@modelprofile.com/authswitch 10.0.0 → 10.0.1

package/ts/classes.claudecodelocks.ts

@@ -17,8 +17,18 @@ interface IClaudeCodeLock {
 interface IHeldLock {
   lockfilePath: string;
   release: () => Promise<void>;
+  /** After how long another process may take this lock over when its time is not renewed. */
+  stale: number;
+  /** The lock directory as it was created for this hold: a takeover removes it and creates another. */
+  identity: { device: number; inode: number; birthtimeMs: number };
 }
 
+/**
+ * How much of a lock's stale time must remain when a lease is asserted. Everything a caller does after an
+ * assertion is a synchronous file write, so no other process can find the lock stale before it completes.
+ */
+const HOLD_MARGIN_MS = 2_000;
+
 export interface IClaudeCodeLocksOptions {
   /** How long an operation waits for a lock that Claude Code holds. */
   timeoutMs?: number;
@@ -26,6 +36,12 @@ export interface IClaudeCodeLocksOptions {
 
 /** The vendor locks may be lost while an awaited database operation is in flight. */
 export interface IClaudeCodeLockLease {
+  /**
+   * Proves, at this moment, that every lock is still this hold's: its directory is the one this hold created,
+   * and its time was renewed recently enough that no other process may take it over before a synchronous write
+   * that follows completes. A lock whose renewal stalled -- an event loop blocked past its update interval --
+   * fails this even when nobody has taken it yet.
+   */
   assertHeld(): void;
 }
 
@@ -134,6 +150,16 @@ export class ClaudeCodeLocks {
     const lease: IClaudeCodeLockLease = {
       assertHeld: () => {
         if (!active || compromised) throw new ClaudeCodeLockOutcomeUnknownError(false);
+        for (const lock of held) {
+          let current: plugins.fs.Stats;
+          try { current = plugins.fs.lstatSync(lock.lockfilePath); }
+          catch { throw new ClaudeCodeLockOutcomeUnknownError(false); }
+          if (!current.isDirectory() || current.dev !== lock.identity.device || current.ino !== lock.identity.inode
+            || current.birthtimeMs !== lock.identity.birthtimeMs
+            || Date.now() - current.mtimeMs > lock.stale - HOLD_MARGIN_MS) {
+            throw new ClaudeCodeLockOutcomeUnknownError(false);
+          }
+        }
       },
     };
     const releaseAll = async (): Promise<void> => {
@@ -189,7 +215,11 @@ export class ClaudeCodeLocks {
         const release = await lockfileArg.lock(lock.file, {
           lockfilePath: lock.lockfilePath, realpath: false, stale: lock.stale, update: lock.update, onCompromised: onCompromisedArg,
         });
-        heldArg.push({ lockfilePath: lock.lockfilePath, release });
+        let created: plugins.fs.Stats;
+        try { created = plugins.fs.lstatSync(lock.lockfilePath); }
+        catch (error) { await release().catch(() => undefined); throw error; }
+        heldArg.push({ lockfilePath: lock.lockfilePath, release, stale: lock.stale,
+          identity: { device: created.dev, inode: created.ino, birthtimeMs: created.birthtimeMs } });
       } catch (error) {
         if (errorCode(error) === 'ELOCKED') return lock;
         if (requireAllArg || !lock.bestEffort) {

package/ts/classes.claudenative.ts

@@ -6,9 +6,25 @@ import { claudeRequest } from './claudehttp.js';
 import { writeSecretFileAtomically } from './helpers.js';
 import { HarnessProcesses } from './classes.harnessprocesses.js';
 
-/** The private file and lock contract verified for this Claude Code release. */
-export const CLAUDE_NATIVE_HANDOFF_VERSION = '2.1.273';
+/**
+ * The earliest Claude Code whose native file contract this adapter writes: `.credentials.json` beside
+ * `.claude.json`, and the lock protocol and live credential pickup verified for 2.1.273 (hints.md).
+ */
+export const CLAUDE_NATIVE_MINIMUM_VERSION = '2.1.273';
+/**
+ * The releases whose lock table, live credential pickup and refresh compare-and-swap were read from their own
+ * bundle (hints.md). A Claude Code session may keep running in the home a handoff writes only when it runs one
+ * of these; an installed release above the floor that is not listed is proven by `claude auth status` instead,
+ * and only while no session runs in that home.
+ */
+export const CLAUDE_NATIVE_VERIFIED_RELEASES: readonly string[] = ['2.1.273', '2.1.282'];
+/**
+ * Token files Claude Code reads at fixed paths when no descriptor variable names one (2.1.282 `KI`, `YGn`):
+ * the remote container's hand-off of an OAuth token or an API key. Either one outranks the native login.
+ */
+const REMOTE_CREDENTIAL_FILES = ['/home/claude/.claude/remote/.oauth_token', '/home/claude/.claude/remote/.api_key'] as const;
 const MAX_NATIVE_FILE_BYTES = 4 * 1024 * 1024;
+const AUTH_STATUS_TIMEOUT_MS = 4_000;
 const MAX_PROCESS_CONTEXT_BYTES = 1024 * 1024;
 const PROFILE_TIMEOUT_MS = 10_000;
 const ACCOUNT_CACHES = [
@@ -19,7 +35,8 @@ const ACCOUNT_CACHES = [
 const CREDENTIAL_OVERRIDES = [
   'CLAUDE_CODE_OAUTH_TOKEN', 'CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR', 'ANTHROPIC_API_KEY',
   'ANTHROPIC_AUTH_TOKEN', 'ANTHROPIC_PROFILE', 'CLAUDE_CODE_USE_BEDROCK',
-  'CLAUDE_CODE_USE_VERTEX', 'CLAUDE_CODE_USE_FOUNDRY', 'ANTHROPIC_BASE_URL',
+  'CLAUDE_CODE_USE_VERTEX', 'CLAUDE_CODE_USE_FOUNDRY', 'CLAUDE_CODE_USE_ANTHROPIC_AWS',
+  'CLAUDE_CODE_USE_ANTHROPIC_GOOGLE_CLOUD', 'CLAUDE_CODE_USE_MANTLE', 'ANTHROPIC_BASE_URL',
   'ANTHROPIC_FEDERATION_RULE_ID', 'ANTHROPIC_ORGANIZATION_ID',
   'ANTHROPIC_IDENTITY_TOKEN_FILE', 'ANTHROPIC_IDENTITY_TOKEN', 'ANTHROPIC_WORKSPACE_ID',
   'ANTHROPIC_UNIX_SOCKET', 'CLAUDE_CODE_REMOTE', 'CLAUDE_CODE_SIMPLE',
@@ -37,8 +54,9 @@ export class ClaudeNativeEffectiveAuthUnsupportedError extends Error {
 
   constructor(public readonly reason: TAuthSwitchClaudeProofFailure) {
     super(reason === 'unsupported_release'
-      ? `Native Claude handoff requires Claude Code ${CLAUDE_NATIVE_HANDOFF_VERSION} for every active session.`
-      : `Cannot prove that Claude Code ${CLAUDE_NATIVE_HANDOFF_VERSION} uses its native claude.ai login (${reason}).`);
+      ? `Native Claude handoff requires Claude Code ${CLAUDE_NATIVE_MINIMUM_VERSION} or newer, and a session `
+        + `running in this home must run a verified release (${CLAUDE_NATIVE_VERIFIED_RELEASES.join(', ')}).`
+      : `Cannot prove that Claude Code uses its native claude.ai login (${reason}).`);
   }
 }
 
@@ -95,6 +113,20 @@ export type TClaudeNativePrepareResult =
 
 export interface IClaudeNativeLockedSession {
   readStable(): IClaudeNativeSnapshot;
+  /**
+   * Proves that Claude Code itself selects the native login of `expected` in this home. A verified release is
+   * proven by the adapter's own reading of its selector; any other release above the floor is asked through
+   * `claude auth status --json`, which names the organization and the account's email, the only account
+   * identifiers it reports. Throws `ClaudeNativeEffectiveAuthUnsupportedError` when it cannot be proven, and
+   * `ClaudeCodeLockOutcomeUnknownError` when the locks were lost while it asked.
+   */
+  proveEffectiveLogin(expected: IClaudeNativeLogin): Promise<void>;
+  /**
+   * Writes back the exact bytes a written plan replaced, while the locks that guarded the write are still held.
+   * True once both files read back as they were; false, writing nothing, when the pair is no longer exactly
+   * what the plan wrote.
+   */
+  restorePreparedSource(plan: IClaudeNativePreparedWrite): boolean;
   verifyProfileIdentity(snapshot: IClaudeNativeSnapshot,
     expected: IClaudeNativeIdentity): Promise<IClaudeNativeProfileProof>;
   prepareWrite(input: {
@@ -115,6 +147,12 @@ export interface IClaudeNativeLockedSession {
 export interface IClaudeNativeVersionProbe {
   installedVersion(): string;
   runningContexts(): readonly IClaudeNativeRunningContext[];
+  /**
+   * What `claude auth status --json` prints under `env`, whatever its exit code, or null when it does not
+   * answer. Asynchronous on purpose: it runs while the vendor locks are held, and their renewal timers must keep
+   * running.
+   */
+  authStatus(env: NodeJS.ProcessEnv): Promise<string | null>;
 }
 
 /** Only selector keys and paths, never a process's credential values, leave the /proc reader. */
@@ -171,8 +209,30 @@ const onlyDigests = (value: IClaudeNativeDigests): IClaudeNativeDigests => ({
 });
 const preparedWrites = new WeakMap<IClaudeNativePreparedWrite, {
   session: ClaudeNativeLockedSession; credentialRaw: string; configRaw: string;
-  originalConfigRaw: Buffer | null; targetAccessToken: string;
+  originalCredentialRaw: Buffer | null; originalConfigRaw: Buffer | null; targetAccessToken: string;
 }>();
+/** A written plan's original bytes, kept until the handoff proves the write or restores them. */
+const writtenPlans = new WeakMap<IClaudeNativePreparedWrite, {
+  session: ClaudeNativeLockedSession; credentialRaw: string; configRaw: string;
+  originalCredentialRaw: Buffer; originalConfigRaw: Buffer;
+}>();
+
+const parseClaudeVersion = (value: string): [number, number, number] | null => {
+  const match = /^(\d{1,6})\.(\d{1,6})\.(\d{1,6})$/.exec(value);
+  return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
+};
+const atLeast = (version: [number, number, number], minimum: [number, number, number]): boolean => {
+  for (let index = 0; index < 3; index++) {
+    if (version[index] !== minimum[index]) return version[index] > minimum[index];
+  }
+  return true;
+};
+
+/** Which proof applies to one operation: the adapter's own selector reading, or Claude Code's own answer. */
+interface IClaudeNativeSupport {
+  runningSessions: number;
+  proof: 'verified_release' | 'auth_status';
+}
 const sameIdentity = (left: IClaudeNativeIdentity, right: IClaudeNativeIdentity): boolean =>
   left.accountUuid === right.accountUuid && left.organizationUuid === right.organizationUuid;
 
@@ -303,6 +363,15 @@ const assertNoKnownNativeLoginOverride = (env: NodeJS.ProcessEnv, processRoot?:
   for (const key of CREDENTIAL_OVERRIDES) {
     if (env[key]) throw new ClaudeNativeEffectiveAuthUnsupportedError('override');
   }
+  for (const file of REMOTE_CREDENTIAL_FILES) {
+    try {
+      plugins.fs.lstatSync(processViewPath(file, processRoot));
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') continue;
+      throw new ClaudeNativeEffectiveAuthUnsupportedError('override');
+    }
+    throw new ClaudeNativeEffectiveAuthUnsupportedError('override');
+  }
   const configDir = env.ANTHROPIC_CONFIG_DIR?.trim()
     || (env.XDG_CONFIG_HOME?.trim()
       ? plugins.path.join(env.XDG_CONFIG_HOME.trim(), 'anthropic')
@@ -504,6 +573,20 @@ class ClaudeNativeVersionProbe implements IClaudeNativeVersionProbe {
     } catch { return 'unknown'; }
   }
 
+  public authStatus(env: NodeJS.ProcessEnv): Promise<string | null> {
+    // Well inside the shortest lock renewal window (the config lock renews every 5 s); it answers in ~200 ms.
+    return new Promise(resolve => {
+      const child = plugins.childProcess.execFile(this.executable, ['auth', 'status', '--json'], {
+        encoding: 'utf8', timeout: AUTH_STATUS_TIMEOUT_MS, maxBuffer: 64 * 1024, windowsHide: true, env,
+      }, (error, stdout) => {
+        // A logged-out status still prints its JSON and exits 1; only no answer at all is null.
+        const exited = error === null || typeof error.code === 'number';
+        resolve(exited && stdout ? stdout : null);
+      });
+      child.stdin?.end();
+    });
+  }
+
   public runningContexts(): readonly IClaudeNativeRunningContext[] {
     const contexts: IClaudeNativeRunningContext[] = [];
     // Keep candidates from every mount namespace: a bind mount can expose the same inode.
@@ -597,7 +680,7 @@ export class ClaudeNativeAdapter {
     this.platform = options.platform ?? process.platform;
   }
 
-  private assertSupported(): number {
+  private assertSupported(): IClaudeNativeSupport {
     if (this.platform !== 'linux') throw new Error('Native Claude handoff requires the verified Linux file backend.');
     const home = plugins.fs.lstatSync(this.options.configDir);
     if (!home.isDirectory() || home.isSymbolicLink() || home.uid !== process.getuid?.()
@@ -621,9 +704,12 @@ export class ClaudeNativeAdapter {
     for (const file of this.settingsFiles) {
       assertSettingsSelectNative(file);
     }
-    if (this.versionProbe.installedVersion() !== CLAUDE_NATIVE_HANDOFF_VERSION) {
+    const installedText = this.versionProbe.installedVersion();
+    const installed = parseClaudeVersion(installedText);
+    if (!installed || !atLeast(installed, parseClaudeVersion(CLAUDE_NATIVE_MINIMUM_VERSION)!)) {
       throw new ClaudeNativeEffectiveAuthUnsupportedError('unsupported_release');
     }
+    const installedVerified = CLAUDE_NATIVE_VERIFIED_RELEASES.includes(installedText);
     let runningSessions = 0;
     const nativeHomeIdentity = directoryIdentity(this.options.configDir);
     const configParentIdentity = directoryIdentity(configParent);
@@ -636,7 +722,9 @@ export class ClaudeNativeAdapter {
         || !sameDirectory(running.configParentIdentity, configParentIdentity)) {
         throw new ClaudeNativeEffectiveAuthUnsupportedError('running_session');
       }
-      if (running.version !== CLAUDE_NATIVE_HANDOFF_VERSION) {
+      // A session keeps taking its own locks and picking up the swapped login while the handoff runs, so
+      // it must be a release whose lock and pickup contract was read from its bundle.
+      if (running.version === null || !CLAUDE_NATIVE_VERIFIED_RELEASES.includes(running.version)) {
         throw new ClaudeNativeEffectiveAuthUnsupportedError('unsupported_release');
       }
       if (!running.env || !running.cwd || running.hasSettingsOverride === null
@@ -650,7 +738,34 @@ export class ClaudeNativeAdapter {
       assertProjectSettingsSelectNative(running.cwd, running.processRoot);
       runningSessions++;
     }
-    return runningSessions;
+    // An installed release nobody verified is proven by its own answer, which says nothing about how a session
+    // already running would take the locks or pick up the swap; it is written only while none runs here.
+    if (!installedVerified && runningSessions > 0) {
+      throw new ClaudeNativeEffectiveAuthUnsupportedError('unsupported_release');
+    }
+    return { runningSessions, proof: installedVerified ? 'verified_release' : 'auth_status' };
+  }
+
+  /**
+   * Claude Code's own account of the login it selects in this home: `claude auth status --json` under the
+   * adapter's environment. It must be the claude.ai login of `expected`, read from this home, with no API key.
+   */
+  private async proveEffectiveLogin(expected: IClaudeNativeLogin): Promise<void> {
+    if (this.assertSupported().proof === 'verified_release') return;
+    const organizationUuid = expected.oauthAccount.organizationUuid;
+    const email = typeof expected.oauthAccount.emailAddress === 'string' ? expected.oauthAccount.emailAddress : null;
+    const raw = await this.versionProbe.authStatus(this.env);
+    let status: unknown;
+    try { status = raw === null ? null : JSON.parse(raw); } catch { status = null; }
+    if (!isRecord(status) || typeof status.loggedIn !== 'boolean' || typeof status.authMethod !== 'string') {
+      throw new ClaudeNativeEffectiveAuthUnsupportedError('unsupported_release');
+    }
+    if (status.loggedIn !== true || status.authMethod !== 'claude.ai' || status.apiProvider !== 'firstParty'
+      || (status.apiKeySource !== undefined && status.apiKeySource !== null)
+      || status.configDirectory !== this.options.configDir || status.orgId !== organizationUuid
+      || (status.email ?? null) !== email) {
+      throw new ClaudeNativeEffectiveAuthUnsupportedError('override');
+    }
   }
 
   /** The caller keeps its NoSQLDB journal and both ownership transactions inside this callback. */
@@ -659,12 +774,13 @@ export class ClaudeNativeAdapter {
     return this.locks.holdAsync(async lease => {
       this.assertSupported();
       const session = new ClaudeNativeLockedSession(this.credentialFile, this.options.configFile,
-        this.fetcher, lease, () => this.assertSupported());
+        this.fetcher, lease, () => this.assertSupported().runningSessions,
+        expected => this.proveEffectiveLogin(expected));
       const firstSnapshot = session.readStable();
       const result = await action(session);
       try {
         lease.assertHeld();
-        const afterRunningSessions = this.assertSupported();
+        const afterRunningSessions = this.assertSupported().runningSessions;
         if (firstSnapshot.runningEffectiveAuth === 'no_scoped_sessions' && afterRunningSessions > 0) {
           throw new ClaudeNativeEffectiveAuthUnsupportedError('running_session');
         }
@@ -680,7 +796,34 @@ export class ClaudeNativeAdapter {
 class ClaudeNativeLockedSession implements IClaudeNativeLockedSession {
   constructor(private readonly credentialFile: string, private readonly configFile: string,
     private readonly fetcher: typeof fetch, private readonly lease: IClaudeCodeLockLease,
-    private readonly assertSupported: () => number) {}
+    private readonly assertSupported: () => number,
+    private readonly proveEffective: (expected: IClaudeNativeLogin) => Promise<void>) {}
+
+  public async proveEffectiveLogin(expected: IClaudeNativeLogin): Promise<void> {
+    this.lease.assertHeld();
+    await this.proveEffective(expected);
+    // Asserted after the answer, before anything is decided or written on it.
+    this.lease.assertHeld();
+  }
+
+  public restorePreparedSource(plan: IClaudeNativePreparedWrite): boolean {
+    this.lease.assertHeld();
+    const written = writtenPlans.get(plan);
+    if (!written || written.session !== this) throw new Error('Claude native write plan is not held by this lease.');
+    writtenPlans.delete(plan);
+    let current: ReturnType<typeof readPair>;
+    try { current = readPair(this.credentialFile, this.configFile); } catch { return false; }
+    if (!sameRaw(current.credentialRaw, Buffer.from(written.credentialRaw))
+      || !sameRaw(current.configRaw, Buffer.from(written.configRaw))) return false;
+    this.lease.assertHeld();
+    writeSecretFileAtomically(this.credentialFile, written.originalCredentialRaw.toString('utf8'));
+    writeSecretFileAtomically(this.configFile, written.originalConfigRaw.toString('utf8'));
+    this.lease.assertHeld();
+    const restored = readPair(this.credentialFile, this.configFile);
+    return sameRaw(restored.credentialRaw, written.originalCredentialRaw)
+      && sameRaw(restored.configRaw, written.originalConfigRaw)
+      && sameDigests(digests(restored), plan.before);
+  }
 
   private observation(): IClaudeNativeDigests | null {
     try { return digests(readPair(this.credentialFile, this.configFile)); }
@@ -811,7 +954,7 @@ class ClaudeNativeLockedSession implements IClaudeNativeLockedSession {
       targetIdentity: Object.freeze({ ...input.expectedIdentity }),
       profile: Object.freeze({ ...profile }),
     });
-    preparedWrites.set(plan, { session: this, credentialRaw, configRaw,
+    preparedWrites.set(plan, { session: this, credentialRaw, configRaw, originalCredentialRaw: original.credentialRaw,
       originalConfigRaw: original.configRaw, targetAccessToken: String(target.login.claudeAiOauth.accessToken) });
     return { kind: 'prepared', plan };
   }
@@ -864,6 +1007,10 @@ class ClaudeNativeLockedSession implements IClaudeNativeLockedSession {
         || plan.profile.accessTokenDigest !== hash(String(snapshot.login.claudeAiOauth.accessToken))) {
         return { kind: 'uncertain', reason: 'native_write_or_readback_failed', observed: onlyDigests(snapshot) };
       }
+      if (prepared.originalCredentialRaw !== null && prepared.originalConfigRaw !== null) {
+        writtenPlans.set(plan, { session: this, credentialRaw: prepared.credentialRaw, configRaw: prepared.configRaw,
+          originalCredentialRaw: prepared.originalCredentialRaw, originalConfigRaw: prepared.originalConfigRaw });
+      }
       return { kind: 'written', snapshot, profile: plan.profile };
     } catch {
       return { kind: 'uncertain', reason: 'native_write_or_readback_failed', observed: this.observation() };