@optimuslabs/harness-map-staging 1.5.28 → 1.5.29

package/dist/approved_tenant_gate.js

@@ -185,6 +185,11 @@ export function cursorTeamViolation(approved, signedIn) {
  * the ChatGPT account is the person's own, so the login is keyed by email domain instead.
  */
 const CODEX_PERSONAL_PLANS = new Set(['free', 'go', 'plus']);
+/**
+ * Codex work plans, mirroring the backend's `CodexPlans.WORK`: only these are a shared workspace.
+ * Any other plan with a ChatGPT login (Pro, or one not recognised) is a personal account too.
+ */
+const CODEX_WORK_PLANS = new Set(['business', 'hc', 'enterprise', 'edu', 'education']);
 /** Codex's login from ~/.codex/auth.json (claims only, never tokens), or null when there is none. */
 export function readCodexSignedIn(home = homedir()) {
     const identity = readCodexIdentity(home);
@@ -192,19 +197,24 @@ export function readCodexSignedIn(home = homedir()) {
 }
 /**
  * The tenant a Codex login is in, mirroring the backend's `codex_tenants`: its ChatGPT workspace
- * (`chatgpt_account_id`, the claim Codex's own `forced_chatgpt_workspace_id` checks), or
- * `@<email domain>` on a personal plan. Null when there is no ChatGPT login (an API key).
+ * (`chatgpt_account_id`, the claim Codex's own `forced_chatgpt_workspace_id` checks) on a work plan,
+ * else `@<email domain>`, a personal account. Null when there is no ChatGPT login (an API key).
  */
 export function codexTenants(signedIn) {
     const plan = (signedIn.plan ?? '').trim().toLowerCase();
-    if (CODEX_PERSONAL_PLANS.has(plan)) {
-        const email = (signedIn.email ?? '').trim();
-        const at = email.lastIndexOf('@');
-        return at >= 0 && at < email.length - 1 ? [`@${email.slice(at + 1).toLowerCase()}`] : [];
-    }
+    if (CODEX_PERSONAL_PLANS.has(plan))
+        return codexEmailDomainTenant(signedIn);
     const account = (signedIn.account_id ?? '').trim();
     // The collector falls back to the API organization ("org-...") with no ChatGPT account.
-    return account && !account.startsWith('org-') ? [account] : null;
+    if (!account || account.startsWith('org-'))
+        return null;
+    return CODEX_WORK_PLANS.has(plan) ? [account] : codexEmailDomainTenant(signedIn);
+}
+/** `@<email domain>` for a Codex login, or [] when it has no email: how a personal account is keyed. */
+function codexEmailDomainTenant(signedIn) {
+    const email = (signedIn.email ?? '').trim();
+    const at = email.lastIndexOf('@');
+    return at >= 0 && at < email.length - 1 ? [`@${email.slice(at + 1).toLowerCase()}`] : [];
 }
 /** The block message when Codex's login may not be used, else null. */
 export function codexTenantViolation(approved, signedIn) {

package/dist/log_config_files/collection/claude_desktop_orgs_collector.js

@@ -126,11 +126,17 @@ function claudeJsonDetails(home, account, orgUuids) {
     const name = text(oauth.organizationName);
     if (name)
         details.orgNames[org] = name;
-    const plan = readClaudeLoginPlan(home) || claudeCodePlan(claudeJson, oauth);
+    // The org's own type first: the login token's plan describes whichever org the token is for now,
+    // which is not this one while ~/.claude.json still caches the org from before a move to a team.
+    const plan = claudeOrgPlan(oauth) || readClaudeLoginPlan(home) || claudeCodePlan(claudeJson, oauth);
     if (plan)
         details.orgPlans[org] = plan;
     return details;
 }
+/** The plan of the org `oauthAccount` names, fetched with it: its type, else its seat tier. */
+function claudeOrgPlan(oauth) {
+    return text(oauth.organizationType) || text(oauth.seatTier);
+}
 /** Raw, in the order the backend reads Claude Code's plan, so both normalise alike. */
 function claudeCodePlan(claudeJson, oauth) {
     return (text(claudeJson?.subscriptionType) ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.28",
+  "version": "1.5.29",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {