@demicodes/provider-claude-code 0.3.3 → 0.4.0

package/dist/index.d.mts

@@ -39,11 +39,15 @@ interface ClaudeCodeAuthStore {
     forceRefresh?: boolean;
   }): Promise<ClaudeCodeOAuthAccess>;
 }
+/** Renews a pool oauth secret (wired to `refreshClaudeCodeSecret`; injectable in tests). */
+type ClaudeCodeSecretRefresh = (secret: Record<string, unknown>) => Promise<Record<string, unknown>>;
 interface FileClaudeCodeAuthStoreOptions {
   /** Optional path to oauth.json (pool entry). */
   oauthFile?: string;
   /** Prefer this token over env/keychain when set (tests / static). */
   accessToken?: string | null;
+  /** Renews the oauth file when its access token nears expiry. */
+  refresh?: ClaudeCodeSecretRefresh;
 }
 /**
  * Resolves Claude OAuth: explicit token → oauth file → CLAUDE_CODE_OAUTH_TOKEN → keychain.
@@ -51,6 +55,7 @@ interface FileClaudeCodeAuthStoreOptions {
 declare class FileClaudeCodeAuthStore implements ClaudeCodeAuthStore {
   private readonly oauthFile;
   private readonly accessToken;
+  private readonly refresh;
   constructor(options?: FileClaudeCodeAuthStoreOptions);
   status(): Promise<ProviderAuthState>;
   resolveAccess(): Promise<ClaudeCodeOAuthAccess>;
@@ -115,10 +120,44 @@ declare function openClaudeCodeCredentialPool(options?: {
   stateDir?: string;
 }): FileCredentialPool;
 declare function createClaudeCodeCredentials(pool: FileCredentialPool, authStore: ClaudeCodeAuthStore, options?: {
-  loginCommand?: string;
-  loginArgs?: string[];
   quota?: ProviderQuota | null;
   onActiveChange?: () => void;
+  /** Injectable fetch for the OAuth login flow (tests). */
+  loginFetch?: typeof fetch;
 }): ProviderCredentials;
 //#endregion
-export { type ClaudeCodeAuthStore, type ClaudeCodeModelCatalogOptions, type ClaudeCodeOAuthAccess, type ClaudeCodeProviderOptions, type ClaudeCodeQuotaOptions, FileClaudeCodeAuthStore, PoolAwareClaudeCodeAuthStore, StaticClaudeCodeAuthStore, createClaudeCodeCredentials, createClaudeCodeProvider, createClaudeCodeQuota, listClaudeCodeModels, mapClaudeUsagePayload, observeClaudeRateLimitHeaders, observeClaudeStreamBody, openClaudeCodeCredentialPool, resolveClaudeCodeOAuthAccess, resolveWireLogDir };
+//#region src/login.d.ts
+/** Pool-entry oauth.json shape (demi-owned; refreshable when refreshToken present). */
+interface ClaudeCodeOAuthSecret {
+  accessToken: string;
+  refreshToken?: string | null;
+  /** ISO-8601 access token expiry. */
+  expiresAt?: string | null;
+  scopes?: string[] | null;
+  subscriptionType?: string | null;
+  rateLimitTier?: string | null;
+  emailAddress?: string | null;
+  [key: string]: unknown;
+}
+interface ClaudeCodeLoginOptions {
+  signal?: AbortSignal;
+  /** Fires once with the authorize URL; the flow then waits on promptForCode. */
+  onPending?: (pending: {
+    verificationUrl: string;
+    requiresCodeInput: true;
+  }) => void;
+  /** Collects the "code#state" string the vendor page shows after approval. */
+  promptForCode: () => Promise<string>;
+  fetch?: typeof fetch;
+  consoleBase?: string;
+}
+/** Runs the copy-back OAuth flow and returns a refreshable pool secret. */
+declare function runClaudeCodeLogin(options: ClaudeCodeLoginOptions): Promise<ClaudeCodeOAuthSecret>;
+/** Refreshes a pool secret in place; returns the renewed secret. */
+declare function refreshClaudeCodeSecret(secret: ClaudeCodeOAuthSecret, options?: {
+  fetch?: typeof fetch;
+  consoleBase?: string;
+  signal?: AbortSignal;
+}): Promise<ClaudeCodeOAuthSecret>;
+//#endregion
+export { type ClaudeCodeAuthStore, type ClaudeCodeLoginOptions, type ClaudeCodeModelCatalogOptions, type ClaudeCodeOAuthAccess, type ClaudeCodeOAuthSecret, type ClaudeCodeProviderOptions, type ClaudeCodeQuotaOptions, FileClaudeCodeAuthStore, PoolAwareClaudeCodeAuthStore, StaticClaudeCodeAuthStore, createClaudeCodeCredentials, createClaudeCodeProvider, createClaudeCodeQuota, listClaudeCodeModels, mapClaudeUsagePayload, observeClaudeRateLimitHeaders, observeClaudeStreamBody, openClaudeCodeCredentialPool, refreshClaudeCodeSecret, resolveClaudeCodeOAuthAccess, resolveWireLogDir, runClaudeCodeLogin };

package/dist/index.mjs

@@ -1,11 +1,11 @@
 import { errorMessage, isRecord, nonEmptyString, numberOrNull, stringOrNull } from "@demicodes/utils";
-import { createHash, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { applyModelPolicy, clampUsedPercent, createProviderQuota, defineProvider, numberHeader, severityFromUsedPercent, toolResultContentToText, unixSecondsToIso } from "@demicodes/provider";
 import { execFile, spawn } from "node:child_process";
-import { readFile } from "node:fs/promises";
+import { readFile, writeFile } from "node:fs/promises";
 import { promisify } from "node:util";
 import process$1 from "node:process";
-import { FileCredentialPool, credentialIdFromIdentity, runVendorLoginCommand } from "@demicodes/provider/credentials-pool";
+import { FileCredentialPool, credentialIdFromIdentity } from "@demicodes/provider/credentials-pool";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { appendFileSync, mkdirSync, statSync } from "node:fs";
 import { createInterface } from "node:readline";
@@ -202,15 +202,18 @@ function reasoningEfforts(value) {
 //#endregion
 //#region src/auth.ts
 const execFileAsync = promisify(execFile);
+const OAUTH_EXPIRY_SKEW_MS = 300 * 1e3;
 /**
 * Resolves Claude OAuth: explicit token → oauth file → CLAUDE_CODE_OAUTH_TOKEN → keychain.
 */
 var FileClaudeCodeAuthStore = class {
 	oauthFile;
 	accessToken;
+	refresh;
 	constructor(options = {}) {
 		this.oauthFile = options.oauthFile ?? null;
 		this.accessToken = nonEmptyString(options.accessToken) ?? null;
+		this.refresh = options.refresh ?? null;
 	}
 	async status() {
 		try {
@@ -235,7 +238,13 @@ var FileClaudeCodeAuthStore = class {
 			source: "static"
 		};
 		if (this.oauthFile) try {
-			const raw = JSON.parse(await readFile(this.oauthFile, "utf8"));
+			let raw = JSON.parse(await readFile(this.oauthFile, "utf8"));
+			if (!isRecord(raw)) throw new ClaudeCodeAuthError("auth_invalid", `Invalid OAuth file: ${this.oauthFile}`);
+			const expiresAt = nonEmptyString(raw.expiresAt);
+			if (expiresAt !== void 0 && Date.parse(expiresAt) - Date.now() < OAUTH_EXPIRY_SKEW_MS && nonEmptyString(raw.refreshToken) && this.refresh) {
+				raw = await this.refresh(raw);
+				await writeFile(this.oauthFile, `${JSON.stringify(raw, null, 2)}\n`);
+			}
 			if (!isRecord(raw)) throw new ClaudeCodeAuthError("auth_invalid", `Invalid OAuth file: ${this.oauthFile}`);
 			const accessToken = nonEmptyString(raw.accessToken) ?? nonEmptyString(raw.access_token);
 			if (!accessToken) throw new ClaudeCodeAuthError("auth_missing", `No accessToken in ${this.oauthFile}`);
@@ -306,6 +315,93 @@ var ClaudeCodeAuthError = class extends Error {
 	}
 };
 //#endregion
+//#region src/login.ts
+const CLAUDE_AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+const CLAUDE_CONSOLE_BASE = "https://console.anthropic.com";
+const CLAUDE_CODE_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+const CLAUDE_LOGIN_SCOPE = "org:create_api_key user:profile user:inference";
+function tokenEndpoint(consoleBase) {
+	return `${consoleBase.replace(/\/+$/, "")}/v1/oauth/token`;
+}
+async function requestTokens(fetchImpl, consoleBase, body, signal) {
+	const response = await fetchImpl(tokenEndpoint(consoleBase), {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify(body),
+		signal
+	});
+	if (!response.ok) throw new ClaudeCodeAuthError("auth_invalid", `Claude OAuth token request failed with HTTP ${response.status}`);
+	const parsed = await response.json().catch(() => null);
+	if (!isRecord(parsed)) throw new ClaudeCodeAuthError("auth_invalid", "Claude OAuth token response is not a JSON object");
+	const accessToken = nonEmptyString(parsed.access_token);
+	if (!accessToken) throw new ClaudeCodeAuthError("auth_invalid", "Claude OAuth token response is missing access_token");
+	const expiresIn = Number(parsed.expires_in);
+	const account = isRecord(parsed.account) ? parsed.account : {};
+	return {
+		accessToken,
+		refreshToken: nonEmptyString(parsed.refresh_token) ?? null,
+		expiresAt: Number.isFinite(expiresIn) && expiresIn > 0 ? new Date(Date.now() + expiresIn * 1e3).toISOString() : null,
+		scopes: typeof parsed.scope === "string" ? parsed.scope.split(" ").filter(Boolean) : null,
+		subscriptionType: nonEmptyString(parsed.subscription_type) ?? nonEmptyString(account.subscription_type) ?? null,
+		...nonEmptyString(account.email_address) ? { emailAddress: nonEmptyString(account.email_address) } : {}
+	};
+}
+/** Runs the copy-back OAuth flow and returns a refreshable pool secret. */
+async function runClaudeCodeLogin(options) {
+	const fetchImpl = options.fetch ?? fetch;
+	const consoleBase = options.consoleBase ?? CLAUDE_CONSOLE_BASE;
+	const verifier = randomBytes(32).toString("base64url");
+	const challenge = createHash("sha256").update(verifier).digest("base64url");
+	const state = randomBytes(32).toString("base64url");
+	const redirectUri = `${consoleBase.replace(/\/+$/, "")}/oauth/code/callback`;
+	const params = new URLSearchParams({
+		code: "true",
+		client_id: CLAUDE_CODE_CLIENT_ID,
+		response_type: "code",
+		redirect_uri: redirectUri,
+		scope: CLAUDE_LOGIN_SCOPE,
+		code_challenge: challenge,
+		code_challenge_method: "S256",
+		state
+	});
+	options.onPending?.({
+		verificationUrl: `${CLAUDE_AUTHORIZE_URL}?${params.toString()}`,
+		requiresCodeInput: true
+	});
+	const pasted = (await options.promptForCode()).trim();
+	if (!pasted) throw new ClaudeCodeAuthError("auth_invalid", "Empty authorization code");
+	const [code, returnedState] = pasted.split("#");
+	if (!nonEmptyString(code)) throw new ClaudeCodeAuthError("auth_invalid", "Authorization code is missing the code part");
+	if (returnedState && returnedState !== state) throw new ClaudeCodeAuthError("auth_invalid", "Authorization code state mismatch — copy the full string from the callback page");
+	return requestTokens(fetchImpl, consoleBase, {
+		grant_type: "authorization_code",
+		code,
+		state: returnedState ?? state,
+		client_id: CLAUDE_CODE_CLIENT_ID,
+		redirect_uri: redirectUri,
+		code_verifier: verifier
+	}, options.signal);
+}
+/** Refreshes a pool secret in place; returns the renewed secret. */
+async function refreshClaudeCodeSecret(secret, options = {}) {
+	const refreshToken = nonEmptyString(secret.refreshToken);
+	if (!refreshToken) throw new ClaudeCodeAuthError("auth_missing", "Claude OAuth secret has no refreshToken to renew with");
+	const renewed = await requestTokens(options.fetch ?? fetch, options.consoleBase ?? CLAUDE_CONSOLE_BASE, {
+		grant_type: "refresh_token",
+		refresh_token: refreshToken,
+		client_id: CLAUDE_CODE_CLIENT_ID
+	}, options.signal);
+	return {
+		...secret,
+		accessToken: renewed.accessToken,
+		refreshToken: renewed.refreshToken ?? refreshToken,
+		expiresAt: renewed.expiresAt ?? secret.expiresAt ?? null,
+		scopes: renewed.scopes ?? secret.scopes ?? null,
+		subscriptionType: renewed.subscriptionType ?? secret.subscriptionType ?? null,
+		...nonEmptyString(renewed.emailAddress) ? { emailAddress: renewed.emailAddress } : {}
+	};
+}
+//#endregion
 //#region src/credentials.ts
 var PoolAwareClaudeCodeAuthStore = class {
 	pool;
@@ -321,7 +417,10 @@ var PoolAwareClaudeCodeAuthStore = class {
 	async currentStore() {
 		await this.pool.ensureActivePointer();
 		const activeId = await this.pool.getActiveId();
-		if (activeId) return new FileClaudeCodeAuthStore({ oauthFile: this.pool.secretPath(activeId) });
+		if (activeId) return new FileClaudeCodeAuthStore({
+			oauthFile: this.pool.secretPath(activeId),
+			refresh: (secret) => refreshClaudeCodeSecret(secret)
+		});
 		return new FileClaudeCodeAuthStore();
 	}
 };
@@ -333,8 +432,6 @@ function openClaudeCodeCredentialPool(options = {}) {
 	});
 }
 function createClaudeCodeCredentials(pool, authStore, options = {}) {
-	const loginCommand = options.loginCommand ?? "claude";
-	const loginArgs = options.loginArgs ?? ["auth", "login"];
 	const capability = () => ({
 		mode: "supported",
 		canBeginLogin: true,
@@ -385,23 +482,58 @@ function createClaudeCodeCredentials(pool, authStore, options = {}) {
 			updatedAt: meta.updatedAt
 		};
 	};
+	const importSecret = async (secret, source) => {
+		const email = nonEmptyString(secret.emailAddress);
+		const identityKey = email ? `email:${email}` : `token:${createHash("sha256").update(secret.accessToken).digest("hex").slice(0, 16)}`;
+		const label = email ?? nonEmptyString(secret.subscriptionType) ?? `claude-${identityKey.slice(-8)}`;
+		const id = (await pool.findByIdentityKey(identityKey))?.id ?? credentialIdFromIdentity(identityKey, label);
+		const meta = {
+			id,
+			label,
+			detail: nonEmptyString(secret.subscriptionType) ?? nonEmptyString(secret.rateLimitTier) ?? null,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			source,
+			identityKey
+		};
+		await pool.writeEntry(meta, `${JSON.stringify(secret, null, 2)}\n`);
+		if (!await pool.getActiveId()) await pool.setActiveId(id);
+		options.quota?.clearLatest?.();
+		options.onActiveChange?.();
+		return {
+			id: meta.id,
+			label: meta.label,
+			detail: meta.detail,
+			updatedAt: meta.updatedAt
+		};
+	};
 	return {
 		capability,
 		list: () => pool.list(),
 		getActive,
 		setActive,
 		beginLogin: async (loginOptions) => {
-			const result = await runVendorLoginCommand(loginCommand, loginArgs, { signal: loginOptions?.signal });
-			if (result.status === "completed") return { status: "completed" };
-			if (result.status === "cancelled") return { status: "cancelled" };
-			if (result.status === "unavailable") return {
+			if (!loginOptions?.promptForCode) return {
 				status: "unavailable",
-				message: result.message ?? "Login unavailable"
-			};
-			return {
-				status: "failed",
-				message: result.message ?? "Login failed"
+				message: "Claude login requires promptForCode to collect the pasted authorization code"
 			};
+			try {
+				const secret = await runClaudeCodeLogin({
+					signal: loginOptions.signal,
+					onPending: loginOptions.onPending,
+					promptForCode: loginOptions.promptForCode,
+					fetch: options.loginFetch
+				});
+				return {
+					status: "completed",
+					credentialId: (await importSecret(secret, "login:oauth")).id
+				};
+			} catch (error) {
+				if (loginOptions.signal?.aborted) return { status: "cancelled" };
+				return {
+					status: "failed",
+					message: errorMessage(error)
+				};
+			}
 		},
 		importDefault: async () => {
 			const vendor = new FileClaudeCodeAuthStore();
@@ -1649,4 +1781,4 @@ function itemsDiverged(active, items) {
 	return false;
 }
 //#endregion
-export { FileClaudeCodeAuthStore, PoolAwareClaudeCodeAuthStore, StaticClaudeCodeAuthStore, createClaudeCodeCredentials, createClaudeCodeProvider, createClaudeCodeQuota, listClaudeCodeModels, mapClaudeUsagePayload, observeClaudeRateLimitHeaders, observeClaudeStreamBody, openClaudeCodeCredentialPool, resolveClaudeCodeOAuthAccess, resolveWireLogDir };
+export { FileClaudeCodeAuthStore, PoolAwareClaudeCodeAuthStore, StaticClaudeCodeAuthStore, createClaudeCodeCredentials, createClaudeCodeProvider, createClaudeCodeQuota, listClaudeCodeModels, mapClaudeUsagePayload, observeClaudeRateLimitHeaders, observeClaudeStreamBody, openClaudeCodeCredentialPool, refreshClaudeCodeSecret, resolveClaudeCodeOAuthAccess, resolveWireLogDir, runClaudeCodeLogin };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@demicodes/provider-claude-code",
   "description": "Claude Code provider adapter for Demi.",
-  "version": "0.3.3",
+  "version": "0.4.0",
   "private": false,
   "type": "module",
   "exports": {
@@ -12,11 +12,11 @@
   },
   "dependencies": {
     "@demicodes/core": "^0.3.2",
-    "@demicodes/provider": "^0.3.2",
+    "@demicodes/provider": "^0.4.0",
     "@demicodes/utils": "^0.3.2"
   },
   "devDependencies": {
-    "@demicodes/agent": "^0.3.2",
+    "@demicodes/agent": "^0.3.3",
     "@demicodes/shell": "^0.3.2"
   },
   "license": "Apache-2.0",