claude-dev-env 8.82.0 → 8.82.1

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.82.0",
+    "version": "8.82.1",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/scripts/account_broker_support.py

@@ -26,7 +26,7 @@ else:
 import codex_account_choice
 import codex_account_meters
 from claude_account_profile import default_profile_home, validate_profile_name
-from claude_chain_usage import WeeklyUtilizationProbeError, probe_account_meters
+from claude_chain_usage import ClaudeSignedOutError, WeeklyUtilizationProbeError, probe_account_meters
 from dev_env_scripts_constants.account_broker_constants import (
     ALL_BATCH_FILE_EXTENSIONS,
     ALL_CLAUDE_BINARY_CANDIDATE_RELATIVE_PARTS,
@@ -41,6 +41,7 @@ from dev_env_scripts_constants.account_broker_constants import (
     CMD_SHELL_METACHARACTERS,
     Decision,
     JobOutcome,
+    ALL_LOGIN_REFRESH_ENVIRONMENT,
     LOGIN_REFRESH_TIMEOUT_SECONDS,
     METER_READ_ATTEMPTS,
     Meters,
@@ -253,7 +254,7 @@ def refresh_claude_login(account_home: Path) -> bool:
     claude_path = resolve_claude_path()
     if claude_path is None:
         return False
-    refresh_environment = {**os.environ, CLAUDE_CONFIG_DIR_ENV_VAR: str(account_home)}
+    refresh_environment = {**os.environ, **ALL_LOGIN_REFRESH_ENVIRONMENT, CLAUDE_CONFIG_DIR_ENV_VAR: str(account_home)}
     try:
         subprocess.run(
             [str(claude_path), *ALL_LOGIN_REFRESH_ARGUMENTS],
@@ -325,7 +326,7 @@ def read_meters_with_backoff(read_meters: Callable[[Account], Meters | None], ac
     Returns:
         The meters from the first read that succeeds, or None with the last
         failure text once every attempt failed. A missing Codex executable
-        fails at once, without a retry.
+        or a signed-out Claude account fails at once, without a retry.
     """
     unread_reason = None
     for each_attempt in range(METER_READ_ATTEMPTS):
@@ -333,7 +334,7 @@ def read_meters_with_backoff(read_meters: Callable[[Account], Meters | None], ac
             time.sleep(meter_read_delay_seconds(each_attempt))
         try:
             return read_meters(account), None
-        except codex_account_meters.CodexExecutableNotFoundError as error:
+        except (codex_account_meters.CodexExecutableNotFoundError, ClaudeSignedOutError) as error:
             return None, str(error)
         except (
             codex_account_meters.CodexMeterUnreadError,

package/scripts/claude_chain_usage.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import http.client
 import importlib.util
+import json
 import sys
 import urllib.error
 from dataclasses import dataclass
@@ -13,6 +14,8 @@ from types import ModuleType
 from typing import Callable
 
 from dev_env_scripts_constants.claude_chain_usage_constants import (
+    CREDENTIALS_OAUTH_SECTION_KEY,
+    CREDENTIALS_REFRESH_TOKEN_KEY,
     NO_ACCESS_TOKEN_ERROR_TEMPLATE,
     RESOLVE_USAGE_WINDOW_FILENAME,
     RESOLVE_USAGE_WINDOW_MISSING_ERROR_TEMPLATE,
@@ -29,6 +32,10 @@ class WeeklyUtilizationProbeError(Exception):
     """Raised when an account's usage meters cannot be measured."""
 
 
+class ClaudeSignedOutError(WeeklyUtilizationProbeError):
+    """Raised when an account has no usable token and no way to get one, so a retry cannot help."""
+
+
 def _usage_pause_scripts_directory(module_file: Path) -> Path:
     """Return the usage-pause scripts directory beside this scripts tree.
 
@@ -111,6 +118,24 @@ class AccountUsageMeters:
     weekly_resets_at: datetime | None
 
 
+def _holds_refresh_token(credentials_path: Path) -> bool:
+    """Report whether a credential file holds a refresh token the CLI can renew a login from.
+
+    Args:
+        credentials_path: The account's CLI credential file.
+
+    Returns:
+        True when the file's OAuth section carries a non-empty refresh token.
+    """
+    try:
+        credentials_payload = json.loads(credentials_path.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return False
+    oauth_section = credentials_payload.get(CREDENTIALS_OAUTH_SECTION_KEY) if isinstance(credentials_payload, dict) else None
+    refresh_token = oauth_section.get(CREDENTIALS_REFRESH_TOKEN_KEY) if isinstance(oauth_section, dict) else None
+    return isinstance(refresh_token, str) and bool(refresh_token)
+
+
 def _read_access_token(
     usage_window_resolver: ModuleType,
     credentials_path: Path,
@@ -123,6 +148,7 @@ def _read_access_token(
 
         credential file holds a token                ->  that token
         token expired, refresh_login saves a new one ->  the new token
+        no token and no refresh token (signed out)   ->  no refresh_login call
         no token, the session's own credential path  ->  the session ingress token
         no token, another account's credential path  ->  None
 
@@ -142,7 +168,7 @@ def _read_access_token(
     file_token = usage_window_resolver.read_oauth_access_token(credentials_path, now)
     if file_token is not None:
         return file_token
-    if refresh_login is not None and credentials_path.is_file():
+    if refresh_login is not None and _holds_refresh_token(credentials_path):
         refresh_login(credentials_path.parent)
         refreshed_token = usage_window_resolver.read_oauth_access_token(credentials_path, datetime.now().astimezone())
         if refreshed_token is not None:
@@ -162,7 +188,7 @@ def _fetch_account_usage_payload(
     try:
         access_token = _read_access_token(usage_window_resolver, credentials_path, now, refresh_login)
         if access_token is None:
-            raise WeeklyUtilizationProbeError(
+            raise ClaudeSignedOutError(
                 NO_ACCESS_TOKEN_ERROR_TEMPLATE.format(credentials_path=credentials_path)
             )
         return usage_window_resolver._fetch_usage_payload(access_token)

package/scripts/dev_env_scripts_constants/account_broker_constants.py

@@ -68,7 +68,33 @@ ALL_CLAUDE_BINARY_CANDIDATE_RELATIVE_PARTS: tuple[tuple[str, ...], ...] = (
     (".local", "bin", "claude.exe"),
     (".local", "bin", "claude"),
 )
-ALL_LOGIN_REFRESH_ARGUMENTS: tuple[str, ...] = ("-p", "ok", "--model", "haiku")
+ALL_LOGIN_REFRESH_ARGUMENTS: tuple[str, ...] = (
+    "-p",
+    "ok",
+    "--model",
+    "haiku",
+    "--setting-sources",
+    "local",
+    "--settings",
+    '{"enabledPlugins": {}, "autoMemoryEnabled": false}',
+    "--strict-mcp-config",
+    "--mcp-config",
+    '{"mcpServers": {}}',
+    "--no-session-persistence",
+    "--disable-slash-commands",
+    "--tools",
+    "",
+    "--max-turns",
+    "1",
+)
+ALL_LOGIN_REFRESH_ENVIRONMENT: dict[str, str] = {
+    "CLAUDE_CODE_DISABLE_CLAUDE_MDS": "1",
+    "CLAUDE_CODE_DISABLE_AUTO_MEMORY": "1",
+    "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1",
+    "DISABLE_TELEMETRY": "1",
+    "DISABLE_ERROR_REPORTING": "1",
+    "DISABLE_AUTOUPDATER": "1",
+}
 LOGIN_REFRESH_TIMEOUT_SECONDS = 120.0
 ALL_PARENT_CLAUDE_SESSION_VARIABLES: frozenset[str] = frozenset({
     "CLAUDE_CODE_SESSION_ID",

package/scripts/dev_env_scripts_constants/claude_chain_usage_constants.py

@@ -42,6 +42,12 @@ JSON_ERROR_KEY: str = "error"
 CLI_CONFIG_PATH_FLAG: str = "--config-path"
 """CLI flag that overrides the chain configuration file path."""
 
+CREDENTIALS_OAUTH_SECTION_KEY: str = "claudeAiOauth"
+"""Credential file key holding the CLI's OAuth login."""
+
+CREDENTIALS_REFRESH_TOKEN_KEY: str = "refreshToken"
+"""OAuth section key holding the token the CLI renews a login from; empty when signed out."""
+
 NO_ACCESS_TOKEN_ERROR_TEMPLATE: str = (
     "no usable bearer token from the OAuth credential file at {credentials_path}"
 )

package/scripts/test_account_broker_support.py

@@ -348,6 +348,22 @@ def test_should_cap_the_meter_read_delay(monkeypatch: pytest.MonkeyPatch, tmp_pa
     assert all_delays == [1.0, 2.0, 4.0, 8.0, 8.0]
 
 
+def test_should_read_a_signed_out_claude_account_once(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    all_delays = _recorded_sleeps(monkeypatch)
+    all_reads: list[Account] = []
+
+    def signed_out_reader(account: Account) -> Meters:
+        all_reads.append(account)
+        raise support.ClaudeSignedOutError("no usable bearer token")
+
+    meters, unread_reason = support.read_meters_with_backoff(signed_out_reader, Account(Product.CLAUDE, "main", tmp_path))
+
+    assert meters is None
+    assert unread_reason == "no usable bearer token"
+    assert len(all_reads) == 1
+    assert all_delays == []
+
+
 def test_should_cache_account_reading_under_injected_state_path(
     monkeypatch: pytest.MonkeyPatch, tmp_path: Path
 ) -> None:
@@ -604,19 +620,35 @@ def test_should_match_order_names_to_an_account_named_by_its_windows_launcher_pa
 
 
 def test_should_run_the_cli_against_the_account_home(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-    all_calls: list[tuple[list[str], str]] = []
+    all_calls: list[tuple[list[str], dict[str, str]]] = []
 
     def fake_run(command: list[str], **keyword_arguments: object) -> subprocess.CompletedProcess[bytes]:
         environment = keyword_arguments["env"]
         assert isinstance(environment, dict)
-        all_calls.append((command, environment["CLAUDE_CONFIG_DIR"]))
+        all_calls.append((command, environment))
         return subprocess.CompletedProcess(command, 0)
 
     monkeypatch.setattr(support, "resolve_claude_path", lambda: Path("claude"))
     monkeypatch.setattr(support.subprocess, "run", fake_run)
 
     assert support.refresh_claude_login(tmp_path) is True
-    assert all_calls == [(["claude", "-p", "ok", "--model", "haiku"], str(tmp_path))]
+    [(command, environment)] = all_calls
+    assert command[:5] == ["claude", "-p", "ok", "--model", "haiku"]
+    assert command[command.index("--setting-sources") + 1] == "local"
+    assert json.loads(command[command.index("--settings") + 1]) == {"enabledPlugins": {}, "autoMemoryEnabled": False}
+    assert "--strict-mcp-config" in command
+    assert json.loads(command[command.index("--mcp-config") + 1]) == {"mcpServers": {}}
+    assert "--no-session-persistence" in command
+    assert "--disable-slash-commands" in command
+    assert command[command.index("--tools") + 1] == ""
+    assert command[command.index("--max-turns") + 1] == "1"
+    assert environment["CLAUDE_CONFIG_DIR"] == str(tmp_path)
+    assert environment["CLAUDE_CODE_DISABLE_CLAUDE_MDS"] == "1"
+    assert environment["CLAUDE_CODE_DISABLE_AUTO_MEMORY"] == "1"
+    assert environment["CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC"] == "1"
+    assert environment["DISABLE_TELEMETRY"] == "1"
+    assert environment["DISABLE_ERROR_REPORTING"] == "1"
+    assert environment["DISABLE_AUTOUPDATER"] == "1"
 
 
 def test_should_skip_the_refresh_without_a_cli(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:

package/scripts/test_claude_chain_usage.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import json
 import subprocess
 import sys
 import urllib.error
@@ -212,11 +213,18 @@ def _expiring_resolver(all_tokens: list[str | None], all_fetched_tokens: list[st
     return Resolver()
 
 
+def _write_credentials(credentials_path: Path, refresh_token: str) -> None:
+    credentials_path.write_text(
+        json.dumps({"claudeAiOauth": {"accessToken": "", "refreshToken": refresh_token, "expiresAt": 0}}),
+        encoding="utf-8",
+    )
+
+
 def test_should_refresh_an_expired_login_and_read_the_meter(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
     account_home = tmp_path / "ev"
     account_home.mkdir()
     credentials_path = account_home / ".credentials.json"
-    credentials_path.write_text("{}", encoding="utf-8")
+    _write_credentials(credentials_path, "refresh-value")
     all_refreshed_homes: list[Path] = []
     all_fetched_tokens: list[str] = []
     monkeypatch.setattr(usage, "_load_resolve_usage_window_module", lambda: _expiring_resolver([None, "fresh-token"], all_fetched_tokens))
@@ -230,8 +238,23 @@ def test_should_refresh_an_expired_login_and_read_the_meter(monkeypatch: pytest.
 
 def test_should_report_no_token_when_the_refresh_saves_none(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
     credentials_path = tmp_path / ".credentials.json"
-    credentials_path.write_text("{}", encoding="utf-8")
+    _write_credentials(credentials_path, "refresh-value")
     monkeypatch.setattr(usage, "_load_resolve_usage_window_module", lambda: _expiring_resolver([None, None], []))
 
-    with pytest.raises(usage.WeeklyUtilizationProbeError, match="bearer token"):
+    with pytest.raises(usage.ClaudeSignedOutError, match="bearer token"):
         usage.probe_account_meters(credentials_path, lambda home: True)
+
+
+@pytest.mark.parametrize("credentials_text", ["{}", '{"claudeAiOauth": {"accessToken": "", "refreshToken": "", "expiresAt": 0}}', "not json"])
+def test_should_skip_the_refresh_for_a_signed_out_account(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path, credentials_text: str
+) -> None:
+    credentials_path = tmp_path / ".credentials.json"
+    credentials_path.write_text(credentials_text, encoding="utf-8")
+    all_refreshed_homes: list[Path] = []
+    monkeypatch.setattr(usage, "_load_resolve_usage_window_module", lambda: _expiring_resolver([None], []))
+
+    with pytest.raises(usage.ClaudeSignedOutError, match="bearer token"):
+        usage.probe_account_meters(credentials_path, all_refreshed_homes.append)
+
+    assert all_refreshed_homes == []