gsd-pi 2.78.0 → 2.78.1

package/src/resources/extensions/claude-code-cli/readiness.ts

@@ -5,8 +5,13 @@
  * Results are cached for 30 seconds to avoid shelling out on every
  * model-availability check.
  *
- * Auth verification follows the T3 Code pattern: run `claude auth status`
- * and check the exit code + output for an authenticated session.
+ * Auth verification runs `claude auth status --json` and inspects the
+ * `loggedIn` field, falling back to plain `claude auth status` and a text
+ * heuristic when the JSON shape is unavailable (older Claude CLI builds).
+ *
+ * Set GSD_CLAUDE_DEBUG=1 to print the probe's binary selection and auth
+ * outputs to stderr — useful when diagnosing platform-specific detection
+ * failures (Issue #4997).
  */
 
 import { execFileSync } from "node:child_process";
@@ -27,27 +32,109 @@ const CLAUDE_COMMAND = process.platform === "win32" ? "claude.cmd" : "claude";
  */
 const CLAUDE_COMMAND_CANDIDATES = process.platform === "win32" ? [CLAUDE_COMMAND, "claude.exe", "claude"] : [CLAUDE_COMMAND];
 
-function execClaude(args: string[]): Buffer {
-	let lastError: unknown;
+// Keep the version probe snappy — `claude --version` is a quick path.
+const VERSION_TIMEOUT_MS = 5_000;
+// Auth status can be much slower on Windows because the spawn goes through
+// cmd.exe → claude.cmd → node → Claude CLI. 15s leaves headroom on cold spawns
+// without making startup feel hung when the CLI is genuinely missing.
+const AUTH_TIMEOUT_MS = 15_000;
+
+function debugLog(...parts: unknown[]): void {
+	if (process.env.GSD_CLAUDE_DEBUG) {
+		process.stderr.write(`[claude-readiness] ${parts.map((p) => (typeof p === "string" ? p : JSON.stringify(p))).join(" ")}\n`);
+	}
+}
+
+/**
+ * Find the first candidate that responds to `--version`. Returns the
+ * candidate name on success, null if none worked.
+ *
+ * On Windows with `shell: true`, a missing candidate surfaces as a
+ * non-zero exit from cmd.exe rather than ENOENT — so we cannot rely on
+ * the error code to decide "try next". Treat any failure as "try next"
+ * for the version probe; the only thing that matters for binary
+ * detection is whether *some* candidate produces a `claude --version`
+ * line.
+ */
+function findWorkingCommand(): string | null {
 	for (const command of CLAUDE_COMMAND_CANDIDATES) {
 		try {
-			return execFileSync(command, args, {
-				timeout: 5_000,
+			execFileSync(command, ["--version"], {
+				timeout: VERSION_TIMEOUT_MS,
 				stdio: "pipe",
 				shell: process.platform === "win32",
 			});
+			debugLog("version probe ok via", command);
+			return command;
 		} catch (error) {
-			lastError = error;
-			const code = (error as NodeJS.ErrnoException | undefined)?.code;
-			// Windows Git Bash can surface `.cmd` spawn failures as EINVAL instead
-			// of ENOENT. Treat both as "try next candidate".
-			if (code === "ENOENT" || code === "EINVAL") {
-				continue;
+			debugLog("version probe failed for", command, "code=", (error as NodeJS.ErrnoException | undefined)?.code);
+			continue;
+		}
+	}
+	return null;
+}
+
+/**
+ * Decide auth state from `claude auth status` output.
+ *
+ * Newer Claude CLI builds emit JSON by default with a `loggedIn` boolean.
+ * Older builds emit free-form text. We prefer the structured signal and fall
+ * back to a text heuristic. Note: the text heuristic only covers English
+ * phrasing — the JSON path is the durable signal.
+ */
+function parseAuthStatus(output: string): boolean | null {
+	const trimmed = output.trim();
+	if (!trimmed) return null;
+
+	if (trimmed.startsWith("{")) {
+		try {
+			const parsed = JSON.parse(trimmed) as { loggedIn?: unknown };
+			if (typeof parsed.loggedIn === "boolean") {
+				return parsed.loggedIn;
 			}
-			throw error;
+		} catch {
+			// Fall through to text heuristic.
 		}
 	}
-	throw lastError ?? new Error(`Claude CLI executable not found (tried: ${CLAUDE_COMMAND_CANDIDATES.join(", ")})`);
+
+	const lower = trimmed.toLowerCase();
+	if (/not logged in|no credentials|unauthenticated|not authenticated/.test(lower)) {
+		return false;
+	}
+	if (/logged in|authenticated|signed in|email|subscription/.test(lower)) {
+		return true;
+	}
+	return null;
+}
+
+function probeAuth(command: string): boolean | null {
+	// Try --json first (newer CLIs).
+	try {
+		const out = execFileSync(command, ["auth", "status", "--json"], {
+			timeout: AUTH_TIMEOUT_MS,
+			stdio: "pipe",
+			shell: process.platform === "win32",
+		}).toString();
+		debugLog("auth status --json output:", out.slice(0, 200));
+		const parsed = parseAuthStatus(out);
+		if (parsed !== null) return parsed;
+	} catch (error) {
+		debugLog("auth status --json threw:", (error as Error).message?.slice(0, 200));
+	}
+
+	// Fallback: plain `auth status` (older CLIs that don't accept --json).
+	try {
+		const out = execFileSync(command, ["auth", "status"], {
+			timeout: AUTH_TIMEOUT_MS,
+			stdio: "pipe",
+			shell: process.platform === "win32",
+		}).toString();
+		debugLog("auth status output:", out.slice(0, 200));
+		return parseAuthStatus(out);
+	} catch (error) {
+		debugLog("auth status threw:", (error as Error).message?.slice(0, 200));
+		return null;
+	}
 }
 
 let cachedBinaryPresent: boolean | null = null;
@@ -55,6 +142,10 @@ let cachedAuthed: boolean | null = null;
 let lastCheckMs = 0;
 const CHECK_INTERVAL_MS = 30_000;
 
+/**
+ * Refresh the cached binary/auth state when the cache window has expired.
+ * Preserves a known auth state across soft-fail auth probes.
+ */
 function refreshCache(): void {
 	const now = Date.now();
 	if (cachedBinaryPresent !== null && now - lastCheckMs < CHECK_INTERVAL_MS) {
@@ -64,27 +155,23 @@ function refreshCache(): void {
 	// Set timestamp first to prevent re-entrant checks during the same window
 	lastCheckMs = now;
 
-	// Check binary presence
-	try {
-		execClaude(["--version"]);
-		cachedBinaryPresent = true;
-	} catch {
+	const command = findWorkingCommand();
+	if (!command) {
 		cachedBinaryPresent = false;
 		cachedAuthed = false;
 		return;
 	}
+	cachedBinaryPresent = true;
 
-	// Check auth status — exit code 0 with non-error output means authenticated
-	try {
-		const output = execClaude(["auth", "status"])
-			.toString()
-			.toLowerCase();
-		// The CLI outputs "not logged in", "no credentials", or similar when unauthenticated
-		cachedAuthed = !(/not logged in|no credentials|unauthenticated|not authenticated/i.test(output));
-	} catch {
-		// Non-zero exit code means not authenticated
-		cachedAuthed = false;
+	const authed = probeAuth(command);
+	if (authed === null) {
+		// Couldn't determine auth state from CLI output. Don't clobber a
+		// previously known-good cache; otherwise default to false so we don't
+		// silently route requests to an unauthenticated CLI.
+		if (cachedAuthed === null) cachedAuthed = false;
+		return;
 	}
+	cachedAuthed = authed;
 }
 
 /**