claude-dev-env 1.93.1 → 1.94.0

package/scripts/Get-SessionAccount.ps1

@@ -0,0 +1,210 @@
+#!/usr/bin/env pwsh
+[CmdletBinding()]
+param(
+    [switch]$AsJson
+)
+
+$noiseEmailPatterns = @(
+    '@example\.(com|org|net)$',
+    '(@|\.)sentry\.io$',
+    '@anthropic\.',
+    '^Claude@\d'
+)
+
+$isoLatin1CodePage = 28591
+
+$profileStorageDirectoryNames = @('sentry', 'IndexedDB', 'Session Storage', 'WebStorage')
+
+$emailAddressPattern = '(?<![a-zA-Z0-9._%+-])[a-zA-Z0-9][a-zA-Z0-9._%+-]*@[a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)+(?![a-zA-Z0-9-])'
+
+$maximumStorageFileBytes = 50MB
+
+function Test-NoiseEmail {
+    param([string]$Email)
+    foreach ($pattern in $noiseEmailPatterns) {
+        if ($Email -imatch $pattern) { return $true }
+    }
+    return $false
+}
+
+function Get-EncodingAgnosticTextView {
+    param([string]$FilePath)
+    try {
+        $fileBytes = [System.IO.File]::ReadAllBytes($FilePath)
+        if ($fileBytes.Length -eq 0) { return @() }
+        $isoLatin1Encoding = [System.Text.Encoding]::GetEncoding($isoLatin1CodePage)
+        return @(
+            $isoLatin1Encoding.GetString($fileBytes),
+            [System.Text.Encoding]::Unicode.GetString($fileBytes)
+        )
+    }
+    catch {
+        return @()
+    }
+}
+
+function Get-EmailCandidatesFromProfile {
+    param(
+        [string]$ProfileDirectory,
+        [string]$ExcludeEmail
+    )
+    $scanDirectories = $profileStorageDirectoryNames |
+        ForEach-Object { Join-Path $ProfileDirectory $_ } |
+        Where-Object { Test-Path -LiteralPath $_ }
+    $foundEmails = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+
+    foreach ($scanDirectory in $scanDirectories) {
+        $candidateFiles = Get-ChildItem -LiteralPath $scanDirectory -Recurse -File -ErrorAction SilentlyContinue |
+            Where-Object { $_.Length -lt $maximumStorageFileBytes }
+        foreach ($candidateFile in $candidateFiles) {
+            $decodedTextViews = Get-EncodingAgnosticTextView -FilePath $candidateFile.FullName
+            foreach ($decodedText in $decodedTextViews) {
+                foreach ($match in [regex]::Matches($decodedText, $emailAddressPattern)) {
+                    $candidateEmail = $match.Value
+                    $isKnownCliEmail = $ExcludeEmail -and ($candidateEmail -ieq $ExcludeEmail)
+                    if (-not (Test-NoiseEmail -Email $candidateEmail) -and -not $isKnownCliEmail) {
+                        [void]$foundEmails.Add($candidateEmail)
+                    }
+                }
+            }
+        }
+    }
+    return $foundEmails
+}
+
+function Write-AccountResult {
+    param(
+        [string]$Email,
+        [string]$AccountUuid,
+        [string]$Source,
+        [string]$CliEmail,
+        [string]$CliAccountUuid,
+        [switch]$AsJson
+    )
+    if ($AsJson) {
+        [pscustomobject]@{
+            account        = $Email
+            accountUuid    = $AccountUuid
+            source         = $Source
+            cliAccount     = $CliEmail
+            cliAccountUuid = $CliAccountUuid
+        } | ConvertTo-Json
+        return
+    }
+    Write-Output "Account: $Email"
+    Write-Output "AccountUuid: $AccountUuid"
+    Write-Output "Source: $Source"
+    if ($CliEmail) {
+        Write-Output "CliAccount: $CliEmail"
+        Write-Output "CliAccountUuid: $CliAccountUuid"
+    }
+}
+
+function Get-SessionAccountResult {
+    param(
+        [int]$ExitCode,
+        [string]$Email = $null,
+        [string]$AccountUuid = $null,
+        [string]$Source = $null,
+        [string]$CliEmail = $null,
+        [string]$CliAccountUuid = $null,
+        [string]$ErrorMessage = $null
+    )
+    [pscustomobject]@{
+        ExitCode       = $ExitCode
+        Email          = $Email
+        AccountUuid    = $AccountUuid
+        Source         = $Source
+        CliEmail       = $CliEmail
+        CliAccountUuid = $CliAccountUuid
+        ErrorMessage   = $ErrorMessage
+    }
+}
+
+function Resolve-SessionAccount {
+    param(
+        [string]$CliConfigPath,
+        [string]$ProfileDirectory
+    )
+    if (-not (Test-Path -LiteralPath $CliConfigPath)) {
+        return Get-SessionAccountResult -ExitCode 2 -ErrorMessage "CLI config not found: $CliConfigPath"
+    }
+
+    try {
+        $cliConfig = Get-Content -LiteralPath $CliConfigPath -Raw -ErrorAction Stop | ConvertFrom-Json -AsHashtable -ErrorAction Stop
+    }
+    catch {
+        return Get-SessionAccountResult -ExitCode 2 -ErrorMessage "Failed to parse CLI config as JSON: $CliConfigPath"
+    }
+
+    if ($cliConfig -isnot [System.Collections.IDictionary]) {
+        return Get-SessionAccountResult -ExitCode 2 -ErrorMessage "CLI config top level is not a JSON object: $CliConfigPath"
+    }
+
+    $oauthAccount = $cliConfig['oauthAccount']
+    $cliEmail = if ($oauthAccount) { $oauthAccount['emailAddress'] } else { $null }
+    $cliAccountUuid = if ($oauthAccount) { $oauthAccount['accountUuid'] } else { $null }
+    if (-not $cliEmail -or -not $cliAccountUuid) {
+        return Get-SessionAccountResult -ExitCode 2 -ErrorMessage "CLI config is missing oauthAccount.emailAddress or oauthAccount.accountUuid: $CliConfigPath"
+    }
+
+    if (-not $ProfileDirectory -or -not (Test-Path -LiteralPath $ProfileDirectory)) {
+        return Get-SessionAccountResult -ExitCode 0 -Email $cliEmail -AccountUuid $cliAccountUuid -Source 'cli-config'
+    }
+
+    $profileConfigPath = Join-Path $ProfileDirectory 'config.json'
+    if (-not (Test-Path -LiteralPath $profileConfigPath)) {
+        return Get-SessionAccountResult -ExitCode 2 -ErrorMessage "Desktop profile config not found: $profileConfigPath"
+    }
+
+    try {
+        $profileConfig = Get-Content -LiteralPath $profileConfigPath -Raw -ErrorAction Stop | ConvertFrom-Json -AsHashtable -ErrorAction Stop
+    }
+    catch {
+        return Get-SessionAccountResult -ExitCode 2 -ErrorMessage "Failed to parse desktop profile config as JSON: $profileConfigPath"
+    }
+
+    if ($profileConfig -isnot [System.Collections.IDictionary]) {
+        return Get-SessionAccountResult -ExitCode 2 -ErrorMessage "Desktop profile config top level is not a JSON object: $profileConfigPath"
+    }
+
+    $profileAccountUuid = $profileConfig['lastKnownAccountUuid']
+    if (-not $profileAccountUuid) {
+        return Get-SessionAccountResult -ExitCode 2 -ErrorMessage "Desktop profile config is missing lastKnownAccountUuid: $profileConfigPath"
+    }
+
+    if ($profileAccountUuid -eq $cliAccountUuid) {
+        return Get-SessionAccountResult -ExitCode 0 -Email $cliEmail -AccountUuid $cliAccountUuid -Source 'desktop-profile (matches cli-config)'
+    }
+
+    $candidateEmails = @(Get-EmailCandidatesFromProfile -ProfileDirectory $ProfileDirectory -ExcludeEmail $cliEmail)
+    if ($candidateEmails.Count -eq 1) {
+        return Get-SessionAccountResult -ExitCode 0 -Email $candidateEmails[0] -AccountUuid $profileAccountUuid -Source 'desktop-profile (differs from cli-config)' -CliEmail $cliEmail -CliAccountUuid $cliAccountUuid
+    }
+
+    if ($candidateEmails.Count -eq 0) {
+        return Get-SessionAccountResult -ExitCode 1 -ErrorMessage "Desktop profile account ($profileAccountUuid) differs from CLI config, but no candidate email was recovered from profile storage: $ProfileDirectory"
+    }
+
+    return Get-SessionAccountResult -ExitCode 1 -ErrorMessage "Desktop profile account ($profileAccountUuid) differs from CLI config, and multiple candidate emails were found in profile storage: $($candidateEmails -join ', ')"
+}
+
+function Invoke-GetSessionAccount {
+    param(
+        [switch]$AsJson
+    )
+    $cliConfigPath = Join-Path $HOME '.claude.json'
+    $sessionAccount = Resolve-SessionAccount -CliConfigPath $cliConfigPath -ProfileDirectory $env:CLAUDE_USER_DATA_DIR
+    if ($sessionAccount.ErrorMessage) {
+        Write-Error $sessionAccount.ErrorMessage -ErrorAction Continue
+        exit $sessionAccount.ExitCode
+    }
+    Write-AccountResult -Email $sessionAccount.Email -AccountUuid $sessionAccount.AccountUuid -Source $sessionAccount.Source -CliEmail $sessionAccount.CliEmail -CliAccountUuid $sessionAccount.CliAccountUuid -AsJson:$AsJson
+    exit $sessionAccount.ExitCode
+}
+
+if ($MyInvocation.InvocationName -ne '.') {
+    Set-StrictMode -Version Latest
+    $ErrorActionPreference = 'Stop'
+    Invoke-GetSessionAccount -AsJson:$AsJson
+}

package/scripts/tests/CLAUDE.md

@@ -1,6 +1,6 @@
 # scripts/tests
 
-pytest suite for the Python scripts in `scripts/`.
+pytest suite for the Python scripts and Pester suite for the PowerShell scripts in `scripts/`.
 
 ## Test files
 
@@ -11,8 +11,22 @@ pytest suite for the Python scripts in `scripts/`.
 | `test_sweep_empty_dirs.py` | `sweep_empty_dirs.py` — age check, one-shot mode, and continuous-watch behavior |
 | `test_sync_to_cursor.py` | `sync_to_cursor/` package — mapping, hashing, manifest, and path resolution |
 
+## PowerShell test files
+
+| File | Covers |
+|---|---|
+| `Get-SessionAccount.Tests.ps1` | `Get-SessionAccount.ps1` — noise filtering, profile-storage email recovery, CLI-vs-desktop account resolution, and output formatting |
+
 ## Running
 
+Python scripts (pytest):
+
 ```bash
 python -m pytest packages/claude-dev-env/scripts/tests/
 ```
+
+PowerShell scripts (Pester 5+, `*.Tests.ps1`):
+
+```powershell
+Invoke-Pester -Path packages/claude-dev-env/scripts/tests/
+```

package/scripts/tests/Get-SessionAccount.Tests.ps1

@@ -0,0 +1,350 @@
+Set-StrictMode -Version Latest
+
+BeforeAll {
+    $scriptUnderTest = Join-Path (Split-Path -Parent $PSScriptRoot) 'Get-SessionAccount.ps1'
+    . $scriptUnderTest
+
+    function New-Utf16StorageFile {
+        param(
+            [string]$ProfileDirectory,
+            [string]$StoreName,
+            [string]$FileName,
+            [string]$EmailText
+        )
+        $storeDirectory = Join-Path $ProfileDirectory $StoreName
+        New-Item -ItemType Directory -Path $storeDirectory -Force | Out-Null
+        $emailBytes = [System.Text.Encoding]::Unicode.GetBytes("`0`0$EmailText`0`0")
+        $filePath = Join-Path $storeDirectory $FileName
+        [System.IO.File]::WriteAllBytes($filePath, $emailBytes)
+    }
+
+    function New-Utf8StorageFile {
+        param(
+            [string]$ProfileDirectory,
+            [string]$StoreName,
+            [string]$FileName,
+            [string]$JsonText
+        )
+        $storeDirectory = Join-Path $ProfileDirectory $StoreName
+        New-Item -ItemType Directory -Path $storeDirectory -Force | Out-Null
+        $filePath = Join-Path $storeDirectory $FileName
+        [System.IO.File]::WriteAllText($filePath, $JsonText, [System.Text.Encoding]::UTF8)
+    }
+
+    function New-CliConfigFile {
+        param(
+            [string]$Directory,
+            [string]$Email,
+            [string]$AccountUuid
+        )
+        New-Item -ItemType Directory -Path $Directory -Force | Out-Null
+        $cliConfigPath = Join-Path $Directory '.claude.json'
+        $cliConfigJson = [pscustomobject]@{
+            oauthAccount = [pscustomobject]@{
+                emailAddress = $Email
+                accountUuid  = $AccountUuid
+            }
+        } | ConvertTo-Json
+        [System.IO.File]::WriteAllText($cliConfigPath, $cliConfigJson, [System.Text.Encoding]::UTF8)
+        return $cliConfigPath
+    }
+
+    function New-ProfileConfigFile {
+        param(
+            [string]$ProfileDirectory,
+            [string]$LastKnownAccountUuid
+        )
+        New-Item -ItemType Directory -Path $ProfileDirectory -Force | Out-Null
+        $profileConfigPath = Join-Path $ProfileDirectory 'config.json'
+        $profileConfigJson = [pscustomobject]@{
+            lastKnownAccountUuid = $LastKnownAccountUuid
+        } | ConvertTo-Json
+        [System.IO.File]::WriteAllText($profileConfigPath, $profileConfigJson, [System.Text.Encoding]::UTF8)
+    }
+}
+
+Describe 'Test-NoiseEmail' {
+    It 'rejects the placeholder example domain' {
+        (Test-NoiseEmail -Email 'noreply@example.com') | Should -Be $true
+    }
+
+    It 'keeps a legitimate local part that contains the substring example' {
+        (Test-NoiseEmail -Email 'sam.exampleson@company.com') | Should -Be $false
+    }
+
+    It 'keeps a legitimate domain that merely contains the substring example' {
+        (Test-NoiseEmail -Email 'person@example-labs.io') | Should -Be $false
+    }
+
+    It 'still rejects sentry and anthropic noise addresses' {
+        (Test-NoiseEmail -Email 'someone@sentry.io') | Should -Be $true
+        (Test-NoiseEmail -Email 'billing@anthropic.com') | Should -Be $true
+    }
+
+    It 'rejects a sentry ingest subdomain address' {
+        (Test-NoiseEmail -Email 'abc@o123.ingest.sentry.io') | Should -Be $true
+    }
+
+    It 'keeps an address whose local part merely contains sentry.io' {
+        (Test-NoiseEmail -Email 'sentry.io.reports@realcompany.com') | Should -Be $false
+    }
+
+    It 'keeps an address whose domain merely starts with anthropic' {
+        (Test-NoiseEmail -Email 'user@anthropic-partner.com') | Should -Be $false
+    }
+}
+
+Describe 'Get-EmailCandidatesFromProfile' {
+    It 'recovers an email persisted as UTF-16 in Session Storage' {
+        $profileDirectory = Join-Path $TestDrive 'utf16-profile'
+        New-Utf16StorageFile -ProfileDirectory $profileDirectory -StoreName 'Session Storage' -FileName '000003.ldb' -EmailText 'user@host.com'
+
+        $candidateEmails = @(Get-EmailCandidatesFromProfile -ProfileDirectory $profileDirectory)
+
+        ($candidateEmails -contains 'user@host.com') | Should -Be $true
+    }
+
+    It 'recovers an email stored as UTF-8 JSON in the sentry store' {
+        $profileDirectory = Join-Path $TestDrive 'utf8-profile'
+        New-Utf8StorageFile -ProfileDirectory $profileDirectory -StoreName 'sentry' -FileName 'events.json' -JsonText '{"user":{"email":"person@company.com"}}'
+
+        $candidateEmails = @(Get-EmailCandidatesFromProfile -ProfileDirectory $profileDirectory)
+
+        ($candidateEmails -contains 'person@company.com') | Should -Be $true
+    }
+
+    It 'keeps a single UTF-16 email whose local part contains the substring example' {
+        $profileDirectory = Join-Path $TestDrive 'example-profile'
+        New-Utf16StorageFile -ProfileDirectory $profileDirectory -StoreName 'Session Storage' -FileName '000004.ldb' -EmailText 'sam.exampleson@company.com'
+
+        $candidateEmails = @(Get-EmailCandidatesFromProfile -ProfileDirectory $profileDirectory)
+
+        $candidateEmails.Count | Should -Be 1
+        $candidateEmails[0] | Should -Be 'sam.exampleson@company.com'
+    }
+
+    It 'counts the same email recovered with differing casing across stores as one candidate' {
+        $profileDirectory = Join-Path $TestDrive 'mixed-case-profile'
+        New-Utf16StorageFile -ProfileDirectory $profileDirectory -StoreName 'Session Storage' -FileName '000012.ldb' -EmailText 'Desktop@Company.com'
+        New-Utf16StorageFile -ProfileDirectory $profileDirectory -StoreName 'IndexedDB' -FileName '000013.ldb' -EmailText 'desktop@company.com'
+
+        $candidateEmails = @(Get-EmailCandidatesFromProfile -ProfileDirectory $profileDirectory)
+
+        $candidateEmails.Count | Should -Be 1
+    }
+
+    It 'refuses to recover an email whose local part is glued to an adjacent boundary byte' {
+        $profileDirectory = Join-Path $TestDrive 'prefix-polluted-profile'
+        New-Utf16StorageFile -ProfileDirectory $profileDirectory -StoreName 'Session Storage' -FileName '000010.ldb' -EmailText '.desktop@company.com'
+
+        $candidateEmails = @(Get-EmailCandidatesFromProfile -ProfileDirectory $profileDirectory)
+
+        ($candidateEmails -contains '.desktop@company.com') | Should -Be $false
+        $candidateEmails.Count | Should -Be 0
+    }
+}
+
+Describe 'Resolve-SessionAccount' {
+    It 'returns exit code 2 when the CLI config file is absent' {
+        $cliConfigPath = Join-Path $TestDrive 'absent-cli/.claude.json'
+
+        $sessionAccount = Resolve-SessionAccount -CliConfigPath $cliConfigPath -ProfileDirectory ''
+
+        $sessionAccount.ExitCode | Should -Be 2
+        $sessionAccount.ErrorMessage | Should -Match 'CLI config not found'
+    }
+
+    It 'returns exit code 2 when the CLI config is not valid JSON' {
+        $configDirectory = Join-Path $TestDrive 'unparseable-cli'
+        New-Item -ItemType Directory -Path $configDirectory -Force | Out-Null
+        $cliConfigPath = Join-Path $configDirectory '.claude.json'
+        [System.IO.File]::WriteAllText($cliConfigPath, 'this is not json {', [System.Text.Encoding]::UTF8)
+
+        $sessionAccount = Resolve-SessionAccount -CliConfigPath $cliConfigPath -ProfileDirectory ''
+
+        $sessionAccount.ExitCode | Should -Be 2
+        $sessionAccount.ErrorMessage | Should -Match 'Failed to parse CLI config'
+    }
+
+    It 'returns exit code 2 when the CLI config top level is a JSON string' {
+        $configDirectory = Join-Path $TestDrive 'scalar-cli'
+        New-Item -ItemType Directory -Path $configDirectory -Force | Out-Null
+        $cliConfigPath = Join-Path $configDirectory '.claude.json'
+        [System.IO.File]::WriteAllText($cliConfigPath, '"just a string"', [System.Text.Encoding]::UTF8)
+
+        $sessionAccount = Resolve-SessionAccount -CliConfigPath $cliConfigPath -ProfileDirectory ''
+
+        $sessionAccount.ExitCode | Should -Be 2
+        $sessionAccount.ErrorMessage | Should -Match 'not a JSON object'
+    }
+
+    It 'returns exit code 2 when the CLI config top level is a JSON array' {
+        $configDirectory = Join-Path $TestDrive 'array-cli'
+        New-Item -ItemType Directory -Path $configDirectory -Force | Out-Null
+        $cliConfigPath = Join-Path $configDirectory '.claude.json'
+        [System.IO.File]::WriteAllText($cliConfigPath, '[1, 2, 3]', [System.Text.Encoding]::UTF8)
+
+        $sessionAccount = Resolve-SessionAccount -CliConfigPath $cliConfigPath -ProfileDirectory ''
+
+        $sessionAccount.ExitCode | Should -Be 2
+        $sessionAccount.ErrorMessage | Should -Match 'not a JSON object'
+    }
+
+    It 'returns exit code 2 when the desktop profile config top level is not a JSON object' {
+        $cliConfigPath = New-CliConfigFile -Directory (Join-Path $TestDrive 'scalar-profile-cli') -Email 'cli@company.com' -AccountUuid 'uuid-cli'
+        $profileDirectory = Join-Path $TestDrive 'scalar-profile'
+        New-Item -ItemType Directory -Path $profileDirectory -Force | Out-Null
+        $profileConfigPath = Join-Path $profileDirectory 'config.json'
+        [System.IO.File]::WriteAllText($profileConfigPath, '42', [System.Text.Encoding]::UTF8)
+
+        $sessionAccount = Resolve-SessionAccount -CliConfigPath $cliConfigPath -ProfileDirectory $profileDirectory
+
+        $sessionAccount.ExitCode | Should -Be 2
+        $sessionAccount.ErrorMessage | Should -Match 'not a JSON object'
+    }
+
+    It 'returns exit code 2 when the CLI config lacks oauthAccount fields' {
+        $configDirectory = Join-Path $TestDrive 'incomplete-cli'
+        New-Item -ItemType Directory -Path $configDirectory -Force | Out-Null
+        $cliConfigPath = Join-Path $configDirectory '.claude.json'
+        [System.IO.File]::WriteAllText($cliConfigPath, '{"oauthAccount":{"emailAddress":"","accountUuid":""}}', [System.Text.Encoding]::UTF8)
+
+        $sessionAccount = Resolve-SessionAccount -CliConfigPath $cliConfigPath -ProfileDirectory ''
+
+        $sessionAccount.ExitCode | Should -Be 2
+        $sessionAccount.ErrorMessage | Should -Match 'missing oauthAccount'
+    }
+
+    It 'reports the cli-config account with exit code 0 when no desktop profile is set' {
+        $cliConfigPath = New-CliConfigFile -Directory (Join-Path $TestDrive 'cli-only') -Email 'cli@company.com' -AccountUuid 'uuid-cli'
+
+        $sessionAccount = Resolve-SessionAccount -CliConfigPath $cliConfigPath -ProfileDirectory ''
+
+        $sessionAccount.ExitCode | Should -Be 0
+        $sessionAccount.Source | Should -Be 'cli-config'
+        $sessionAccount.Email | Should -Be 'cli@company.com'
+    }
+
+    It 'returns exit code 2 when the desktop profile config is absent' {
+        $cliConfigPath = New-CliConfigFile -Directory (Join-Path $TestDrive 'missing-profile-cli') -Email 'cli@company.com' -AccountUuid 'uuid-cli'
+        $profileDirectory = Join-Path $TestDrive 'profile-without-config'
+        New-Item -ItemType Directory -Path $profileDirectory -Force | Out-Null
+
+        $sessionAccount = Resolve-SessionAccount -CliConfigPath $cliConfigPath -ProfileDirectory $profileDirectory
+
+        $sessionAccount.ExitCode | Should -Be 2
+        $sessionAccount.ErrorMessage | Should -Match 'Desktop profile config not found'
+    }
+
+    It 'reports the matching desktop-profile account with exit code 0' {
+        $cliConfigPath = New-CliConfigFile -Directory (Join-Path $TestDrive 'match-cli') -Email 'cli@company.com' -AccountUuid 'uuid-shared'
+        $profileDirectory = Join-Path $TestDrive 'match-profile'
+        New-ProfileConfigFile -ProfileDirectory $profileDirectory -LastKnownAccountUuid 'uuid-shared'
+
+        $sessionAccount = Resolve-SessionAccount -CliConfigPath $cliConfigPath -ProfileDirectory $profileDirectory
+
+        $sessionAccount.ExitCode | Should -Be 0
+        $sessionAccount.Source | Should -Be 'desktop-profile (matches cli-config)'
+        $sessionAccount.Email | Should -Be 'cli@company.com'
+    }
+
+    It 'recovers the desktop account email with exit code 0 when exactly one candidate differs from the cli account' {
+        $cliConfigPath = New-CliConfigFile -Directory (Join-Path $TestDrive 'differ-cli') -Email 'cli@company.com' -AccountUuid 'uuid-cli'
+        $profileDirectory = Join-Path $TestDrive 'differ-profile'
+        New-ProfileConfigFile -ProfileDirectory $profileDirectory -LastKnownAccountUuid 'uuid-desktop'
+        New-Utf16StorageFile -ProfileDirectory $profileDirectory -StoreName 'Session Storage' -FileName '000005.ldb' -EmailText 'desktop@company.com'
+
+        $sessionAccount = Resolve-SessionAccount -CliConfigPath $cliConfigPath -ProfileDirectory $profileDirectory
+
+        $sessionAccount.ExitCode | Should -Be 0
+        $sessionAccount.Email | Should -Be 'desktop@company.com'
+        $sessionAccount.AccountUuid | Should -Be 'uuid-desktop'
+        $sessionAccount.Source | Should -Be 'desktop-profile (differs from cli-config)'
+        $sessionAccount.CliEmail | Should -Be 'cli@company.com'
+    }
+
+    It 'recovers the desktop email even when the known cli email also lingers in profile storage' {
+        $cliConfigPath = New-CliConfigFile -Directory (Join-Path $TestDrive 'lingering-cli') -Email 'cli@company.com' -AccountUuid 'uuid-cli'
+        $profileDirectory = Join-Path $TestDrive 'lingering-profile'
+        New-ProfileConfigFile -ProfileDirectory $profileDirectory -LastKnownAccountUuid 'uuid-desktop'
+        New-Utf16StorageFile -ProfileDirectory $profileDirectory -StoreName 'Session Storage' -FileName '000008.ldb' -EmailText 'desktop@company.com'
+        New-Utf16StorageFile -ProfileDirectory $profileDirectory -StoreName 'IndexedDB' -FileName '000009.ldb' -EmailText 'cli@company.com'
+
+        $sessionAccount = Resolve-SessionAccount -CliConfigPath $cliConfigPath -ProfileDirectory $profileDirectory
+
+        $sessionAccount.ExitCode | Should -Be 0
+        $sessionAccount.Email | Should -Be 'desktop@company.com'
+        $sessionAccount.AccountUuid | Should -Be 'uuid-desktop'
+        $sessionAccount.CliEmail | Should -Be 'cli@company.com'
+    }
+
+    It 'fails safe with exit code 1 rather than reporting a prefix-polluted email as the account' {
+        $cliConfigPath = New-CliConfigFile -Directory (Join-Path $TestDrive 'polluted-cli') -Email 'cli@company.com' -AccountUuid 'uuid-cli'
+        $profileDirectory = Join-Path $TestDrive 'polluted-resolve-profile'
+        New-ProfileConfigFile -ProfileDirectory $profileDirectory -LastKnownAccountUuid 'uuid-desktop'
+        New-Utf16StorageFile -ProfileDirectory $profileDirectory -StoreName 'Session Storage' -FileName '000011.ldb' -EmailText '.desktop@company.com'
+
+        $sessionAccount = Resolve-SessionAccount -CliConfigPath $cliConfigPath -ProfileDirectory $profileDirectory
+
+        $sessionAccount.ExitCode | Should -Be 1
+        $sessionAccount.Email | Should -BeNullOrEmpty
+        $sessionAccount.ErrorMessage | Should -Match 'no candidate email was recovered'
+    }
+
+    It 'returns exit code 1 when the desktop account differs but no candidate email is recovered' {
+        $cliConfigPath = New-CliConfigFile -Directory (Join-Path $TestDrive 'none-cli') -Email 'cli@company.com' -AccountUuid 'uuid-cli'
+        $profileDirectory = Join-Path $TestDrive 'none-profile'
+        New-ProfileConfigFile -ProfileDirectory $profileDirectory -LastKnownAccountUuid 'uuid-desktop'
+
+        $sessionAccount = Resolve-SessionAccount -CliConfigPath $cliConfigPath -ProfileDirectory $profileDirectory
+
+        $sessionAccount.ExitCode | Should -Be 1
+        $sessionAccount.ErrorMessage | Should -Match 'no candidate email was recovered'
+    }
+
+    It 'returns exit code 1 when the desktop account differs and multiple candidate emails are found' {
+        $cliConfigPath = New-CliConfigFile -Directory (Join-Path $TestDrive 'multi-cli') -Email 'cli@company.com' -AccountUuid 'uuid-cli'
+        $profileDirectory = Join-Path $TestDrive 'multi-profile'
+        New-ProfileConfigFile -ProfileDirectory $profileDirectory -LastKnownAccountUuid 'uuid-desktop'
+        New-Utf16StorageFile -ProfileDirectory $profileDirectory -StoreName 'Session Storage' -FileName '000006.ldb' -EmailText 'first@company.com'
+        New-Utf16StorageFile -ProfileDirectory $profileDirectory -StoreName 'IndexedDB' -FileName '000007.ldb' -EmailText 'second@company.com'
+
+        $sessionAccount = Resolve-SessionAccount -CliConfigPath $cliConfigPath -ProfileDirectory $profileDirectory
+
+        $sessionAccount.ExitCode | Should -Be 1
+        $sessionAccount.ErrorMessage | Should -Match 'multiple candidate emails'
+    }
+}
+
+Describe 'Write-AccountResult' {
+    It 'writes the account fields as text without cli lines when no CliEmail is given' {
+        $textLines = Write-AccountResult -Email 'a@company.com' -AccountUuid 'uuid-a' -Source 'cli-config'
+        $joinedText = $textLines -join "`n"
+
+        $joinedText | Should -Match 'Account: a@company.com'
+        $joinedText | Should -Match 'AccountUuid: uuid-a'
+        $joinedText | Should -Match 'Source: cli-config'
+        $joinedText | Should -Not -Match 'CliAccount:'
+    }
+
+    It 'writes the cli account lines as text when a CliEmail is given' {
+        $textLines = Write-AccountResult -Email 'd@company.com' -AccountUuid 'uuid-d' -Source 'desktop-profile (differs from cli-config)' -CliEmail 'c@company.com' -CliAccountUuid 'uuid-c'
+        $joinedText = $textLines -join "`n"
+
+        $joinedText | Should -Match 'Account: d@company.com'
+        $joinedText | Should -Match 'CliAccount: c@company.com'
+        $joinedText | Should -Match 'CliAccountUuid: uuid-c'
+    }
+
+    It 'emits a JSON object carrying the account contract fields when AsJson is set' {
+        $AsJson = $true
+        $jsonOutput = Write-AccountResult -Email 'd@company.com' -AccountUuid 'uuid-d' -Source 'desktop-profile (differs from cli-config)' -CliEmail 'c@company.com' -CliAccountUuid 'uuid-c' -AsJson:$AsJson
+        $parsedResult = $jsonOutput | ConvertFrom-Json
+
+        $parsedResult.account | Should -Be 'd@company.com'
+        $parsedResult.accountUuid | Should -Be 'uuid-d'
+        $parsedResult.source | Should -Be 'desktop-profile (differs from cli-config)'
+        $parsedResult.cliAccount | Should -Be 'c@company.com'
+        $parsedResult.cliAccountUuid | Should -Be 'uuid-c'
+    }
+}

package/skills/CLAUDE.md

@@ -17,16 +17,13 @@ Skills install to `~/.claude/skills/<skill-name>/` via `packages/claude-dev-env/
 
 ## Shared support code
 
-`_shared/` — support code used by more than one skill. It holds `pr-loop/`, which provides prompt templates and Python helper scripts shared across the PR-loop skills, and `advisor/`, which provides the shared warm-advisor protocol used by `team-advisor` and `orchestrator`.
+`_shared/` — support code used by more than one skill. It holds `pr-loop/`, which provides prompt templates and Python helper scripts shared across the PR-loop skills, and `advisor/`, which provides the shared warm-advisor protocol used by `team-advisor`, `orchestrator`, and `orchestrator-refresh`.
 
 ## Skill groups
 
 **Planning and implementation**
 - `anthropic-plan` — creates a source-grounded plan packet before any code changes
-- `implement` — structured implementation from an existing plan packet
-- `bdd-protocol` — BDD depth: Example Mapping, scenario quality, outside-in layout
-- `verified-build` — build + test loop that gates on a verifier verdict
-- `orchestrator` — turns the session into the advisor-orchestrator: it spawns executor subagents to do the code edits and test runs; hard decisions go to a shared advisor (Claude warm `session-advisor` via SendMessage; Grok self-as-advisor on the orchestrating session)
+- `orchestrator` — turns the session into the orchestrator: it spawns executor subagents to do the code edits and test runs; hard decisions go to a shared advisor (Claude warm `session-advisor` via SendMessage; Grok self-as-advisor on the orchestrating session)
 - `orchestrator-refresh` — sub-skill fired by the `/orchestrator` loop to re-assert the host-matched shared-advisor discipline mid-run (Claude SendMessage; Grok self-as-advisor, no Agent spawn)
 - `team-advisor` — binds one advisor at the strongest reachable tier (Claude warm agent; Grok self-as-advisor) and consults it for a second opinion before a big decision, at completion, when stuck, or when reconsidering the approach
 
@@ -34,44 +31,25 @@ Skills install to `~/.claude/skills/<skill-name>/` via `packages/claude-dev-env/
 - `autoconverge` — autonomous single-run workflow that drives a PR to ready
 - `pr-converge` — paced convergence loop across `ScheduleWakeup` ticks
 - `bugteam` — open-loop audit-fix until convergence
-- `pr-review-responder` — fetches all reviewer comments and replies systematically
-- `pr-consistency-audit` — cross-file consistency check on a PR diff
 - `copilot-review` — requests and polls a GitHub Copilot review
-- `findbugs` / `fixbugs` — find bugs then fix them in separate passes
+- `copilot-finding-triage` — tiers each Copilot gate finding, verifies each code concern with an executed check, then routes it (auto-fix a confirmed defect, resolve a refuted one, page the user only for an inconclusive one)
 - `reviewer-gates` — availability gates for external reviewers (opt-out parse, Copilot quota, Bugbot trigger/detect)
-- `pr-scope-resolve` — one resolution ladder for a PR-loop skill's audit/fix target
-- `pr-fix-protocol` — fix, reply, and resolve reviewer findings; the unresolved-thread sweep
-- `post-audit-findings` — publishes an audit pass as one GitHub PR review
 - `pr-loop-lifecycle` — opens and closes a PR-loop run (grant, teardown, PR description, revoke, report)
 - `pr-loop-cloud-transport` — six-step transport workflow that lets any PR-loop skill run in a session whose `gh` CLI is absent or cannot act on the PR (MCP schema load, origin/HEAD fix, identity rules, the gh-to-MCP substitution matrix, the Copilot status rule, and the post self-check)
-- `code` — strict-mode code generation session
 
 **Research and discovery**
-- `deep-research` — multi-source research with citation
-- `research-mode` — activates anti-hallucination discipline for a session
 - `recall` — retrieves facts from memory files
 - `remember` — saves a decision, gotcha, or architectural choice to the Obsidian vault
 - `everything-search` — file-system search via the Everything `es.exe` CLI
-- `caveman` — trims noise from a draft artifact
 
 **Session and workflow management**
 - `session-log` — logs a session report to the Obsidian vault
 - `session-tidy` — tidies the session folder
-- `bg-agent` — launches a background agent
 - `task-build` — gathers open tasks
 - `privacy-hygiene` — full-repo personal-data and secret sweep plus remediation guide
 - `update` — updates the dev-env package
-- `gh-paginate` — safe `gh api` pagination patterns
 - `fresh-branch` — creates a clean branch off main
 - `rebase` — rebases onto main
-- `gotcha` — records a hard-won lesson to memory
-- `logifix` — restores the Logitech Gaming Software (LCore) tray icon when it disappears on Windows
-- `refine` — refinement pass on an artifact
-- `structure-prompt` — structures a freeform prompt
-- `monitor-open-prs` — polls open PRs for status
-- `pre-compact` — compact-safe session handoff
-- `qbug` — required baseline PR audit; one clean-coder subagent loops audit → fix → commit → push until clean or stuck
 - `usage-pause` — waits out the 5-hour usage window in ScheduleWakeup stages that keep agent contexts warm; probes the OAuth usage endpoint or takes a manual reset override
 - `skill-builder` — complete skill-building lifecycle
 - `auditing-claude-config` — audits a Claude Code setup for context-budget waste and produces a migration table with savings
-- `log-audit` — background agent that audits this repo's own logs for recurring errors and timing regressions and files grouped fixes