@demicodes/provider-claude-code 0.10.2 → 0.10.3

package/README.md

@@ -5,38 +5,8 @@ and `listClaudeCodeModels()`.
 
 ```ts
 import { createClaudeCodeProvider, listClaudeCodeModels } from '@demicodes/provider-claude-code'
-
-const provider = createClaudeCodeProvider()
-// provider.auth, provider.quota, provider.credentials (multi-account pool by default)
 ```
 
-## Auth and credentials
-
-- Default material: `CLAUDE_CODE_OAUTH_TOKEN` or macOS Keychain (`Claude Code-credentials`).
-- Multi-credential pool under `$DEMI_HOME/credentials/claude-code/`; active token is
-  injected into the CLI child as `CLAUDE_CODE_OAUTH_TOKEN`.
-- Lifecycle: `beginLogin` → `claude auth login` → `importDefault` / `add` → `setActive`.
-- Changing active credential forces a cold restart of a long-lived CLI process.
-
-See [docs/provider-global-credentials.md](../../docs/provider-global-credentials.md).
-
-## Quota
-
-- **probe** (cost: `free`): `GET /api/oauth/usage` with the active OAuth token.
-- **observe**: stream-json `rate_limits` bodies (and unified rate-limit headers when present).
-
-See [docs/provider-quota.md](../../docs/provider-quota.md).
-
-## Tool-call batches
-
-Claude Code's SDK-MCP control channel can hold later `tools/call` callbacks until
-the preceding callback receives a result, even when the model emitted several
-`tool_use` blocks in one response. The provider preserves the model's original
-batch and tool-use IDs for the host scheduler, then matches the completed
-results to SDK-MCP callbacks as the CLI releases them.
-
-See [docs/tool-call-concurrency.md](../../docs/tool-call-concurrency.md).
-
 > Diagnostics: the transport writes a raw request/response wire log (including
 > prompts) to `$TMPDIR/demi-claude-wire` by default. Disable with
 > `DEMI_CLAUDE_WIRE_LOG=0`. See [SECURITY](../../SECURITY.md).

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { ModelPolicy, Provider, ProviderAuthState, ProviderCredentials, ProviderModelList, ProviderQuota, ProviderQuotaProbeResult } from "@demicodes/provider";
-import { FileCredentialPool } from "@demicodes/provider/credentials-pool";
+import { ModelPolicy, Provider, ProviderModelList, ProviderQuota, ProviderQuotaProbeResult } from "@demicodes/provider";
+
 //#region src/models.d.ts
 interface ClaudeCodeModelCatalogOptions {
   fetch?: ModelCatalogFetch;
@@ -10,74 +10,12 @@ interface ClaudeCodeModelCatalogOptions {
 type ModelCatalogFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
 declare function listClaudeCodeModels(options?: ClaudeCodeModelCatalogOptions): Promise<ProviderModelList>;
 //#endregion
-//#region src/oauth.d.ts
-/**
- * Where a resolved token came from. Callers that inject the token into a
- * spawned CLI must skip `keychain`: that token is the CLI's own short-lived
- * credential, and injecting it via CLAUDE_CODE_OAUTH_TOKEN disables the CLI's
- * refresh flow — the run starts 401ing as soon as the token expires. Owned
- * sources (static/file/env) are the caller's responsibility and inject as-is.
- */
-type ClaudeCodeOAuthSource = 'static' | 'file' | 'env' | 'keychain';
-interface ClaudeCodeOAuthAccess {
-  accessToken: string;
-  source: ClaudeCodeOAuthSource;
-  subscriptionType?: string | null;
-  rateLimitTier?: string | null;
-}
-/**
- * Resolve Claude Code consumer OAuth access for quota APIs.
- * Order: options env CLAUDE_CODE_OAUTH_TOKEN, then macOS Keychain "Claude Code-credentials".
- * Prefer injecting {@link ClaudeCodeAuthStore} when multi-credential is enabled.
- */
-declare function resolveClaudeCodeOAuthAccess(): Promise<ClaudeCodeOAuthAccess | null>;
-//#endregion
-//#region src/auth.d.ts
-interface ClaudeCodeAuthStore {
-  status(): Promise<ProviderAuthState>;
-  resolveAccess(options?: {
-    forceRefresh?: boolean;
-  }): Promise<ClaudeCodeOAuthAccess>;
-}
-/** Renews a pool oauth secret (wired to `refreshClaudeCodeSecret`; injectable in tests). */
-type ClaudeCodeSecretRefresh = (secret: Record<string, unknown>) => Promise<Record<string, unknown>>;
-interface FileClaudeCodeAuthStoreOptions {
-  /** Optional path to oauth.json (pool entry). */
-  oauthFile?: string;
-  /** Prefer this token over env/keychain when set (tests / static). */
-  accessToken?: string | null;
-  /** Renews the oauth file when its access token nears expiry. */
-  refresh?: ClaudeCodeSecretRefresh;
-}
-/**
- * Resolves Claude OAuth: explicit token → oauth file → CLAUDE_CODE_OAUTH_TOKEN → keychain.
- */
-declare class FileClaudeCodeAuthStore implements ClaudeCodeAuthStore {
-  private readonly oauthFile;
-  private readonly accessToken;
-  private readonly refresh;
-  constructor(options?: FileClaudeCodeAuthStoreOptions);
-  status(): Promise<ProviderAuthState>;
-  resolveAccess(): Promise<ClaudeCodeOAuthAccess>;
-}
-declare class StaticClaudeCodeAuthStore implements ClaudeCodeAuthStore {
-  private readonly access;
-  constructor(access: ClaudeCodeOAuthAccess);
-  status(): Promise<ProviderAuthState>;
-  resolveAccess(): Promise<ClaudeCodeOAuthAccess>;
-}
-//#endregion
 //#region src/provider.d.ts
 interface ClaudeCodeProviderOptions {
   id?: string;
   displayName?: string;
   claudePath?: string;
   models?: ModelPolicy;
-  /** Demi state root for credential pool (`$DEMI_HOME` / `~/.demi`). */
-  stateDir?: string;
-  /** When true (default), attach multi-credential pool + global switch. */
-  credentials?: boolean;
-  authStore?: ClaudeCodeAuthStore;
 }
 declare function createClaudeCodeProvider(options?: ClaudeCodeProviderOptions): Provider;
 //#endregion
@@ -89,6 +27,18 @@ declare function createClaudeCodeProvider(options?: ClaudeCodeProviderOptions):
  */
 declare function resolveWireLogDir(): string | null;
 //#endregion
+//#region src/oauth.d.ts
+interface ClaudeCodeOAuthAccess {
+  accessToken: string;
+  subscriptionType?: string | null;
+  rateLimitTier?: string | null;
+}
+/**
+ * Resolve Claude Code consumer OAuth access for quota APIs.
+ * Order: options env CLAUDE_CODE_OAUTH_TOKEN, then macOS Keychain "Claude Code-credentials".
+ */
+declare function resolveClaudeCodeOAuthAccess(): Promise<ClaudeCodeOAuthAccess | null>;
+//#endregion
 //#region src/quota.d.ts
 interface ClaudeCodeQuotaOptions {
   providerId?: string;
@@ -108,56 +58,4 @@ declare function mapClaudeUsagePayload(payload: unknown, access?: ClaudeCodeOAut
 /** Map anthropic-ratelimit-unified-* headers into a coarse snapshot. */
 declare function observeClaudeRateLimitHeaders(headers: Headers | undefined): ProviderQuotaProbeResult | null;
 //#endregion
-//#region src/credentials.d.ts
-declare class PoolAwareClaudeCodeAuthStore implements ClaudeCodeAuthStore {
-  private readonly pool;
-  constructor(pool: FileCredentialPool);
-  status(): Promise<import("@demicodes/provider").ProviderAuthState>;
-  resolveAccess(): Promise<ClaudeCodeOAuthAccess>;
-  private currentStore;
-}
-declare function openClaudeCodeCredentialPool(options?: {
-  stateDir?: string;
-}): FileCredentialPool;
-declare function createClaudeCodeCredentials(pool: FileCredentialPool, authStore: ClaudeCodeAuthStore, options?: {
-  quota?: ProviderQuota | null;
-  onActiveChange?: () => void;
-  /** Injectable fetch for the OAuth login flow (tests). */
-  loginFetch?: typeof fetch;
-}): ProviderCredentials;
-//#endregion
-//#region src/login.d.ts
-/** Pool-entry oauth.json shape (demi-owned; refreshable when refreshToken present). */
-interface ClaudeCodeOAuthSecret {
-  accessToken: string;
-  refreshToken?: string | null;
-  /** ISO-8601 access token expiry. */
-  expiresAt?: string | null;
-  scopes?: string[] | null;
-  subscriptionType?: string | null;
-  rateLimitTier?: string | null;
-  emailAddress?: string | null;
-  [key: string]: unknown;
-}
-interface ClaudeCodeLoginOptions {
-  signal?: AbortSignal;
-  /** Fires once with the authorize URL; the flow then waits on promptForCode. */
-  onPending?: (pending: {
-    verificationUrl: string;
-    requiresCodeInput: true;
-  }) => void;
-  /** Collects the "code#state" string the vendor page shows after approval. */
-  promptForCode: () => Promise<string>;
-  fetch?: typeof fetch;
-  consoleBase?: string;
-}
-/** Runs the copy-back OAuth flow and returns a refreshable pool secret. */
-declare function runClaudeCodeLogin(options: ClaudeCodeLoginOptions): Promise<ClaudeCodeOAuthSecret>;
-/** Refreshes a pool secret in place; returns the renewed secret. */
-declare function refreshClaudeCodeSecret(secret: ClaudeCodeOAuthSecret, options?: {
-  fetch?: typeof fetch;
-  consoleBase?: string;
-  signal?: AbortSignal;
-}): Promise<ClaudeCodeOAuthSecret>;
-//#endregion
-export { type ClaudeCodeAuthStore, type ClaudeCodeLoginOptions, type ClaudeCodeModelCatalogOptions, type ClaudeCodeOAuthAccess, type ClaudeCodeOAuthSecret, type ClaudeCodeProviderOptions, type ClaudeCodeQuotaOptions, FileClaudeCodeAuthStore, PoolAwareClaudeCodeAuthStore, StaticClaudeCodeAuthStore, createClaudeCodeCredentials, createClaudeCodeProvider, createClaudeCodeQuota, listClaudeCodeModels, mapClaudeUsagePayload, observeClaudeRateLimitHeaders, observeClaudeStreamBody, openClaudeCodeCredentialPool, refreshClaudeCodeSecret, resolveClaudeCodeOAuthAccess, resolveWireLogDir, runClaudeCodeLogin };
+export { type ClaudeCodeModelCatalogOptions, type ClaudeCodeOAuthAccess, type ClaudeCodeProviderOptions, type ClaudeCodeQuotaOptions, createClaudeCodeProvider, createClaudeCodeQuota, listClaudeCodeModels, mapClaudeUsagePayload, observeClaudeRateLimitHeaders, observeClaudeStreamBody, resolveClaudeCodeOAuthAccess, resolveWireLogDir };

package/dist/index.mjs

@@ -1,12 +1,10 @@
-import { abortable, errorMessage, isRecord, nonEmptyString, numberOrNull, stringOrNull } from "@demicodes/utils";
-import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { applyModelPolicy, clampUsedPercent, createProviderQuota, defineProvider, numberHeader, severityFromUsedPercent, toolResultContentToText, unixSecondsToIso } from "@demicodes/provider";
+import { errorMessage, isRecord, nonEmptyString, numberOrNull, stringOrNull } from "@demicodes/utils";
+import { randomUUID } from "node:crypto";
+import { applyModelPolicy, clampUsedPercent, createProviderQuota, defineProvider, severityFromUsedPercent, unixSecondsToIso } from "@demicodes/provider";
+import { Buffer as Buffer$1 } from "node:buffer";
 import { execFile, spawn } from "node:child_process";
-import { readFile, writeFile } from "node:fs/promises";
 import { promisify } from "node:util";
 import process$1 from "node:process";
-import { FileCredentialPool, credentialIdFromIdentity } from "@demicodes/provider/credentials-pool";
-import { Buffer as Buffer$1 } from "node:buffer";
 import { appendFileSync, mkdirSync, statSync } from "node:fs";
 import { createInterface } from "node:readline";
 import { tmpdir } from "node:os";
@@ -97,8 +95,7 @@ const CLAUDE_FAMILY_RANK = {
 	haiku: 2
 };
 function claudeFamilyRank(id) {
-	const family = id.slice(7).split("-")[0] ?? "";
-	return CLAUDE_FAMILY_RANK[family] ?? 3;
+	return CLAUDE_FAMILY_RANK[id.slice(7).split("-")[0] ?? ""] ?? 3;
 }
 /** Canonical catalog order: flagship family first (Opus > Sonnet > Haiku > others), newest version first. */
 function compareClaudeModels(a, b) {
@@ -200,377 +197,6 @@ function reasoningEfforts(value) {
 	return efforts.length > 0 ? efforts : [];
 }
 //#endregion
-//#region src/auth.ts
-const execFileAsync = promisify(execFile);
-const OAUTH_EXPIRY_SKEW_MS = 300 * 1e3;
-/**
-* Resolves Claude OAuth: explicit token → oauth file → CLAUDE_CODE_OAUTH_TOKEN → keychain.
-*/
-var FileClaudeCodeAuthStore = class {
-	oauthFile;
-	accessToken;
-	refresh;
-	constructor(options = {}) {
-		this.oauthFile = options.oauthFile ?? null;
-		this.accessToken = nonEmptyString(options.accessToken) ?? null;
-		this.refresh = options.refresh ?? null;
-	}
-	async status() {
-		try {
-			return {
-				status: "authenticated",
-				accountLabel: nonEmptyString((await this.resolveAccess()).subscriptionType) ?? "Claude Code"
-			};
-		} catch (error) {
-			if (error instanceof ClaudeCodeAuthError && error.code === "auth_missing") return {
-				status: "unauthenticated",
-				message: error.message
-			};
-			return {
-				status: "error",
-				message: error instanceof Error ? error.message : String(error)
-			};
-		}
-	}
-	async resolveAccess() {
-		if (this.accessToken) return {
-			accessToken: this.accessToken,
-			source: "static"
-		};
-		if (this.oauthFile) try {
-			let raw = JSON.parse(await readFile(this.oauthFile, "utf8"));
-			if (!isRecord(raw)) throw new ClaudeCodeAuthError("auth_invalid", `Invalid OAuth file: ${this.oauthFile}`);
-			const expiresAt = nonEmptyString(raw.expiresAt);
-			if (expiresAt !== void 0 && Date.parse(expiresAt) - Date.now() < OAUTH_EXPIRY_SKEW_MS && nonEmptyString(raw.refreshToken) && this.refresh) {
-				raw = await this.refresh(raw);
-				await writeFile(this.oauthFile, `${JSON.stringify(raw, null, 2)}\n`);
-			}
-			if (!isRecord(raw)) throw new ClaudeCodeAuthError("auth_invalid", `Invalid OAuth file: ${this.oauthFile}`);
-			const accessToken = nonEmptyString(raw.accessToken) ?? nonEmptyString(raw.access_token);
-			if (!accessToken) throw new ClaudeCodeAuthError("auth_missing", `No accessToken in ${this.oauthFile}`);
-			return {
-				accessToken,
-				source: "file",
-				subscriptionType: nonEmptyString(raw.subscriptionType) ?? null,
-				rateLimitTier: nonEmptyString(raw.rateLimitTier) ?? null
-			};
-		} catch (error) {
-			if (error instanceof ClaudeCodeAuthError) throw error;
-			throw new ClaudeCodeAuthError("auth_missing", `Failed to read Claude OAuth file ${this.oauthFile}: ${error instanceof Error ? error.message : String(error)}`);
-		}
-		const fromEnv = nonEmptyString(process$1.env.CLAUDE_CODE_OAUTH_TOKEN);
-		if (fromEnv) return {
-			accessToken: fromEnv,
-			source: "env"
-		};
-		if (process$1.platform === "darwin") try {
-			const { stdout } = await execFileAsync("security", [
-				"find-generic-password",
-				"-s",
-				"Claude Code-credentials",
-				"-w"
-			], {
-				encoding: "utf8",
-				timeout: 5e3
-			});
-			const parsed = JSON.parse(stdout.trim());
-			if (!isRecord(parsed)) throw new ClaudeCodeAuthError("auth_missing", "Claude Code keychain item is not a JSON object");
-			const oauth = isRecord(parsed.claudeAiOauth) ? parsed.claudeAiOauth : null;
-			if (!oauth) throw new ClaudeCodeAuthError("auth_missing", "Claude Code keychain missing claudeAiOauth");
-			const accessToken = nonEmptyString(oauth.accessToken);
-			if (!accessToken) throw new ClaudeCodeAuthError("auth_missing", "Claude Code keychain missing accessToken");
-			return {
-				accessToken,
-				source: "keychain",
-				subscriptionType: nonEmptyString(oauth.subscriptionType) ?? null,
-				rateLimitTier: nonEmptyString(oauth.rateLimitTier) ?? null
-			};
-		} catch (error) {
-			if (error instanceof ClaudeCodeAuthError) throw error;
-		}
-		throw new ClaudeCodeAuthError("auth_missing", "Claude Code OAuth access token not found (set CLAUDE_CODE_OAUTH_TOKEN or log in with Claude Code)");
-	}
-};
-var StaticClaudeCodeAuthStore = class {
-	access;
-	constructor(access) {
-		this.access = access;
-	}
-	async status() {
-		return {
-			status: "authenticated",
-			accountLabel: nonEmptyString(this.access.subscriptionType) ?? "Claude Code"
-		};
-	}
-	async resolveAccess() {
-		return this.access;
-	}
-};
-var ClaudeCodeAuthError = class extends Error {
-	code;
-	constructor(code, message) {
-		super(message);
-		this.code = code;
-		this.name = "ClaudeCodeAuthError";
-	}
-};
-//#endregion
-//#region src/login.ts
-const CLAUDE_AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
-const CLAUDE_CONSOLE_BASE = "https://console.anthropic.com";
-const CLAUDE_CODE_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
-const CLAUDE_LOGIN_SCOPE = "org:create_api_key user:profile user:inference";
-function tokenEndpoint(consoleBase) {
-	return `${consoleBase.replace(/\/+$/, "")}/v1/oauth/token`;
-}
-async function requestTokens(fetchImpl, consoleBase, body, signal) {
-	const response = await fetchImpl(tokenEndpoint(consoleBase), {
-		method: "POST",
-		headers: { "content-type": "application/json" },
-		body: JSON.stringify(body),
-		signal
-	});
-	if (!response.ok) throw new ClaudeCodeAuthError("auth_invalid", `Claude OAuth token request failed with HTTP ${response.status}`);
-	const parsed = await response.json().catch(() => null);
-	if (!isRecord(parsed)) throw new ClaudeCodeAuthError("auth_invalid", "Claude OAuth token response is not a JSON object");
-	const accessToken = nonEmptyString(parsed.access_token);
-	if (!accessToken) throw new ClaudeCodeAuthError("auth_invalid", "Claude OAuth token response is missing access_token");
-	const expiresIn = Number(parsed.expires_in);
-	const account = isRecord(parsed.account) ? parsed.account : {};
-	return {
-		accessToken,
-		refreshToken: nonEmptyString(parsed.refresh_token) ?? null,
-		expiresAt: Number.isFinite(expiresIn) && expiresIn > 0 ? new Date(Date.now() + expiresIn * 1e3).toISOString() : null,
-		scopes: typeof parsed.scope === "string" ? parsed.scope.split(" ").filter(Boolean) : null,
-		subscriptionType: nonEmptyString(parsed.subscription_type) ?? nonEmptyString(account.subscription_type) ?? null,
-		...nonEmptyString(account.email_address) ? { emailAddress: nonEmptyString(account.email_address) } : {}
-	};
-}
-/** Runs the copy-back OAuth flow and returns a refreshable pool secret. */
-async function runClaudeCodeLogin(options) {
-	const fetchImpl = options.fetch ?? fetch;
-	const consoleBase = options.consoleBase ?? CLAUDE_CONSOLE_BASE;
-	const verifier = randomBytes(32).toString("base64url");
-	const challenge = createHash("sha256").update(verifier).digest("base64url");
-	const state = randomBytes(32).toString("base64url");
-	const redirectUri = `${consoleBase.replace(/\/+$/, "")}/oauth/code/callback`;
-	const params = new URLSearchParams({
-		code: "true",
-		client_id: CLAUDE_CODE_CLIENT_ID,
-		response_type: "code",
-		redirect_uri: redirectUri,
-		scope: CLAUDE_LOGIN_SCOPE,
-		code_challenge: challenge,
-		code_challenge_method: "S256",
-		state
-	});
-	options.onPending?.({
-		verificationUrl: `${CLAUDE_AUTHORIZE_URL}?${params.toString()}`,
-		requiresCodeInput: true
-	});
-	const pasted = (await options.promptForCode()).trim();
-	if (!pasted) throw new ClaudeCodeAuthError("auth_invalid", "Empty authorization code");
-	const [code, returnedState] = pasted.split("#");
-	if (!nonEmptyString(code)) throw new ClaudeCodeAuthError("auth_invalid", "Authorization code is missing the code part");
-	if (returnedState && returnedState !== state) throw new ClaudeCodeAuthError("auth_invalid", "Authorization code state mismatch — copy the full string from the callback page");
-	return requestTokens(fetchImpl, consoleBase, {
-		grant_type: "authorization_code",
-		code,
-		state: returnedState ?? state,
-		client_id: CLAUDE_CODE_CLIENT_ID,
-		redirect_uri: redirectUri,
-		code_verifier: verifier
-	}, options.signal);
-}
-/** Refreshes a pool secret in place; returns the renewed secret. */
-async function refreshClaudeCodeSecret(secret, options = {}) {
-	const refreshToken = nonEmptyString(secret.refreshToken);
-	if (!refreshToken) throw new ClaudeCodeAuthError("auth_missing", "Claude OAuth secret has no refreshToken to renew with");
-	const renewed = await requestTokens(options.fetch ?? fetch, options.consoleBase ?? CLAUDE_CONSOLE_BASE, {
-		grant_type: "refresh_token",
-		refresh_token: refreshToken,
-		client_id: CLAUDE_CODE_CLIENT_ID
-	}, options.signal);
-	return {
-		...secret,
-		accessToken: renewed.accessToken,
-		refreshToken: renewed.refreshToken ?? refreshToken,
-		expiresAt: renewed.expiresAt ?? secret.expiresAt ?? null,
-		scopes: renewed.scopes ?? secret.scopes ?? null,
-		subscriptionType: renewed.subscriptionType ?? secret.subscriptionType ?? null,
-		...nonEmptyString(renewed.emailAddress) ? { emailAddress: renewed.emailAddress } : {}
-	};
-}
-//#endregion
-//#region src/credentials.ts
-var PoolAwareClaudeCodeAuthStore = class {
-	pool;
-	constructor(pool) {
-		this.pool = pool;
-	}
-	async status() {
-		return this.currentStore().then((s) => s.status());
-	}
-	async resolveAccess() {
-		return this.currentStore().then((s) => s.resolveAccess());
-	}
-	async currentStore() {
-		await this.pool.ensureActivePointer();
-		const activeId = await this.pool.getActiveId();
-		if (activeId) return new FileClaudeCodeAuthStore({
-			oauthFile: this.pool.secretPath(activeId),
-			refresh: (secret) => refreshClaudeCodeSecret(secret)
-		});
-		return new FileClaudeCodeAuthStore();
-	}
-};
-function openClaudeCodeCredentialPool(options = {}) {
-	return new FileCredentialPool({
-		stateDir: options.stateDir,
-		providerKey: "claude-code",
-		secretFileName: "oauth.json"
-	});
-}
-function createClaudeCodeCredentials(pool, authStore, options = {}) {
-	const capability = () => ({
-		mode: "supported",
-		canBeginLogin: true,
-		canImportDefault: true,
-		canAdd: true,
-		multi: true
-	});
-	const getActive = async () => {
-		await pool.ensureActivePointer();
-		return {
-			credentialId: await pool.getActiveId(),
-			status: await authStore.status()
-		};
-	};
-	const setActive = async (credentialId) => {
-		await pool.setActiveId(credentialId);
-		options.quota?.clearLatest?.();
-		options.onActiveChange?.();
-		return getActive();
-	};
-	const importAccess = async (access, source) => {
-		const token = nonEmptyString(access.accessToken);
-		if (!token) throw new ClaudeCodeAuthError("auth_missing", "No Claude access token to import");
-		const identityKey = nonEmptyString(access.subscriptionType) != null ? `token:${createHash("sha256").update(token).digest("hex").slice(0, 16)}:${access.subscriptionType}` : `token:${createHash("sha256").update(token).digest("hex").slice(0, 16)}`;
-		const label = nonEmptyString(access.subscriptionType) ?? `claude-${identityKey.slice(-8)}`;
-		const id = (await pool.findByIdentityKey(identityKey))?.id ?? credentialIdFromIdentity(identityKey, label);
-		const meta = {
-			id,
-			label,
-			detail: nonEmptyString(access.rateLimitTier) ?? null,
-			updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-			source,
-			identityKey
-		};
-		const secret = {
-			accessToken: token,
-			subscriptionType: access.subscriptionType ?? null,
-			rateLimitTier: access.rateLimitTier ?? null
-		};
-		await pool.writeEntry(meta, `${JSON.stringify(secret, null, 2)}\n`);
-		if (!await pool.getActiveId()) await pool.setActiveId(id);
-		options.quota?.clearLatest?.();
-		options.onActiveChange?.();
-		return {
-			id: meta.id,
-			label: meta.label,
-			detail: meta.detail,
-			updatedAt: meta.updatedAt
-		};
-	};
-	const importSecret = async (secret, source) => {
-		const email = nonEmptyString(secret.emailAddress);
-		const identityKey = email ? `email:${email}` : `token:${createHash("sha256").update(secret.accessToken).digest("hex").slice(0, 16)}`;
-		const label = email ?? nonEmptyString(secret.subscriptionType) ?? `claude-${identityKey.slice(-8)}`;
-		const id = (await pool.findByIdentityKey(identityKey))?.id ?? credentialIdFromIdentity(identityKey, label);
-		const meta = {
-			id,
-			label,
-			detail: nonEmptyString(secret.subscriptionType) ?? nonEmptyString(secret.rateLimitTier) ?? null,
-			updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-			source,
-			identityKey
-		};
-		await pool.writeEntry(meta, `${JSON.stringify(secret, null, 2)}\n`);
-		if (!await pool.getActiveId()) await pool.setActiveId(id);
-		options.quota?.clearLatest?.();
-		options.onActiveChange?.();
-		return {
-			id: meta.id,
-			label: meta.label,
-			detail: meta.detail,
-			updatedAt: meta.updatedAt
-		};
-	};
-	return {
-		capability,
-		list: () => pool.list(),
-		getActive,
-		setActive,
-		beginLogin: async (loginOptions) => {
-			if (!loginOptions?.promptForCode) return {
-				status: "unavailable",
-				message: "Claude login requires promptForCode to collect the pasted authorization code"
-			};
-			try {
-				const secret = await runClaudeCodeLogin({
-					signal: loginOptions.signal,
-					onPending: loginOptions.onPending,
-					promptForCode: loginOptions.promptForCode,
-					fetch: options.loginFetch
-				});
-				return {
-					status: "completed",
-					credentialId: (await importSecret(secret, "login:oauth")).id
-				};
-			} catch (error) {
-				if (loginOptions.signal?.aborted) return { status: "cancelled" };
-				return {
-					status: "failed",
-					message: errorMessage(error)
-				};
-			}
-		},
-		importDefault: async () => {
-			const vendor = new FileClaudeCodeAuthStore();
-			let access;
-			try {
-				access = await vendor.resolveAccess();
-			} catch {
-				throw new ClaudeCodeAuthError("auth_missing", "No Claude Code OAuth to import. Run claude auth login or beginLogin first.");
-			}
-			return importAccess(access, "vendor:default");
-		},
-		add: async (input) => {
-			if (typeof input.accessToken === "string") return importAccess({
-				accessToken: input.accessToken,
-				source: "static",
-				subscriptionType: typeof input.subscriptionType === "string" ? input.subscriptionType : null,
-				rateLimitTier: typeof input.rateLimitTier === "string" ? input.rateLimitTier : null
-			}, "add:accessToken");
-			if (isRecord(input.oauth) && typeof input.oauth.accessToken === "string") {
-				const oauth = input.oauth;
-				return importAccess({
-					accessToken: oauth.accessToken,
-					source: "static",
-					subscriptionType: typeof oauth.subscriptionType === "string" ? oauth.subscriptionType : null,
-					rateLimitTier: typeof oauth.rateLimitTier === "string" ? oauth.rateLimitTier : null
-				}, "add:oauth");
-			}
-			throw new Error("Claude credentials.add expects accessToken or oauth.accessToken");
-		},
-		remove: async (credentialId) => {
-			await pool.remove(credentialId);
-			options.quota?.clearLatest?.();
-			options.onActiveChange?.();
-		}
-	};
-}
-//#endregion
 //#region src/jsonl.ts
 /**
 * Builds the input messages used to prime a *fresh* Claude CLI process with prior
@@ -648,7 +274,7 @@ function renderToolUseText(toolName, input) {
 	return `[Earlier in this conversation I called the tool ${toolName} with input: ${safeJson(input)}.`;
 }
 function renderToolResultText(toolName, item) {
-	const body = toolResultContentToText(item.output);
+	const body = toolResultToText(item.output);
 	const suffix = toolName ? ` from ${toolName}` : "";
 	return item.isError ? `It returned an error${suffix}: ${body}]` : `It returned${suffix}: ${body}]`;
 }
@@ -713,10 +339,6 @@ function userContentToClaude(content) {
 			type: "image",
 			source: imageSourceToClaude(block.source)
 		};
-		if (block.type === "video") return {
-			type: "text",
-			text: "[video]"
-		};
 		if (block.type === "document") return documentSourceToClaude(block.source);
 		return {
 			type: "text",
@@ -749,30 +371,11 @@ function assistantItemToClaudeContent(item) {
 	};
 }
 function toolResultToClaudeContent(item) {
-	const hasImage = item.output.some((block) => block.type !== "text");
 	return {
 		type: "tool_result",
 		tool_use_id: item.toolUseId,
 		is_error: item.isError,
-		content: hasImage ? item.output.map(toolResultBlockToClaude) : toolResultContentToText(item.output)
-	};
-}
-function toolResultBlockToClaude(block) {
-	if (block.type === "text") return {
-		type: "text",
-		text: block.text
-	};
-	if (block.type === "video") return {
-		type: "text",
-		text: `[video:${block.source.mediaType}]`
-	};
-	return {
-		type: "image",
-		source: {
-			type: "base64",
-			media_type: block.source.mediaType,
-			data: block.source.data
-		}
+		content: toolResultToText(item.output)
 	};
 }
 function imageSourceToClaude(source) {
@@ -797,6 +400,9 @@ function documentSourceToClaude(source) {
 		title: source.fileName
 	};
 }
+function toolResultToText(output) {
+	return output.map((block) => block.type === "text" ? block.text : `[image:${block.source.mediaType}]`).join("\n");
+}
 function bytesToBase64(data) {
 	return Buffer$1.from(data.buffer, data.byteOffset, data.byteLength).toString("base64");
 }
@@ -805,28 +411,6 @@ function toolNameToClaude(name) {
 	return `mcp__main__${name}`;
 }
 //#endregion
-//#region src/oauth.ts
-/**
-* The token to inject into a spawned CLI as CLAUDE_CODE_OAUTH_TOKEN, or null
-* to let the CLI authenticate itself. Keychain-sourced tokens are never
-* injected — see {@link ClaudeCodeOAuthSource}.
-*/
-function injectableCliToken(access) {
-	return access.source === "keychain" ? null : access.accessToken;
-}
-/**
-* Resolve Claude Code consumer OAuth access for quota APIs.
-* Order: options env CLAUDE_CODE_OAUTH_TOKEN, then macOS Keychain "Claude Code-credentials".
-* Prefer injecting {@link ClaudeCodeAuthStore} when multi-credential is enabled.
-*/
-async function resolveClaudeCodeOAuthAccess() {
-	try {
-		return await new FileClaudeCodeAuthStore().resolveAccess();
-	} catch {
-		return null;
-	}
-}
-//#endregion
 //#region src/output.ts
 function mapClaudeStdoutMessage(message, options = {}) {
 	const events = [];
@@ -834,7 +418,7 @@ function mapClaudeStdoutMessage(message, options = {}) {
 		events,
 		terminal: false
 	};
-	if (message.type === "assistant" && isRecord(message.message)) events.push(...mapContentArray(message.message.content, options));
+	if (message.type === "assistant" && isRecord(message.message) && !options.ignoreAssistantContent) events.push(...mapContentArray(message.message.content, options));
 	if (message.type === "stream_event" && isRecord(message.event)) events.push(...mapStreamEvent(message.event));
 	if (message.type === "control_request") {
 		const request = parseControlRequest(message);
@@ -855,7 +439,7 @@ function mapClaudeStdoutMessage(message, options = {}) {
 		}
 		events.push({
 			type: "response",
-			usage: mapResultUsage(message.usage)
+			usage: mapUsage(message.usage)
 		});
 		return {
 			events,
@@ -892,11 +476,11 @@ function mapContentArray(content, options) {
 	const events = [];
 	for (const block of content) {
 		if (!isRecord(block)) continue;
-		if (block.type === "text" && !options.ignoreAssistantContent) events.push({
+		if (block.type === "text") events.push({
 			type: "text_delta",
 			text: String(block.text ?? "")
 		});
-		else if (block.type === "thinking" && !options.ignoreAssistantContent) {
+		else if (block.type === "thinking") {
 			events.push({ type: "thinking_start" });
 			events.push({
 				type: "thinking_delta",
@@ -906,7 +490,7 @@ function mapContentArray(content, options) {
 				type: "thinking_signature",
 				signature: block.signature
 			});
-		} else if (block.type === "redacted_thinking" && !options.ignoreAssistantContent) events.push({
+		} else if (block.type === "redacted_thinking") events.push({
 			type: "redacted_thinking",
 			data: String(block.data ?? "")
 		});
@@ -970,7 +554,6 @@ function parseControlRequest(message) {
 			outerRequestId: message.request_id,
 			serverName: request.server_name,
 			id,
-			toolUseId: sdkMcpToolUseId(inner.params),
 			method,
 			params: inner.params
 		};
@@ -985,26 +568,6 @@ function parseControlRequest(message) {
 		params: message.params
 	};
 }
-function sdkMcpToolUseId(params) {
-	if (!isRecord(params) || !isRecord(params._meta)) return void 0;
-	const value = params._meta["claudecode/toolUseId"];
-	return typeof value === "string" && value.length > 0 ? value : void 0;
-}
-/**
-* Usage for the response event from a `result` message. The top-level
-* `result.usage` sums every API call the CLI made within the turn (initial call
-* plus one per tool result), so its input/cache counts can exceed the context
-* window itself and must not be reported as request usage. `usage.iterations`
-* lists the per-call usage; the last entry is the final request — the one the
-* response contract requires.
-*/
-function mapResultUsage(usage) {
-	if (isRecord(usage) && Array.isArray(usage.iterations)) {
-		const last = usage.iterations[usage.iterations.length - 1];
-		if (isRecord(last)) return mapUsage(last);
-	}
-	return mapUsage(usage);
-}
 function mapUsage(usage) {
 	if (!isRecord(usage)) return {
 		inputTokens: 0,
@@ -1042,6 +605,42 @@ function stripMcpToolPrefix(name) {
 	return /^mcp__[^_]+__(.+)$/.exec(name)?.[1] ?? name;
 }
 //#endregion
+//#region src/oauth.ts
+const execFileAsync = promisify(execFile);
+/**
+* Resolve Claude Code consumer OAuth access for quota APIs.
+* Order: options env CLAUDE_CODE_OAUTH_TOKEN, then macOS Keychain "Claude Code-credentials".
+*/
+async function resolveClaudeCodeOAuthAccess() {
+	const fromEnv = nonEmptyString(process$1.env.CLAUDE_CODE_OAUTH_TOKEN);
+	if (fromEnv) return { accessToken: fromEnv };
+	if (process$1.platform === "darwin") try {
+		const { stdout } = await execFileAsync("security", [
+			"find-generic-password",
+			"-s",
+			"Claude Code-credentials",
+			"-w"
+		], {
+			encoding: "utf8",
+			timeout: 5e3
+		});
+		const parsed = JSON.parse(stdout.trim());
+		if (!isRecord(parsed)) return null;
+		const oauth = isRecord(parsed.claudeAiOauth) ? parsed.claudeAiOauth : null;
+		if (!oauth) return null;
+		const accessToken = nonEmptyString(oauth.accessToken);
+		if (!accessToken) return null;
+		return {
+			accessToken,
+			subscriptionType: nonEmptyString(oauth.subscriptionType) ?? null,
+			rateLimitTier: nonEmptyString(oauth.rateLimitTier) ?? null
+		};
+	} catch {
+		return null;
+	}
+	return null;
+}
+//#endregion
 //#region src/quota.ts
 const DEFAULT_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
 const DEFAULT_OAUTH_BETA = "oauth-2025-04-20";
@@ -1063,15 +662,14 @@ function createClaudeCodeQuota(options = {}) {
 		probe: async ({ signal } = {}) => {
 			const access = await resolveAccess();
 			if (!access?.accessToken) throw new Error("Claude Code OAuth access token not found (set CLAUDE_CODE_OAUTH_TOKEN or log in with Claude Code)");
-			const headers = new Headers({
-				authorization: `Bearer ${access.accessToken}`,
-				"anthropic-beta": DEFAULT_OAUTH_BETA,
-				accept: "application/json",
-				"user-agent": "demi-provider-claude-code"
-			});
 			const response = await fetchImpl(usageUrl, {
 				method: "GET",
-				headers,
+				headers: new Headers({
+					authorization: `Bearer ${access.accessToken}`,
+					"anthropic-beta": DEFAULT_OAUTH_BETA,
+					accept: "application/json",
+					"user-agent": "demi-provider-claude-code"
+				}),
 				signal
 			});
 			if (!response.ok) {
@@ -1148,7 +746,7 @@ function observeClaudeRateLimitHeaders(headers) {
 	const claim = headers.get("anthropic-ratelimit-unified-representative-claim");
 	const overageUtil = headers.get("anthropic-ratelimit-unified-overage-period-channel-utilization");
 	if (!status && !reset && !claim && !overageUtil) return null;
-	const usedPercent = clampUsedPercent(numberHeader(headers, "anthropic-ratelimit-unified-overage-period-channel-utilization"));
+	const usedPercent = clampUsedPercent(overageUtil != null ? Number(overageUtil) : null);
 	return {
 		windows: [{
 			id: "unified",
@@ -1205,15 +803,13 @@ function buildClaudeArgs(params) {
 	if (params.thinkingEffort) args.push("--effort", params.thinkingEffort);
 	return args;
 }
-function buildClaudeEnv(base = process.env, options = {}) {
+function buildClaudeEnv(base = process.env) {
 	const env = {
 		...base,
 		DISABLE_AUTO_COMPACT: "1",
 		MAX_MCP_OUTPUT_TOKENS: "1000000"
 	};
 	delete env.CLAUDECODE;
-	const token = options.oauthAccessToken?.trim();
-	if (token) env.CLAUDE_CODE_OAUTH_TOKEN = token;
 	return env;
 }
 //#endregion
@@ -1260,19 +856,13 @@ function resolveSpawnCwd(cwd) {
 	try {
 		if (statSync(cwd).isDirectory()) return cwd;
 	} catch {}
-	return process$1.cwd();
+	return process.cwd();
 }
 var ClaudeCliTransportFactory = class {
 	claudePath;
-	resolveOAuthAccessToken;
 	constructor(options = {}) {
-		if (typeof options === "string") {
-			this.claudePath = options;
-			this.resolveOAuthAccessToken = null;
-		} else {
-			this.claudePath = options.claudePath ?? "claude";
-			this.resolveOAuthAccessToken = options.resolveOAuthAccessToken ?? null;
-		}
+		if (typeof options === "string") this.claudePath = options;
+		else this.claudePath = options.claudePath ?? "claude";
 	}
 	async start(request) {
 		const args = buildClaudeArgsForRequest(request);
@@ -1284,10 +874,9 @@ var ClaudeCliTransportFactory = class {
 			cwd: request.cwd,
 			args
 		});
-		const oauthAccessToken = this.resolveOAuthAccessToken ? await this.resolveOAuthAccessToken() : null;
 		return new ChildProcessClaudeTransport(spawn(this.claudePath, args, {
 			cwd: resolveSpawnCwd(request.cwd),
-			env: buildClaudeEnv(process$1.env, { oauthAccessToken }),
+			env: buildClaudeEnv(),
 			stdio: [
 				"pipe",
 				"pipe",
@@ -1376,21 +965,10 @@ function thinkingEffort(thinking) {
 var ClaudeCodeProvider = class {
 	transportFactory;
 	quota;
-	getActiveCredentialId;
 	active = null;
 	constructor(options = {}) {
-		this.transportFactory = options.transportFactory ?? new ClaudeCliTransportFactory({
-			claudePath: options.claudePath,
-			resolveOAuthAccessToken: options.authStore ? async () => {
-				try {
-					return injectableCliToken(await options.authStore.resolveAccess());
-				} catch {
-					return null;
-				}
-			} : void 0
-		});
+		this.transportFactory = options.transportFactory ?? new ClaudeCliTransportFactory({ claudePath: options.claudePath });
 		this.quota = options.quota ?? null;
-		this.getActiveCredentialId = options.getActiveCredentialId ?? null;
 	}
 	observeQuotaFromMessage(message) {
 		try {
@@ -1440,50 +1018,21 @@ var ClaudeCodeProvider = class {
 				}
 				const raw = next.value;
 				this.observeQuotaFromMessage(raw);
-				const mapped = mapClaudeStdoutMessage(raw, { ignoreAssistantContent: active.hasStreamed && isMessageType(raw, "assistant") });
+				const mapped = mapClaudeStdoutMessage(raw, {
+					ignoreAssistantContent: active.hasStreamed && isMessageType(raw, "assistant"),
+					ignoreAssistantToolUse: active.sdkMcpEnabled
+				});
 				if (isMessageType(raw, "stream_event")) active.hasStreamed = true;
 				if (mapped.controlRequest) {
-					const handled = await this.handleControlRequest(active, mapped.controlRequest, request);
-					if (handled === "tool-call") {
+					if (await this.handleControlRequest(active, mapped.controlRequest, request) === "tool-call") {
 						const event = active.pendingControlRequest ? controlRequestToToolCall(active.pendingControlRequest) : null;
 						keepActiveForContinuation = true;
 						if (event) yield event;
 						return;
 					}
-					if (handled === "sdk-tool-call") {
-						const pending = active.pendingSdkControlRequests.get(mapped.controlRequest.toolUseId ?? "");
-						const event = pending ? controlRequestToToolCall(pending) : null;
-						if (event?.type === "tool_call_requested") {
-							active.pendingSdkToolCalls = [event];
-							keepActiveForContinuation = true;
-							yield event;
-						}
-						return;
-					}
 					continue;
 				}
 				const toolUseIds = mapped.events.filter(isToolCallRequested).map((event) => event.toolUseId);
-				if (active.sdkMcpEnabled) {
-					for (const event of mapped.events) {
-						if (event.type === "tool_call_requested") {
-							active.collectingSdkToolCalls.set(event.toolUseId, event);
-							continue;
-						}
-						yield event;
-					}
-					if (isStreamMessageStop(raw) && active.collectingSdkToolCalls.size > 0) {
-						active.pendingSdkToolCalls = [...active.collectingSdkToolCalls.values()];
-						active.collectingSdkToolCalls.clear();
-						keepActiveForContinuation = true;
-						for (const event of active.pendingSdkToolCalls) yield event;
-						return;
-					}
-					if (mapped.terminal) {
-						keepActiveForContinuation = true;
-						return;
-					}
-					continue;
-				}
 				if (toolUseIds.length > 0) active.pendingToolUseIds = toolUseIds;
 				for (const event of mapped.events) {
 					if (event.type === "tool_call_requested") keepActiveForContinuation = true;
@@ -1526,26 +1075,22 @@ var ClaudeCodeProvider = class {
 	* the session changed, or the transcript was rewritten underneath us (compaction).
 	*/
 	async ensureActiveForRequest(request) {
-		const credentialId = this.getActiveCredentialId ? await this.getActiveCredentialId() : null;
 		const existing = this.active;
-		if (existing && existing.sessionId === request.sessionId && existing.modelId === request.modelId && existing.thinkingSig === thinkingSignature(request) && existing.credentialId === credentialId) {
-			if (existing.pendingControlRequest !== null || existing.pendingSdkToolCalls.length > 0 || existing.pendingToolUseIds.length > 0 || !itemsDiverged(existing, request.items)) {
+		if (existing && existing.sessionId === request.sessionId && existing.modelId === request.modelId && existing.thinkingSig === thinkingSignature(request)) {
+			if (existing.pendingControlRequest !== null || existing.pendingToolUseIds.length > 0 || !itemsDiverged(existing, request.items)) {
 				await this.sendContinuation(existing, request);
 				return existing;
 			}
 		}
 		if (existing) await this.disposeActive(existing);
-		return this.coldStart(request, credentialId);
+		return this.coldStart(request);
 	}
-	async coldStart(request, credentialId) {
+	async coldStart(request) {
 		const transport = await this.transportFactory.start(request);
 		const active = {
 			transport,
 			iterator: transport.messages()[Symbol.asyncIterator](),
 			pendingControlRequest: null,
-			pendingSdkControlRequests: /* @__PURE__ */ new Map(),
-			pendingSdkToolCalls: [],
-			collectingSdkToolCalls: /* @__PURE__ */ new Map(),
 			pendingToolUseIds: [],
 			bufferedMessages: [],
 			sdkMcpEnabled: request.tools.length > 0,
@@ -1553,7 +1098,6 @@ var ClaudeCodeProvider = class {
 			sessionId: request.sessionId,
 			modelId: request.modelId,
 			thinkingSig: thinkingSignature(request),
-			credentialId,
 			sentUserMessageCount: 0,
 			firstUserSig: null
 		};
@@ -1570,10 +1114,6 @@ var ClaudeCodeProvider = class {
 			await this.writeToolResults(request, active.pendingControlRequest);
 			active.pendingControlRequest = null;
 		}
-		if (active.pendingSdkToolCalls.length > 0) {
-			await this.writeSdkMcpToolResults(active, request);
-			active.pendingSdkToolCalls = [];
-		}
 		if (active.pendingToolUseIds.length > 0) {
 			await this.writeToolResultMessages(request, active.pendingToolUseIds);
 			active.pendingToolUseIds = [];
@@ -1627,15 +1167,6 @@ var ClaudeCodeProvider = class {
 				await this.writeControlError(active, request, "Invalid tools/call request");
 				return "handled";
 			}
-			if (request.protocol === "sdk-mcp") {
-				request.toolUseId ??= `mcp-control-${randomUUID()}`;
-				const normalized = {
-					...request,
-					toolUseId: request.toolUseId
-				};
-				active.pendingSdkControlRequests.set(normalized.toolUseId, normalized);
-				return active.hasStreamed ? "handled" : "sdk-tool-call";
-			}
 			active.pendingControlRequest = {
 				...request,
 				toolUseId: `mcp-control-${randomUUID()}`
@@ -1645,38 +1176,6 @@ var ClaudeCodeProvider = class {
 		await this.writeControlError(active, request, `Unsupported method: ${request.method}`);
 		return "handled";
 	}
-	async writeSdkMcpToolResults(active, request) {
-		const results = new Map(request.items.filter((item) => item.type === "tool_result").map((item) => [item.toolUseId, item]));
-		const expected = active.pendingSdkToolCalls.map((event) => event.toolUseId);
-		const missing = expected.filter((toolUseId) => !results.has(toolUseId));
-		if (missing.length > 0) throw new Error(`Claude Code provider missing tool_result for SDK MCP tool_use ${missing.join(", ")}`);
-		const remaining = new Set(expected);
-		while (remaining.size > 0) {
-			let responded = false;
-			for (const toolUseId of remaining) {
-				const controlRequest = active.pendingSdkControlRequests.get(toolUseId);
-				if (!controlRequest) continue;
-				await this.writeToolResults(request, controlRequest);
-				active.pendingSdkControlRequests.delete(toolUseId);
-				remaining.delete(toolUseId);
-				responded = true;
-			}
-			if (remaining.size === 0) return;
-			if (responded) continue;
-			const next = await abortable(active.iterator.next(), request.cancel);
-			if (next.done) throw new Error(`Claude Code exited before requesting SDK MCP tool result for ${[...remaining].join(", ")}`);
-			this.observeQuotaFromMessage(next.value);
-			const mapped = mapClaudeStdoutMessage(next.value, {
-				ignoreAssistantContent: true,
-				ignoreAssistantToolUse: true
-			});
-			if (mapped.controlRequest) {
-				if (await this.handleControlRequest(active, mapped.controlRequest, request) === "tool-call") throw new Error("Claude Code emitted a legacy tool call while awaiting SDK MCP results");
-				continue;
-			}
-			active.bufferedMessages.push(next.value);
-		}
-	}
 	async writeToolResults(request, controlRequest) {
 		if (!this.active) throw new Error("No active Claude transport");
 		const expectedToolUseId = controlRequest.toolUseId ?? String(controlRequest.id);
@@ -1777,32 +1276,19 @@ var ClaudeCodeProvider = class {
 function createClaudeCodeProvider(options = {}) {
 	const id = options.id ?? "claude-code";
 	const displayName = options.displayName ?? "Claude Code";
-	const enableCredentials = options.credentials ?? options.authStore === void 0;
-	const pool = !options.authStore && enableCredentials ? openClaudeCodeCredentialPool({ stateDir: options.stateDir }) : null;
-	const authStore = options.authStore ?? (pool ? new PoolAwareClaudeCodeAuthStore(pool) : new FileClaudeCodeAuthStore());
-	const quota = createClaudeCodeQuota({
-		providerId: id,
-		resolveAccess: async () => {
-			try {
-				return await authStore.resolveAccess();
-			} catch {
-				return null;
-			}
-		}
-	});
-	const credentialsApi = pool ? createClaudeCodeCredentials(pool, authStore, { quota }) : void 0;
+	const quota = createClaudeCodeQuota({ providerId: id });
 	const runtimeOptions = {
 		claudePath: options.claudePath,
-		quota,
-		authStore,
-		getActiveCredentialId: pool ? () => pool.getActiveId() : void 0
+		quota
 	};
 	return defineProvider({
 		id,
 		displayName,
-		auth: { status: () => authStore.status() },
+		auth: { status: () => ({
+			status: "unknown",
+			message: "Auth is checked when a Claude Code request runs"
+		}) },
 		quota,
-		...credentialsApi ? { credentials: credentialsApi } : {},
 		state: () => ({
 			status: "unknown",
 			message: "Runtime is checked when a Claude Code request runs"
@@ -1820,19 +1306,18 @@ function isControlResponseFor(value, requestId) {
 	if (!isRecord(value) || value.type !== "control_response" || !isRecord(value.response)) return false;
 	return value.response.request_id === requestId && value.response.subtype === "success";
 }
+function toolResultContentToText(output) {
+	return output.map((block) => block.type === "text" ? block.text : `[image:${block.source.mediaType}]`).join("\n");
+}
 function toolResultContentToMcp(output) {
 	return output.map((block) => {
 		if (block.type === "text") return {
 			type: "text",
 			text: block.text
 		};
-		if (block.type === "video") return {
-			type: "text",
-			text: `[video:${block.source.mediaType}]`
-		};
 		return {
 			type: "image",
-			data: block.source.data,
+			data: Buffer.from(block.source.data).toString("base64"),
 			mimeType: block.source.mediaType
 		};
 	});
@@ -1840,9 +1325,6 @@ function toolResultContentToMcp(output) {
 function isMessageType(value, type) {
 	return isRecord(value) && value.type === type;
 }
-function isStreamMessageStop(value) {
-	return isRecord(value) && value.type === "stream_event" && isRecord(value.event) && value.event.type === "message_stop";
-}
 function thinkingSignature(request) {
 	return JSON.stringify(request.thinking ?? null);
 }
@@ -1867,4 +1349,4 @@ function itemsDiverged(active, items) {
 	return false;
 }
 //#endregion
-export { FileClaudeCodeAuthStore, PoolAwareClaudeCodeAuthStore, StaticClaudeCodeAuthStore, createClaudeCodeCredentials, createClaudeCodeProvider, createClaudeCodeQuota, listClaudeCodeModels, mapClaudeUsagePayload, observeClaudeRateLimitHeaders, observeClaudeStreamBody, openClaudeCodeCredentialPool, refreshClaudeCodeSecret, resolveClaudeCodeOAuthAccess, resolveWireLogDir, runClaudeCodeLogin };
+export { createClaudeCodeProvider, createClaudeCodeQuota, listClaudeCodeModels, mapClaudeUsagePayload, observeClaudeRateLimitHeaders, observeClaudeStreamBody, resolveClaudeCodeOAuthAccess, resolveWireLogDir };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@demicodes/provider-claude-code",
   "description": "Claude Code provider adapter for Demi.",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "private": false,
   "type": "module",
   "exports": {
@@ -11,13 +11,13 @@
     }
   },
   "dependencies": {
-    "@demicodes/core": "^0.10.2",
-    "@demicodes/provider": "^0.10.2",
-    "@demicodes/utils": "^0.10.2"
+    "@demicodes/core": "^0.10.3",
+    "@demicodes/provider": "^0.10.3",
+    "@demicodes/utils": "^0.10.3"
   },
   "devDependencies": {
-    "@demicodes/agent": "^0.10.2",
-    "@demicodes/shell": "^0.10.2"
+    "@demicodes/agent": "^0.10.3",
+    "@demicodes/shell": "^0.10.3"
   },
   "license": "Apache-2.0",
   "main": "./dist/index.mjs",