefers ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN
+// over the `claude /login` subscription, billing every request to the key. The
+// status must say so — and only when a usable login is really being bypassed.
+
+test('checkCredentials: ANTHROPIC_API_KEY in the process env alongside a valid subscription login reports the override', async () => {
+  await withTempHome(async (homeDir) => {
+    await writeCredentialsFile(homeDir, validSubscriptionCredentials('someone@example.com'));
+
+    await withEnv({ ANTHROPIC_API_KEY: 'test-api-key' }, async () => {
+      const status = await checkCredentials(new ClaudeProviderAuth());
+      // The existing fields are untouched: the key still wins and keeps its label.
+      assert.equal(status.authenticated, true);
+      assert.equal(status.method, 'api_key');
+      assert.equal(status.email, 'API Key Auth');
+      assert.deepEqual(status.subscriptionOverride, {
+        variable: 'ANTHROPIC_API_KEY',
+        source: 'process_env',
+        subscriptionEmail: 'someone@example.com',
+      });
+    });
+  });
+});
+
+test('checkCredentials: ANTHROPIC_AUTH_TOKEN in the process env alongside a valid subscription login names the auth token', async () => {
+  await withTempHome(async (homeDir) => {
+    await writeCredentialsFile(homeDir, validSubscriptionCredentials());
+
+    await withEnv({ ANTHROPIC_AUTH_TOKEN: 'test-auth-token', ANTHROPIC_API_KEY: 'test-api-key' }, async () => {
+      const status = await checkCredentials(new ClaudeProviderAuth());
+      assert.equal(status.method, 'api_key');
+      assert.equal(status.email, 'Auth Token');
+      assert.deepEqual(status.subscriptionOverride, {
+        variable: 'ANTHROPIC_AUTH_TOKEN',
+        source: 'process_env',
+        subscriptionEmail: null,
+      });
+    });
+  });
+});
+
+test('checkCredentials: ANTHROPIC_API_KEY in settings.json env alongside a valid subscription login points at settings.json', async () => {
+  await withTempHome(async (homeDir) => {
+    await writeSettingsFile(homeDir, { ANTHROPIC_API_KEY: 'test-api-key-from-settings' });
+    await writeCredentialsFile(homeDir, validSubscriptionCredentials('someone@example.com'));
+
+    await withEnv({}, async () => {
+      const status = await checkCredentials(new ClaudeProviderAuth());
+      assert.equal(status.method, 'api_key');
+      assert.equal(status.email, 'API Key Auth');
+      assert.deepEqual(status.subscriptionOverride, {
+        variable: 'ANTHROPIC_API_KEY',
+        source: 'settings_file',
+        subscriptionEmail: 'someone@example.com',
+      });
+    });
+  });
+});
+
+test('checkCredentials: ANTHROPIC_API_KEY with no credentials file reports no override', async () => {
+  await withTempHome(async () => {
+    await withEnv({ ANTHROPIC_API_KEY: 'test-api-key' }, async () => {
+      const status = await checkCredentials(new ClaudeProviderAuth());
+      assert.equal(status.authenticated, true);
+      assert.equal(status.method, 'api_key');
+      assert.equal(status.subscriptionOverride, undefined);
+    });
+  });
+});
+
+test('checkCredentials: ANTHROPIC_API_KEY with an expired subscription login reports no override', async () => {
+  await withTempHome(async (homeDir) => {
+    // Nothing usable is being bypassed here, so warning would only confuse.
+    await writeCredentialsFile(homeDir, {
+      claudeAiOauth: {
+        accessToken: 'stale-token',
+        refreshToken: 'stale-refresh-token',
+        expiresAt: 1_000_000_000_000,
+        refreshTokenExpiresAt: 1_000_000_000_000,
+      },
+    });
+
+    await withEnv({ ANTHROPIC_API_KEY: 'test-api-key' }, async () => {
+      const status = await checkCredentials(new ClaudeProviderAuth());
+      assert.equal(status.authenticated, true);
+      assert.equal(status.method, 'api_key');
+      assert.equal(status.subscriptionOverride, undefined);
+    });
+  });
+});
+
+test('checkCredentials: a valid subscription login with no API key reports credentials_file and no override', async () => {
+  await withTempHome(async (homeDir) => {
+    await writeCredentialsFile(homeDir, validSubscriptionCredentials('someone@example.com'));
+
+    await withEnv({}, async () => {
+      const status = await checkCredentials(new ClaudeProviderAuth());
+      assert.equal(status.authenticated, true);
+      assert.equal(status.method, 'credentials_file');
+      assert.equal(status.email, 'someone@example.com');
+      assert.equal(status.subscriptionOverride, undefined);
+    });
+  });
+});
+
+test('getStatus: passes the subscription override through to the wire shape, and omits the key when there is none', async () => {
+  await withTempHome(async (homeDir) => {
+    await writeCredentialsFile(homeDir, validSubscriptionCredentials('someone@example.com'));
+
+    await withEnv({ ANTHROPIC_API_KEY: 'test-api-key' }, async () => {
+      const status = await getStatusWithCliInstalled(new ClaudeProviderAuth());
+      assert.equal(status.installed, true);
+      assert.equal(status.provider, 'claude');
+      assert.equal(status.authenticated, true);
+      assert.equal(status.method, 'api_key');
+      assert.equal(status.email, 'API Key Auth');
+      assert.deepEqual(status.subscriptionOverride, {
+        variable: 'ANTHROPIC_API_KEY',
+        source: 'process_env',
+        subscriptionEmail: 'someone@example.com',
+      });
+    });
+
+    await withEnv({}, async () => {
+      const status = await getStatusWithCliInstalled(new ClaudeProviderAuth());
+      assert.equal(status.method, 'credentials_file');
+      // Omitted, not null: existing JSON consumers see exactly the old payload.
+      assert.equal('subscriptionOverride' in status, false);
+    });
+  });
+});

package/server/modules/providers/tests/claude-background-work.test.ts

@@ -0,0 +1,213 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  createBackgroundWorkTracker,
+  startsBackgroundWork,
+} from '@/modules/providers/list/claude/claude-runtime.provider.js';
+
+// Only turns that start work outliving the turn hold their CLI process open. A
+// turn scored `false` here has its stdin released the moment `result` arrives,
+// and the CLI reads that EOF as print wind-down — so anything still running dies.
+const turn = (...blocks: Array<{ name: string; input?: Record<string, unknown> }>) => ({
+  type: 'assistant',
+  message: { content: blocks.map((block) => ({ type: 'tool_use', input: {}, ...block })) },
+});
+
+test('a backgrounded Bash holds the process open', () => {
+  assert.equal(startsBackgroundWork(turn({ name: 'Bash', input: { run_in_background: true } })), true);
+});
+
+test('a foreground Bash does not', () => {
+  assert.equal(startsBackgroundWork(turn({ name: 'Bash', input: { run_in_background: false } })), false);
+});
+
+test('a backgrounded Agent holds the process open', () => {
+  // The gap this suite exists for: a background agent used to be scored as
+  // nothing outstanding, so the CLI wound down and killed it mid-run.
+  assert.equal(startsBackgroundWork(turn({ name: 'Agent', input: { run_in_background: true } })), true);
+});
+
+test('an Agent with no run_in_background holds the process open', () => {
+  // `run_in_background` is optional on AgentInput and agents background by
+  // default, so an omitted field means background, not foreground.
+  assert.equal(startsBackgroundWork(turn({ name: 'Agent', input: { prompt: 'Investigate' } })), true);
+});
+
+test('a foreground Agent does not', () => {
+  // It never pushes a follow-up turn, so holding for it would pin the process
+  // for the full BG_WAIT_CEILING_MS.
+  assert.equal(startsBackgroundWork(turn({ name: 'Agent', input: { run_in_background: false } })), false);
+});
+
+test('a Workflow holds the process open', () => {
+  // WorkflowInput has no foreground option: every call returns a task id
+  // immediately and reports back in a later turn.
+  assert.equal(startsBackgroundWork(turn({ name: 'Workflow', input: { script: 'export const meta = {}' } })), true);
+});
+
+test('a deferred-work tool holds the process open', () => {
+  assert.equal(startsBackgroundWork(turn({ name: 'Monitor' })), true);
+});
+
+test('a turn that starts nothing lasting does not', () => {
+  assert.equal(startsBackgroundWork(turn({ name: 'Read' })), false);
+});
+
+test('one backgrounded agent among foreground calls is enough', () => {
+  assert.equal(
+    startsBackgroundWork(
+      turn(
+        { name: 'Read' },
+        { name: 'Agent', input: { run_in_background: false } },
+        { name: 'Agent', input: { run_in_background: true } },
+      ),
+    ),
+    true,
+  );
+});
+
+test('a message carrying no tool calls does not', () => {
+  assert.equal(startsBackgroundWork({ type: 'result', message: { content: 'done' } }), false);
+  assert.equal(startsBackgroundWork({ type: 'assistant', message: { content: [] } }), false);
+  assert.equal(startsBackgroundWork({}), false);
+});
+
+// Once the turn's `result` is out, the tracker below is the only record of
+// what the held process is still running: the running-sessions list reads it
+// and a stop request is refused unless it names one of its tasks. The event
+// shapes are the SDK's own, as a real query emits them.
+const started = (taskId: string, extra: Record<string, unknown> = {}) => ({
+  type: 'system',
+  subtype: 'task_started',
+  task_id: taskId,
+  tool_use_id: `toolu_${taskId}`,
+  description: `Task ${taskId}`,
+  task_type: 'local_agent',
+  ...extra,
+});
+const notified = (taskId: string, status: string) => ({
+  type: 'system', subtype: 'task_notification', task_id: taskId, tool_use_id: `toolu_${taskId}`, status, summary: '', output_file: '',
+});
+const updated = (taskId: string, patch: Record<string, unknown>) => ({
+  type: 'system', subtype: 'task_updated', task_id: taskId, patch,
+});
+
+test('a task_started with a tool_use_id adds the task under its session', () => {
+  const tracker = createBackgroundWorkTracker();
+  const before = Date.now();
+  // The session's own turn issued the call, so the task is its own work.
+  tracker.apply('s1', {
+    type: 'assistant',
+    parent_tool_use_id: null,
+    message: { role: 'assistant', content: [{ type: 'tool_use', id: 'toolu_t1', name: 'Workflow', input: {} }] },
+  });
+  tracker.apply('s1', started('t1', { task_type: 'local_workflow', workflow_name: 'spec' }));
+
+  const [entry] = tracker.list();
+  assert.equal(tracker.list().length, 1);
+  assert.equal(entry.sessionId, 's1');
+  assert.equal(entry.tasks.length, 1);
+  const { startedAt, ...task } = entry.tasks[0];
+  assert.deepEqual(task, {
+    taskId: 't1',
+    toolUseId: 'toolu_t1',
+    taskType: 'local_workflow',
+    description: 'Task t1',
+    workflowName: 'spec',
+  });
+  assert.ok(startedAt >= before && startedAt <= Date.now());
+  assert.equal(tracker.hasOutstanding('s1'), true);
+  assert.equal(tracker.has('s1', 't1'), true);
+});
+
+test('a task started for a call the session itself made is its own; one from inside an agent is nested', () => {
+  // Verified on a real run: a workflow agent that backgrounds `sleep 60` puts
+  // a `task_started` on the parent's stream, with a tool_use_id from the
+  // agent's transcript. The parent transcript has no card for it, and the
+  // pill would otherwise read "3 tasks" for one workflow.
+  const tracker = createBackgroundWorkTracker();
+  tracker.apply('s1', {
+    type: 'assistant',
+    parent_tool_use_id: null,
+    message: { role: 'assistant', content: [{ type: 'tool_use', id: 'toolu_t1', name: 'Workflow', input: {} }] },
+  });
+  tracker.apply('s1', started('t1', { task_type: 'local_workflow', workflow_name: 'spec' }));
+  tracker.apply('s1', started('t2', { task_type: 'local_bash', description: 'Sleep for 60 seconds' }));
+
+  const [entry] = tracker.list();
+  assert.deepEqual(entry.tasks.map((task) => [task.taskId, task.nested ?? false]), [['t1', false], ['t2', true]]);
+  assert.equal(tracker.has('s1', 't2'), true, 'a nested task can still be stopped');
+
+  // The set of own calls dies with the session, like the tasks.
+  tracker.clear('s1');
+  tracker.apply('s1', started('t1', { task_type: 'local_workflow' }));
+  assert.equal(tracker.list()[0].tasks[0].nested, true);
+});
+
+test('a task_started without a tool_use_id is not tracked', () => {
+  // Housekeeping tasks the CLI starts on its own have no launching call and
+  // nothing in the transcript to show them under.
+  const tracker = createBackgroundWorkTracker();
+  tracker.apply('s1', { type: 'system', subtype: 'task_started', task_id: 'ambient', description: 'x' });
+
+  assert.deepEqual(tracker.list(), []);
+  assert.equal(tracker.hasOutstanding('s1'), false);
+});
+
+test('a task_notification removes the task whatever its status', () => {
+  const tracker = createBackgroundWorkTracker();
+  tracker.apply('s1', started('t1'));
+  tracker.apply('s1', started('t2'));
+  tracker.apply('s1', notified('t1', 'completed'));
+
+  assert.equal(tracker.has('s1', 't1'), false);
+  assert.equal(tracker.has('s1', 't2'), true);
+  assert.equal(tracker.hasOutstanding('s1'), true);
+
+  tracker.apply('s1', notified('t2', 'stopped'));
+  assert.equal(tracker.hasOutstanding('s1'), false);
+  assert.deepEqual(tracker.list(), []);
+});
+
+test('a terminal task_updated removes the task', () => {
+  const tracker = createBackgroundWorkTracker();
+  for (const [taskId, status] of [['a', 'completed'], ['b', 'failed'], ['c', 'killed']]) {
+    tracker.apply('s1', started(taskId));
+    tracker.apply('s1', updated(taskId, { status, end_time: 1 }));
+    assert.equal(tracker.has('s1', taskId), false, `${status} settles the task`);
+  }
+  assert.equal(tracker.hasOutstanding('s1'), false);
+});
+
+test('a non-terminal task_updated keeps the task', () => {
+  const tracker = createBackgroundWorkTracker();
+  tracker.apply('s1', started('t1'));
+  tracker.apply('s1', updated('t1', { status: 'running' }));
+  tracker.apply('s1', updated('t1', { is_backgrounded: true }));
+  tracker.apply('s1', updated('t1', { status: 'paused' }));
+
+  assert.equal(tracker.has('s1', 't1'), true);
+  assert.equal(tracker.hasOutstanding('s1'), true);
+});
+
+test('clearing a session empties it and leaves the others alone', () => {
+  const tracker = createBackgroundWorkTracker();
+  tracker.apply('s1', started('t1'));
+  tracker.apply('s2', started('t2'));
+  tracker.clear('s1');
+
+  assert.equal(tracker.hasOutstanding('s1'), false);
+  assert.equal(tracker.has('s1', 't1'), false);
+  assert.deepEqual(tracker.list().map((entry) => entry.sessionId), ['s2']);
+});
+
+test('messages that are not task events leave the set untouched', () => {
+  const tracker = createBackgroundWorkTracker();
+  tracker.apply('s1', started('t1'));
+  tracker.apply('s1', { type: 'assistant', message: { content: [] } });
+  tracker.apply('s1', { type: 'system', subtype: 'task_progress', task_id: 't1', description: 'x', usage: {} });
+  tracker.apply('s1', { type: 'result', task_id: 't1' });
+
+  assert.equal(tracker.has('s1', 't1'), true);
+});

package/server/modules/providers/tests/claude-compaction.test.ts

@@ -0,0 +1,101 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { ClaudeSessionsProvider } from '@/modules/providers/list/claude/claude-sessions.provider.js';
+
+const provider = new ClaudeSessionsProvider();
+const SESSION_ID = 'claude-compaction-1';
+
+/**
+ * Both records that describe a compaction are `system` events, which normalized
+ * to nothing before this: the boundary carries the numbers, the status says one
+ * is running. Each becomes one ordinary assistant row, so a client that knows
+ * nothing of `compact` still reads the sentence.
+ */
+test('a compact boundary becomes one row carrying its numbers', () => {
+  const [row, ...rest] = provider.normalizeMessage({
+    type: 'system',
+    subtype: 'compact_boundary',
+    uuid: 'u-1',
+    timestamp: '2026-01-01T00:00:00.000Z',
+    compactMetadata: {
+      trigger: 'manual',
+      preTokens: 335_402,
+      postTokens: 10_120,
+      durationMs: 142_000,
+    },
+  }, SESSION_ID);
+
+  assert.equal(rest.length, 0);
+  assert.equal(row.kind, 'text');
+  assert.equal(row.role, 'assistant');
+  assert.equal(row.content, 'Compacted · manual · 335k → 10k tokens · 2m 22s');
+  assert.deepEqual(row.compact, {
+    phase: 'done',
+    trigger: 'manual',
+    preTokens: 335_402,
+    postTokens: 10_120,
+    durationMs: 142_000,
+  });
+});
+
+test('the live spelling of the metadata reads the same', () => {
+  const [row] = provider.normalizeMessage({
+    type: 'system',
+    subtype: 'compact_boundary',
+    compact_metadata: { trigger: 'auto', pre_tokens: 1_240_000, post_tokens: 18_000, duration_ms: 45_000 },
+  }, SESSION_ID);
+
+  assert.equal(row.content, 'Compacted · auto · 1.2M → 18k tokens · 45s');
+  assert.equal(row.compact?.trigger, 'auto');
+});
+
+test('a boundary with no metadata still says a compaction happened', () => {
+  const [row] = provider.normalizeMessage({
+    type: 'system',
+    subtype: 'compact_boundary',
+  }, SESSION_ID);
+
+  assert.equal(row.content, 'Compacted · auto');
+  assert.equal(row.compact?.phase, 'done');
+});
+
+test('a compacting status becomes a running row, and other statuses none', () => {
+  const [running] = provider.normalizeMessage({
+    type: 'system',
+    subtype: 'status',
+    status: 'compacting',
+  }, SESSION_ID);
+
+  assert.equal(running.content, 'Compacting conversation…');
+  assert.equal(running.compact?.phase, 'running');
+
+  assert.deepEqual(
+    provider.normalizeMessage({ type: 'system', subtype: 'status', status: 'requesting' }, SESSION_ID),
+    [],
+  );
+});
+
+test('a failed compaction says so, with the reason when there is one', () => {
+  const [failed] = provider.normalizeMessage({
+    type: 'system',
+    subtype: 'status',
+    compact_result: 'failed',
+    compact_error: 'context still too large',
+  }, SESSION_ID);
+
+  assert.equal(failed.content, 'Compaction failed: context still too large');
+  assert.equal(failed.compact?.phase, 'failed');
+  assert.equal(failed.compact?.error, 'context still too large');
+});
+
+test('the summary keeps its flag, so the client can fold it into the row', () => {
+  const [row] = provider.normalizeMessage({
+    type: 'user',
+    isCompactSummary: true,
+    message: { role: 'user', content: 'This session is being continued from a previous conversation.' },
+  }, SESSION_ID);
+
+  assert.equal(row.role, 'assistant');
+  assert.equal(row.isCompactSummary, true);
+});