@optimuslabs/harness-map-staging 1.5.31 → 1.5.34

package/dist/approved_tenant_gate.js

@@ -10,6 +10,7 @@
  * gateway) is allowed here; blocking those is a separate level. So is one whose API key, auth
  * token, Bedrock or Vertex setting overrides an `oauthAccount` left behind by an earlier login:
  * Claude Code is not using that login, the same precedence as the backend's derive_auth_method.
+ * An API key Claude Code was asked about and turned down does not count: it keeps using the login.
  */
 import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -18,7 +19,6 @@ import { readCursorEmail, readCursorTeamIds, vscdbPath, } from './log_config_fil
 import { resolveSqlite3Binary } from './log_config_files/runtime/sqlite_binary.js';
 import { readCodexIdentity } from './log_config_files/collection/codex_token_usage_collector.js';
 import { readDesktopActiveLogin } from './log_config_files/collection/claude_desktop_orgs_collector.js';
-const CLAUDE_CREDENTIAL_ENV = ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN'];
 const CLAUDE_PROVIDER_ENV = ['CLAUDE_CODE_USE_BEDROCK', 'CLAUDE_CODE_USE_VERTEX'];
 /** The `env` block of Claude Code's user settings.json, or {} when there is none to read. */
 function claudeSettingsEnv(configDir) {
@@ -33,13 +33,25 @@ function claudeSettingsEnv(configDir) {
     }
 }
 /**
- * Whether Claude Code authenticates with something other than its claude.ai login: an API key or
- * auth token, or Bedrock / Vertex, from the session's environment or settings.json's `env`.
+ * Whether Claude Code turned this API key down. It asks once about a key it finds in its
+ * environment and keeps the last 20 characters of each one it rejected in `.claude.json`'s
+ * `customApiKeyResponses.rejected`; a rejected key is not used, the claude.ai login is.
  */
-function claudeUsesOtherCredentials(env, configDir) {
+function apiKeyRejected(claudeJson, apiKey) {
+    const responses = claudeJson.customApiKeyResponses;
+    return Array.isArray(responses?.rejected) && responses.rejected.includes(apiKey.slice(-20));
+}
+/**
+ * Whether Claude Code authenticates with something other than its claude.ai login: an API key it
+ * has not rejected, an auth token, or Bedrock / Vertex, from the session's environment or
+ * settings.json's `env`.
+ */
+function claudeUsesOtherCredentials(env, configDir, claudeJson) {
     const settingsEnv = claudeSettingsEnv(configDir);
     const value = (name) => String(env[name] ?? settingsEnv[name] ?? '').trim();
-    return (CLAUDE_CREDENTIAL_ENV.some((name) => value(name) !== '') ||
+    const apiKey = value('ANTHROPIC_API_KEY');
+    return ((apiKey !== '' && !apiKeyRejected(claudeJson, apiKey)) ||
+        value('ANTHROPIC_AUTH_TOKEN') !== '' ||
         CLAUDE_PROVIDER_ENV.some((name) => ['1', 'true', 'yes', 'on'].includes(value(name).toLowerCase())));
 }
 /** The claude.ai org this Claude Code session is signed into, or null when there is none to check. */
@@ -48,10 +60,12 @@ export function readClaudeSignedInTenant(env = process.env) {
     // directory is checked rather than the default one.
     const configDir = (env.CLAUDE_CONFIG_DIR || '').trim();
     const path = configDir ? join(configDir, '.claude.json') : join(homedir(), '.claude.json');
-    if (!existsSync(path) || claudeUsesOtherCredentials(env, configDir))
+    if (!existsSync(path))
         return null;
     try {
         const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        if (claudeUsesOtherCredentials(env, configDir, parsed ?? {}))
+            return null;
         const account = parsed?.oauthAccount;
         const tenantId = typeof account?.organizationUuid === 'string' ? account.organizationUuid.trim() : '';
         if (!tenantId)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optimuslabs/harness-map-staging",
-  "version": "1.5.31",
+  "version": "1.5.34",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {
@@ -49,17 +49,17 @@
   },
   "devDependencies": {
     "@types/node": "^24.10.1",
-    "@vitest/coverage-v8": "^4.1.8",
-    "@vitest/ui": "^4.1.8",
+    "@vitest/coverage-v8": "^4.1.12",
+    "@vitest/ui": "^4.1.12",
     "ts-node": "^10.9.2",
     "typescript": "^5.4.5",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.12"
   },
   "dependencies": {
     "@optimuslabs/tofu-staging": "^0.1.18",
     "axios": "^1.20.0",
     "canonicalize": "^2.1.0",
-    "smol-toml": "^1.7.1"
+    "smol-toml": "^1.9.1"
   },
   "publishConfig": {
     "access": "public"