crewly 1.20.362 → 1.20.364

package/dist/backend/backend/src/services/harness/claude-native-login.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Claude Code's own login state: is a config dir (or the default login)
+ * signed in through Claude Code itself?
+ *
+ * Crewly does not collect, store or intermediate Claude.ai credentials
+ * (Anthropic's Claude Code legal page). Claude Code keeps its own login in
+ * `<config dir>/.credentials.json` or, on macOS, in the keychain, so a file
+ * check alone is wrong on a Mac: the default login of a Mac has no
+ * `.credentials.json` at all. Two questions are therefore asked of the CLI
+ * itself, always with Crewly's own env (no `CLAUDE_CODE_OAUTH_TOKEN`, no API
+ * key) so a token can never make a login look native:
+ *
+ * - {@link readClaudeAuthStatus}: `claude auth status --json`, the CLI's own
+ *   record (`loggedIn`). Cheap, no network turn, but it keeps saying
+ *   `loggedIn: true` for an expired login. Feeds the sync "signed in" flag.
+ * - {@link probeClaudeNativeLogin}: one tiny real turn. This is the
+ *   verification the token migration waits for before it deletes anything.
+ *
+ * Neither prints or reads a credential: only the exit code and the output
+ * of the CLI are looked at.
+ *
+ * @module services/harness/claude-native-login
+ */
+import type { LoginState, RunCommand } from './harness.types.js';
+/** Injectable dependencies. */
+export interface ClaudeNativeLoginDeps {
+    run?: RunCommand;
+    /** Base env (default process.env) */
+    env?: NodeJS.ProcessEnv;
+    homeDir?: string;
+    /** PATH lookup of the `claude` binary */
+    resolveCommand?: (command: string) => string | null;
+    /** Scratch directory the probe turn runs in */
+    scratchDir?: string;
+    timeoutMs?: number;
+    now?: () => number;
+}
+/**
+ * Env to ask Claude Code about its OWN login: the caller's env without any
+ * token or key, pointed at a config dir (or the default login's).
+ *
+ * @param baseEnv - Starting env
+ * @param configDir - A named account's config dir; null = the default login
+ * @returns Env for the child process
+ */
+export declare function nativeLoginEnv(baseEnv: NodeJS.ProcessEnv, configDir: string | null): NodeJS.ProcessEnv;
+/**
+ * Ask the CLI whether it is signed in (`claude auth status --json`).
+ *
+ * @param configDir - A named account's config dir; null = the default login
+ * @param deps - Dependencies
+ * @returns `loggedIn` as the CLI reports it, or null when it could not be asked
+ */
+export declare function readClaudeAuthStatus(configDir: string | null, deps?: ClaudeNativeLoginDeps): Promise<boolean | null>;
+/**
+ * Refresh the cached `claude auth status` answer of accounts.
+ *
+ * @param accounts - Account configs: `account` is the name (null = default login), `configDir` its dir (null = default)
+ * @param deps - Dependencies
+ * @param maxAgeMs - Skip an account answered this recently
+ * @returns Resolves when every account was asked (an unanswered one keeps its old answer)
+ */
+export declare function refreshClaudeNativeLogins(accounts: ReadonlyArray<{
+    account: string | null;
+    configDir: string | null;
+}>, deps?: ClaudeNativeLoginDeps, maxAgeMs?: number): Promise<void>;
+/**
+ * The last `claude auth status` answer for an account.
+ *
+ * @param account - Account name; null = the default login
+ * @returns True/false, or undefined when never asked
+ */
+export declare function cachedClaudeNativeLogin(account: string | null): boolean | undefined;
+/**
+ * Set the cached answer (after a verified login or sign-out).
+ *
+ * @param account - Account name; null = the default login
+ * @param loggedIn - New answer
+ * @param now - Clock
+ */
+export declare function setCachedClaudeNativeLogin(account: string | null, loggedIn: boolean, now?: number): void;
+/** Forget every cached answer (tests). */
+export declare function resetClaudeNativeLoginCache(): void;
+/**
+ * Classify the output of a probe turn.
+ *
+ * @param result - Exit code and output
+ * @returns `logged_out` on a login-expiry message; `logged_in` when the turn
+ *   worked or the account answered with a usage limit (a limit proves the
+ *   login works); else `unknown`
+ */
+export declare function classifyNativeProbe(result: {
+    code: number | null;
+    stdout: string;
+    stderr: string;
+}): LoginState;
+/**
+ * Verify a login with one real Claude turn on Claude Code's own login, with
+ * no token or key in the env.
+ *
+ * @param configDir - A named account's config dir; null = the default login
+ * @param deps - Dependencies
+ * @returns `logged_in`, `logged_out` or `unknown`; never rejects
+ */
+export declare function probeClaudeNativeLogin(configDir: string | null, deps?: ClaudeNativeLoginDeps): Promise<LoginState>;
+//# sourceMappingURL=claude-native-login.d.ts.map

package/dist/backend/backend/src/services/harness/claude-native-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-native-login.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/claude-native-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAQH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGjE,+BAA+B;AAC/B,MAAM,WAAW,qBAAqB;IACrC,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,qCAAqC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACpD,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAWD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,UAAU,CAOtG;AAeD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAa9H;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC9C,QAAQ,EAAE,aAAa,CAAC;IAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,EAC7E,IAAI,GAAE,qBAA0B,EAChC,QAAQ,SAAS,GACf,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,GAAG,SAAS,CAEnF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,GAAE,MAAmB,GAAG,IAAI,CAEpH;AAED,0CAA0C;AAC1C,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAO/G;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,UAAU,CAAC,CAW5H"}

package/dist/backend/backend/src/services/harness/claude-native-login.js

@@ -0,0 +1,174 @@
+/**
+ * Claude Code's own login state: is a config dir (or the default login)
+ * signed in through Claude Code itself?
+ *
+ * Crewly does not collect, store or intermediate Claude.ai credentials
+ * (Anthropic's Claude Code legal page). Claude Code keeps its own login in
+ * `<config dir>/.credentials.json` or, on macOS, in the keychain, so a file
+ * check alone is wrong on a Mac: the default login of a Mac has no
+ * `.credentials.json` at all. Two questions are therefore asked of the CLI
+ * itself, always with Crewly's own env (no `CLAUDE_CODE_OAUTH_TOKEN`, no API
+ * key) so a token can never make a login look native:
+ *
+ * - {@link readClaudeAuthStatus}: `claude auth status --json`, the CLI's own
+ *   record (`loggedIn`). Cheap, no network turn, but it keeps saying
+ *   `loggedIn: true` for an expired login. Feeds the sync "signed in" flag.
+ * - {@link probeClaudeNativeLogin}: one tiny real turn. This is the
+ *   verification the token migration waits for before it deletes anything.
+ *
+ * Neither prints or reads a credential: only the exit code and the output
+ * of the CLI are looked at.
+ *
+ * @module services/harness/claude-native-login
+ */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { HARNESS_CONSTANTS, RUNTIME_TYPES } from '../../constants.js';
+import { detectUsageLimit, isExhaustingKind } from '../runtime-fallback/usage-limit-rules.js';
+import { buildHarnessPath, resolveExecutable, runCommand } from './harness-exec.utils.js';
+import { detectLoginExpiry } from './login-expiry-rules.js';
+/** Env that would nest the run in a Claude session or leak Crewly's API token. */
+const NESTED_ENV = ['CREWLY_API_TOKEN', 'CLAUDECODE', 'CLAUDE_CODE_ENTRYPOINT', 'CLAUDE_CODE_SSE_PORT'];
+/** Cache key of the default login. */
+const DEFAULT_KEY = '';
+/** Last `claude auth status` answer per account (`''` = the default login). */
+const statusCache = new Map();
+/**
+ * Env to ask Claude Code about its OWN login: the caller's env without any
+ * token or key, pointed at a config dir (or the default login's).
+ *
+ * @param baseEnv - Starting env
+ * @param configDir - A named account's config dir; null = the default login
+ * @returns Env for the child process
+ */
+export function nativeLoginEnv(baseEnv, configDir) {
+    const env = { ...baseEnv };
+    delete env[HARNESS_CONSTANTS.CLAUDE.OAUTH_TOKEN_ENV];
+    delete env[HARNESS_CONSTANTS.CLAUDE.API_KEY_ENV];
+    for (const name of NESTED_ENV)
+        delete env[name];
+    if (configDir)
+        env[HARNESS_CONSTANTS.CLAUDE.CONFIG_DIR_ENV] = configDir;
+    return env;
+}
+/**
+ * Resolve the claude binary and base env once per call.
+ *
+ * @param deps - Dependencies
+ * @returns Binary path (or null), base env and the runner
+ */
+function setup(deps) {
+    const env = deps.env ?? process.env;
+    const homeDir = deps.homeDir ?? os.homedir();
+    const resolve = deps.resolveCommand ?? ((command) => resolveExecutable(command, buildHarnessPath(env.PATH, homeDir)));
+    return { binary: resolve('claude'), env, run: deps.run ?? runCommand, timeoutMs: deps.timeoutMs ?? HARNESS_CONSTANTS.RELOGIN.PROBE_TIMEOUT_MS };
+}
+/**
+ * Ask the CLI whether it is signed in (`claude auth status --json`).
+ *
+ * @param configDir - A named account's config dir; null = the default login
+ * @param deps - Dependencies
+ * @returns `loggedIn` as the CLI reports it, or null when it could not be asked
+ */
+export async function readClaudeAuthStatus(configDir, deps = {}) {
+    try {
+        const { binary, env, run, timeoutMs } = setup(deps);
+        if (!binary)
+            return null;
+        const result = await run(binary, ['auth', 'status', '--json'], { env: nativeLoginEnv(env, configDir), timeoutMs });
+        const parsed = JSON.parse(result.stdout);
+        if (parsed !== null && typeof parsed === 'object' && typeof parsed.loggedIn === 'boolean') {
+            return parsed.loggedIn;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Refresh the cached `claude auth status` answer of accounts.
+ *
+ * @param accounts - Account configs: `account` is the name (null = default login), `configDir` its dir (null = default)
+ * @param deps - Dependencies
+ * @param maxAgeMs - Skip an account answered this recently
+ * @returns Resolves when every account was asked (an unanswered one keeps its old answer)
+ */
+export async function refreshClaudeNativeLogins(accounts, deps = {}, maxAgeMs = 60_000) {
+    const now = (deps.now ?? Date.now)();
+    for (const { account, configDir } of accounts) {
+        const key = account ?? DEFAULT_KEY;
+        const known = statusCache.get(key);
+        if (known && now - known.at < maxAgeMs)
+            continue;
+        const loggedIn = await readClaudeAuthStatus(configDir, deps);
+        if (loggedIn !== null)
+            statusCache.set(key, { loggedIn, at: now });
+    }
+}
+/**
+ * The last `claude auth status` answer for an account.
+ *
+ * @param account - Account name; null = the default login
+ * @returns True/false, or undefined when never asked
+ */
+export function cachedClaudeNativeLogin(account) {
+    return statusCache.get(account ?? DEFAULT_KEY)?.loggedIn;
+}
+/**
+ * Set the cached answer (after a verified login or sign-out).
+ *
+ * @param account - Account name; null = the default login
+ * @param loggedIn - New answer
+ * @param now - Clock
+ */
+export function setCachedClaudeNativeLogin(account, loggedIn, now = Date.now()) {
+    statusCache.set(account ?? DEFAULT_KEY, { loggedIn, at: now });
+}
+/** Forget every cached answer (tests). */
+export function resetClaudeNativeLoginCache() {
+    statusCache.clear();
+}
+/**
+ * Classify the output of a probe turn.
+ *
+ * @param result - Exit code and output
+ * @returns `logged_out` on a login-expiry message; `logged_in` when the turn
+ *   worked or the account answered with a usage limit (a limit proves the
+ *   login works); else `unknown`
+ */
+export function classifyNativeProbe(result) {
+    const output = `${result.stdout}\n${result.stderr}`;
+    if (detectLoginExpiry(output, HARNESS_CONSTANTS.IDS.CLAUDE_CODE))
+        return 'logged_out';
+    const limit = detectUsageLimit(output, RUNTIME_TYPES.CLAUDE_CODE);
+    if (limit && isExhaustingKind(limit.kind))
+        return 'logged_in';
+    if (result.code === 0)
+        return 'logged_in';
+    return 'unknown';
+}
+/**
+ * Verify a login with one real Claude turn on Claude Code's own login, with
+ * no token or key in the env.
+ *
+ * @param configDir - A named account's config dir; null = the default login
+ * @param deps - Dependencies
+ * @returns `logged_in`, `logged_out` or `unknown`; never rejects
+ */
+export async function probeClaudeNativeLogin(configDir, deps = {}) {
+    try {
+        const { binary, env, run, timeoutMs } = setup(deps);
+        if (!binary)
+            return 'unknown';
+        const scratch = deps.scratchDir ?? path.join(os.tmpdir(), 'crewly-native-login-probe');
+        fs.mkdirSync(scratch, { recursive: true });
+        const result = await run(binary, HARNESS_CONSTANTS.CLAUDE.PROBE_ARGS, { env: nativeLoginEnv(env, configDir), timeoutMs, cwd: scratch });
+        return classifyNativeProbe(result);
+    }
+    catch {
+        return 'unknown';
+    }
+}
+//# sourceMappingURL=claude-native-login.js.map

package/dist/backend/backend/src/services/harness/claude-native-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-native-login.js","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/claude-native-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAgB5D,kFAAkF;AAClF,MAAM,UAAU,GAAG,CAAC,kBAAkB,EAAE,YAAY,EAAE,wBAAwB,EAAE,sBAAsB,CAAU,CAAC;AAEjH,sCAAsC;AACtC,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,+EAA+E;AAC/E,MAAM,WAAW,GAAG,IAAI,GAAG,EAA6C,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,OAA0B,EAAE,SAAwB;IAClF,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,EAAE,CAAC;IAC9C,OAAO,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACrD,OAAO,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,UAAU;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,SAAS;QAAE,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC;IACxE,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,SAAS,KAAK,CAAC,IAA2B;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9H,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,iBAAiB,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;AACjJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAwB,EAAE,OAA8B,EAAE;IACpG,IAAI,CAAC;QACJ,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACnH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAQ,MAAiC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACvH,OAAQ,MAAgC,CAAC,QAAQ,CAAC;QACnD,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,QAA6E,EAC7E,OAA8B,EAAE,EAChC,QAAQ,GAAG,MAAM;IAEjB,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACrC,KAAK,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,OAAO,IAAI,WAAW,CAAC;QACnC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,EAAE,GAAG,QAAQ;YAAE,SAAS;QACjD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,QAAQ,KAAK,IAAI;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAsB;IAC7D,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,IAAI,WAAW,CAAC,EAAE,QAAQ,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAsB,EAAE,QAAiB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC7G,WAAW,CAAC,GAAG,CAAC,OAAO,IAAI,WAAW,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,2BAA2B;IAC1C,WAAW,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA+D;IAClG,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IACpD,IAAI,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,YAAY,CAAC;IACtF,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,KAAK,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC;IAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAC1C,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,SAAwB,EAAE,OAA8B,EAAE;IACtG,IAAI,CAAC;QACJ,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC;QACvF,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACxI,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC"}

package/dist/backend/backend/src/services/harness/claude-token-migration.service.d.ts

@@ -0,0 +1,158 @@
+/**
+ * Claude token migration — retire the Claude sign-in tokens older Crewly
+ * versions saved, without locking anyone out.
+ *
+ * Anthropic's Claude Code legal page: developers may not collect, store or
+ * intermediate Claude.ai credentials or session tokens; sign-in must finish
+ * through Anthropic's own flow. Older Crewly ran `claude setup-token`, read
+ * the token off the screen and saved it in `harness-credentials.json`
+ * (`claude.oauthToken` for the default login, `claudeAccounts.<name>.oauthToken`
+ * for named accounts). Crewly now signs in with Claude Code's own
+ * `claude auth login` and stores nothing (login-broker.service.ts).
+ *
+ * Rules of the transition:
+ *
+ * - A saved token keeps being handed to its account's Claude Code processes
+ *   until that account is signed in natively (store.legacyClaudeTokenEnv).
+ *   Nothing stops working on upgrade.
+ * - A token is deleted only after the account's native login is verified by
+ *   a real Claude turn run WITHOUT any token or key in the env
+ *   (claude-native-login.ts). A login that only looks signed in is not enough.
+ * - A named account's own config dir can only have been signed in by Crewly's
+ *   flow or by the owner, so a verified native login there retires its token
+ *   at once (the periodic run notices a login done by hand too). The default
+ *   login is different: the machine's own Claude login may be another
+ *   account than the one the saved token belongs to, so its token is retired
+ *   only by a sign-in done through Crewly (`login claude`), never guessed.
+ * - The owner is told once per machine which accounts need one re-sign-in
+ *   (state file `claude-token-migration.json`, no secrets in it).
+ * - When no saved token remains, the leftover Claude keys are removed from
+ *   `harness-credentials.json`; other keys are untouched, the file is
+ *   rewritten atomically with mode 0600, and no backup is kept.
+ *
+ * @module services/harness/claude-token-migration.service
+ */
+import { type HarnessCredentialsStore } from './harness-credentials.store.js';
+import { type HarnessLogger, type LoginState } from './harness.types.js';
+/** A login that still depends on a token an older Crewly saved. */
+export interface LegacyTokenEntry {
+    /** Named account; null = the default login */
+    account: string | null;
+}
+/** What one run did. */
+export interface MigrationResult {
+    /** Logins whose token was deleted this run */
+    retired: Array<string | null>;
+    /** Logins that still run on a saved token (need a native sign-in) */
+    pending: Array<string | null>;
+    /** The owner notice was sent this run */
+    notified: boolean;
+}
+/** Owner DM sender. */
+export interface MigrationNotifier {
+    sendToOwner(text: string): Promise<unknown>;
+}
+/** Injectable dependencies. */
+export interface ClaudeTokenMigrationDeps {
+    credentials?: Pick<HarnessCredentialsStore, 'getLegacyClaudeOauthToken' | 'listClaudeAccountsWithToken' | 'clearLegacyClaudeOauthToken' | 'clearClaudeAccount' | 'pruneLegacyClaudeKeys'>;
+    /** Real Claude turn on Claude Code's own login, no token in the env */
+    probe?: (configDir: string | null) => Promise<LoginState>;
+    /** `claude auth status` on Claude Code's own login */
+    readStatus?: (configDir: string | null) => Promise<boolean | null>;
+    /** Config dir of a named account */
+    accountConfigDir?: (account: string) => string;
+    notifier?: () => MigrationNotifier | null;
+    /** Directory of the state file (default CREWLY_HOME) */
+    crewlyHome?: string;
+    logger?: HarnessLogger;
+    now?: () => number;
+}
+/** Retires saved Claude tokens once the account is signed in natively. */
+export declare class ClaudeTokenMigrationService {
+    private readonly credentials;
+    private readonly probe;
+    private readonly readStatus;
+    private readonly accountConfigDir;
+    private notifier;
+    private readonly crewlyHome;
+    private readonly logger;
+    private readonly now;
+    private running;
+    private timer;
+    /**
+     * @param deps - Injectable dependencies (all optional)
+     */
+    constructor(deps?: ClaudeTokenMigrationDeps);
+    /**
+     * Where the owner notice is sent.
+     *
+     * @param notifier - Lazy owner DM sender
+     */
+    setNotifier(notifier: () => MigrationNotifier | null): void;
+    /**
+     * Logins that still depend on a saved token.
+     *
+     * @returns Entries (default login first)
+     */
+    listLegacy(): LegacyTokenEntry[];
+    /**
+     * Check every login that still has a saved token; retire what can be
+     * retired and tell the owner about the rest, once. Safe to call at any
+     * time and as often as you like (idempotent); concurrent calls share one run.
+     *
+     * @returns What happened; never rejects
+     */
+    run(): Promise<MigrationResult>;
+    /**
+     * A sign-in done through Crewly just completed and was verified: retire
+     * the saved token of that login (default or named).
+     *
+     * @param account - Named account; null = the default login
+     * @returns Resolves when done; never rejects
+     */
+    afterLogin(account: string | null): Promise<void>;
+    /**
+     * Run now (after a short delay) and then on an interval.
+     *
+     * @param startDelayMs - Delay before the first run
+     */
+    start(startDelayMs?: number): void;
+    /** Stop the timers. */
+    stop(): void;
+    private hasLegacy;
+    private configDirOf;
+    /**
+     * Delete the saved token of a login when its native login passes a real
+     * Claude turn with no token in the env.
+     *
+     * @param account - Named account; null = the default login
+     * @returns True when the token was deleted
+     */
+    private retireIfVerified;
+    /** Remove leftover Claude keys once no saved token remains. */
+    private finishCleanup;
+    private runOnce;
+    private statePath;
+    private readState;
+    private writeState;
+    /**
+     * Tell the owner, once per machine, which logins need one re-sign-in.
+     *
+     * @param pending - Logins that still run on a saved token
+     * @returns True when the notice was delivered now
+     */
+    private notifyOnce;
+}
+/**
+ * The backend's token migration, bound to the stored credentials.
+ *
+ * @returns The singleton
+ */
+export declare function getClaudeTokenMigrationService(): ClaudeTokenMigrationService;
+/**
+ * Replace or clear the singleton (tests).
+ *
+ * @param service - Service, or null
+ */
+export declare function setClaudeTokenMigrationServiceForTesting(service: ClaudeTokenMigrationService | null): void;
+//# sourceMappingURL=claude-token-migration.service.d.ts.map

package/dist/backend/backend/src/services/harness/claude-token-migration.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-token-migration.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/claude-token-migration.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAQH,OAAO,EAA8B,KAAK,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAC1G,OAAO,EAAyB,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAIhG,mEAAmE;AACnE,MAAM,WAAW,gBAAgB;IAChC,8CAA8C;IAC9C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAwB;AACxB,MAAM,WAAW,eAAe;IAC/B,8CAA8C;IAC9C,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9B,qEAAqE;IACrE,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9B,yCAAyC;IACzC,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED,uBAAuB;AACvB,MAAM,WAAW,iBAAiB;IACjC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5C;AAWD,+BAA+B;AAC/B,MAAM,WAAW,wBAAwB;IACxC,WAAW,CAAC,EAAE,IAAI,CACjB,uBAAuB,EACrB,2BAA2B,GAC3B,6BAA6B,GAC7B,6BAA6B,GAC7B,oBAAoB,GACpB,uBAAuB,CACzB,CAAC;IACF,uEAAuE;IACvE,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1D,sDAAsD;IACtD,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACnE,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/C,QAAQ,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAC;IAC1C,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAYD,0EAA0E;AAC1E,qBAAa,2BAA2B;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuD;IACnF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoD;IAC1E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAwD;IACnF,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA8B;IAC/D,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,OAAO,CAAyC;IACxD,OAAO,CAAC,KAAK,CAA+B;IAE5C;;OAEG;gBACS,IAAI,GAAE,wBAA6B;IAW/C;;;;OAIG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,iBAAiB,GAAG,IAAI,GAAG,IAAI;IAI3D;;;;OAIG;IACH,UAAU,IAAI,gBAAgB,EAAE;IAOhC;;;;;;OAMG;IACH,GAAG,IAAI,OAAO,CAAC,eAAe,CAAC;IAc/B;;;;;;OAMG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAavD;;;;OAIG;IACH,KAAK,CAAC,YAAY,GAAE,MAAiC,GAAG,IAAI;IAW5D,uBAAuB;IACvB,IAAI,IAAI,IAAI;IAUZ,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,WAAW;IAInB;;;;;;OAMG;YACW,gBAAgB;IAU9B,+DAA+D;IAC/D,OAAO,CAAC,aAAa;YAIP,OAAO;IAgBrB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,UAAU;IAQlB;;;;;OAKG;YACW,UAAU;CAoBxB;AAKD;;;;GAIG;AACH,wBAAgB,8BAA8B,IAAI,2BAA2B,CAG5E;AAED;;;;GAIG;AACH,wBAAgB,wCAAwC,CAAC,OAAO,EAAE,2BAA2B,GAAG,IAAI,GAAG,IAAI,CAG1G"}