skills-script 1.1.2 → 1.2.0

package/README.md

@@ -29,8 +29,10 @@ npx skills-script
 1. 工具选择：
    - `skills-sync`
    - `claude-settings-switch`
+   - `claude-auth-switch`
 2. 进入对应工具流程并执行。
 3. `claude-settings-switch` 固定操作 `~/.claude`（例如 `/Users/youzi/.claude`）。
+4. `claude-auth-switch` 管理官方登录授权账号的备份与切换（Keychain + `~/.claude.json`），账号档案隔离存放在 `~/.claude/auth-accounts/`。
 
 ## 非交互模式
 
@@ -44,6 +46,7 @@ npx skills-script sync claude,codex,.aaa
 
 - `docs/tools/skills-sync.md`
 - `docs/tools/claude-settings-switch.md`
+- `docs/tools/claude-auth-switch.md`
 
 ## 发布
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skills-script",
-  "version": "1.1.2",
+  "version": "1.2.0",
   "description": "Interactive skills toolkit CLI",
   "type": "module",
   "bin": {

package/src/commands/interactive.js

@@ -2,6 +2,7 @@ import path from 'node:path';
 import { multiSelect, promptInput, selectOne } from '../lib/interactive.js';
 import { resolveTargetDirs, runSyncByTargets } from './sync.js';
 import { runClaudeSettingSwitch } from './switch-setting.js';
+import { runClaudeAuthSwitch } from './switch-auth.js';
 
 function parseCustomInput(input) {
   if (!input) return [];
@@ -16,7 +17,8 @@ export async function runInteractive(cwd = process.cwd()) {
     title: 'Select a tool',
     options: [
       { label: 'skills-sync', value: 'skills-sync' },
-      { label: 'claude-settings-switch', value: 'claude-settings-switch' }
+      { label: 'claude-settings-switch', value: 'claude-settings-switch' },
+      { label: 'claude-auth-switch', value: 'claude-auth-switch' }
     ]
   });
 
@@ -24,6 +26,10 @@ export async function runInteractive(cwd = process.cwd()) {
     return runClaudeSettingSwitch();
   }
 
+  if (tool === 'claude-auth-switch') {
+    return runClaudeAuthSwitch();
+  }
+
   if (tool !== 'skills-sync') {
     console.error('[ERROR] Unsupported tool selected.');
     return 1;

package/src/commands/switch-auth.js

@@ -0,0 +1,154 @@
+import { selectOne } from '../lib/interactive.js';
+import {
+  applyAccountState,
+  deleteProfile,
+  getCurrentAccount,
+  listProfiles,
+  loadProfile,
+  saveProfile,
+  writeClaudeJson,
+  writeCredentials
+} from '../lib/claude-auth.js';
+
+function formatProfileLabel(profile, currentSlug) {
+  const parts = [profile.email];
+  if (profile.slug === currentSlug) parts.push('(current)');
+  if (profile.corrupted) parts.push('(corrupted)');
+  if (profile.savedAt) parts.push(`saved ${profile.savedAt}`);
+  return parts.join('  ');
+}
+
+async function backupCurrentAccount(current) {
+  const filePath = await saveProfile({
+    slug: current.slug,
+    email: current.email,
+    credentials: current.credentials,
+    claudeJson: current.claudeJson
+  });
+  console.log(`[OK] backup: ${filePath}`);
+}
+
+async function runSaveCurrent(current) {
+  if (!current.loggedIn) {
+    console.error('[ERROR] No active login found (credentials or oauthAccount missing).');
+    return 1;
+  }
+  await backupCurrentAccount(current);
+  return 0;
+}
+
+async function runSwitch(current) {
+  const profiles = (await listProfiles()).filter((p) => !p.corrupted);
+  const candidates = profiles.filter((p) => p.slug !== current.slug);
+
+  if (!candidates.length) {
+    console.error('[ERROR] No other saved account to switch to.');
+    console.error('        Save the current account first, then log in with another account and run this tool again.');
+    return 1;
+  }
+
+  const targetSlug = await selectOne({
+    title: `Switch Claude auth account (current: ${current.email || 'not logged in'})`,
+    options: candidates.map((p) => ({
+      label: formatProfileLabel(p, current.slug),
+      value: p.slug
+    }))
+  });
+
+  const target = await loadProfile(targetSlug);
+
+  if (current.loggedIn) {
+    await backupCurrentAccount(current);
+  }
+
+  try {
+    await writeCredentials(target.credentials);
+  } catch (error) {
+    console.error(`[ERROR] Failed to write credentials: ${error?.message || error}`);
+    return 1;
+  }
+
+  try {
+    const nextClaudeJson = applyAccountState(current.claudeJson, target.accountState || {});
+    await writeClaudeJson(nextClaudeJson);
+  } catch (error) {
+    // Roll credentials back so keychain and ~/.claude.json stay consistent.
+    if (current.credentials) {
+      try {
+        await writeCredentials(current.credentials);
+      } catch {
+        console.error('[ERROR] Rollback of credentials also failed. Re-login may be required.');
+      }
+    }
+    console.error(`[ERROR] Failed to update ~/.claude.json: ${error?.message || error}`);
+    return 1;
+  }
+
+  console.log(`[OK] active account: ${target.email || targetSlug}`);
+  console.log('[WARN] Restart running Claude Code sessions to pick up the new account.');
+  return 0;
+}
+
+async function runDelete(current) {
+  const profiles = await listProfiles();
+  if (!profiles.length) {
+    console.error('[ERROR] No saved account profile found.');
+    return 1;
+  }
+
+  const targetSlug = await selectOne({
+    title: 'Delete a saved auth account profile',
+    options: profiles.map((p) => ({
+      label: formatProfileLabel(p, current.slug),
+      value: p.slug
+    }))
+  });
+
+  const confirmed = await selectOne({
+    title: `Delete profile "${targetSlug}"? The saved tokens will be removed permanently.`,
+    options: [
+      { label: 'No, keep it', value: false },
+      { label: 'Yes, delete', value: true }
+    ]
+  });
+
+  if (!confirmed) {
+    console.log('[INFO] Canceled.');
+    return 0;
+  }
+
+  const filePath = await deleteProfile(targetSlug);
+  console.log(`[OK] deleted: ${filePath}`);
+  return 0;
+}
+
+export async function runClaudeAuthSwitch() {
+  let current;
+  try {
+    current = await getCurrentAccount();
+  } catch (error) {
+    console.error(`[ERROR] Failed to read current auth state: ${error?.message || error}`);
+    return 1;
+  }
+
+  const action = await selectOne({
+    title: `Claude auth account (current: ${current.email || 'not logged in'})`,
+    options: [
+      { label: 'Switch account', value: 'switch' },
+      { label: 'Backup current account', value: 'save' },
+      { label: 'Delete saved profile', value: 'delete' }
+    ]
+  });
+
+  try {
+    if (action === 'switch') return await runSwitch(current);
+    if (action === 'save') return await runSaveCurrent(current);
+    if (action === 'delete') return await runDelete(current);
+  } catch (error) {
+    console.error(`[ERROR] ${error?.message || error}`);
+    return 1;
+  }
+
+  console.error('[ERROR] Unsupported action.');
+  return 1;
+}

package/src/commands/switch-setting.js

@@ -116,11 +116,9 @@ export async function runClaudeSettingSwitch() {
   }
 
   const baseUrlValue = findAnthropicBaseUrlValue(activeJson);
-  const baseUrlName = normalizeBaseUrlName(baseUrlValue);
-  if (!baseUrlName) {
-    console.error('[ERROR] ANTHROPIC_BASE_URL not found in current settings.json');
-    return 1;
-  }
+  // Without ANTHROPIC_BASE_URL the active settings use the official login,
+  // so back it up as the "auth" variant.
+  const baseUrlName = normalizeBaseUrlName(baseUrlValue) || 'auth';
 
   const backupPath = await getUniqueBackupPath(claudeDir, `settings.${baseUrlName}.json`);
   const selectedPath = path.join(claudeDir, selected);

package/src/lib/claude-auth.js

@@ -0,0 +1,265 @@
+import { spawn } from 'node:child_process';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import process from 'node:process';
+
+const KEYCHAIN_SERVICE = 'Claude Code-credentials';
+
+// Fields in ~/.claude.json that belong to the logged-in account. They are
+// swapped together with the credentials so quota/subscription/model-access
+// state never leaks from one account into another.
+export const ACCOUNT_SCOPED_KEYS = [
+  'oauthAccount',
+  'userID',
+  'hasAvailableSubscription',
+  'subscriptionNoticeCount',
+  'cachedExtraUsageDisabledReason',
+  'modelAccessCache',
+  's1mAccessCache',
+  'passesEligibilityCache',
+  'orgModelDefaultCache',
+  'additionalModelCostsCache',
+  'additionalModelOptionsCache',
+  'clientDataCacheSlots'
+];
+
+export function getClaudeDir() {
+  return path.join(os.homedir(), '.claude');
+}
+
+export function getAuthStoreDir() {
+  return path.join(getClaudeDir(), 'auth-accounts');
+}
+
+export function getClaudeJsonPath() {
+  return path.join(os.homedir(), '.claude.json');
+}
+
+function isDarwin() {
+  return process.platform === 'darwin';
+}
+
+function getCredentialsFilePath() {
+  return path.join(getClaudeDir(), '.credentials.json');
+}
+
+function runSecurity(args, { stdinText } = {}) {
+  return new Promise((resolve) => {
+    const child = spawn('security', args, {
+      stdio: [stdinText === undefined ? 'ignore' : 'pipe', 'pipe', 'pipe']
+    });
+
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr.on('data', (chunk) => {
+      stderr += chunk;
+    });
+    child.on('error', (error) => {
+      resolve({ code: -1, stdout, stderr: String(error?.message || error) });
+    });
+    child.on('close', (code) => {
+      resolve({ code: code ?? -1, stdout, stderr });
+    });
+
+    if (stdinText !== undefined) {
+      child.stdin.end(stdinText);
+    }
+  });
+}
+
+function quoteForSecurityShell(value) {
+  return `"${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}
+
+async function readKeychainCredentials() {
+  const result = await runSecurity([
+    'find-generic-password',
+    '-s',
+    KEYCHAIN_SERVICE,
+    '-w'
+  ]);
+  if (result.code !== 0) return null;
+  const raw = result.stdout.replace(/\n$/, '');
+  return raw || null;
+}
+
+// Writes through `security -i` (commands over stdin) so the token never
+// appears in the process argument list.
+async function writeKeychainCredentials(raw) {
+  const command = [
+    'add-generic-password',
+    '-U',
+    '-s',
+    quoteForSecurityShell(KEYCHAIN_SERVICE),
+    '-a',
+    quoteForSecurityShell(os.userInfo().username),
+    '-w',
+    quoteForSecurityShell(raw)
+  ].join(' ');
+
+  const result = await runSecurity(['-i'], { stdinText: `${command}\n` });
+  if (result.code !== 0) {
+    throw new Error(`Keychain write failed: ${result.stderr.trim() || `exit ${result.code}`}`);
+  }
+}
+
+export async function readCredentials() {
+  if (isDarwin()) {
+    return readKeychainCredentials();
+  }
+
+  try {
+    return await fs.readFile(getCredentialsFilePath(), 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+export async function writeCredentials(raw) {
+  if (isDarwin()) {
+    await writeKeychainCredentials(raw);
+    return;
+  }
+
+  await writeFileAtomic(getCredentialsFilePath(), raw, 0o600);
+}
+
+async function writeFileAtomic(filePath, content, mode) {
+  const tmpPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
+  await fs.writeFile(tmpPath, content, { mode });
+  await fs.rename(tmpPath, filePath);
+}
+
+export async function readClaudeJson() {
+  const raw = await fs.readFile(getClaudeJsonPath(), 'utf8');
+  return JSON.parse(raw);
+}
+
+export async function writeClaudeJson(json) {
+  await writeFileAtomic(getClaudeJsonPath(), JSON.stringify(json, null, 2), 0o600);
+}
+
+export function extractAccountState(claudeJson) {
+  const state = {};
+  for (const key of ACCOUNT_SCOPED_KEYS) {
+    if (Object.prototype.hasOwnProperty.call(claudeJson, key)) {
+      state[key] = claudeJson[key];
+    }
+  }
+  return state;
+}
+
+export function applyAccountState(claudeJson, state) {
+  const next = { ...claudeJson };
+  for (const key of ACCOUNT_SCOPED_KEYS) {
+    if (Object.prototype.hasOwnProperty.call(state, key)) {
+      next[key] = state[key];
+    } else {
+      delete next[key];
+    }
+  }
+  return next;
+}
+
+export function normalizeAccountSlug(email) {
+  if (typeof email !== 'string') return null;
+  const cleaned = email
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9.-]+/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-+|-+$/g, '');
+  return cleaned || null;
+}
+
+export function profileFileName(slug) {
+  return `auth.${slug}.json`;
+}
+
+async function ensureStoreDir() {
+  const dir = getAuthStoreDir();
+  await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+  // mkdir does not change the mode of a pre-existing directory.
+  await fs.chmod(dir, 0o700);
+  return dir;
+}
+
+export async function getCurrentAccount() {
+  const [credentials, claudeJson] = await Promise.all([
+    readCredentials(),
+    readClaudeJson()
+  ]);
+
+  const email = claudeJson?.oauthAccount?.emailAddress || null;
+  return {
+    credentials,
+    claudeJson,
+    email,
+    slug: normalizeAccountSlug(email),
+    loggedIn: Boolean(credentials && email)
+  };
+}
+
+export async function saveProfile({ slug, email, credentials, claudeJson }) {
+  const dir = await ensureStoreDir();
+  const filePath = path.join(dir, profileFileName(slug));
+  const profile = {
+    version: 1,
+    email,
+    savedAt: new Date().toISOString(),
+    credentials,
+    accountState: extractAccountState(claudeJson)
+  };
+  await writeFileAtomic(filePath, JSON.stringify(profile, null, 2), 0o600);
+  await fs.chmod(filePath, 0o600);
+  return filePath;
+}
+
+export async function listProfiles() {
+  let entries;
+  try {
+    entries = await fs.readdir(getAuthStoreDir(), { withFileTypes: true });
+  } catch {
+    return [];
+  }
+
+  const profiles = [];
+  for (const entry of entries) {
+    const match = entry.isFile() && entry.name.match(/^auth\.(.+)\.json$/);
+    if (!match) continue;
+
+    const filePath = path.join(getAuthStoreDir(), entry.name);
+    try {
+      const profile = JSON.parse(await fs.readFile(filePath, 'utf8'));
+      profiles.push({
+        slug: match[1],
+        email: profile.email || match[1],
+        savedAt: profile.savedAt || null,
+        filePath
+      });
+    } catch {
+      profiles.push({ slug: match[1], email: match[1], savedAt: null, filePath, corrupted: true });
+    }
+  }
+
+  return profiles.sort((a, b) => a.slug.localeCompare(b.slug));
+}
+
+export async function loadProfile(slug) {
+  const filePath = path.join(getAuthStoreDir(), profileFileName(slug));
+  const profile = JSON.parse(await fs.readFile(filePath, 'utf8'));
+  if (!profile || typeof profile !== 'object' || !profile.credentials) {
+    throw new Error(`Profile is missing credentials: ${filePath}`);
+  }
+  return profile;
+}
+
+export async function deleteProfile(slug) {
+  const filePath = path.join(getAuthStoreDir(), profileFileName(slug));
+  await fs.rm(filePath);
+  return filePath;
+}