@demicodes/provider-claude-code 0.3.2 → 0.3.3

package/dist/index.d.mts

@@ -11,8 +11,17 @@ type ModelCatalogFetch = (input: string | URL | Request, init?: RequestInit) =>
 declare function listClaudeCodeModels(options?: ClaudeCodeModelCatalogOptions): Promise<ProviderModelList>;
 //#endregion
 //#region src/oauth.d.ts
+/**
+ * Where a resolved token came from. Callers that inject the token into a
+ * spawned CLI must skip `keychain`: that token is the CLI's own short-lived
+ * credential, and injecting it via CLAUDE_CODE_OAUTH_TOKEN disables the CLI's
+ * refresh flow — the run starts 401ing as soon as the token expires. Owned
+ * sources (static/file/env) are the caller's responsibility and inject as-is.
+ */
+type ClaudeCodeOAuthSource = 'static' | 'file' | 'env' | 'keychain';
 interface ClaudeCodeOAuthAccess {
   accessToken: string;
+  source: ClaudeCodeOAuthSource;
   subscriptionType?: string | null;
   rateLimitTier?: string | null;
 }

package/dist/index.mjs

@@ -230,7 +230,10 @@ var FileClaudeCodeAuthStore = class {
 		}
 	}
 	async resolveAccess() {
-		if (this.accessToken) return { accessToken: this.accessToken };
+		if (this.accessToken) return {
+			accessToken: this.accessToken,
+			source: "static"
+		};
 		if (this.oauthFile) try {
 			const raw = JSON.parse(await readFile(this.oauthFile, "utf8"));
 			if (!isRecord(raw)) throw new ClaudeCodeAuthError("auth_invalid", `Invalid OAuth file: ${this.oauthFile}`);
@@ -238,6 +241,7 @@ var FileClaudeCodeAuthStore = class {
 			if (!accessToken) throw new ClaudeCodeAuthError("auth_missing", `No accessToken in ${this.oauthFile}`);
 			return {
 				accessToken,
+				source: "file",
 				subscriptionType: nonEmptyString(raw.subscriptionType) ?? null,
 				rateLimitTier: nonEmptyString(raw.rateLimitTier) ?? null
 			};
@@ -246,7 +250,10 @@ var FileClaudeCodeAuthStore = class {
 			throw new ClaudeCodeAuthError("auth_missing", `Failed to read Claude OAuth file ${this.oauthFile}: ${error instanceof Error ? error.message : String(error)}`);
 		}
 		const fromEnv = nonEmptyString(process$1.env.CLAUDE_CODE_OAUTH_TOKEN);
-		if (fromEnv) return { accessToken: fromEnv };
+		if (fromEnv) return {
+			accessToken: fromEnv,
+			source: "env"
+		};
 		if (process$1.platform === "darwin") try {
 			const { stdout } = await execFileAsync("security", [
 				"find-generic-password",
@@ -265,6 +272,7 @@ var FileClaudeCodeAuthStore = class {
 			if (!accessToken) throw new ClaudeCodeAuthError("auth_missing", "Claude Code keychain missing accessToken");
 			return {
 				accessToken,
+				source: "keychain",
 				subscriptionType: nonEmptyString(oauth.subscriptionType) ?? null,
 				rateLimitTier: nonEmptyString(oauth.rateLimitTier) ?? null
 			};
@@ -408,6 +416,7 @@ function createClaudeCodeCredentials(pool, authStore, options = {}) {
 		add: async (input) => {
 			if (typeof input.accessToken === "string") return importAccess({
 				accessToken: input.accessToken,
+				source: "static",
 				subscriptionType: typeof input.subscriptionType === "string" ? input.subscriptionType : null,
 				rateLimitTier: typeof input.rateLimitTier === "string" ? input.rateLimitTier : null
 			}, "add:accessToken");
@@ -415,6 +424,7 @@ function createClaudeCodeCredentials(pool, authStore, options = {}) {
 				const oauth = input.oauth;
 				return importAccess({
 					accessToken: oauth.accessToken,
+					source: "static",
 					subscriptionType: typeof oauth.subscriptionType === "string" ? oauth.subscriptionType : null,
 					rateLimitTier: typeof oauth.rateLimitTier === "string" ? oauth.rateLimitTier : null
 				}, "add:oauth");
@@ -663,6 +673,28 @@ function toolNameToClaude(name) {
 	return `mcp__main__${name}`;
 }
 //#endregion
+//#region src/oauth.ts
+/**
+* The token to inject into a spawned CLI as CLAUDE_CODE_OAUTH_TOKEN, or null
+* to let the CLI authenticate itself. Keychain-sourced tokens are never
+* injected — see {@link ClaudeCodeOAuthSource}.
+*/
+function injectableCliToken(access) {
+	return access.source === "keychain" ? null : access.accessToken;
+}
+/**
+* Resolve Claude Code consumer OAuth access for quota APIs.
+* Order: options env CLAUDE_CODE_OAUTH_TOKEN, then macOS Keychain "Claude Code-credentials".
+* Prefer injecting {@link ClaudeCodeAuthStore} when multi-credential is enabled.
+*/
+async function resolveClaudeCodeOAuthAccess() {
+	try {
+		return await new FileClaudeCodeAuthStore().resolveAccess();
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region src/output.ts
 function mapClaudeStdoutMessage(message, options = {}) {
 	const events = [];
@@ -872,20 +904,6 @@ function stripMcpToolPrefix(name) {
 	return /^mcp__[^_]+__(.+)$/.exec(name)?.[1] ?? name;
 }
 //#endregion
-//#region src/oauth.ts
-/**
-* Resolve Claude Code consumer OAuth access for quota APIs.
-* Order: options env CLAUDE_CODE_OAUTH_TOKEN, then macOS Keychain "Claude Code-credentials".
-* Prefer injecting {@link ClaudeCodeAuthStore} when multi-credential is enabled.
-*/
-async function resolveClaudeCodeOAuthAccess() {
-	try {
-		return await new FileClaudeCodeAuthStore().resolveAccess();
-	} catch {
-		return null;
-	}
-}
-//#endregion
 //#region src/quota.ts
 const DEFAULT_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
 const DEFAULT_OAUTH_BETA = "oauth-2025-04-20";
@@ -1227,7 +1245,7 @@ var ClaudeCodeProvider = class {
 			claudePath: options.claudePath,
 			resolveOAuthAccessToken: options.authStore ? async () => {
 				try {
-					return (await options.authStore.resolveAccess()).accessToken;
+					return injectableCliToken(await options.authStore.resolveAccess());
 				} catch {
 					return null;
 				}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@demicodes/provider-claude-code",
   "description": "Claude Code provider adapter for Demi.",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "private": false,
   "type": "module",
   "exports": {