fix(auth): route Claude status through controller

Proof of fix:\n- Причина: AuthClaudeStatus парсился, но host API mode считал его unsupported и не имел /auth/claude/status endpoint.\n- Решение: добавлен controller/API status endpoint, app routing/client dispatch и OpenAPI контракт; статус читает controller state без запуска Claude CLI и без утечки секретов.\n- Доказательство: bun run --cwd packages/api test -- auth.test.ts openapi.test.ts; bun run --cwd packages/app test -- program-auth.test.ts parser-auth.test.ts; typecheck packages api/app/openapi.

Author: skulidropek

packages/api/src/api/contracts.ts

@@ -299,6 +299,14 @@ export type CodexAuthStatus = {
   readonly account: string | null
 }
 
+export type ClaudeAuthStatus = {
+  readonly label: string
+  readonly message: string
+  readonly connected: boolean
+  readonly authPath: string
+  readonly method: "none" | "oauth-token" | "claude-ai-session"
+}
+
 export type GrokAuthStatus = {
   readonly label: string
   readonly message: string

packages/api/src/api/openapi.ts

@@ -251,6 +251,19 @@ export const CodexStatusResponseSchema = Schema.Struct({
   status: CodexAuthStatusSchema
 })
 
+export const ClaudeAuthStatusSchema = Schema.Struct({
+  authPath: Schema.String,
+  connected: Schema.Boolean,
+  label: Schema.String,
+  message: Schema.String,
+  method: Schema.Literal("none", "oauth-token", "claude-ai-session")
+})
+
+export const ClaudeStatusResponseSchema = Schema.Struct({
+  ok: OptionalOkSchema,
+  status: ClaudeAuthStatusSchema
+})
+
 export const GrokAuthStatusSchema = Schema.Struct({
   authPath: Schema.String,
   connected: Schema.Boolean,
@@ -601,6 +614,11 @@ const AuthGroup = HttpApiGroup.make("auth")
       .setUrlParams(QueryLabelSchema)
       .addSuccess(CodexStatusResponseSchema)
   )
+  .add(
+    endpoint.get("claudeStatus", "/auth/claude/status")
+      .setUrlParams(QueryLabelSchema)
+      .addSuccess(ClaudeStatusResponseSchema)
+  )
   .add(
     endpoint.post("githubLogin", "/auth/github/login")
       .setPayload(GithubAuthLoginRequestSchema)

packages/api/src/http.ts

@@ -59,6 +59,7 @@ import {
   logoutGitAuth,
   logoutGitlabAuth,
   logoutGithubAuth,
+  readClaudeAuthStatus,
   readCodexAuthStatus,
   readGrokAuthStatus,
   readGitAuthStatus,
@@ -1138,6 +1139,15 @@ export const makeRouter = () => {
         return yield* _(jsonResponse({ status }, 200))
       }).pipe(Effect.catchAll(errorResponse))
     ),
+    HttpRouter.get(
+      "/auth/claude/status",
+      Effect.gen(function*(_) {
+        const request = yield* _(HttpServerRequest.HttpServerRequest)
+        const label = new URL(request.url, "http://localhost").searchParams.get("label")
+        const status = yield* _(readClaudeAuthStatus(label))
+        return yield* _(jsonResponse({ status }, 200))
+      }).pipe(Effect.catchAll(errorResponse))
+    ),
     HttpRouter.get(
       "/auth/menu",
       Effect.gen(function*(_) {

packages/api/src/services/auth.ts

@@ -37,6 +37,7 @@ import type {
   CodexAuthLoginRequest,
   CodexAuthLogoutRequest,
   CodexAuthStatus,
+  ClaudeAuthStatus,
   GrokAuthLogoutRequest,
   GrokAuthStatus,
   GitAuthLoginRequest,
@@ -64,6 +65,7 @@ export const gitlabAuthRequiredMessage = [
   "If the repository requires access, run: docker-git auth gitlab login"
 ].join("\n")
 export const githubAuthEnvGlobalPath = defaultTemplateConfig.envGlobalPath
+export const claudeAuthPath = ".docker-git/.orch/auth/claude"
 export const codexAuthPath = defaultTemplateConfig.codexAuthPath
 export const grokAuthPath = defaultTemplateConfig.grokAuthPath
 
@@ -80,6 +82,7 @@ type JsonRecord = Readonly<Record<string, unknown>>
 type CodexRuntime = FileSystem.FileSystem | Path.Path | CommandExecutor.CommandExecutor
 type CodexCommandError = CommandFailedError | PlatformError
 type GrokCommandError = CommandFailedError | PlatformError
+type ClaudeAuthMethod = ClaudeAuthStatus["method"]
 
 const labelFromKey = (key: string): string =>
   key.startsWith(githubTokenPrefix) ? key.slice(githubTokenPrefix.length) : "default"
@@ -517,6 +520,85 @@ const grokAuthStatus = (
   method
 })
 
+const claudeAuthStatus = (
+  label: string,
+  authPath: string,
+  method: ClaudeAuthMethod
+): ClaudeAuthStatus => ({
+  label,
+  message: method === "none"
+    ? `Claude not connected (${label}).`
+    : `Claude connected (${label}, ${method}).`,
+  connected: method !== "none",
+  authPath,
+  method
+})
+
+const resolveClaudeAccountPath = (
+  path: Path.Path,
+  label: string | null | undefined
+): {
+  readonly accountLabel: string
+  readonly accountPath: string
+} => {
+  const rootPath = resolvePathFromCwd(path, process.cwd(), claudeAuthPath)
+  const accountLabel = normalizeAccountLabel(label ?? null, "default")
+  return {
+    accountLabel,
+    accountPath: path.join(rootPath, accountLabel)
+  }
+}
+
+const readNonEmptyFile = (
+  fs: FileSystem.FileSystem,
+  filePath: string
+): Effect.Effect<boolean, PlatformError> =>
+  fs.readFileString(filePath).pipe(
+    Effect.map((text) => text.trim().length > 0),
+    Effect.orElseSucceed(() => false)
+  )
+
+const resolveClaudeAuthMethod = (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  accountPath: string
+): Effect.Effect<ClaudeAuthMethod, PlatformError> =>
+  Effect.gen(function*(_) {
+    const hasOauthToken = yield* _(readNonEmptyFile(fs, path.join(accountPath, ".oauth-token")))
+    if (hasOauthToken) {
+      return "oauth-token"
+    }
+
+    const hasRootCredentials = yield* _(readNonEmptyFile(fs, path.join(accountPath, ".credentials.json")))
+    if (hasRootCredentials) {
+      return "claude-ai-session"
+    }
+
+    const hasNestedCredentials = yield* _(readNonEmptyFile(fs, path.join(accountPath, ".claude", ".credentials.json")))
+    return hasNestedCredentials ? "claude-ai-session" : "none"
+  })
+
+// CHANGE: expose Claude auth status through the controller without running the Claude CLI
+// WHY: host API mode must route `docker-git auth claude status`; status should inspect controller state like Grok/Codex
+// QUOTE(ТЗ): "Можешь сделать что бы работал claude status?"
+// REF: user-report-2026-07-01-claude-status-api-mode
+// SOURCE: n/a
+// FORMAT THEOREM: forall label: status(label) = connected iff persisted Claude credential exists
+// PURITY: SHELL
+// EFFECT: Effect<ClaudeAuthStatus, PlatformError, FileSystem | Path>
+// INVARIANT: secrets are never returned; only method/label/path are exposed
+// COMPLEXITY: O(1)
+export const readClaudeAuthStatus = (
+  label?: string | null | undefined
+): Effect.Effect<ClaudeAuthStatus, PlatformError, FileSystem.FileSystem | Path.Path> =>
+  Effect.gen(function*(_) {
+    const fs = yield* _(FileSystem.FileSystem)
+    const path = yield* _(Path.Path)
+    const { accountLabel, accountPath } = resolveClaudeAccountPath(path, label)
+    const method = yield* _(resolveClaudeAuthMethod(fs, path, accountPath))
+    return claudeAuthStatus(accountLabel, accountPath, method)
+  })
+
 export const readGrokAuthStatus = (
   label?: string | null | undefined
 ): Effect.Effect<GrokAuthStatus, PlatformError, FileSystem.FileSystem | Path.Path> =>

packages/api/tests/auth.test.ts

@@ -19,6 +19,7 @@ import {
   logoutCodexAuth,
   logoutGitAuth,
   logoutGrokAuth,
+  readClaudeAuthStatus,
   readCodexAuthStatus,
   readGitAuthStatus,
   readGrokAuthStatus,
@@ -514,6 +515,108 @@ describe("api auth", () => {
       })
     ).pipe(Effect.provide(NodeContext.layer)))
 
+  it.effect("reads labeled Claude OAuth status from controller state", () =>
+    withTempDir((root) =>
+      Effect.gen(function*(_) {
+        const fs = yield* _(FileSystem.FileSystem)
+        const path = yield* _(Path.Path)
+        const projectsRoot = path.join(root, ".docker-git")
+        const accountDir = path.join(projectsRoot, ".orch", "auth", "claude", "team-a")
+
+        yield* _(fs.makeDirectory(accountDir, { recursive: true }))
+        yield* _(fs.writeFileString(path.join(accountDir, ".oauth-token"), "sk-ant-oat01-test\n"))
+
+        const status = yield* _(
+          withProjectsRoot(
+            projectsRoot,
+            withWorkingDirectory(root, readClaudeAuthStatus("team-a"))
+          )
+        )
+
+        expect(status.connected).toBe(true)
+        expect(status.label).toBe("team-a")
+        expect(status.method).toBe("oauth-token")
+        expect(status.authPath).toBe(accountDir)
+        expect(status.message).toBe("Claude connected (team-a, oauth-token).")
+        expect(JSON.stringify(status)).not.toContain("sk-ant-oat01-test")
+      })
+    ).pipe(Effect.provide(NodeContext.layer)))
+
+  it.effect("reads labeled Claude root session credentials from controller state", () =>
+    withTempDir((root) =>
+      Effect.gen(function*(_) {
+        const fs = yield* _(FileSystem.FileSystem)
+        const path = yield* _(Path.Path)
+        const projectsRoot = path.join(root, ".docker-git")
+        const accountDir = path.join(projectsRoot, ".orch", "auth", "claude", "team-a")
+
+        yield* _(fs.makeDirectory(accountDir, { recursive: true }))
+        yield* _(fs.writeFileString(path.join(accountDir, ".credentials.json"), "{\"session\":\"ok\"}\n"))
+
+        const status = yield* _(
+          withProjectsRoot(
+            projectsRoot,
+            withWorkingDirectory(root, readClaudeAuthStatus("team-a"))
+          )
+        )
+
+        expect(status.connected).toBe(true)
+        expect(status.label).toBe("team-a")
+        expect(status.method).toBe("claude-ai-session")
+        expect(status.authPath).toBe(accountDir)
+        expect(status.message).toBe("Claude connected (team-a, claude-ai-session).")
+      })
+    ).pipe(Effect.provide(NodeContext.layer)))
+
+  it.effect("reads labeled Claude nested session credentials from controller state", () =>
+    withTempDir((root) =>
+      Effect.gen(function*(_) {
+        const fs = yield* _(FileSystem.FileSystem)
+        const path = yield* _(Path.Path)
+        const projectsRoot = path.join(root, ".docker-git")
+        const accountDir = path.join(projectsRoot, ".orch", "auth", "claude", "team-a")
+        const nestedDir = path.join(accountDir, ".claude")
+
+        yield* _(fs.makeDirectory(nestedDir, { recursive: true }))
+        yield* _(fs.writeFileString(path.join(nestedDir, ".credentials.json"), "{\"session\":\"ok\"}\n"))
+
+        const status = yield* _(
+          withProjectsRoot(
+            projectsRoot,
+            withWorkingDirectory(root, readClaudeAuthStatus("team-a"))
+          )
+        )
+
+        expect(status.connected).toBe(true)
+        expect(status.label).toBe("team-a")
+        expect(status.method).toBe("claude-ai-session")
+        expect(status.authPath).toBe(accountDir)
+        expect(status.message).toBe("Claude connected (team-a, claude-ai-session).")
+      })
+    ).pipe(Effect.provide(NodeContext.layer)))
+
+  it.effect("reports missing default Claude auth from controller state", () =>
+    withTempDir((root) =>
+      Effect.gen(function*(_) {
+        const path = yield* _(Path.Path)
+        const projectsRoot = path.join(root, ".docker-git")
+        const accountDir = path.join(projectsRoot, ".orch", "auth", "claude", "default")
+
+        const status = yield* _(
+          withProjectsRoot(
+            projectsRoot,
+            withWorkingDirectory(root, readClaudeAuthStatus(null))
+          )
+        )
+
+        expect(status.connected).toBe(false)
+        expect(status.label).toBe("default")
+        expect(status.method).toBe("none")
+        expect(status.authPath).toBe(accountDir)
+        expect(status.message).toBe("Claude not connected (default).")
+      })
+    ).pipe(Effect.provide(NodeContext.layer)))
+
   it.effect("removes labeled Grok auth from controller state", () =>
     withTempDir((root) =>
       Effect.gen(function*(_) {

packages/api/tests/openapi.test.ts

@@ -32,11 +32,12 @@ describe("openapi contract", () => {
       expect(paths["/auth/git/status"]).toBeDefined()
       expect(paths["/auth/gitlab/status"]).toBeDefined()
       expect(paths["/auth/codex/status"]).toBeDefined()
+      expect(paths["/auth/claude/status"]).toBeDefined()
       expect(paths["/auth/grok/status"]).toBeDefined()
       expect(paths["/auth/codex/login"]).toBeUndefined()
       expect(paths["/projects/{projectId}/auth/menu"]).toBeDefined()
       expect(paths["/projects/{projectId}/auth"]).toBeUndefined()
-      expect(Object.keys(paths)).toHaveLength(54)
+      expect(Object.keys(paths)).toHaveLength(55)
     }))
 
   it.effect("documents real HTTP success status codes for create and async endpoints", () =>

packages/app/src/docker-git/api-client-auth.ts

@@ -22,6 +22,7 @@ import type {
   AuthCodexLoginCommand,
   AuthCodexLogoutCommand,
   AuthCodexStatusCommand,
+  AuthClaudeStatusCommand,
   AuthGithubLoginCommand,
   AuthGithubLogoutCommand,
   AuthGithubStatusCommand,
@@ -203,6 +204,11 @@ export const codexStatus = (command: AuthCodexStatusCommand) => {
   return request("GET", `/auth/codex/status${query}`)
 }
 
+export const claudeStatus = (command: AuthClaudeStatusCommand) => {
+  const query = command.label === null ? "" : `?label=${encodeURIComponent(command.label)}`
+  return request("GET", `/auth/claude/status${query}`)
+}
+
 export const grokStatus = (command: AuthGrokStatusCommand) => {
   const query = command.label === null ? "" : `?label=${encodeURIComponent(command.label)}`
   return request("GET", `/auth/grok/status${query}`)

packages/app/src/docker-git/api-client.ts

@@ -28,6 +28,7 @@ export {
   codexLogin,
   codexLogout,
   codexStatus,
+  claudeStatus,
   githubLogin,
   githubLogout,
   githubStatus,

packages/app/src/docker-git/program-auth.ts

@@ -6,6 +6,7 @@ import {
   codexLogin,
   codexLogout,
   codexStatus,
+  claudeStatus,
   createAuthTerminalSession,
   githubLogin,
   githubLogout,
@@ -44,6 +45,7 @@ export type RoutedAuthCommand = Extract<
       | "AuthGitStatus"
       | "AuthGitLogout"
       | "AuthClaudeLogin"
+      | "AuthClaudeStatus"
       | "AuthGeminiLogin"
       | "AuthGrokLogin"
       | "AuthGrokStatus"
@@ -77,6 +79,7 @@ const routedAuthTags: Readonly<Record<string, true>> = {
   AuthGithubLogout: true,
   AuthGithubStatus: true,
   AuthClaudeLogin: true,
+  AuthClaudeStatus: true,
   AuthGeminiLogin: true,
   AuthGrokLogin: true,
   AuthGrokLogout: true,
@@ -156,6 +159,10 @@ const handleClaudeLoginCommand = (
     )
   )
 
+const handleClaudeStatusCommand = (
+  command: Extract<OperationalCommand, { readonly _tag: "AuthClaudeStatus" }>
+) => withControllerReady(pipe(claudeStatus(command), Effect.flatMap((payload) => renderAuthPayload(payload))))
+
 const handleGeminiLoginCommand = (
   command: Extract<OperationalCommand, { readonly _tag: "AuthGeminiLogin" }>
 ) =>
@@ -214,6 +221,7 @@ export const dispatchRoutedAuthCommand = (
     Match.when({ _tag: "AuthGitStatus" }, handleGitStatusCommand),
     Match.when({ _tag: "AuthGitLogout" }, handleGitLogoutCommand),
     Match.when({ _tag: "AuthClaudeLogin" }, handleClaudeLoginCommand),
+    Match.when({ _tag: "AuthClaudeStatus" }, handleClaudeStatusCommand),
     Match.when({ _tag: "AuthGeminiLogin" }, handleGeminiLoginCommand),
     Match.when({ _tag: "AuthGrokLogin" }, handleGrokLoginCommand),
     Match.when({ _tag: "AuthGrokStatus" }, handleGrokStatusCommand),