@melaya/runner 1.0.73 → 1.0.74

package/dist/detect.js

@@ -4,32 +4,48 @@
  */
 import { execFile } from "child_process";
 import { promisify } from "util";
+import { readFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
 const execFileAsync = promisify(execFile);
-/** Claude Code is a subscription CLI — when it's installed AND logged in on
- *  this machine, report its model aliases so the platform's model picker can
- *  show the TRUE availability for local runs (the cloud host's CLI status is
- *  the wrong signal: claude_code pipelines execute HERE, on the runner). */
+/** Claude Code is a subscription CLI — when it's logged in on this machine,
+ *  report its model aliases so the platform's model picker shows TRUE
+ *  availability for local runs (claude_code pipelines execute HERE).
+ *
+ *  We read the CLI's OAuth credentials FILE directly rather than spawning
+ *  `claude auth status`. That subprocess flashed a console window on Windows
+ *  every time the runner started (`windowsHide` is unreliable through the
+ *  `.cmd` shell wrapper, which spawns its own conhost). The file is the source
+ *  of truth on Windows/Linux; macOS keeps the grant in the Keychain, where
+ *  `security` is a subprocess but pops NO window. Zero windows, faster, and
+ *  it mirrors exactly what the runtime (model.py `_read_claude_oauth`) reads. */
 async function detectClaudeCode() {
-    // npm global installs on Windows expose claude.cmd — execFile with a bare
-    // name won't resolve .cmd without a shell, so try the .cmd wrapper first.
-    const candidates = process.platform === "win32" ? ["claude.cmd", "claude"] : ["claude"];
-    for (const exe of candidates) {
+    let raw = null;
+    try {
+        raw = await readFile(join(homedir(), ".claude", ".credentials.json"), "utf8");
+    }
+    catch {
+        raw = null;
+    }
+    if (!raw && process.platform === "darwin") {
         try {
-            const { stdout } = await execFileAsync(exe, ["auth", "status"], {
-                timeout: 10_000,
-                windowsHide: true,
-                // .cmd files need a shell on win32; harmless elsewhere.
-                shell: process.platform === "win32",
-            });
-            const status = JSON.parse(stdout);
-            if (status.loggedIn) {
-                return ["sonnet", "opus", "haiku"].map((name) => ({ provider: "claude_code", name }));
-            }
-            return []; // installed but logged out — don't advertise models
+            const { stdout } = await execFileAsync("security", ["find-generic-password", "-s", "Claude Code-credentials", "-w"], { timeout: 8000 });
+            if (stdout && stdout.trim())
+                raw = stdout.trim();
+        }
+        catch { /* not in keychain */ }
+    }
+    if (!raw)
+        return [];
+    try {
+        const oauth = (JSON.parse(raw)?.claudeAiOauth ?? {});
+        const expiresAt = Number(oauth.expiresAt ?? 0);
+        if (oauth.accessToken && (!expiresAt || Date.now() < expiresAt)) {
+            return ["sonnet", "opus", "haiku"].map((name) => ({ provider: "claude_code", name }));
         }
-        catch { /* not installed / not on PATH / non-JSON — try next candidate */ }
     }
-    return [];
+    catch { /* malformed creds → treat as logged out */ }
+    return []; // not logged in / expired → don't advertise models
 }
 export async function detectModels() {
     const models = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.0.73",
+  "version": "1.0.74",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "UNLICENSED",
   "private": false,