fix(auth): address claude oauth review hardening

Author: konard

packages/app/src/docker-git/controller-compose-files.ts

@@ -25,10 +25,10 @@ const mapComposePathError = (error: PlatformError): ControllerBootstrapError =>
 // QUOTE(ТЗ): n/a
 // REF: issue-440-review-compose-overlay
 // SOURCE: n/a
-// FORMAT THEOREM: forall p: env(extra)=p and exists(resolve(p)) -> resolve(extra)=Some(resolve(p))
+// FORMAT THEOREM: forall p: env(extra)=p and regular_file(resolve(p)) -> resolve(extra)=Some(resolve(p))
 // PURITY: SHELL
 // EFFECT: Effect<string | null, ControllerBootstrapError, FileSystem | Path>
-// INVARIANT: non-empty extra compose env values either resolve to an existing file or fail before docker compose
+// INVARIANT: non-empty extra compose env values either resolve to a regular file or fail before docker compose
 // COMPLEXITY: O(1)
 export const loadControllerComposeExtraPath = (): Effect.Effect<
   string | null,
@@ -45,12 +45,23 @@ export const loadControllerComposeExtraPath = (): Effect.Effect<
     const path = yield* _(Path.Path)
     const extraOverlayPath = path.resolve(raw)
     const isExists = yield* _(fs.exists(extraOverlayPath).pipe(Effect.mapError(mapComposePathError)))
-    return isExists
+    if (!isExists) {
+      return yield* _(
+        Effect.fail(
+          controllerBootstrapError(
+            `${controllerComposeExtraFileEnvKey} points to ${extraOverlayPath}, but it was not found.`
+          )
+        )
+      )
+    }
+
+    const info = yield* _(fs.stat(extraOverlayPath).pipe(Effect.mapError(mapComposePathError)))
+    return info.type === "File"
       ? extraOverlayPath
       : yield* _(
         Effect.fail(
           controllerBootstrapError(
-            `${controllerComposeExtraFileEnvKey} points to ${extraOverlayPath}, but it was not found.`
+            `${controllerComposeExtraFileEnvKey} points to ${extraOverlayPath}, but it is not a regular file.`
           )
         )
       )

packages/app/tests/docker-git/controller-compose.test.ts

@@ -1,4 +1,5 @@
 import { NodeContext } from "@effect/platform-node"
+import * as FileSystem from "@effect/platform/FileSystem"
 import * as Path from "@effect/platform/Path"
 import { describe, expect, it } from "@effect/vitest"
 import { Effect } from "effect"
@@ -114,6 +115,28 @@ describe("controller compose preparation", () => {
     ).pipe(Effect.provide(NodeContext.layer))
   })
 
+  it.effect("rejects extra compose overlay paths that are directories", () =>
+    withMinimalControllerRoot((rootDir) =>
+      Effect.gen(function*(_) {
+        const fs = yield* _(FileSystem.FileSystem)
+        const path = yield* _(Path.Path)
+        const extraComposePath = path.join(rootDir, "docker-compose.auth-claude-login.yml")
+        yield* _(fs.makeDirectory(extraComposePath))
+        yield* _(
+          withControllerEnv([
+            [controllerBuildSkillerEnvKey, "0"],
+            [controllerComposeExtraFileEnvKey, extraComposePath],
+            [controllerDockerRuntimeEnvKey, undefined],
+            [controllerGpuModeEnvKey, undefined]
+          ])
+        )
+
+        const error = yield* _(resolveControllerComposeFiles().pipe(Effect.flip))
+        expect(error._tag).toBe("ControllerBootstrapError")
+        expect(error.message).toContain("regular file")
+      })
+    ).pipe(Effect.provide(NodeContext.layer)))
+
   it.effect("does not initialize the Skiller submodule when package metadata already exists", () => {
     const startedCommands: Array<string> = []
 

packages/auth-oauth/src/claude-docker-oauth.ts

@@ -1,4 +1,4 @@
-import { chmod, mkdtemp, mkdir, rm, writeFile } from "node:fs/promises"
+import { chmod, mkdtemp, mkdir, rename, rm, writeFile } from "node:fs/promises"
 import { tmpdir } from "node:os"
 import { join, resolve } from "node:path"
 import { fileURLToPath } from "node:url"
@@ -285,8 +285,23 @@ const runDockerProbe = (spec: ClaudeDockerProbeSpec): Promise<number> =>
 
 const writeCapturedToken = async (accountPath: string, token: string): Promise<void> => {
   const tokenPath = claudeOauthTokenPath(accountPath)
-  await writeFile(tokenPath, formatClaudeOauthTokenFile(token), "utf8")
-  await chmod(tokenPath, claudeOauthTokenFileMode)
+  const tempDir = await mkdtemp(join(accountPath, ".oauth-token-write-"))
+  const tempPath = join(tempDir, ".oauth-token")
+  let renamed = false
+  try {
+    await writeFile(tempPath, formatClaudeOauthTokenFile(token), {
+      encoding: "utf8",
+      mode: claudeOauthTokenFileMode
+    })
+    await chmod(tempPath, claudeOauthTokenFileMode)
+    await rename(tempPath, tokenPath)
+    renamed = true
+  } finally {
+    await rm(tempDir, { recursive: true, force: true })
+    if (!renamed) {
+      await rm(tempPath, { force: true })
+    }
+  }
 }
 
 const dockerProbeStatusFromExitCode = (exitCode: number): ClaudeDockerProbeStatus =>

packages/auth-oauth/src/claude-local-smoke.ts

@@ -91,7 +91,10 @@ export const persistClaudeLocalOauthToken = async (
   token: string
 ): Promise<void> => {
   const tokenPath = claudeOauthTokenPath(accountPath)
-  await writeFile(tokenPath, formatClaudeOauthTokenFile(token), "utf8")
+  await writeFile(tokenPath, formatClaudeOauthTokenFile(token), {
+    encoding: "utf8",
+    mode: claudeOauthTokenFileMode
+  })
   await chmod(tokenPath, claudeOauthTokenFileMode)
 }
 

packages/auth-oauth/tests/claude-docker-oauth.test.ts

@@ -1,4 +1,4 @@
-import { mkdtemp, readFile, stat } from "node:fs/promises"
+import { mkdtemp, readFile, rm, stat } from "node:fs/promises"
 import { tmpdir } from "node:os"
 import { join } from "node:path"
 
@@ -41,12 +41,16 @@ const oauthTokenArbitrary = fc.array(fc.constantFrom(
   maxLength: 64
 }).map((chars) => `${oauthTokenPrefix}${chars.join("")}`)
 
+const temporaryAccountPath = (prefix: string) =>
+  Effect.acquireRelease(
+    Effect.tryPromise(() => mkdtemp(join(tmpdir(), prefix))),
+    (accountPath) => Effect.promise(() => rm(accountPath, { recursive: true, force: true }))
+  )
+
 describe("Claude Docker OAuth runner", () => {
   it.effect("runs Docker setup-token, persists token, then probes through the mounted token file", () =>
-    Effect.gen(function*(_) {
-      const accountPath = yield* _(
-        Effect.tryPromise(() => mkdtemp(join(tmpdir(), "docker-git-auth-oauth-docker-test-")))
-      )
+    Effect.scoped(Effect.gen(function*(_) {
+      const accountPath = yield* _(temporaryAccountPath("docker-git-auth-oauth-docker-test-"))
       const builds: Array<ClaudeDockerBuildSpec> = []
       const setupRuns: Array<ClaudeDockerSetupTokenSpec> = []
       const probeRuns: Array<ClaudeDockerProbeSpec> = []
@@ -96,13 +100,11 @@ describe("Claude Docker OAuth runner", () => {
       expect(probeRuns[0]?.args.slice(-3)).toEqual(["claude-test:latest", "-p", "ping"])
       const tokenMode = yield* _(Effect.tryPromise(() => stat(claudeOauthTokenPath(accountPath))))
       expect(tokenMode.mode & 0o777).toBe(claudeOauthTokenFileMode)
-    }))
+    })))
 
   it.effect("keeps the captured token and file mode when Docker probe fails", () =>
-    Effect.gen(function*(_) {
-      const accountPath = yield* _(
-        Effect.tryPromise(() => mkdtemp(join(tmpdir(), "docker-git-auth-oauth-docker-probe-test-")))
-      )
+    Effect.scoped(Effect.gen(function*(_) {
+      const accountPath = yield* _(temporaryAccountPath("docker-git-auth-oauth-docker-probe-test-"))
       const result = yield* _(
         Effect.tryPromise(() =>
           runClaudeDockerOauth({
@@ -124,7 +126,7 @@ describe("Claude Docker OAuth runner", () => {
       const tokenMode = yield* _(Effect.tryPromise(() => stat(claudeOauthTokenPath(accountPath))))
       expect(tokenFile).toBe(`${oauthToken}\n`)
       expect(tokenMode.mode & 0o777).toBe(claudeOauthTokenFileMode)
-    }))
+    })))
 
   it.effect("returns command failure when setup-token exits non-zero without token", () =>
     Effect.gen(function*(_) {

packages/lib/src/usecases/auth-claude-oauth.ts

@@ -177,6 +177,13 @@ const resolveClaudeDockerOauthTokenResult = (
           )
         )
       }
+      if (result.probeStatus._tag === "ClaudeDockerProbeFailed") {
+        yield* _(
+          Effect.logWarning(
+            `claude -p ping failed with exit=${result.probeStatus.exitCode}; OAuth token was saved. Run docker-git auth claude status to verify later.`
+          )
+        )
+      }
       return result.token
     }
     if (result._tag === "ClaudeDockerOauthCommandFailed") {

packages/lib/src/usecases/auth-claude.ts

@@ -57,7 +57,7 @@ const persistClaudeOauthToken = (
 ): Effect.Effect<void, PlatformError> =>
   Effect.gen(function*(_) {
     const tokenPath = claudeOauthTokenPath(accountPath)
-    yield* _(fs.writeFileString(tokenPath, formatClaudeOauthTokenFile(token)))
+    yield* _(fs.writeFileString(tokenPath, formatClaudeOauthTokenFile(token), { mode: claudeOauthTokenFileMode }))
     yield* _(fs.chmod(tokenPath, claudeOauthTokenFileMode))
   })
 

packages/lib/tests/usecases/auth-claude-local.test.ts

@@ -16,9 +16,8 @@ import {
   runClaudeLocalEnvTokenLoginFlow
 } from "../../src/usecases/auth-claude-local.js"
 
-const oauthTokenPrefix = ["sk", "ant", ""].join("-")
-const oauthToken = `${oauthTokenPrefix}oat01-LOCAL0123456789abcdef`
-const lowerPriorityToken = `${oauthTokenPrefix}oat01-LOWERPRIORITY0123456789`
+const oauthToken = "TEST_CLAUDE_OAUTH_TOKEN_LOCAL"
+const lowerPriorityToken = "TEST_CLAUDE_OAUTH_TOKEN_LOWER_PRIORITY"
 
 const makeExitCodeExecutor = (
   exitCode: number,

packages/lib/tests/usecases/auth-claude-login.test.ts

@@ -4,7 +4,7 @@ import * as FileSystem from "@effect/platform/FileSystem"
 import * as Path from "@effect/platform/Path"
 import { NodeContext } from "@effect/platform-node"
 import { describe, expect, it } from "@effect/vitest"
-import { Effect } from "effect"
+import { Effect, Logger } from "effect"
 import * as Inspectable from "effect/Inspectable"
 import * as Sink from "effect/Sink"
 import * as Stream from "effect/Stream"
@@ -13,8 +13,7 @@ import { authClaudeLogin } from "../../src/usecases/auth-claude.js"
 
 const encode = (value: string): Uint8Array => new TextEncoder().encode(value)
 
-const oauthTokenPrefix = ["sk", "ant", ""].join("-")
-const oauthToken = `${oauthTokenPrefix}oat01-EXAMPLE0123456789abcdef`
+const oauthToken = "TEST_CLAUDE_OAUTH_TOKEN_EXAMPLE"
 
 // Mirrors the real `claude setup-token` output that the OAuth parser scans for.
 const setupTokenOutput = (token: string): string =>
@@ -130,10 +129,18 @@ const withPatchedEnv = <A, E, R>(
 const runLoginAndReadToken = (
   root: string,
   pingExitCode: number
-): Effect.Effect<string, unknown, FileSystem.FileSystem | Path.Path> =>
+): Effect.Effect<
+  { readonly logs: ReadonlyArray<string>; readonly tokenText: string },
+  unknown,
+  FileSystem.FileSystem | Path.Path
+> =>
   Effect.gen(function*(_) {
     const fs = yield* _(FileSystem.FileSystem)
     const path = yield* _(Path.Path)
+    const logs: Array<string> = []
+    const logger = Logger.make(({ message }) => {
+      logs.push(String(message))
+    })
     const claudeAuthPath = path.join(root, ".docker-git/.orch/auth/claude")
 
     yield* _(
@@ -142,11 +149,13 @@ const runLoginAndReadToken = (
         label: null,
         claudeAuthPath
       }).pipe(
-        Effect.provideService(CommandExecutor.CommandExecutor, makeFakeExecutor(oauthToken, pingExitCode))
+        Effect.provideService(CommandExecutor.CommandExecutor, makeFakeExecutor(oauthToken, pingExitCode)),
+        Effect.provide(Logger.replace(Logger.defaultLogger, logger))
       )
     )
 
-    return yield* _(fs.readFileString(path.join(claudeAuthPath, "default", ".oauth-token")))
+    const tokenText = yield* _(fs.readFileString(path.join(claudeAuthPath, "default", ".oauth-token")))
+    return { logs, tokenText }
   })
 
 const runLoginWithoutCapturedToken = (
@@ -184,8 +193,9 @@ describe("authClaudeLogin", () => {
       withPatchedEnv(
         { HOME: root, DOCKER_GIT_STATE_AUTO_SYNC: "0", DOCKER_GIT_PROJECTS_ROOT: undefined },
         Effect.gen(function*(_) {
-          const persisted = yield* _(runLoginAndReadToken(root, 7))
-          expect(persisted.trim()).toBe(oauthToken)
+          const { logs, tokenText } = yield* _(runLoginAndReadToken(root, 7))
+          expect(tokenText.trim()).toBe(oauthToken)
+          expect(logs.some((message) => message.includes("claude -p ping failed with exit=7"))).toBe(true)
         })
       )
     ).pipe(Effect.provide(NodeContext.layer)))
@@ -195,8 +205,8 @@ describe("authClaudeLogin", () => {
       withPatchedEnv(
         { HOME: root, DOCKER_GIT_STATE_AUTO_SYNC: "0", DOCKER_GIT_PROJECTS_ROOT: undefined },
         Effect.gen(function*(_) {
-          const persisted = yield* _(runLoginAndReadToken(root, 0))
-          expect(persisted.trim()).toBe(oauthToken)
+          const { tokenText } = yield* _(runLoginAndReadToken(root, 0))
+          expect(tokenText.trim()).toBe(oauthToken)
         })
       )
     ).pipe(Effect.provide(NodeContext.layer)))

scripts/e2e/auth-claude-login.sh

@@ -13,6 +13,7 @@ chmod 0700 "$ROOT"
 KEEP="${KEEP:-0}"
 COMPOSE_OVERRIDE_FILE="$ROOT/docker-compose.auth-claude-login.yml"
 LOGIN_TIMEOUT_SECONDS="${DOCKER_GIT_E2E_AUTH_CLAUDE_LOGIN_TIMEOUT_SECONDS:-900}"
+OAUTH_TOKEN_MARKER="docker-git-e2e-oauth-token-marker"
 
 export DOCKER_GIT_PROJECTS_ROOT="$ROOT"
 export DOCKER_GIT_STATE_AUTO_SYNC=0
@@ -21,11 +22,11 @@ export DOCKER_GIT_PROJECTS_ROOT_VOLUME="docker-git-e2e-auth-claude-$RUN_ID-proje
 export DOCKER_GIT_CONTROLLER_COMPOSE_EXTRA_FILE="$COMPOSE_OVERRIDE_FILE"
 export COMPOSE_PROJECT_NAME="docker-git"
 
-cat > "$COMPOSE_OVERRIDE_FILE" <<'YAML'
+cat > "$COMPOSE_OVERRIDE_FILE" <<YAML
 services:
   api:
     environment:
-      DOCKER_GIT_CLAUDE_OAUTH_TOKEN: docker-git-e2e-oauth-token-marker
+      DOCKER_GIT_CLAUDE_OAUTH_TOKEN: ${OAUTH_TOKEN_MARKER}
 YAML
 
 LOG_FILE="/tmp/docker-git-auth-claude-login-$RUN_ID.log"
@@ -74,6 +75,10 @@ if [[ "$login_exit" -ne 0 ]]; then
   fail "docker-git auth claude login failed (exit: $login_exit)"
 fi
 
+if grep -Fq -- "$OAUTH_TOKEN_MARKER" "$LOG_FILE"; then
+  fail "expected OAuth token marker to be absent from auth claude login output"
+fi
+
 grep -Fq -- "Claude OAuth token saved" "$LOG_FILE" \
   || fail "expected saved-token warning in auth claude login output"