@optimuslabs/harness-map-staging 1.5.25 → 1.5.27

package/dist/log_config_files/collection/claude_desktop_orgs_collector.js

@@ -0,0 +1,175 @@
+import { closeSync, existsSync, fstatSync, openSync, readdirSync, readFileSync, readSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { readClaudeLoginPlan } from './claude_login_plan.js';
+/**
+ * Every org Claude Desktop's signed-in account has used, so both tenants are recorded when one
+ * login belongs to a team org and a personal org and switches between them in Desktop.
+ *
+ * Desktop's "two accounts" in that case are one account (one account UUID, one email) in two
+ * orgs, and ~/.claude.json's `oauthAccount` only ever names the active org. Desktop keeps a session
+ * directory per org it has used, under the account:
+ *   ~/Library/Application Support/Claude/claude-code-sessions/<accountUuid>/<orgUuid>/
+ *   ~/Library/Application Support/Claude/local-agent-mode-sessions/<accountUuid>/<orgUuid>/
+ *
+ * The folders are only read when one account has ever used Desktop on this Mac. Switching between
+ * separate Desktop logins leaves folders (and token-log entries) pairing each account with the
+ * other's orgs, so with more than one account they cannot say which org is whose. Then only the org
+ * Desktop is signed into now is reported: the newest `[oauth-v2] … orgId=` line of Desktop's own
+ * main.log, which is the login in use and cannot belong to another account.
+ *
+ * Reads `lastKnownAccountUuid` from config.json and nothing else from it -- the same file holds
+ * Desktop's encrypted token caches, which are never touched or uploaded. The email, and the active
+ * org's name and plan, come from ~/.claude.json only when it is the same account (and, for the name
+ * and plan, the same org): Desktop's own files name neither. The plan prefers Claude Code's stored
+ * login over that cached profile (see claude_login_plan.ts). macOS only.
+ */
+const FILE_TYPE = 'claude_desktop_orgs';
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const SESSION_ROOTS = ['claude-code-sessions', 'local-agent-mode-sessions'];
+/** Only the end of Desktop's main.log is read: the newest sign-in is all that matters. */
+const DESKTOP_LOG_TAIL_BYTES = 256 * 1024;
+const DESKTOP_ORG_LINE = /\[oauth-v2\].*?orgId=([0-9a-f-]{36})/i;
+const DESKTOP_ACCOUNT = /cacheKey=acct:([0-9a-f-]{36})/i;
+function readTail(path, bytes) {
+    let fd;
+    try {
+        fd = openSync(path, 'r');
+        const size = fstatSync(fd).size;
+        const length = Math.min(size, bytes);
+        const buffer = Buffer.alloc(length);
+        readSync(fd, buffer, 0, length, size - length);
+        return buffer.toString('utf8');
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+/**
+ * The org (and, when logged, account) Claude Desktop is signed into now, or null when unknown.
+ *
+ * Desktop keeps its own login, apart from Claude Code's ~/.claude.json, and logs every token lookup
+ * as `[oauth-v2] … orgId=<org>` (with `cacheKey=acct:<account>|…` on lookups): the newest such line
+ * is the org Desktop is using.
+ */
+export function readDesktopActiveLogin(home = homedir()) {
+    const logPath = join(home, 'Library', 'Logs', 'Claude', 'main.log');
+    let tail = '';
+    try {
+        if (existsSync(logPath))
+            tail = readTail(logPath, DESKTOP_LOG_TAIL_BYTES);
+    }
+    catch {
+        return null;
+    }
+    const lines = tail.split('\n').filter((line) => DESKTOP_ORG_LINE.test(line));
+    const newest = lines.length ? lines[lines.length - 1] : '';
+    const org = newest.match(DESKTOP_ORG_LINE)?.[1]?.toLowerCase() ?? '';
+    if (!org)
+        return null;
+    return { org, account: newest.match(DESKTOP_ACCOUNT)?.[1]?.toLowerCase() ?? '' };
+}
+function claudeSupportDir(home) {
+    return join(home, 'Library', 'Application Support', 'Claude');
+}
+function readJson(path) {
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        return parsed && typeof parsed === 'object' ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function text(value) {
+    return typeof value === 'string' ? value.trim() : '';
+}
+/** The lowercased UUID-named directories in `dir`, or [] when it does not exist. */
+function uuidDirs(dir) {
+    try {
+        return readdirSync(dir, { withFileTypes: true })
+            .filter((entry) => entry.isDirectory() && UUID.test(entry.name))
+            .map((entry) => entry.name.toLowerCase());
+    }
+    catch {
+        return [];
+    }
+}
+/** Every account with a session directory, in any session root. */
+function accountsWithSessions(supportDir) {
+    return new Set(SESSION_ROOTS.flatMap((root) => uuidDirs(join(supportDir, root))));
+}
+/** The org UUIDs with a session directory under this account, in any session root. */
+function orgsForAccount(supportDir, account) {
+    return [...new Set(SESSION_ROOTS.flatMap((root) => uuidDirs(join(supportDir, root, account))))].sort();
+}
+/** The orgs to report: every one with a single account on this Mac, else the active one. */
+function orgsToReport(supportDir, account, active) {
+    const accounts = accountsWithSessions(supportDir);
+    const orgs = new Set(accounts.size === 1 && accounts.has(account) ? orgsForAccount(supportDir, account) : []);
+    if (active)
+        orgs.add(active.org);
+    return [...orgs].sort();
+}
+/** The email, and that org's name and plan, only when ~/.claude.json is signed into the same account. */
+function claudeJsonDetails(home, account, orgUuids) {
+    const details = { email: '', orgNames: {}, orgPlans: {} };
+    const claudeJson = readJson(join(home, '.claude.json'));
+    const oauth = claudeJson?.oauthAccount;
+    if (!oauth || text(oauth.accountUuid).toLowerCase() !== account)
+        return details;
+    details.email = text(oauth.emailAddress);
+    const org = text(oauth.organizationUuid).toLowerCase();
+    if (!org || !orgUuids.includes(org))
+        return details;
+    const name = text(oauth.organizationName);
+    if (name)
+        details.orgNames[org] = name;
+    const plan = readClaudeLoginPlan(home) || claudeCodePlan(claudeJson, oauth);
+    if (plan)
+        details.orgPlans[org] = plan;
+    return details;
+}
+/** Raw, in the order the backend reads Claude Code's plan, so both normalise alike. */
+function claudeCodePlan(claudeJson, oauth) {
+    return (text(claudeJson?.subscriptionType) ||
+        text(oauth.subscriptionType) ||
+        text(oauth.organizationType) ||
+        text(oauth.seatTier));
+}
+/**
+ * One aggregate naming the orgs the signed-in Desktop account has used -- every one with a single
+ * account on this Mac, else the active one -- or [] when this isn't macOS or none is known.
+ */
+function collectClaudeDesktopOrgs(home = homedir()) {
+    if (process.platform !== 'darwin')
+        return [];
+    const supportDir = claudeSupportDir(home);
+    const configPath = join(supportDir, 'config.json');
+    if (!existsSync(configPath))
+        return [];
+    const active = readDesktopActiveLogin(home);
+    const account = (active?.account || text(readJson(configPath)?.lastKnownAccountUuid)).toLowerCase();
+    if (!UUID.test(account))
+        return [];
+    const orgUuids = orgsToReport(supportDir, account, active);
+    if (orgUuids.length === 0)
+        return [];
+    const { email, orgNames, orgPlans } = claudeJsonDetails(home, account, orgUuids);
+    return [
+        {
+            file_type: FILE_TYPE,
+            file_path: configPath,
+            raw_content: {
+                account_uuid: account,
+                email,
+                org_uuids: orgUuids,
+                org_names: orgNames,
+                org_plans: orgPlans,
+                active_org_uuid: active?.org ?? '',
+            },
+        },
+    ];
+}
+export { collectClaudeDesktopOrgs, FILE_TYPE as CLAUDE_DESKTOP_ORGS_FILE_TYPE };

package/dist/log_config_files/collection/claude_login_plan.js

@@ -0,0 +1,72 @@
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, join } from 'node:path';
+/**
+ * The plan of the login Claude Code is actually using, from its stored OAuth credentials.
+ *
+ * `~/.claude.json`'s `oauthAccount` is a cached profile and can disagree with the login: a Team
+ * login has been seen there as `organizationType: "claude_pro"` on the person's personal org, while
+ * `/status` (which reads the credentials) said "Claude Team account". The credentials'
+ * `claudeAiOauth.subscriptionType` is what Claude Code bills and runs prompts against, so it wins.
+ *
+ * Credentials live in `~/.claude/.credentials.json` on Linux and Windows, and in the macOS login
+ * keychain as "Claude Code-credentials". Only `subscriptionType` is read out; the tokens beside it
+ * are never kept, logged or uploaded. The keychain is only read for the real home directory: it
+ * belongs to the signed-in macOS user, not to any other home a scan is pointed at.
+ */
+const KEYCHAIN_SERVICE = 'Claude Code-credentials';
+const PLAN = /^[a-z0-9_-]{1,64}$/i;
+function planFrom(credentials) {
+    try {
+        const plan = JSON.parse(credentials)?.claudeAiOauth
+            ?.subscriptionType;
+        return typeof plan === 'string' && PLAN.test(plan.trim()) ? plan.trim() : '';
+    }
+    catch {
+        return '';
+    }
+}
+function readCredentialsFile(home) {
+    try {
+        return readFileSync(join(home, '.claude', '.credentials.json'), 'utf8');
+    }
+    catch {
+        return '';
+    }
+}
+function readKeychainCredentials(home) {
+    if (process.platform !== 'darwin' || home !== homedir())
+        return '';
+    try {
+        return execFileSync('security', ['find-generic-password', '-s', KEYCHAIN_SERVICE, '-w'], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 3000,
+        });
+    }
+    catch {
+        return '';
+    }
+}
+const isObject = (value) => typeof value === 'object' && value !== null;
+/** Claude Code's login plan (e.g. "team", "pro"), or '' when no stored login names one. */
+export function readClaudeLoginPlan(home = homedir()) {
+    return planFrom(readCredentialsFile(home)) || planFrom(readKeychainCredentials(home));
+}
+/**
+ * Sets the login plan as the top-level `subscriptionType` of each uploaded `~/.claude.json` with a
+ * claude.ai login, the field the backend reads first for Claude's plan. Files are returned as given
+ * when there is no such upload or no plan.
+ */
+export function withClaudeLoginPlan(files, home = homedir()) {
+    const claudeJsons = files.filter((f) => basename(f.file_path) === '.claude.json' && isObject(f.raw_content?.oauthAccount));
+    if (claudeJsons.length === 0)
+        return files;
+    const plan = readClaudeLoginPlan(home);
+    if (!plan)
+        return files;
+    for (const file of claudeJsons)
+        file.raw_content.subscriptionType = plan;
+    return files;
+}

package/dist/log_config_files/collection/codex_token_usage_collector.js

@@ -339,4 +339,4 @@ function collectCodexTokenUsage(home = homedir()) {
         },
     ];
 }
-export { collectCodexTokenUsage, TOKEN_USAGE_RECENCY_DAYS, TOKEN_USAGE_FILE_TYPE };
+export { collectCodexTokenUsage, readCodexIdentity, TOKEN_USAGE_RECENCY_DAYS, TOKEN_USAGE_FILE_TYPE };

package/dist/log_config_files/collection/config_collector.js

@@ -236,6 +236,7 @@ export { collectHermesTokenUsage } from './hermes_token_usage_collector.js';
 export { collectOpenclawTokenUsage } from './openclaw_token_usage_collector.js';
 export { collectPiTokenUsage } from './pi_token_usage_collector.js';
 export { collectCoworkDesktopVersion } from './cowork_desktop_version_collector.js';
+export { collectClaudeDesktopOrgs } from './claude_desktop_orgs_collector.js';
 export { collectGrokCliVersion } from './grok_cli_version_collector.js';
 export { collectClaudeDesktopExtensionManifests, collectClaudeDesktopExtensionSettingsFiles, enrichClaudeDesktopExtensionsInstallationsUpload, mergeClaudeDesktopExtensionEnableSettings, } from './claude_desktop_extensions_collector.js';
 export { collectCursorProjectWorkspaceMcpConfigs } from './cursor_project_mcp_collector.js';

package/dist/log_config_files/collection/cursor_token_usage_collector.js

@@ -43,6 +43,38 @@ function querySqlite(sqlite3, dbPath, sql) {
         return null;
     }
 }
+/** ItemTable row holding Cursor's persisted app state, including the login's teams. */
+const PERSISTENT_STORAGE_KEY = 'src.vs.platform.reactivestorage.browser.reactiveStorageServiceImpl.persistentStorage.applicationUser';
+/**
+ * The Cursor teams the signed-in login belongs to, as strings, or null when they cannot be read.
+ *
+ * `aiSettings.teamIds` is the list Cursor's own `AllowedTeamId` policy checks. An empty list is a
+ * login on no team (a personal account) and is returned as []; only an unreadable or missing value
+ * is null, so the backend can tell "personal" from "unknown". Only that one field is extracted --
+ * the row is large and holds unrelated state.
+ */
+function readCursorTeamIds(sqlite3, dbPath) {
+    const raw = querySqlite(sqlite3, dbPath, `SELECT json_extract(value, '$.aiSettings.teamIds') FROM ItemTable WHERE key = '${PERSISTENT_STORAGE_KEY}';`);
+    if (raw === null)
+        return null;
+    try {
+        const parsed = JSON.parse(raw.trim());
+        if (!Array.isArray(parsed))
+            return null;
+        return parsed
+            .filter((t) => typeof t === 'number' || typeof t === 'string')
+            .map((t) => String(t).trim())
+            .filter((t) => t.length > 0);
+    }
+    catch {
+        return null;
+    }
+}
+/** The email Cursor's signed-in login uses, or '' when there is none or it cannot be read. */
+function readCursorEmail(sqlite3, dbPath) {
+    const raw = querySqlite(sqlite3, dbPath, `SELECT value FROM ItemTable WHERE key = 'cursorAuth/cachedEmail';`);
+    return (raw ?? '').trim();
+}
 function num(value) {
     if (typeof value === 'number' && Number.isFinite(value))
         return value;
@@ -52,19 +84,44 @@ function num(value) {
     }
     return 0;
 }
-/**
- * Aggregate Cursor token usage / sessions / version / identity from state.vscdb.
- * Returns a single-element array (one per-machine aggregate) or [] when no usable DB exists.
- */
-function collectCursorTokenUsage(home = homedir()) {
-    const dbPath = vscdbPath(home);
-    if (!existsSync(dbPath))
-        return [];
-    const cutoffMs = Date.now() - TOKEN_USAGE_RECENCY_DAYS * 24 * 60 * 60 * 1000;
-    const sqlite3 = resolveSqlite3Binary();
-    if (!sqlite3)
-        return [];
-    // Identity: version, email, plan, subscription status, sign-up type, display name.
+/** The `key<FIELD_SEP>value` rows of a query's output, split; rows without a separator are skipped. */
+function splitRows(raw) {
+    const rows = [];
+    for (const row of (raw ?? '').split(ROW_SEP)) {
+        const trimmed = row.trim();
+        const sep = trimmed.indexOf(FIELD_SEP);
+        if (sep > -1)
+            rows.push([trimmed.slice(0, sep), trimmed.slice(sep + 1)]);
+    }
+    return rows;
+}
+/** ItemTable key → the identity field it fills (the scoped profile is handled on its own). */
+const IDENTITY_KEYS = {
+    'cursor.startupMetrics.lastVersion': 'version',
+    'cursorAuth/cachedEmail': 'email',
+    'cursorAuth/stripeMembershipType': 'plan',
+    'cursorAuth/stripeSubscriptionStatus': 'subscriptionStatus',
+    'cursorAuth/cachedSignUpType': 'signUpType',
+};
+/** The display name in Cursor's cached scoped profile, or '' when it is missing or not JSON. */
+function profileDisplayName(value) {
+    try {
+        const profile = JSON.parse(value);
+        return typeof profile['displayName'] === 'string' ? profile['displayName'] : '';
+    }
+    catch {
+        /* non-JSON or missing — skip */
+        return '';
+    }
+}
+function setIdentityField(identity, key, value) {
+    if (key === 'cursorAuth/cachedScopedProfile')
+        identity.displayName = profileDisplayName(value);
+    else if (IDENTITY_KEYS[key])
+        identity[IDENTITY_KEYS[key]] = value;
+}
+/** Identity: version, email, plan, subscription status, sign-up type, display name. */
+function readCursorIdentity(sqlite3, dbPath) {
     const identityRaw = querySqlite(sqlite3, dbPath, `SELECT key || char(31) || COALESCE(value, '') || char(30)
      FROM ItemTable
      WHERE key IN (
@@ -75,54 +132,24 @@ function collectCursorTokenUsage(home = homedir()) {
        'cursorAuth/cachedSignUpType',
        'cursorAuth/cachedScopedProfile'
      );`);
-    let version = '';
-    let email = '';
-    let plan = '';
-    let subscriptionStatus = '';
-    let signUpType = '';
-    let displayName = '';
-    if (identityRaw) {
-        for (const row of identityRaw.split(ROW_SEP)) {
-            const trimmed = row.trim();
-            if (!trimmed)
-                continue;
-            const sep = trimmed.indexOf(FIELD_SEP);
-            if (sep === -1)
-                continue;
-            const key = trimmed.slice(0, sep);
-            const value = trimmed.slice(sep + 1);
-            switch (key) {
-                case 'cursor.startupMetrics.lastVersion':
-                    version = value;
-                    break;
-                case 'cursorAuth/cachedEmail':
-                    email = value;
-                    break;
-                case 'cursorAuth/stripeMembershipType':
-                    plan = value;
-                    break;
-                case 'cursorAuth/stripeSubscriptionStatus':
-                    subscriptionStatus = value;
-                    break;
-                case 'cursorAuth/cachedSignUpType':
-                    signUpType = value;
-                    break;
-                case 'cursorAuth/cachedScopedProfile':
-                    try {
-                        const profile = JSON.parse(value);
-                        if (typeof profile['displayName'] === 'string')
-                            displayName = profile['displayName'];
-                    }
-                    catch {
-                        /* non-JSON or missing — skip */
-                    }
-                    break;
-            }
-        }
-    }
-    // Usage: aggregate session counts and model names from composerData entries in the last 30
-    // days. composerData:<conversationId> entries carry a Unix ms timestamp in $.createdAt and
-    // the model in $.modelConfig.modelName. Token counts are not written by Cursor 3.8+.
+    const identity = {
+        version: '',
+        email: '',
+        plan: '',
+        subscriptionStatus: '',
+        signUpType: '',
+        displayName: '',
+    };
+    for (const [key, value] of splitRows(identityRaw))
+        setIdentityField(identity, key, value);
+    return identity;
+}
+/**
+ * Usage: aggregate session counts and model names from composerData entries since `cutoffMs`.
+ * composerData:<conversationId> entries carry a Unix ms timestamp in $.createdAt and
+ * the model in $.modelConfig.modelName. Token counts are not written by Cursor 3.8+.
+ */
+function readCursorUsage(sqlite3, dbPath, cutoffMs) {
     // cutoffMs is a safe integer — interpolating directly avoids an extra round-trip.
     // key range (not LIKE 'composerData:%') so the query hits the primary-key index on `key`
     // instead of a full-table scan. SQLite's LIKE optimizer only rewrites a prefix match to an
@@ -140,53 +167,62 @@ function collectCursorTokenUsage(home = homedir()) {
      WHERE key >= 'composerData:' AND key < 'composerData;'
        AND CAST(json_extract(value, '$.createdAt') AS INTEGER) >= ${cutoffMs}
      GROUP BY json_extract(value, '$.modelConfig.modelName');`);
-    const models = new Set();
-    let sessionCount = 0;
     // Cursor 3.8+ doesn't write token counts, so there's no real per-model token weighting — the
     // per-model composer COUNT from the query above is the only usage-weight signal available.
     // Mirrors Cowork's session-count convention (see cowork_extract.py): "Most used model" is
     // derived from whichever model has the most composers, not the most tokens.
-    const modelComposerCounts = {};
-    if (usageRaw) {
-        for (const row of usageRaw.split(ROW_SEP)) {
-            const trimmed = row.trim();
-            if (!trimmed)
-                continue;
-            const sep = trimmed.indexOf(FIELD_SEP);
-            if (sep === -1)
-                continue;
-            const model = trimmed.slice(0, sep).trim();
-            const cnt = num(trimmed.slice(sep + 1));
-            sessionCount += cnt;
-            if (model) {
-                models.add(model);
-                modelComposerCounts[model] = (modelComposerCounts[model] ?? 0) + cnt;
-            }
-        }
+    const usage = { models: new Set(), sessionCount: 0, modelComposerCounts: {} };
+    for (const [rawModel, rawCount] of splitRows(usageRaw)) {
+        const model = rawModel.trim();
+        const cnt = num(rawCount);
+        usage.sessionCount += cnt;
+        if (!model)
+            continue;
+        usage.models.add(model);
+        usage.modelComposerCounts[model] = (usage.modelComposerCounts[model] ?? 0) + cnt;
     }
-    if (sessionCount === 0 && !email && !version)
+    return usage;
+}
+/**
+ * Aggregate Cursor token usage / sessions / version / identity from state.vscdb.
+ * Returns a single-element array (one per-machine aggregate) or [] when no usable DB exists.
+ */
+function collectCursorTokenUsage(home = homedir()) {
+    const dbPath = vscdbPath(home);
+    if (!existsSync(dbPath))
+        return [];
+    const cutoffMs = Date.now() - TOKEN_USAGE_RECENCY_DAYS * 24 * 60 * 60 * 1000;
+    const sqlite3 = resolveSqlite3Binary();
+    if (!sqlite3)
+        return [];
+    const identity = readCursorIdentity(sqlite3, dbPath);
+    const usage = readCursorUsage(sqlite3, dbPath, cutoffMs);
+    if (usage.sessionCount === 0 && !identity.email && !identity.version)
         return [];
+    const teamIds = readCursorTeamIds(sqlite3, dbPath);
     return [
         {
             file_type: TOKEN_USAGE_FILE_TYPE,
             file_path: dbPath,
             raw_content: {
-                version,
-                session_count: sessionCount,
-                models: [...models].sort(),
-                model_token_split: modelComposerCounts,
+                version: identity.version,
+                session_count: usage.sessionCount,
+                models: [...usage.models].sort(),
+                model_token_split: usage.modelComposerCounts,
                 window_days: TOKEN_USAGE_RECENCY_DAYS,
                 totals: {
                     input_tokens: 0,
                     output_tokens: 0,
                 },
-                email,
-                display_name: displayName,
-                plan,
-                subscription_status: subscriptionStatus,
-                auth_method: signUpType ? 'cursor_account' : '',
+                email: identity.email,
+                display_name: identity.displayName,
+                plan: identity.plan,
+                subscription_status: identity.subscriptionStatus,
+                auth_method: identity.signUpType ? 'cursor_account' : '',
+                // Omitted when unreadable: the backend reads a missing list as unknown, [] as personal.
+                ...(teamIds !== null ? { team_ids: teamIds } : {}),
             },
         },
     ];
 }
-export { collectCursorTokenUsage, TOKEN_USAGE_RECENCY_DAYS, TOKEN_USAGE_FILE_TYPE, vscdbPath };
+export { collectCursorTokenUsage, readCursorEmail, readCursorTeamIds, TOKEN_USAGE_RECENCY_DAYS, TOKEN_USAGE_FILE_TYPE, vscdbPath, };