fix: route claude auth status through controller

packages/api/src/api/contracts.ts

@@ -299,6 +299,14 @@ export type CodexAuthStatus = {
   readonly account: string | null
 }
 
+export type ClaudeAuthStatus = {
+  readonly label: string
+  readonly message: string
+  readonly connected: boolean
+  readonly authPath: string
+  readonly method: "none" | "oauth-token" | "claude-ai-session"
+}
+
 export type GrokAuthStatus = {
   readonly label: string
   readonly message: string

packages/api/src/api/openapi.ts

@@ -251,6 +251,19 @@ export const CodexStatusResponseSchema = Schema.Struct({
   status: CodexAuthStatusSchema
 })
 
+export const ClaudeAuthStatusSchema = Schema.Struct({
+  authPath: Schema.String,
+  connected: Schema.Boolean,
+  label: Schema.String,
+  message: Schema.String,
+  method: Schema.Literal("none", "oauth-token", "claude-ai-session")
+})
+
+export const ClaudeStatusResponseSchema = Schema.Struct({
+  ok: OptionalOkSchema,
+  status: ClaudeAuthStatusSchema
+})
+
 export const GrokAuthStatusSchema = Schema.Struct({
   authPath: Schema.String,
   connected: Schema.Boolean,
@@ -601,6 +614,11 @@ const AuthGroup = HttpApiGroup.make("auth")
       .setUrlParams(QueryLabelSchema)
       .addSuccess(CodexStatusResponseSchema)
   )
+  .add(
+    endpoint.get("claudeStatus", "/auth/claude/status")
+      .setUrlParams(QueryLabelSchema)
+      .addSuccess(ClaudeStatusResponseSchema)
+  )
   .add(
     endpoint.post("githubLogin", "/auth/github/login")
       .setPayload(GithubAuthLoginRequestSchema)

packages/api/src/http.ts

@@ -59,6 +59,7 @@ import {
   logoutGitAuth,
   logoutGitlabAuth,
   logoutGithubAuth,
+  readClaudeAuthStatus,
   readCodexAuthStatus,
   readGrokAuthStatus,
   readGitAuthStatus,
@@ -1138,6 +1139,15 @@ export const makeRouter = () => {
         return yield* _(jsonResponse({ status }, 200))
       }).pipe(Effect.catchAll(errorResponse))
     ),
+    HttpRouter.get(
+      "/auth/claude/status",
+      Effect.gen(function*(_) {
+        const request = yield* _(HttpServerRequest.HttpServerRequest)
+        const label = new URL(request.url, "http://localhost").searchParams.get("label")
+        const status = yield* _(readClaudeAuthStatus(label))
+        return yield* _(jsonResponse({ status }, 200))
+      }).pipe(Effect.catchAll(errorResponse))
+    ),
     HttpRouter.get(
       "/auth/menu",
       Effect.gen(function*(_) {

packages/api/src/services/auth.ts

@@ -6,6 +6,11 @@ import { defaultTemplateConfig } from "@effect-template/lib/core/template-defaul
 import { parseGithubRepoUrl, parseGitlabRepoUrl } from "@effect-template/lib/core/repo"
 import { CommandFailedError } from "@effect-template/lib/shell/errors"
 import { authCodexLogin as runCodexLogin } from "@effect-template/lib/usecases/auth-codex"
+import {
+  claudeAuthRoot,
+  resolveClaudeAccountPath,
+  resolveClaudeAuthMethod
+} from "@effect-template/lib/usecases/auth-claude"
 import { authGrokLogout as runGrokLogout } from "@effect-template/lib/usecases/auth-grok-logout"
 import { authGitLogin as runGitLogin, authGitLogout as runGitLogout, listGitConnections } from "@effect-template/lib/usecases/auth-git"
 import { authGitlabLogin as runGitlabLogin, authGitlabLogout as runGitlabLogout, listGitlabTokens } from "@effect-template/lib/usecases/auth-gitlab"
@@ -37,6 +42,7 @@ import type {
   CodexAuthLoginRequest,
   CodexAuthLogoutRequest,
   CodexAuthStatus,
+  ClaudeAuthStatus,
   GrokAuthLogoutRequest,
   GrokAuthStatus,
   GitAuthLoginRequest,
@@ -65,6 +71,7 @@ export const gitlabAuthRequiredMessage = [
 ].join("\n")
 export const githubAuthEnvGlobalPath = defaultTemplateConfig.envGlobalPath
 export const codexAuthPath = defaultTemplateConfig.codexAuthPath
+export const claudeAuthPath = claudeAuthRoot
 export const grokAuthPath = defaultTemplateConfig.grokAuthPath
 
 const githubTokenKey = "GITHUB_TOKEN"
@@ -503,6 +510,20 @@ const codexAuthStatus = (
   account
 })
 
+const claudeAuthStatus = (
+  label: string,
+  authPath: string,
+  method: ClaudeAuthStatus["method"]
+): ClaudeAuthStatus => ({
+  label,
+  message: method === "none"
+    ? `Claude not connected (${label}).`
+    : `Claude connected (${label}, ${method}).`,
+  connected: method !== "none",
+  authPath,
+  method
+})
+
 const grokAuthStatus = (
   label: string,
   authPath: string,
@@ -517,6 +538,18 @@ const grokAuthStatus = (
   method
 })
 
+export const readClaudeAuthStatus = (
+  label?: string | null | undefined
+): Effect.Effect<ClaudeAuthStatus, PlatformError, FileSystem.FileSystem | Path.Path> =>
+  Effect.gen(function*(_) {
+    const fs = yield* _(FileSystem.FileSystem)
+    const path = yield* _(Path.Path)
+    const rootPath = resolvePathFromCwd(path, process.cwd(), claudeAuthPath)
+    const { accountLabel, accountPath } = resolveClaudeAccountPath(path, rootPath, label ?? null)
+    const method = yield* _(resolveClaudeAuthMethod(fs, path, accountPath))
+    return claudeAuthStatus(accountLabel, accountPath, method)
+  })
+
 export const readGrokAuthStatus = (
   label?: string | null | undefined
 ): Effect.Effect<GrokAuthStatus, PlatformError, FileSystem.FileSystem | Path.Path> =>

packages/api/tests/openapi.test.ts

@@ -32,11 +32,12 @@ describe("openapi contract", () => {
       expect(paths["/auth/git/status"]).toBeDefined()
       expect(paths["/auth/gitlab/status"]).toBeDefined()
       expect(paths["/auth/codex/status"]).toBeDefined()
+      expect(paths["/auth/claude/status"]).toBeDefined()
       expect(paths["/auth/grok/status"]).toBeDefined()
       expect(paths["/auth/codex/login"]).toBeUndefined()
       expect(paths["/projects/{projectId}/auth/menu"]).toBeDefined()
       expect(paths["/projects/{projectId}/auth"]).toBeUndefined()
-      expect(Object.keys(paths)).toHaveLength(54)
+      expect(Object.keys(paths)).toHaveLength(55)
     }))
 
   it.effect("documents real HTTP success status codes for create and async endpoints", () =>

packages/app/src/docker-git/api-client-auth.ts

@@ -22,6 +22,7 @@ import type {
   AuthCodexLoginCommand,
   AuthCodexLogoutCommand,
   AuthCodexStatusCommand,
+  AuthClaudeStatusCommand,
   AuthGithubLoginCommand,
   AuthGithubLogoutCommand,
   AuthGithubStatusCommand,
@@ -203,6 +204,11 @@ export const codexStatus = (command: AuthCodexStatusCommand) => {
   return request("GET", `/auth/codex/status${query}`)
 }
 
+export const claudeStatus = (command: AuthClaudeStatusCommand) => {
+  const query = command.label === null ? "" : `?label=${encodeURIComponent(command.label)}`
+  return request("GET", `/auth/claude/status${query}`)
+}
+
 export const grokStatus = (command: AuthGrokStatusCommand) => {
   const query = command.label === null ? "" : `?label=${encodeURIComponent(command.label)}`
   return request("GET", `/auth/grok/status${query}`)

packages/app/src/docker-git/api-client.ts

@@ -28,6 +28,7 @@ export {
   codexLogin,
   codexLogout,
   codexStatus,
+  claudeStatus,
   githubLogin,
   githubLogout,
   githubStatus,

packages/app/src/docker-git/program-auth.ts

@@ -6,6 +6,7 @@ import {
   codexLogin,
   codexLogout,
   codexStatus,
+  claudeStatus,
   createAuthTerminalSession,
   githubLogin,
   githubLogout,
@@ -52,6 +53,7 @@ export type RoutedAuthCommand = Extract<
       | "AuthCodexImport"
       | "AuthCodexStatus"
       | "AuthCodexLogout"
+      | "AuthClaudeStatus"
   }
 >
 
@@ -77,6 +79,7 @@ const routedAuthTags: Readonly<Record<string, true>> = {
   AuthGithubLogout: true,
   AuthGithubStatus: true,
   AuthClaudeLogin: true,
+  AuthClaudeStatus: true,
   AuthGeminiLogin: true,
   AuthGrokLogin: true,
   AuthGrokLogout: true,
@@ -156,6 +159,10 @@ const handleClaudeLoginCommand = (
     )
   )
 
+const handleClaudeStatusCommand = (
+  command: Extract<OperationalCommand, { readonly _tag: "AuthClaudeStatus" }>
+) => withControllerReady(pipe(claudeStatus(command), Effect.flatMap((payload) => renderAuthPayload(payload))))
+
 const handleGeminiLoginCommand = (
   command: Extract<OperationalCommand, { readonly _tag: "AuthGeminiLogin" }>
 ) =>
@@ -214,6 +221,7 @@ export const dispatchRoutedAuthCommand = (
     Match.when({ _tag: "AuthGitStatus" }, handleGitStatusCommand),
     Match.when({ _tag: "AuthGitLogout" }, handleGitLogoutCommand),
     Match.when({ _tag: "AuthClaudeLogin" }, handleClaudeLoginCommand),
+    Match.when({ _tag: "AuthClaudeStatus" }, handleClaudeStatusCommand),
     Match.when({ _tag: "AuthGeminiLogin" }, handleGeminiLoginCommand),
     Match.when({ _tag: "AuthGrokLogin" }, handleGrokLoginCommand),
     Match.when({ _tag: "AuthGrokStatus" }, handleGrokStatusCommand),

packages/app/src/docker-git/program-unsupported.ts

@@ -5,7 +5,6 @@ export type UnsupportedOperationalCommandTag =
   | "ScrapImport"
   | "McpPlaywrightUp"
   | "Apply"
-  | "AuthClaudeStatus"
   | "AuthClaudeLogout"
   | "AuthGeminiStatus"
   | "AuthGeminiLogout"
@@ -26,10 +25,6 @@ export const unsupportedOperationalCommands: Record<
     command: "Apply",
     message: "Command Apply is not available in API-only host mode."
   },
-  AuthClaudeStatus: {
-    command: "auth claude status",
-    message: "Claude status is not routed through the controller in host API mode."
-  },
   AuthClaudeLogout: {
     command: "auth claude logout",
     message: "Claude logout is not routed through the controller in host API mode."

packages/app/tests/docker-git/program.test.ts

@@ -12,6 +12,7 @@ const runBrowserFrontendCommandMock = vi.hoisted(
 const runMenuCallMock = vi.hoisted(() => vi.fn(() => {}))
 const readCommandMock = vi.hoisted(() => vi.fn<() => Command>())
 const codexLoginMock = vi.hoisted(() => vi.fn(() => Effect.void))
+const claudeStatusMock = vi.hoisted(() => vi.fn(() => Effect.succeed({ status: { connected: false } })))
 const createAuthTerminalSessionMock = vi.hoisted(() => vi.fn())
 const attachTerminalSessionMock = vi.hoisted(() => vi.fn(() => Effect.void))
 const gitlabLoginMock = vi.hoisted(() => vi.fn(() => Effect.succeed({ ok: true })))
@@ -43,6 +44,11 @@ const claudeLoginCommand: Extract<Command, { readonly _tag: "AuthClaudeLogin" }>
   label: "work",
   claudeAuthPath: ".docker-git/.orch/auth/claude"
 }
+const claudeStatusCommand: Extract<Command, { readonly _tag: "AuthClaudeStatus" }> = {
+  _tag: "AuthClaudeStatus",
+  label: "work",
+  claudeAuthPath: ".docker-git/.orch/auth/claude"
+}
 const geminiLoginCommand: Extract<Command, { readonly _tag: "AuthGeminiLogin" }> = {
   _tag: "AuthGeminiLogin",
   label: null,
@@ -71,6 +77,7 @@ vi.mock("../../src/docker-git/api-client.js", () => ({
   codexImport: vi.fn(() => Effect.succeed({ ok: true })),
   codexLogout: vi.fn(() => Effect.void),
   codexStatus: vi.fn(() => Effect.succeed({ ok: true })),
+  claudeStatus: claudeStatusMock,
   createAuthTerminalSession: createAuthTerminalSessionMock,
   createProject: vi.fn(() => Effect.succeed(null)),
   downAllProjects: vi.fn(() => Effect.void),
@@ -122,6 +129,8 @@ describe("program menu dispatch", () => {
     readCommandMock.mockReturnValue(menuCommand)
     codexLoginMock.mockReset()
     codexLoginMock.mockImplementation(() => Effect.void)
+    claudeStatusMock.mockReset()
+    claudeStatusMock.mockImplementation(() => Effect.succeed({ status: { connected: false } }))
     createAuthTerminalSessionMock.mockReset()
     createAuthTerminalSessionMock.mockImplementation(() =>
       Effect.succeed({
@@ -212,6 +221,16 @@ describe("program menu dispatch", () => {
       expect(process.exitCode ?? 0).toBe(0)
     }))
 
+  it.effect("routes claude status through the controller API", () =>
+    Effect.gen(function*(_) {
+      readCommandMock.mockReturnValue(claudeStatusCommand)
+      yield* _(runProgram())
+
+      expect(ensureControllerReadyMock).toHaveBeenCalledTimes(1)
+      expect(claudeStatusMock).toHaveBeenCalledWith(claudeStatusCommand)
+      expect(process.exitCode ?? 0).toBe(0)
+    }))
+
   it.effect("routes gemini login through controller auth terminal sessions", () =>
     Effect.gen(function*(_) {
       readCommandMock.mockReturnValue(geminiLoginCommand)

packages/lib/src/usecases/auth-claude.ts

@@ -19,7 +19,7 @@ import { autoSyncState } from "./state-repo.js"
 import { readFileStringIfPresent, writeFileStringEnsuringParent } from "./volatile-files.js"
 
 type ClaudeRuntime = FileSystem.FileSystem | Path.Path | CommandExecutor.CommandExecutor
-type ClaudeAuthMethod = "none" | "oauth-token" | "claude-ai-session"
+export type ClaudeAuthMethod = "none" | "oauth-token" | "claude-ai-session"
 
 type ClaudeAccountContext = {
   readonly accountLabel: string
@@ -113,7 +113,7 @@ const readOauthToken = (
     return token.length > 0 ? token : null
   })
 
-const resolveClaudeAuthMethod = (
+export const resolveClaudeAuthMethod = (
   fs: FileSystem.FileSystem,
   path: Path.Path,
   accountPath: string
@@ -166,7 +166,7 @@ RUN npm install -g @anthropic-ai/claude-code@latest
 ENTRYPOINT ["claude"]
 `
 
-const resolveClaudeAccountPath = (path: Path.Path, rootPath: string, label: string | null): {
+export const resolveClaudeAccountPath = (path: Path.Path, rootPath: string, label: string | null): {
   readonly accountLabel: string
   readonly accountPath: string
 } => {