@camerontaylor/paseo-server 0.11.0-beta.1.fork.1 → 0.11.0-beta.3.fork.1

package/dist/server/builtin-plugins/claude-usage-source/index.server.ts

@@ -1,6 +1,6 @@
 import type { PluginServerContext } from "@camerontaylor/paseo-plugin/server";
 import { inputSchema } from "./shared/input.js";
-import { fetchUsage, identify } from "./server/usage.js";
+import { discover, fetchUsage } from "./server/usage.js";
 
 export default function contribute(server: PluginServerContext) {
   server.registerUsageSource({
@@ -8,8 +8,7 @@ export default function contribute(server: PluginServerContext) {
     label: "Claude",
     icon: "icon.svg",
     input: inputSchema,
-    discover: async () => [{}],
-    identify,
+    discover: () => discover(),
     fetch: fetchUsage,
   });
   return () => {};

package/dist/server/builtin-plugins/claude-usage-source/server/stores.ts

@@ -0,0 +1,131 @@
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { z } from "zod";
+import { routeSchema } from "../shared/input.js";
+
+export interface StoreLookup {
+  home?: string;
+  env?: NodeJS.ProcessEnv;
+  platform?: NodeJS.Platform;
+  now?: () => number;
+  sqlite?: () => Sqlite | undefined;
+}
+interface Database {
+  prepare(sql: string): { all(...args: string[]): unknown[] };
+  close(): void;
+}
+export interface Sqlite {
+  DatabaseSync: new (path: string, options: { readOnly: boolean }) => Database;
+}
+export const oauthSchema = z.object({
+  access: z.string().min(1),
+  accountId: z.string().optional(),
+  expires: z.number().optional(),
+});
+const rowSchema = z.object({ id: z.number().int().positive(), data: z.string() });
+export type Route = z.infer<typeof routeSchema>;
+
+export async function readJson(path: string): Promise<unknown> {
+  try {
+    return JSON.parse(await readFile(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+export function piAuthPath(lookup: StoreLookup): string {
+  const home = lookup.home ?? homedir();
+  const env = lookup.env ?? process.env;
+  const configured = env.PI_CODING_AGENT_DIR?.trim();
+  if (!configured) return join(home, ".pi", "agent", "auth.json");
+  if (configured === "~") return join(home, "auth.json");
+  const directory = configured.startsWith("~/")
+    ? join(home, configured.slice(2))
+    : resolve(configured);
+  return join(directory, "auth.json");
+}
+
+function ompDatabasePath(lookup: StoreLookup): string {
+  const home = lookup.home ?? homedir();
+  const env = lookup.env ?? process.env;
+  const platform = lookup.platform ?? process.platform;
+  const profile = (env.OMP_PROFILE ?? env.PI_PROFILE)?.trim() || "default";
+  const base = join(home, env.PI_CONFIG_DIR || ".omp");
+  const configRoot = profile === "default" ? base : join(base, "profiles", profile);
+  const defaultAgentDir = join(configRoot, "agent");
+  const agentDir =
+    profile === "default" && env.PI_CODING_AGENT_DIR
+      ? resolve(env.PI_CODING_AGENT_DIR)
+      : defaultAgentDir;
+  if (
+    (platform === "linux" || platform === "darwin") &&
+    agentDir === defaultAgentDir &&
+    env.XDG_DATA_HOME
+  ) {
+    const xdgBase = join(env.XDG_DATA_HOME, "omp");
+    const xdgRoot = profile === "default" ? xdgBase : join(xdgBase, "profiles", profile);
+    if (existsSync(xdgRoot)) return join(xdgRoot, "agent.db");
+  }
+  return join(agentDir, "agent.db");
+}
+
+function builtinSqlite(): Sqlite | undefined {
+  // Node 20 must still compile/load the plugin; only OMP needs this newer builtin.
+  const parsed = z
+    .object({
+      DatabaseSync: z.custom<Sqlite["DatabaseSync"]>((value) => typeof value === "function"),
+    })
+    .safeParse(process.getBuiltinModule?.("node:sqlite"));
+  return parsed.success ? parsed.data : undefined;
+}
+
+function ompRows(path: string, lookup: StoreLookup) {
+  let db: Database | undefined;
+  try {
+    const sqlite = (lookup.sqlite ?? builtinSqlite)();
+    if (!sqlite) return [];
+    db = new sqlite.DatabaseSync(path, { readOnly: true });
+    const rows = db
+      .prepare(
+        "SELECT id, data FROM auth_credentials WHERE provider = ? AND credential_type = 'oauth' AND disabled_cause IS NULL ORDER BY id",
+      )
+      .all("anthropic");
+    return rows.flatMap((value) => {
+      const row = rowSchema.safeParse(value);
+      if (!row.success) return [];
+      try {
+        const oauth = oauthSchema.parse(JSON.parse(row.data.data));
+        return [{ id: row.data.id, oauth }];
+      } catch {
+        return [];
+      }
+    });
+  } catch {
+    return [];
+  } finally {
+    db?.close();
+  }
+}
+
+export function discoverOmp(lookup: StoreLookup): Route[] {
+  const path = ompDatabasePath(lookup);
+  return ompRows(path, lookup).map(({ id }) => ({ store: "omp", path, credentialId: id }));
+}
+
+export function readOmp(route: Extract<Route, { store: "omp" }>, lookup: StoreLookup) {
+  return ompRows(route.path, lookup).find((row) => row.id === route.credentialId)?.oauth ?? null;
+}
+
+export async function readHarness(
+  route: Extract<Route, { path: string }>,
+  lookup: StoreLookup = {},
+) {
+  if (route.store === "omp") return readOmp(route, lookup);
+  const provider = "anthropic";
+  const parsed = z.record(z.string(), z.unknown()).safeParse(await readJson(route.path));
+  if (!parsed.success) return null;
+  const oauth = oauthSchema.extend({ type: z.literal("oauth") }).safeParse(parsed.data[provider]);
+  return oauth.success ? oauth.data : null;
+}

package/dist/server/builtin-plugins/claude-usage-source/server/usage.ts

@@ -1,3 +1,4 @@
+import { discoverOmp, piAuthPath, readHarness, type StoreLookup } from "./stores.js";
 import type { UsageInput } from "../shared/input.js";
 import { execFile } from "node:child_process";
 import { existsSync, promises as fs } from "node:fs";
@@ -8,7 +9,8 @@ import { z } from "zod";
 import {
   hashAccountKey,
   toneFromUsedPct,
-  unavailableUsage,
+  unavailable,
+  type UsageAccount,
   windowFromUsedPct,
   type UsageReport,
   type UsageWindow,
@@ -26,6 +28,7 @@ const ClaudeCredentialsSchema = z.object({
   claudeAiOauth: z
     .object({
       accessToken: z.string().optional(),
+      expiresAt: z.number().optional(),
       refreshToken: z.string().optional(),
       subscriptionType: z.string().optional(),
       rateLimitTier: z.string().optional(),
@@ -74,13 +77,8 @@ type ClaudeLimit = z.infer<typeof ClaudeLimitSchema>;
 
 const SCOPED_WEEKLY_KIND = "weekly_scoped";
 
-// A 403 is not a stale token, so refreshing cannot clear it, and refreshing anyway rewrites
-// the credentials on every poll. What causes the refusal is not visible from here, so the
-// message names the refusal rather than guessing at a reason.
-const CLAUDE_USAGE_FORBIDDEN_MESSAGE =
-  "Usage request was refused (HTTP 403). Check the daemon's network access to api.anthropic.com.";
-
 interface ClaudeCredentialRecord {
+  expires?: number;
   oauth: { accessToken: string } & NonNullable<ClaudeCredentials["claudeAiOauth"]>;
 }
 
@@ -338,27 +336,24 @@ export async function readClaudeKeychainCredentials(
   return null;
 }
 
-interface ClaudeCredentialLookup {
-  platform?: NodeJS.Platform;
+interface ClaudeCredentialLookup extends StoreLookup {
   readKeychainCredentials?: () => Promise<unknown | null>;
   claudeHome?: string;
-  accountHome?: string;
 }
 
-/** Shared credential lookup for usage fetches and account identification. */
-export async function resolveClaudeCredentials(
-  input: UsageInput,
-  lookup: ClaudeCredentialLookup = {},
-): Promise<ClaudeCredentialRecord | null> {
-  if ("providerId" in input)
-    return input.configDir ? readCredentialFile(join(input.configDir, ".credentials.json")) : null;
+type RoutedInput = Extract<UsageInput, { route: unknown }>;
+
+function claudeCredentialPath(lookup: ClaudeCredentialLookup): string {
+  const home = lookup.home ?? homedir();
+  const env = lookup.env ?? process.env;
   const claudeHome =
-    lookup.claudeHome ??
-    process.env["CLAUDE_CONFIG_DIR"] ??
-    process.env["CLAUDE_HOME"] ??
-    join(homedir(), ".claude");
-  const fileCredentials = await readCredentialFile(join(claudeHome, ".credentials.json"));
-  if (fileCredentials) return fileCredentials;
+    lookup.claudeHome ?? env.CLAUDE_CONFIG_DIR ?? env.CLAUDE_HOME ?? join(home, ".claude");
+  return join(claudeHome, ".credentials.json");
+}
+
+async function keychainCredentialRecord(
+  lookup: ClaudeCredentialLookup,
+): Promise<ClaudeCredentialRecord | null> {
   if ((lookup.platform ?? process.platform) !== "darwin") return null;
   const parsed = ClaudeCredentialsSchema.safeParse(
     await (lookup.readKeychainCredentials ?? readClaudeKeychainCredentials)(),
@@ -366,6 +361,61 @@ export async function resolveClaudeCredentials(
   return parsed.success ? toCredentialRecord(parsed.data) : null;
 }
 
+export async function discover(
+  lookup: ClaudeCredentialLookup = {},
+  fetchApi: typeof fetch = fetch,
+): Promise<UsageAccount[]> {
+  // Claude Code only reads the file when its Keychain login is empty.
+  const primary: RoutedInput = (await keychainCredentialRecord(lookup))
+    ? { route: { store: "keychain" } }
+    : { route: { store: "claude", path: claudeCredentialPath(lookup) } };
+  const candidates: RoutedInput[] = [
+    primary,
+    { route: { store: "pi", path: piAuthPath(lookup) } },
+    ...discoverOmp(lookup).map((route) => ({ route })),
+  ];
+  const accounts: UsageAccount[] = [];
+  for (const input of candidates) {
+    const credentials = await resolveClaudeCredentials(input, lookup);
+    if (!credentials) continue;
+    const fallback = { key: hashAccountKey(JSON.stringify(input.route)), input };
+    if (credentials.expires !== undefined && credentials.expires <= (lookup.now ?? Date.now)()) {
+      accounts.push(fallback);
+      continue;
+    }
+    try {
+      const profile = await readProfile(
+        credentials.oauth.accessToken,
+        fetchApi,
+        lookup.now ?? Date.now,
+      );
+      accounts.push("status" in profile ? fallback : { ...profile, input });
+    } catch {
+      // Keep the login visible; fetching usage reports the vendor failure.
+      accounts.push(fallback);
+    }
+  }
+  return accounts;
+}
+
+/** Re-read the selected login; the harness owns token refresh. */
+export async function resolveClaudeCredentials(
+  input: UsageInput | Record<string, never>,
+  lookup: ClaudeCredentialLookup = {},
+): Promise<ClaudeCredentialRecord | null> {
+  if ("providerId" in input)
+    return input.configDir ? readCredentialFile(join(input.configDir, ".credentials.json")) : null;
+  if (!("route" in input)) {
+    const primary = await keychainCredentialRecord(lookup);
+    return primary ?? readCredentialFile(claudeCredentialPath(lookup));
+  }
+  const route = input.route;
+  if (route.store === "claude") return readCredentialFile(route.path);
+  if (route.store === "keychain") return keychainCredentialRecord(lookup);
+  const oauth = await readHarness(route, lookup);
+  return oauth ? { oauth: { accessToken: oauth.access }, expires: oauth.expires } : null;
+}
+
 async function readCredentialFile(path: string): Promise<ClaudeCredentialRecord | null> {
   if (!existsSync(path)) return null;
   try {
@@ -379,7 +429,9 @@ async function readCredentialFile(path: string): Promise<ClaudeCredentialRecord
 
 function toCredentialRecord(credentials: ClaudeCredentials): ClaudeCredentialRecord | null {
   const oauth = credentials.claudeAiOauth;
-  return oauth?.accessToken ? { oauth: { ...oauth, accessToken: oauth.accessToken } } : null;
+  return oauth?.accessToken
+    ? { oauth: { ...oauth, accessToken: oauth.accessToken }, expires: oauth.expiresAt }
+    : null;
 }
 
 export async function fetchUsage(
@@ -415,9 +467,7 @@ export async function fetchUsage(
     return parsed;
   }
 
-  async function callClaudeApi(
-    token: string,
-  ): Promise<ClaudeUsageResponse | "NEEDS_AUTH" | "FORBIDDEN"> {
+  async function callClaudeApi(token: string): Promise<ClaudeUsageResponse | number> {
     const res = await fetchApi("https://api.anthropic.com/api/oauth/usage", {
       signal: AbortSignal.timeout(15_000),
       headers: {
@@ -426,29 +476,38 @@ export async function fetchUsage(
         "anthropic-beta": CLAUDE_OAUTH_BETA,
       },
     });
-    if (res.status === 401) return "NEEDS_AUTH";
-    if (res.status === 403) return "FORBIDDEN";
+    if (res.status === 401 || res.status === 403) return res.status;
     if (!res.ok) throw new Error(`Claude usage API returned ${res.status}`);
     return ClaudeUsageResponseSchema.parse(await res.json());
   }
 
   const credentials = await resolveClaudeCredentials(input, credentialLookup);
-  if (!credentials) {
-    return unavailableUsage();
-  }
+  if (!credentials) throw new Error("Claude login store no longer exists");
+  const refreshedBy =
+    !("route" in input) || input.route.store === "claude" || input.route.store === "keychain"
+      ? "claude"
+      : input.route.store;
+  if (
+    credentials.expires !== undefined &&
+    credentials.expires <= (credentialLookup.now ?? Date.now)()
+  )
+    return unavailable({
+      kind: "expired",
+      expiresAt: new Date(credentials.expires).toISOString(),
+      refreshedBy,
+    });
+  const profile = await cachedProfile(
+    credentials.oauth.accessToken,
+    (credentialLookup.now ?? Date.now)(),
+  );
+  if (profile && "status" in profile)
+    return unavailable({ kind: "rejected", status: profile.status, refreshedBy });
 
   const { oauth } = credentials;
   const plan = buildClaudePlan(oauth.subscriptionType, oauth.rateLimitTier);
   const resp = await callClaudeApi(oauth.accessToken);
 
-  if (resp === "FORBIDDEN") {
-    return { ...unavailableUsage(), error: CLAUDE_USAGE_FORBIDDEN_MESSAGE };
-  }
-
-  if (resp === "NEEDS_AUTH") {
-    // Read-only on credentials; the Claude CLI owns refresh. See docs/providers.md.
-    return unavailableUsage();
-  }
+  if (typeof resp === "number") return unavailable({ kind: "rejected", status: resp, refreshedBy });
 
   const scoped = reconcileScopedLimits(
     legacyScopedLimits(resp),
@@ -483,45 +542,27 @@ export async function fetchUsage(
 }
 
 // The OAuth usage endpoint meters the active organization selected by the token.
-const ClaudeAccountSchema = z.object({
-  accountUuid: z.string().min(1),
-  organizationUuid: z.string().min(1),
-  emailAddress: z.string().optional(),
-});
-type ClaudeIdentity = { key: string; label?: string } | null;
+type ClaudeIdentity = { key: string; label?: string } | { status: number };
 const PROFILE_TTL_MS = 300_000;
 const PROFILE_CACHE_LIMIT = 128;
 const profileCache = new Map<string, { at: number; result: Promise<ClaudeIdentity> }>();
 
+function cachedProfile(token: string, now: number): Promise<ClaudeIdentity> | undefined {
+  pruneProfileCache(now);
+  return profileCache.get(hashAccountKey(token))?.result;
+}
+
 function pruneProfileCache(now: number): void {
   for (const [key, entry] of profileCache) {
     if (now - entry.at >= PROFILE_TTL_MS) profileCache.delete(key);
   }
 }
 
-export async function identify(
-  input: UsageInput,
-  fetchApi: typeof fetch = fetch,
-  now: () => number = Date.now,
-  credentialLookup: ClaudeCredentialLookup = {},
-) {
-  if ("providerId" in input) return { key: `provider.${input.providerId}`, label: input.label };
-  const directory = credentialLookup.accountHome ?? homedir();
-  try {
-    const config = z
-      .object({ oauthAccount: ClaudeAccountSchema })
-      .parse(JSON.parse(await fs.readFile(join(directory, ".claude.json"), "utf8")));
-    const account = config.oauthAccount;
-    return {
-      key: `${account.accountUuid}.${account.organizationUuid}`,
-      ...(account.emailAddress ? { label: account.emailAddress } : {}),
-    };
-  } catch {
-    // Credentials may still be present even when account metadata is absent.
-  }
-  const credentials = await resolveClaudeCredentials(input, credentialLookup);
-  if (!credentials) return null;
-  const token = credentials.oauth.accessToken;
+async function readProfile(
+  token: string,
+  fetchApi: typeof fetch,
+  now: () => number,
+): Promise<ClaudeIdentity> {
   const tokenHash = hashAccountKey(token);
   pruneProfileCache(now());
   const pending = profileCache.get(tokenHash);
@@ -540,7 +581,7 @@ export async function identify(
         "anthropic-beta": CLAUDE_OAUTH_BETA,
       },
     });
-    if (response.status === 401 || response.status === 403) return null;
+    if (response.status === 401 || response.status === 403) return { status: response.status };
     if (!response.ok) throw new Error(`Claude profile API returned ${response.status}`);
     const profile = z
       .object({
@@ -562,3 +603,15 @@ export async function identify(
     throw error;
   }
 }
+
+export async function identify(
+  input: UsageInput | Record<string, never>,
+  fetchApi: typeof fetch = fetch,
+  now: () => number = Date.now,
+  credentialLookup: ClaudeCredentialLookup = {},
+) {
+  if ("providerId" in input) return { key: `provider.${input.providerId}`, label: input.label };
+  const credentials = await resolveClaudeCredentials(input, credentialLookup);
+  if (!credentials) return null;
+  return readProfile(credentials.oauth.accessToken, fetchApi, now);
+}

package/dist/server/builtin-plugins/claude-usage-source/shared/input.ts

@@ -1,6 +1,18 @@
 import { z } from "zod";
+
+export const routeSchema = z.discriminatedUnion("store", [
+  z.object({ store: z.enum(["claude", "pi"]), path: z.string().min(1) }).strict(),
+  z
+    .object({
+      store: z.literal("omp"),
+      path: z.string().min(1),
+      credentialId: z.number().int().positive(),
+    })
+    .strict(),
+  z.object({ store: z.literal("keychain") }).strict(),
+]);
 export const inputSchema = z.union([
-  z.strictObject({}),
+  z.object({ route: routeSchema }).strict(),
   z.strictObject({
     providerId: z.string().min(1),
     label: z.string(),

package/dist/server/builtin-plugins/codex-usage-source/index.server.ts

@@ -1,6 +1,6 @@
 import type { PluginServerContext } from "@camerontaylor/paseo-plugin/server";
 import { inputSchema } from "./shared/input.js";
-import { fetchUsage, identify } from "./server/usage.js";
+import { discover, fetchUsage } from "./server/usage.js";
 
 export default function contribute(server: PluginServerContext) {
   server.registerUsageSource({
@@ -8,8 +8,7 @@ export default function contribute(server: PluginServerContext) {
     label: "Codex",
     icon: "icon.svg",
     input: inputSchema,
-    discover: async () => [{}],
-    identify,
+    discover: () => discover(),
     fetch: fetchUsage,
   });
   return () => {};

package/dist/server/builtin-plugins/codex-usage-source/server/stores.ts

@@ -0,0 +1,131 @@
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { z } from "zod";
+import { routeSchema } from "../shared/input.js";
+
+export interface StoreLookup {
+  home?: string;
+  env?: NodeJS.ProcessEnv;
+  platform?: NodeJS.Platform;
+  now?: () => number;
+  sqlite?: () => Sqlite | undefined;
+}
+interface Database {
+  prepare(sql: string): { all(...args: string[]): unknown[] };
+  close(): void;
+}
+export interface Sqlite {
+  DatabaseSync: new (path: string, options: { readOnly: boolean }) => Database;
+}
+export const oauthSchema = z.object({
+  access: z.string().min(1),
+  accountId: z.string().optional(),
+  expires: z.number().optional(),
+});
+const rowSchema = z.object({ id: z.number().int().positive(), data: z.string() });
+export type Route = z.infer<typeof routeSchema>;
+
+export async function readJson(path: string): Promise<unknown> {
+  try {
+    return JSON.parse(await readFile(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+export function piAuthPath(lookup: StoreLookup): string {
+  const home = lookup.home ?? homedir();
+  const env = lookup.env ?? process.env;
+  const configured = env.PI_CODING_AGENT_DIR?.trim();
+  if (!configured) return join(home, ".pi", "agent", "auth.json");
+  if (configured === "~") return join(home, "auth.json");
+  const directory = configured.startsWith("~/")
+    ? join(home, configured.slice(2))
+    : resolve(configured);
+  return join(directory, "auth.json");
+}
+
+function ompDatabasePath(lookup: StoreLookup): string {
+  const home = lookup.home ?? homedir();
+  const env = lookup.env ?? process.env;
+  const platform = lookup.platform ?? process.platform;
+  const profile = (env.OMP_PROFILE ?? env.PI_PROFILE)?.trim() || "default";
+  const base = join(home, env.PI_CONFIG_DIR || ".omp");
+  const configRoot = profile === "default" ? base : join(base, "profiles", profile);
+  const defaultAgentDir = join(configRoot, "agent");
+  const agentDir =
+    profile === "default" && env.PI_CODING_AGENT_DIR
+      ? resolve(env.PI_CODING_AGENT_DIR)
+      : defaultAgentDir;
+  if (
+    (platform === "linux" || platform === "darwin") &&
+    agentDir === defaultAgentDir &&
+    env.XDG_DATA_HOME
+  ) {
+    const xdgBase = join(env.XDG_DATA_HOME, "omp");
+    const xdgRoot = profile === "default" ? xdgBase : join(xdgBase, "profiles", profile);
+    if (existsSync(xdgRoot)) return join(xdgRoot, "agent.db");
+  }
+  return join(agentDir, "agent.db");
+}
+
+function builtinSqlite(): Sqlite | undefined {
+  // Node 20 must still compile/load the plugin; only OMP needs this newer builtin.
+  const parsed = z
+    .object({
+      DatabaseSync: z.custom<Sqlite["DatabaseSync"]>((value) => typeof value === "function"),
+    })
+    .safeParse(process.getBuiltinModule?.("node:sqlite"));
+  return parsed.success ? parsed.data : undefined;
+}
+
+function ompRows(path: string, lookup: StoreLookup) {
+  let db: Database | undefined;
+  try {
+    const sqlite = (lookup.sqlite ?? builtinSqlite)();
+    if (!sqlite) return [];
+    db = new sqlite.DatabaseSync(path, { readOnly: true });
+    const rows = db
+      .prepare(
+        "SELECT id, data FROM auth_credentials WHERE provider = ? AND credential_type = 'oauth' AND disabled_cause IS NULL ORDER BY id",
+      )
+      .all("openai-codex");
+    return rows.flatMap((value) => {
+      const row = rowSchema.safeParse(value);
+      if (!row.success) return [];
+      try {
+        const oauth = oauthSchema.parse(JSON.parse(row.data.data));
+        return [{ id: row.data.id, oauth }];
+      } catch {
+        return [];
+      }
+    });
+  } catch {
+    return [];
+  } finally {
+    db?.close();
+  }
+}
+
+export function discoverOmp(lookup: StoreLookup): Route[] {
+  const path = ompDatabasePath(lookup);
+  return ompRows(path, lookup).map(({ id }) => ({ store: "omp", path, credentialId: id }));
+}
+
+export function readOmp(route: Extract<Route, { store: "omp" }>, lookup: StoreLookup) {
+  return ompRows(route.path, lookup).find((row) => row.id === route.credentialId)?.oauth ?? null;
+}
+
+export async function readHarness(
+  route: Extract<Route, { path: string }>,
+  lookup: StoreLookup = {},
+) {
+  if (route.store === "omp") return readOmp(route, lookup);
+  const provider = route.store === "opencode" ? "openai" : "openai-codex";
+  const parsed = z.record(z.string(), z.unknown()).safeParse(await readJson(route.path));
+  if (!parsed.success) return null;
+  const oauth = oauthSchema.extend({ type: z.literal("oauth") }).safeParse(parsed.data[provider]);
+  return oauth.success ? oauth.data : null;
+}