@scrylog/cli 0.1.3 → 0.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scrylog/cli",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "description": "Terminal dashboard for monitoring tmux sessions running AI coding agents",
   "license": "MIT",
   "type": "module",

package/src/api/routes/webhooks/claude.ts

@@ -46,27 +46,7 @@ export function createClaudeWebhookRouter(store: DaemonStore, logger: Logger, gi
     const storeId = `claude:${sessionId}`;
     if (eventType === "SessionEnd") {
       store.markLocalCommand(sessionId);
-      const existing = store.getSession(storeId);
-      if (existing) {
-        store.upsertSession({
-          ...existing,
-          state: "idle",
-          hasAttention: false,
-          summary: summary ?? existing.summary ?? "Claude session ended",
-          lastActivity: lastActivity ?? Date.now(),
-          detectionSource: "claude-hook",
-          claude: {
-            sessionId,
-            transcriptPath: transcriptPath ?? existing.claude?.transcriptPath ?? "",
-            ...(eventType !== undefined ? { hookEventType: eventType } : {}),
-            ...(eventTime !== undefined ? { hookEventTime: eventTime } : {}),
-            ...(hookSeq !== undefined ? { hookSeq } : {}),
-            ...(endReason !== undefined ? { endReason } : {}),
-            ...(errorType !== undefined ? { errorType } : {}),
-          },
-        });
-      }
-
+      store.removeSession(storeId);
       logger.info("webhook", "claude session ended", { event: "session.ended", tool: "claude", sessionId, reason: endReason });
       return c.json({ ok: true as const }, 200);
     }

package/src/api/routes/webhooks/opencode.ts

@@ -1,6 +1,7 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
 import type { ScrylogConfig } from "../../../shared/config";
 import type { DaemonStore } from "../../../daemon/store";
+import type { GitCollector } from "../../../daemon/collectors/git";
 import type { Logger } from "../../../shared/logger";
 import type { SessionModel } from "../../../shared/types";
 import type { OpencodeWebhookPayload } from "../../models/opencode";
@@ -8,7 +9,7 @@ import { mapHookState, extractSessionParentId } from "../../services/opencode-se
 import { WebhookRouteKey } from "../../docs/webhooks.keys";
 import { defineRoute } from "../../lib/route";
 
-export function createOpencodeWebhookRouter(store: DaemonStore, config: ScrylogConfig, logger: Logger): OpenAPIHono {
+export function createOpencodeWebhookRouter(store: DaemonStore, config: ScrylogConfig, logger: Logger, gitCollector?: GitCollector): OpenAPIHono {
   const router = new OpenAPIHono();
 
   router.openapi(defineRoute(WebhookRouteKey.WEBHOOK_OPENCODE), async (c) => {
@@ -46,6 +47,7 @@ export function createOpencodeWebhookRouter(store: DaemonStore, config: ScrylogC
 
       const title = payload.info?.title ?? payload.title ?? existing?.summary ?? "OpenCode session";
       const directory = payload.info?.directory ?? payload.directory ?? existing?.currentPath;
+      const resolvedProject = directory && gitCollector ? gitCollector.resolve(directory) : undefined;
       const parentSessionId = extractSessionParentId(event, payload, existing);
       const timeUpdated = payload.info?.time?.updated ?? Date.now();
 
@@ -66,6 +68,7 @@ export function createOpencodeWebhookRouter(store: DaemonStore, config: ScrylogC
           hasAttention,
           summary: title,
           currentPath: directory ?? existing.currentPath,
+          project: resolvedProject ?? existing.project,
           parentSessionId,
           lastActivity: stateChanged ? Date.now() : Math.max(existing.lastActivity, timeUpdated),
           opencode: {
@@ -88,6 +91,7 @@ export function createOpencodeWebhookRouter(store: DaemonStore, config: ScrylogC
           detectionSource: "opencode-hook",
           hasAttention,
           currentPath: directory,
+          project: resolvedProject,
           parentSessionId,
           opencode: {
             sessionId: rawId,

package/src/api/routes.ts

@@ -51,7 +51,7 @@ export function createApiApp(
   app.route("/api", createSystemRouter(store, config, logger));
   app.route("/api", createSessionsRouter(store, config));
   app.route("/api", createUsageRouter(store));
-  app.route("/api/webhook", createOpencodeWebhookRouter(store, config, logger));
+  app.route("/api/webhook", createOpencodeWebhookRouter(store, config, logger, gitCollector));
   app.route("/api/webhook", createClaudeWebhookRouter(store, logger, gitCollector));
   app.route("/api/webhook", createCodexWebhookRouter(store, logger, gitCollector));
 

package/src/cli/commands.ts

@@ -89,7 +89,7 @@ export function runTokenCommand(target: "mcp" | "api" | "both", action: string,
   throw new Error(`Unknown token action: ${action}`);
 }
 
-export async function runLogsCommand(): Promise<void> {
+export async function runLogsCommand(_options: GlobalCliOptions): Promise<void> {
   const logPath = getDaemonLogPath();
   process.stdout.write(`Log path: ${logPath}\n`);
   if (!existsSync(logPath)) {
@@ -247,6 +247,24 @@ export async function runSetupWizard(options: GlobalCliOptions): Promise<void> {
       }
     }
 
+    if (isClaudeHooksInstalled()) {
+      process.stdout.write("Claude hooks already installed.\n");
+    } else {
+      const installClaude = await prompt.yesNo("Install Claude hooks now?", false);
+      if (installClaude) {
+        await runClaudeHooksInstall(options);
+      }
+    }
+
+    if (isCodexHooksInstalled()) {
+      process.stdout.write("Codex hooks already installed.\n");
+    } else {
+      const installCodex = await prompt.yesNo("Install Codex hooks now?", false);
+      if (installCodex) {
+        await runCodexHooksInstall(options);
+      }
+    }
+
     const pollInterval = await prompt.text("Daemon poll interval (ms)", String(current.daemon.pollIntervalMs));
     const logLevel = await prompt.choose("Daemon log level", ["debug", "info", "warn", "error"], ["debug", "info", "warn", "error"].indexOf(current.daemon.logLevel));
     next.daemon.pollIntervalMs = parseOptionalInt(pollInterval, current.daemon.pollIntervalMs);
@@ -326,6 +344,52 @@ function parseOptionalInt(value: string, fallback: number): number {
 
 const OPENCODE_PLUGIN_NAME = "@scrylog/opencode-plugin";
 
+export function isClaudeHooksInstalled(homeDir = homedir()): boolean {
+  const settingsPath = join(homeDir, ".claude", "settings.json");
+  if (!existsSync(settingsPath)) return false;
+  try {
+    const settings = JSON.parse(readFileSync(settingsPath, "utf8")) as ClaudeSettings;
+    const hooks = settings.hooks ?? {};
+    return Object.values(hooks).some((rules) =>
+      rules.some((rule) =>
+        rule.hooks.some((h) => typeof h.command === "string" && h.command.includes("scrylog-claude-hook")),
+      ),
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function isCodexHooksInstalled(homeDir = homedir()): boolean {
+  const codexDir = process.env.CODEX_HOME ? process.env.CODEX_HOME : join(homeDir, ".codex");
+  const hooksPath = join(codexDir, "hooks.json");
+  if (!existsSync(hooksPath)) return false;
+  try {
+    const config = JSON.parse(readFileSync(hooksPath, "utf8")) as CodexHooksConfig;
+    const hooks = config.hooks ?? {};
+    return Object.values(hooks).some((rules) =>
+      rules.some((rule) =>
+        rule.hooks.some((h) => typeof h.command === "string" && h.command.includes("scrylog-codex-hook")),
+      ),
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function isOpencodePluginRegistered(homeDir = homedir()): boolean {
+  const settingsPath = join(homeDir, ".config", "opencode", "opencode.json");
+  if (!existsSync(settingsPath)) return false;
+  try {
+    const settings = JSON.parse(readFileSync(settingsPath, "utf8")) as OpenCodeSettings;
+    return (settings.plugin ?? []).some(
+      (plugin) => typeof plugin === "string" && plugin.includes(OPENCODE_PLUGIN_NAME),
+    );
+  } catch {
+    return false;
+  }
+}
+
 function backupBeforeWrite(path: string): void {
   if (!existsSync(path)) return;
   const bak = `${path}.bak`;
@@ -397,21 +461,21 @@ export async function runClaudeHooksInstall(options: GlobalCliOptions): Promise<
     mkdirSync(claudeDir, { recursive: true });
   }
 
+  if (isClaudeHooksInstalled()) {
+    process.stdout.write("Claude hooks are already installed.\n");
+    return;
+  }
+
   // Merge hooks — add scrylog entries without removing existing ones
   const existingHooks = settings.hooks ?? {};
   const updatedHooks: Record<string, ClaudeSettingsHookRule[]> = { ...existingHooks };
 
   for (const event of CLAUDE_HOOK_EVENTS) {
     const existing = updatedHooks[event] ?? [];
-    const alreadyInstalled = existing.some((rule) =>
-      rule.hooks.some((h) => typeof h.command === "string" && h.command.includes("scrylog-claude-hook")),
-    );
-    if (!alreadyInstalled) {
-      updatedHooks[event] = [
-        ...existing,
-        { matcher: "", hooks: [{ type: "command", command: hookBin }] },
-      ];
-    }
+    updatedHooks[event] = [
+      ...existing,
+      { matcher: "", hooks: [{ type: "command", command: hookBin }] },
+    ];
   }
 
   settings.hooks = updatedHooks;
@@ -490,22 +554,22 @@ export async function runCodexHooksInstall(options: GlobalCliOptions): Promise<v
     mkdirSync(codexDir, { recursive: true });
   }
 
+  if (isCodexHooksInstalled()) {
+    process.stdout.write("Codex hooks are already installed.\n");
+    return;
+  }
+
   // Merge hooks — add scrylog entries without removing existing ones
   const existingHooks = config.hooks ?? {};
   const updatedHooks: Record<string, CodexHookRule[]> = { ...existingHooks };
 
   for (const event of CODEX_HOOK_EVENTS) {
     const existing = updatedHooks[event] ?? [];
-    const alreadyInstalled = existing.some((rule) =>
-      rule.hooks.some((h) => typeof h.command === "string" && h.command.includes("scrylog-codex-hook")),
-    );
-    if (!alreadyInstalled) {
-      const entry: CodexHookRule = {
-        matcher: event === "UserPromptSubmit" || event === "Stop" ? undefined : "",
-        hooks: [{ type: "command", command: hookBin, ...(event === "Stop" ? { timeout: 30 } : {}) }],
-      };
-      updatedHooks[event] = [...existing, entry];
-    }
+    const entry: CodexHookRule = {
+      matcher: event === "UserPromptSubmit" || event === "Stop" ? undefined : "",
+      hooks: [{ type: "command", command: hookBin, ...(event === "Stop" ? { timeout: 30 } : {}) }],
+    };
+    updatedHooks[event] = [...existing, entry];
   }
 
   config.hooks = updatedHooks;
@@ -549,9 +613,7 @@ export async function runOpenCodeHooksInstall(options: GlobalCliOptions): Promis
 
   // Merge plugin entry without removing existing ones
   const existingPlugins = settings.plugin ?? [];
-  const alreadyInstalled = existingPlugins.some(
-    (plugin) => typeof plugin === "string" && plugin.includes(OPENCODE_PLUGIN_NAME),
-  );
+  const alreadyInstalled = isOpencodePluginRegistered();
 
   if (!alreadyInstalled) {
     settings.plugin = [...existingPlugins, OPENCODE_PLUGIN_NAME];

package/src/daemon/collectors/claude/collector.ts

@@ -145,6 +145,16 @@ export class ClaudeCollector implements Collector {
   private processTranscript(transcript: import("./discovery").DiscoveredTranscript, _hasRunning: boolean): void {
     const store = this.store!;
     const config = this.config!;
+
+    // Do not re-add sessions that were explicitly ended via SessionEnd hook.
+    // The transcript file persists on disk after the session ends; without this
+    // guard, the discovery cycle would recreate the session immediately after
+    // the webhook removed it.
+    if (store.isLocalCommand(transcript.sessionId)) {
+      store.removeSession(`claude:${transcript.sessionId}`);
+      return;
+    }
+
     const existingSession = store.getSession(`claude:${transcript.sessionId}`);
     const watched = this.watched.get(transcript.path);
     if (

package/src/daemon/collectors/opencode/collector.ts

@@ -258,8 +258,9 @@ export class OpenCodeCollector implements Collector {
                 inst.url,
                 inst.pendingPermissions,
                 inst.pendingQuestions,
+                this.gitCollector,
               );
-              const merged: SessionModel = { ...existing, state: updated.state, hasAttention: updated.hasAttention };
+              const merged: SessionModel = { ...existing, state: updated.state, hasAttention: updated.hasAttention, project: updated.project ?? existing.project };
               inst.sessions.set(props.sessionID, merged);
               store.upsertSession(merged);
               if (prevState !== merged.state) {
@@ -385,8 +386,9 @@ export class OpenCodeCollector implements Collector {
       inst.url,
       inst.pendingPermissions,
       inst.pendingQuestions,
+      this.gitCollector,
     );
-    const merged: SessionModel = { ...existing, state: updated.state, hasAttention: updated.hasAttention };
+    const merged: SessionModel = { ...existing, state: updated.state, hasAttention: updated.hasAttention, project: updated.project ?? existing.project };
     inst.sessions.set(sessionId, merged);
     store.upsertSession(merged);
     if (prevState !== merged.state) {

package/src/daemon/store.ts

@@ -4,6 +4,22 @@ import { NOOP_LOGGER } from "../shared/logger";
 import type { CollectorStatus, DaemonState, SessionInfo, SessionModel, StoreEvent } from "../shared/types";
 import type { RetentionConfig } from "../shared/config";
 
+/**
+ * Returns true when an incoming claude-hook "working" event represents an explicit
+ * user response to a pending attention (permission or question), so the attention
+ * can be cleared. Background working events (unrelated subagent activity) return false.
+ */
+function resolvesAttention(existing: SessionModel, incoming: SessionModel): boolean {
+  const evt = incoming.claude?.hookEventType;
+  if (evt === "UserPromptSubmit" || evt === "PermissionDenied") return true;
+  if (
+    (evt === "PreToolUse" || evt === "PostToolUse")
+    && existing.claude?.attentionKind === "permission"
+    && incoming.claude?.toolName === existing.claude.toolName
+  ) return true;
+  return false;
+}
+
 /**
  * In-memory state store for the daemon.
  * Maintains all session data and emits typed StoreEvent events on changes.
@@ -143,6 +159,18 @@ export class DaemonStore extends EventEmitter {
       });
     }
 
+    // For all sessions: preserve a previously-resolved project/currentPath when
+    // the incoming model lacks them. Project resolution can transiently fail
+    // (Claude slug decode returning null, OpenCode directory not yet populated),
+    // and once resolved the association must not oscillate back to undefined.
+    // An incoming model that carries a non-empty project still wins.
+    if (existing && !session.project && existing.project) {
+      session = { ...session, project: existing.project };
+    }
+    if (existing && !session.currentPath && existing.currentPath) {
+      session = { ...session, currentPath: existing.currentPath };
+    }
+
     // Preserve stateChangedAt from the stored session when the incoming model
     // doesn't carry it (e.g. built by processTranscript from file state only).
     if (existing && !session.stateChangedAt && existing.stateChangedAt) {
@@ -163,25 +191,50 @@ export class DaemonStore extends EventEmitter {
         session = { ...session, state: existing.state, stateChangedAt: existing.stateChangedAt };
       } else {
         this.suppressedIdle.delete(session.id);
-        const isGracePeriodIdleToWorking = existing.state === "idle"
+
+        // For hook-managed Claude sessions: pending attention (waiting-input +
+        // hasAttention) takes precedence over concurrent background working events
+        // until the user explicitly responds. Background subagent activity must not
+        // clear the permission/question from the dashboard.
+        const pendingAttention = existing.state === "waiting-input"
+          && existing.hasAttention === true
           && session.state === "working"
-          && existing.lastChildActiveAt
-          && (now - existing.lastChildActiveAt) < 1500;
+          && session.detectionSource === "claude-hook"
+          && !resolvesAttention(existing, session);
 
-        if (session.state === "working") {
+        if (pendingAttention) {
+          // Revert to waiting-input, advancing only the claude metadata (hookSeq etc.)
+          // so subsequent events are not rejected as stale.
           session = {
             ...session,
-            stableForMs: 0,
-            stateChangedAt: now,
-            lastWorkingChangedAt: isGracePeriodIdleToWorking
-              ? (existing.lastWorkingChangedAt ?? now)
-              : now,
+            state: "waiting-input" as SessionModel["state"],
+            hasAttention: true,
+            summary: existing.summary,
+            activeTool: existing.activeTool,
+            stateChangedAt: existing.stateChangedAt,
+            stableForMs: existing.stableForMs,
           };
         } else {
-          session = { ...session, stableForMs: 0, stateChangedAt: now };
+          const isGracePeriodIdleToWorking = existing.state === "idle"
+            && session.state === "working"
+            && existing.lastChildActiveAt
+            && (now - existing.lastChildActiveAt) < 1500;
+
+          if (session.state === "working") {
+            session = {
+              ...session,
+              stableForMs: 0,
+              stateChangedAt: now,
+              lastWorkingChangedAt: isGracePeriodIdleToWorking
+                ? (existing.lastWorkingChangedAt ?? now)
+                : now,
+            };
+          } else {
+            session = { ...session, stableForMs: 0, stateChangedAt: now };
 
-          if (session.state === "waiting-input" || session.state === "error") {
-            session = { ...session, lastWorkingChangedAt: undefined, lastChildActiveAt: undefined };
+            if (session.state === "waiting-input" || session.state === "error") {
+              session = { ...session, lastWorkingChangedAt: undefined, lastChildActiveAt: undefined };
+            }
           }
         }
       }

package/src/service/manager.ts

@@ -64,7 +64,7 @@ export function resolveDaemonExec(configPath?: string, daemonPath = whichCommand
 export function renderLaunchAgentPlist(configPath?: string): string {
   const args = resolveDaemonExec(configPath);
   const programArguments = args.map((arg) => `      <string>${xmlEscape(arg)}</string>`).join("\n");
-  const path = launchdPath(args);
+  const path = resolveServicePath(args);
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -91,11 +91,13 @@ ${programArguments}
 
 export function renderSystemdUserUnit(configPath?: string): string {
   const args = resolveDaemonExec(configPath);
+  const path = resolveServicePath(args);
   return `[Unit]
 Description=scrylog daemon
 After=default.target
 
 [Service]
+Environment="PATH=${path}"
 ExecStart=${args.map(shellQuote).join(" ")}
 Restart=on-failure
 RestartSec=3
@@ -248,7 +250,7 @@ function shellQuote(value: string): string {
   return `'${value.replace(/'/g, `'"'"'`)}'`;
 }
 
-function launchdPath(args: string[]): string {
+function resolveServicePath(args: string[]): string {
   const commandPath = args[0];
   const candidates = [
     commandPath && isAbsolute(commandPath) ? dirname(commandPath) : undefined,

package/src/tui/index.ts

@@ -1,4 +1,6 @@
 #!/usr/bin/env bun
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
 import { loadConfig } from "../shared/config";
 import type { ScrylogConfig } from "../shared/config";
 import { DaemonClient } from "./client";
@@ -17,7 +19,7 @@ import {
   runTokenCommand,
 } from "../cli/commands";
 
-function printHelp() {
+export function printHelp() {
   process.stdout.write(`scrylog
 
 Usage:
@@ -30,11 +32,18 @@ Usage:
   scrylog claude hooks install [--config <path>]
   scrylog codex hooks install [--config <path>]
   scrylog opencode hooks install [--config <path>]
-  scrylog logs
+  scrylog logs [--config <path>]
 
 Options:
   --config <path>   Load config from an explicit path
   -h, --help        Show this help text
+  -V, --version     Show the installed scrylog version
+
+See also:
+  scrylogd            Background daemon (collects sessions and serves API/MCP)
+  scrylog-mcp         stdio MCP server that proxies daemon data to AI agents
+  scrylog-claude-hook Claude Code lifecycle hook binary
+  scrylog-codex-hook  Codex CLI lifecycle hook binary
 
 Notes:
   Running scrylog with no subcommand launches the TUI dashboard.
@@ -47,6 +56,11 @@ Notes:
 `);
 }
 
+export function printVersion() {
+  const pkg = JSON.parse(readFileSync(join(import.meta.dir, "..", "..", "package.json"), "utf8")) as { version?: string };
+  process.stdout.write(`scrylog ${pkg.version ?? "unknown"}\n`);
+}
+
 function extractGlobalOptions(argv: string[]) {
   const args = [...argv];
   let configPath: string | undefined;
@@ -106,8 +120,24 @@ export function printDaemonNotRunning(config: ScrylogConfig, platform: ServiceSt
   }
 }
 
+export const TOKEN_USAGE = "Usage: scrylog token <mcp|api|both> <generate|rotate|clear>";
+
+export function parseTokenArgs(args: string[]): { target: "mcp" | "api" | "both"; action: string } {
+  const [target, action] = args;
+  if (!target) throw new Error(`Missing token target (mcp, api, or both). ${TOKEN_USAGE}`);
+  if (!action) throw new Error(`Missing token action (generate, rotate, or clear). ${TOKEN_USAGE}`);
+  if (target !== "mcp" && target !== "api" && target !== "both") {
+    throw new Error(`Invalid token target: ${target}. Must be mcp, api, or both. ${TOKEN_USAGE}`);
+  }
+  return { target, action };
+}
+
 async function main(): Promise<void> {
   const { args, options } = extractGlobalOptions(process.argv.slice(2));
+  if (args.includes("--version") || args.includes("-V")) {
+    printVersion();
+    process.exit(0);
+  }
   if (args.includes("--help") || args.includes("-h")) {
     printHelp();
     process.exit(0);
@@ -142,19 +172,13 @@ async function main(): Promise<void> {
   }
 
   if (command === "token") {
-    if (!subcommand) throw new Error("Missing token target (mcp, api, or both)");
-    const action = args[2];
-    if (!action) throw new Error("Missing token action (generate, rotate, or clear)");
-    const target = subcommand;
-    if (target !== "mcp" && target !== "api" && target !== "both") {
-      throw new Error(`Invalid token target: ${target}. Must be mcp, api, or both.`);
-    }
-    runTokenCommand(target as "mcp" | "api" | "both", action, options);
+    const { target, action } = parseTokenArgs([subcommand, args[2]]);
+    runTokenCommand(target, action, options);
     return;
   }
 
   if (command === "logs") {
-    await runLogsCommand();
+    await runLogsCommand(options);
     return;
   }
 

package/src/usage/index.ts

@@ -8,11 +8,12 @@ export { ClaudeUsageProvider } from "./providers/claude";
 export { CodexUsageProvider } from "./providers/codex";
 export { OpenCodeGoUsageProvider } from "./providers/opencode-go";
 export { ClaudeAuthResolver } from "./resolvers/claude-auth";
+export { ClaudeDesktopAuthResolver } from "./resolvers/claude-desktop-auth";
 export { ClaudeWebResolver } from "./resolvers/claude-web";
 export { ClaudeCliResolver } from "./resolvers/claude-cli";
 export { CodexAuthResolver } from "./resolvers/codex-auth";
 export { OpenCodeGoWebResolver } from "./resolvers/opencode-go-web";
-export { extractCookies, buildCookieHeader } from "./resolvers/browser-cookies";
+export { extractCookies, buildCookieHeader, decryptSafeStorageBlob, getChromiumSafeStorageKey } from "./resolvers/browser-cookies";
 export { AnthropicOAuthUsageClient } from "./clients/anthropic-oauth-usage";
 export { AnthropicWebUsageClient } from "./clients/anthropic-web-usage";
 export { CodexOAuthUsageClient } from "./clients/codex-oauth-usage";

package/src/usage/resolvers/browser-cookies.ts

@@ -1,5 +1,5 @@
-import { execSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
+import * as child_process from "node:child_process";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { createDecipheriv, pbkdf2Sync } from "node:crypto";
 import { join } from "node:path";
@@ -11,32 +11,161 @@ export interface BrowserCookie {
   value: string;
 }
 
-const CHROME_COOKIE_PATHS = ((): string[] => {
+// ---------------------------------------------------------------------------
+// Browser catalog types
+// ---------------------------------------------------------------------------
+
+interface ChromiumProfileEntry {
+  /** Unique browser ID, e.g. "chrome", "brave", "claude-desktop" */
+  id: string;
+  /** Relative path under ~/Library/Application Support/ on macOS */
+  macOSPath: string;
+  /** Relative path under ~/.config/ on Linux */
+  linuxPath: string;
+  /** Relative path under %APPDATA%/ on Windows */
+  windowsPath: string;
+  /** macOS Keychain service label, e.g. "Chrome Safe Storage" */
+  keychainService?: string;
+  /** macOS Keychain account label, e.g. "Chrome" */
+  keychainAccount?: string;
+}
+
+interface GeckoProfileEntry {
+  /** Unique browser ID, e.g. "firefox", "zen" */
+  id: string;
+  /**
+   * Profiles parent folder name.
+   * macOS: ~/Library/Application Support/<profilesFolder>/Profiles
+   * Linux: ~/.mozilla/<profilesFolder>/Profiles
+   */
+  profilesFolder: string;
+}
+
+// ---------------------------------------------------------------------------
+// Browser catalogs
+// ---------------------------------------------------------------------------
+
+export const CHROMIUM_PROFILES: ChromiumProfileEntry[] = [
+  {
+    id: "chrome",
+    macOSPath: "Google/Chrome",
+    linuxPath: "google-chrome",
+    windowsPath: "Google/Chrome/User Data",
+    keychainService: "Chrome Safe Storage",
+    keychainAccount: "Chrome",
+  },
+  {
+    id: "edge",
+    macOSPath: "Microsoft Edge",
+    linuxPath: "microsoft-edge",
+    windowsPath: "Microsoft/Edge/User Data",
+    keychainService: "Microsoft Edge Safe Storage",
+    keychainAccount: "Microsoft Edge",
+  },
+  {
+    id: "brave",
+    macOSPath: "BraveSoftware/Brave-Browser",
+    linuxPath: "BraveSoftware/Brave-Browser",
+    windowsPath: "BraveSoftware/Brave-Browser/User Data",
+    keychainService: "Brave Safe Storage",
+    keychainAccount: "Brave",
+  },
+  {
+    id: "arc",
+    macOSPath: "Arc/User Data",
+    linuxPath: "Arc",
+    windowsPath: "Arc/User Data",
+    keychainService: "Arc Safe Storage",
+    keychainAccount: "Arc",
+  },
+  {
+    id: "vivaldi",
+    macOSPath: "Vivaldi",
+    linuxPath: "vivaldi",
+    windowsPath: "Vivaldi/User Data",
+    keychainService: "Vivaldi Safe Storage",
+    keychainAccount: "Vivaldi",
+  },
+  {
+    id: "chromium",
+    macOSPath: "Chromium",
+    linuxPath: "chromium",
+    windowsPath: "Chromium/User Data",
+    keychainService: "Chromium Safe Storage",
+    keychainAccount: "Chromium",
+  },
+  {
+    id: "yandex",
+    macOSPath: "Yandex/YandexBrowser",
+    linuxPath: "yandex-browser",
+    windowsPath: "Yandex/YandexBrowser/User Data",
+    keychainService: "Yandex Safe Storage",
+    keychainAccount: "Yandex",
+  },
+  {
+    // Claude Desktop app (Electron/Chromium) — macOS and Windows only
+    id: "claude-desktop",
+    macOSPath: "Claude",
+    linuxPath: "", // not available on Linux
+    windowsPath: "Anthropic/Claude",
+    keychainService: "Claude Safe Storage",
+    keychainAccount: "Claude",
+  },
+];
+
+export const GECKO_PROFILES: GeckoProfileEntry[] = [
+  { id: "firefox", profilesFolder: "Firefox" },
+  { id: "zen", profilesFolder: "zen" },
+];
+
+const SAFARI_COOKIE_PATH = join(homedir(), "Library", "Cookies", "Cookies.binarycookies");
+
+// ---------------------------------------------------------------------------
+// Platform root resolution
+// ---------------------------------------------------------------------------
+
+function chromiumRootPath(entry: ChromiumProfileEntry): string {
   const home = homedir();
   if (IS_MAC) {
-    return [
-      join(home, "Library", "Application Support", "Google", "Chrome", "Default", "Cookies"),
-      join(home, "Library", "Application Support", "Google", "Chrome", "Profile 1", "Cookies"),
-    ];
+    if (!entry.macOSPath) return "";
+    return join(home, "Library", "Application Support", entry.macOSPath);
   }
   if (IS_WINDOWS) {
-    return [
-      join(home, "AppData", "Local", "Google", "Chrome", "User Data", "Default", "Cookies"),
-    ];
+    const appData = process.env.APPDATA ?? join(home, "AppData", "Roaming");
+    if (!entry.windowsPath) return "";
+    return join(appData, entry.windowsPath);
   }
-  // Linux / WSL
-  return [
-    join(home, ".config", "google-chrome", "Default", "Cookies"),
-    join(home, ".config", "chromium", "Default", "Cookies"),
-  ];
-})();
+  // Linux
+  if (!entry.linuxPath) return "";
+  return join(home, ".config", entry.linuxPath);
+}
 
-const SAFARI_COOKIE_PATH = join(homedir(), "Library", "Cookies", "Cookies.binarycookies");
+function geckoProfilesRoot(entry: GeckoProfileEntry): string {
+  const home = homedir();
+  if (IS_MAC) {
+    return join(home, "Library", "Application Support", entry.profilesFolder, "Profiles");
+  }
+  if (IS_WINDOWS) {
+    // Firefox on Windows is not in scope; skip
+    return "";
+  }
+  // Linux
+  return join(home, ".mozilla", entry.profilesFolder, "Profiles");
+}
+
+// ---------------------------------------------------------------------------
+// Chromium helpers
+// ---------------------------------------------------------------------------
 
-function getChromeSafeStorageKey(): Buffer | null {
+/**
+ * Derives the Chromium AES-128-CBC key for a given Keychain service label.
+ * macOS: reads from Keychain via `security` then applies PBKDF2.
+ * Linux/Windows: uses the fixed "peanuts" PBKDF2 key (no Keychain).
+ */
+export function getChromiumSafeStorageKey(service: string, _account: string): Buffer | null {
   try {
     if (IS_MAC) {
-      const password = execSync('security find-generic-password -s "Chrome Safe Storage" -w', {
+      const password = child_process.execSync(`security find-generic-password -s "${service}" -w`, {
         encoding: "utf8",
         stdio: ["pipe", "pipe", "pipe"],
       }).trim();
@@ -45,79 +174,190 @@ function getChromeSafeStorageKey(): Buffer | null {
     }
 
     if (IS_WINDOWS) {
-      return null;
+      // DPAPI not implemented; fall back to peanuts key (partial compatibility)
+      return pbkdf2Sync("peanuts", "saltysalt", 1003, 16, "sha1");
     }
+
+    // Linux
     return pbkdf2Sync("peanuts", "saltysalt", 1003, 16, "sha1");
   } catch {
     return null;
   }
 }
 
-function decryptChromeCookie(encrypted: Buffer, key: Buffer, dbVersion = 0): string | null {
-  if (encrypted.length < 3) return null;
-  // v10 or v11 prefix
-  const prefix = encrypted.slice(0, 3).toString("ascii");
+/**
+ * Returns all profile subdirectory paths under rootPath that match the
+ * Chromium naming conventions: Default, Profile *, user-*.
+ */
+export function discoverChromiumProfiles(rootPath: string): string[] {
+  if (!existsSync(rootPath)) return [];
+  let entries: string[];
+  try {
+    entries = readdirSync(rootPath, { withFileTypes: true })
+      .filter((d) => d.isDirectory())
+      .map((d) => d.name);
+  } catch {
+    return [];
+  }
+  return entries
+    .filter((name) => name === "Default" || /^Profile \d+$/.test(name) || /^user-/.test(name))
+    .map((name) => join(rootPath, name));
+}
+
+/**
+ * Returns the two candidate cookie DB paths for a Chromium profile directory.
+ * The caller is responsible for checking existence before opening.
+ */
+export function chromiumCookieDbPaths(profilePath: string): string[] {
+  return [join(profilePath, "Cookies"), join(profilePath, "Network", "Cookies")];
+}
+
+/**
+ * Internal: decrypt AES-128-CBC safeStorage payload, returning raw bytes after
+ * PKCS#7 un-padding.  Returns `null` on decryption failure.  Callers that need
+ * the Chrome v24+ 32-byte domain-hash strip must apply it themselves.
+ */
+function decryptSafeStorageRaw(buf: Buffer, key: Buffer): Buffer | null {
+  if (buf.length < 3) return null;
+  const prefix = buf.slice(0, 3).toString("ascii");
   if (prefix !== "v10" && prefix !== "v11") {
-    // Possibly plain text (older Chrome versions)
-    return encrypted.toString("utf8");
+    return buf; // plain text (older versions)
   }
   const iv = Buffer.alloc(16, 32); // space character (0x20) repeated 16 times
   try {
     const decipher = createDecipheriv("aes-128-cbc", key, iv);
-    let decrypted = Buffer.concat([decipher.update(encrypted.slice(3)), decipher.final()]);
+    let decrypted = Buffer.concat([decipher.update(buf.slice(3)), decipher.final()]);
     // Remove PKCS#7 padding
     const padLen = decrypted[decrypted.length - 1];
     if (padLen > 0 && padLen <= 16) {
       decrypted = decrypted.slice(0, decrypted.length - padLen);
     }
-    // Chrome v24+ prepends a SHA256 hash of the domain (32 bytes) to encrypted values
-    if (dbVersion >= 24 && decrypted.length >= 32) {
-      decrypted = decrypted.slice(32);
-    }
-    return decrypted.toString("utf8");
+    return decrypted;
   } catch {
     return null;
   }
 }
 
-function readChromeCookies(domain: string): BrowserCookie[] {
+/**
+ * Decrypt a Chromium/Electron safeStorage blob (AES-128-CBC, v10/v11 prefix)
+ * and return the result as a UTF-8 string.
+ *
+ * Used for Electron `safeStorage`-encrypted config fields (e.g. `oauth:tokenCache`
+ * in Claude Desktop's `config.json`).  Does **not** strip the Chrome v24+ 32-byte
+ * domain-hash prefix — use `decryptChromiumCookie` for cookie DB values.
+ */
+export function decryptSafeStorageBlob(buf: Buffer, key: Buffer): string | null {
+  const raw = decryptSafeStorageRaw(buf, key);
+  return raw !== null ? raw.toString("utf8") : null;
+}
+
+function decryptChromiumCookie(encrypted: Buffer, key: Buffer, dbVersion = 0): string | null {
+  const raw = decryptSafeStorageRaw(encrypted, key);
+  if (raw === null) return null;
+  // Chrome v24+ prepends a SHA256 hash of the domain (32 bytes) to encrypted cookie values
+  if (encrypted.length >= 3) {
+    const prefix = encrypted.slice(0, 3).toString("ascii");
+    if ((prefix === "v10" || prefix === "v11") && dbVersion >= 24 && raw.length >= 32) {
+      return raw.slice(32).toString("utf8");
+    }
+  }
+  return raw.toString("utf8");
+}
+
+export function readChromiumCookies(entry: ChromiumProfileEntry, domain: string): BrowserCookie[] {
   const cookies: BrowserCookie[] = [];
-  const key = getChromeSafeStorageKey();
-  if (!key) return cookies;
+  const rootPath = chromiumRootPath(entry);
+  if (!rootPath || !existsSync(rootPath)) return cookies;
 
-  for (const dbPath of CHROME_COOKIE_PATHS) {
-    if (!existsSync(dbPath)) continue;
-    let db: Database | undefined;
-    try {
-      db = new Database(dbPath, { readonly: true });
+  // Resolve decryption key only if we found a root (avoids Keychain prompts for absent browsers)
+  const key = getChromiumSafeStorageKey(
+    entry.keychainService ?? "",
+    entry.keychainAccount ?? ""
+  );
+  if (!key) return cookies;
 
-      // Chrome v24+ prepends a SHA256 hash (32 bytes) to encrypted cookie values
-      let dbVersion = 0;
+  const profiles = discoverChromiumProfiles(rootPath);
+  for (const profilePath of profiles) {
+    for (const dbPath of chromiumCookieDbPaths(profilePath)) {
+      if (!existsSync(dbPath)) continue;
+      let db: Database | undefined;
       try {
-        const versionStmt = db.query("SELECT value FROM meta WHERE key = 'version'");
-        const versionRow = versionStmt.get() as { value: number } | null;
-        if (versionRow) dbVersion = Number(versionRow.value);
+        db = new Database(dbPath, { readonly: true });
+
+        // Chrome v24+ prepends a SHA256 hash (32 bytes) to encrypted cookie values
+        let dbVersion = 0;
+        try {
+          const versionStmt = db.query("SELECT value FROM meta WHERE key = 'version'");
+          const versionRow = versionStmt.get() as { value: number } | null;
+          if (versionRow) dbVersion = Number(versionRow.value);
+        } catch {
+          // meta table may not exist in older DBs
+        }
+
+        const stmt = db.query(
+          "SELECT name, encrypted_value, host_key FROM cookies WHERE host_key LIKE ? AND expires_utc > ?"
+        );
+        const now = (Date.now() + 11644473600000) * 1000; // Chrome epoch offset
+        const rows = stmt.all(`%${domain}%`, now) as Array<{
+          name: string;
+          encrypted_value: Uint8Array;
+          host_key: string;
+        }>;
+        for (const row of rows) {
+          const value = decryptChromiumCookie(Buffer.from(row.encrypted_value), key, dbVersion);
+          if (value !== null) {
+            cookies.push({ name: row.name, value });
+          }
+        }
       } catch {
-        // meta table may not exist in older DBs
+        // Ignore permission errors, locked DB (SQLITE_BUSY), etc.
+      } finally {
+        db?.close();
       }
+    }
+  }
+
+  return cookies;
+}
 
-      const stmt = db.query(
-        "SELECT name, encrypted_value, host_key FROM cookies WHERE host_key LIKE ? AND expires_utc > ?"
-      );
-      const now = (Date.now() + 11644473600000) * 1000; // Chrome epoch offset
-      const rows = stmt.all(`%${domain}%`, now) as Array<{
-        name: string;
-        encrypted_value: Uint8Array;
-        host_key: string;
-      }>;
+// ---------------------------------------------------------------------------
+// Gecko (Firefox/Zen) support
+// ---------------------------------------------------------------------------
+
+export function readGeckoCookies(entry: GeckoProfileEntry, domain: string): BrowserCookie[] {
+  const cookies: BrowserCookie[] = [];
+  const profilesRoot = geckoProfilesRoot(entry);
+  if (!profilesRoot || !existsSync(profilesRoot)) return cookies;
+
+  let profileNames: string[];
+  try {
+    profileNames = readdirSync(profilesRoot, { withFileTypes: true })
+      .filter((d) => d.isDirectory() && d.name.includes(".default"))
+      .map((d) => d.name)
+      // Prefer .default-release over .default
+      .sort((a, b) => {
+        const aScore = a.endsWith(".default-release") ? 1 : 0;
+        const bScore = b.endsWith(".default-release") ? 1 : 0;
+        return bScore - aScore;
+      });
+  } catch {
+    return cookies;
+  }
+
+  for (const profileName of profileNames) {
+    const dbPath = join(profilesRoot, profileName, "cookies.sqlite");
+    if (!existsSync(dbPath)) continue;
+    let db: Database | undefined;
+    try {
+      db = new Database(dbPath, { readonly: true });
+      const stmt = db.query("SELECT name, value FROM moz_cookies WHERE host LIKE ?");
+      const rows = stmt.all(`%${domain}%`) as Array<{ name: string; value: string }>;
       for (const row of rows) {
-        const value = decryptChromeCookie(Buffer.from(row.encrypted_value), key, dbVersion);
-        if (value !== null) {
-          cookies.push({ name: row.name, value });
-        }
+        cookies.push({ name: row.name, value: row.value });
       }
+      if (cookies.length > 0) break; // first-profile-wins within a browser
     } catch {
-      // Ignore permission errors or locked DB
+      // Ignore locked or corrupt DB
     } finally {
       db?.close();
     }
@@ -126,6 +366,10 @@ function readChromeCookies(domain: string): BrowserCookie[] {
   return cookies;
 }
 
+// ---------------------------------------------------------------------------
+// Safari (macOS-only, unchanged)
+// ---------------------------------------------------------------------------
+
 function readSafariCookies(domain: string): BrowserCookie[] {
   const cookies: BrowserCookie[] = [];
   if (process.platform !== "darwin") return cookies;
@@ -134,7 +378,7 @@ function readSafariCookies(domain: string): BrowserCookie[] {
   try {
     const data = readFileSync(SAFARI_COOKIE_PATH);
     // Simple binarycookies parser
-    // Header: 4 bytes magic "cook", 4 bytes page size, then pages
+    // Header: 4 bytes magic "cook", 4 bytes page count, then pages
     if (data.length < 8 || data.toString("ascii", 0, 4) !== "cook") return cookies;
 
     const numPages = data.readUInt32BE(4);
@@ -185,11 +429,39 @@ function readSafariCookies(domain: string): BrowserCookie[] {
   return cookies;
 }
 
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+/**
+ * Extract cookies for the given domain from all available browser sources.
+ * Sources are tried in order that minimises Keychain prompts:
+ *   macOS:   Gecko (Firefox/Zen) → Safari → Chromium catalog
+ *   Linux:   Gecko → Chromium catalog
+ *   Windows: Gecko (limited) → Chromium catalog
+ *
+ * Returns the first source that yields ≥1 matching cookie; subsequent sources
+ * are skipped (first-source-wins).
+ */
 export function extractCookies(domain: string): BrowserCookie[] {
-  const chrome = readChromeCookies(domain);
-  if (chrome.length > 0) return chrome;
-  // Safari is only available on macOS.
-  if (IS_MAC) return readSafariCookies(domain);
+  // 1. Gecko sources first — no Keychain prompt, cheap read
+  for (const entry of GECKO_PROFILES) {
+    const cookies = readGeckoCookies(entry, domain);
+    if (cookies.length > 0) return cookies;
+  }
+
+  // 2. Safari (macOS only) — no Keychain prompt
+  if (IS_MAC) {
+    const safari = readSafariCookies(domain);
+    if (safari.length > 0) return safari;
+  }
+
+  // 3. Chromium catalog — may trigger Keychain prompts on macOS
+  for (const entry of CHROMIUM_PROFILES) {
+    const cookies = readChromiumCookies(entry, domain);
+    if (cookies.length > 0) return cookies;
+  }
+
   return [];
 }
 

package/src/usage/resolvers/claude-auth.ts

@@ -5,6 +5,7 @@ import { join } from "node:path";
 import type { TokenResolver } from "../resolver";
 import type { ClaudeOAuthCredentials } from "../types";
 import { IS_MAC } from "../../shared/platform";
+import { ClaudeDesktopAuthResolver } from "./claude-desktop-auth";
 
 export class ClaudeAuthResolver implements TokenResolver<ClaudeOAuthCredentials> {
   private readonly debug = (message: string, meta?: Record<string, unknown>) => {
@@ -26,11 +27,19 @@ export class ClaudeAuthResolver implements TokenResolver<ClaudeOAuthCredentials>
       this.debug("Keychain not available on this platform", { platform: process.platform });
     }
 
-    // 2. Linux/WSL/Windows: Claude Code stores credentials in ~/.claude/.credentials.json
+    // 2. Claude Desktop app local token cache (macOS / Windows only).
+    //    Reads the Electron safeStorage-encrypted `oauth:tokenCache` from
+    //    ~/Library/Application Support/Claude/config.json (macOS) or
+    //    %APPDATA%/Anthropic/Claude/config.json (Windows).  This covers the
+    //    common case where the user has Claude Desktop but not Claude Code CLI.
+    const desktopCreds = await new ClaudeDesktopAuthResolver().resolve();
+    if (desktopCreds) return desktopCreds;
+
+    // 3. Linux/WSL/Windows: Claude Code stores credentials in ~/.claude/.credentials.json
     const fileCreds = this.tryCredentialsFile();
     if (fileCreds) return fileCreds;
 
-    // 3. Universal env-var fallback
+    // 4. Universal env-var fallback
     const envToken = process.env.CLAUDE_CODE_OAUTH_TOKEN;
     if (envToken) {
       return { accessToken: envToken };

package/src/usage/resolvers/claude-desktop-auth.ts

@@ -0,0 +1,160 @@
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import type { TokenResolver } from "../resolver";
+import type { ClaudeOAuthCredentials } from "../types";
+import { IS_MAC, IS_WINDOWS } from "../../shared/platform";
+import { getChromiumSafeStorageKey, decryptSafeStorageBlob } from "./browser-cookies";
+
+/**
+ * Shape of a single entry in the `oauth:tokenCache` field of Claude Desktop's
+ * `config.json`.  The key in the outer Record is a colon-separated composite:
+ *   `<accountId>:<orgId>:<audience>:<space-separated scopes>`
+ */
+interface TokenCacheEntry {
+  token: string;
+  refreshToken?: string;
+  /** Milliseconds since Unix epoch */
+  expiresAt?: number;
+  subscriptionType?: string;
+  rateLimitTier?: string;
+}
+
+/**
+ * Reads the Claude Desktop app's local OAuth token cache and surfaces it as a
+ * `ClaudeOAuthCredentials` so the OAuth usage route works without Claude Code CLI.
+ *
+ * Data source:
+ *   macOS:   ~/Library/Application Support/Claude/config.json → oauth:tokenCache
+ *   Windows: %APPDATA%/Anthropic/Claude/config.json → oauth:tokenCache
+ *   Linux:   Claude Desktop is unavailable; resolver always returns null.
+ *
+ * The `oauth:tokenCache` value is an Electron safeStorage blob (base64, v10/v11
+ * AES-128-CBC) decrypted with the Keychain key from "Claude Safe Storage".
+ */
+export class ClaudeDesktopAuthResolver implements TokenResolver<ClaudeOAuthCredentials> {
+  private readonly debug = (message: string, meta?: Record<string, unknown>) => {
+    if (process.env.SCRYLOG_DEBUG_AUTH) {
+      process.stderr.write(
+        `[scrylog:claude-desktop-auth] ${message}${meta ? ` ${JSON.stringify(meta)}` : ""}\n`
+      );
+    }
+  };
+
+  async resolve(): Promise<ClaudeOAuthCredentials | null> {
+    const configPath = this.getConfigPath();
+    if (!configPath) {
+      this.debug("Claude Desktop not supported on this platform", { platform: process.platform });
+      return null;
+    }
+    if (!existsSync(configPath)) {
+      this.debug("Claude Desktop config.json not found", { path: configPath });
+      return null;
+    }
+
+    try {
+      const raw = readFileSync(configPath, "utf8");
+      const cfg = JSON.parse(raw) as Record<string, unknown>;
+      const blobB64 = cfg["oauth:tokenCache"];
+      if (typeof blobB64 !== "string" || !blobB64) {
+        this.debug("oauth:tokenCache missing or not a string in config.json");
+        return null;
+      }
+
+      const buf = Buffer.from(blobB64, "base64");
+      const key = getChromiumSafeStorageKey("Claude Safe Storage", "Claude");
+      if (!key) {
+        this.debug("Failed to retrieve Claude Safe Storage key from Keychain");
+        return null;
+      }
+
+      const plaintext = decryptSafeStorageBlob(buf, key);
+      if (!plaintext) {
+        this.debug("Failed to decrypt oauth:tokenCache blob");
+        return null;
+      }
+
+      const cache = JSON.parse(plaintext) as Record<string, TokenCacheEntry>;
+      const creds = this.selectBestEntry(cache);
+      if (creds) {
+        this.debug("Resolved Claude Desktop OAuth credentials");
+      } else {
+        this.debug("No usable entry found in oauth:tokenCache");
+      }
+      return creds;
+    } catch (err) {
+      this.debug("Error reading Claude Desktop config", {
+        error: err instanceof Error ? err.message : String(err),
+      });
+      return null;
+    }
+  }
+
+  async isAvailable(): Promise<boolean> {
+    return (await this.resolve()) !== null;
+  }
+
+  private getConfigPath(): string | null {
+    const home = homedir();
+    if (IS_MAC) {
+      return join(home, "Library", "Application Support", "Claude", "config.json");
+    }
+    if (IS_WINDOWS) {
+      const appData = process.env.APPDATA ?? join(home, "AppData", "Roaming");
+      return join(appData, "Anthropic", "Claude", "config.json");
+    }
+    // Linux: Claude Desktop is not available
+    return null;
+  }
+
+  /**
+   * Pick the best (longest-lived, has user:profile scope) non-expired token entry.
+   *
+   * The cache key format is:
+   *   `<accountId>:<orgId>:<audience>:<space-separated scopes>`
+   * e.g.
+   *   `uuid1:uuid2:https://api.anthropic.com:user:inference user:file_upload user:profile ...`
+   *
+   * AnthropicOAuthUsageClient requires the `user:profile` scope, so entries that
+   * lack it are skipped.
+   */
+  private selectBestEntry(
+    cache: Record<string, TokenCacheEntry>
+  ): ClaudeOAuthCredentials | null {
+    const now = Date.now();
+    let bestCreds: ClaudeOAuthCredentials | null = null;
+    let bestExpiresAt = -Infinity;
+
+    for (const [scopeKey, entry] of Object.entries(cache)) {
+      if (!entry.token) continue;
+      // Discard expired entries
+      if (entry.expiresAt !== undefined && entry.expiresAt <= now) continue;
+      // Require user:profile scope for the OAuth usage endpoint
+      if (!scopeKey.includes("user:profile")) continue;
+
+      const expiresAt = entry.expiresAt ?? Infinity;
+      if (expiresAt > bestExpiresAt) {
+        bestExpiresAt = expiresAt;
+
+        // Parse space-separated scopes from the composite key.
+        // Key format after the audience URL: "...:<audience>:<scopes>"
+        const audienceMatch = scopeKey.match(/:[^:]+:\/\/[^:]+:(.+)$/);
+        const scopes = audienceMatch ? audienceMatch[1].split(" ") : undefined;
+
+        bestCreds = {
+          accessToken: entry.token,
+          refreshToken: entry.refreshToken,
+          expiresAt:
+            entry.expiresAt !== undefined
+              ? new Date(entry.expiresAt).toISOString()
+              : undefined,
+          scopes,
+          subscriptionType: entry.subscriptionType,
+          rateLimitTier: entry.rateLimitTier,
+        };
+      }
+    }
+
+    return bestCreds;
+  }
+}