@optimuslabs/harness-map-staging 1.5.26 → 1.5.27

package/dist/log_config_files/collection/claude_desktop_orgs_collector.js

@@ -1,6 +1,7 @@
 import { closeSync, existsSync, fstatSync, openSync, readdirSync, readFileSync, readSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
+import { readClaudeLoginPlan } from './claude_login_plan.js';
 /**
  * Every org Claude Desktop's signed-in account has used, so both tenants are recorded when one
  * login belongs to a team org and a personal org and switches between them in Desktop.
@@ -20,7 +21,8 @@ import { homedir } from 'node:os';
  * Reads `lastKnownAccountUuid` from config.json and nothing else from it -- the same file holds
  * Desktop's encrypted token caches, which are never touched or uploaded. The email, and the active
  * org's name and plan, come from ~/.claude.json only when it is the same account (and, for the name
- * and plan, the same org): Desktop's own files name neither. macOS only.
+ * and plan, the same org): Desktop's own files name neither. The plan prefers Claude Code's stored
+ * login over that cached profile (see claude_login_plan.ts). macOS only.
  */
 const FILE_TYPE = 'claude_desktop_orgs';
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -124,7 +126,7 @@ function claudeJsonDetails(home, account, orgUuids) {
     const name = text(oauth.organizationName);
     if (name)
         details.orgNames[org] = name;
-    const plan = claudeCodePlan(claudeJson, oauth);
+    const plan = readClaudeLoginPlan(home) || claudeCodePlan(claudeJson, oauth);
     if (plan)
         details.orgPlans[org] = plan;
     return details;

package/dist/log_config_files/collection/claude_login_plan.js

@@ -0,0 +1,72 @@
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, join } from 'node:path';
+/**
+ * The plan of the login Claude Code is actually using, from its stored OAuth credentials.
+ *
+ * `~/.claude.json`'s `oauthAccount` is a cached profile and can disagree with the login: a Team
+ * login has been seen there as `organizationType: "claude_pro"` on the person's personal org, while
+ * `/status` (which reads the credentials) said "Claude Team account". The credentials'
+ * `claudeAiOauth.subscriptionType` is what Claude Code bills and runs prompts against, so it wins.
+ *
+ * Credentials live in `~/.claude/.credentials.json` on Linux and Windows, and in the macOS login
+ * keychain as "Claude Code-credentials". Only `subscriptionType` is read out; the tokens beside it
+ * are never kept, logged or uploaded. The keychain is only read for the real home directory: it
+ * belongs to the signed-in macOS user, not to any other home a scan is pointed at.
+ */
+const KEYCHAIN_SERVICE = 'Claude Code-credentials';
+const PLAN = /^[a-z0-9_-]{1,64}$/i;
+function planFrom(credentials) {
+    try {
+        const plan = JSON.parse(credentials)?.claudeAiOauth
+            ?.subscriptionType;
+        return typeof plan === 'string' && PLAN.test(plan.trim()) ? plan.trim() : '';
+    }
+    catch {
+        return '';
+    }
+}
+function readCredentialsFile(home) {
+    try {
+        return readFileSync(join(home, '.claude', '.credentials.json'), 'utf8');
+    }
+    catch {
+        return '';
+    }
+}
+function readKeychainCredentials(home) {
+    if (process.platform !== 'darwin' || home !== homedir())
+        return '';
+    try {
+        return execFileSync('security', ['find-generic-password', '-s', KEYCHAIN_SERVICE, '-w'], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 3000,
+        });
+    }
+    catch {
+        return '';
+    }
+}
+const isObject = (value) => typeof value === 'object' && value !== null;
+/** Claude Code's login plan (e.g. "team", "pro"), or '' when no stored login names one. */
+export function readClaudeLoginPlan(home = homedir()) {
+    return planFrom(readCredentialsFile(home)) || planFrom(readKeychainCredentials(home));
+}
+/**
+ * Sets the login plan as the top-level `subscriptionType` of each uploaded `~/.claude.json` with a
+ * claude.ai login, the field the backend reads first for Claude's plan. Files are returned as given
+ * when there is no such upload or no plan.
+ */
+export function withClaudeLoginPlan(files, home = homedir()) {
+    const claudeJsons = files.filter((f) => basename(f.file_path) === '.claude.json' && isObject(f.raw_content?.oauthAccount));
+    if (claudeJsons.length === 0)
+        return files;
+    const plan = readClaudeLoginPlan(home);
+    if (!plan)
+        return files;
+    for (const file of claudeJsons)
+        file.raw_content.subscriptionType = plan;
+    return files;
+}

package/dist/log_config_files/runtime/main_runner.js

@@ -26,6 +26,7 @@ import { canonicalCursorUserStateVscdbPath } from './remediation_config_path.js'
 import { ensureWorkspaceRepoEnv, resolveProjectRoot } from './workspace_repo.js';
 import { scanActiveWorktrees, activeWorktreeRootSet, filterConfigFilesToActiveWorktrees, } from './worktree_scanner.js';
 import { createSignature, canonicalizePayload } from '../sender/signing.js';
+import { withClaudeLoginPlan } from '../collection/claude_login_plan.js';
 const PROJECT_ROOT = resolveProjectRoot();
 const configFileKey = (c) => `${c.file_type}\t${c.file_path}`;
 /** Appends the entries not in the batch yet (by file type and path), recording each as seen. */
@@ -70,7 +71,7 @@ async function fetchPatterns(endpointBase) {
 function scanPatterns(patternsResponse) {
     persistVscdbComposerContractFromPatternsResponse(patternsResponse);
     hookRunLog(`scanning config files`);
-    return collectConfigFilesFromPatterns(patternsResponse.patterns, PROJECT_ROOT, hookRunLog, {
+    const files = collectConfigFilesFromPatterns(patternsResponse.patterns, PROJECT_ROOT, hookRunLog, {
         vscdbEntrySpecs: patternsResponse.vscdb_entry_specs,
         vscdb_read_queries: patternsResponse.vscdb_read_queries,
         vscdb_merge_from_composer_state: patternsResponse.vscdb_merge_from_composer_state,
@@ -80,6 +81,7 @@ function scanPatterns(patternsResponse) {
         absolute_path_prefixes: patternsResponse.absolute_path_prefixes,
         mcp_tool_glob_spec: patternsResponse.mcp_tool_glob_spec ?? null,
     });
+    return withClaudeLoginPlan(files, HOME_DIR);
 }
 /** MCP tool caches: the global cache, Cursor's per-project caches and its workspace vscdb files. */
 function addMcpToolCaches(patternsResponse, configFiles, seen) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.26",
+  "version": "1.5.27",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {