@provos/ironcurtain 0.9.0 → 0.10.0

package/dist/docker/oauth-credentials.d.ts

@@ -20,11 +20,21 @@ export interface OAuthCredentials {
 }
 /** Where OAuth credentials were loaded from. */
 export type OAuthCredentialSource = 'file' | 'keychain';
+/** Keychain lookup result that preserves the service name for write-back. */
+export interface KeychainResult {
+    readonly credentials: OAuthCredentials;
+    readonly serviceName: string;
+}
 /** Authentication method detected on the host. */
 export type AuthMethod = {
     readonly kind: 'oauth';
     readonly credentials: OAuthCredentials;
-    readonly source: OAuthCredentialSource;
+    readonly source: 'file';
+} | {
+    readonly kind: 'oauth';
+    readonly credentials: OAuthCredentials;
+    readonly source: 'keychain';
+    readonly keychainServiceName: string;
 } | {
     readonly kind: 'apikey';
     readonly key: string;
@@ -56,14 +66,30 @@ export declare function loadCredentialsFromFile(filePath: string): OAuthCredenti
  */
 export declare function parseCredentialsJson(json: string): OAuthCredentials | null;
 /**
- * Attempts to extract OAuth credentials from the macOS Keychain.
+ * Attempts to extract OAuth credentials from the macOS Keychain,
+ * also returning which service name succeeded (needed for write-back).
  * Returns null on non-macOS platforms, Keychain access failure, or
  * when no valid credentials are found.
  *
  * Tries both service names because Claude Code has a known bug where
  * the write and read service names differ.
  */
+export declare function extractFromKeychainWithService(): KeychainResult | null;
+/**
+ * Attempts to extract OAuth credentials from the macOS Keychain.
+ * Returns null on non-macOS platforms, Keychain access failure, or
+ * when no valid credentials are found.
+ *
+ * Delegates to extractFromKeychainWithService() and strips the service name.
+ */
 export declare function extractFromKeychain(): OAuthCredentials | null;
+/**
+ * Writes updated OAuth credentials back to the macOS Keychain.
+ * Preserves existing fields in the Keychain entry (e.g., scopes, subscriptionType).
+ *
+ * No-op on non-macOS platforms.
+ */
+export declare function writeToKeychain(credentials: OAuthCredentials, serviceName: string): void;
 /**
  * Refreshes an OAuth access token using a refresh token grant.
  *
@@ -76,19 +102,32 @@ export declare function refreshOAuthToken(refreshToken: string): Promise<OAuthCr
  * preserving other fields in the file (e.g., scopes, subscriptionType).
  */
 export declare function saveOAuthCredentials(credentials: OAuthCredentials, filePath?: string): void;
-/** Injectable credential sources for testability. */
+/**
+ * Injectable credential sources for testability.
+ *
+ * The optional refresh/save/keychain-write functions enable token refresh
+ * and persistence in detectAuthMethod(). When these functions are omitted,
+ * expired tokens are not refreshed or written back; the caller only receives
+ * the detection result (and any existing, possibly stale, credentials).
+ */
 export interface CredentialSources {
     loadFromFile: () => OAuthCredentials | null;
     loadFromKeychain: () => OAuthCredentials | null;
+    refreshToken?: (refreshToken: string) => Promise<OAuthCredentials | null>;
+    saveToFile?: (credentials: OAuthCredentials) => void;
+    loadFromKeychainWithService?: () => KeychainResult | null;
+    writeToKeychain?: (credentials: OAuthCredentials, serviceName: string) => void;
 }
 /**
  * Detects the best authentication method available on the host.
+ * When refresh functions are provided in sources, attempts to refresh
+ * expired OAuth tokens before falling back to API key auth.
  *
  * Priority:
  * 1. IRONCURTAIN_DOCKER_AUTH=apikey env var forces API key mode
- * 2. OAuth credentials from ~/.claude/.credentials.json (if not expired)
- * 3. OAuth credentials from macOS Keychain (if credentials file missing)
+ * 2. OAuth credentials from ~/.claude/.credentials.json (valid or refreshable)
+ * 3. OAuth credentials from macOS Keychain (valid or refreshable)
  * 4. API key from config
  * 5. None
  */
-export declare function detectAuthMethod(config: IronCurtainConfig, sources?: CredentialSources): AuthMethod;
+export declare function detectAuthMethod(config: IronCurtainConfig, sources?: CredentialSources): Promise<AuthMethod>;

package/dist/docker/oauth-credentials.js

@@ -94,14 +94,15 @@ export function parseCredentialsJson(json) {
     }
 }
 /**
- * Attempts to extract OAuth credentials from the macOS Keychain.
+ * Attempts to extract OAuth credentials from the macOS Keychain,
+ * also returning which service name succeeded (needed for write-back).
  * Returns null on non-macOS platforms, Keychain access failure, or
  * when no valid credentials are found.
  *
  * Tries both service names because Claude Code has a known bug where
  * the write and read service names differ.
  */
-export function extractFromKeychain() {
+export function extractFromKeychainWithService() {
     if (platform() !== 'darwin')
         return null;
     const account = userInfo().username;
@@ -115,7 +116,7 @@ export function extractFromKeychain() {
             const credentials = parseCredentialsJson(result.trim());
             if (credentials) {
                 logger.info(`Found OAuth credentials in macOS Keychain (service: "${service}")`);
-                return credentials;
+                return { credentials, serviceName: service };
             }
         }
         catch {
@@ -125,6 +126,58 @@ export function extractFromKeychain() {
     }
     return null;
 }
+/**
+ * Attempts to extract OAuth credentials from the macOS Keychain.
+ * Returns null on non-macOS platforms, Keychain access failure, or
+ * when no valid credentials are found.
+ *
+ * Delegates to extractFromKeychainWithService() and strips the service name.
+ */
+export function extractFromKeychain() {
+    return extractFromKeychainWithService()?.credentials ?? null;
+}
+/**
+ * Writes updated OAuth credentials back to the macOS Keychain.
+ * Preserves existing fields in the Keychain entry (e.g., scopes, subscriptionType).
+ *
+ * No-op on non-macOS platforms.
+ */
+export function writeToKeychain(credentials, serviceName) {
+    if (platform() !== 'darwin')
+        return;
+    const account = userInfo().username;
+    // Read existing Keychain value to preserve extra fields
+    let existing = {};
+    try {
+        const raw = execFileSync('security', ['find-generic-password', '-s', serviceName, '-a', account, '-w'], {
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+            timeout: 10_000,
+        });
+        const parsed = JSON.parse(raw.trim());
+        if (typeof parsed === 'object' && parsed !== null) {
+            existing = parsed;
+        }
+    }
+    catch {
+        // Entry doesn't exist or is unreadable -- start fresh
+    }
+    const existingOauth = typeof existing.claudeAiOauth === 'object' && existing.claudeAiOauth !== null
+        ? existing.claudeAiOauth
+        : {};
+    existing.claudeAiOauth = {
+        ...existingOauth,
+        accessToken: credentials.accessToken,
+        refreshToken: credentials.refreshToken,
+        expiresAt: credentials.expiresAt,
+    };
+    const json = JSON.stringify(existing);
+    // -U flag updates an existing entry or creates a new one
+    execFileSync('security', ['add-generic-password', '-U', '-s', serviceName, '-a', account, '-w', json], {
+        timeout: 10_000,
+        stdio: ['pipe', 'pipe', 'pipe'],
+    });
+}
 /** Claude Code's public OAuth client ID. */
 const OAUTH_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
 /** Anthropic's OAuth token endpoint (platform.claude.com since mid-2025). */
@@ -136,22 +189,25 @@ const OAUTH_TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
  * token, network error, etc.).
  */
 export async function refreshOAuthToken(refreshToken) {
+    const REFRESH_TIMEOUT_MS = 30_000;
     try {
+        const body = new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+            client_id: OAUTH_CLIENT_ID,
+        });
         const response = await fetch(OAUTH_TOKEN_URL, {
             method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                grant_type: 'refresh_token',
-                refresh_token: refreshToken,
-                client_id: OAUTH_CLIENT_ID,
-            }),
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+            signal: AbortSignal.timeout(REFRESH_TIMEOUT_MS),
         });
         if (!response.ok) {
             logger.warn(`OAuth token refresh failed: HTTP ${response.status}`);
             return null;
         }
         const data = (await response.json());
-        return parseTokenResponse(data);
+        return parseTokenResponse(data, refreshToken);
     }
     catch (err) {
         logger.warn(`OAuth token refresh error: ${err instanceof Error ? err.message : String(err)}`);
@@ -160,19 +216,19 @@ export async function refreshOAuthToken(refreshToken) {
 }
 /**
  * Validates and extracts credentials from an OAuth token endpoint response.
- * Returns null if any required field is missing or invalid.
+ * Returns null if access_token or expires_in are missing/invalid.
+ * Preserves the original refresh token when the response omits refresh_token
+ * (not all providers rotate refresh tokens on every grant).
  */
-function parseTokenResponse(data) {
+function parseTokenResponse(data, fallbackRefreshToken) {
     const { access_token: accessToken, refresh_token: refreshToken, expires_in: expiresIn } = data;
     if (!isNonEmptyString(accessToken))
         return null;
-    if (!isNonEmptyString(refreshToken))
-        return null;
     if (!isPositiveFiniteNumber(expiresIn))
         return null;
     return {
         accessToken,
-        refreshToken,
+        refreshToken: isNonEmptyString(refreshToken) ? refreshToken : fallbackRefreshToken,
         expiresAt: Date.now() + expiresIn * 1000,
     };
 }
@@ -208,39 +264,62 @@ export function saveOAuthCredentials(credentials, filePath) {
 const defaultSources = {
     loadFromFile: loadOAuthCredentials,
     loadFromKeychain: extractFromKeychain,
+    refreshToken: refreshOAuthToken,
+    saveToFile: saveOAuthCredentials,
+    loadFromKeychainWithService: extractFromKeychainWithService,
+    writeToKeychain,
 };
 /**
  * Detects the best authentication method available on the host.
+ * When refresh functions are provided in sources, attempts to refresh
+ * expired OAuth tokens before falling back to API key auth.
  *
  * Priority:
  * 1. IRONCURTAIN_DOCKER_AUTH=apikey env var forces API key mode
- * 2. OAuth credentials from ~/.claude/.credentials.json (if not expired)
- * 3. OAuth credentials from macOS Keychain (if credentials file missing)
+ * 2. OAuth credentials from ~/.claude/.credentials.json (valid or refreshable)
+ * 3. OAuth credentials from macOS Keychain (valid or refreshable)
  * 4. API key from config
  * 5. None
  */
-export function detectAuthMethod(config, sources) {
-    const { loadFromFile, loadFromKeychain } = sources ?? defaultSources;
+export async function detectAuthMethod(config, sources) {
+    const s = sources ?? defaultSources;
     // Allow explicit override to force API key mode
     if (process.env.IRONCURTAIN_DOCKER_AUTH === 'apikey') {
         logger.info('Docker auth override: forced API key mode via IRONCURTAIN_DOCKER_AUTH');
         return resolveApiKeyAuth(config);
     }
     // Try OAuth from credentials file
-    const fileCreds = loadFromFile();
+    const fileCreds = s.loadFromFile();
     if (fileCreds) {
         if (!isTokenExpired(fileCreds)) {
             logger.info('Detected OAuth credentials from ~/.claude/.credentials.json');
             return { kind: 'oauth', credentials: fileCreds, source: 'file' };
         }
+        // Attempt refresh if refresh function is available
+        if (s.refreshToken) {
+            const refreshed = await tryRefreshFileCreds(fileCreds, s.refreshToken, s.saveToFile);
+            if (refreshed)
+                return refreshed;
+        }
         logger.warn('OAuth token from credentials file is expired');
     }
     // Try macOS Keychain if credentials file was not found
     if (!fileCreds) {
-        const keychainCreds = loadFromKeychain();
-        if (keychainCreds) {
-            if (!isTokenExpired(keychainCreds)) {
-                return { kind: 'oauth', credentials: keychainCreds, source: 'keychain' };
+        const keychainResult = s.loadFromKeychainWithService?.() ?? toKeychainResult(s.loadFromKeychain());
+        if (keychainResult) {
+            if (!isTokenExpired(keychainResult.credentials)) {
+                return {
+                    kind: 'oauth',
+                    credentials: keychainResult.credentials,
+                    source: 'keychain',
+                    keychainServiceName: keychainResult.serviceName,
+                };
+            }
+            // Attempt refresh if refresh function is available
+            if (s.refreshToken) {
+                const refreshed = await tryRefreshKeychainCreds(keychainResult, s.refreshToken, s.writeToKeychain);
+                if (refreshed)
+                    return refreshed;
             }
             logger.warn('OAuth token from macOS Keychain is expired');
         }
@@ -248,6 +327,54 @@ export function detectAuthMethod(config, sources) {
     // Fall back to API key
     return resolveApiKeyAuth(config);
 }
+/**
+ * Wraps a plain OAuthCredentials from loadFromKeychain() into a KeychainResult.
+ * Uses the first service name as a fallback since we don't know which one matched.
+ */
+function toKeychainResult(creds) {
+    if (!creds)
+        return null;
+    return { credentials: creds, serviceName: KEYCHAIN_SERVICE_NAMES[0] };
+}
+/**
+ * Attempts to refresh expired file-sourced credentials.
+ * On success, saves to file and returns the oauth AuthMethod.
+ */
+async function tryRefreshFileCreds(fileCreds, doRefresh, saveToFile) {
+    const refreshed = await doRefresh(fileCreds.refreshToken);
+    if (!refreshed)
+        return null;
+    try {
+        saveToFile?.(refreshed);
+    }
+    catch (err) {
+        logger.warn(`Failed to save refreshed credentials to file: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    logger.info('Refreshed expired OAuth token from credentials file');
+    return { kind: 'oauth', credentials: refreshed, source: 'file' };
+}
+/**
+ * Attempts to refresh expired Keychain-sourced credentials.
+ * On success, writes back to Keychain and returns the oauth AuthMethod.
+ */
+async function tryRefreshKeychainCreds(keychainResult, doRefresh, doWriteToKeychain) {
+    const refreshed = await doRefresh(keychainResult.credentials.refreshToken);
+    if (!refreshed)
+        return null;
+    try {
+        doWriteToKeychain?.(refreshed, keychainResult.serviceName);
+    }
+    catch (err) {
+        logger.warn(`Failed to write refreshed credentials to Keychain: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    logger.info('Refreshed expired OAuth token from macOS Keychain');
+    return {
+        kind: 'oauth',
+        credentials: refreshed,
+        source: 'keychain',
+        keychainServiceName: keychainResult.serviceName,
+    };
+}
 /**
  * Resolves API key authentication from config.
  */

package/dist/docker/oauth-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-credentials.js","sourceRoot":"","sources":["../../src/docker/oauth-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAkBvC,+EAA+E;AAC/E,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,2DAA2D;AAC3D,MAAM,sBAAsB,GAAG,CAAC,yBAAyB,EAAE,aAAa,CAAU,CAAC;AAEnF;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,WAA6B;IAC1D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,IAAI,WAAW,CAAC,SAAS,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;IAC1C,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAE/D,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC;QAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAE7D,MAAM,KAAK,GAAG,KAAgC,CAAC;QAC/C,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;QACvD,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAE1D,OAAO;YACL,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,QAAQ,EAAE,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,QAAQ,CAAC;IACpC,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;gBACrG,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,wDAAwD,OAAO,IAAI,CAAC,CAAC;gBACjF,OAAO,WAAW,CAAC;YACrB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;YACxD,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4CAA4C;AAC5C,MAAM,eAAe,GAAG,sCAAsC,CAAC;AAE/D,6EAA6E;AAC7E,MAAM,eAAe,GAAG,4CAA4C,CAAC;AAErE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,YAAoB;IAC1D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,eAAe;aAC3B,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAChE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,IAA6B;IACvD,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAE/F,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpD,OAAO;QACL,WAAW;QACX,YAAY;QACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI;KACzC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAA6B,EAAE,QAAiB;IACnF,MAAM,QAAQ,GAAG,QAAQ,IAAI,sBAAsB,EAAE,CAAC;IAEtD,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAA4B,CAAC;QACpF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IAED,MAAM,aAAa,GACjB,OAAO,QAAQ,CAAC,aAAa,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa,KAAK,IAAI;QAC3E,CAAC,CAAE,QAAQ,CAAC,aAAyC;QACrD,CAAC,CAAC,EAAE,CAAC;IAET,QAAQ,CAAC,aAAa,GAAG;QACvB,GAAG,aAAa;QAChB,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,SAAS,EAAE,WAAW,CAAC,SAAS;KACjC,CAAC;IAEF,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,iFAAiF;IACjF,kEAAkE;IAClE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAQD,MAAM,cAAc,GAAsB;IACxC,YAAY,EAAE,oBAAoB;IAClC,gBAAgB,EAAE,mBAAmB;CACtC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB,EAAE,OAA2B;IACrF,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,GAAG,OAAO,IAAI,cAAc,CAAC;IAErE,gDAAgD;IAChD,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,QAAQ,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACrF,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,kCAAkC;IAClC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YAC3E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC9D,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;QACzC,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;gBACnC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YAC3E,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,MAAyB;IAClD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;IAC9C,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"oauth-credentials.js","sourceRoot":"","sources":["../../src/docker/oauth-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AA8BvC,+EAA+E;AAC/E,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,2DAA2D;AAC3D,MAAM,sBAAsB,GAAG,CAAC,yBAAyB,EAAE,aAAa,CAAU,CAAC;AAEnF;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,WAA6B;IAC1D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,IAAI,WAAW,CAAC,SAAS,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;IAC1C,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAE/D,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC;QAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAE7D,MAAM,KAAK,GAAG,KAAgC,CAAC;QAC/C,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;QACvD,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAE1D,OAAO;YACL,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,8BAA8B;IAC5C,IAAI,QAAQ,EAAE,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,QAAQ,CAAC;IACpC,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;gBACrG,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,wDAAwD,OAAO,IAAI,CAAC,CAAC;gBACjF,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;YACxD,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,8BAA8B,EAAE,EAAE,WAAW,IAAI,IAAI,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,WAA6B,EAAE,WAAmB;IAChF,IAAI,QAAQ,EAAE,KAAK,QAAQ;QAAE,OAAO;IAEpC,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,QAAQ,CAAC;IAEpC,wDAAwD;IACxD,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;YACtG,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,QAAQ,GAAG,MAAiC,CAAC;QAC/C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IAED,MAAM,aAAa,GACjB,OAAO,QAAQ,CAAC,aAAa,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa,KAAK,IAAI;QAC3E,CAAC,CAAE,QAAQ,CAAC,aAAyC;QACrD,CAAC,CAAC,EAAE,CAAC;IAET,QAAQ,CAAC,aAAa,GAAG;QACvB,GAAG,aAAa;QAChB,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,SAAS,EAAE,WAAW,CAAC,SAAS;KACjC,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAEtC,yDAAyD;IACzD,YAAY,CAAC,UAAU,EAAE,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;QACrG,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED,4CAA4C;AAC5C,MAAM,eAAe,GAAG,sCAAsC,CAAC;AAE/D,6EAA6E;AAC7E,MAAM,eAAe,GAAG,4CAA4C,CAAC;AAErE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,YAAoB;IAC1D,MAAM,kBAAkB,GAAG,MAAM,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,eAAe;SAC3B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAChE,OAAO,kBAAkB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAA6B,EAAE,oBAA4B;IACrF,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAE/F,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpD,OAAO;QACL,WAAW;QACX,YAAY,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB;QAClF,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI;KACzC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAA6B,EAAE,QAAiB;IACnF,MAAM,QAAQ,GAAG,QAAQ,IAAI,sBAAsB,EAAE,CAAC;IAEtD,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAA4B,CAAC;QACpF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IAED,MAAM,aAAa,GACjB,OAAO,QAAQ,CAAC,aAAa,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa,KAAK,IAAI;QAC3E,CAAC,CAAE,QAAQ,CAAC,aAAyC;QACrD,CAAC,CAAC,EAAE,CAAC;IAET,QAAQ,CAAC,aAAa,GAAG;QACvB,GAAG,aAAa;QAChB,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,SAAS,EAAE,WAAW,CAAC,SAAS;KACjC,CAAC;IAEF,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,iFAAiF;IACjF,kEAAkE;IAClE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAmBD,MAAM,cAAc,GAAsB;IACxC,YAAY,EAAE,oBAAoB;IAClC,gBAAgB,EAAE,mBAAmB;IACrC,YAAY,EAAE,iBAAiB;IAC/B,UAAU,EAAE,oBAAoB;IAChC,2BAA2B,EAAE,8BAA8B;IAC3D,eAAe;CAChB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAyB,EAAE,OAA2B;IAC3F,MAAM,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC;IAEpC,gDAAgD;IAChD,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,QAAQ,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACrF,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,kCAAkC;IAClC,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,EAAE,CAAC;IACnC,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YAC3E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACnE,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;YACrF,IAAI,SAAS;gBAAE,OAAO,SAAS,CAAC;QAClC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC9D,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,cAAc,GAAG,CAAC,CAAC,2BAA2B,EAAE,EAAE,IAAI,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACnG,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChD,OAAO;oBACL,IAAI,EAAE,OAAO;oBACb,WAAW,EAAE,cAAc,CAAC,WAAW;oBACvC,MAAM,EAAE,UAAU;oBAClB,mBAAmB,EAAE,cAAc,CAAC,WAAW;iBAChD,CAAC;YACJ,CAAC;YAED,mDAAmD;YACnD,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;gBACnB,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,cAAc,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC;gBACnG,IAAI,SAAS;oBAAE,OAAO,SAAS,CAAC;YAClC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,KAA8B;IACtD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,mBAAmB,CAChC,SAA2B,EAC3B,SAAqE,EACrE,UAAoD;IAEpD,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,IAAI,CAAC;QACH,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,iDAAiD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnH,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACnE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,uBAAuB,CACpC,cAA8B,EAC9B,SAAqE,EACrE,iBAAgF;IAEhF,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAC3E,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,IAAI,CAAC;QACH,iBAAiB,EAAE,CAAC,SAAS,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,sDAAsD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IACjE,OAAO;QACL,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,UAAU;QAClB,mBAAmB,EAAE,cAAc,CAAC,WAAW;KAChD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,MAAyB;IAClD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;IAC9C,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC"}

package/dist/docker/oauth-token-manager.d.ts

@@ -6,10 +6,9 @@
  * may also refresh tokens concurrently — re-reads the credentials file
  * before attempting a refresh to avoid using a stale refresh token.
  *
- * On macOS where credentials come from the Keychain, the manager operates
- * in read-only mode: it re-reads credentials from file and Keychain but
- * never performs its own refresh grant. This prevents invalidating the
- * host Claude Code's refresh token, which lives in the Keychain.
+ * For file-sourced credentials, refreshed tokens are saved back to the
+ * credentials file. For Keychain-sourced credentials (macOS), refreshed
+ * tokens are written back to the Keychain via the writeToKeychain dep.
  *
  * A single in-flight refresh promise is shared across concurrent callers
  * to prevent duplicate refresh requests.
@@ -22,6 +21,10 @@ export interface TokenManagerDeps {
     refreshToken: (refreshToken: string) => Promise<OAuthCredentials | null>;
     saveCredentials: (credentials: OAuthCredentials, filePath?: string) => void;
     credentialsFilePath: string;
+    /** When set, refreshed credentials are written to the Keychain instead of the file. */
+    writeToKeychain?: (credentials: OAuthCredentials, serviceName: string) => void;
+    /** The Keychain service name to use with writeToKeychain. */
+    keychainServiceName?: string;
     /** @deprecated No longer used internally. Kept for backward compatibility with tests. */
     now?: () => number;
 }
@@ -29,12 +32,12 @@ export interface OAuthTokenManagerOptions {
     /**
      * Whether the manager may perform its own refresh_token grant.
      *
-     * When false (Keychain-sourced credentials on macOS), the manager only
-     * re-reads credentials from the file and Keychain — it never POSTs to
-     * the token endpoint itself, because doing so would rotate the refresh
-     * token and break host Claude Code's copy in the Keychain.
+     * When false, the manager only re-reads credentials from the file and
+     * Keychain — it never POSTs to the token endpoint itself.
      *
-     * Defaults to true (file-sourced credentials on Linux/WSL).
+     * Defaults to true. For Keychain-sourced credentials, set writeToKeychain
+     * and keychainServiceName in deps so refreshed tokens are persisted to
+     * the Keychain rather than the credentials file.
      */
     canRefresh?: boolean;
 }
@@ -67,13 +70,9 @@ export declare class OAuthTokenManager {
      * Core refresh logic with deduplication. Concurrent callers share a single
      * in-flight refresh promise.
      *
-     * File-sourced credentials (canRefresh=true):
-     *   Re-read file -> if still expired, POST refresh grant -> on failure,
-     *   re-read file once more (host process may have won the race).
-     *
-     * Keychain-sourced credentials (canRefresh=false):
-     *   Re-read file and Keychain only -- never POST a refresh grant, because
-     *   doing so would rotate the refresh token and break host Claude Code.
+     * Re-read file -> for Keychain-sourced creds, also re-read Keychain ->
+     * if still expired and canRefresh is true, POST refresh grant ->
+     * on failure, re-read file once more (host process may have won the race).
      */
     private doRefresh;
     private executeRefresh;

package/dist/docker/oauth-token-manager.js

@@ -6,10 +6,9 @@
  * may also refresh tokens concurrently — re-reads the credentials file
  * before attempting a refresh to avoid using a stale refresh token.
  *
- * On macOS where credentials come from the Keychain, the manager operates
- * in read-only mode: it re-reads credentials from file and Keychain but
- * never performs its own refresh grant. This prevents invalidating the
- * host Claude Code's refresh token, which lives in the Keychain.
+ * For file-sourced credentials, refreshed tokens are saved back to the
+ * credentials file. For Keychain-sourced credentials (macOS), refreshed
+ * tokens are written back to the Keychain via the writeToKeychain dep.
  *
  * A single in-flight refresh promise is shared across concurrent callers
  * to prevent duplicate refresh requests.
@@ -68,13 +67,9 @@ export class OAuthTokenManager {
      * Core refresh logic with deduplication. Concurrent callers share a single
      * in-flight refresh promise.
      *
-     * File-sourced credentials (canRefresh=true):
-     *   Re-read file -> if still expired, POST refresh grant -> on failure,
-     *   re-read file once more (host process may have won the race).
-     *
-     * Keychain-sourced credentials (canRefresh=false):
-     *   Re-read file and Keychain only -- never POST a refresh grant, because
-     *   doing so would rotate the refresh token and break host Claude Code.
+     * Re-read file -> for Keychain-sourced creds, also re-read Keychain ->
+     * if still expired and canRefresh is true, POST refresh grant ->
+     * on failure, re-read file once more (host process may have won the race).
      */
     doRefresh() {
         if (this.inflightRefresh) {
@@ -93,24 +88,35 @@ export class OAuthTokenManager {
             this.credentials = fileCreds;
             return this.credentials.accessToken;
         }
-        // In read-only mode, also try the Keychain but never POST a refresh grant
-        if (!this.canRefresh) {
+        // For Keychain-sourced creds, check if the host process already refreshed.
+        // Capture the Keychain's refresh token in case it's newer than our startup copy.
+        let keychainRefreshToken;
+        if (this.deps.keychainServiceName) {
             const keychainCreds = this.deps.loadFromKeychain();
             if (keychainCreds && !isTokenExpired(keychainCreds)) {
                 logger.info('[oauth-token-manager] Found valid token in Keychain (refreshed by host process)');
                 this.credentials = keychainCreds;
                 return this.credentials.accessToken;
             }
-            logger.warn('[oauth-token-manager] Token expired and cannot self-refresh (Keychain mode) — waiting for host Claude Code to refresh');
+            keychainRefreshToken = keychainCreds?.refreshToken;
+        }
+        // Hard guard: when canRefresh is false, never POST a refresh grant
+        if (!this.canRefresh) {
+            logger.warn('[oauth-token-manager] Token expired and self-refresh is disabled');
             return null;
         }
-        // Attempt refresh ourselves, preferring the file's refresh token if available
-        const refreshToken = fileCreds?.refreshToken ?? this.credentials.refreshToken;
+        // Pick the best available refresh token: file > keychain > initial credentials
+        const refreshToken = fileCreds?.refreshToken ?? keychainRefreshToken ?? this.credentials.refreshToken;
         const newCreds = await this.deps.refreshToken(refreshToken);
         if (newCreds) {
             logger.info('[oauth-token-manager] Token refresh successful');
             try {
-                this.deps.saveCredentials(newCreds, this.deps.credentialsFilePath);
+                if (this.deps.keychainServiceName && this.deps.writeToKeychain) {
+                    this.deps.writeToKeychain(newCreds, this.deps.keychainServiceName);
+                }
+                else {
+                    this.deps.saveCredentials(newCreds, this.deps.credentialsFilePath);
+                }
             }
             catch (err) {
                 logger.warn(`[oauth-token-manager] Failed to save refreshed credentials: ${err instanceof Error ? err.message : String(err)}`);

package/dist/docker/oauth-token-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-token-manager.js","sourceRoot":"","sources":["../../src/docker/oauth-token-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAavC,MAAM,WAAW,GAAqB;IACpC,eAAe,EAAE,uBAAuB;IACxC,gBAAgB,EAAE,mBAAmB;IACrC,YAAY,EAAE,iBAAiB;IAC/B,eAAe,EAAE,oBAAoB;IACrC,mBAAmB,EAAE,sBAAsB,EAAE;CAC9C,CAAC;AAgBF,MAAM,OAAO,iBAAiB;IACpB,WAAW,CAAmB;IAC9B,eAAe,GAAkC,IAAI,CAAC;IAC7C,IAAI,CAAmB;IACvB,UAAU,CAAU;IAErC,YACE,kBAAoC,EACpC,OAAkC,EAClC,IAAgC;QAEhC,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;IACtC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,mBAAmB;QACvB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QACtC,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACrF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,OAAO,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB;QACrB,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;;OAWG;IACK,SAAS;QACf,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,eAAe,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACxD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,yEAAyE;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC3E,IAAI,SAAS,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;YAC1G,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;YAC7B,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QACtC,CAAC;QAED,0EAA0E;QAC1E,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACnD,IAAI,aAAa,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;gBAC/F,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC;gBACjC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;YACtC,CAAC;YACD,MAAM,CAAC,IAAI,CACT,uHAAuH,CACxH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,8EAA8E;QAC9E,MAAM,YAAY,GAAG,SAAS,EAAE,YAAY,IAAI,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC;QAC9E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAE5D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAC9D,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACrE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CACT,+DAA+D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAClH,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;YAC5B,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QACtC,CAAC;QAED,4EAA4E;QAC5E,MAAM,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;QAC7F,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC/E,IAAI,aAAa,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;YAC/F,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC;YACjC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QACtC,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"oauth-token-manager.js","sourceRoot":"","sources":["../../src/docker/oauth-token-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAiBvC,MAAM,WAAW,GAAqB;IACpC,eAAe,EAAE,uBAAuB;IACxC,gBAAgB,EAAE,mBAAmB;IACrC,YAAY,EAAE,iBAAiB;IAC/B,eAAe,EAAE,oBAAoB;IACrC,mBAAmB,EAAE,sBAAsB,EAAE;CAC9C,CAAC;AAgBF,MAAM,OAAO,iBAAiB;IACpB,WAAW,CAAmB;IAC9B,eAAe,GAAkC,IAAI,CAAC;IAC7C,IAAI,CAAmB;IACvB,UAAU,CAAU;IAErC,YACE,kBAAoC,EACpC,OAAkC,EAClC,IAAgC;QAEhC,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;IACtC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,mBAAmB;QACvB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QACtC,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACrF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,OAAO,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB;QACrB,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED;;;;;;;OAOG;IACK,SAAS;QACf,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,eAAe,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACxD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,yEAAyE;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC3E,IAAI,SAAS,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;YAC1G,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;YAC7B,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QACtC,CAAC;QAED,2EAA2E;QAC3E,iFAAiF;QACjF,IAAI,oBAAwC,CAAC;QAC7C,IAAI,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAClC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACnD,IAAI,aAAa,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;gBAC/F,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC;gBACjC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;YACtC,CAAC;YACD,oBAAoB,GAAG,aAAa,EAAE,YAAY,CAAC;QACrD,CAAC;QAED,mEAAmE;QACnE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;YAChF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,+EAA+E;QAC/E,MAAM,YAAY,GAAG,SAAS,EAAE,YAAY,IAAI,oBAAoB,IAAI,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC;QACtG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAE5D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAC9D,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;oBAC/D,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBACrE,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CACT,+DAA+D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAClH,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;YAC5B,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QACtC,CAAC;QAED,4EAA4E;QAC5E,MAAM,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;QAC7F,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC/E,IAAI,aAAa,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;YAC/F,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC;YACjC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QACtC,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/docker/provider-config.d.ts

@@ -22,6 +22,32 @@ export type RequestBodyRewriter = (body: Record<string, unknown>, context: {
     method: string;
     path: string;
 }) => RewriteResult | null;
+/**
+ * Upstream target for provider requests when the default API host
+ * is overridden via environment variables (e.g., ANTHROPIC_BASE_URL).
+ * The MITM proxy uses this to route upstream connections to a custom
+ * API gateway (e.g., LiteLLM) instead of the provider's canonical host.
+ */
+export interface UpstreamTarget {
+    /** Hostname of the upstream server. */
+    readonly hostname: string;
+    /** Port number of the upstream server. */
+    readonly port: number;
+    /** Path prefix to prepend to all request paths ('' for none). */
+    readonly pathPrefix: string;
+    /** Whether to use TLS for the upstream connection. */
+    readonly useTls: boolean;
+}
+/**
+ * Parses a base URL string into an UpstreamTarget.
+ *
+ * Supports http:// and https:// URLs. The path component becomes the
+ * pathPrefix (trailing slashes stripped). Defaults to port 443 for
+ * https and port 80 for http when no port is specified.
+ *
+ * @throws {Error} If the URL uses an unsupported protocol.
+ */
+export declare function parseUpstreamBaseUrl(baseUrl: string): UpstreamTarget;
 export interface ProviderConfig {
     /** Hostname of the API endpoint (e.g., 'api.anthropic.com'). */
     readonly host: string;
@@ -52,6 +78,12 @@ export interface ProviderConfig {
      * Only applies to POST requests. Requires requestRewriter to be set.
      */
     readonly rewriteEndpoints?: readonly string[];
+    /**
+     * Optional upstream target override. When set, the MITM proxy routes
+     * requests to this target instead of the provider's canonical host.
+     * Populated from environment variables (e.g., ANTHROPIC_BASE_URL).
+     */
+    readonly upstreamTarget?: UpstreamTarget;
 }
 export interface EndpointPattern {
     readonly method: 'GET' | 'POST' | 'PUT' | 'DELETE';

package/dist/docker/provider-config.js

@@ -5,6 +5,26 @@
  * and fake key prefix. The proxy uses these to filter requests and swap
  * sentinel keys for real ones.
  */
+/**
+ * Parses a base URL string into an UpstreamTarget.
+ *
+ * Supports http:// and https:// URLs. The path component becomes the
+ * pathPrefix (trailing slashes stripped). Defaults to port 443 for
+ * https and port 80 for http when no port is specified.
+ *
+ * @throws {Error} If the URL uses an unsupported protocol.
+ */
+export function parseUpstreamBaseUrl(baseUrl) {
+    const parsed = new URL(baseUrl);
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+        throw new Error(`Unsupported protocol in upstream base URL: ${parsed.protocol}`);
+    }
+    const useTls = parsed.protocol === 'https:';
+    const defaultPort = useTls ? 443 : 80;
+    const port = parsed.port ? parseInt(parsed.port, 10) : defaultPort;
+    const pathPrefix = parsed.pathname.replace(/\/+$/, '');
+    return { hostname: parsed.hostname, port, pathPrefix, useTls };
+}
 /**
  * Checks whether a request method+path is in the provider's allowlist.
  */