crewly 1.20.362 → 1.20.364

package/dist/backend/backend/src/services/harness/claude-token-migration.service.js

@@ -0,0 +1,283 @@
+/**
+ * Claude token migration — retire the Claude sign-in tokens older Crewly
+ * versions saved, without locking anyone out.
+ *
+ * Anthropic's Claude Code legal page: developers may not collect, store or
+ * intermediate Claude.ai credentials or session tokens; sign-in must finish
+ * through Anthropic's own flow. Older Crewly ran `claude setup-token`, read
+ * the token off the screen and saved it in `harness-credentials.json`
+ * (`claude.oauthToken` for the default login, `claudeAccounts.<name>.oauthToken`
+ * for named accounts). Crewly now signs in with Claude Code's own
+ * `claude auth login` and stores nothing (login-broker.service.ts).
+ *
+ * Rules of the transition:
+ *
+ * - A saved token keeps being handed to its account's Claude Code processes
+ *   until that account is signed in natively (store.legacyClaudeTokenEnv).
+ *   Nothing stops working on upgrade.
+ * - A token is deleted only after the account's native login is verified by
+ *   a real Claude turn run WITHOUT any token or key in the env
+ *   (claude-native-login.ts). A login that only looks signed in is not enough.
+ * - A named account's own config dir can only have been signed in by Crewly's
+ *   flow or by the owner, so a verified native login there retires its token
+ *   at once (the periodic run notices a login done by hand too). The default
+ *   login is different: the machine's own Claude login may be another
+ *   account than the one the saved token belongs to, so its token is retired
+ *   only by a sign-in done through Crewly (`login claude`), never guessed.
+ * - The owner is told once per machine which accounts need one re-sign-in
+ *   (state file `claude-token-migration.json`, no secrets in it).
+ * - When no saved token remains, the leftover Claude keys are removed from
+ *   `harness-credentials.json`; other keys are untouched, the file is
+ *   rewritten atomically with mode 0600, and no backup is kept.
+ *
+ * @module services/harness/claude-token-migration.service
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { HARNESS_CONSTANTS } from '../../constants.js';
+import { getCrewlyHomePath } from '../core/crewly-home.utils.js';
+import { claudeAccountConfigDir } from './claude-accounts.js';
+import { probeClaudeNativeLogin, readClaudeAuthStatus, setCachedClaudeNativeLogin } from './claude-native-login.js';
+import { getHarnessCredentialsStore } from './harness-credentials.store.js';
+import { SILENT_HARNESS_LOGGER } from './harness.types.js';
+const MIGRATION = HARNESS_CONSTANTS.CLAUDE.TOKEN_MIGRATION;
+/**
+ * Display name of a login for the owner.
+ *
+ * @param account - Named account; null = the default login
+ * @returns e.g. `login claude work` / `login claude`
+ */
+function loginCommandFor(account) {
+    return account ? `login claude ${account}` : 'login claude';
+}
+/** Retires saved Claude tokens once the account is signed in natively. */
+export class ClaudeTokenMigrationService {
+    credentials;
+    probe;
+    readStatus;
+    accountConfigDir;
+    notifier;
+    crewlyHome;
+    logger;
+    now;
+    running = null;
+    timer = null;
+    /**
+     * @param deps - Injectable dependencies (all optional)
+     */
+    constructor(deps = {}) {
+        this.credentials = deps.credentials ?? getHarnessCredentialsStore();
+        this.probe = deps.probe ?? ((configDir) => probeClaudeNativeLogin(configDir));
+        this.readStatus = deps.readStatus ?? ((configDir) => readClaudeAuthStatus(configDir));
+        this.accountConfigDir = deps.accountConfigDir ?? ((account) => claudeAccountConfigDir(account));
+        this.notifier = deps.notifier ?? (() => null);
+        this.crewlyHome = deps.crewlyHome;
+        this.logger = deps.logger ?? SILENT_HARNESS_LOGGER;
+        this.now = deps.now ?? Date.now;
+    }
+    /**
+     * Where the owner notice is sent.
+     *
+     * @param notifier - Lazy owner DM sender
+     */
+    setNotifier(notifier) {
+        this.notifier = notifier;
+    }
+    /**
+     * Logins that still depend on a saved token.
+     *
+     * @returns Entries (default login first)
+     */
+    listLegacy() {
+        const entries = [];
+        if (this.credentials.getLegacyClaudeOauthToken() !== null)
+            entries.push({ account: null });
+        for (const account of this.credentials.listClaudeAccountsWithToken())
+            entries.push({ account });
+        return entries;
+    }
+    /**
+     * Check every login that still has a saved token; retire what can be
+     * retired and tell the owner about the rest, once. Safe to call at any
+     * time and as often as you like (idempotent); concurrent calls share one run.
+     *
+     * @returns What happened; never rejects
+     */
+    run() {
+        if (!this.running) {
+            this.running = this.runOnce()
+                .catch((error) => {
+                this.logger.warn('Claude token migration failed', { error: error instanceof Error ? error.message : String(error) });
+                return { retired: [], pending: [], notified: false };
+            })
+                .finally(() => {
+                this.running = null;
+            });
+        }
+        return this.running;
+    }
+    /**
+     * A sign-in done through Crewly just completed and was verified: retire
+     * the saved token of that login (default or named).
+     *
+     * @param account - Named account; null = the default login
+     * @returns Resolves when done; never rejects
+     */
+    async afterLogin(account) {
+        try {
+            if (!this.hasLegacy(account)) {
+                this.finishCleanup();
+                return;
+            }
+            await this.retireIfVerified(account);
+            this.finishCleanup();
+        }
+        catch (error) {
+            this.logger.warn('Claude token migration after a login failed', { error: error instanceof Error ? error.message : String(error) });
+        }
+    }
+    /**
+     * Run now (after a short delay) and then on an interval.
+     *
+     * @param startDelayMs - Delay before the first run
+     */
+    start(startDelayMs = MIGRATION.START_DELAY_MS) {
+        if (this.timer)
+            return;
+        const first = setTimeout(() => {
+            void this.run();
+            this.timer = setInterval(() => void this.run(), MIGRATION.RUN_INTERVAL_MS);
+            this.timer.unref?.();
+        }, startDelayMs);
+        first.unref?.();
+        this.timer = first;
+    }
+    /** Stop the timers. */
+    stop() {
+        if (this.timer) {
+            clearTimeout(this.timer);
+            clearInterval(this.timer);
+        }
+        this.timer = null;
+    }
+    // ----------------------------------------------------------------- internals
+    hasLegacy(account) {
+        return account === null ? this.credentials.getLegacyClaudeOauthToken() !== null : this.credentials.listClaudeAccountsWithToken().includes(account);
+    }
+    configDirOf(account) {
+        return account ? this.accountConfigDir(account) : null;
+    }
+    /**
+     * Delete the saved token of a login when its native login passes a real
+     * Claude turn with no token in the env.
+     *
+     * @param account - Named account; null = the default login
+     * @returns True when the token was deleted
+     */
+    async retireIfVerified(account) {
+        const configDir = this.configDirOf(account);
+        if ((await this.probe(configDir)) !== 'logged_in')
+            return false;
+        if (account)
+            this.credentials.clearClaudeAccount(account);
+        else
+            this.credentials.clearLegacyClaudeOauthToken();
+        setCachedClaudeNativeLogin(account, true, this.now());
+        this.logger.info('Retired a saved Claude token: the account is signed in through Claude Code itself', { account: account ?? 'default' });
+        return true;
+    }
+    /** Remove leftover Claude keys once no saved token remains. */
+    finishCleanup() {
+        if (this.listLegacy().length === 0)
+            this.credentials.pruneLegacyClaudeKeys();
+    }
+    async runOnce() {
+        const result = { retired: [], pending: [], notified: false };
+        for (const { account } of this.listLegacy()) {
+            // The default login is retired only by a sign-in done through Crewly
+            // (afterLogin): the machine's own Claude login may be another account.
+            if (account !== null && (await this.readStatus(this.configDirOf(account))) === true && (await this.retireIfVerified(account))) {
+                result.retired.push(account);
+                continue;
+            }
+            result.pending.push(account);
+        }
+        this.finishCleanup();
+        if (result.pending.length > 0)
+            result.notified = await this.notifyOnce(result.pending);
+        return result;
+    }
+    statePath() {
+        return path.join(this.crewlyHome ?? getCrewlyHomePath(), MIGRATION.STATE_FILE);
+    }
+    readState() {
+        try {
+            const parsed = JSON.parse(fs.readFileSync(this.statePath(), 'utf-8'));
+            if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed))
+                return { version: 1, ...parsed };
+        }
+        catch {
+            // no state yet
+        }
+        return { version: 1 };
+    }
+    writeState(state) {
+        const file = this.statePath();
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        const tmp = `${file}.${process.pid}.tmp`;
+        fs.writeFileSync(tmp, `${JSON.stringify(state, null, 2)}\n`, { mode: HARNESS_CONSTANTS.CREDENTIALS_FILE_MODE });
+        fs.renameSync(tmp, file);
+    }
+    /**
+     * Tell the owner, once per machine, which logins need one re-sign-in.
+     *
+     * @param pending - Logins that still run on a saved token
+     * @returns True when the notice was delivered now
+     */
+    async notifyOnce(pending) {
+        if (this.readState().notifiedAt)
+            return false;
+        const notifier = this.notifier();
+        if (!notifier)
+            return false;
+        const lines = pending.map((account) => `• ${account ? `Claude account "${account}"` : 'The default Claude login'}: reply \`${loginCommandFor(account)}\``);
+        const text = [
+            'Anthropic requires Claude sign-in to finish inside Claude Code itself, so Crewly no longer saves Claude sign-in tokens.',
+            'Everything keeps working as before. Please sign these in once more, when you have a minute:',
+            ...lines,
+            'After that, the old saved token is deleted from this machine.',
+        ].join('\n');
+        try {
+            const delivered = await notifier.sendToOwner(text);
+            if (delivered === false)
+                return false;
+        }
+        catch {
+            return false;
+        }
+        this.writeState({ version: 1, notifiedAt: new Date(this.now()).toISOString(), notifiedFor: pending.map((a) => a ?? 'default') });
+        return true;
+    }
+}
+/** Backend singleton. */
+let instance = null;
+/**
+ * The backend's token migration, bound to the stored credentials.
+ *
+ * @returns The singleton
+ */
+export function getClaudeTokenMigrationService() {
+    if (!instance)
+        instance = new ClaudeTokenMigrationService();
+    return instance;
+}
+/**
+ * Replace or clear the singleton (tests).
+ *
+ * @param service - Service, or null
+ */
+export function setClaudeTokenMigrationServiceForTesting(service) {
+    instance?.stop();
+    instance = service;
+}
+//# sourceMappingURL=claude-token-migration.service.js.map

package/dist/backend/backend/src/services/harness/claude-token-migration.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-token-migration.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/claude-token-migration.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACpH,OAAO,EAAE,0BAA0B,EAAgC,MAAM,gCAAgC,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAuC,MAAM,oBAAoB,CAAC;AAEhG,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,eAAe,CAAC;AAuD3D;;;;;GAKG;AACH,SAAS,eAAe,CAAC,OAAsB;IAC9C,OAAO,OAAO,CAAC,CAAC,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;AAC7D,CAAC;AAED,0EAA0E;AAC1E,MAAM,OAAO,2BAA2B;IACtB,WAAW,CAAuD;IAClE,KAAK,CAAoD;IACzD,UAAU,CAAwD;IAClE,gBAAgB,CAA8B;IACvD,QAAQ,CAAiC;IAChC,UAAU,CAAqB;IAC/B,MAAM,CAAgB;IACtB,GAAG,CAAe;IAC3B,OAAO,GAAoC,IAAI,CAAC;IAChD,KAAK,GAA0B,IAAI,CAAC;IAE5C;;OAEG;IACH,YAAY,OAAiC,EAAE;QAC9C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,0BAA0B,EAAE,CAAC;QACpE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;QAChG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,qBAAqB,CAAC;QACnD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,QAAwC;QACnD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,UAAU;QACT,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,WAAW,CAAC,yBAAyB,EAAE,KAAK,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,2BAA2B,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAChG,OAAO,OAAO,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,GAAG;QACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE;iBAC3B,KAAK,CAAC,CAAC,KAAK,EAAmB,EAAE;gBACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACrH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACtD,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACb,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACrB,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,OAAsB;QACtC,IAAI,CAAC;YACJ,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,IAAI,CAAC,aAAa,EAAE,CAAC;gBACrB,OAAO;YACR,CAAC;YACD,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,CAAC,aAAa,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpI,CAAC;IACF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAuB,SAAS,CAAC,cAAc;QACpD,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC;YAC3E,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACtB,CAAC,EAAE,YAAY,CAAC,CAAC;QACjB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,CAAC;IAED,uBAAuB;IACvB,IAAI;QACH,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,8EAA8E;IAEtE,SAAS,CAAC,OAAsB;QACvC,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,yBAAyB,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,2BAA2B,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpJ,CAAC;IAEO,WAAW,CAAC,OAAsB;QACzC,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,gBAAgB,CAAC,OAAsB;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,WAAW;YAAE,OAAO,KAAK,CAAC;QAChE,IAAI,OAAO;YAAE,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;;YACrD,IAAI,CAAC,WAAW,CAAC,2BAA2B,EAAE,CAAC;QACpD,0BAA0B,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mFAAmF,EAAE,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;QACzI,OAAO,IAAI,CAAC;IACb,CAAC;IAED,+DAA+D;IACvD,aAAa;QACpB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,WAAW,CAAC,qBAAqB,EAAE,CAAC;IAC9E,CAAC;IAEO,KAAK,CAAC,OAAO;QACpB,MAAM,MAAM,GAAoB,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC9E,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAC7C,qEAAqE;YACrE,uEAAuE;YACvE,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC/H,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC7B,SAAS;YACV,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvF,OAAO,MAAM,CAAC;IACf,CAAC;IAEO,SAAS;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IAChF,CAAC;IAEO,SAAS;QAChB,IAAI,CAAC;YACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;YAC/E,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAI,MAAkC,EAAE,CAAC;QAC5I,CAAC;QAAC,MAAM,CAAC;YACR,eAAe;QAChB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACvB,CAAC;IAEO,UAAU,CAAC,KAAqB;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QACzC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,qBAAqB,EAAE,CAAC,CAAC;QAChH,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,UAAU,CAAC,OAA6B;QACrD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,mBAAmB,OAAO,GAAG,CAAC,CAAC,CAAC,0BAA0B,aAAa,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3J,MAAM,IAAI,GAAG;YACZ,yHAAyH;YACzH,6FAA6F;YAC7F,GAAG,KAAK;YACR,+DAA+D;SAC/D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,SAAS,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;QACjI,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AAED,yBAAyB;AACzB,IAAI,QAAQ,GAAuC,IAAI,CAAC;AAExD;;;;GAIG;AACH,MAAM,UAAU,8BAA8B;IAC7C,IAAI,CAAC,QAAQ;QAAE,QAAQ,GAAG,IAAI,2BAA2B,EAAE,CAAC;IAC5D,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wCAAwC,CAAC,OAA2C;IACnG,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjB,QAAQ,GAAG,OAAO,CAAC;AACpB,CAAC"}

package/dist/backend/backend/src/services/harness/harness-credentials.store.d.ts

@@ -1,9 +1,14 @@
 /**
  * Harness credentials store — the harness logins Crewly itself holds.
  *
- * Claude Code's `setup-token` prints a long-lived OAuth token instead of
- * saving it, and an Anthropic API key has to reach agents somehow; both live
- * here, in `<crewlyHome>/harness-credentials.json` with mode 0600. Codex
+ * An Anthropic API key has to reach agents somehow, so it lives here, in
+ * `<crewlyHome>/harness-credentials.json` with mode 0600. Crewly no longer
+ * saves Claude.ai sign-in tokens: Claude Code stores its own login (config
+ * dir or keychain) and Anthropic's rules say developers may not collect or
+ * store those. Older versions did save a `claude setup-token` token here
+ * (`claude.oauthToken`, `claudeAccounts.<name>.oauthToken`); that data is
+ * only read to keep an account working until the owner signs it in again,
+ * then deleted (services/harness/claude-token-migration.service.ts). Codex
  * writes its own credentials (`$CODEX_HOME/auth.json`), so nothing is stored
  * for it unless a future flow needs the key. Antigravity CLI reads its Gemini
  * API key only from the environment, so Crewly keeps that key here too.
@@ -19,7 +24,7 @@
 /** Stored credentials. Every field is optional. */
 export interface HarnessCredentials {
     claude?: {
-        /** Long-lived token from `claude setup-token` (exported as CLAUDE_CODE_OAUTH_TOKEN) */
+        /** LEGACY, read-only: token an older Crewly saved from `claude setup-token`; removed by the migration */
         oauthToken?: string;
         /** Anthropic API key (exported as ANTHROPIC_API_KEY) */
         anthropicApiKey?: string;
@@ -81,14 +86,6 @@ export declare class HarnessCredentialsStore {
      * @param credentials - Full credentials object
      */
     write(credentials: HarnessCredentials): void;
-    /**
-     * Store Claude's long-lived OAuth token. Replaces a stored API key, so
-     * agents use exactly the login the owner chose last.
-     *
-     * @param token - Token printed by `claude setup-token`
-     * @throws Error when the token is empty
-     */
-    setClaudeOauthToken(token: string): void;
     /**
      * Store an Anthropic API key. Replaces a stored OAuth token.
      *
@@ -125,15 +122,8 @@ export declare class HarnessCredentialsStore {
      */
     clearClaude(): void;
     /**
-     * Store the `setup-token` token of one of the owner's other Claude Code accounts.
-     *
-     * @param account - Account name (validated by the caller)
-     * @param token - Token printed by `claude setup-token`
-     * @throws Error when the token is empty
-     */
-    setClaudeAccountToken(account: string, token: string): void;
-    /**
-     * The stored token of one of the owner's other Claude Code accounts.
+     * LEGACY: the token an older Crewly saved for one of the owner's other
+     * Claude Code accounts (never written any more).
      *
      * @param account - Account name
      * @returns The token, or null when none is stored
@@ -146,11 +136,41 @@ export declare class HarnessCredentialsStore {
      */
     listClaudeAccountsWithToken(): string[];
     /**
-     * Forget the token of one of the owner's other Claude Code accounts.
+     * Forget the token of one of the owner's other Claude Code accounts. The
+     * `claudeAccounts` key goes away with its last entry.
      *
      * @param account - Account name
      */
     clearClaudeAccount(account: string): void;
+    /**
+     * LEGACY: the default login's token an older Crewly saved.
+     *
+     * @returns The token, or null
+     */
+    getLegacyClaudeOauthToken(): string | null;
+    /**
+     * Delete the default login's legacy token. The `claude` key is removed
+     * when nothing but bookkeeping is left (a stored API key stays).
+     */
+    clearLegacyClaudeOauthToken(): void;
+    /**
+     * Remove what an older Crewly left for Claude sign-in tokens once no token
+     * is stored: empty `claudeAccounts` entries or object, an empty
+     * `claude.oauthToken`, and a `claude` object holding nothing but
+     * bookkeeping. A stored API key and every other key stay untouched. Does
+     * nothing (and does not rewrite the file) when there is nothing to remove.
+     */
+    pruneLegacyClaudeKeys(): void;
+    /**
+     * Env that keeps an account working with the token an older Crewly saved
+     * for it. LEGACY, transition only: empty once the account's native login
+     * is verified and the token deleted. This is the only place the token is
+     * handed to a Claude Code process.
+     *
+     * @param account - Named account; null = the default login
+     * @returns `{ CLAUDE_CODE_OAUTH_TOKEN }`, or `{}` when no token is stored
+     */
+    legacyClaudeTokenEnv(account: string | null): Record<string, string>;
     /**
      * Which Claude credential Crewly holds (never the value).
      *
@@ -161,8 +181,8 @@ export declare class HarnessCredentialsStore {
      * Env vars to inject into agent sessions.
      *
      * Always sets PATH (user npm prefix bin first, see harness-exec.utils).
-     * Adds `CLAUDE_CODE_OAUTH_TOKEN` or `ANTHROPIC_API_KEY` when Crewly holds
-     * a Claude credential. Nothing is added for Codex: it reads its own
+     * Adds `ANTHROPIC_API_KEY` when Crewly holds one (and, during the token
+     * migration only, the legacy token of the default login). Nothing is added for Codex: it reads its own
      * `auth.json`.
      *
      * For an `antigravity-cli` session it also adds the stored Gemini key as

package/dist/backend/backend/src/services/harness/harness-credentials.store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"harness-credentials.store.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/harness-credentials.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAQH,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IAClC,MAAM,CAAC,EAAE;QACR,uFAAuF;QACvF,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,wDAAwD;QACxD,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,KAAK,CAAC,EAAE;QACP,iFAAiF;QACjF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,WAAW,CAAC,EAAE;QACb,2GAA2G;QAC3G,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7E;AAED,gDAAgD;AAChD,MAAM,MAAM,sBAAsB,GAAG,aAAa,GAAG,SAAS,GAAG,IAAI,CAAC;AAYtE;;;;;GAKG;AACH,qBAAa,uBAAuB;IAKvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAJtC;;;OAGG;gBAC0B,QAAQ,CAAC,EAAE,MAAM,YAAA;IAE9C;;;;OAIG;IACH,WAAW,IAAI,MAAM;IAIrB;;;;OAIG;IACH,IAAI,IAAI,kBAAkB;IAS1B;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAe5C;;;;;;OAMG;IACH,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAMxC;;;;;OAKG;IACH,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMrC;;;;;OAKG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMlC;;;;;OAKG;IACH,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAM7C;;;;OAIG;IACH,0BAA0B,IAAI,MAAM,GAAG,IAAI;IAK3C;;OAEG;IACH,gBAAgB,IAAI,IAAI;IAQxB;;OAEG;IACH,WAAW,IAAI,IAAI;IAQnB;;;;;;OAMG;IACH,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAS3D;;;;;OAKG;IACH,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAKrD;;;;OAIG;IACH,2BAA2B,IAAI,MAAM,EAAE;IAKvC;;;;OAIG;IACH,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAQzC;;;;OAIG;IACH,uBAAuB,IAAI,sBAAsB;IAOjD;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAAmB,CAAC,OAAO,GAAE,MAAM,CAAC,UAAwB,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAgB3G;AAKD;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,uBAAuB,CAEpE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,MAAM,CAAC,UAAwB,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM1H"}
+{"version":3,"file":"harness-credentials.store.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/harness-credentials.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAQH,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IAClC,MAAM,CAAC,EAAE;QACR,yGAAyG;QACzG,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,wDAAwD;QACxD,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,KAAK,CAAC,EAAE;QACP,iFAAiF;QACjF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,WAAW,CAAC,EAAE;QACb,2GAA2G;QAC3G,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7E;AAED,gDAAgD;AAChD,MAAM,MAAM,sBAAsB,GAAG,aAAa,GAAG,SAAS,GAAG,IAAI,CAAC;AAYtE;;;;;GAKG;AACH,qBAAa,uBAAuB;IAKvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAJtC;;;OAGG;gBAC0B,QAAQ,CAAC,EAAE,MAAM,YAAA;IAE9C;;;;OAIG;IACH,WAAW,IAAI,MAAM;IAIrB;;;;OAIG;IACH,IAAI,IAAI,kBAAkB;IAS1B;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAe5C;;;;;OAKG;IACH,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMrC;;;;;OAKG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMlC;;;;;OAKG;IACH,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAM7C;;;;OAIG;IACH,0BAA0B,IAAI,MAAM,GAAG,IAAI;IAK3C;;OAEG;IACH,gBAAgB,IAAI,IAAI;IAQxB;;OAEG;IACH,WAAW,IAAI,IAAI;IAQnB;;;;;;OAMG;IACH,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAKrD;;;;OAIG;IACH,2BAA2B,IAAI,MAAM,EAAE;IAKvC;;;;;OAKG;IACH,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAWzC;;;;OAIG;IACH,yBAAyB,IAAI,MAAM,GAAG,IAAI;IAK1C;;;OAGG;IACH,2BAA2B,IAAI,IAAI;IAUnC;;;;;;OAMG;IACH,qBAAqB,IAAI,IAAI;IAyB7B;;;;;;;;OAQG;IACH,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAKpE;;;;OAIG;IACH,uBAAuB,IAAI,sBAAsB;IAOjD;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAAmB,CAAC,OAAO,GAAE,MAAM,CAAC,UAAwB,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAiB3G;AAKD;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,uBAAuB,CAEpE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,MAAM,CAAC,UAAwB,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM1H"}

package/dist/backend/backend/src/services/harness/harness-credentials.store.js

@@ -1,9 +1,14 @@
 /**
  * Harness credentials store — the harness logins Crewly itself holds.
  *
- * Claude Code's `setup-token` prints a long-lived OAuth token instead of
- * saving it, and an Anthropic API key has to reach agents somehow; both live
- * here, in `<crewlyHome>/harness-credentials.json` with mode 0600. Codex
+ * An Anthropic API key has to reach agents somehow, so it lives here, in
+ * `<crewlyHome>/harness-credentials.json` with mode 0600. Crewly no longer
+ * saves Claude.ai sign-in tokens: Claude Code stores its own login (config
+ * dir or keychain) and Anthropic's rules say developers may not collect or
+ * store those. Older versions did save a `claude setup-token` token here
+ * (`claude.oauthToken`, `claudeAccounts.<name>.oauthToken`); that data is
+ * only read to keep an account working until the owner signs it in again,
+ * then deleted (services/harness/claude-token-migration.service.ts). Codex
  * writes its own credentials (`$CODEX_HOME/auth.json`), so nothing is stored
  * for it unless a future flow needs the key. Antigravity CLI reads its Gemini
  * API key only from the environment, so Crewly keeps that key here too.
@@ -91,19 +96,6 @@ export class HarnessCredentialsStore {
         fs.renameSync(tmp, file);
         fs.chmodSync(file, HARNESS_CONSTANTS.CREDENTIALS_FILE_MODE);
     }
-    /**
-     * Store Claude's long-lived OAuth token. Replaces a stored API key, so
-     * agents use exactly the login the owner chose last.
-     *
-     * @param token - Token printed by `claude setup-token`
-     * @throws Error when the token is empty
-     */
-    setClaudeOauthToken(token) {
-        if (!isNonEmptyString(token))
-            throw new Error('Claude OAuth token is empty');
-        const current = this.read();
-        this.write({ ...current, claude: { oauthToken: token.trim(), updatedAt: new Date().toISOString() } });
-    }
     /**
      * Store an Anthropic API key. Replaces a stored OAuth token.
      *
@@ -172,23 +164,8 @@ export class HarnessCredentialsStore {
         this.write(next);
     }
     /**
-     * Store the `setup-token` token of one of the owner's other Claude Code accounts.
-     *
-     * @param account - Account name (validated by the caller)
-     * @param token - Token printed by `claude setup-token`
-     * @throws Error when the token is empty
-     */
-    setClaudeAccountToken(account, token) {
-        if (!isNonEmptyString(token))
-            throw new Error('Claude OAuth token is empty');
-        const current = this.read();
-        this.write({
-            ...current,
-            claudeAccounts: { ...(current.claudeAccounts ?? {}), [account]: { oauthToken: token.trim(), updatedAt: new Date().toISOString() } },
-        });
-    }
-    /**
-     * The stored token of one of the owner's other Claude Code accounts.
+     * LEGACY: the token an older Crewly saved for one of the owner's other
+     * Claude Code accounts (never written any more).
      *
      * @param account - Account name
      * @returns The token, or null when none is stored
@@ -207,7 +184,8 @@ export class HarnessCredentialsStore {
         return Object.keys(accounts).filter((name) => isNonEmptyString(accounts[name]?.oauthToken));
     }
     /**
-     * Forget the token of one of the owner's other Claude Code accounts.
+     * Forget the token of one of the owner's other Claude Code accounts. The
+     * `claudeAccounts` key goes away with its last entry.
      *
      * @param account - Account name
      */
@@ -217,7 +195,85 @@ export class HarnessCredentialsStore {
             return;
         const accounts = { ...current.claudeAccounts };
         delete accounts[account];
-        this.write({ ...current, claudeAccounts: accounts });
+        const next = { ...current };
+        if (Object.keys(accounts).length > 0)
+            next.claudeAccounts = accounts;
+        else
+            delete next.claudeAccounts;
+        this.write(next);
+    }
+    /**
+     * LEGACY: the default login's token an older Crewly saved.
+     *
+     * @returns The token, or null
+     */
+    getLegacyClaudeOauthToken() {
+        const token = this.read().claude?.oauthToken;
+        return isNonEmptyString(token) ? token : null;
+    }
+    /**
+     * Delete the default login's legacy token. The `claude` key is removed
+     * when nothing but bookkeeping is left (a stored API key stays).
+     */
+    clearLegacyClaudeOauthToken() {
+        const current = this.read();
+        if (!current.claude || !('oauthToken' in current.claude))
+            return;
+        const { oauthToken: _removed, ...rest } = current.claude;
+        const next = { ...current };
+        if (isNonEmptyString(rest.anthropicApiKey))
+            next.claude = rest;
+        else
+            delete next.claude;
+        this.write(next);
+    }
+    /**
+     * Remove what an older Crewly left for Claude sign-in tokens once no token
+     * is stored: empty `claudeAccounts` entries or object, an empty
+     * `claude.oauthToken`, and a `claude` object holding nothing but
+     * bookkeeping. A stored API key and every other key stay untouched. Does
+     * nothing (and does not rewrite the file) when there is nothing to remove.
+     */
+    pruneLegacyClaudeKeys() {
+        const current = this.read();
+        const next = { ...current };
+        let changed = false;
+        if (next.claudeAccounts) {
+            const kept = Object.fromEntries(Object.entries(next.claudeAccounts).filter(([, v]) => isNonEmptyString(v?.oauthToken)));
+            if (Object.keys(kept).length !== Object.keys(next.claudeAccounts).length || Object.keys(kept).length === 0) {
+                changed = true;
+                if (Object.keys(kept).length > 0)
+                    next.claudeAccounts = kept;
+                else
+                    delete next.claudeAccounts;
+            }
+        }
+        if (next.claude && !isNonEmptyString(next.claude.oauthToken)) {
+            const { oauthToken: _unused, updatedAt: _stamp, ...rest } = next.claude;
+            if (Object.keys(rest).length === 0) {
+                delete next.claude;
+                changed = true;
+            }
+            else if ('oauthToken' in next.claude) {
+                next.claude = { ...rest, ...(next.claude.updatedAt ? { updatedAt: next.claude.updatedAt } : {}) };
+                changed = true;
+            }
+        }
+        if (changed)
+            this.write(next);
+    }
+    /**
+     * Env that keeps an account working with the token an older Crewly saved
+     * for it. LEGACY, transition only: empty once the account's native login
+     * is verified and the token deleted. This is the only place the token is
+     * handed to a Claude Code process.
+     *
+     * @param account - Named account; null = the default login
+     * @returns `{ CLAUDE_CODE_OAUTH_TOKEN }`, or `{}` when no token is stored
+     */
+    legacyClaudeTokenEnv(account) {
+        const token = account ? this.getClaudeAccountToken(account) : this.getLegacyClaudeOauthToken();
+        return token ? { [HARNESS_CONSTANTS.CLAUDE.OAUTH_TOKEN_ENV]: token } : {};
     }
     /**
      * Which Claude credential Crewly holds (never the value).
@@ -236,8 +292,8 @@ export class HarnessCredentialsStore {
      * Env vars to inject into agent sessions.
      *
      * Always sets PATH (user npm prefix bin first, see harness-exec.utils).
-     * Adds `CLAUDE_CODE_OAUTH_TOKEN` or `ANTHROPIC_API_KEY` when Crewly holds
-     * a Claude credential. Nothing is added for Codex: it reads its own
+     * Adds `ANTHROPIC_API_KEY` when Crewly holds one (and, during the token
+     * migration only, the legacy token of the default login). Nothing is added for Codex: it reads its own
      * `auth.json`.
      *
      * For an `antigravity-cli` session it also adds the stored Gemini key as
@@ -254,8 +310,9 @@ export class HarnessCredentialsStore {
         const env = { PATH: buildHarnessPath(baseEnv.PATH) };
         const stored = this.read();
         const claude = stored.claude;
-        if (isNonEmptyString(claude?.oauthToken)) {
-            env[HARNESS_CONSTANTS.CLAUDE.OAUTH_TOKEN_ENV] = claude.oauthToken;
+        const legacy = this.legacyClaudeTokenEnv(null);
+        if (Object.keys(legacy).length > 0) {
+            Object.assign(env, legacy);
         }
         else if (isNonEmptyString(claude?.anthropicApiKey)) {
             env[HARNESS_CONSTANTS.CLAUDE.API_KEY_ENV] = claude.anthropicApiKey;

package/dist/backend/backend/src/services/harness/harness-credentials.store.js.map

@@ -1 +1 @@
-{"version":3,"file":"harness-credentials.store.js","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/harness-credentials.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AA+B3D;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IAKN;IAJ7B;;;OAGG;IACH,YAA6B,QAAiB;QAAjB,aAAQ,GAAR,QAAQ,CAAS;IAAG,CAAC;IAElD;;;;OAIG;IACH,WAAW;QACV,OAAO,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAC5F,CAAC;IAED;;;;OAIG;IACH,IAAI;QACH,IAAI,CAAC;YACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;YACjF,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;QACtH,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAA+B;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QACvD,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QAC1E,IAAI,CAAC;YACJ,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACV,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QAC3D,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB,CAAC,KAAa;QAChC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACvG,CAAC;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,GAAW;QAC7B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,GAAW;QAC1B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACtG,CAAC;IAED;;;;;OAKG;IACH,0BAA0B,CAAC,GAAW;QACrC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED;;;;OAIG;IACH,0BAA0B;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;QAClD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,gBAAgB;QACf,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,WAAW;YAAE,OAAO;QACjC,MAAM,IAAI,GAAuB,EAAE,GAAG,OAAO,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,WAAW,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,WAAW;QACV,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO;QAC5B,MAAM,IAAI,GAAuB,EAAE,GAAG,OAAO,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,MAAM,CAAC;QACnB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACH,qBAAqB,CAAC,OAAe,EAAE,KAAa;QACnD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC;YACV,GAAG,OAAO;YACV,cAAc,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE;SACnI,CAAC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,qBAAqB,CAAC,OAAe;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;QAChE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACH,2BAA2B;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,cAAc,IAAI,EAAE,CAAC;QAClD,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,OAAe;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC;YAAE,OAAO;QAC/C,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;QAC/C,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtD,CAAC;IAED;;;;OAIG;IACH,uBAAuB;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC;QAClC,IAAI,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC;YAAE,OAAO,aAAa,CAAC;QAC/D,IAAI,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC;YAAE,OAAO,SAAS,CAAC;QAChE,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAAmB,CAAC,UAA6B,OAAO,CAAC,GAAG,EAAE,WAAoB;QACjF,MAAM,GAAG,GAA2B,EAAE,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;YAC1C,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;QACnE,CAAC;aAAM,IAAI,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;QACpE,CAAC;QACD,IAAI,WAAW,KAAK,aAAa,CAAC,eAAe,EAAE,CAAC;YACnD,GAAG,CAAC,qBAAqB,CAAC,uBAAuB,CAAC,GAAG,qBAAqB,CAAC,yBAAyB,CAAC;YACrG,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC;YAC7C,IAAI,gBAAgB,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,qBAAqB,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;QACzE,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;CACD;AAED,4EAA4E;AAC5E,MAAM,YAAY,GAAG,IAAI,uBAAuB,EAAE,CAAC;AAEnD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B;IACzC,OAAO,YAAY,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAA6B,OAAO,CAAC,GAAG,EAAE,WAAoB;IACjG,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IACjD,CAAC;AACF,CAAC"}
+{"version":3,"file":"harness-credentials.store.js","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/harness-credentials.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AA+B3D;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IAKN;IAJ7B;;;OAGG;IACH,YAA6B,QAAiB;QAAjB,aAAQ,GAAR,QAAQ,CAAS;IAAG,CAAC;IAElD;;;;OAIG;IACH,WAAW;QACV,OAAO,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAC5F,CAAC;IAED;;;;OAIG;IACH,IAAI;QACH,IAAI,CAAC;YACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;YACjF,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;QACtH,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAA+B;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QACvD,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QAC1E,IAAI,CAAC;YACJ,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACV,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QAC3D,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,GAAW;QAC7B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,GAAW;QAC1B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACtG,CAAC;IAED;;;;;OAKG;IACH,0BAA0B,CAAC,GAAW;QACrC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED;;;;OAIG;IACH,0BAA0B;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;QAClD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,gBAAgB;QACf,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,WAAW;YAAE,OAAO;QACjC,MAAM,IAAI,GAAuB,EAAE,GAAG,OAAO,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,WAAW,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,WAAW;QACV,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO;QAC5B,MAAM,IAAI,GAAuB,EAAE,GAAG,OAAO,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,MAAM,CAAC;QACnB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACH,qBAAqB,CAAC,OAAe;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;QAChE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACH,2BAA2B;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,cAAc,IAAI,EAAE,CAAC;QAClD,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,OAAe;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC;YAAE,OAAO;QAC/C,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;QAC/C,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,IAAI,GAAuB,EAAE,GAAG,OAAO,EAAE,CAAC;QAChD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;;YAChE,OAAO,IAAI,CAAC,cAAc,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACH,yBAAyB;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;QAC7C,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACH,2BAA2B;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO;QACjE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACzD,MAAM,IAAI,GAAuB,EAAE,GAAG,OAAO,EAAE,CAAC;QAChD,IAAI,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;;YAC1D,OAAO,IAAI,CAAC,MAAM,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACH,qBAAqB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAuB,EAAE,GAAG,OAAO,EAAE,CAAC;QAChD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;YACxH,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5G,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;oBAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;;oBACxD,OAAO,IAAI,CAAC,cAAc,CAAC;YACjC,CAAC;QACF,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;YACxE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpC,OAAO,IAAI,CAAC,MAAM,CAAC;gBACnB,OAAO,GAAG,IAAI,CAAC;YAChB,CAAC;iBAAM,IAAI,YAAY,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACxC,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClG,OAAO,GAAG,IAAI,CAAC;YAChB,CAAC;QACF,CAAC;QACD,IAAI,OAAO;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;;OAQG;IACH,oBAAoB,CAAC,OAAsB;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC/F,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACH,uBAAuB;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC;QAClC,IAAI,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC;YAAE,OAAO,aAAa,CAAC;QAC/D,IAAI,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC;YAAE,OAAO,SAAS,CAAC;QAChE,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAAmB,CAAC,UAA6B,OAAO,CAAC,GAAG,EAAE,WAAoB;QACjF,MAAM,GAAG,GAA2B,EAAE,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC;aAAM,IAAI,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;QACpE,CAAC;QACD,IAAI,WAAW,KAAK,aAAa,CAAC,eAAe,EAAE,CAAC;YACnD,GAAG,CAAC,qBAAqB,CAAC,uBAAuB,CAAC,GAAG,qBAAqB,CAAC,yBAAyB,CAAC;YACrG,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC;YAC7C,IAAI,gBAAgB,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,qBAAqB,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;QACzE,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;CACD;AAED,4EAA4E;AAC5E,MAAM,YAAY,GAAG,IAAI,uBAAuB,EAAE,CAAC;AAEnD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B;IACzC,OAAO,YAAY,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAA6B,OAAO,CAAC,GAAG,EAAE,WAAoB;IACjG,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IACjD,CAAC;AACF,CAAC"}