feat(consent): local source discovery + per-source opt-in (task 002)

crates/adapters/Cargo.toml

@@ -12,6 +12,9 @@ serde_json = { workspace = true }
 # rustls keeps TLS portable (no OpenSSL/native-tls) across mac/win/linux.
 reqwest = { version = "0.12", default-features = false, features = ["rustls-tls"] }
 dirs = "5"
+# In-process Mutex for the consent cache. parking_lot (already in the tree via tauri) gives
+# poison-free guards, so lock sites read as locking, not error handling.
+parking_lot = "0.12"
 
 # OS keychain for OUR secrets (refreshed tokens), per-OS backend so the workspace builds
 # cross-platform (incl. Linux/Windows CI). Runtime keychain access is only exercised by the

crates/adapters/src/claude.rs

@@ -3,6 +3,7 @@
 //! Reuses the Claude Code CLI's existing OAuth login (ADR 0012, metadata-only discovery →
 //! per-source opt-in applies at the app layer). Order: the plain file first, then the macOS
 //! Keychain (which may prompt the user the first time).
+use std::path::{Path, PathBuf};
 use std::sync::Arc;
 
 use async_trait::async_trait;
@@ -18,6 +19,33 @@ use crate::{KeyringSecretStore, ReqwestHttp, SystemClock, KEYCHAIN_SERVICE};
 #[derive(Debug, Default, Clone, Copy)]
 pub struct ClaudeCredentials;
 
+impl ClaudeCredentials {
+    /// Metadata-only presence check (ADR 0012): does a Claude Code login *exist* on this
+    /// machine? Checks the credentials file's existence and the Keychain item's presence — it
+    /// never opens, decrypts, or parses the token. This is the discovery path: the secret is
+    /// only read later via [`OAuthCredentialSource::load`], after the user opts the source in.
+    pub fn is_present() -> bool {
+        file_present() || keychain_present()
+    }
+}
+
+/// Claude Code's plaintext credentials file under a given home dir. Split out so presence can
+/// be unit-tested against a temp home without reading anything.
+fn credentials_path(home: &Path) -> PathBuf {
+    home.join(".claude/.credentials.json")
+}
+
+/// Does the credentials file *exist*? `is_file` is a stat — it never opens the file, so even a
+/// present-but-garbage file counts as "a login exists here", which is exactly what proves
+/// discovery is decoupled from reading the secret.
+fn path_present(home: &Path) -> bool {
+    credentials_path(home).is_file()
+}
+
+fn file_present() -> bool {
+    dirs::home_dir().map(|h| path_present(&h)).unwrap_or(false)
+}
+
 #[async_trait]
 impl OAuthCredentialSource for ClaudeCredentials {
     async fn load(&self) -> Result<OAuthTokens, PortError> {
@@ -111,6 +139,24 @@ fn read_keychain() -> Option<String> {
     None
 }
 
+/// Does the macOS Keychain hold Claude Code's credential item? Runs `find-generic-password`
+/// **without `-w`**, so it returns only the item's attributes (exit 0 if present) and never the
+/// password — presence only, no secret read (ADR 0012). Contrast [`read_keychain`], which
+/// passes `-w` to read the token and runs only on the consented `load` path.
+#[cfg(target_os = "macos")]
+fn keychain_present() -> bool {
+    std::process::Command::new("/usr/bin/security")
+        .args(["find-generic-password", "-s", "Claude Code-credentials"])
+        .output()
+        .map(|o| o.status.success())
+        .unwrap_or(false)
+}
+
+#[cfg(not(target_os = "macos"))]
+fn keychain_present() -> bool {
+    false
+}
+
 /// Best-effort detection of the installed Claude Code CLI version for the required
 /// `User-Agent: claude-code/<version>` header (without it, the endpoint 429s hard).
 pub fn detect_user_agent() -> String {
@@ -168,4 +214,29 @@ mod tests {
     fn detect_user_agent_has_the_claude_code_prefix() {
         assert!(detect_user_agent().starts_with("claude-code/"));
     }
+
+    #[test]
+    fn presence_is_metadata_only_and_never_reads_the_secret() {
+        let base = std::env::temp_dir().join(format!("mlt-presence-test-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&base);
+
+        // No credentials file ⇒ not present.
+        assert!(
+            !path_present(&base),
+            "absent credentials file ⇒ not present"
+        );
+
+        std::fs::create_dir_all(base.join(".claude")).unwrap();
+        // Deliberately INVALID content: discovery reports "present" from existence alone,
+        // while the real secret path (`parse_creds`) rejects it — proof the probe never reads
+        // or parses the credential it discovered.
+        std::fs::write(credentials_path(&base), "not a real credential").unwrap();
+        assert!(path_present(&base), "existing file ⇒ present (stat only)");
+        assert!(
+            parse_creds("not a real credential").is_err(),
+            "the secret-reading path would reject this content"
+        );
+
+        let _ = std::fs::remove_dir_all(&base);
+    }
 }

crates/adapters/src/consent.rs

@@ -0,0 +1,149 @@
+//! File-backed [`ConsentStore`]: the user's per-source opt-in, persisted as a small JSON map
+//! (`{ "<source-id>": true }`) in the app config dir. Consent is **not** a secret, so it lives
+//! here as plain settings — never in the keychain (ADR 0012). A missing entry means the source
+//! is **disabled**, so on a fresh install nothing is read until the user opts in.
+use std::collections::BTreeMap;
+use std::path::PathBuf;
+
+use parking_lot::Mutex;
+
+use mlt_core::domain::ProviderId;
+use mlt_core::ports::{ConsentStore, PortError};
+
+/// In-memory consent map with write-through to a JSON file. The map is the source of truth at
+/// runtime (so reads on the refresh hot path never touch disk); every change is persisted so
+/// the choice survives a restart.
+#[derive(Debug)]
+pub struct FileConsentStore {
+    path: PathBuf,
+    state: Mutex<BTreeMap<String, bool>>,
+}
+
+impl FileConsentStore {
+    /// Load consent from `path`. Best-effort: a missing or unparseable file starts empty
+    /// (every source opted-out), so a corrupt settings file can never accidentally enable a
+    /// source — it fails closed.
+    pub fn load(path: PathBuf) -> Self {
+        let state = std::fs::read_to_string(&path)
+            .ok()
+            .and_then(|raw| serde_json::from_str::<BTreeMap<String, bool>>(&raw).ok())
+            .unwrap_or_default();
+        Self {
+            path,
+            state: Mutex::new(state),
+        }
+    }
+
+    fn persist(&self, map: &BTreeMap<String, bool>) -> Result<(), PortError> {
+        if let Some(parent) = self.path.parent() {
+            std::fs::create_dir_all(parent).map_err(|e| PortError::Io(e.to_string()))?;
+        }
+        let json = serde_json::to_string_pretty(map).map_err(|e| PortError::Io(e.to_string()))?;
+        std::fs::write(&self.path, json).map_err(|e| PortError::Io(e.to_string()))
+    }
+}
+
+impl ConsentStore for FileConsentStore {
+    fn is_enabled(&self, id: &ProviderId) -> Result<bool, PortError> {
+        Ok(self.state.lock().get(id.as_str()).copied().unwrap_or(false))
+    }
+
+    fn set_enabled(&self, id: &ProviderId, enabled: bool) -> Result<(), PortError> {
+        let mut map = self.state.lock();
+        let previous = map.insert(id.as_str().to_string(), enabled);
+        if let Err(e) = self.persist(&map) {
+            // Persist failed — undo the in-memory change so runtime consent never diverges
+            // from disk. Fail closed: a source is only ever treated as opted-in once that
+            // choice has been durably recorded.
+            match previous {
+                Some(prev) => {
+                    map.insert(id.as_str().to_string(), prev);
+                }
+                None => {
+                    map.remove(id.as_str());
+                }
+            }
+            return Err(e);
+        }
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn temp_path(tag: &str) -> PathBuf {
+        std::env::temp_dir().join(format!(
+            "mlt-consent-test-{}-{tag}/consent.json",
+            std::process::id()
+        ))
+    }
+
+    #[test]
+    fn unknown_source_defaults_to_disabled() {
+        let store = FileConsentStore::load(temp_path("default"));
+        assert!(!store.is_enabled(&ProviderId::new("claude-code")).unwrap());
+    }
+
+    #[test]
+    fn opt_in_persists_across_a_reload() {
+        let path = temp_path("persist");
+        let _ = std::fs::remove_dir_all(path.parent().unwrap());
+        let id = ProviderId::new("claude-code");
+
+        let store = FileConsentStore::load(path.clone());
+        store.set_enabled(&id, true).unwrap();
+        // A fresh instance reading the same file (i.e. an app restart) still sees the opt-in.
+        let reloaded = FileConsentStore::load(path.clone());
+        assert!(
+            reloaded.is_enabled(&id).unwrap(),
+            "consent survives restart"
+        );
+
+        // Opting back out is likewise persisted.
+        reloaded.set_enabled(&id, false).unwrap();
+        assert!(!FileConsentStore::load(path.clone())
+            .is_enabled(&id)
+            .unwrap());
+
+        let _ = std::fs::remove_dir_all(path.parent().unwrap());
+    }
+
+    #[test]
+    fn per_source_toggles_are_independent() {
+        let path = temp_path("independent");
+        let _ = std::fs::remove_dir_all(path.parent().unwrap());
+        let store = FileConsentStore::load(path.clone());
+
+        store.set_enabled(&ProviderId::new("a"), true).unwrap();
+        store.set_enabled(&ProviderId::new("b"), false).unwrap();
+        assert!(store.is_enabled(&ProviderId::new("a")).unwrap());
+        assert!(!store.is_enabled(&ProviderId::new("b")).unwrap());
+
+        let _ = std::fs::remove_dir_all(path.parent().unwrap());
+    }
+
+    #[test]
+    fn failed_persist_leaves_runtime_consent_unchanged() {
+        let dir = std::env::temp_dir().join(format!(
+            "mlt-consent-test-{}-failclosed",
+            std::process::id()
+        ));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        // Put a *file* where the consent dir's parent should be, so `create_dir_all` (and
+        // therefore `persist`) fails deterministically — no real disk fault needed.
+        let blocker = dir.join("blocker");
+        std::fs::write(&blocker, "x").unwrap();
+        let store = FileConsentStore::load(blocker.join("consent.json"));
+        let id = ProviderId::new("claude-code");
+
+        assert!(store.set_enabled(&id, true).is_err(), "persist must fail");
+        // The opt-in must NOT have taken effect in memory: disk and runtime stay in lockstep,
+        // so a source is never read on the strength of a write that never landed.
+        assert!(!store.is_enabled(&id).unwrap());
+
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}

crates/adapters/src/lib.rs

@@ -6,13 +6,17 @@
 
 pub mod claude;
 pub mod clock;
+pub mod consent;
 pub mod http;
 pub mod secrets;
+pub mod sources;
 
 pub use claude::{claude_strategy, detect_user_agent, ClaudeCredentials};
 pub use clock::SystemClock;
+pub use consent::FileConsentStore;
 pub use http::ReqwestHttp;
 pub use secrets::KeyringSecretStore;
+pub use sources::LocalSourceProbe;
 
 /// Keychain service name under which MLT stores its own secrets.
 pub const KEYCHAIN_SERVICE: &str = "com.bigshotpictures.mlt";

crates/adapters/src/sources.rs

@@ -0,0 +1,36 @@
+//! [`SourceProbe`] implementation: metadata-only discovery of local sources (ADR 0012).
+//!
+//! Dispatches a source id to its presence check. Every branch decides presence from existence
+//! alone (a credentials file, a Keychain item) and never reads a secret — the per-source
+//! checks live with their credential adapter (e.g. [`crate::claude::ClaudeCredentials::is_present`]).
+use async_trait::async_trait;
+
+use mlt_core::domain::ProviderId;
+use mlt_core::ports::SourceProbe;
+
+use crate::claude::ClaudeCredentials;
+
+/// Probes the real machine for each known source. Unknown ids report absent rather than
+/// erroring, so the catalog can list a source before its probe exists.
+#[derive(Debug, Default, Clone, Copy)]
+pub struct LocalSourceProbe;
+
+#[async_trait]
+impl SourceProbe for LocalSourceProbe {
+    async fn is_present(&self, id: &ProviderId) -> bool {
+        match id.as_str() {
+            "claude-code" => ClaudeCredentials::is_present(),
+            _ => false,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn unknown_source_is_absent() {
+        assert!(!LocalSourceProbe.is_present(&ProviderId::new("nope")).await);
+    }
+}

crates/core/src/lib.rs

@@ -8,7 +8,9 @@
 pub mod domain;
 pub mod ports;
 pub mod providers;
+pub mod sources;
 
 pub use domain::*;
 pub use ports::*;
 pub use providers::*;
+pub use sources::*;

crates/core/src/ports.rs

@@ -46,6 +46,23 @@ pub trait OAuthCredentialSource: Send + Sync {
     async fn load(&self) -> Result<OAuthTokens, PortError>;
 }
 
+/// Metadata-only presence detection for a discoverable local source (ADR 0012). An
+/// implementation MUST decide presence from **existence alone** — a credentials file on
+/// disk, a Keychain item being present — and MUST NOT read, decrypt, or parse any secret.
+/// Returning `true` means "a login for this source exists here", never that it was read.
+#[async_trait]
+pub trait SourceProbe: Send + Sync {
+    async fn is_present(&self, id: &ProviderId) -> bool;
+}
+
+/// Persists the user's per-source opt-in. Consent is **not** a secret, so it lives here —
+/// a plain settings store — never in the keychain (ADR 0012). A source with no stored
+/// entry is treated as **disabled**: nothing is read until the user explicitly opts in.
+pub trait ConsentStore: Send + Sync {
+    fn is_enabled(&self, id: &ProviderId) -> Result<bool, PortError>;
+    fn set_enabled(&self, id: &ProviderId, enabled: bool) -> Result<(), PortError>;
+}
+
 #[async_trait]
 pub trait UsageRepo: Send + Sync {
     async fn save(&self, snapshot: &UsageSnapshot) -> Result<(), PortError>;