Statusline stuck on '⚠ Reauthenticate' after upgrade: codemie-statusline.mjs not shipped + installer doesn't re-point settings.json + stale CBC decrypt

[aleksandrprimachenko-hub]

Description

The Claude plugin status line permanently shows ⚠ Reauthenticate in the budget/spend slot after upgrading @codemieai/code. Re-authenticating (even daily) never fixes it, and the machine hostname is unchanged. Root cause is a combination of a shipped-file/filename mismatch, an installer that never upgrades an existing statusLine command, and a credential-format change (CBC → GCM) that a stale deployed script cannot read.

Steps to Reproduce

1. Install a build where the statusline deploys as ~/.claude/codemie-budget-status.js and ~/.claude/settings.json statusLine.command is set to run it. Confirm the budget shows (e.g. $15.78/$150 (11%)).
2. Upgrade @codemieai/code to a version that (a) reads the statusline from plugin/codemie-statusline.mjs and (b) stores SSO credentials with AES-256-GCM.
3. Start codemie-claude again. Observe the startup complaint about a non-existing file …/plugin/codemie-statusline.mjs.
4. Observe the status line now shows ⚠ Reauthenticate and stays that way regardless of re-authentication.

Expected Behavior

After an upgrade, the status line keeps working: the current statusline script is deployed and actually run, and it can decrypt the current credential format to show the budget.

Actual Behavior

Status line is stuck on ⚠ Reauthenticate indefinitely. Three distinct defects combine:

1. Shipped-file / filename mismatch (forces a manual cp on every upgrade)

• dist/agents/plugins/claude/claude.plugin.js:172-184 (when CODEMIE_STATUS=1) reads the statusline from plugin/codemie-statusline.mjs and writes it to ~/.claude/codemie-statusline.mjs.
• The package only ships dist/agents/plugins/claude/plugin/statusline.mjs — there is no codemie-statusline.mjs. So readFile throws on startup ("non-existing file … codemie-statusline.mjs"), aborting statusline setup.
• Workaround users are forced into: cp .../plugin/statusline.mjs .../plugin/codemie-statusline.mjs after every upgrade.
• Fix: have the build emit codemie-statusline.mjs (or make the code read statusline.mjs) so the names agree.

2. Installer never upgrades an existing statusLine command

• The statusLine setting is injected into ~/.claude/settings.json only "if not already configured".
• An older build deployed the script as ~/.claude/codemie-budget-status.js and pointed settings.json there. After upgrading, settings.json still points at the old codemie-budget-status.js, which is never refreshed — so a stale script keeps running indefinitely even once codemie-statusline.mjs is correctly deployed.
• Fix: on install/upgrade, detect a codemie-managed statusLine.command and migrate it to the current script path/name (e.g. rewrite an old codemie-budget-status.js reference to codemie-statusline.mjs).

3. Credential format changed (CBC → GCM); stale statusline can't read it and the failure is misleading

• Newer runtime encrypts SSO credentials with AES-256-GCM as iv:authTag:ciphertext (3 colon-separated parts) — dist/utils/security.js encrypt().
• The old deployed statusline's decrypt() is CBC-only: it does const [ivHex, encHex] = text.split(':') and aes-256-cbc, so it throws on the 3-part GCM blob (12-byte GCM IV is invalid for CBC / parts[1] is the auth tag, not ciphertext).
• readCredsFile() swallows the error → getAuthHeaders() returns null → statusline renders ⚠ Reauthenticate, even though credentials are valid and re-auth cannot help.
• Fix: (a) fixing Add GitHub Actions workflow for NPM publishing #1/feat: Add Release Manager agent and CI/CD automation #2 resolves this for upgraders; (b) additionally, the statusline should not collapse a decrypt failure into Reauthenticate — surface the real reason and/or fall back to the last cached budget value instead of discarding it.

Impact

Budget/spend display is permanently broken after upgrade. Users re-authenticate repeatedly to no effect. The only working fix is manual: cp the missing file and manually repoint settings.json from codemie-budget-status.js to codemie-statusline.mjs.

Environment

Field	Value
OS	Linux 6.6.87.2-microsoft-standard-WSL2 x86_64 (WSL2)
Node.js	v24.14.1
npm	11.11.0
CodeMie CLI	0.9.0 (@codemieai/code@0.9.0)
Shell	/bin/bash
Invoked via	codemie-claude / Claude Code statusLine

Suggested references (for maintainers)

• dist/agents/plugins/claude/claude.plugin.js:172-184 — statusline deploy + settings.json injection ("if not already configured")
• dist/agents/plugins/claude/plugin/statusline.mjs — shipped source (correct name); GCM-capable decrypt()
• dist/utils/security.js encrypt() — GCM writer (iv:authTag:ciphertext)