@scrylog/cli 0.2.0 → 0.3.1

package/src/usage/resolvers/claude-desktop-auth.ts

@@ -1,160 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import type { TokenResolver } from "../resolver";
-import type { ClaudeOAuthCredentials } from "../types";
-import { IS_MAC, IS_WINDOWS } from "../../shared/platform";
-import { getChromiumSafeStorageKey, decryptSafeStorageBlob } from "./browser-cookies";
-
-/**
- * Shape of a single entry in the `oauth:tokenCache` field of Claude Desktop's
- * `config.json`.  The key in the outer Record is a colon-separated composite:
- *   `<accountId>:<orgId>:<audience>:<space-separated scopes>`
- */
-interface TokenCacheEntry {
-  token: string;
-  refreshToken?: string;
-  /** Milliseconds since Unix epoch */
-  expiresAt?: number;
-  subscriptionType?: string;
-  rateLimitTier?: string;
-}
-
-/**
- * Reads the Claude Desktop app's local OAuth token cache and surfaces it as a
- * `ClaudeOAuthCredentials` so the OAuth usage route works without Claude Code CLI.
- *
- * Data source:
- *   macOS:   ~/Library/Application Support/Claude/config.json → oauth:tokenCache
- *   Windows: %APPDATA%/Anthropic/Claude/config.json → oauth:tokenCache
- *   Linux:   Claude Desktop is unavailable; resolver always returns null.
- *
- * The `oauth:tokenCache` value is an Electron safeStorage blob (base64, v10/v11
- * AES-128-CBC) decrypted with the Keychain key from "Claude Safe Storage".
- */
-export class ClaudeDesktopAuthResolver implements TokenResolver<ClaudeOAuthCredentials> {
-  private readonly debug = (message: string, meta?: Record<string, unknown>) => {
-    if (process.env.SCRYLOG_DEBUG_AUTH) {
-      process.stderr.write(
-        `[scrylog:claude-desktop-auth] ${message}${meta ? ` ${JSON.stringify(meta)}` : ""}\n`
-      );
-    }
-  };
-
-  async resolve(): Promise<ClaudeOAuthCredentials | null> {
-    const configPath = this.getConfigPath();
-    if (!configPath) {
-      this.debug("Claude Desktop not supported on this platform", { platform: process.platform });
-      return null;
-    }
-    if (!existsSync(configPath)) {
-      this.debug("Claude Desktop config.json not found", { path: configPath });
-      return null;
-    }
-
-    try {
-      const raw = readFileSync(configPath, "utf8");
-      const cfg = JSON.parse(raw) as Record<string, unknown>;
-      const blobB64 = cfg["oauth:tokenCache"];
-      if (typeof blobB64 !== "string" || !blobB64) {
-        this.debug("oauth:tokenCache missing or not a string in config.json");
-        return null;
-      }
-
-      const buf = Buffer.from(blobB64, "base64");
-      const key = getChromiumSafeStorageKey("Claude Safe Storage", "Claude");
-      if (!key) {
-        this.debug("Failed to retrieve Claude Safe Storage key from Keychain");
-        return null;
-      }
-
-      const plaintext = decryptSafeStorageBlob(buf, key);
-      if (!plaintext) {
-        this.debug("Failed to decrypt oauth:tokenCache blob");
-        return null;
-      }
-
-      const cache = JSON.parse(plaintext) as Record<string, TokenCacheEntry>;
-      const creds = this.selectBestEntry(cache);
-      if (creds) {
-        this.debug("Resolved Claude Desktop OAuth credentials");
-      } else {
-        this.debug("No usable entry found in oauth:tokenCache");
-      }
-      return creds;
-    } catch (err) {
-      this.debug("Error reading Claude Desktop config", {
-        error: err instanceof Error ? err.message : String(err),
-      });
-      return null;
-    }
-  }
-
-  async isAvailable(): Promise<boolean> {
-    return (await this.resolve()) !== null;
-  }
-
-  private getConfigPath(): string | null {
-    const home = homedir();
-    if (IS_MAC) {
-      return join(home, "Library", "Application Support", "Claude", "config.json");
-    }
-    if (IS_WINDOWS) {
-      const appData = process.env.APPDATA ?? join(home, "AppData", "Roaming");
-      return join(appData, "Anthropic", "Claude", "config.json");
-    }
-    // Linux: Claude Desktop is not available
-    return null;
-  }
-
-  /**
-   * Pick the best (longest-lived, has user:profile scope) non-expired token entry.
-   *
-   * The cache key format is:
-   *   `<accountId>:<orgId>:<audience>:<space-separated scopes>`
-   * e.g.
-   *   `uuid1:uuid2:https://api.anthropic.com:user:inference user:file_upload user:profile ...`
-   *
-   * AnthropicOAuthUsageClient requires the `user:profile` scope, so entries that
-   * lack it are skipped.
-   */
-  private selectBestEntry(
-    cache: Record<string, TokenCacheEntry>
-  ): ClaudeOAuthCredentials | null {
-    const now = Date.now();
-    let bestCreds: ClaudeOAuthCredentials | null = null;
-    let bestExpiresAt = -Infinity;
-
-    for (const [scopeKey, entry] of Object.entries(cache)) {
-      if (!entry.token) continue;
-      // Discard expired entries
-      if (entry.expiresAt !== undefined && entry.expiresAt <= now) continue;
-      // Require user:profile scope for the OAuth usage endpoint
-      if (!scopeKey.includes("user:profile")) continue;
-
-      const expiresAt = entry.expiresAt ?? Infinity;
-      if (expiresAt > bestExpiresAt) {
-        bestExpiresAt = expiresAt;
-
-        // Parse space-separated scopes from the composite key.
-        // Key format after the audience URL: "...:<audience>:<scopes>"
-        const audienceMatch = scopeKey.match(/:[^:]+:\/\/[^:]+:(.+)$/);
-        const scopes = audienceMatch ? audienceMatch[1].split(" ") : undefined;
-
-        bestCreds = {
-          accessToken: entry.token,
-          refreshToken: entry.refreshToken,
-          expiresAt:
-            entry.expiresAt !== undefined
-              ? new Date(entry.expiresAt).toISOString()
-              : undefined,
-          scopes,
-          subscriptionType: entry.subscriptionType,
-          rateLimitTier: entry.rateLimitTier,
-        };
-      }
-    }
-
-    return bestCreds;
-  }
-}

package/src/usage/resolvers/claude-web.ts

@@ -1,16 +0,0 @@
-import type { TokenResolver } from "../resolver";
-import type { ClaudeWebSession } from "../types";
-import { extractCookies, buildCookieHeader } from "./browser-cookies";
-
-export class ClaudeWebResolver implements TokenResolver<ClaudeWebSession> {
-  async resolve(): Promise<ClaudeWebSession | null> {
-    const cookies = extractCookies("claude.ai");
-    const sessionKey = cookies.find((c) => c.name === "sessionKey");
-    if (!sessionKey) return null;
-    return { cookieHeader: buildCookieHeader(cookies) };
-  }
-
-  async isAvailable(): Promise<boolean> {
-    return (await this.resolve()) !== null;
-  }
-}

package/src/usage/resolvers/codex-auth.ts

@@ -1,117 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import type { TokenResolver } from "../resolver";
-import type { CodexOAuthCredentials } from "../types";
-
-function getCodexDir(): string {
-  if (process.env.CODEX_HOME) return process.env.CODEX_HOME;
-  return join(homedir(), ".codex");
-}
-
-function readConfigToml(codexDir: string): string | undefined {
-  const path = join(codexDir, "config.toml");
-  if (!existsSync(path)) return undefined;
-  try {
-    const content = readFileSync(path, "utf8");
-    for (const line of content.split(/\r?\n/)) {
-      const match = line.match(/^chatgpt_base_url\s*=\s*"(.+)"\s*$/);
-      if (match) return match[1];
-    }
-  } catch {
-    // ignore
-  }
-  return undefined;
-}
-
-function decodeJwtClaims(token: string): { email?: string; sub?: string; org_id?: string } {
-  try {
-    const payload = token.split(".")[1];
-    if (!payload) return {};
-    const json = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as Record<string, unknown>;
-    return {
-      email: typeof json["email"] === "string" ? json["email"] : undefined,
-      sub: typeof json["sub"] === "string" ? json["sub"] : undefined,
-      org_id: typeof json["org_id"] === "string" ? json["org_id"] : undefined,
-    };
-  } catch {
-    return {};
-  }
-}
-
-/**
- * Extract access_token and related fields from Codex auth.json.
- * Codex CLI writes credentials in a nested "tokens" object, e.g.:
- *   { "tokens": { "access_token": "...", "refresh_token": "...", "account_id": "..." } }
- * Some versions may write flat keys. This helper supports both formats.
- */
-function extractTokens(raw: Record<string, unknown>): {
-  accessToken: string | undefined;
-  accountId: string | undefined;
-  refreshToken: string | undefined;
-} {
-  const tokens =
-    typeof raw["tokens"] === "object" && raw["tokens"] !== null
-      ? (raw["tokens"] as Record<string, unknown>)
-      : undefined;
-
-  const accessToken =
-    typeof raw["access_token"] === "string"
-      ? raw["access_token"]
-      : typeof tokens?.["access_token"] === "string"
-        ? tokens["access_token"]
-        : undefined;
-
-  const accountId =
-    typeof tokens?.["account_id"] === "string" ? tokens["account_id"] : undefined;
-
-  const refreshToken =
-    typeof raw["refresh_token"] === "string"
-      ? raw["refresh_token"]
-      : typeof tokens?.["refresh_token"] === "string"
-        ? tokens["refresh_token"]
-        : undefined;
-
-  return { accessToken, accountId, refreshToken };
-}
-
-export class CodexAuthResolver implements TokenResolver<CodexOAuthCredentials> {
-  async resolve(): Promise<CodexOAuthCredentials | null> {
-    const codexDir = getCodexDir();
-    const authPath = join(codexDir, "auth.json");
-    if (!existsSync(authPath)) return null;
-
-    try {
-      const raw = JSON.parse(readFileSync(authPath, "utf8")) as Record<string, unknown>;
-      const tokens = extractTokens(raw);
-      if (!tokens.accessToken) return null;
-
-      const claims = decodeJwtClaims(tokens.accessToken);
-      const chatgptBaseUrl = readConfigToml(codexDir);
-
-      return {
-        accessToken: tokens.accessToken,
-        refreshToken: tokens.refreshToken,
-        expiresAt: typeof raw["expires_at"] === "string" ? raw["expires_at"] : undefined,
-        accountEmail: claims.email ?? null,
-        accountId: tokens.accountId ?? claims.sub ?? claims.org_id ?? null,
-        ...(chatgptBaseUrl ? { chatgptBaseUrl } : {}),
-      };
-    } catch {
-      return null;
-    }
-  }
-
-  async isAvailable(): Promise<boolean> {
-    const codexDir = getCodexDir();
-    const authPath = join(codexDir, "auth.json");
-    if (!existsSync(authPath)) return false;
-    try {
-      const raw = JSON.parse(readFileSync(authPath, "utf8")) as Record<string, unknown>;
-      const { accessToken } = extractTokens(raw);
-      return typeof accessToken === "string" && accessToken.length > 0;
-    } catch {
-      return false;
-    }
-  }
-}

package/src/usage/resolvers/opencode-go-web.ts

@@ -1,14 +0,0 @@
-import type { TokenResolver } from "../resolver";
-import { extractCookies, buildCookieHeader } from "./browser-cookies";
-
-export class OpenCodeGoWebResolver implements TokenResolver<{ cookies: string }> {
-  async resolve(): Promise<{ cookies: string } | null> {
-    const cookies = extractCookies("opencode.ai");
-    if (cookies.length === 0) return null;
-    return { cookies: buildCookieHeader(cookies) };
-  }
-
-  async isAvailable(): Promise<boolean> {
-    return (await this.resolve()) !== null;
-  }
-}

package/src/usage/types.ts

@@ -1,190 +0,0 @@
-// Standardized unified types for usage limits — all providers share the same structure
-
-export interface UsageWindow {
-  /** Machine-readable identifier, e.g. "session", "weekly", "monthly", "designs" */
-  id: string;
-  /** Human-readable label, e.g. "Current Session", "Weekly", "Monthly" */
-  title: string;
-  /** Percentage used (0-100) */
-  usedPercent: number;
-  /** Absolute usage count (requests, tokens, credits) — optional */
-  used?: number;
-  /** Absolute limit — optional */
-  limit?: number;
-  /** Window duration in minutes — optional */
-  windowMinutes?: number;
-  /** Reset timestamp (ISO 8601) — preferred */
-  resetsAt?: string | null;
-  /** Seconds until reset — computed if not provided by provider */
-  resetInSec?: number;
-}
-
-export interface ProviderCostSnapshot {
-  /** Amount used */
-  used: number;
-  /** Limit amount */
-  limit: number;
-  /** Currency code, e.g. "USD" */
-  currency: string;
-  /** Billing period label, e.g. "Monthly" */
-  period: string;
-  /** Reset timestamp (ISO 8601) */
-  resetsAt?: string | null;
-  /** Last update timestamp (ISO 8601) */
-  updatedAt: string;
-}
-
-export interface UsageProviderEntry {
-  /** Provider identifier, e.g. "claude", "opencode-go" */
-  provider: string;
-
-  /** Account identifier — stable across hosts for grouping. null only when provider is unavailable or identity could not be determined. */
-  accountId: string | null;
-
-  /** Whether this provider is available on this machine (credentials detected) */
-  available: boolean;
-
-  /** Status of this provider */
-  status: "ok" | "error" | "unavailable" | "pending";
-
-  /** Metadata about the data source and account */
-  metadata?: {
-    /** How the data was obtained, e.g. "oauth", "web", "cli" */
-    dataSource?: string;
-    /** Account email if known */
-    accountEmail?: string | null;
-    /** Organization/account name if known */
-    accountOrganization?: string | null;
-    /** Subscription type, e.g. "pro", "free" */
-    subscriptionType?: string | null;
-    /** Rate limit tier */
-    rateLimitTier?: string | null;
-    /** Workspace ID (OpenCode Go) */
-    workspaceId?: string | null;
-    /** Workspace name (OpenCode Go) */
-    workspaceName?: string | null;
-  };
-
-  /** Errors specific to this provider (only present when status === "error") */
-  errors?: string[];
-
-  /** Usage windows — standardized for all providers */
-  windows?: UsageWindow[];
-
-  /** Cost/overage snapshot if available */
-  cost?: ProviderCostSnapshot | null;
-
-  /** Last update timestamp (ISO 8601) */
-  updatedAt?: string;
-}
-
-export interface UsageState {
-  /** All configured providers, including unavailable ones */
-  providers: UsageProviderEntry[];
-  /** Global refresh timestamp */
-  lastRefreshedAt: number;
-}
-
-// Legacy provider-specific snapshots (internal use only, mapped to UsageProviderEntry)
-
-export interface ClaudeUsageSnapshot {
-  source: "oauth" | "web" | "cli";
-  primary: RateWindowLegacy;
-  secondary: RateWindowLegacy | null;
-  opus: RateWindowLegacy | null;
-  extraRateWindows: NamedRateWindowLegacy[];
-  providerCost: ProviderCostSnapshotLegacy | null;
-  updatedAt: Date;
-  accountEmail: string | null;
-  accountOrganization: string | null;
-  loginMethod: string | null;
-  subscriptionType: string | null;
-  rateLimitTier: string | null;
-}
-
-export interface OpenCodeGoUsageSnapshot {
-  source: "web";
-  hasMonthlyUsage: boolean;
-  rollingUsagePercent: number;
-  weeklyUsagePercent: number;
-  monthlyUsagePercent: number;
-  rollingResetInSec: number;
-  weeklyResetInSec: number;
-  monthlyResetInSec: number;
-  updatedAt: Date;
-  workspaceId: string | null;
-  workspaceName: string | null;
-}
-
-// Legacy internal types (used by providers before mapping to unified model)
-
-export interface RateWindowLegacy {
-  usedPercent: number;
-  windowMinutes: number;
-  resetsAt: Date | null;
-  resetDescription: string | null;
-}
-
-export interface NamedRateWindowLegacy {
-  id: string;
-  title: string;
-  window: RateWindowLegacy;
-}
-
-export interface ProviderCostSnapshotLegacy {
-  used: number;
-  limit: number;
-  currencyCode: string;
-  period: string;
-  resetsAt: Date | null;
-  updatedAt: Date;
-}
-
-// Credential types
-
-export interface ClaudeOAuthCredentials {
-  accessToken: string;
-  refreshToken?: string;
-  expiresAt?: string;
-  scopes?: string[];
-  rateLimitTier?: string;
-  subscriptionType?: string;
-}
-
-export interface CodexOAuthCredentials {
-  accessToken: string;
-  refreshToken?: string;
-  expiresAt?: string;
-  accountEmail?: string | null;
-  accountId?: string | null;
-  chatgptBaseUrl?: string;
-}
-
-export interface ClaudeWebSession {
-  cookieHeader: string;
-}
-
-export type ClaudeDataSource = "oauth" | "web" | "cli" | "auto";
-
-export interface ClaudePlannerDecision {
-  primary: ClaudeDataSource;
-  fallback: ClaudeDataSource[];
-  webExtras: boolean;
-}
-
-export type CodexDataSource = "oauth" | "auto";
-
-export interface CodexUsageSnapshot {
-  source: "oauth";
-  planType: string | null;
-  primaryWindow: RateWindowLegacy | null;
-  secondaryWindow: RateWindowLegacy | null;
-  credits: {
-    hasCredits: boolean;
-    unlimited: boolean;
-    balance: number | null;
-  } | null;
-  updatedAt: Date;
-  accountEmail: string | null;
-  accountId: string | null;
-}