crewly 1.20.362 → 1.20.363

package/dist/cli/backend/src/services/harness/claude-token-migration.service.d.ts

@@ -0,0 +1,158 @@
+/**
+ * Claude token migration — retire the Claude sign-in tokens older Crewly
+ * versions saved, without locking anyone out.
+ *
+ * Anthropic's Claude Code legal page: developers may not collect, store or
+ * intermediate Claude.ai credentials or session tokens; sign-in must finish
+ * through Anthropic's own flow. Older Crewly ran `claude setup-token`, read
+ * the token off the screen and saved it in `harness-credentials.json`
+ * (`claude.oauthToken` for the default login, `claudeAccounts.<name>.oauthToken`
+ * for named accounts). Crewly now signs in with Claude Code's own
+ * `claude auth login` and stores nothing (login-broker.service.ts).
+ *
+ * Rules of the transition:
+ *
+ * - A saved token keeps being handed to its account's Claude Code processes
+ *   until that account is signed in natively (store.legacyClaudeTokenEnv).
+ *   Nothing stops working on upgrade.
+ * - A token is deleted only after the account's native login is verified by
+ *   a real Claude turn run WITHOUT any token or key in the env
+ *   (claude-native-login.ts). A login that only looks signed in is not enough.
+ * - A named account's own config dir can only have been signed in by Crewly's
+ *   flow or by the owner, so a verified native login there retires its token
+ *   at once (the periodic run notices a login done by hand too). The default
+ *   login is different: the machine's own Claude login may be another
+ *   account than the one the saved token belongs to, so its token is retired
+ *   only by a sign-in done through Crewly (`login claude`), never guessed.
+ * - The owner is told once per machine which accounts need one re-sign-in
+ *   (state file `claude-token-migration.json`, no secrets in it).
+ * - When no saved token remains, the leftover Claude keys are removed from
+ *   `harness-credentials.json`; other keys are untouched, the file is
+ *   rewritten atomically with mode 0600, and no backup is kept.
+ *
+ * @module services/harness/claude-token-migration.service
+ */
+import { type HarnessCredentialsStore } from './harness-credentials.store.js';
+import { type HarnessLogger, type LoginState } from './harness.types.js';
+/** A login that still depends on a token an older Crewly saved. */
+export interface LegacyTokenEntry {
+    /** Named account; null = the default login */
+    account: string | null;
+}
+/** What one run did. */
+export interface MigrationResult {
+    /** Logins whose token was deleted this run */
+    retired: Array<string | null>;
+    /** Logins that still run on a saved token (need a native sign-in) */
+    pending: Array<string | null>;
+    /** The owner notice was sent this run */
+    notified: boolean;
+}
+/** Owner DM sender. */
+export interface MigrationNotifier {
+    sendToOwner(text: string): Promise<unknown>;
+}
+/** Injectable dependencies. */
+export interface ClaudeTokenMigrationDeps {
+    credentials?: Pick<HarnessCredentialsStore, 'getLegacyClaudeOauthToken' | 'listClaudeAccountsWithToken' | 'clearLegacyClaudeOauthToken' | 'clearClaudeAccount' | 'pruneLegacyClaudeKeys'>;
+    /** Real Claude turn on Claude Code's own login, no token in the env */
+    probe?: (configDir: string | null) => Promise<LoginState>;
+    /** `claude auth status` on Claude Code's own login */
+    readStatus?: (configDir: string | null) => Promise<boolean | null>;
+    /** Config dir of a named account */
+    accountConfigDir?: (account: string) => string;
+    notifier?: () => MigrationNotifier | null;
+    /** Directory of the state file (default CREWLY_HOME) */
+    crewlyHome?: string;
+    logger?: HarnessLogger;
+    now?: () => number;
+}
+/** Retires saved Claude tokens once the account is signed in natively. */
+export declare class ClaudeTokenMigrationService {
+    private readonly credentials;
+    private readonly probe;
+    private readonly readStatus;
+    private readonly accountConfigDir;
+    private notifier;
+    private readonly crewlyHome;
+    private readonly logger;
+    private readonly now;
+    private running;
+    private timer;
+    /**
+     * @param deps - Injectable dependencies (all optional)
+     */
+    constructor(deps?: ClaudeTokenMigrationDeps);
+    /**
+     * Where the owner notice is sent.
+     *
+     * @param notifier - Lazy owner DM sender
+     */
+    setNotifier(notifier: () => MigrationNotifier | null): void;
+    /**
+     * Logins that still depend on a saved token.
+     *
+     * @returns Entries (default login first)
+     */
+    listLegacy(): LegacyTokenEntry[];
+    /**
+     * Check every login that still has a saved token; retire what can be
+     * retired and tell the owner about the rest, once. Safe to call at any
+     * time and as often as you like (idempotent); concurrent calls share one run.
+     *
+     * @returns What happened; never rejects
+     */
+    run(): Promise<MigrationResult>;
+    /**
+     * A sign-in done through Crewly just completed and was verified: retire
+     * the saved token of that login (default or named).
+     *
+     * @param account - Named account; null = the default login
+     * @returns Resolves when done; never rejects
+     */
+    afterLogin(account: string | null): Promise<void>;
+    /**
+     * Run now (after a short delay) and then on an interval.
+     *
+     * @param startDelayMs - Delay before the first run
+     */
+    start(startDelayMs?: number): void;
+    /** Stop the timers. */
+    stop(): void;
+    private hasLegacy;
+    private configDirOf;
+    /**
+     * Delete the saved token of a login when its native login passes a real
+     * Claude turn with no token in the env.
+     *
+     * @param account - Named account; null = the default login
+     * @returns True when the token was deleted
+     */
+    private retireIfVerified;
+    /** Remove leftover Claude keys once no saved token remains. */
+    private finishCleanup;
+    private runOnce;
+    private statePath;
+    private readState;
+    private writeState;
+    /**
+     * Tell the owner, once per machine, which logins need one re-sign-in.
+     *
+     * @param pending - Logins that still run on a saved token
+     * @returns True when the notice was delivered now
+     */
+    private notifyOnce;
+}
+/**
+ * The backend's token migration, bound to the stored credentials.
+ *
+ * @returns The singleton
+ */
+export declare function getClaudeTokenMigrationService(): ClaudeTokenMigrationService;
+/**
+ * Replace or clear the singleton (tests).
+ *
+ * @param service - Service, or null
+ */
+export declare function setClaudeTokenMigrationServiceForTesting(service: ClaudeTokenMigrationService | null): void;
+//# sourceMappingURL=claude-token-migration.service.d.ts.map

package/dist/cli/backend/src/services/harness/claude-token-migration.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-token-migration.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/claude-token-migration.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAQH,OAAO,EAA8B,KAAK,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAC1G,OAAO,EAAyB,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAIhG,mEAAmE;AACnE,MAAM,WAAW,gBAAgB;IAChC,8CAA8C;IAC9C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAwB;AACxB,MAAM,WAAW,eAAe;IAC/B,8CAA8C;IAC9C,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9B,qEAAqE;IACrE,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9B,yCAAyC;IACzC,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED,uBAAuB;AACvB,MAAM,WAAW,iBAAiB;IACjC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5C;AAWD,+BAA+B;AAC/B,MAAM,WAAW,wBAAwB;IACxC,WAAW,CAAC,EAAE,IAAI,CACjB,uBAAuB,EACrB,2BAA2B,GAC3B,6BAA6B,GAC7B,6BAA6B,GAC7B,oBAAoB,GACpB,uBAAuB,CACzB,CAAC;IACF,uEAAuE;IACvE,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1D,sDAAsD;IACtD,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACnE,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/C,QAAQ,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAC;IAC1C,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAYD,0EAA0E;AAC1E,qBAAa,2BAA2B;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuD;IACnF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoD;IAC1E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAwD;IACnF,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA8B;IAC/D,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,OAAO,CAAyC;IACxD,OAAO,CAAC,KAAK,CAA+B;IAE5C;;OAEG;gBACS,IAAI,GAAE,wBAA6B;IAW/C;;;;OAIG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,iBAAiB,GAAG,IAAI,GAAG,IAAI;IAI3D;;;;OAIG;IACH,UAAU,IAAI,gBAAgB,EAAE;IAOhC;;;;;;OAMG;IACH,GAAG,IAAI,OAAO,CAAC,eAAe,CAAC;IAc/B;;;;;;OAMG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAavD;;;;OAIG;IACH,KAAK,CAAC,YAAY,GAAE,MAAiC,GAAG,IAAI;IAW5D,uBAAuB;IACvB,IAAI,IAAI,IAAI;IAUZ,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,WAAW;IAInB;;;;;;OAMG;YACW,gBAAgB;IAU9B,+DAA+D;IAC/D,OAAO,CAAC,aAAa;YAIP,OAAO;IAgBrB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,UAAU;IAQlB;;;;;OAKG;YACW,UAAU;CAoBxB;AAKD;;;;GAIG;AACH,wBAAgB,8BAA8B,IAAI,2BAA2B,CAG5E;AAED;;;;GAIG;AACH,wBAAgB,wCAAwC,CAAC,OAAO,EAAE,2BAA2B,GAAG,IAAI,GAAG,IAAI,CAG1G"}

package/dist/cli/backend/src/services/harness/claude-token-migration.service.js

@@ -0,0 +1,283 @@
+/**
+ * Claude token migration — retire the Claude sign-in tokens older Crewly
+ * versions saved, without locking anyone out.
+ *
+ * Anthropic's Claude Code legal page: developers may not collect, store or
+ * intermediate Claude.ai credentials or session tokens; sign-in must finish
+ * through Anthropic's own flow. Older Crewly ran `claude setup-token`, read
+ * the token off the screen and saved it in `harness-credentials.json`
+ * (`claude.oauthToken` for the default login, `claudeAccounts.<name>.oauthToken`
+ * for named accounts). Crewly now signs in with Claude Code's own
+ * `claude auth login` and stores nothing (login-broker.service.ts).
+ *
+ * Rules of the transition:
+ *
+ * - A saved token keeps being handed to its account's Claude Code processes
+ *   until that account is signed in natively (store.legacyClaudeTokenEnv).
+ *   Nothing stops working on upgrade.
+ * - A token is deleted only after the account's native login is verified by
+ *   a real Claude turn run WITHOUT any token or key in the env
+ *   (claude-native-login.ts). A login that only looks signed in is not enough.
+ * - A named account's own config dir can only have been signed in by Crewly's
+ *   flow or by the owner, so a verified native login there retires its token
+ *   at once (the periodic run notices a login done by hand too). The default
+ *   login is different: the machine's own Claude login may be another
+ *   account than the one the saved token belongs to, so its token is retired
+ *   only by a sign-in done through Crewly (`login claude`), never guessed.
+ * - The owner is told once per machine which accounts need one re-sign-in
+ *   (state file `claude-token-migration.json`, no secrets in it).
+ * - When no saved token remains, the leftover Claude keys are removed from
+ *   `harness-credentials.json`; other keys are untouched, the file is
+ *   rewritten atomically with mode 0600, and no backup is kept.
+ *
+ * @module services/harness/claude-token-migration.service
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { HARNESS_CONSTANTS } from '../../constants.js';
+import { getCrewlyHomePath } from '../core/crewly-home.utils.js';
+import { claudeAccountConfigDir } from './claude-accounts.js';
+import { probeClaudeNativeLogin, readClaudeAuthStatus, setCachedClaudeNativeLogin } from './claude-native-login.js';
+import { getHarnessCredentialsStore } from './harness-credentials.store.js';
+import { SILENT_HARNESS_LOGGER } from './harness.types.js';
+const MIGRATION = HARNESS_CONSTANTS.CLAUDE.TOKEN_MIGRATION;
+/**
+ * Display name of a login for the owner.
+ *
+ * @param account - Named account; null = the default login
+ * @returns e.g. `login claude work` / `login claude`
+ */
+function loginCommandFor(account) {
+    return account ? `login claude ${account}` : 'login claude';
+}
+/** Retires saved Claude tokens once the account is signed in natively. */
+export class ClaudeTokenMigrationService {
+    credentials;
+    probe;
+    readStatus;
+    accountConfigDir;
+    notifier;
+    crewlyHome;
+    logger;
+    now;
+    running = null;
+    timer = null;
+    /**
+     * @param deps - Injectable dependencies (all optional)
+     */
+    constructor(deps = {}) {
+        this.credentials = deps.credentials ?? getHarnessCredentialsStore();
+        this.probe = deps.probe ?? ((configDir) => probeClaudeNativeLogin(configDir));
+        this.readStatus = deps.readStatus ?? ((configDir) => readClaudeAuthStatus(configDir));
+        this.accountConfigDir = deps.accountConfigDir ?? ((account) => claudeAccountConfigDir(account));
+        this.notifier = deps.notifier ?? (() => null);
+        this.crewlyHome = deps.crewlyHome;
+        this.logger = deps.logger ?? SILENT_HARNESS_LOGGER;
+        this.now = deps.now ?? Date.now;
+    }
+    /**
+     * Where the owner notice is sent.
+     *
+     * @param notifier - Lazy owner DM sender
+     */
+    setNotifier(notifier) {
+        this.notifier = notifier;
+    }
+    /**
+     * Logins that still depend on a saved token.
+     *
+     * @returns Entries (default login first)
+     */
+    listLegacy() {
+        const entries = [];
+        if (this.credentials.getLegacyClaudeOauthToken() !== null)
+            entries.push({ account: null });
+        for (const account of this.credentials.listClaudeAccountsWithToken())
+            entries.push({ account });
+        return entries;
+    }
+    /**
+     * Check every login that still has a saved token; retire what can be
+     * retired and tell the owner about the rest, once. Safe to call at any
+     * time and as often as you like (idempotent); concurrent calls share one run.
+     *
+     * @returns What happened; never rejects
+     */
+    run() {
+        if (!this.running) {
+            this.running = this.runOnce()
+                .catch((error) => {
+                this.logger.warn('Claude token migration failed', { error: error instanceof Error ? error.message : String(error) });
+                return { retired: [], pending: [], notified: false };
+            })
+                .finally(() => {
+                this.running = null;
+            });
+        }
+        return this.running;
+    }
+    /**
+     * A sign-in done through Crewly just completed and was verified: retire
+     * the saved token of that login (default or named).
+     *
+     * @param account - Named account; null = the default login
+     * @returns Resolves when done; never rejects
+     */
+    async afterLogin(account) {
+        try {
+            if (!this.hasLegacy(account)) {
+                this.finishCleanup();
+                return;
+            }
+            await this.retireIfVerified(account);
+            this.finishCleanup();
+        }
+        catch (error) {
+            this.logger.warn('Claude token migration after a login failed', { error: error instanceof Error ? error.message : String(error) });
+        }
+    }
+    /**
+     * Run now (after a short delay) and then on an interval.
+     *
+     * @param startDelayMs - Delay before the first run
+     */
+    start(startDelayMs = MIGRATION.START_DELAY_MS) {
+        if (this.timer)
+            return;
+        const first = setTimeout(() => {
+            void this.run();
+            this.timer = setInterval(() => void this.run(), MIGRATION.RUN_INTERVAL_MS);
+            this.timer.unref?.();
+        }, startDelayMs);
+        first.unref?.();
+        this.timer = first;
+    }
+    /** Stop the timers. */
+    stop() {
+        if (this.timer) {
+            clearTimeout(this.timer);
+            clearInterval(this.timer);
+        }
+        this.timer = null;
+    }
+    // ----------------------------------------------------------------- internals
+    hasLegacy(account) {
+        return account === null ? this.credentials.getLegacyClaudeOauthToken() !== null : this.credentials.listClaudeAccountsWithToken().includes(account);
+    }
+    configDirOf(account) {
+        return account ? this.accountConfigDir(account) : null;
+    }
+    /**
+     * Delete the saved token of a login when its native login passes a real
+     * Claude turn with no token in the env.
+     *
+     * @param account - Named account; null = the default login
+     * @returns True when the token was deleted
+     */
+    async retireIfVerified(account) {
+        const configDir = this.configDirOf(account);
+        if ((await this.probe(configDir)) !== 'logged_in')
+            return false;
+        if (account)
+            this.credentials.clearClaudeAccount(account);
+        else
+            this.credentials.clearLegacyClaudeOauthToken();
+        setCachedClaudeNativeLogin(account, true, this.now());
+        this.logger.info('Retired a saved Claude token: the account is signed in through Claude Code itself', { account: account ?? 'default' });
+        return true;
+    }
+    /** Remove leftover Claude keys once no saved token remains. */
+    finishCleanup() {
+        if (this.listLegacy().length === 0)
+            this.credentials.pruneLegacyClaudeKeys();
+    }
+    async runOnce() {
+        const result = { retired: [], pending: [], notified: false };
+        for (const { account } of this.listLegacy()) {
+            // The default login is retired only by a sign-in done through Crewly
+            // (afterLogin): the machine's own Claude login may be another account.
+            if (account !== null && (await this.readStatus(this.configDirOf(account))) === true && (await this.retireIfVerified(account))) {
+                result.retired.push(account);
+                continue;
+            }
+            result.pending.push(account);
+        }
+        this.finishCleanup();
+        if (result.pending.length > 0)
+            result.notified = await this.notifyOnce(result.pending);
+        return result;
+    }
+    statePath() {
+        return path.join(this.crewlyHome ?? getCrewlyHomePath(), MIGRATION.STATE_FILE);
+    }
+    readState() {
+        try {
+            const parsed = JSON.parse(fs.readFileSync(this.statePath(), 'utf-8'));
+            if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed))
+                return { version: 1, ...parsed };
+        }
+        catch {
+            // no state yet
+        }
+        return { version: 1 };
+    }
+    writeState(state) {
+        const file = this.statePath();
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        const tmp = `${file}.${process.pid}.tmp`;
+        fs.writeFileSync(tmp, `${JSON.stringify(state, null, 2)}\n`, { mode: HARNESS_CONSTANTS.CREDENTIALS_FILE_MODE });
+        fs.renameSync(tmp, file);
+    }
+    /**
+     * Tell the owner, once per machine, which logins need one re-sign-in.
+     *
+     * @param pending - Logins that still run on a saved token
+     * @returns True when the notice was delivered now
+     */
+    async notifyOnce(pending) {
+        if (this.readState().notifiedAt)
+            return false;
+        const notifier = this.notifier();
+        if (!notifier)
+            return false;
+        const lines = pending.map((account) => `• ${account ? `Claude account "${account}"` : 'The default Claude login'}: reply \`${loginCommandFor(account)}\``);
+        const text = [
+            'Anthropic requires Claude sign-in to finish inside Claude Code itself, so Crewly no longer saves Claude sign-in tokens.',
+            'Everything keeps working as before. Please sign these in once more, when you have a minute:',
+            ...lines,
+            'After that, the old saved token is deleted from this machine.',
+        ].join('\n');
+        try {
+            const delivered = await notifier.sendToOwner(text);
+            if (delivered === false)
+                return false;
+        }
+        catch {
+            return false;
+        }
+        this.writeState({ version: 1, notifiedAt: new Date(this.now()).toISOString(), notifiedFor: pending.map((a) => a ?? 'default') });
+        return true;
+    }
+}
+/** Backend singleton. */
+let instance = null;
+/**
+ * The backend's token migration, bound to the stored credentials.
+ *
+ * @returns The singleton
+ */
+export function getClaudeTokenMigrationService() {
+    if (!instance)
+        instance = new ClaudeTokenMigrationService();
+    return instance;
+}
+/**
+ * Replace or clear the singleton (tests).
+ *
+ * @param service - Service, or null
+ */
+export function setClaudeTokenMigrationServiceForTesting(service) {
+    instance?.stop();
+    instance = service;
+}
+//# sourceMappingURL=claude-token-migration.service.js.map

package/dist/cli/backend/src/services/harness/claude-token-migration.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-token-migration.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/claude-token-migration.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACpH,OAAO,EAAE,0BAA0B,EAAgC,MAAM,gCAAgC,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAuC,MAAM,oBAAoB,CAAC;AAEhG,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,eAAe,CAAC;AAuD3D;;;;;GAKG;AACH,SAAS,eAAe,CAAC,OAAsB;IAC9C,OAAO,OAAO,CAAC,CAAC,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;AAC7D,CAAC;AAED,0EAA0E;AAC1E,MAAM,OAAO,2BAA2B;IACtB,WAAW,CAAuD;IAClE,KAAK,CAAoD;IACzD,UAAU,CAAwD;IAClE,gBAAgB,CAA8B;IACvD,QAAQ,CAAiC;IAChC,UAAU,CAAqB;IAC/B,MAAM,CAAgB;IACtB,GAAG,CAAe;IAC3B,OAAO,GAAoC,IAAI,CAAC;IAChD,KAAK,GAA0B,IAAI,CAAC;IAE5C;;OAEG;IACH,YAAY,OAAiC,EAAE;QAC9C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,0BAA0B,EAAE,CAAC;QACpE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;QAChG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,qBAAqB,CAAC;QACnD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,QAAwC;QACnD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,UAAU;QACT,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,WAAW,CAAC,yBAAyB,EAAE,KAAK,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,2BAA2B,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAChG,OAAO,OAAO,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,GAAG;QACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE;iBAC3B,KAAK,CAAC,CAAC,KAAK,EAAmB,EAAE;gBACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACrH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACtD,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACb,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACrB,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,OAAsB;QACtC,IAAI,CAAC;YACJ,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,IAAI,CAAC,aAAa,EAAE,CAAC;gBACrB,OAAO;YACR,CAAC;YACD,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,CAAC,aAAa,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpI,CAAC;IACF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAuB,SAAS,CAAC,cAAc;QACpD,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC;YAC3E,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACtB,CAAC,EAAE,YAAY,CAAC,CAAC;QACjB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,CAAC;IAED,uBAAuB;IACvB,IAAI;QACH,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,8EAA8E;IAEtE,SAAS,CAAC,OAAsB;QACvC,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,yBAAyB,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,2BAA2B,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpJ,CAAC;IAEO,WAAW,CAAC,OAAsB;QACzC,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,gBAAgB,CAAC,OAAsB;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,WAAW;YAAE,OAAO,KAAK,CAAC;QAChE,IAAI,OAAO;YAAE,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;;YACrD,IAAI,CAAC,WAAW,CAAC,2BAA2B,EAAE,CAAC;QACpD,0BAA0B,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mFAAmF,EAAE,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;QACzI,OAAO,IAAI,CAAC;IACb,CAAC;IAED,+DAA+D;IACvD,aAAa;QACpB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,WAAW,CAAC,qBAAqB,EAAE,CAAC;IAC9E,CAAC;IAEO,KAAK,CAAC,OAAO;QACpB,MAAM,MAAM,GAAoB,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC9E,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAC7C,qEAAqE;YACrE,uEAAuE;YACvE,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC/H,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC7B,SAAS;YACV,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvF,OAAO,MAAM,CAAC;IACf,CAAC;IAEO,SAAS;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IAChF,CAAC;IAEO,SAAS;QAChB,IAAI,CAAC;YACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;YAC/E,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAI,MAAkC,EAAE,CAAC;QAC5I,CAAC;QAAC,MAAM,CAAC;YACR,eAAe;QAChB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACvB,CAAC;IAEO,UAAU,CAAC,KAAqB;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QACzC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,qBAAqB,EAAE,CAAC,CAAC;QAChH,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,UAAU,CAAC,OAA6B;QACrD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,mBAAmB,OAAO,GAAG,CAAC,CAAC,CAAC,0BAA0B,aAAa,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3J,MAAM,IAAI,GAAG;YACZ,yHAAyH;YACzH,6FAA6F;YAC7F,GAAG,KAAK;YACR,+DAA+D;SAC/D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,SAAS,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;QACjI,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AAED,yBAAyB;AACzB,IAAI,QAAQ,GAAuC,IAAI,CAAC;AAExD;;;;GAIG;AACH,MAAM,UAAU,8BAA8B;IAC7C,IAAI,CAAC,QAAQ;QAAE,QAAQ,GAAG,IAAI,2BAA2B,EAAE,CAAC;IAC5D,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wCAAwC,CAAC,OAA2C;IACnG,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjB,QAAQ,GAAG,OAAO,CAAC;AACpB,CAAC"}

package/dist/cli/backend/src/services/harness/harness-credentials.store.d.ts

@@ -1,9 +1,14 @@
 /**
  * Harness credentials store — the harness logins Crewly itself holds.
  *
- * Claude Code's `setup-token` prints a long-lived OAuth token instead of
- * saving it, and an Anthropic API key has to reach agents somehow; both live
- * here, in `<crewlyHome>/harness-credentials.json` with mode 0600. Codex
+ * An Anthropic API key has to reach agents somehow, so it lives here, in
+ * `<crewlyHome>/harness-credentials.json` with mode 0600. Crewly no longer
+ * saves Claude.ai sign-in tokens: Claude Code stores its own login (config
+ * dir or keychain) and Anthropic's rules say developers may not collect or
+ * store those. Older versions did save a `claude setup-token` token here
+ * (`claude.oauthToken`, `claudeAccounts.<name>.oauthToken`); that data is
+ * only read to keep an account working until the owner signs it in again,
+ * then deleted (services/harness/claude-token-migration.service.ts). Codex
  * writes its own credentials (`$CODEX_HOME/auth.json`), so nothing is stored
  * for it unless a future flow needs the key. Antigravity CLI reads its Gemini
  * API key only from the environment, so Crewly keeps that key here too.
@@ -19,7 +24,7 @@
 /** Stored credentials. Every field is optional. */
 export interface HarnessCredentials {
     claude?: {
-        /** Long-lived token from `claude setup-token` (exported as CLAUDE_CODE_OAUTH_TOKEN) */
+        /** LEGACY, read-only: token an older Crewly saved from `claude setup-token`; removed by the migration */
         oauthToken?: string;
         /** Anthropic API key (exported as ANTHROPIC_API_KEY) */
         anthropicApiKey?: string;
@@ -81,14 +86,6 @@ export declare class HarnessCredentialsStore {
      * @param credentials - Full credentials object
      */
     write(credentials: HarnessCredentials): void;
-    /**
-     * Store Claude's long-lived OAuth token. Replaces a stored API key, so
-     * agents use exactly the login the owner chose last.
-     *
-     * @param token - Token printed by `claude setup-token`
-     * @throws Error when the token is empty
-     */
-    setClaudeOauthToken(token: string): void;
     /**
      * Store an Anthropic API key. Replaces a stored OAuth token.
      *
@@ -125,15 +122,8 @@ export declare class HarnessCredentialsStore {
      */
     clearClaude(): void;
     /**
-     * Store the `setup-token` token of one of the owner's other Claude Code accounts.
-     *
-     * @param account - Account name (validated by the caller)
-     * @param token - Token printed by `claude setup-token`
-     * @throws Error when the token is empty
-     */
-    setClaudeAccountToken(account: string, token: string): void;
-    /**
-     * The stored token of one of the owner's other Claude Code accounts.
+     * LEGACY: the token an older Crewly saved for one of the owner's other
+     * Claude Code accounts (never written any more).
      *
      * @param account - Account name
      * @returns The token, or null when none is stored
@@ -146,11 +136,41 @@ export declare class HarnessCredentialsStore {
      */
     listClaudeAccountsWithToken(): string[];
     /**
-     * Forget the token of one of the owner's other Claude Code accounts.
+     * Forget the token of one of the owner's other Claude Code accounts. The
+     * `claudeAccounts` key goes away with its last entry.
      *
      * @param account - Account name
      */
     clearClaudeAccount(account: string): void;
+    /**
+     * LEGACY: the default login's token an older Crewly saved.
+     *
+     * @returns The token, or null
+     */
+    getLegacyClaudeOauthToken(): string | null;
+    /**
+     * Delete the default login's legacy token. The `claude` key is removed
+     * when nothing but bookkeeping is left (a stored API key stays).
+     */
+    clearLegacyClaudeOauthToken(): void;
+    /**
+     * Remove what an older Crewly left for Claude sign-in tokens once no token
+     * is stored: empty `claudeAccounts` entries or object, an empty
+     * `claude.oauthToken`, and a `claude` object holding nothing but
+     * bookkeeping. A stored API key and every other key stay untouched. Does
+     * nothing (and does not rewrite the file) when there is nothing to remove.
+     */
+    pruneLegacyClaudeKeys(): void;
+    /**
+     * Env that keeps an account working with the token an older Crewly saved
+     * for it. LEGACY, transition only: empty once the account's native login
+     * is verified and the token deleted. This is the only place the token is
+     * handed to a Claude Code process.
+     *
+     * @param account - Named account; null = the default login
+     * @returns `{ CLAUDE_CODE_OAUTH_TOKEN }`, or `{}` when no token is stored
+     */
+    legacyClaudeTokenEnv(account: string | null): Record<string, string>;
     /**
      * Which Claude credential Crewly holds (never the value).
      *
@@ -161,8 +181,8 @@ export declare class HarnessCredentialsStore {
      * Env vars to inject into agent sessions.
      *
      * Always sets PATH (user npm prefix bin first, see harness-exec.utils).
-     * Adds `CLAUDE_CODE_OAUTH_TOKEN` or `ANTHROPIC_API_KEY` when Crewly holds
-     * a Claude credential. Nothing is added for Codex: it reads its own
+     * Adds `ANTHROPIC_API_KEY` when Crewly holds one (and, during the token
+     * migration only, the legacy token of the default login). Nothing is added for Codex: it reads its own
      * `auth.json`.
      *
      * For an `antigravity-cli` session it also adds the stored Gemini key as

package/dist/cli/backend/src/services/harness/harness-credentials.store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"harness-credentials.store.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/harness-credentials.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAQH,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IAClC,MAAM,CAAC,EAAE;QACR,uFAAuF;QACvF,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,wDAAwD;QACxD,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,KAAK,CAAC,EAAE;QACP,iFAAiF;QACjF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,WAAW,CAAC,EAAE;QACb,2GAA2G;QAC3G,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7E;AAED,gDAAgD;AAChD,MAAM,MAAM,sBAAsB,GAAG,aAAa,GAAG,SAAS,GAAG,IAAI,CAAC;AAYtE;;;;;GAKG;AACH,qBAAa,uBAAuB;IAKvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAJtC;;;OAGG;gBAC0B,QAAQ,CAAC,EAAE,MAAM,YAAA;IAE9C;;;;OAIG;IACH,WAAW,IAAI,MAAM;IAIrB;;;;OAIG;IACH,IAAI,IAAI,kBAAkB;IAS1B;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAe5C;;;;;;OAMG;IACH,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAMxC;;;;;OAKG;IACH,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMrC;;;;;OAKG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMlC;;;;;OAKG;IACH,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAM7C;;;;OAIG;IACH,0BAA0B,IAAI,MAAM,GAAG,IAAI;IAK3C;;OAEG;IACH,gBAAgB,IAAI,IAAI;IAQxB;;OAEG;IACH,WAAW,IAAI,IAAI;IAQnB;;;;;;OAMG;IACH,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAS3D;;;;;OAKG;IACH,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAKrD;;;;OAIG;IACH,2BAA2B,IAAI,MAAM,EAAE;IAKvC;;;;OAIG;IACH,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAQzC;;;;OAIG;IACH,uBAAuB,IAAI,sBAAsB;IAOjD;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAAmB,CAAC,OAAO,GAAE,MAAM,CAAC,UAAwB,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAgB3G;AAKD;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,uBAAuB,CAEpE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,MAAM,CAAC,UAAwB,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM1H"}
+{"version":3,"file":"harness-credentials.store.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/harness-credentials.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAQH,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IAClC,MAAM,CAAC,EAAE;QACR,yGAAyG;QACzG,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,wDAAwD;QACxD,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,KAAK,CAAC,EAAE;QACP,iFAAiF;QACjF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,WAAW,CAAC,EAAE;QACb,2GAA2G;QAC3G,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7E;AAED,gDAAgD;AAChD,MAAM,MAAM,sBAAsB,GAAG,aAAa,GAAG,SAAS,GAAG,IAAI,CAAC;AAYtE;;;;;GAKG;AACH,qBAAa,uBAAuB;IAKvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAJtC;;;OAGG;gBAC0B,QAAQ,CAAC,EAAE,MAAM,YAAA;IAE9C;;;;OAIG;IACH,WAAW,IAAI,MAAM;IAIrB;;;;OAIG;IACH,IAAI,IAAI,kBAAkB;IAS1B;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAe5C;;;;;OAKG;IACH,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMrC;;;;;OAKG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMlC;;;;;OAKG;IACH,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAM7C;;;;OAIG;IACH,0BAA0B,IAAI,MAAM,GAAG,IAAI;IAK3C;;OAEG;IACH,gBAAgB,IAAI,IAAI;IAQxB;;OAEG;IACH,WAAW,IAAI,IAAI;IAQnB;;;;;;OAMG;IACH,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAKrD;;;;OAIG;IACH,2BAA2B,IAAI,MAAM,EAAE;IAKvC;;;;;OAKG;IACH,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAWzC;;;;OAIG;IACH,yBAAyB,IAAI,MAAM,GAAG,IAAI;IAK1C;;;OAGG;IACH,2BAA2B,IAAI,IAAI;IAUnC;;;;;;OAMG;IACH,qBAAqB,IAAI,IAAI;IAyB7B;;;;;;;;OAQG;IACH,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAKpE;;;;OAIG;IACH,uBAAuB,IAAI,sBAAsB;IAOjD;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAAmB,CAAC,OAAO,GAAE,MAAM,CAAC,UAAwB,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAiB3G;AAKD;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,uBAAuB,CAEpE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,MAAM,CAAC,UAAwB,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM1H"}