very-happy-cli 0.2.182 → 0.2.183

package/dist/daemonSupervisor-57JYYzMf.cjs

@@ -0,0 +1,268 @@
+'use strict';
+
+var node_child_process = require('node:child_process');
+var module$1 = require('node:module');
+var node_crypto = require('node:crypto');
+var path = require('node:path');
+var os = require('node:os');
+
+var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
+const CLAUDE_KEYCHAIN_SERVICE_PREFIX = "Claude Code";
+function keychainIdentity(env = process.env, deps = {}) {
+  const home = deps.home ?? os.homedir();
+  const secureDir = env.CLAUDE_SECURESTORAGE_CONFIG_DIR?.trim();
+  const configDirEnv = env.CLAUDE_CONFIG_DIR?.trim();
+  const configDir = secureDir || configDirEnv || path.join(home, ".claude");
+  const hasCustomDir = Boolean(secureDir || configDirEnv);
+  const dirSuffix = hasCustomDir ? "-" + node_crypto.createHash("sha256").update(configDir.normalize("NFC")).digest("hex").slice(0, 8) : "";
+  const oauthSuffix = env.CLAUDE_CODE_OAUTH_CLIENT_ID?.trim() ? "-custom-oauth" : "";
+  const rawAccount = env.USER || safeUsername(deps.username);
+  const account = /^[a-zA-Z0-9._-]+$/.test(rawAccount) ? rawAccount : "claude-code-user";
+  return {
+    service: `${CLAUDE_KEYCHAIN_SERVICE_PREFIX}${oauthSuffix}-credentials${dirSuffix}`,
+    account,
+    configDir,
+    credentialsPath: path.join(configDir, ".credentials.json")
+  };
+}
+function safeUsername(provider) {
+  try {
+    return provider ? provider() : os.userInfo().username;
+  } catch {
+    return "";
+  }
+}
+
+const CLAUDE_AUTH_PROBE_VERSION = 1;
+const LOCAL_CREDENTIAL_SOURCE = "Claude local credentials";
+function classifyAuthStatus(run, credentialSource) {
+  const localSource = credentialSource === void 0 || credentialSource === LOCAL_CREDENTIAL_SOURCE;
+  if (run.spawnError) {
+    return { status: "error", diagnosis: "probe-crash", detail: `could not run claude auth status: ${run.spawnError}` };
+  }
+  if (run.timedOut) {
+    return { status: "error", diagnosis: "probe-timeout", detail: "claude auth status did not answer within the timeout" };
+  }
+  const parsed = parseJsonObject(run.stdout);
+  if (!parsed) {
+    if (!localSource) return { status: "unknown", authMethod: credentialSource, detail: `auth status unparseable under ${credentialSource}` };
+    return { status: "error", diagnosis: "probe-crash", detail: `claude auth status returned no JSON (exit ${run.exitCode ?? "null"})` };
+  }
+  const authMethod = typeof parsed.authMethod === "string" ? parsed.authMethod : void 0;
+  const subscriptionType = typeof parsed.subscriptionType === "string" ? parsed.subscriptionType : void 0;
+  if (parsed.loggedIn === true) {
+    return { status: "ok", authMethod: localSource ? authMethod : credentialSource, subscriptionType };
+  }
+  if (!localSource) {
+    return { status: "unknown", authMethod: credentialSource, detail: `Claude Code reports loggedIn=false under ${credentialSource}; not a local-credential failure` };
+  }
+  return { status: "not-logged-in", authMethod, subscriptionType, detail: "Claude Code in the daemon context reports it is not logged in" };
+}
+function parseJsonObject(text) {
+  const trimmed = text.trim();
+  if (!trimmed) return null;
+  const start = trimmed.indexOf("{");
+  if (start < 0) return null;
+  try {
+    const value = JSON.parse(trimmed.slice(start));
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function resolveSdkClaudeBinary(platform = process.platform, arch = process.arch, resolver = (s) => module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('daemonSupervisor-57JYYzMf.cjs', document.baseURI).href))).resolve(s)) {
+  const platformArch = `${platform}-${arch}`;
+  const candidates = [
+    `@anthropic-ai/claude-agent-sdk-${platformArch}/claude`,
+    `@anthropic-ai/claude-agent-sdk-${platformArch}/claude.exe`
+  ];
+  for (const candidate of candidates) {
+    try {
+      return resolver(candidate);
+    } catch {
+    }
+  }
+  return null;
+}
+function interpretSecurityRead(result) {
+  if (result.error === "ENOENT") return { kind: "unsupported" };
+  if (result.error === "timeout") return { kind: "error", detail: "security timed out" };
+  if (result.exitCode === 44) return { kind: "absent" };
+  if (result.exitCode === 36) return { kind: "unreadable" };
+  if (result.exitCode !== 0) return { kind: "error", detail: `security exited ${result.exitCode ?? "null"}` };
+  const raw = result.stdout.trim();
+  if (!raw) return { kind: "absent" };
+  const parsed = parseJsonObject(raw);
+  const oauth = parsed && typeof parsed.claudeAiOauth === "object" && parsed.claudeAiOauth ? parsed.claudeAiOauth : null;
+  if (!oauth) return { kind: "present", accessToken: "", refreshToken: "", raw };
+  return {
+    kind: "present",
+    accessToken: typeof oauth.accessToken === "string" ? oauth.accessToken : "",
+    refreshToken: typeof oauth.refreshToken === "string" ? oauth.refreshToken : "",
+    raw
+  };
+}
+function interpretCredentialsFile(text) {
+  if (text === null) return { exists: false, hasTokens: false, refreshToken: "" };
+  const parsed = parseJsonObject(text);
+  const oauth = parsed && typeof parsed.claudeAiOauth === "object" && parsed.claudeAiOauth ? parsed.claudeAiOauth : null;
+  const access = oauth && typeof oauth.accessToken === "string" ? oauth.accessToken : "";
+  const refresh = oauth && typeof oauth.refreshToken === "string" ? oauth.refreshToken : "";
+  return { exists: true, hasTokens: access.length > 0 && refresh.length > 0, refreshToken: refresh };
+}
+function tokenTail(token) {
+  return token ? node_crypto.createHash("sha256").update(token).digest("hex").slice(-6) : "";
+}
+const CREDENTIALS_REJECTED_DETAIL = "Credentials exist but Claude Code rejects them in the daemon context \u2014 the refresh token has most likely been rotated away by another store or another machine using the same credentials. Log in again with `claude` on this machine.";
+function diagnoseStores(input) {
+  const { status, keychain, file } = input;
+  if (keychain.kind === "present") {
+    const empty = keychain.accessToken.length === 0 && keychain.refreshToken.length === 0;
+    if (empty && file.hasTokens && status === "not-logged-in") {
+      return {
+        diagnosis: "keychain-empty-item",
+        repairable: "delete-empty-keychain-item",
+        keychainRaw: keychain.raw,
+        detail: "The login keychain holds a Claude Code credentials item with empty tokens; Claude Code prefers it over the valid ~/.claude/.credentials.json and reports not logged in."
+      };
+    }
+    if (!empty && file.hasTokens && tokenTail(keychain.refreshToken) !== tokenTail(file.refreshToken)) {
+      return {
+        diagnosis: "store-divergence",
+        detail: "Keychain and ~/.claude/.credentials.json hold different refresh tokens; one of them will stop working at its next refresh. Treat the daemon-context login as canonical, or pin credentialStore=file."
+      };
+    }
+    return {};
+  }
+  if ((keychain.kind === "absent" || keychain.kind === "unreadable" || keychain.kind === "unsupported") && !file.hasTokens) {
+    return { diagnosis: "no-credentials", detail: "No Claude Code credentials found for this daemon context; log in with `claude` on this machine." };
+  }
+  if (keychain.kind === "unreadable" && file.hasTokens && status === "not-logged-in") {
+    return { diagnosis: "credentials-rejected", detail: CREDENTIALS_REJECTED_DETAIL };
+  }
+  if (keychain.kind === "error") {
+    return { detail: `keychain check failed: ${keychain.detail}` };
+  }
+  return {};
+}
+function securityReadArgs(identity) {
+  return ["find-generic-password", "-s", identity.service, "-a", identity.account, "-w"];
+}
+function securityDeleteArgs(identity) {
+  return ["delete-generic-password", "-s", identity.service, "-a", identity.account];
+}
+const HAPPY_DAEMON_LAUNCHD_LABEL = "com.mereith.happy-daemon";
+function classifyLineage(input) {
+  if (input.platform !== "darwin") return "other";
+  const label = input.label ?? HAPPY_DAEMON_LAUNCHD_LABEL;
+  if (input.env.XPC_SERVICE_NAME !== label) return "other";
+  if (input.launchdJobPid !== null && input.ancestorPids.includes(input.launchdJobPid)) return "launchd";
+  return "inherited-env";
+}
+function parseLaunchctlPid(printOutput) {
+  const match = /^\s*pid\s*=\s*(\d+)/m.exec(printOutput);
+  return match ? Number(match[1]) : null;
+}
+function keychainOffShimDir(happyLibDir) {
+  return path.join(happyLibDir, "scripts", "shims", "keychain-off");
+}
+function withKeychainOffPath(path$1, shimDir) {
+  const parts = (path$1 ?? "").split(path.delimiter).filter((p) => p && p !== shimDir);
+  return [shimDir, ...parts].join(path.delimiter);
+}
+function buildClaudeAuthState(input) {
+  const { classification, diagnosis } = input;
+  const detail = (diagnosis?.detail ?? classification.detail)?.slice(0, 200);
+  const state = {
+    probeVersion: CLAUDE_AUTH_PROBE_VERSION,
+    daemonPid: input.daemonPid,
+    status: classification.status,
+    context: { platform: input.platform, lineage: input.lineage, credentialStore: input.credentialStore },
+    checkedAt: input.now ?? Date.now()
+  };
+  if (classification.authMethod) state.authMethod = classification.authMethod;
+  if (classification.subscriptionType) state.subscriptionType = classification.subscriptionType;
+  const diag = diagnosis?.diagnosis ?? classification.diagnosis;
+  if (diag) state.diagnosis = diag;
+  if (detail) state.detail = detail;
+  if (diagnosis?.repairable) state.repairable = diagnosis.repairable;
+  return state;
+}
+function claudeAuthStateChanged(prev, next) {
+  if (!prev) return true;
+  const strip = ({ checkedAt: _c, ...rest }) => JSON.stringify(rest);
+  return strip(prev) !== strip(next);
+}
+function keychainIdentityFor(env) {
+  return keychainIdentity(env);
+}
+
+function detectDaemonSupervisor(env, platform = process.platform, launchd = null) {
+  const explicit = env.HAPPY_DAEMON_SUPERVISOR?.trim().toLowerCase();
+  if (explicit === "systemd") return "systemd";
+  if (explicit === "none") return "none";
+  if (platform === "linux" && typeof env.INVOCATION_ID === "string" && env.INVOCATION_ID.trim() !== "") return "systemd";
+  if (platform === "darwin" && launchd && classifyLineage({ platform, env, launchdJobPid: launchd.jobPid, ancestorPids: launchd.ancestorPids }) === "launchd") return "launchd";
+  return "none";
+}
+function daemonLineage(supervisor, env, platform = process.platform, launchd = null) {
+  if (supervisor !== "none") return supervisor;
+  return classifyLineage({ platform, env, launchdJobPid: launchd?.jobPid ?? null, ancestorPids: launchd?.ancestorPids ?? [] });
+}
+function execText(file, args) {
+  return new Promise((resolve) => {
+    node_child_process.execFile(file, args, { timeout: LAUNCHD_PROBE_TIMEOUT_MS, maxBuffer: 1024 * 1024 }, (error, stdout) => resolve(error ? "" : String(stdout ?? "")));
+  });
+}
+const LAUNCHD_PROBE_TIMEOUT_MS = 3e3;
+async function probeLaunchdJob(exec = execText) {
+  const uid = typeof process.getuid === "function" ? process.getuid() : null;
+  const jobPid = uid === null ? null : parseLaunchctlPid(await exec("launchctl", ["print", `gui/${uid}/${HAPPY_DAEMON_LAUNCHD_LABEL}`]));
+  const ancestorPids = [process.pid];
+  let pid = process.ppid;
+  for (let i = 0; i < 10 && pid > 1; i++) {
+    ancestorPids.push(pid);
+    const ppid = Number((await exec("ps", ["-o", "ppid=", "-p", String(pid)])).trim());
+    if (!Number.isFinite(ppid) || ppid <= 0 || ppid === pid) break;
+    pid = ppid;
+  }
+  return { jobPid, ancestorPids };
+}
+const SYSTEMD_RESTART_HINT = "systemctl --user restart very-happy-daemon";
+async function kickstartLaunchdJob(run = (file, args) => node_child_process.spawnSync(file, args, { encoding: "utf8", timeout: LAUNCHD_PROBE_TIMEOUT_MS }), uid = typeof process.getuid === "function" ? process.getuid() : null, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
+  if (uid === null) return false;
+  const target = `gui/${uid}/${HAPPY_DAEMON_LAUNCHD_LABEL}`;
+  try {
+    for (let i = 0; i < 50; i++) {
+      const printed = run("launchctl", ["print", target]);
+      if (printed.status !== 0) return false;
+      if (parseLaunchctlPid(printed.stdout ?? "") === null) break;
+      await sleep(100);
+    }
+    return run("launchctl", ["kickstart", target]).status === 0;
+  } catch {
+    return false;
+  }
+}
+
+exports.CREDENTIALS_REJECTED_DETAIL = CREDENTIALS_REJECTED_DETAIL;
+exports.HAPPY_DAEMON_LAUNCHD_LABEL = HAPPY_DAEMON_LAUNCHD_LABEL;
+exports.SYSTEMD_RESTART_HINT = SYSTEMD_RESTART_HINT;
+exports.buildClaudeAuthState = buildClaudeAuthState;
+exports.classifyAuthStatus = classifyAuthStatus;
+exports.classifyLineage = classifyLineage;
+exports.claudeAuthStateChanged = claudeAuthStateChanged;
+exports.daemonLineage = daemonLineage;
+exports.detectDaemonSupervisor = detectDaemonSupervisor;
+exports.diagnoseStores = diagnoseStores;
+exports.interpretCredentialsFile = interpretCredentialsFile;
+exports.interpretSecurityRead = interpretSecurityRead;
+exports.keychainIdentityFor = keychainIdentityFor;
+exports.keychainOffShimDir = keychainOffShimDir;
+exports.kickstartLaunchdJob = kickstartLaunchdJob;
+exports.parseLaunchctlPid = parseLaunchctlPid;
+exports.probeLaunchdJob = probeLaunchdJob;
+exports.resolveSdkClaudeBinary = resolveSdkClaudeBinary;
+exports.securityDeleteArgs = securityDeleteArgs;
+exports.securityReadArgs = securityReadArgs;
+exports.withKeychainOffPath = withKeychainOffPath;

package/dist/daemonSupervisor-DfzrtNhM.mjs

@@ -0,0 +1,245 @@
+import { spawnSync, execFile } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { createHash } from 'node:crypto';
+import { join, delimiter } from 'node:path';
+import { homedir, userInfo } from 'node:os';
+
+const CLAUDE_KEYCHAIN_SERVICE_PREFIX = "Claude Code";
+function keychainIdentity(env = process.env, deps = {}) {
+  const home = deps.home ?? homedir();
+  const secureDir = env.CLAUDE_SECURESTORAGE_CONFIG_DIR?.trim();
+  const configDirEnv = env.CLAUDE_CONFIG_DIR?.trim();
+  const configDir = secureDir || configDirEnv || join(home, ".claude");
+  const hasCustomDir = Boolean(secureDir || configDirEnv);
+  const dirSuffix = hasCustomDir ? "-" + createHash("sha256").update(configDir.normalize("NFC")).digest("hex").slice(0, 8) : "";
+  const oauthSuffix = env.CLAUDE_CODE_OAUTH_CLIENT_ID?.trim() ? "-custom-oauth" : "";
+  const rawAccount = env.USER || safeUsername(deps.username);
+  const account = /^[a-zA-Z0-9._-]+$/.test(rawAccount) ? rawAccount : "claude-code-user";
+  return {
+    service: `${CLAUDE_KEYCHAIN_SERVICE_PREFIX}${oauthSuffix}-credentials${dirSuffix}`,
+    account,
+    configDir,
+    credentialsPath: join(configDir, ".credentials.json")
+  };
+}
+function safeUsername(provider) {
+  try {
+    return provider ? provider() : userInfo().username;
+  } catch {
+    return "";
+  }
+}
+
+const CLAUDE_AUTH_PROBE_VERSION = 1;
+const LOCAL_CREDENTIAL_SOURCE = "Claude local credentials";
+function classifyAuthStatus(run, credentialSource) {
+  const localSource = credentialSource === void 0 || credentialSource === LOCAL_CREDENTIAL_SOURCE;
+  if (run.spawnError) {
+    return { status: "error", diagnosis: "probe-crash", detail: `could not run claude auth status: ${run.spawnError}` };
+  }
+  if (run.timedOut) {
+    return { status: "error", diagnosis: "probe-timeout", detail: "claude auth status did not answer within the timeout" };
+  }
+  const parsed = parseJsonObject(run.stdout);
+  if (!parsed) {
+    if (!localSource) return { status: "unknown", authMethod: credentialSource, detail: `auth status unparseable under ${credentialSource}` };
+    return { status: "error", diagnosis: "probe-crash", detail: `claude auth status returned no JSON (exit ${run.exitCode ?? "null"})` };
+  }
+  const authMethod = typeof parsed.authMethod === "string" ? parsed.authMethod : void 0;
+  const subscriptionType = typeof parsed.subscriptionType === "string" ? parsed.subscriptionType : void 0;
+  if (parsed.loggedIn === true) {
+    return { status: "ok", authMethod: localSource ? authMethod : credentialSource, subscriptionType };
+  }
+  if (!localSource) {
+    return { status: "unknown", authMethod: credentialSource, detail: `Claude Code reports loggedIn=false under ${credentialSource}; not a local-credential failure` };
+  }
+  return { status: "not-logged-in", authMethod, subscriptionType, detail: "Claude Code in the daemon context reports it is not logged in" };
+}
+function parseJsonObject(text) {
+  const trimmed = text.trim();
+  if (!trimmed) return null;
+  const start = trimmed.indexOf("{");
+  if (start < 0) return null;
+  try {
+    const value = JSON.parse(trimmed.slice(start));
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function resolveSdkClaudeBinary(platform = process.platform, arch = process.arch, resolver = (s) => createRequire(import.meta.url).resolve(s)) {
+  const platformArch = `${platform}-${arch}`;
+  const candidates = [
+    `@anthropic-ai/claude-agent-sdk-${platformArch}/claude`,
+    `@anthropic-ai/claude-agent-sdk-${platformArch}/claude.exe`
+  ];
+  for (const candidate of candidates) {
+    try {
+      return resolver(candidate);
+    } catch {
+    }
+  }
+  return null;
+}
+function interpretSecurityRead(result) {
+  if (result.error === "ENOENT") return { kind: "unsupported" };
+  if (result.error === "timeout") return { kind: "error", detail: "security timed out" };
+  if (result.exitCode === 44) return { kind: "absent" };
+  if (result.exitCode === 36) return { kind: "unreadable" };
+  if (result.exitCode !== 0) return { kind: "error", detail: `security exited ${result.exitCode ?? "null"}` };
+  const raw = result.stdout.trim();
+  if (!raw) return { kind: "absent" };
+  const parsed = parseJsonObject(raw);
+  const oauth = parsed && typeof parsed.claudeAiOauth === "object" && parsed.claudeAiOauth ? parsed.claudeAiOauth : null;
+  if (!oauth) return { kind: "present", accessToken: "", refreshToken: "", raw };
+  return {
+    kind: "present",
+    accessToken: typeof oauth.accessToken === "string" ? oauth.accessToken : "",
+    refreshToken: typeof oauth.refreshToken === "string" ? oauth.refreshToken : "",
+    raw
+  };
+}
+function interpretCredentialsFile(text) {
+  if (text === null) return { exists: false, hasTokens: false, refreshToken: "" };
+  const parsed = parseJsonObject(text);
+  const oauth = parsed && typeof parsed.claudeAiOauth === "object" && parsed.claudeAiOauth ? parsed.claudeAiOauth : null;
+  const access = oauth && typeof oauth.accessToken === "string" ? oauth.accessToken : "";
+  const refresh = oauth && typeof oauth.refreshToken === "string" ? oauth.refreshToken : "";
+  return { exists: true, hasTokens: access.length > 0 && refresh.length > 0, refreshToken: refresh };
+}
+function tokenTail(token) {
+  return token ? createHash("sha256").update(token).digest("hex").slice(-6) : "";
+}
+const CREDENTIALS_REJECTED_DETAIL = "Credentials exist but Claude Code rejects them in the daemon context \u2014 the refresh token has most likely been rotated away by another store or another machine using the same credentials. Log in again with `claude` on this machine.";
+function diagnoseStores(input) {
+  const { status, keychain, file } = input;
+  if (keychain.kind === "present") {
+    const empty = keychain.accessToken.length === 0 && keychain.refreshToken.length === 0;
+    if (empty && file.hasTokens && status === "not-logged-in") {
+      return {
+        diagnosis: "keychain-empty-item",
+        repairable: "delete-empty-keychain-item",
+        keychainRaw: keychain.raw,
+        detail: "The login keychain holds a Claude Code credentials item with empty tokens; Claude Code prefers it over the valid ~/.claude/.credentials.json and reports not logged in."
+      };
+    }
+    if (!empty && file.hasTokens && tokenTail(keychain.refreshToken) !== tokenTail(file.refreshToken)) {
+      return {
+        diagnosis: "store-divergence",
+        detail: "Keychain and ~/.claude/.credentials.json hold different refresh tokens; one of them will stop working at its next refresh. Treat the daemon-context login as canonical, or pin credentialStore=file."
+      };
+    }
+    return {};
+  }
+  if ((keychain.kind === "absent" || keychain.kind === "unreadable" || keychain.kind === "unsupported") && !file.hasTokens) {
+    return { diagnosis: "no-credentials", detail: "No Claude Code credentials found for this daemon context; log in with `claude` on this machine." };
+  }
+  if (keychain.kind === "unreadable" && file.hasTokens && status === "not-logged-in") {
+    return { diagnosis: "credentials-rejected", detail: CREDENTIALS_REJECTED_DETAIL };
+  }
+  if (keychain.kind === "error") {
+    return { detail: `keychain check failed: ${keychain.detail}` };
+  }
+  return {};
+}
+function securityReadArgs(identity) {
+  return ["find-generic-password", "-s", identity.service, "-a", identity.account, "-w"];
+}
+function securityDeleteArgs(identity) {
+  return ["delete-generic-password", "-s", identity.service, "-a", identity.account];
+}
+const HAPPY_DAEMON_LAUNCHD_LABEL = "com.mereith.happy-daemon";
+function classifyLineage(input) {
+  if (input.platform !== "darwin") return "other";
+  const label = input.label ?? HAPPY_DAEMON_LAUNCHD_LABEL;
+  if (input.env.XPC_SERVICE_NAME !== label) return "other";
+  if (input.launchdJobPid !== null && input.ancestorPids.includes(input.launchdJobPid)) return "launchd";
+  return "inherited-env";
+}
+function parseLaunchctlPid(printOutput) {
+  const match = /^\s*pid\s*=\s*(\d+)/m.exec(printOutput);
+  return match ? Number(match[1]) : null;
+}
+function keychainOffShimDir(happyLibDir) {
+  return join(happyLibDir, "scripts", "shims", "keychain-off");
+}
+function withKeychainOffPath(path, shimDir) {
+  const parts = (path ?? "").split(delimiter).filter((p) => p && p !== shimDir);
+  return [shimDir, ...parts].join(delimiter);
+}
+function buildClaudeAuthState(input) {
+  const { classification, diagnosis } = input;
+  const detail = (diagnosis?.detail ?? classification.detail)?.slice(0, 200);
+  const state = {
+    probeVersion: CLAUDE_AUTH_PROBE_VERSION,
+    daemonPid: input.daemonPid,
+    status: classification.status,
+    context: { platform: input.platform, lineage: input.lineage, credentialStore: input.credentialStore },
+    checkedAt: input.now ?? Date.now()
+  };
+  if (classification.authMethod) state.authMethod = classification.authMethod;
+  if (classification.subscriptionType) state.subscriptionType = classification.subscriptionType;
+  const diag = diagnosis?.diagnosis ?? classification.diagnosis;
+  if (diag) state.diagnosis = diag;
+  if (detail) state.detail = detail;
+  if (diagnosis?.repairable) state.repairable = diagnosis.repairable;
+  return state;
+}
+function claudeAuthStateChanged(prev, next) {
+  if (!prev) return true;
+  const strip = ({ checkedAt: _c, ...rest }) => JSON.stringify(rest);
+  return strip(prev) !== strip(next);
+}
+function keychainIdentityFor(env) {
+  return keychainIdentity(env);
+}
+
+function detectDaemonSupervisor(env, platform = process.platform, launchd = null) {
+  const explicit = env.HAPPY_DAEMON_SUPERVISOR?.trim().toLowerCase();
+  if (explicit === "systemd") return "systemd";
+  if (explicit === "none") return "none";
+  if (platform === "linux" && typeof env.INVOCATION_ID === "string" && env.INVOCATION_ID.trim() !== "") return "systemd";
+  if (platform === "darwin" && launchd && classifyLineage({ platform, env, launchdJobPid: launchd.jobPid, ancestorPids: launchd.ancestorPids }) === "launchd") return "launchd";
+  return "none";
+}
+function daemonLineage(supervisor, env, platform = process.platform, launchd = null) {
+  if (supervisor !== "none") return supervisor;
+  return classifyLineage({ platform, env, launchdJobPid: launchd?.jobPid ?? null, ancestorPids: launchd?.ancestorPids ?? [] });
+}
+function execText(file, args) {
+  return new Promise((resolve) => {
+    execFile(file, args, { timeout: LAUNCHD_PROBE_TIMEOUT_MS, maxBuffer: 1024 * 1024 }, (error, stdout) => resolve(error ? "" : String(stdout ?? "")));
+  });
+}
+const LAUNCHD_PROBE_TIMEOUT_MS = 3e3;
+async function probeLaunchdJob(exec = execText) {
+  const uid = typeof process.getuid === "function" ? process.getuid() : null;
+  const jobPid = uid === null ? null : parseLaunchctlPid(await exec("launchctl", ["print", `gui/${uid}/${HAPPY_DAEMON_LAUNCHD_LABEL}`]));
+  const ancestorPids = [process.pid];
+  let pid = process.ppid;
+  for (let i = 0; i < 10 && pid > 1; i++) {
+    ancestorPids.push(pid);
+    const ppid = Number((await exec("ps", ["-o", "ppid=", "-p", String(pid)])).trim());
+    if (!Number.isFinite(ppid) || ppid <= 0 || ppid === pid) break;
+    pid = ppid;
+  }
+  return { jobPid, ancestorPids };
+}
+const SYSTEMD_RESTART_HINT = "systemctl --user restart very-happy-daemon";
+async function kickstartLaunchdJob(run = (file, args) => spawnSync(file, args, { encoding: "utf8", timeout: LAUNCHD_PROBE_TIMEOUT_MS }), uid = typeof process.getuid === "function" ? process.getuid() : null, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
+  if (uid === null) return false;
+  const target = `gui/${uid}/${HAPPY_DAEMON_LAUNCHD_LABEL}`;
+  try {
+    for (let i = 0; i < 50; i++) {
+      const printed = run("launchctl", ["print", target]);
+      if (printed.status !== 0) return false;
+      if (parseLaunchctlPid(printed.stdout ?? "") === null) break;
+      await sleep(100);
+    }
+    return run("launchctl", ["kickstart", target]).status === 0;
+  } catch {
+    return false;
+  }
+}
+
+export { CREDENTIALS_REJECTED_DETAIL as C, HAPPY_DAEMON_LAUNCHD_LABEL as H, SYSTEMD_RESTART_HINT as S, keychainIdentityFor as a, securityDeleteArgs as b, keychainOffShimDir as c, interpretCredentialsFile as d, buildClaudeAuthState as e, claudeAuthStateChanged as f, classifyAuthStatus as g, diagnoseStores as h, interpretSecurityRead as i, classifyLineage as j, kickstartLaunchdJob as k, probeLaunchdJob as l, detectDaemonSupervisor as m, daemonLineage as n, parseLaunchctlPid as p, resolveSdkClaudeBinary as r, securityReadArgs as s, withKeychainOffPath as w };

package/dist/{defaultPermissionMode-MXpZlXud.cjs → defaultPermissionMode-DQmdZZIg.cjs}

@@ -1,7 +1,7 @@
 'use strict';
 
-var logger = require('./logger-DK1ytCz6.cjs');
-var persistence = require('./persistence-BdpwWXKh.cjs');
+var logger = require('./logger-Cgwz30rK.cjs');
+var persistence = require('./persistence-DZRMUZZS.cjs');
 
 const PRESENCE_SETTLE_MS = 6e3;
 async function commitHibernation(deps) {

package/dist/{defaultPermissionMode-BLfxu-Yz.mjs → defaultPermissionMode-U9LuUeQh.mjs}

@@ -1,5 +1,5 @@
-import { l as logger } from './logger-DpqihN1f.mjs';
-import { e as evaluateWrapperIdle, j as HIBERNATION_UNSUPPORTED_BACKOFF_MS } from './persistence-jOEuAFTS.mjs';
+import { l as logger } from './logger-RMPh5aqe.mjs';
+import { e as evaluateWrapperIdle, j as HIBERNATION_UNSUPPORTED_BACKOFF_MS } from './persistence-zJo4r7YI.mjs';
 
 const PRESENCE_SETTLE_MS = 6e3;
 async function commitHibernation(deps) {