@georgedong32/ccs 7.66.0

package/dist/cliproxy/auth/token-expiry-checker.js

@@ -0,0 +1,124 @@
+"use strict";
+/**
+ * Token Expiry Checker
+ *
+ * Inspects token files to determine expiry times and refresh requirements.
+ * Supports expiry_date field with fallback to file modification time.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAllTokenExpiryInfo = exports.getTokenExpiryInfo = exports.FALLBACK_EXPIRY_MINUTES = exports.PREEMPTIVE_REFRESH_MINUTES = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const profile_detector_1 = require("../../auth/profile-detector");
+const account_manager_1 = require("../account-manager");
+const provider_refreshers_1 = require("./provider-refreshers");
+/** Preemptive refresh time: refresh tokens 45 minutes before expiry */
+exports.PREEMPTIVE_REFRESH_MINUTES = 45;
+/** Fallback expiry: assume 50 minutes if no expiry_date field */
+exports.FALLBACK_EXPIRY_MINUTES = 50;
+/** Maximum token file size in bytes (1MB) - prevent DoS from huge files */
+const MAX_TOKEN_FILE_SIZE = 1024 * 1024;
+/**
+ * Get token expiry info for a specific account
+ * @returns null if token file doesn't exist or is invalid
+ */
+function getTokenExpiryInfo(provider, accountId) {
+    const account = (0, account_manager_1.getProviderAccounts)(provider).find((a) => a.id === accountId);
+    if (!account) {
+        return null;
+    }
+    const tokenPath = (0, account_manager_1.getAccountTokenPath)(account);
+    if (!tokenPath || !fs.existsSync(tokenPath)) {
+        return null;
+    }
+    try {
+        const stats = fs.statSync(tokenPath);
+        // Prevent DoS from huge token files
+        if (stats.size > MAX_TOKEN_FILE_SIZE) {
+            return null;
+        }
+        const content = fs.readFileSync(tokenPath, 'utf-8');
+        const data = JSON.parse(content);
+        // Validate refresh_token exists (required for CCS-managed refresh).
+        // CLIProxy-delegated providers may not expose refresh_token in token files —
+        // CLIProxyAPIPlus manages refresh internally, so skip this check for them.
+        if (!(0, provider_refreshers_1.isRefreshDelegated)(provider)) {
+            if (!data.refresh_token || typeof data.refresh_token !== 'string') {
+                return null;
+            }
+        }
+        // Calculate expiry time with validation
+        let expiresAt;
+        if (data.expiry_date &&
+            typeof data.expiry_date === 'number' &&
+            Number.isFinite(data.expiry_date) &&
+            data.expiry_date > 0) {
+            // Use expiry_date field if valid
+            expiresAt = data.expiry_date;
+        }
+        else {
+            // Fallback: use file mtime + 50 minutes
+            expiresAt = stats.mtime.getTime() + exports.FALLBACK_EXPIRY_MINUTES * 60 * 1000;
+        }
+        // Check if needs refresh (within preemptive window)
+        const now = Date.now();
+        const timeUntilExpiry = expiresAt - now;
+        const preemptiveMs = exports.PREEMPTIVE_REFRESH_MINUTES * 60 * 1000;
+        const needsRefresh = timeUntilExpiry < preemptiveMs;
+        return {
+            provider,
+            accountId,
+            tokenFile: path.basename(tokenPath),
+            expiresAt,
+            needsRefresh,
+            lastModified: stats.mtime,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+exports.getTokenExpiryInfo = getTokenExpiryInfo;
+/**
+ * Get token expiry info for all accounts across all providers
+ * @returns Array of token expiry info, excluding invalid tokens
+ */
+function getAllTokenExpiryInfo() {
+    const providers = [...profile_detector_1.CLIPROXY_PROFILES];
+    const results = [];
+    for (const provider of providers) {
+        const accounts = (0, account_manager_1.getProviderAccounts)(provider);
+        for (const account of accounts) {
+            const info = getTokenExpiryInfo(provider, account.id);
+            if (info) {
+                results.push(info);
+            }
+        }
+    }
+    return results;
+}
+exports.getAllTokenExpiryInfo = getAllTokenExpiryInfo;
+//# sourceMappingURL=token-expiry-checker.js.map

package/dist/cliproxy/auth/token-expiry-checker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-expiry-checker.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/token-expiry-checker.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAE7B,kEAAgE;AAChE,wDAA8E;AAC9E,+DAA2D;AAE3D,uEAAuE;AAC1D,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAE7C,iEAAiE;AACpD,QAAA,uBAAuB,GAAG,EAAE,CAAC;AAE1C,2EAA2E;AAC3E,MAAM,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAAC;AA4BxC;;;GAGG;AACH,SAAgB,kBAAkB,CAChC,QAA0B,EAC1B,SAAiB;IAEjB,MAAM,OAAO,GAAG,IAAA,qCAAmB,EAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;IAC9E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,IAAA,qCAAmB,EAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAErC,oCAAoC;QACpC,IAAI,KAAK,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,IAAI,GAAc,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE5C,oEAAoE;QACpE,6EAA6E;QAC7E,2EAA2E;QAC3E,IAAI,CAAC,IAAA,wCAAkB,EAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;gBAClE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,IAAI,SAAiB,CAAC;QACtB,IACE,IAAI,CAAC,WAAW;YAChB,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;YACpC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC;YACjC,IAAI,CAAC,WAAW,GAAG,CAAC,EACpB,CAAC;YACD,iCAAiC;YACjC,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,wCAAwC;YACxC,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,+BAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;QAC1E,CAAC;QAED,oDAAoD;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,eAAe,GAAG,SAAS,GAAG,GAAG,CAAC;QACxC,MAAM,YAAY,GAAG,kCAA0B,GAAG,EAAE,GAAG,IAAI,CAAC;QAC5D,MAAM,YAAY,GAAG,eAAe,GAAG,YAAY,CAAC;QAEpD,OAAO;YACL,QAAQ;YACR,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YACnC,SAAS;YACT,YAAY;YACZ,YAAY,EAAE,KAAK,CAAC,KAAK;SAC1B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAjED,gDAiEC;AAED;;;GAGG;AACH,SAAgB,qBAAqB;IACnC,MAAM,SAAS,GAAuB,CAAC,GAAG,oCAAiB,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAA,qCAAmB,EAAC,QAAQ,CAAC,CAAC;QAE/C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACtD,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAhBD,sDAgBC"}

package/dist/cliproxy/auth/token-manager.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Token Manager for CLIProxyAPI
+ *
+ * Handles OAuth token storage, retrieval, and validation.
+ * Tokens are stored in ~/.ccs/cliproxy/auth/ directory.
+ */
+import { CLIProxyProvider } from '../types';
+import { AuthStatus } from './auth-types';
+/**
+ * Get token directory for provider
+ */
+export declare function getProviderTokenDir(provider: CLIProxyProvider): string;
+/**
+ * Check if a JSON file contains a token for the given provider
+ * Reads the file and checks the "type" field
+ */
+export declare function isTokenFileForProvider(filePath: string, provider: CLIProxyProvider): boolean;
+/**
+ * Check if provider has valid authentication
+ * CLIProxyAPI stores OAuth tokens as JSON files in the auth directory.
+ * Detection strategy:
+ * 1. First check by filename prefix (fast path)
+ * 2. If no match, check JSON content for "type" field (Gemini uses {email}-{projectID}.json without prefix)
+ */
+export declare function isAuthenticated(provider: CLIProxyProvider): boolean;
+/**
+ * Get detailed auth status for provider
+ * Uses same detection strategy as isAuthenticated: prefix first, then content
+ */
+export declare function getAuthStatus(provider: CLIProxyProvider): AuthStatus;
+/**
+ * Get auth status for all providers
+ */
+export declare function getAllAuthStatus(): AuthStatus[];
+/**
+ * Clear authentication for provider
+ * Only removes files belonging to the specified provider (by prefix or content)
+ * Does NOT remove the shared auth directory or other providers' files
+ */
+export declare function clearAuth(provider: CLIProxyProvider): boolean;
+/**
+ * Register account from newly created token file
+ * Scans auth directory for new token and extracts email
+ * @param provider - The CLIProxy provider
+ * @param tokenDir - Directory containing token files
+ * @param nickname - Optional nickname (uses auto-generated from email if not provided)
+ */
+export declare function registerAccountFromToken(provider: CLIProxyProvider, tokenDir: string, nickname?: string, verbose?: boolean, expectedAccountId?: string): import('../account-manager').AccountInfo | null;
+/**
+ * Display auth status for all providers
+ */
+export declare function displayAuthStatus(): void;
+/**
+ * Ensure OAuth token is valid for provider, refreshing if expired or expiring soon.
+ * This prevents UND_ERR_SOCKET errors caused by expired tokens during API calls.
+ *
+ * Refresh responsibility:
+ * - gemini: CCS refreshes directly via Google OAuth
+ * - codex, agy, kiro, ghcp, qwen, iflow: CLIProxyAPIPlus handles refresh
+ *   automatically in background (e.g. kiro refreshes every 1 min).
+ *   CCS only checks if token file exists (authentication state).
+ * - claude: not yet implemented
+ *
+ * @param provider The CLIProxy provider
+ * @param verbose Log progress if true
+ * @returns Object with valid status and whether refresh occurred
+ */
+export declare function ensureTokenValid(provider: CLIProxyProvider, verbose?: boolean): Promise<{
+    valid: boolean;
+    refreshed: boolean;
+    error?: string;
+}>;
+//# sourceMappingURL=token-manager.d.ts.map

package/dist/cliproxy/auth/token-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-manager.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/token-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAM5C,OAAO,EACL,UAAU,EAIX,MAAM,cAAc,CAAC;AAEtB;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAEtE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAU5F;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAkCnE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,gBAAgB,GAAG,UAAU,CAoDpE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,UAAU,EAAE,CAG/C;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAkC7D;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,EACjB,OAAO,UAAQ,EACf,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,oBAAoB,EAAE,WAAW,GAAG,IAAI,CAmIjD;AA0CD;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAkBxC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,UAAQ,GACd,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CASjE"}

package/dist/cliproxy/auth/token-manager.js

@@ -0,0 +1,381 @@
+"use strict";
+/**
+ * Token Manager for CLIProxyAPI
+ *
+ * Handles OAuth token storage, retrieval, and validation.
+ * Tokens are stored in ~/.ccs/cliproxy/auth/ directory.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureTokenValid = exports.displayAuthStatus = exports.registerAccountFromToken = exports.clearAuth = exports.getAllAuthStatus = exports.getAuthStatus = exports.isAuthenticated = exports.isTokenFileForProvider = exports.getProviderTokenDir = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const profile_detector_1 = require("../../auth/profile-detector");
+const config_generator_1 = require("../config-generator");
+const account_manager_1 = require("../account-manager");
+const token_file_ops_1 = require("../accounts/token-file-ops");
+const email_account_identity_1 = require("../accounts/email-account-identity");
+const auth_types_1 = require("./auth-types");
+/**
+ * Get token directory for provider
+ */
+function getProviderTokenDir(provider) {
+    return (0, config_generator_1.getProviderAuthDir)(provider);
+}
+exports.getProviderTokenDir = getProviderTokenDir;
+/**
+ * Check if a JSON file contains a token for the given provider
+ * Reads the file and checks the "type" field
+ */
+function isTokenFileForProvider(filePath, provider) {
+    try {
+        const content = fs.readFileSync(filePath, 'utf-8');
+        const data = JSON.parse(content);
+        const typeValue = (data.type || '').toLowerCase();
+        const validTypes = auth_types_1.PROVIDER_TYPE_VALUES[provider] || [];
+        return validTypes.includes(typeValue);
+    }
+    catch {
+        return false;
+    }
+}
+exports.isTokenFileForProvider = isTokenFileForProvider;
+/**
+ * Check if provider has valid authentication
+ * CLIProxyAPI stores OAuth tokens as JSON files in the auth directory.
+ * Detection strategy:
+ * 1. First check by filename prefix (fast path)
+ * 2. If no match, check JSON content for "type" field (Gemini uses {email}-{projectID}.json without prefix)
+ */
+function isAuthenticated(provider) {
+    const tokenDir = getProviderTokenDir(provider);
+    if (!fs.existsSync(tokenDir)) {
+        return false;
+    }
+    const validPrefixes = auth_types_1.PROVIDER_AUTH_PREFIXES[provider] || [];
+    try {
+        const files = fs.readdirSync(tokenDir);
+        const jsonFiles = files.filter((f) => f.endsWith('.json') || f.endsWith('.token') || f === 'credentials');
+        // Strategy 1: Check by filename prefix (fast path for antigravity, codex)
+        const prefixMatch = jsonFiles.some((f) => {
+            const lowerFile = f.toLowerCase();
+            return validPrefixes.some((prefix) => lowerFile.startsWith(prefix));
+        });
+        if (prefixMatch)
+            return true;
+        // Strategy 2: Check JSON content for "type" field (needed for Gemini)
+        for (const f of jsonFiles) {
+            const filePath = path.join(tokenDir, f);
+            if (isTokenFileForProvider(filePath, provider)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+exports.isAuthenticated = isAuthenticated;
+/**
+ * Get detailed auth status for provider
+ * Uses same detection strategy as isAuthenticated: prefix first, then content
+ */
+function getAuthStatus(provider) {
+    const tokenDir = getProviderTokenDir(provider);
+    let tokenFiles = [];
+    let lastAuth;
+    const validPrefixes = auth_types_1.PROVIDER_AUTH_PREFIXES[provider] || [];
+    if (fs.existsSync(tokenDir)) {
+        const files = fs.readdirSync(tokenDir);
+        const jsonFiles = files.filter((f) => f.endsWith('.json') || f.endsWith('.token') || f === 'credentials');
+        // Check each file: by prefix OR by content
+        tokenFiles = jsonFiles.filter((f) => {
+            const lowerFile = f.toLowerCase();
+            // Strategy 1: prefix match
+            if (validPrefixes.some((prefix) => lowerFile.startsWith(prefix))) {
+                return true;
+            }
+            // Strategy 2: content match (for Gemini tokens without prefix)
+            const filePath = path.join(tokenDir, f);
+            return isTokenFileForProvider(filePath, provider);
+        });
+        // Get most recent modification time
+        for (const file of tokenFiles) {
+            const filePath = path.join(tokenDir, file);
+            try {
+                const stats = fs.statSync(filePath);
+                if (!lastAuth || stats.mtime > lastAuth) {
+                    lastAuth = stats.mtime;
+                }
+            }
+            catch {
+                // Skip if can't stat file
+            }
+        }
+    }
+    // Get registered accounts for multi-account support
+    const accounts = (0, account_manager_1.getProviderAccounts)(provider);
+    const defaultAccount = (0, account_manager_1.getDefaultAccount)(provider);
+    return {
+        provider,
+        authenticated: tokenFiles.length > 0,
+        tokenDir,
+        tokenFiles,
+        lastAuth,
+        accounts,
+        defaultAccount: defaultAccount?.id,
+    };
+}
+exports.getAuthStatus = getAuthStatus;
+/**
+ * Get auth status for all providers
+ */
+function getAllAuthStatus() {
+    const providers = [...profile_detector_1.CLIPROXY_PROFILES];
+    return providers.map(getAuthStatus);
+}
+exports.getAllAuthStatus = getAllAuthStatus;
+/**
+ * Clear authentication for provider
+ * Only removes files belonging to the specified provider (by prefix or content)
+ * Does NOT remove the shared auth directory or other providers' files
+ */
+function clearAuth(provider) {
+    const tokenDir = getProviderTokenDir(provider);
+    if (!fs.existsSync(tokenDir)) {
+        return false;
+    }
+    const validPrefixes = auth_types_1.PROVIDER_AUTH_PREFIXES[provider] || [];
+    const files = fs.readdirSync(tokenDir);
+    let removedCount = 0;
+    // Only remove files that belong to this provider
+    for (const file of files) {
+        const filePath = path.join(tokenDir, file);
+        const lowerFile = file.toLowerCase();
+        // Check by prefix first (fast path)
+        const matchesByPrefix = validPrefixes.some((prefix) => lowerFile.startsWith(prefix));
+        // If no prefix match, check by content (for Gemini tokens without prefix)
+        const matchesByContent = !matchesByPrefix && isTokenFileForProvider(filePath, provider);
+        if (matchesByPrefix || matchesByContent) {
+            try {
+                fs.unlinkSync(filePath);
+                removedCount++;
+            }
+            catch {
+                // Failed to remove - skip
+            }
+        }
+    }
+    // DO NOT remove the shared auth directory - other providers may still have tokens
+    return removedCount > 0;
+}
+exports.clearAuth = clearAuth;
+/**
+ * Register account from newly created token file
+ * Scans auth directory for new token and extracts email
+ * @param provider - The CLIProxy provider
+ * @param tokenDir - Directory containing token files
+ * @param nickname - Optional nickname (uses auto-generated from email if not provided)
+ */
+function registerAccountFromToken(provider, tokenDir, nickname, verbose = false, expectedAccountId) {
+    const { registerAccount } = require('../account-manager');
+    let selectedCandidate = null;
+    try {
+        const files = fs.readdirSync(tokenDir);
+        const jsonFiles = files.filter((f) => f.endsWith('.json'));
+        const existingAccounts = (0, account_manager_1.getProviderAccounts)(provider);
+        const rawCandidates = jsonFiles.flatMap((file) => {
+            const filePath = path.join(tokenDir, file);
+            if (!isTokenFileForProvider(filePath, provider))
+                return [];
+            const content = fs.readFileSync(filePath, 'utf-8');
+            const data = JSON.parse(content);
+            const email = data.email || undefined;
+            const projectId = data.project_id || undefined;
+            const stats = fs.statSync(filePath);
+            return [
+                {
+                    file,
+                    filePath,
+                    email,
+                    projectId,
+                    mtimeMs: stats.mtimeMs,
+                    alreadyRegistered: existingAccounts.some((account) => account.tokenFile === file),
+                },
+            ];
+        });
+        const duplicateEmailCounts = new Map();
+        const duplicateEmailTokenSets = new Map();
+        for (const account of existingAccounts) {
+            if (!account.email)
+                continue;
+            const key = account.email.toLowerCase();
+            const tokenSet = duplicateEmailTokenSets.get(key) ?? new Set();
+            tokenSet.add(account.tokenFile);
+            duplicateEmailTokenSets.set(key, tokenSet);
+        }
+        for (const candidate of rawCandidates) {
+            if (!candidate.email)
+                continue;
+            const key = candidate.email.toLowerCase();
+            const tokenSet = duplicateEmailTokenSets.get(key) ?? new Set();
+            tokenSet.add(candidate.file);
+            duplicateEmailTokenSets.set(key, tokenSet);
+        }
+        for (const [key, tokenSet] of duplicateEmailTokenSets) {
+            duplicateEmailCounts.set(key, tokenSet.size);
+        }
+        const candidates = rawCandidates
+            .map((rawCandidate) => {
+            const duplicateEmailCount = rawCandidate.email
+                ? (duplicateEmailCounts.get(rawCandidate.email.toLowerCase()) ?? 1)
+                : 1;
+            const accountId = rawCandidate.email
+                ? (0, email_account_identity_1.buildEmailBackedAccountId)(provider, rawCandidate.file, rawCandidate.email, duplicateEmailCount)
+                : (0, token_file_ops_1.extractAccountIdFromTokenFile)(rawCandidate.file, rawCandidate.email);
+            return {
+                ...rawCandidate,
+                accountId,
+            };
+        })
+            .sort((a, b) => b.mtimeMs - a.mtimeMs);
+        if (expectedAccountId) {
+            selectedCandidate =
+                candidates.find((candidate) => candidate.accountId === expectedAccountId) ||
+                    candidates.find((candidate) => candidate.file === expectedAccountId) ||
+                    candidates.find((candidate) => {
+                        const existingAccount = existingAccounts.find((account) => account.id === expectedAccountId);
+                        return !!existingAccount && existingAccount.tokenFile === candidate.file;
+                    }) ||
+                    null;
+        }
+        else {
+            selectedCandidate = candidates[0] || null;
+        }
+        if (!selectedCandidate) {
+            if (verbose && expectedAccountId) {
+                console.error(`[auth] No token matched the expected account ${expectedAccountId}; refusing ambiguous registration`);
+            }
+            return null;
+        }
+        const account = registerAccount(provider, selectedCandidate.file, selectedCandidate.email, nickname, selectedCandidate.projectId);
+        uploadTokenToRemoteAsync(selectedCandidate.filePath, verbose);
+        return account;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (verbose) {
+            console.error(`[auth] Failed to register token-backed account: ${message}`);
+        }
+        if (selectedCandidate && !selectedCandidate.alreadyRegistered && !expectedAccountId) {
+            (0, token_file_ops_1.deleteTokenFile)(selectedCandidate.file);
+        }
+        if (expectedAccountId && verbose) {
+            console.error(`[auth] Reauthentication target ${expectedAccountId} did not resolve cleanly from the new token`);
+        }
+        return null;
+    }
+}
+exports.registerAccountFromToken = registerAccountFromToken;
+/**
+ * Upload token to remote server asynchronously (fire and forget).
+ * Only runs if remote mode is enabled. Logs success/failure via uploadTokenToRemote.
+ * Does not block the OAuth flow - local token is always valid regardless of upload result.
+ *
+ * @param tokenPath - Path to the token file
+ * @param verbose - Enable verbose logging for upload progress
+ */
+function uploadTokenToRemoteAsync(tokenPath, verbose) {
+    // Dynamic import to avoid circular dependencies
+    Promise.resolve().then(() => __importStar(require('../remote-token-uploader'))).then(({ uploadTokenToRemote, isRemoteUploadEnabled }) => {
+        if (isRemoteUploadEnabled()) {
+            // uploadTokenToRemote handles its own success/failure logging
+            // On failure, show additional warning so users know local token is still valid
+            uploadTokenToRemote(tokenPath, verbose)
+                .then((success) => {
+                if (!success) {
+                    console.error('\n[!] Remote upload failed - token saved locally only. Run "ccs tokens upload" to retry.');
+                }
+            })
+                .catch((err) => {
+                // Unexpected error (not handled by uploadTokenToRemote)
+                const message = err instanceof Error ? err.message : String(err);
+                console.error(`[token-manager] Unexpected upload error: ${message}`);
+                console.error('[!] Token saved locally. Run "ccs tokens upload" to sync to remote server.');
+            });
+        }
+    })
+        .catch((err) => {
+        // Module load failed - log for debugging
+        const message = err instanceof Error ? err.message : String(err);
+        console.error(`[token-manager] Failed to load remote-token-uploader: ${message}`);
+    });
+}
+/**
+ * Display auth status for all providers
+ */
+function displayAuthStatus() {
+    console.log('CLIProxy Authentication Status:');
+    console.log('');
+    const statuses = getAllAuthStatus();
+    for (const status of statuses) {
+        const oauthConfig = (0, auth_types_1.getOAuthConfig)(status.provider);
+        const icon = status.authenticated ? '[OK]' : '[!]';
+        const authStatus = status.authenticated ? 'Authenticated' : 'Not authenticated';
+        const lastAuthStr = status.lastAuth ? ` (last: ${status.lastAuth.toLocaleDateString()})` : '';
+        console.log(`${icon} ${oauthConfig.displayName}: ${authStatus}${lastAuthStr}`);
+    }
+    console.log('');
+    console.log('To authenticate: ccs <provider> --auth');
+    console.log('To logout:       ccs <provider> --logout');
+}
+exports.displayAuthStatus = displayAuthStatus;
+/**
+ * Ensure OAuth token is valid for provider, refreshing if expired or expiring soon.
+ * This prevents UND_ERR_SOCKET errors caused by expired tokens during API calls.
+ *
+ * Refresh responsibility:
+ * - gemini: CCS refreshes directly via Google OAuth
+ * - codex, agy, kiro, ghcp, qwen, iflow: CLIProxyAPIPlus handles refresh
+ *   automatically in background (e.g. kiro refreshes every 1 min).
+ *   CCS only checks if token file exists (authentication state).
+ * - claude: not yet implemented
+ *
+ * @param provider The CLIProxy provider
+ * @param verbose Log progress if true
+ * @returns Object with valid status and whether refresh occurred
+ */
+async function ensureTokenValid(provider, verbose = false) {
+    if (provider === 'gemini') {
+        const { ensureGeminiTokenValid } = await Promise.resolve().then(() => __importStar(require('./gemini-token-refresh')));
+        return ensureGeminiTokenValid(verbose);
+    }
+    // For CLIProxy-delegated providers, token refresh is handled by CLIProxyAPIPlus.
+    // CCS only verifies the token file exists (authentication state).
+    return { valid: isAuthenticated(provider), refreshed: false };
+}
+exports.ensureTokenValid = ensureTokenValid;
+//# sourceMappingURL=token-manager.js.map

package/dist/cliproxy/auth/token-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-manager.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/token-manager.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAE7B,kEAAgE;AAChE,0DAAyD;AACzD,wDAA4E;AAC5E,+DAA4F;AAC5F,+EAA+E;AAC/E,6CAKsB;AAEtB;;GAEG;AACH,SAAgB,mBAAmB,CAAC,QAA0B;IAC5D,OAAO,IAAA,qCAAkB,EAAC,QAAQ,CAAC,CAAC;AACtC,CAAC;AAFD,kDAEC;AAED;;;GAGG;AACH,SAAgB,sBAAsB,CAAC,QAAgB,EAAE,QAA0B;IACjF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,iCAAoB,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACxD,OAAO,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAVD,wDAUC;AAED;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,QAA0B;IACxD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAE/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,aAAa,GAAG,mCAAsB,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAE7D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,aAAa,CAC1E,CAAC;QAEF,0EAA0E;QAC1E,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACvC,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAClC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QACH,IAAI,WAAW;YAAE,OAAO,IAAI,CAAC;QAE7B,sEAAsE;QACtE,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YACxC,IAAI,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC/C,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAlCD,0CAkCC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAAC,QAA0B;IACtD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,UAAU,GAAa,EAAE,CAAC;IAC9B,IAAI,QAA0B,CAAC;IAE/B,MAAM,aAAa,GAAG,mCAAsB,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAE7D,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,aAAa,CAC1E,CAAC;QAEF,2CAA2C;QAC3C,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAClC,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAClC,2BAA2B;YAC3B,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACjE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,+DAA+D;YAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YACxC,OAAO,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QAEH,oCAAoC;QACpC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACpC,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,GAAG,QAAQ,EAAE,CAAC;oBACxC,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;gBACzB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,MAAM,QAAQ,GAAG,IAAA,qCAAmB,EAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,IAAA,mCAAiB,EAAC,QAAQ,CAAC,CAAC;IAEnD,OAAO;QACL,QAAQ;QACR,aAAa,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC;QACpC,QAAQ;QACR,UAAU;QACV,QAAQ;QACR,QAAQ;QACR,cAAc,EAAE,cAAc,EAAE,EAAE;KACnC,CAAC;AACJ,CAAC;AApDD,sCAoDC;AAED;;GAEG;AACH,SAAgB,gBAAgB;IAC9B,MAAM,SAAS,GAAuB,CAAC,GAAG,oCAAiB,CAAC,CAAC;IAC7D,OAAO,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AACtC,CAAC;AAHD,4CAGC;AAED;;;;GAIG;AACH,SAAgB,SAAS,CAAC,QAA0B;IAClD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAE/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,aAAa,GAAG,mCAAsB,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,iDAAiD;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAErC,oCAAoC;QACpC,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAErF,0EAA0E;QAC1E,MAAM,gBAAgB,GAAG,CAAC,eAAe,IAAI,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAExF,IAAI,eAAe,IAAI,gBAAgB,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACxB,YAAY,EAAE,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,OAAO,YAAY,GAAG,CAAC,CAAC;AAC1B,CAAC;AAlCD,8BAkCC;AAED;;;;;;GAMG;AACH,SAAgB,wBAAwB,CACtC,QAA0B,EAC1B,QAAgB,EAChB,QAAiB,EACjB,OAAO,GAAG,KAAK,EACf,iBAA0B;IAa1B,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1D,IAAI,iBAAiB,GAA2C,IAAI,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACnE,MAAM,gBAAgB,GAAG,IAAA,qCAAmB,EAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,aAAa,GAAwB,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,CAAC;gBAAE,OAAO,EAAE,CAAC;YAE3D,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4C,CAAC;YAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;YACtC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC;YAC/C,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAEpC,OAAO;gBACL;oBACE,IAAI;oBACJ,QAAQ;oBACR,KAAK;oBACL,SAAS;oBACT,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,iBAAiB,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC;iBAClF;aACF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAkB,CAAC;QACvD,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC/D,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;YACvC,IAAI,CAAC,OAAO,CAAC,KAAK;gBAAE,SAAS;YAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YACvE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,uBAAuB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;YACtC,IAAI,CAAC,SAAS,CAAC,KAAK;gBAAE,SAAS;YAC/B,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YACvE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7B,uBAAuB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,uBAAuB,EAAE,CAAC;YACtD,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,UAAU,GAAqB,aAAa;aAC/C,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE;YACpB,MAAM,mBAAmB,GAAG,YAAY,CAAC,KAAK;gBAC5C,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;gBACnE,CAAC,CAAC,CAAC,CAAC;YACN,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK;gBAClC,CAAC,CAAC,IAAA,kDAAyB,EACvB,QAAQ,EACR,YAAY,CAAC,IAAI,EACjB,YAAY,CAAC,KAAK,EAClB,mBAAmB,CACpB;gBACH,CAAC,CAAC,IAAA,8CAA6B,EAAC,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAEzE,OAAO;gBACL,GAAG,YAAY;gBACf,SAAS;aACV,CAAC;QACJ,CAAC,CAAC;aACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QAEzC,IAAI,iBAAiB,EAAE,CAAC;YACtB,iBAAiB;gBACf,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,iBAAiB,CAAC;oBACzE,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,iBAAiB,CAAC;oBACpE,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;wBAC5B,MAAM,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAC3C,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,iBAAiB,CAC9C,CAAC;wBACF,OAAO,CAAC,CAAC,eAAe,IAAI,eAAe,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,CAAC;oBAC3E,CAAC,CAAC;oBACF,IAAI,CAAC;QACT,CAAC;aAAM,CAAC;YACN,iBAAiB,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,IAAI,OAAO,IAAI,iBAAiB,EAAE,CAAC;gBACjC,OAAO,CAAC,KAAK,CACX,gDAAgD,iBAAiB,mCAAmC,CACrG,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,eAAe,CAC7B,QAAQ,EACR,iBAAiB,CAAC,IAAI,EACtB,iBAAiB,CAAC,KAAK,EACvB,QAAQ,EACR,iBAAiB,CAAC,SAAS,CAC5B,CAAC;QAEF,wBAAwB,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9D,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,mDAAmD,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,iBAAiB,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACpF,IAAA,gCAAe,EAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,iBAAiB,IAAI,OAAO,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CACX,kCAAkC,iBAAiB,6CAA6C,CACjG,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAzID,4DAyIC;AAED;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAAC,SAAiB,EAAE,OAAgB;IACnE,gDAAgD;IAChD,kDAAO,0BAA0B,IAC9B,IAAI,CAAC,CAAC,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,EAAE,EAAE;QACvD,IAAI,qBAAqB,EAAE,EAAE,CAAC;YAC5B,8DAA8D;YAC9D,+EAA+E;YAC/E,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC;iBACpC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChB,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CACX,0FAA0F,CAC3F,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACtB,wDAAwD;gBACxD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,OAAO,CAAC,KAAK,CAAC,4CAA4C,OAAO,EAAE,CAAC,CAAC;gBACrE,OAAO,CAAC,KAAK,CACX,4EAA4E,CAC7E,CAAC;YACJ,CAAC,CAAC,CAAC;QACP,CAAC;IACH,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACtB,yCAAyC;QACzC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,yDAAyD,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB;IAC/B,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IAEpC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,IAAA,2BAAc,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QACnD,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,mBAAmB,CAAC;QAChF,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAE9F,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,WAAW,CAAC,WAAW,KAAK,UAAU,GAAG,WAAW,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;AAC1D,CAAC;AAlBD,8CAkBC;AAED;;;;;;;;;;;;;;GAcG;AACI,KAAK,UAAU,gBAAgB,CACpC,QAA0B,EAC1B,OAAO,GAAG,KAAK;IAEf,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,EAAE,sBAAsB,EAAE,GAAG,wDAAa,wBAAwB,GAAC,CAAC;QAC1E,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,iFAAiF;IACjF,kEAAkE;IAClE,OAAO,EAAE,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAChE,CAAC;AAZD,4CAYC"}

package/dist/cliproxy/auth/token-refresh-config.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Token Refresh Configuration
+ *
+ * Loads token refresh worker settings from unified config.
+ * Returns null if disabled or not configured.
+ */
+import type { TokenRefreshSettings } from '../../config/unified-config-types';
+/**
+ * Get token refresh configuration from unified config
+ * @returns Config if enabled, null if disabled or not configured
+ */
+export declare function getTokenRefreshConfig(): TokenRefreshSettings | null;
+//# sourceMappingURL=token-refresh-config.d.ts.map

package/dist/cliproxy/auth/token-refresh-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-refresh-config.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/token-refresh-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAE9E;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,oBAAoB,GAAG,IAAI,CAgBnE"}

package/dist/cliproxy/auth/token-refresh-config.js

@@ -0,0 +1,31 @@
+"use strict";
+/**
+ * Token Refresh Configuration
+ *
+ * Loads token refresh worker settings from unified config.
+ * Returns null if disabled or not configured.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getTokenRefreshConfig = void 0;
+const unified_config_loader_1 = require("../../config/unified-config-loader");
+/**
+ * Get token refresh configuration from unified config
+ * @returns Config if enabled, null if disabled or not configured
+ */
+function getTokenRefreshConfig() {
+    const config = (0, unified_config_loader_1.loadOrCreateUnifiedConfig)();
+    // Return null if not configured or explicitly disabled
+    if (!config.cliproxy?.token_refresh?.enabled) {
+        return null;
+    }
+    // Return config with defaults
+    return {
+        enabled: true,
+        interval_minutes: config.cliproxy.token_refresh.interval_minutes ?? 30,
+        preemptive_minutes: config.cliproxy.token_refresh.preemptive_minutes ?? 45,
+        max_retries: config.cliproxy.token_refresh.max_retries ?? 3,
+        verbose: config.cliproxy.token_refresh.verbose ?? false,
+    };
+}
+exports.getTokenRefreshConfig = getTokenRefreshConfig;
+//# sourceMappingURL=token-refresh-config.js.map

package/dist/cliproxy/auth/token-refresh-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-refresh-config.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/token-refresh-config.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,8EAA+E;AAG/E;;;GAGG;AACH,SAAgB,qBAAqB;IACnC,MAAM,MAAM,GAAG,IAAA,iDAAyB,GAAE,CAAC;IAE3C,uDAAuD;IACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8BAA8B;IAC9B,OAAO;QACL,OAAO,EAAE,IAAI;QACb,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,gBAAgB,IAAI,EAAE;QACtE,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,kBAAkB,IAAI,EAAE;QAC1E,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,WAAW,IAAI,CAAC;QAC3D,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,IAAI,KAAK;KACxD,CAAC;AACJ,CAAC;AAhBD,sDAgBC"}