@demicodes/provider-claude-code 0.3.2 → 0.4.0

package/dist/index.d.mts

@@ -11,8 +11,17 @@ type ModelCatalogFetch = (input: string | URL | Request, init?: RequestInit) =>
 declare function listClaudeCodeModels(options?: ClaudeCodeModelCatalogOptions): Promise<ProviderModelList>;
 //#endregion
 //#region src/oauth.d.ts
+/**
+ * Where a resolved token came from. Callers that inject the token into a
+ * spawned CLI must skip `keychain`: that token is the CLI's own short-lived
+ * credential, and injecting it via CLAUDE_CODE_OAUTH_TOKEN disables the CLI's
+ * refresh flow — the run starts 401ing as soon as the token expires. Owned
+ * sources (static/file/env) are the caller's responsibility and inject as-is.
+ */
+type ClaudeCodeOAuthSource = 'static' | 'file' | 'env' | 'keychain';
 interface ClaudeCodeOAuthAccess {
   accessToken: string;
+  source: ClaudeCodeOAuthSource;
   subscriptionType?: string | null;
   rateLimitTier?: string | null;
 }
@@ -30,11 +39,15 @@ interface ClaudeCodeAuthStore {
     forceRefresh?: boolean;
   }): Promise<ClaudeCodeOAuthAccess>;
 }
+/** Renews a pool oauth secret (wired to `refreshClaudeCodeSecret`; injectable in tests). */
+type ClaudeCodeSecretRefresh = (secret: Record<string, unknown>) => Promise<Record<string, unknown>>;
 interface FileClaudeCodeAuthStoreOptions {
   /** Optional path to oauth.json (pool entry). */
   oauthFile?: string;
   /** Prefer this token over env/keychain when set (tests / static). */
   accessToken?: string | null;
+  /** Renews the oauth file when its access token nears expiry. */
+  refresh?: ClaudeCodeSecretRefresh;
 }
 /**
  * Resolves Claude OAuth: explicit token → oauth file → CLAUDE_CODE_OAUTH_TOKEN → keychain.
@@ -42,6 +55,7 @@ interface FileClaudeCodeAuthStoreOptions {
 declare class FileClaudeCodeAuthStore implements ClaudeCodeAuthStore {
   private readonly oauthFile;
   private readonly accessToken;
+  private readonly refresh;
   constructor(options?: FileClaudeCodeAuthStoreOptions);
   status(): Promise<ProviderAuthState>;
   resolveAccess(): Promise<ClaudeCodeOAuthAccess>;
@@ -106,10 +120,44 @@ declare function openClaudeCodeCredentialPool(options?: {
   stateDir?: string;
 }): FileCredentialPool;
 declare function createClaudeCodeCredentials(pool: FileCredentialPool, authStore: ClaudeCodeAuthStore, options?: {
-  loginCommand?: string;
-  loginArgs?: string[];
   quota?: ProviderQuota | null;
   onActiveChange?: () => void;
+  /** Injectable fetch for the OAuth login flow (tests). */
+  loginFetch?: typeof fetch;
 }): ProviderCredentials;
 //#endregion
-export { type ClaudeCodeAuthStore, type ClaudeCodeModelCatalogOptions, type ClaudeCodeOAuthAccess, type ClaudeCodeProviderOptions, type ClaudeCodeQuotaOptions, FileClaudeCodeAuthStore, PoolAwareClaudeCodeAuthStore, StaticClaudeCodeAuthStore, createClaudeCodeCredentials, createClaudeCodeProvider, createClaudeCodeQuota, listClaudeCodeModels, mapClaudeUsagePayload, observeClaudeRateLimitHeaders, observeClaudeStreamBody, openClaudeCodeCredentialPool, resolveClaudeCodeOAuthAccess, resolveWireLogDir };
+//#region src/login.d.ts
+/** Pool-entry oauth.json shape (demi-owned; refreshable when refreshToken present). */
+interface ClaudeCodeOAuthSecret {
+  accessToken: string;
+  refreshToken?: string | null;
+  /** ISO-8601 access token expiry. */
+  expiresAt?: string | null;
+  scopes?: string[] | null;
+  subscriptionType?: string | null;
+  rateLimitTier?: string | null;
+  emailAddress?: string | null;
+  [key: string]: unknown;
+}
+interface ClaudeCodeLoginOptions {
+  signal?: AbortSignal;
+  /** Fires once with the authorize URL; the flow then waits on promptForCode. */
+  onPending?: (pending: {
+    verificationUrl: string;
+    requiresCodeInput: true;
+  }) => void;
+  /** Collects the "code#state" string the vendor page shows after approval. */
+  promptForCode: () => Promise<string>;
+  fetch?: typeof fetch;
+  consoleBase?: string;
+}
+/** Runs the copy-back OAuth flow and returns a refreshable pool secret. */
+declare function runClaudeCodeLogin(options: ClaudeCodeLoginOptions): Promise<ClaudeCodeOAuthSecret>;
+/** Refreshes a pool secret in place; returns the renewed secret. */
+declare function refreshClaudeCodeSecret(secret: ClaudeCodeOAuthSecret, options?: {
+  fetch?: typeof fetch;
+  consoleBase?: string;
+  signal?: AbortSignal;
+}): Promise<ClaudeCodeOAuthSecret>;
+//#endregion
+export { type ClaudeCodeAuthStore, type ClaudeCodeLoginOptions, type ClaudeCodeModelCatalogOptions, type ClaudeCodeOAuthAccess, type ClaudeCodeOAuthSecret, type ClaudeCodeProviderOptions, type ClaudeCodeQuotaOptions, FileClaudeCodeAuthStore, PoolAwareClaudeCodeAuthStore, StaticClaudeCodeAuthStore, createClaudeCodeCredentials, createClaudeCodeProvider, createClaudeCodeQuota, listClaudeCodeModels, mapClaudeUsagePayload, observeClaudeRateLimitHeaders, observeClaudeStreamBody, openClaudeCodeCredentialPool, refreshClaudeCodeSecret, resolveClaudeCodeOAuthAccess, resolveWireLogDir, runClaudeCodeLogin };

package/dist/index.mjs

@@ -1,11 +1,11 @@
 import { errorMessage, isRecord, nonEmptyString, numberOrNull, stringOrNull } from "@demicodes/utils";
-import { createHash, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { applyModelPolicy, clampUsedPercent, createProviderQuota, defineProvider, numberHeader, severityFromUsedPercent, toolResultContentToText, unixSecondsToIso } from "@demicodes/provider";
 import { execFile, spawn } from "node:child_process";
-import { readFile } from "node:fs/promises";
+import { readFile, writeFile } from "node:fs/promises";
 import { promisify } from "node:util";
 import process$1 from "node:process";
-import { FileCredentialPool, credentialIdFromIdentity, runVendorLoginCommand } from "@demicodes/provider/credentials-pool";
+import { FileCredentialPool, credentialIdFromIdentity } from "@demicodes/provider/credentials-pool";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { appendFileSync, mkdirSync, statSync } from "node:fs";
 import { createInterface } from "node:readline";
@@ -202,15 +202,18 @@ function reasoningEfforts(value) {
 //#endregion
 //#region src/auth.ts
 const execFileAsync = promisify(execFile);
+const OAUTH_EXPIRY_SKEW_MS = 300 * 1e3;
 /**
 * Resolves Claude OAuth: explicit token → oauth file → CLAUDE_CODE_OAUTH_TOKEN → keychain.
 */
 var FileClaudeCodeAuthStore = class {
 	oauthFile;
 	accessToken;
+	refresh;
 	constructor(options = {}) {
 		this.oauthFile = options.oauthFile ?? null;
 		this.accessToken = nonEmptyString(options.accessToken) ?? null;
+		this.refresh = options.refresh ?? null;
 	}
 	async status() {
 		try {
@@ -230,14 +233,24 @@ var FileClaudeCodeAuthStore = class {
 		}
 	}
 	async resolveAccess() {
-		if (this.accessToken) return { accessToken: this.accessToken };
+		if (this.accessToken) return {
+			accessToken: this.accessToken,
+			source: "static"
+		};
 		if (this.oauthFile) try {
-			const raw = JSON.parse(await readFile(this.oauthFile, "utf8"));
+			let raw = JSON.parse(await readFile(this.oauthFile, "utf8"));
+			if (!isRecord(raw)) throw new ClaudeCodeAuthError("auth_invalid", `Invalid OAuth file: ${this.oauthFile}`);
+			const expiresAt = nonEmptyString(raw.expiresAt);
+			if (expiresAt !== void 0 && Date.parse(expiresAt) - Date.now() < OAUTH_EXPIRY_SKEW_MS && nonEmptyString(raw.refreshToken) && this.refresh) {
+				raw = await this.refresh(raw);
+				await writeFile(this.oauthFile, `${JSON.stringify(raw, null, 2)}\n`);
+			}
 			if (!isRecord(raw)) throw new ClaudeCodeAuthError("auth_invalid", `Invalid OAuth file: ${this.oauthFile}`);
 			const accessToken = nonEmptyString(raw.accessToken) ?? nonEmptyString(raw.access_token);
 			if (!accessToken) throw new ClaudeCodeAuthError("auth_missing", `No accessToken in ${this.oauthFile}`);
 			return {
 				accessToken,
+				source: "file",
 				subscriptionType: nonEmptyString(raw.subscriptionType) ?? null,
 				rateLimitTier: nonEmptyString(raw.rateLimitTier) ?? null
 			};
@@ -246,7 +259,10 @@ var FileClaudeCodeAuthStore = class {
 			throw new ClaudeCodeAuthError("auth_missing", `Failed to read Claude OAuth file ${this.oauthFile}: ${error instanceof Error ? error.message : String(error)}`);
 		}
 		const fromEnv = nonEmptyString(process$1.env.CLAUDE_CODE_OAUTH_TOKEN);
-		if (fromEnv) return { accessToken: fromEnv };
+		if (fromEnv) return {
+			accessToken: fromEnv,
+			source: "env"
+		};
 		if (process$1.platform === "darwin") try {
 			const { stdout } = await execFileAsync("security", [
 				"find-generic-password",
@@ -265,6 +281,7 @@ var FileClaudeCodeAuthStore = class {
 			if (!accessToken) throw new ClaudeCodeAuthError("auth_missing", "Claude Code keychain missing accessToken");
 			return {
 				accessToken,
+				source: "keychain",
 				subscriptionType: nonEmptyString(oauth.subscriptionType) ?? null,
 				rateLimitTier: nonEmptyString(oauth.rateLimitTier) ?? null
 			};
@@ -298,6 +315,93 @@ var ClaudeCodeAuthError = class extends Error {
 	}
 };
 //#endregion
+//#region src/login.ts
+const CLAUDE_AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+const CLAUDE_CONSOLE_BASE = "https://console.anthropic.com";
+const CLAUDE_CODE_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+const CLAUDE_LOGIN_SCOPE = "org:create_api_key user:profile user:inference";
+function tokenEndpoint(consoleBase) {
+	return `${consoleBase.replace(/\/+$/, "")}/v1/oauth/token`;
+}
+async function requestTokens(fetchImpl, consoleBase, body, signal) {
+	const response = await fetchImpl(tokenEndpoint(consoleBase), {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify(body),
+		signal
+	});
+	if (!response.ok) throw new ClaudeCodeAuthError("auth_invalid", `Claude OAuth token request failed with HTTP ${response.status}`);
+	const parsed = await response.json().catch(() => null);
+	if (!isRecord(parsed)) throw new ClaudeCodeAuthError("auth_invalid", "Claude OAuth token response is not a JSON object");
+	const accessToken = nonEmptyString(parsed.access_token);
+	if (!accessToken) throw new ClaudeCodeAuthError("auth_invalid", "Claude OAuth token response is missing access_token");
+	const expiresIn = Number(parsed.expires_in);
+	const account = isRecord(parsed.account) ? parsed.account : {};
+	return {
+		accessToken,
+		refreshToken: nonEmptyString(parsed.refresh_token) ?? null,
+		expiresAt: Number.isFinite(expiresIn) && expiresIn > 0 ? new Date(Date.now() + expiresIn * 1e3).toISOString() : null,
+		scopes: typeof parsed.scope === "string" ? parsed.scope.split(" ").filter(Boolean) : null,
+		subscriptionType: nonEmptyString(parsed.subscription_type) ?? nonEmptyString(account.subscription_type) ?? null,
+		...nonEmptyString(account.email_address) ? { emailAddress: nonEmptyString(account.email_address) } : {}
+	};
+}
+/** Runs the copy-back OAuth flow and returns a refreshable pool secret. */
+async function runClaudeCodeLogin(options) {
+	const fetchImpl = options.fetch ?? fetch;
+	const consoleBase = options.consoleBase ?? CLAUDE_CONSOLE_BASE;
+	const verifier = randomBytes(32).toString("base64url");
+	const challenge = createHash("sha256").update(verifier).digest("base64url");
+	const state = randomBytes(32).toString("base64url");
+	const redirectUri = `${consoleBase.replace(/\/+$/, "")}/oauth/code/callback`;
+	const params = new URLSearchParams({
+		code: "true",
+		client_id: CLAUDE_CODE_CLIENT_ID,
+		response_type: "code",
+		redirect_uri: redirectUri,
+		scope: CLAUDE_LOGIN_SCOPE,
+		code_challenge: challenge,
+		code_challenge_method: "S256",
+		state
+	});
+	options.onPending?.({
+		verificationUrl: `${CLAUDE_AUTHORIZE_URL}?${params.toString()}`,
+		requiresCodeInput: true
+	});
+	const pasted = (await options.promptForCode()).trim();
+	if (!pasted) throw new ClaudeCodeAuthError("auth_invalid", "Empty authorization code");
+	const [code, returnedState] = pasted.split("#");
+	if (!nonEmptyString(code)) throw new ClaudeCodeAuthError("auth_invalid", "Authorization code is missing the code part");
+	if (returnedState && returnedState !== state) throw new ClaudeCodeAuthError("auth_invalid", "Authorization code state mismatch — copy the full string from the callback page");
+	return requestTokens(fetchImpl, consoleBase, {
+		grant_type: "authorization_code",
+		code,
+		state: returnedState ?? state,
+		client_id: CLAUDE_CODE_CLIENT_ID,
+		redirect_uri: redirectUri,
+		code_verifier: verifier
+	}, options.signal);
+}
+/** Refreshes a pool secret in place; returns the renewed secret. */
+async function refreshClaudeCodeSecret(secret, options = {}) {
+	const refreshToken = nonEmptyString(secret.refreshToken);
+	if (!refreshToken) throw new ClaudeCodeAuthError("auth_missing", "Claude OAuth secret has no refreshToken to renew with");
+	const renewed = await requestTokens(options.fetch ?? fetch, options.consoleBase ?? CLAUDE_CONSOLE_BASE, {
+		grant_type: "refresh_token",
+		refresh_token: refreshToken,
+		client_id: CLAUDE_CODE_CLIENT_ID
+	}, options.signal);
+	return {
+		...secret,
+		accessToken: renewed.accessToken,
+		refreshToken: renewed.refreshToken ?? refreshToken,
+		expiresAt: renewed.expiresAt ?? secret.expiresAt ?? null,
+		scopes: renewed.scopes ?? secret.scopes ?? null,
+		subscriptionType: renewed.subscriptionType ?? secret.subscriptionType ?? null,
+		...nonEmptyString(renewed.emailAddress) ? { emailAddress: renewed.emailAddress } : {}
+	};
+}
+//#endregion
 //#region src/credentials.ts
 var PoolAwareClaudeCodeAuthStore = class {
 	pool;
@@ -313,7 +417,10 @@ var PoolAwareClaudeCodeAuthStore = class {
 	async currentStore() {
 		await this.pool.ensureActivePointer();
 		const activeId = await this.pool.getActiveId();
-		if (activeId) return new FileClaudeCodeAuthStore({ oauthFile: this.pool.secretPath(activeId) });
+		if (activeId) return new FileClaudeCodeAuthStore({
+			oauthFile: this.pool.secretPath(activeId),
+			refresh: (secret) => refreshClaudeCodeSecret(secret)
+		});
 		return new FileClaudeCodeAuthStore();
 	}
 };
@@ -325,8 +432,6 @@ function openClaudeCodeCredentialPool(options = {}) {
 	});
 }
 function createClaudeCodeCredentials(pool, authStore, options = {}) {
-	const loginCommand = options.loginCommand ?? "claude";
-	const loginArgs = options.loginArgs ?? ["auth", "login"];
 	const capability = () => ({
 		mode: "supported",
 		canBeginLogin: true,
@@ -377,23 +482,58 @@ function createClaudeCodeCredentials(pool, authStore, options = {}) {
 			updatedAt: meta.updatedAt
 		};
 	};
+	const importSecret = async (secret, source) => {
+		const email = nonEmptyString(secret.emailAddress);
+		const identityKey = email ? `email:${email}` : `token:${createHash("sha256").update(secret.accessToken).digest("hex").slice(0, 16)}`;
+		const label = email ?? nonEmptyString(secret.subscriptionType) ?? `claude-${identityKey.slice(-8)}`;
+		const id = (await pool.findByIdentityKey(identityKey))?.id ?? credentialIdFromIdentity(identityKey, label);
+		const meta = {
+			id,
+			label,
+			detail: nonEmptyString(secret.subscriptionType) ?? nonEmptyString(secret.rateLimitTier) ?? null,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			source,
+			identityKey
+		};
+		await pool.writeEntry(meta, `${JSON.stringify(secret, null, 2)}\n`);
+		if (!await pool.getActiveId()) await pool.setActiveId(id);
+		options.quota?.clearLatest?.();
+		options.onActiveChange?.();
+		return {
+			id: meta.id,
+			label: meta.label,
+			detail: meta.detail,
+			updatedAt: meta.updatedAt
+		};
+	};
 	return {
 		capability,
 		list: () => pool.list(),
 		getActive,
 		setActive,
 		beginLogin: async (loginOptions) => {
-			const result = await runVendorLoginCommand(loginCommand, loginArgs, { signal: loginOptions?.signal });
-			if (result.status === "completed") return { status: "completed" };
-			if (result.status === "cancelled") return { status: "cancelled" };
-			if (result.status === "unavailable") return {
+			if (!loginOptions?.promptForCode) return {
 				status: "unavailable",
-				message: result.message ?? "Login unavailable"
-			};
-			return {
-				status: "failed",
-				message: result.message ?? "Login failed"
+				message: "Claude login requires promptForCode to collect the pasted authorization code"
 			};
+			try {
+				const secret = await runClaudeCodeLogin({
+					signal: loginOptions.signal,
+					onPending: loginOptions.onPending,
+					promptForCode: loginOptions.promptForCode,
+					fetch: options.loginFetch
+				});
+				return {
+					status: "completed",
+					credentialId: (await importSecret(secret, "login:oauth")).id
+				};
+			} catch (error) {
+				if (loginOptions.signal?.aborted) return { status: "cancelled" };
+				return {
+					status: "failed",
+					message: errorMessage(error)
+				};
+			}
 		},
 		importDefault: async () => {
 			const vendor = new FileClaudeCodeAuthStore();
@@ -408,6 +548,7 @@ function createClaudeCodeCredentials(pool, authStore, options = {}) {
 		add: async (input) => {
 			if (typeof input.accessToken === "string") return importAccess({
 				accessToken: input.accessToken,
+				source: "static",
 				subscriptionType: typeof input.subscriptionType === "string" ? input.subscriptionType : null,
 				rateLimitTier: typeof input.rateLimitTier === "string" ? input.rateLimitTier : null
 			}, "add:accessToken");
@@ -415,6 +556,7 @@ function createClaudeCodeCredentials(pool, authStore, options = {}) {
 				const oauth = input.oauth;
 				return importAccess({
 					accessToken: oauth.accessToken,
+					source: "static",
 					subscriptionType: typeof oauth.subscriptionType === "string" ? oauth.subscriptionType : null,
 					rateLimitTier: typeof oauth.rateLimitTier === "string" ? oauth.rateLimitTier : null
 				}, "add:oauth");
@@ -663,6 +805,28 @@ function toolNameToClaude(name) {
 	return `mcp__main__${name}`;
 }
 //#endregion
+//#region src/oauth.ts
+/**
+* The token to inject into a spawned CLI as CLAUDE_CODE_OAUTH_TOKEN, or null
+* to let the CLI authenticate itself. Keychain-sourced tokens are never
+* injected — see {@link ClaudeCodeOAuthSource}.
+*/
+function injectableCliToken(access) {
+	return access.source === "keychain" ? null : access.accessToken;
+}
+/**
+* Resolve Claude Code consumer OAuth access for quota APIs.
+* Order: options env CLAUDE_CODE_OAUTH_TOKEN, then macOS Keychain "Claude Code-credentials".
+* Prefer injecting {@link ClaudeCodeAuthStore} when multi-credential is enabled.
+*/
+async function resolveClaudeCodeOAuthAccess() {
+	try {
+		return await new FileClaudeCodeAuthStore().resolveAccess();
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region src/output.ts
 function mapClaudeStdoutMessage(message, options = {}) {
 	const events = [];
@@ -872,20 +1036,6 @@ function stripMcpToolPrefix(name) {
 	return /^mcp__[^_]+__(.+)$/.exec(name)?.[1] ?? name;
 }
 //#endregion
-//#region src/oauth.ts
-/**
-* Resolve Claude Code consumer OAuth access for quota APIs.
-* Order: options env CLAUDE_CODE_OAUTH_TOKEN, then macOS Keychain "Claude Code-credentials".
-* Prefer injecting {@link ClaudeCodeAuthStore} when multi-credential is enabled.
-*/
-async function resolveClaudeCodeOAuthAccess() {
-	try {
-		return await new FileClaudeCodeAuthStore().resolveAccess();
-	} catch {
-		return null;
-	}
-}
-//#endregion
 //#region src/quota.ts
 const DEFAULT_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
 const DEFAULT_OAUTH_BETA = "oauth-2025-04-20";
@@ -1227,7 +1377,7 @@ var ClaudeCodeProvider = class {
 			claudePath: options.claudePath,
 			resolveOAuthAccessToken: options.authStore ? async () => {
 				try {
-					return (await options.authStore.resolveAccess()).accessToken;
+					return injectableCliToken(await options.authStore.resolveAccess());
 				} catch {
 					return null;
 				}
@@ -1631,4 +1781,4 @@ function itemsDiverged(active, items) {
 	return false;
 }
 //#endregion
-export { FileClaudeCodeAuthStore, PoolAwareClaudeCodeAuthStore, StaticClaudeCodeAuthStore, createClaudeCodeCredentials, createClaudeCodeProvider, createClaudeCodeQuota, listClaudeCodeModels, mapClaudeUsagePayload, observeClaudeRateLimitHeaders, observeClaudeStreamBody, openClaudeCodeCredentialPool, resolveClaudeCodeOAuthAccess, resolveWireLogDir };
+export { FileClaudeCodeAuthStore, PoolAwareClaudeCodeAuthStore, StaticClaudeCodeAuthStore, createClaudeCodeCredentials, createClaudeCodeProvider, createClaudeCodeQuota, listClaudeCodeModels, mapClaudeUsagePayload, observeClaudeRateLimitHeaders, observeClaudeStreamBody, openClaudeCodeCredentialPool, refreshClaudeCodeSecret, resolveClaudeCodeOAuthAccess, resolveWireLogDir, runClaudeCodeLogin };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@demicodes/provider-claude-code",
   "description": "Claude Code provider adapter for Demi.",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "private": false,
   "type": "module",
   "exports": {
@@ -12,11 +12,11 @@
   },
   "dependencies": {
     "@demicodes/core": "^0.3.2",
-    "@demicodes/provider": "^0.3.2",
+    "@demicodes/provider": "^0.4.0",
     "@demicodes/utils": "^0.3.2"
   },
   "devDependencies": {
-    "@demicodes/agent": "^0.3.2",
+    "@demicodes/agent": "^0.3.3",
     "@demicodes/shell": "^0.3.2"
   },
   "license": "Apache-2.0",