Claude accounts re-land: never sign anyone out, keep proxies working, accounts mirror ~/.claude

src/main/agent-workspace-trust.test.ts

@@ -203,7 +203,6 @@ describe('applyAgentWorkspaceTrust on this machine', () => {
       wslDistro: 'Ubuntu',
       wslLinuxConfigDir: '/home/u/.claude',
       envPatch: {},
-      stripAuthEnv: false,
       provenance: 'test'
     } as const
     const wsl = { ...local, claudeAuth: wslAuth, wslDistro: 'Ubuntu' }

src/main/claude-accounts/claude-account-folder.test.ts

@@ -1,4 +1,12 @@
-import { existsSync, mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from 'node:fs'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  rmSync,
+  symlinkSync,
+  utimesSync,
+  writeFileSync
+} from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -21,7 +29,11 @@ vi.mock('../macos-keychain/generic-password', () => ({
   }
 }))
 
-import { readClaudeFolderLogin, removeClaudeAccountFolder } from './claude-account-folder'
+import {
+  readClaudeFolderLogin,
+  readClaudeFolderLoginAsync,
+  removeClaudeAccountFolder
+} from './claude-account-folder'
 import { claudeKeychainService } from './keychain'
 
 const roots: string[] = []
@@ -65,6 +77,25 @@ describe('claude account folder', () => {
     expect(readClaudeFolderLogin(stateFile)?.email).toBe('b@example.test!')
   })
 
+  it('rereads a state file over a share only when its mtime or size changes', async () => {
+    const { home } = fixture()
+    const stateFile = join(home, '.claude.json')
+    await expect(readClaudeFolderLoginAsync(stateFile)).resolves.toBeNull()
+    writeFileSync(stateFile, JSON.stringify({ oauthAccount: { emailAddress: 'a@example.test' } }))
+    // Whole seconds, which every filesystem stores exactly.
+    const mtime = new Date(Math.floor(Date.now() / 1000) * 1000)
+    utimesSync(stateFile, mtime, mtime)
+    expect((await readClaudeFolderLoginAsync(stateFile))?.email).toBe('a@example.test')
+    // Same size and mtime: the cached answer, so the file was not read again.
+    writeFileSync(stateFile, JSON.stringify({ oauthAccount: { emailAddress: 'b@example.test' } }))
+    utimesSync(stateFile, mtime, mtime)
+    expect((await readClaudeFolderLoginAsync(stateFile))?.email).toBe('a@example.test')
+    utimesSync(stateFile, mtime, new Date(mtime.getTime() + 2_000))
+    expect((await readClaudeFolderLoginAsync(stateFile))?.email).toBe('b@example.test')
+    rmSync(stateFile)
+    await expect(readClaudeFolderLoginAsync(stateFile)).resolves.toBeNull()
+  })
+
   // A real symlink needs Developer Mode on Windows (EPERM otherwise).
   it.skipIf(process.platform === 'win32')(
     'unlinks shared history before deleting, and leaves the older layout alone',

src/main/claude-accounts/claude-account-folder.ts

@@ -7,6 +7,7 @@ import {
   statSync,
   unlinkSync
 } from 'node:fs'
+import { readFile, stat } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { z } from 'zod'
@@ -48,6 +49,20 @@ const logins = new Map<
   { mtimeMs: number; size: number; readAt: number; login: ClaudeFolderLogin | null }
 >()
 
+/** Whether two logins name one account: the same email, and the same organization when both
+ *  name one, so one email in two organizations stays two accounts. */
+export function isSameClaudeLogin(
+  left: { email: string; organizationUuid?: string | null },
+  right: { email: string; organizationUuid?: string | null }
+): boolean {
+  return (
+    left.email.trim().toLowerCase() === right.email.trim().toLowerCase() &&
+    (!left.organizationUuid ||
+      !right.organizationUuid ||
+      left.organizationUuid === right.organizationUuid)
+  )
+}
+
 /** The login parsed Claude state names; null before Claude finishes a sign-in. */
 export function claudeStateLogin(state: Record<string, unknown>): ClaudeFolderLogin | null {
   const parsed = oauthAccount.safeParse(state.oauthAccount)
@@ -87,6 +102,37 @@ export function readClaudeFolderLogin(stateFile: string, maxAgeMs = 0): ClaudeFo
   return login
 }
 
+/** readClaudeFolderLogin without blocking, for a state file across a WSL share. */
+export async function readClaudeFolderLoginAsync(
+  stateFile: string
+): Promise<ClaudeFolderLogin | null> {
+  const current = await stat(stateFile).catch(() => null)
+  if (!current) {
+    logins.delete(stateFile)
+    return null
+  }
+  const recent = logins.get(stateFile)
+  if (recent?.mtimeMs === current.mtimeMs && recent.size === current.size) {
+    return recent.login
+  }
+  let login: ClaudeFolderLogin | null = null
+  try {
+    const state: unknown = JSON.parse(await readFile(stateFile, 'utf8'))
+    if (state && typeof state === 'object' && !Array.isArray(state)) {
+      login = claudeStateLogin(Object.fromEntries(Object.entries(state)))
+    }
+  } catch {
+    // Unreadable reads as signed out, as on the host.
+  }
+  logins.set(stateFile, {
+    mtimeMs: current.mtimeMs,
+    size: current.size,
+    readAt: Date.now(),
+    login
+  })
+  return login
+}
+
 /**
  * Deletes a host account's folder and, on macOS, the Keychain items Claude keyed to it
  * (superset profile-remove.ts). Only `claude-profiles/<id>` is reachable from an id, so an

src/main/claude-accounts/claude-account-selection.ts

@@ -46,7 +46,7 @@ export type ClaudeAccountRuntime = Pick<
 > & {
   router: Pick<
     ClaudeRuntimeAuthService['router'],
-    'accountHome' | 'userConfigDir' | 'copiedLoginIntoSystemDefault'
+    'accountHome' | 'userConfigDir' | 'copiedLoginIntoSystemDefault' | 'coveredBySystemDefault'
   >
 }
 
@@ -107,13 +107,17 @@ export class ClaudeAccountSelection {
     const login = readClaudeFolderLogin(
       claudeStateFile(this.runtimeAuth.router.accountHome(account.id))
     )
-    return login
-      ? {
-          ...summary,
-          email: login.email,
-          organizationUuid: login.organizationUuid,
-          organizationName: login.organizationName
-        }
+    if (login) {
+      return {
+        ...summary,
+        email: login.email,
+        organizationUuid: login.organizationUuid,
+        organizationName: login.organizationName
+      }
+    }
+    // Why: an account System default is signed in to runs there until it signs in on its own.
+    return this.runtimeAuth.router.coveredBySystemDefault(account.id)
+      ? summary
       : { ...summary, needsSignIn: true }
   }
 

src/main/claude-accounts/claude-account-service.test.ts

@@ -44,6 +44,7 @@ function fixture(accounts: ClaudeManagedAccount[] = [account('a'), account('b')]
       JSON.stringify({ oauthAccount: { emailAddress: email } })
     )
   }
+  const covered = new Set<string>()
   let settings: GlobalSettings = {
     ...getDefaultSettings('/tmp'),
     claudeManagedAccounts: accounts,
@@ -54,7 +55,8 @@ function fixture(accounts: ClaudeManagedAccount[] = [account('a'), account('b')]
     router: {
       accountHome: home,
       userConfigDir: () => join(root, 'personal'),
-      copiedLoginIntoSystemDefault: () => existsSync(join(root, 'claude-runtime-auth'))
+      copiedLoginIntoSystemDefault: () => existsSync(join(root, 'claude-runtime-auth')),
+      coveredBySystemDefault: (id: string) => covered.has(id)
     },
     syncForCurrentSelection: vi.fn(async (_target?: ClaudeAccountSelectionTarget) => {}),
     publishAll: vi.fn(async () => {}),
@@ -88,7 +90,7 @@ function fixture(accounts: ClaudeManagedAccount[] = [account('a'), account('b')]
     runtimeAuth,
     runLogin
   )
-  return { root, home, service, runtimeAuth, runLogin, signIn, settings: () => settings }
+  return { root, home, service, runtimeAuth, runLogin, signIn, covered, settings: () => settings }
 }
 
 // The id the last sign-in prepared a folder for.
@@ -121,6 +123,15 @@ describe('ClaudeAccountService', () => {
     expect(byId.get('new-wsl')?.needsSignIn).toBeUndefined()
   })
 
+  it('asks no sign-in of an account System default runs, and lets it be selected', async () => {
+    const f = fixture()
+    f.covered.add('b')
+    expect(f.service.listAccounts().accounts.find((row) => row.id === 'b')?.needsSignIn).toBe(
+      undefined
+    )
+    await expect(f.service.selectAccount('b')).resolves.toMatchObject({ activeAccountId: 'b' })
+  })
+
   it("reports System default's login from the user's own folder", () => {
     const f = fixture()
     mkdirSync(join(f.root, 'personal'))

src/main/claude-accounts/claude-credential-persistence-ratchet.test.ts

@@ -33,7 +33,8 @@ const fsAllowances: Record<string, readonly string[]> = {
     'mkdirSync',
     'renameSync',
     'rmdirSync',
-    'symlinkSync'
+    'symlinkSync',
+    'unlinkSync'
   ],
   'claude-accounts/claude-profile-paths.ts': ['mkdirSync', 'writeFileAtomically'],
   // The which-account file.
@@ -51,7 +52,11 @@ const fsAllowances: Record<string, readonly string[]> = {
     'writeFileSync',
     'writeFileAtomically'
   ],
-  'claude-accounts/claude-profile-provisioning.ts': ['mkdirSync', 'rmSync', 'writeFileAtomically'],
+  'claude-accounts/claude-profile-provisioning.ts': [
+    'publishFileWithoutOverwrite',
+    'rmSync',
+    'writeFileSync'
+  ],
   'claude-accounts/claude-profile-sharing.ts': [
     'mkdirSync',
     'rmdirSync',