fix(auth): persist claude oauth token atomically

Author: konard

packages/lib/src/usecases/auth-claude.ts

@@ -50,15 +50,36 @@ const claudeCredentialsPath = (accountPath: string): string => `${accountPath}/$
 const claudeNestedCredentialsPath = (accountPath: string): string =>
   `${accountPath}/${claudeCredentialsDirName}/${claudeCredentialsFileName}`
 
+// CHANGE: persist Claude OAuth tokens through a restricted temporary file and atomic rename
+// WHY: the final token path must never receive secret bytes before 0600 permissions are established
+// QUOTE(ТЗ): "Исправь CI/CD и все правки от Rabbit Coder."
+// REF: issue-439/pr-440
+// SOURCE: n/a
+// FORMAT THEOREM: forall token, path: write(secret, final(path)) only by rename(temp0600, final(path))
+// PURITY: SHELL
+// EFFECT: Effect<void, PlatformError>
+// INVARIANT: final .oauth-token is regular replacement content with mode 0600 after success
+// COMPLEXITY: O(|token|)
 const persistClaudeOauthToken = (
   fs: FileSystem.FileSystem,
+  path: Path.Path,
   accountPath: string,
   token: string
 ): Effect.Effect<void, PlatformError> =>
   Effect.gen(function*(_) {
     const tokenPath = claudeOauthTokenPath(accountPath)
-    yield* _(fs.writeFileString(tokenPath, formatClaudeOauthTokenFile(token), { mode: claudeOauthTokenFileMode }))
-    yield* _(fs.chmod(tokenPath, claudeOauthTokenFileMode))
+    const tempDir = yield* _(fs.makeTempDirectory({ directory: accountPath, prefix: ".oauth-token-write-" }))
+    const tempPath = path.join(tempDir, ".oauth-token")
+    yield* _(
+      Effect.gen(function*(_) {
+        yield* _(fs.writeFileString(tempPath, formatClaudeOauthTokenFile(token), { mode: claudeOauthTokenFileMode }))
+        yield* _(fs.chmod(tempPath, claudeOauthTokenFileMode))
+        yield* _(fs.rename(tempPath, tokenPath))
+        yield* _(fs.chmod(tokenPath, claudeOauthTokenFileMode))
+      }).pipe(
+        Effect.ensuring(fs.remove(tempDir, { recursive: true, force: true }).pipe(Effect.orElseSucceed(() => void 0)))
+      )
+    )
   })
 
 const syncClaudeCredentialsFile = (
@@ -264,7 +285,7 @@ export const authClaudeLogin = (
         image: claudeImageName,
         containerPath: claudeContainerHomeDir
       }),
-      persistToken: (token) => persistClaudeOauthToken(fs, accountPath, token),
+      persistToken: (token) => persistClaudeOauthToken(fs, path, accountPath, token),
       normalizeStoredCredentials: resolveClaudeAuthMethod(fs, path, accountPath).pipe(Effect.asVoid),
       probeToken: (token) => runClaudePingProbeExitCode(cwd, accountPath, token),
       syncState: autoSyncState(`chore(state): auth claude ${accountLabel}`)

packages/lib/tests/usecases/auth-claude-login.test.ts

@@ -3,6 +3,7 @@ import * as CommandExecutor from "@effect/platform/CommandExecutor"
 import * as FileSystem from "@effect/platform/FileSystem"
 import * as Path from "@effect/platform/Path"
 import { NodeContext } from "@effect/platform-node"
+import { claudeOauthTokenFileMode } from "@prover-coder-ai/docker-git-auth-oauth/claude-oauth-token"
 import { describe, expect, it } from "@effect/vitest"
 import { Effect, Logger } from "effect"
 import * as Inspectable from "effect/Inspectable"
@@ -211,6 +212,57 @@ describe("authClaudeLogin", () => {
       )
     ).pipe(Effect.provide(NodeContext.layer)))
 
+  it.effect("replaces an existing token symlink without writing the secret to the symlink target", () =>
+    withTempDir((root) =>
+      withPatchedEnv(
+        { HOME: root, DOCKER_GIT_STATE_AUTO_SYNC: "0", DOCKER_GIT_PROJECTS_ROOT: undefined },
+        Effect.gen(function*(_) {
+          const fs = yield* _(FileSystem.FileSystem)
+          const path = yield* _(Path.Path)
+          const claudeAuthPath = path.join(root, ".docker-git/.orch/auth/claude")
+          const accountPath = path.join(claudeAuthPath, "default")
+          const tokenPath = path.join(accountPath, ".oauth-token")
+          const outsidePath = path.join(root, "outside-token-target")
+          yield* _(fs.makeDirectory(accountPath, { recursive: true }))
+          yield* _(fs.writeFileString(outsidePath, "outside-sentinel\n"))
+          yield* _(fs.symlink(outsidePath, tokenPath))
+          let finalTokenWrites = 0
+          const guardedFs: FileSystem.FileSystem = {
+            ...fs,
+            writeFileString: (targetPath, data, options) =>
+              (targetPath === tokenPath
+                ? Effect.sync(() => {
+                  finalTokenWrites += 1
+                })
+                : Effect.void).pipe(
+                Effect.zipRight(fs.writeFileString(targetPath, data, options))
+              )
+          }
+
+          yield* _(
+            authClaudeLogin({
+              _tag: "AuthClaudeLogin",
+              label: null,
+              claudeAuthPath
+            }).pipe(
+              Effect.provideService(FileSystem.FileSystem, guardedFs),
+              Effect.provideService(CommandExecutor.CommandExecutor, makeFakeExecutor(oauthToken, 0))
+            )
+          )
+
+          const outsideText = yield* _(fs.readFileString(outsidePath))
+          const tokenText = yield* _(fs.readFileString(tokenPath))
+          const tokenInfo = yield* _(fs.stat(tokenPath))
+
+          expect(outsideText).toBe("outside-sentinel\n")
+          expect(tokenText.trim()).toBe(oauthToken)
+          expect(tokenInfo.type).toBe("File")
+          expect(Number(tokenInfo.mode) & 0o777).toBe(claudeOauthTokenFileMode)
+          expect(finalTokenWrites).toBe(0)
+        })
+      )
+    ).pipe(Effect.provide(NodeContext.layer)))
+
   it.effect("fails when setup-token completes without a captured OAuth token", () =>
     withTempDir((root) =>
       withPatchedEnv(