@modelprofile.com/authswitch 8.1.0 → 9.0.0

package/ts/ts_migration/0003_claude_handoff_proof.ts

@@ -0,0 +1,19 @@
+import * as plugins from '../plugins.js';
+
+/**
+ * Gives every Claude native handoff journalled before 8.2.0 its `proofFailure` field.
+ *
+ * The handoff record is exact-persistence: a document with a key the shape does not declare, or without one
+ * it does, is refused rather than read loosely. A published release therefore cannot gain a field by
+ * declaring it -- the rows that already exist have to carry it too, and this is where that happens.
+ *
+ * Only the absence is filled, with `null`: no release before this one could say which condition of the
+ * native-login proof failed, so there is nothing to infer and nothing to overwrite. A row that already has
+ * the field is left exactly as it is, which is what makes an interrupted run safe to repeat.
+ */
+export const addClaudeHandoffProofFailure = async (db: plugins.nosqldb.SmartdataDb): Promise<void> => {
+  const handoffs = db.mongoDb.collection('authswitch_authority_claude_handoffs');
+  const missing = { proofFailure: { $exists: false } };
+  if (!await handoffs.findOne(missing)) return;
+  await handoffs.updateMany(missing, { $set: { proofFailure: null } });
+};

package/ts/ts_migration/index.ts

@@ -1,6 +1,7 @@
 import * as plugins from '../plugins.js';
 import { migrateAuthorityMeta } from './0001_authority_meta.js';
 import { removeAuthorityBackupRecords } from './0002_remove_backup_records.js';
+import { addClaudeHandoffProofFailure } from './0003_claude_handoff_proof.js';
 
 /**
  * Runs on every start of an existing store, in this fixed order. Each module recognises the published shapes it
@@ -9,4 +10,5 @@ import { removeAuthorityBackupRecords } from './0002_remove_backup_records.js';
 export const runAuthorityMigrations = async (db: plugins.nosqldb.SmartdataDb): Promise<void> => {
   await migrateAuthorityMeta(db);
   await removeAuthorityBackupRecords(db);
+  await addClaudeHandoffProofFailure(db);
 };

package/ts/ts_migration/legacysources/authswitchstores.ts

@@ -175,7 +175,10 @@ export const readAuthSwitchStores = (locations: ILegacySourceLocations): ILegacy
   try { entries = plugins.fs.readdirSync(locations.authSwitchHome, { withFileTypes: true }); }
   catch (error) {
     if ((error as NodeJS.ErrnoException).code === 'ENOENT') return { sources, problems };
-    return { sources, problems: [`${locations.authSwitchHome} could not be listed`] };
+    // The store is named by what it is, never by where it is: this report goes to a CLI and to a backend,
+    // and the location of a credential store is not something either of them may be told. Everything
+    // below names an entry inside the store instead, which is what the owner needs to find it.
+    return { sources, problems: ['the authswitch store could not be listed'] };
   }
   for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
     const path = plugins.path.join(locations.authSwitchHome, entry.name);

package/ts/ts_migration/legacysources/nativestores.ts

@@ -1,5 +1,6 @@
 import * as plugins from '../../plugins.js';
 import { CodexHome } from '../../classes.codexhome.js';
+import { claudeNativeHomeId } from '../../classes.claudenative.js';
 import { accessProofAvailable, accessTokenExpiry, claudeSourceIdentity, EXPIRED_ACCESS_PROBLEM, legacyHash,
   legacySourceDigest, legacySourceId, openAiSourceIdentity, openCodeOpenAiIdentity, parseLegacyJson,
   readLegacyFile, type ILegacySourceFile, type ILegacySourceLocations, type ILegacySourceRecord,
@@ -48,9 +49,9 @@ const countCodexEnrollments = (codexHome: CodexHome): { count: number | null; pr
   } finally { database?.close(); }
 };
 
-const nativeRecord = (sourceKind: TAuthSwitchImportSourceKind, path: string,
+/** `sourcePathHash` is passed in, because a Claude home's id belongs to the module that owns that home. */
+const nativeRecord = (sourceKind: TAuthSwitchImportSourceKind, path: string, sourcePathHash: string,
   files: readonly ILegacySourceFile[], problems: string[]): ILegacySourceRecord => {
-  const sourcePathHash = legacyHash(path);
   return {
     id: legacySourceId(sourceKind, sourcePathHash),
     sourceKind,
@@ -86,7 +87,7 @@ const readCodexNative = (locations: ILegacySourceLocations, now: number): ILegac
   if (read.problem === null && read.file === null) return null;
   const files = read.file ? [read.file] : [];
   const problems = read.problem ? [read.problem] : [];
-  const record = nativeRecord('codex_native', path, files, problems);
+  const record = nativeRecord('codex_native', path, legacyHash(path), files, problems);
   const enrollments = countCodexEnrollments(new CodexHome(locations.codexHome));
   record.enrollmentCount = enrollments.count;
   if (enrollments.problem) problems.push(enrollments.problem);
@@ -114,12 +115,19 @@ const readCodexNative = (locations: ILegacySourceLocations, now: number): ILegac
 };
 
 const readClaudeNative = (locations: ILegacySourceLocations, now: number): ILegacySourceRecord | null => {
-  const credentials = readLegacyFile(locations.claudeCredentialFile, '.credentials.json');
-  const config = readLegacyFile(locations.claudeConfigFile, '.claude.json');
+  if (locations.claudeHome.kind === 'unusable') {
+    // Reported, never skipped and never read from a guessed location: the owner sees the defect and fixes it.
+    const { declaredCredentialFile, problem } = locations.claudeHome.defect;
+    return nativeRecord('claude_native', declaredCredentialFile,
+      claudeNativeHomeId(declaredCredentialFile), [], [problem]);
+  }
+  const { credentialFile, configFile, homeId } = locations.claudeHome.home;
+  const credentials = readLegacyFile(credentialFile, '.credentials.json');
+  const config = readLegacyFile(configFile, '.claude.json');
   if (credentials.problem === null && credentials.file === null) return null;
   const files = [credentials.file, config.file].filter((file): file is ILegacySourceFile => file !== null);
   const problems = [credentials.problem, config.problem].filter((problem): problem is string => problem !== null);
-  const record = nativeRecord('claude_native', locations.claudeCredentialFile, files, problems);
+  const record = nativeRecord('claude_native', credentialFile, homeId, files, problems);
   if (!credentials.file) return record;
   const credentialData = parseLegacyJson(credentials.file.raw);
   const configData = config.file === null ? null : parseLegacyJson(config.file.raw);
@@ -157,7 +165,7 @@ const readOpenCodeNative = (locations: ILegacySourceLocations, now: number): ILe
     if (!value || typeof value !== 'object' || Array.isArray(value)) continue;
     const entry = value as Record<string, unknown>;
     const path = `${locations.openCodeAuthFile}#${provider}`;
-    const record = nativeRecord('opencode_native', path,
+    const record = nativeRecord('opencode_native', path, legacyHash(path),
       [{ name: provider, raw: JSON.stringify(entry) }], []);
     record.label = provider;
     if (entry.type !== 'oauth') {

package/ts/ts_migration/legacysources/shared.ts

@@ -1,5 +1,6 @@
 import * as plugins from '../../plugins.js';
 import { readCredentialRaw } from '../../classes.credentialstore.js';
+import { resolveClaudeNativeHome, type TClaudeNativeHomeResolution } from '../../classes.claudenative.js';
 import type { TAuthSwitchImportProof, TAuthSwitchImportSourceKind,
   TAuthSwitchImportTreatment } from '../../authority-import-contract.js';
 
@@ -50,21 +51,18 @@ export interface ILegacySourceReport {
 export interface ILegacySourceLocations {
   authSwitchHome: string;
   codexHome: string;
-  claudeCredentialFile: string;
-  claudeConfigFile: string;
+  /** Claude's own paths come from the module that owns them, so the daemon and this reader cannot drift. */
+  claudeHome: TClaudeNativeHomeResolution;
   openCodeAuthFile: string;
 }
 
 export const resolveLegacySourceLocations = (env: NodeJS.ProcessEnv,
   homeDirectory: string): ILegacySourceLocations => {
-  const claudeConfigDirectory = env.CLAUDE_CONFIG_DIR || plugins.path.join(homeDirectory, '.claude');
   const dataHome = env.XDG_DATA_HOME || plugins.path.join(homeDirectory, '.local', 'share');
   return {
     authSwitchHome: env.AUTHSWITCH_HOME || plugins.path.join(homeDirectory, '.authswitch'),
     codexHome: env.CODEX_HOME || plugins.path.join(homeDirectory, '.codex'),
-    claudeCredentialFile: plugins.path.join(claudeConfigDirectory, '.credentials.json'),
-    // Claude Code keeps its account metadata beside the home directory, not inside a custom config directory.
-    claudeConfigFile: plugins.path.join(env.CLAUDE_CONFIG_DIR || homeDirectory, '.claude.json'),
+    claudeHome: resolveClaudeNativeHome(env, homeDirectory),
     openCodeAuthFile: plugins.path.join(dataHome, 'opencode', 'auth.json'),
   };
 };