@integrity-labs/agt-cli 0.28.1155 → 0.28.1156

package/dist/{chunk-VSC7DI3S.js → chunk-7NAL24SM.js}

@@ -2,12 +2,12 @@ import {
   CLAUDE_AGENT_PROCESS_PATTERN,
   parsePsRows
 } from "./chunk-XWVM4KPK.js";
-import {
-  effectiveClaudeJsonPath
-} from "./chunk-EL5MWGGH.js";
 import {
   FORCED_UPDATE_HARD_DEADLINE_MS
 } from "./chunk-D55RMQTG.js";
+import {
+  effectiveClaudeJsonPath
+} from "./chunk-EL5MWGGH.js";
 
 // src/lib/claude-code-updater.ts
 import { execFile, execFileSync as execFileSync2 } from "child_process";
@@ -715,4 +715,4 @@ export {
   probeClaudeInstalls,
   maybeUpdateClaudeCode
 };
-//# sourceMappingURL=chunk-VSC7DI3S.js.map
+//# sourceMappingURL=chunk-7NAL24SM.js.map

package/dist/chunk-OAWK4OBN.js

@@ -0,0 +1,117 @@
+import {
+  claudeConfigDirFor
+} from "./chunk-EL5MWGGH.js";
+
+// src/lib/claude-signin-reset.ts
+import { readdirSync, renameSync } from "fs";
+import { basename, dirname, join } from "path";
+var CLAUDE_CREDENTIALS_FILE = ".credentials.json";
+var CLAUDE_CREDENTIALS_FILES = [CLAUDE_CREDENTIALS_FILE, "credentials.json"];
+var SIGNIN_RESET_HOLD_MS = 24 * 60 * 60 * 1e3;
+var realFs = { rename: renameSync, list: (dir) => readdirSync(dir) };
+function compactIso(d) {
+  return d.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
+}
+function signinResetBackupPath(path, pairId, now) {
+  return `${path}.bak-${compactIso(now)}-${pairId.slice(0, 8)}`;
+}
+function existingBackupForPair(path, pairId, names) {
+  const prefix = `${basename(path)}.bak-`;
+  const suffix = `-${pairId.slice(0, 8)}`;
+  const hit = names.filter((n) => n.startsWith(prefix) && n.endsWith(suffix)).sort().pop();
+  return hit ? join(dirname(path), hit) : void 0;
+}
+function freeBackupPath(path, pairId, now, names) {
+  const base = signinResetBackupPath(path, pairId, now);
+  if (!names.includes(basename(base))) return base;
+  const stamp = base.slice(`${path}.bak-`.length, base.length - `-${pairId.slice(0, 8)}`.length);
+  for (let n = 1; ; n++) {
+    const candidate = `${path}.bak-${stamp}-${n}-${pairId.slice(0, 8)}`;
+    if (!names.includes(basename(candidate))) return candidate;
+  }
+}
+function resetClaudeSignin(opts) {
+  const dir = opts.configDir ?? claudeConfigDirFor();
+  const path = join(dir, CLAUDE_CREDENTIALS_FILE);
+  const platform = opts.platform ?? process.platform;
+  if (platform === "darwin") return { outcome: "unsupported", path, platform };
+  const fs = opts.fs ?? realFs;
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  let names;
+  try {
+    names = fs.list(dir);
+  } catch (err) {
+    const code = err?.code;
+    if (code !== "ENOENT") {
+      return { outcome: "failed", path, reason: code ?? (err?.message || "unknown error") };
+    }
+    names = [];
+  }
+  const moved = [];
+  for (const name of CLAUDE_CREDENTIALS_FILES) {
+    const p = join(dir, name);
+    const earlier = existingBackupForPair(p, opts.pairId, names);
+    if (earlier && !names.includes(name)) {
+      moved.push({ path: p, backup: earlier });
+      continue;
+    }
+    const backup = freeBackupPath(p, opts.pairId, now, names);
+    try {
+      fs.rename(p, backup);
+      moved.push({ path: p, backup });
+    } catch (err) {
+      const code = err?.code;
+      if (code === "ENOENT") continue;
+      const reason = code ?? (err?.message || "unknown error");
+      return { outcome: "failed", path: p, reason, ...moved.length ? { moved } : {} };
+    }
+  }
+  if (moved.length === 0) return { outcome: "absent", path };
+  const [first, ...others] = moved;
+  return { outcome: "moved", path: first.path, backup: first.backup, ...others.length ? { others } : {} };
+}
+function signinResetInForce(names, now = /* @__PURE__ */ new Date()) {
+  if (CLAUDE_CREDENTIALS_FILES.some((n) => names.includes(n))) return false;
+  let newest = -Infinity;
+  for (const n of names) {
+    const base = CLAUDE_CREDENTIALS_FILES.find((f) => n.startsWith(`${f}.bak-`));
+    if (!base) continue;
+    const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z-/.exec(n.slice(`${base}.bak-`.length));
+    if (!m) continue;
+    const t = Date.UTC(+m[1], +m[2] - 1, +m[3], +m[4], +m[5], +m[6]);
+    if (t > newest) newest = t;
+  }
+  return newest > -Infinity && now.getTime() - newest < SIGNIN_RESET_HOLD_MS;
+}
+function describeSigninResetForLog(pairId, r) {
+  const pair = pairId.slice(0, 8);
+  switch (r.outcome) {
+    case "moved":
+      return `[claude-pair] sign-in reset pair=${pair} outcome=moved from=${r.path} to=${r.backup}` + (r.others ?? []).map((o) => ` also from=${o.path} to=${o.backup}`).join("");
+    case "absent":
+      return `[claude-pair] sign-in reset pair=${pair} outcome=absent path=${r.path} (nothing to move)`;
+    case "failed":
+      return `[claude-pair] sign-in reset pair=${pair} outcome=failed path=${r.path} reason=${r.reason}` + (r.moved ?? []).map((o) => ` already-moved from=${o.path} to=${o.backup}`).join("");
+    case "unsupported":
+      return `[claude-pair] sign-in reset pair=${pair} outcome=unsupported platform=${r.platform} (sign-in is in the Keychain; nothing touched)`;
+  }
+}
+function describeSigninResetFailure(r) {
+  if (r.outcome === "unsupported") {
+    return 'This host is a Mac, and it keeps its Claude sign-in in the macOS Keychain, which the console cannot clear. Nothing on the host was changed and the sign-in was not started. To clear it, run `claude /logout` on the host (or remove "Claude Code-credentials" in Keychain Access), then use Re-login. If you cannot reach the host, contact Ninjafy support.';
+  }
+  return `Could not reset the saved Claude sign-in on this host (${r.reason}), so the sign-in was not started: a new one would only land on the same stuck screen. ` + // Honest when a first file was already moved aside before the second failed.
+  (r.moved?.length ? "One saved sign-in file was moved aside (a backup was kept on the host); another could not be. " : "Nothing on the host was changed. ") + "Try again; if it repeats, contact Ninjafy support.";
+}
+
+export {
+  CLAUDE_CREDENTIALS_FILE,
+  CLAUDE_CREDENTIALS_FILES,
+  SIGNIN_RESET_HOLD_MS,
+  signinResetBackupPath,
+  resetClaudeSignin,
+  signinResetInForce,
+  describeSigninResetForLog,
+  describeSigninResetFailure
+};
+//# sourceMappingURL=chunk-OAWK4OBN.js.map

package/dist/chunk-OAWK4OBN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/claude-signin-reset.ts"],"sourcesContent":["/**\n * ENG-11659: \"Reset Claude sign-in on this host\", the SSM step as a button.\n *\n * A host whose saved Claude credentials have gone bad (expired beyond refresh,\n * or leaving `claude` on \"OAuth error: Invalid code. Press Enter to retry\")\n * cannot be re-paired from the console: every pairing launches `claude` against\n * the same file and lands on the same screen. Until now the remedy was to SSH in\n * and clear `~/.claude/.credentials.json` by hand.\n *\n * This moves that file aside (under either name Claude Code has used for it,\n * `.credentials.json` and the older `credentials.json`), and nothing else.\n *\n *  - **Rename, never read.** The file holds OAuth tokens. It is moved to a\n *    timestamped backup in the SAME directory (same filesystem, same mode, so\n *    the rename is atomic and nothing is copied), and its contents are never\n *    opened. The fs surface is injected so a test can prove that: the fake\n *    offers no read at all.\n *  - **The credential, and only the credential.** Both names, because the rest\n *    of the CLI treats either as live (Obi Wan on #7129). Not \"any *.json next\n *    to it\": that directory also holds\n *    `settings.json`, and `.claude.json` (the account identity, ENG-8186) is\n *    shared with every running session and rewritten by `claude` on the next\n *    successful login anyway (`finalizeClaudePairOnboarding` waits for exactly\n *    that write). Leaving `.claude.json` alone is also what keeps the account\n *    fingerprint, and so the auth tuple, unchanged: a reset does not trip the\n *    `auth-tuple-change` restart of every agent on the host.\n *  - **Running sessions are not touched.** Nothing is restarted. A running\n *    session keeps the tokens it already holds in memory; on a host where\n *    those had expired (the case this exists for) it was failing already.\n *  - **The path a pairing will actually use.** `claudeConfigDir()` honours\n *    `CLAUDE_CONFIG_DIR`, the same resolution the pair pane is launched with.\n *  - **Once per pair.** The manager retries an `initiating` row on every poll\n *    until its report lands. A second rename would hit ENOENT and report\n *    \"nothing to clear\" for a host whose sign-in WAS just moved (Obi Wan on\n *    #7129). So a backup already carrying this pair's id is the answer: the\n *    reset for this pair has happened. Listing the directory reads names only.\n *  - **Not on macOS.** Claude Code keeps a Mac host's sign-in in the Keychain\n *    (\"Claude Code-credentials\", see claude-auth-detect.ts), not in this file.\n *    A Keychain item cannot be renamed aside, only deleted, and copying it\n *    first would mean reading the token. So a Mac host gets an honest refusal,\n *    not a rename of a file that is not the credential and a false \"nothing to\n *    clear\" (Obi Wan e959be60938a on #7129).\n */\n\nimport { readdirSync, renameSync } from 'node:fs';\nimport { basename, dirname, join } from 'node:path';\nimport { claudeConfigDir } from './claude-config-location.js';\n\nexport const CLAUDE_CREDENTIALS_FILE = '.credentials.json';\n/**\n * Every name Claude Code has used for the credential, dotted first. Keep in\n * sync with findClaudeCredentialsPaths (claude-auth-detect.ts) and\n * syncClaudeCredsToRoot (persistent-session.ts), which both accept either: a\n * reset that moved only the dotted one would report \"nothing to clear\" on a\n * host signed in under the other (Obi Wan on #7129).\n */\nexport const CLAUDE_CREDENTIALS_FILES = [CLAUDE_CREDENTIALS_FILE, 'credentials.json'] as const;\n\n/**\n * How long a reset keeps the legacy /home -> /root sync from copying a\n * credential back. Long enough to cover the pairing it was for (minutes) and\n * an operator coming back to it; short enough that a backup left from an old\n * reset cannot block that sync forever (Obi Wan 80d9b3ea16af on #7129).\n */\nexport const SIGNIN_RESET_HOLD_MS = 24 * 60 * 60 * 1000;\n\nexport type SigninResetResult =\n  /** The credentials file was moved to `backup` (`others`: a second legacy-named one, also moved). */\n  | { outcome: 'moved'; path: string; backup: string; others?: Array<{ path: string; backup: string }> }\n  /** There was no credentials file to move: already signed out. */\n  | { outcome: 'absent'; path: string }\n  /** The rename of `path` failed for another reason; it is where it was. `moved`: any moved before it. */\n  | { outcome: 'failed'; path: string; reason: string; moved?: Array<{ path: string; backup: string }> }\n  /** This platform keeps the sign-in somewhere a rename cannot reach (macOS Keychain). Nothing touched. */\n  | { outcome: 'unsupported'; path: string; platform: string };\n\n/** Only what the reset needs. Deliberately no read method: `list` returns names, never contents. */\nexport interface SigninResetFs {\n  rename(from: string, to: string): void;\n  list(dir: string): string[];\n}\n\nconst realFs: SigninResetFs = { rename: renameSync, list: (dir) => readdirSync(dir) };\n\n/** `2026-10-24T09:41:07.123Z` -> `20261024T094107Z`: sortable, no `:` in a filename. */\nfunction compactIso(d: Date): string {\n  return d.toISOString().replace(/[-:]/g, '').replace(/\\.\\d{3}Z$/, 'Z');\n}\n\nexport function signinResetBackupPath(path: string, pairId: string, now: Date): string {\n  return `${path}.bak-${compactIso(now)}-${pairId.slice(0, 8)}`;\n}\n\n/** A backup an earlier pass made for THIS pair, if any, from a directory listing (names only). */\nfunction existingBackupForPair(path: string, pairId: string, names: readonly string[]): string | undefined {\n  const prefix = `${basename(path)}.bak-`;\n  const suffix = `-${pairId.slice(0, 8)}`;\n  const hit = names.filter((n) => n.startsWith(prefix) && n.endsWith(suffix)).sort().pop();\n  return hit ? join(dirname(path), hit) : undefined;\n}\n\n/** A backup path not already taken in `names` (a second move in the same second must not overwrite the first). */\nfunction freeBackupPath(path: string, pairId: string, now: Date, names: readonly string[]): string {\n  const base = signinResetBackupPath(path, pairId, now);\n  if (!names.includes(basename(base))) return base;\n  const stamp = base.slice(`${path}.bak-`.length, base.length - `-${pairId.slice(0, 8)}`.length);\n  for (let n = 1; ; n++) {\n    const candidate = `${path}.bak-${stamp}-${n}-${pairId.slice(0, 8)}`;\n    if (!names.includes(basename(candidate))) return candidate;\n  }\n}\n\nexport function resetClaudeSignin(opts: {\n  pairId: string;\n  configDir?: string;\n  now?: Date;\n  fs?: SigninResetFs;\n  platform?: NodeJS.Platform;\n}): SigninResetResult {\n  const dir = opts.configDir ?? claudeConfigDir();\n  const path = join(dir, CLAUDE_CREDENTIALS_FILE);\n  const platform = opts.platform ?? process.platform;\n  if (platform === 'darwin') return { outcome: 'unsupported', path, platform };\n  const fs = opts.fs ?? realFs;\n  const now = opts.now ?? new Date();\n  let names: string[];\n  try {\n    names = fs.list(dir);\n  } catch (err) {\n    // No directory means no file and no backup: each rename below says ENOENT.\n    // Any other listing error fails closed (CodeRabbit on #7129): without the\n    // names, freeBackupPath would treat every backup name as free, and rename\n    // silently replaces a backup that is already there.\n    const code = (err as NodeJS.ErrnoException | null)?.code;\n    if (code !== 'ENOENT') {\n      return { outcome: 'failed', path, reason: code ?? ((err as Error)?.message || 'unknown error') };\n    }\n    names = [];\n  }\n  const moved: Array<{ path: string; backup: string }> = [];\n  for (const name of CLAUDE_CREDENTIALS_FILES) {\n    const p = join(dir, name);\n    // Already done for this pair on an earlier pass whose report never landed,\n    // and nothing has been written there since. If a live file IS back (a\n    // sign-in landed between passes), it is moved again to a NEW backup rather\n    // than reported as moved and left in place (CodeRabbit on #7129).\n    const earlier = existingBackupForPair(p, opts.pairId, names);\n    if (earlier && !names.includes(name)) {\n      moved.push({ path: p, backup: earlier });\n      continue;\n    }\n    const backup = freeBackupPath(p, opts.pairId, now, names);\n    try {\n      // No existence check first: rename's own ENOENT is the answer, without a\n      // window between asking and acting.\n      fs.rename(p, backup);\n      moved.push({ path: p, backup });\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException | null)?.code;\n      if (code === 'ENOENT') continue;\n      const reason = code ?? ((err as Error)?.message || 'unknown error');\n      return { outcome: 'failed', path: p, reason, ...(moved.length ? { moved } : {}) };\n    }\n  }\n  if (moved.length === 0) return { outcome: 'absent', path };\n  const [first, ...others] = moved;\n  return { outcome: 'moved', path: first!.path, backup: first!.backup, ...(others.length ? { others } : {}) };\n}\n\n/**\n * Has a sign-in reset moved this directory's credentials aside, with no new\n * sign-in since? True when a reset backup is present and the live file is not.\n *\n * `syncClaudeCredsToRoot` (persistent-session.ts) copies a legacy\n * `/home/<user>/.claude` credential into `/root/.claude` whenever /root has\n * none. Without this check, the next agent spawn after a reset would copy the\n * stuck credential straight back and silently undo it (Obi Wan 922ca17564bc on\n * #7129). Once Re-login writes a fresh file the reset no longer applies, and\n * after SIGNIN_RESET_HOLD_MS an unfinished one stops applying too, so an old\n * backup cannot block that sync forever. Names only, never contents.\n */\nexport function signinResetInForce(names: readonly string[], now: Date = new Date()): boolean {\n  if (CLAUDE_CREDENTIALS_FILES.some((n) => names.includes(n))) return false;\n  // The newest reset backup, by the UTC stamp in its own name (names only).\n  let newest = -Infinity;\n  for (const n of names) {\n    const base = CLAUDE_CREDENTIALS_FILES.find((f) => n.startsWith(`${f}.bak-`));\n    if (!base) continue;\n    const m = /^(\\d{4})(\\d{2})(\\d{2})T(\\d{2})(\\d{2})(\\d{2})Z-/.exec(n.slice(`${base}.bak-`.length));\n    if (!m) continue;\n    const t = Date.UTC(+m[1]!, +m[2]! - 1, +m[3]!, +m[4]!, +m[5]!, +m[6]!);\n    if (t > newest) newest = t;\n  }\n  // A stale backup (older than the hold) no longer means a reset is pending.\n  return newest > -Infinity && now.getTime() - newest < SIGNIN_RESET_HOLD_MS;\n}\n\n/** The manager.log line. Paths and the outcome only, never file contents. */\nexport function describeSigninResetForLog(pairId: string, r: SigninResetResult): string {\n  const pair = pairId.slice(0, 8);\n  switch (r.outcome) {\n    case 'moved':\n      return (\n        `[claude-pair] sign-in reset pair=${pair} outcome=moved from=${r.path} to=${r.backup}` +\n        (r.others ?? []).map((o) => ` also from=${o.path} to=${o.backup}`).join('')\n      );\n    case 'absent':\n      return `[claude-pair] sign-in reset pair=${pair} outcome=absent path=${r.path} (nothing to move)`;\n    case 'failed':\n      return (\n        `[claude-pair] sign-in reset pair=${pair} outcome=failed path=${r.path} reason=${r.reason}` +\n        (r.moved ?? []).map((o) => ` already-moved from=${o.path} to=${o.backup}`).join('')\n      );\n    case 'unsupported':\n      return `[claude-pair] sign-in reset pair=${pair} outcome=unsupported platform=${r.platform} (sign-in is in the Keychain; nothing touched)`;\n  }\n}\n\n/** Operator copy for a reset that could not run, so the pairing was not started. */\nexport function describeSigninResetFailure(\n  r: Extract<SigninResetResult, { outcome: 'failed' | 'unsupported' }>,\n): string {\n  if (r.outcome === 'unsupported') {\n    return (\n      'This host is a Mac, and it keeps its Claude sign-in in the macOS Keychain, which the console cannot ' +\n      'clear. Nothing on the host was changed and the sign-in was not started. To clear it, run `claude /logout` ' +\n      'on the host (or remove \"Claude Code-credentials\" in Keychain Access), then use Re-login. ' +\n      'If you cannot reach the host, contact Ninjafy support.'\n    );\n  }\n  return (\n    `Could not reset the saved Claude sign-in on this host (${r.reason}), so the sign-in was not started: ` +\n    'a new one would only land on the same stuck screen. ' +\n    // Honest when a first file was already moved aside before the second failed.\n    (r.moved?.length\n      ? 'One saved sign-in file was moved aside (a backup was kept on the host); another could not be. '\n      : 'Nothing on the host was changed. ') +\n    'Try again; if it repeats, contact Ninjafy support.'\n  );\n}\n"],"mappings":";;;;;AA4CA,SAAS,aAAa,kBAAkB;AACxC,SAAS,UAAU,SAAS,YAAY;AAGjC,IAAM,0BAA0B;AAQhC,IAAM,2BAA2B,CAAC,yBAAyB,kBAAkB;AAQ7E,IAAM,uBAAuB,KAAK,KAAK,KAAK;AAkBnD,IAAM,SAAwB,EAAE,QAAQ,YAAY,MAAM,CAAC,QAAQ,YAAY,GAAG,EAAE;AAGpF,SAAS,WAAW,GAAiB;AACnC,SAAO,EAAE,YAAY,EAAE,QAAQ,SAAS,EAAE,EAAE,QAAQ,aAAa,GAAG;AACtE;AAEO,SAAS,sBAAsB,MAAc,QAAgB,KAAmB;AACrF,SAAO,GAAG,IAAI,QAAQ,WAAW,GAAG,CAAC,IAAI,OAAO,MAAM,GAAG,CAAC,CAAC;AAC7D;AAGA,SAAS,sBAAsB,MAAc,QAAgB,OAA8C;AACzG,QAAM,SAAS,GAAG,SAAS,IAAI,CAAC;AAChC,QAAM,SAAS,IAAI,OAAO,MAAM,GAAG,CAAC,CAAC;AACrC,QAAM,MAAM,MAAM,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,KAAK,EAAE,SAAS,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI;AACvF,SAAO,MAAM,KAAK,QAAQ,IAAI,GAAG,GAAG,IAAI;AAC1C;AAGA,SAAS,eAAe,MAAc,QAAgB,KAAW,OAAkC;AACjG,QAAM,OAAO,sBAAsB,MAAM,QAAQ,GAAG;AACpD,MAAI,CAAC,MAAM,SAAS,SAAS,IAAI,CAAC,EAAG,QAAO;AAC5C,QAAM,QAAQ,KAAK,MAAM,GAAG,IAAI,QAAQ,QAAQ,KAAK,SAAS,IAAI,OAAO,MAAM,GAAG,CAAC,CAAC,GAAG,MAAM;AAC7F,WAAS,IAAI,KAAK,KAAK;AACrB,UAAM,YAAY,GAAG,IAAI,QAAQ,KAAK,IAAI,CAAC,IAAI,OAAO,MAAM,GAAG,CAAC,CAAC;AACjE,QAAI,CAAC,MAAM,SAAS,SAAS,SAAS,CAAC,EAAG,QAAO;AAAA,EACnD;AACF;AAEO,SAAS,kBAAkB,MAMZ;AACpB,QAAM,MAAM,KAAK,aAAa,mBAAgB;AAC9C,QAAM,OAAO,KAAK,KAAK,uBAAuB;AAC9C,QAAM,WAAW,KAAK,YAAY,QAAQ;AAC1C,MAAI,aAAa,SAAU,QAAO,EAAE,SAAS,eAAe,MAAM,SAAS;AAC3E,QAAM,KAAK,KAAK,MAAM;AACtB,QAAM,MAAM,KAAK,OAAO,oBAAI,KAAK;AACjC,MAAI;AACJ,MAAI;AACF,YAAQ,GAAG,KAAK,GAAG;AAAA,EACrB,SAAS,KAAK;AAKZ,UAAM,OAAQ,KAAsC;AACpD,QAAI,SAAS,UAAU;AACrB,aAAO,EAAE,SAAS,UAAU,MAAM,QAAQ,SAAU,KAAe,WAAW,iBAAiB;AAAA,IACjG;AACA,YAAQ,CAAC;AAAA,EACX;AACA,QAAM,QAAiD,CAAC;AACxD,aAAW,QAAQ,0BAA0B;AAC3C,UAAM,IAAI,KAAK,KAAK,IAAI;AAKxB,UAAM,UAAU,sBAAsB,GAAG,KAAK,QAAQ,KAAK;AAC3D,QAAI,WAAW,CAAC,MAAM,SAAS,IAAI,GAAG;AACpC,YAAM,KAAK,EAAE,MAAM,GAAG,QAAQ,QAAQ,CAAC;AACvC;AAAA,IACF;AACA,UAAM,SAAS,eAAe,GAAG,KAAK,QAAQ,KAAK,KAAK;AACxD,QAAI;AAGF,SAAG,OAAO,GAAG,MAAM;AACnB,YAAM,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;AAAA,IAChC,SAAS,KAAK;AACZ,YAAM,OAAQ,KAAsC;AACpD,UAAI,SAAS,SAAU;AACvB,YAAM,SAAS,SAAU,KAAe,WAAW;AACnD,aAAO,EAAE,SAAS,UAAU,MAAM,GAAG,QAAQ,GAAI,MAAM,SAAS,EAAE,MAAM,IAAI,CAAC,EAAG;AAAA,IAClF;AAAA,EACF;AACA,MAAI,MAAM,WAAW,EAAG,QAAO,EAAE,SAAS,UAAU,KAAK;AACzD,QAAM,CAAC,OAAO,GAAG,MAAM,IAAI;AAC3B,SAAO,EAAE,SAAS,SAAS,MAAM,MAAO,MAAM,QAAQ,MAAO,QAAQ,GAAI,OAAO,SAAS,EAAE,OAAO,IAAI,CAAC,EAAG;AAC5G;AAcO,SAAS,mBAAmB,OAA0B,MAAY,oBAAI,KAAK,GAAY;AAC5F,MAAI,yBAAyB,KAAK,CAAC,MAAM,MAAM,SAAS,CAAC,CAAC,EAAG,QAAO;AAEpE,MAAI,SAAS;AACb,aAAW,KAAK,OAAO;AACrB,UAAM,OAAO,yBAAyB,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,CAAC,OAAO,CAAC;AAC3E,QAAI,CAAC,KAAM;AACX,UAAM,IAAI,iDAAiD,KAAK,EAAE,MAAM,GAAG,IAAI,QAAQ,MAAM,CAAC;AAC9F,QAAI,CAAC,EAAG;AACR,UAAM,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC,GAAI,CAAC,EAAE,CAAC,IAAK,GAAG,CAAC,EAAE,CAAC,GAAI,CAAC,EAAE,CAAC,GAAI,CAAC,EAAE,CAAC,GAAI,CAAC,EAAE,CAAC,CAAE;AACrE,QAAI,IAAI,OAAQ,UAAS;AAAA,EAC3B;AAEA,SAAO,SAAS,aAAa,IAAI,QAAQ,IAAI,SAAS;AACxD;AAGO,SAAS,0BAA0B,QAAgB,GAA8B;AACtF,QAAM,OAAO,OAAO,MAAM,GAAG,CAAC;AAC9B,UAAQ,EAAE,SAAS;AAAA,IACjB,KAAK;AACH,aACE,oCAAoC,IAAI,uBAAuB,EAAE,IAAI,OAAO,EAAE,MAAM,MACnF,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,MAAM,cAAc,EAAE,IAAI,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE;AAAA,IAE9E,KAAK;AACH,aAAO,oCAAoC,IAAI,wBAAwB,EAAE,IAAI;AAAA,IAC/E,KAAK;AACH,aACE,oCAAoC,IAAI,wBAAwB,EAAE,IAAI,WAAW,EAAE,MAAM,MACxF,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,MAAM,uBAAuB,EAAE,IAAI,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE;AAAA,IAEtF,KAAK;AACH,aAAO,oCAAoC,IAAI,iCAAiC,EAAE,QAAQ;AAAA,EAC9F;AACF;AAGO,SAAS,2BACd,GACQ;AACR,MAAI,EAAE,YAAY,eAAe;AAC/B,WACE;AAAA,EAKJ;AACA,SACE,0DAA0D,EAAE,MAAM;AAAA,GAGjE,EAAE,OAAO,SACN,mGACA,uCACJ;AAEJ;","names":[]}

package/dist/{chunk-N2ZAN2JP.js → chunk-QRFACFSH.js}

@@ -20,18 +20,12 @@ import {
   simpleTextHash,
   sweepDialogs
 } from "./chunk-B6UYVEMD.js";
+import {
+  signinResetInForce
+} from "./chunk-OAWK4OBN.js";
 import {
   reapOrphanChannelMcps
 } from "./chunk-XWVM4KPK.js";
-import {
-  CLAUDE_CONFIG_DIR_ENV,
-  archiveLegacyClaudeJson,
-  claudeConfigDirFor,
-  claudeConfigDirIsReady,
-  claudeJsonPathFor,
-  legacyClaudeJsonPathFor,
-  seedClaudeConfigFromLegacy
-} from "./chunk-EL5MWGGH.js";
 import {
   INTEGRATION_REGISTRY,
   OAUTH_PROVIDERS,
@@ -54,6 +48,15 @@ import {
   remoteMcpConnectionLabel,
   remoteMcpConnectionScopedEnvVar
 } from "./chunk-D55RMQTG.js";
+import {
+  CLAUDE_CONFIG_DIR_ENV,
+  archiveLegacyClaudeJson,
+  claudeConfigDirFor,
+  claudeConfigDirIsReady,
+  claudeJsonPathFor,
+  legacyClaudeJsonPathFor,
+  seedClaudeConfigFromLegacy
+} from "./chunk-EL5MWGGH.js";
 import {
   __require
 } from "./chunk-DGUM43GV.js";
@@ -3884,6 +3887,17 @@ function syncClaudeCredsToRoot() {
   for (const filename of [".credentials.json", "credentials.json"]) {
     if (existsSync6(join7("/root/.claude", filename))) return true;
   }
+  try {
+    if (signinResetInForce(readdirSync2("/root/.claude"))) {
+      console.warn(
+        "[persistent-session] Claude sign-in was reset from the console within the last 24h; not copying a /home credential back into /root/.claude. Use Re-login to sign in."
+      );
+      return false;
+    }
+  } catch (err) {
+    const code = err?.code;
+    if (code !== "ENOENT" && code !== "ENOTDIR") throw err;
+  }
   let sourcePath = null;
   try {
     const entries = readdirSync2("/home", { withFileTypes: true });
@@ -6116,4 +6130,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-N2ZAN2JP.js.map
+//# sourceMappingURL=chunk-QRFACFSH.js.map