@scrylog/cli 0.3.0 → 0.3.2

package/src/usage/resolvers/claude-auth.ts

@@ -1,208 +0,0 @@
-import { readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import type { TokenResolver } from "../resolver";
-import type { ClaudeOAuthCredentials } from "../types";
-import { IS_MAC } from "../../shared/platform";
-import { keychainCoordinator, CLAUDE_SAFE_STORAGE_ITEMS } from "./keychain-coordinator";
-import { ClaudeDesktopAuthResolver } from "./claude-desktop-auth";
-
-export const CLAUDE_KEYCHAIN_TOKEN_SERVICES = ["claude-api-oauth", "Claude Code-credentials"] as const;
-
-const DEFAULT_STALE_RESCAN_INTERVAL_MS = 10 * 60 * 1_000;
-
-export interface ClaudeAuthResolverOptions {
-  candidatesSource?: () => Promise<ClaudeOAuthCredentials[]>;
-  staleRescanIntervalMs?: number;
-  now?: () => number;
-}
-
-export class ClaudeAuthResolver implements TokenResolver<ClaudeOAuthCredentials> {
-  private cached?: ClaudeOAuthCredentials;
-  private nextScanAt = 0;
-  private readonly staleRescanIntervalMs: number;
-  private readonly now: () => number;
-  /** Last blocking keychain description seen while resolving candidates. */
-  private lastKeychainFailure: string | null = null;
-
-  constructor(
-    private readonly options: ClaudeAuthResolverOptions = {},
-  ) {
-    this.staleRescanIntervalMs = options.staleRescanIntervalMs ?? DEFAULT_STALE_RESCAN_INTERVAL_MS;
-    this.now = options.now ?? Date.now;
-  }
-
-  private readonly debug = (message: string, meta?: Record<string, unknown>) => {
-    // Avoid coupling to logger; stderr debug line is acceptable for resolver diagnostics.
-    if (process.env.SCRYLOG_DEBUG_AUTH) {
-      process.stderr.write(`[scrylog:claude-auth] ${message}${meta ? ` ${JSON.stringify(meta)}` : ""}\n`);
-    }
-  };
-
-  async resolve(): Promise<ClaudeOAuthCredentials | null> {
-    const cached = this.cached;
-    if (cached && !cached.isStale) return cached;
-    // Debounce full candidate scans (which include keychain reads) while a
-    // cached-but-stale credential exists, so polls never scan every cycle.
-    if (cached && this.now() < this.nextScanAt) return cached;
-    const selected = selectClaudeCredentials(await this.resolveCandidates());
-    this.cached = selected ?? undefined;
-    this.nextScanAt = this.now() + this.staleRescanIntervalMs;
-    this.lastKeychainFailure = selected
-      ? null
-      : keychainCoordinator.describeBlockingFailure([
-          { service: CLAUDE_KEYCHAIN_TOKEN_SERVICES[0]! },
-          { service: CLAUDE_KEYCHAIN_TOKEN_SERVICES[1]! },
-          ...CLAUDE_SAFE_STORAGE_ITEMS,
-        ]);
-    return this.cached ?? null;
-  }
-
-  /**
-   * Actionable keychain diagnostic for the latest resolution attempt, or null
-   * when the last attempt's failure was not keychain-related (missing items,
-   * absent caches are not surfaced).
-   */
-  describeKeychainFailure(): string | null {
-    return this.lastKeychainFailure;
-  }
-
-  /** Invalidates the daemon-lifetime credential cache (e.g. after a 401). */
-  invalidate(): void {
-    this.cached = undefined;
-    this.nextScanAt = 0;
-    for (const service of CLAUDE_KEYCHAIN_TOKEN_SERVICES) {
-      keychainCoordinator.clearMemo(service);
-    }
-  }
-
-  async resolveCandidates(): Promise<ClaudeOAuthCredentials[]> {
-    if (this.options.candidatesSource) return this.options.candidatesSource();
-    return this.resolveCandidatesUncached();
-  }
-
-  private async resolveCandidatesUncached(): Promise<ClaudeOAuthCredentials[]> {
-    const candidates: ClaudeOAuthCredentials[] = [];
-
-    // 1. macOS Keychain is the primary store on macOS.
-    if (IS_MAC) {
-      for (const service of CLAUDE_KEYCHAIN_TOKEN_SERVICES) {
-        const creds = await this.tryService(service);
-        if (creds) candidates.push(creds);
-      }
-    } else {
-      this.debug("Keychain not available on this platform", { platform: process.platform });
-    }
-
-    // 2. Claude Desktop app local token cache (macOS / Windows only).
-    //    Reads the Electron safeStorage-encrypted `oauth:tokenCache` from
-    //    ~/Library/Application Support/Claude/config.json (macOS) or
-    //    %APPDATA%/Anthropic/Claude/config.json (Windows).  This covers the
-    //    common case where the user has Claude Desktop but not Claude Code CLI.
-    const desktopCreds = await new ClaudeDesktopAuthResolver().resolve();
-    if (desktopCreds) candidates.push(desktopCreds);
-
-    // 3. Linux/WSL/Windows: Claude Code stores credentials in ~/.claude/.credentials.json
-    const fileCreds = this.tryCredentialsFile();
-    if (fileCreds) candidates.push(fileCreds);
-
-    // 4. Universal env-var fallback
-    const envToken = process.env.CLAUDE_CODE_OAUTH_TOKEN;
-    if (envToken) {
-      candidates.push({
-        accessToken: envToken,
-        owner: "environment",
-        credentialSource: "environment",
-      });
-    }
-
-    return candidates;
-  }
-
-  async isAvailable(): Promise<boolean> {
-    return (await this.resolve()) !== null;
-  }
-
-  private async tryService(service: string): Promise<ClaudeOAuthCredentials | null> {
-    try {
-      const output = await keychainCoordinator.read(service);
-      if (!output) return null;
-      return parseClaudeCredentialsJson(output, "keychain");
-    } catch (error) {
-      this.debug("Keychain lookup failed", { service, error: error instanceof Error ? error.message : String(error) });
-      return null;
-    }
-  }
-
-  private tryCredentialsFile(): ClaudeOAuthCredentials | null {
-    // On macOS, Keychain is authoritative; skip the file unless explicitly requested.
-    if (IS_MAC && !process.env.CLAUDE_CODE_USE_CREDENTIALS_FILE) return null;
-
-    const claudeDir = process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), ".claude");
-    const path = join(claudeDir, ".credentials.json");
-    try {
-      const raw = readFileSync(path, "utf8");
-      return parseClaudeCredentialsJson(raw, "credentials-file");
-    } catch (error) {
-      this.debug("Failed to read credentials file", { path, error: error instanceof Error ? error.message : String(error) });
-      return null;
-    }
-  }
-
-}
-
-const EXPIRY_SKEW_MS = 60_000;
-
-function parseExpiry(value: unknown): number | undefined | null {
-  if (value === undefined || value === null || value === "") return undefined;
-  const millis = typeof value === "number"
-    ? value
-    : typeof value === "string" && /^\d+$/.test(value.trim())
-      ? Number(value)
-      : typeof value === "string"
-        ? Date.parse(value)
-        : Number.NaN;
-  return Number.isFinite(millis) && millis > 0 ? millis : null;
-}
-
-export function parseClaudeCredentialsJson(
-  input: string,
-  credentialSource: "keychain" | "credentials-file",
-  now = Date.now(),
-): ClaudeOAuthCredentials | null {
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(input);
-  } catch {
-    return null;
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-  const outer = parsed as Record<string, unknown>;
-  const inner = outer.claudeAiOauth && typeof outer.claudeAiOauth === "object" && !Array.isArray(outer.claudeAiOauth)
-    ? outer.claudeAiOauth as Record<string, unknown>
-    : outer;
-  const token = inner.accessToken ?? inner.access_token;
-  if (typeof token !== "string" || !token.trim()) return null;
-
-  const expiryMillis = parseExpiry(inner.expiresAt ?? inner.expires_at);
-  if (expiryMillis === null) return null;
-  return {
-    accessToken: token.trim(),
-    refreshToken: typeof (inner.refreshToken ?? inner.refresh_token) === "string"
-      ? inner.refreshToken as string ?? inner.refresh_token as string
-      : undefined,
-    expiresAt: expiryMillis === undefined ? undefined : new Date(expiryMillis).toISOString(),
-    owner: "claude",
-    credentialSource,
-    isStale: expiryMillis === undefined || expiryMillis <= now + EXPIRY_SKEW_MS,
-    scopes: Array.isArray(inner.scopes) && inner.scopes.every((scope) => typeof scope === "string")
-      ? inner.scopes
-      : undefined,
-    rateLimitTier: typeof inner.rateLimitTier === "string" ? inner.rateLimitTier : undefined,
-    subscriptionType: typeof inner.subscriptionType === "string" ? inner.subscriptionType : undefined,
-  };
-}
-
-export function selectClaudeCredentials(candidates: ClaudeOAuthCredentials[]): ClaudeOAuthCredentials | null {
-  return candidates.find((candidate) => !candidate.isStale) ?? candidates[0] ?? null;
-}

package/src/usage/resolvers/claude-cli.ts

@@ -1,24 +0,0 @@
-import { existsSync } from "node:fs";
-import { homedir } from "node:os";
-import { whichCommand } from "../../shared/platform";
-import type { TokenResolver } from "../resolver";
-
-export class ClaudeCliResolver implements TokenResolver<string> {
-  async resolve(): Promise<string | null> {
-    const paths = [
-      process.env.CLAUDE_BIN_OVERRIDE,
-      `${homedir()}/.claude/local/claude`,
-      "/usr/local/bin/claude",
-    ];
-    for (const p of paths) {
-      if (p && existsSync(p)) return p;
-    }
-    const which = whichCommand("claude");
-    if (which) return which;
-    return null;
-  }
-
-  async isAvailable(): Promise<boolean> {
-    return (await this.resolve()) !== null;
-  }
-}

package/src/usage/resolvers/claude-desktop-auth.ts

@@ -1,170 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import type { TokenResolver } from "../resolver";
-import type { ClaudeOAuthCredentials } from "../types";
-import { IS_MAC, IS_WINDOWS } from "../../shared/platform";
-import { getChromiumSafeStorageKey, decryptSafeStorageBlob } from "./browser-cookies";
-import { keychainCoordinator, CLAUDE_SAFE_STORAGE_ITEMS } from "./keychain-coordinator";
-
-/**
- * Shape of a single entry in the `oauth:tokenCache` field of Claude Desktop's
- * `config.json`.  The key in the outer Record is a colon-separated composite:
- *   `<accountId>:<orgId>:<audience>:<space-separated scopes>`
- */
-interface TokenCacheEntry {
-  token: string;
-  refreshToken?: string;
-  /** Milliseconds since Unix epoch */
-  expiresAt?: number;
-  subscriptionType?: string;
-  rateLimitTier?: string;
-}
-
-/**
- * Reads the Claude Desktop app's local OAuth token cache and surfaces it as a
- * `ClaudeOAuthCredentials` so the OAuth usage route works without Claude Code CLI.
- *
- * Data source:
- *   macOS:   ~/Library/Application Support/Claude/config.json → oauth:tokenCache
- *   Windows: %APPDATA%/Anthropic/Claude/config.json → oauth:tokenCache
- *   Linux:   Claude Desktop is unavailable; resolver always returns null.
- *
- * The `oauth:tokenCache` value is an Electron safeStorage blob (base64, v10/v11
- * AES-128-CBC) decrypted with the Keychain key from "Claude Safe Storage".
- */
-export class ClaudeDesktopAuthResolver implements TokenResolver<ClaudeOAuthCredentials> {
-  private readonly debug = (message: string, meta?: Record<string, unknown>) => {
-    if (process.env.SCRYLOG_DEBUG_AUTH) {
-      process.stderr.write(
-        `[scrylog:claude-desktop-auth] ${message}${meta ? ` ${JSON.stringify(meta)}` : ""}\n`
-      );
-    }
-  };
-
-  async resolve(): Promise<ClaudeOAuthCredentials | null> {
-    const configPath = this.getConfigPath();
-    if (!configPath) {
-      this.debug("Claude Desktop not supported on this platform", { platform: process.platform });
-      return null;
-    }
-    if (!existsSync(configPath)) {
-      this.debug("Claude Desktop config.json not found", { path: configPath });
-      return null;
-    }
-
-    try {
-      const raw = readFileSync(configPath, "utf8");
-      const cfg = JSON.parse(raw) as Record<string, unknown>;
-      const blobB64 = cfg["oauth:tokenCache"];
-      if (typeof blobB64 !== "string" || !blobB64) {
-        this.debug("oauth:tokenCache missing or not a string in config.json");
-        return null;
-      }
-
-      const buf = Buffer.from(blobB64, "base64");
-      const key = await getChromiumSafeStorageKey("Claude Safe Storage", "Claude");
-      if (!key) {
-        this.debug("Failed to retrieve Claude Safe Storage key from Keychain");
-        return null;
-      }
-
-      const plaintext = decryptSafeStorageBlob(buf, key);
-      if (!plaintext) {
-        this.debug("Failed to decrypt oauth:tokenCache blob");
-        return null;
-      }
-
-      const cache = JSON.parse(plaintext) as Record<string, TokenCacheEntry>;
-      const creds = this.selectBestEntry(cache);
-      if (creds) {
-        this.debug("Resolved Claude Desktop OAuth credentials");
-      } else {
-        this.debug("No usable entry found in oauth:tokenCache");
-      }
-      return creds;
-    } catch (err) {
-      this.debug("Error reading Claude Desktop config", {
-        error: err instanceof Error ? err.message : String(err),
-      });
-      return null;
-    }
-  }
-
-  async isAvailable(): Promise<boolean> {
-    return (await this.resolve()) !== null;
-  }
-
-  /** Actionable keychain diagnostic for the latest resolution attempt. */
-  describeKeychainFailure(): string | null {
-    return keychainCoordinator.describeBlockingFailure(CLAUDE_SAFE_STORAGE_ITEMS);
-  }
-
-  private getConfigPath(): string | null {
-    const home = homedir();
-    if (IS_MAC) {
-      return join(home, "Library", "Application Support", "Claude", "config.json");
-    }
-    if (IS_WINDOWS) {
-      const appData = process.env.APPDATA ?? join(home, "AppData", "Roaming");
-      return join(appData, "Anthropic", "Claude", "config.json");
-    }
-    // Linux: Claude Desktop is not available
-    return null;
-  }
-
-  /**
-   * Pick the best (longest-lived, has user:profile scope) non-expired token entry.
-   *
-   * The cache key format is:
-   *   `<accountId>:<orgId>:<audience>:<space-separated scopes>`
-   * e.g.
-   *   `uuid1:uuid2:https://api.anthropic.com:user:inference user:file_upload user:profile ...`
-   *
-   * AnthropicOAuthUsageClient requires the `user:profile` scope, so entries that
-   * lack it are skipped.
-   */
-  private selectBestEntry(
-    cache: Record<string, TokenCacheEntry>
-  ): ClaudeOAuthCredentials | null {
-    const now = Date.now();
-    let bestCreds: ClaudeOAuthCredentials | null = null;
-    let bestExpiresAt = -Infinity;
-    let bestIsStale = true;
-
-    for (const [scopeKey, entry] of Object.entries(cache)) {
-      if (!entry.token) continue;
-      // Require user:profile scope for the OAuth usage endpoint
-      if (!scopeKey.includes("user:profile")) continue;
-
-      const isStale = entry.expiresAt === undefined || entry.expiresAt <= now + 60_000;
-      const expiresAt = entry.expiresAt ?? -Infinity;
-      if ((!isStale && bestIsStale) || (isStale === bestIsStale && expiresAt > bestExpiresAt)) {
-        bestExpiresAt = expiresAt;
-        bestIsStale = isStale;
-
-        // Parse space-separated scopes from the composite key.
-        // Key format after the audience URL: "...:<audience>:<scopes>"
-        const audienceMatch = scopeKey.match(/:[^:]+:\/\/[^:]+:(.+)$/);
-        const scopes = audienceMatch ? audienceMatch[1].split(" ") : undefined;
-
-        bestCreds = {
-          accessToken: entry.token,
-          refreshToken: entry.refreshToken,
-          expiresAt:
-            entry.expiresAt !== undefined
-              ? new Date(entry.expiresAt).toISOString()
-              : undefined,
-          owner: "claude",
-          credentialSource: "claude-desktop",
-          isStale,
-          scopes,
-          subscriptionType: entry.subscriptionType,
-          rateLimitTier: entry.rateLimitTier,
-        };
-      }
-    }
-
-    return bestCreds;
-  }
-}

package/src/usage/resolvers/claude-web.ts

@@ -1,82 +0,0 @@
-import type { TokenResolver } from "../resolver";
-import type { ClaudeWebSession } from "../types";
-import { usageWebSessionCache } from "../web-session-cache";
-import { BrowserCookieSourceCursor, buildCookieHeader, hasBrowserCookieSources } from "./browser-cookies";
-import { keychainCoordinator, CLAUDE_SAFE_STORAGE_ITEMS } from "./keychain-coordinator";
-
-export const CLAUDE_WEB_CACHE_KEY = "claude-web";
-
-export class ClaudeWebResolver implements TokenResolver<ClaudeWebSession> {
-  constructor(
-    private readonly cursorFactory: () => BrowserCookieSourceCursor = () =>
-      new BrowserCookieSourceCursor("claude.ai", ["sessionKey"], { preferredBrowserId: "claude-desktop" }),
-  ) {}
-
-  resolve(): Promise<ClaudeWebSession | null> {
-    return Promise.resolve().then(() => this.buildSession());
-  }
-
-  /**
-   * Cache-only resolution for planning and Web extras. Never reads a browser
-   * cookie store and never requests a Safe Storage key.
-   */
-  async resolveCached(): Promise<ClaudeWebSession | null> {
-    const observed = usageWebSessionCache.observe(CLAUDE_WEB_CACHE_KEY);
-    if (!observed.value) return null;
-    return {
-      cookieHeader: observed.value,
-      cookieCandidates: [observed.value],
-      cacheRevision: observed.revision,
-    };
-  }
-
-  /**
-   * True when an import could yield candidates: a cached value exists or some
-   * browser import source is present. Cheap existence checks only — no SQLite
-   * reads and no Keychain requests.
-   */
-  async hasImportSources(): Promise<boolean> {
-    if (usageWebSessionCache.observe(CLAUDE_WEB_CACHE_KEY).value) return true;
-    return hasBrowserCookieSources();
-  }
-
-  private async buildSession(): Promise<ClaudeWebSession | null> {
-    const observed = usageWebSessionCache.observe(CLAUDE_WEB_CACHE_KEY);
-    if (observed.value) {
-      return {
-        cookieHeader: observed.value,
-        cookieCandidates: [observed.value],
-        cacheRevision: observed.revision,
-      };
-    }
-
-    // Cache miss: import the first source. Later sources are only inspected
-    // when the client advances the cursor after a classified auth rejection.
-    const cursor = this.cursorFactory();
-    const candidate = await cursor.next();
-    if (!candidate) return null;
-    const header = buildCookieHeader(candidate.cookies);
-    if (!header) return null;
-    return {
-      cookieHeader: header,
-      cookieCandidates: [header],
-      cacheRevision: observed.revision,
-      importNext: async () => {
-        const next = await cursor.next();
-        return next ? buildCookieHeader(next.cookies) : null;
-      },
-    };
-  }
-
-  async isAvailable(): Promise<boolean> {
-    return (await this.resolve()) !== null;
-  }
-
-  /**
-   * Actionable keychain diagnostic for the latest import attempt (e.g. the
-   * Safe Storage read failed), or null when the miss was not keychain-related.
-   */
-  describeKeychainFailure(): string | null {
-    return keychainCoordinator.describeBlockingFailure(CLAUDE_SAFE_STORAGE_ITEMS);
-  }
-}

package/src/usage/resolvers/codex-auth.ts

@@ -1,174 +0,0 @@
-import { readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import type { TokenResolver } from "../resolver";
-import type { CodexOAuthCredentials } from "../types";
-import { UsageError } from "../errors";
-
-const NATIVE_EXPIRY_MARGIN_MS = 5 * 60 * 1_000;
-const NATIVE_REFRESH_MAX_AGE_MS = 8 * 24 * 60 * 60 * 1_000;
-
-export class CodexCredentialSourceError extends UsageError {
-  constructor(
-    public readonly reason: "malformed" | "unreadable",
-    message: string,
-  ) {
-    super(reason === "malformed" ? "invalid-response" : "transient", message);
-    this.name = "CodexCredentialSourceError";
-  }
-}
-
-function getCodexDir(): string {
-  if (process.env.CODEX_HOME) return process.env.CODEX_HOME;
-  return join(homedir(), ".codex");
-}
-
-function readConfigToml(codexDir: string): string | undefined {
-  const path = join(codexDir, "config.toml");
-  try {
-    const content = readFileSync(path, "utf8");
-    for (const line of content.split(/\r?\n/)) {
-      const match = line.match(/^chatgpt_base_url\s*=\s*"(.+)"\s*$/);
-      if (match) return match[1];
-    }
-  } catch {
-    // ignore
-  }
-  return undefined;
-}
-
-function decodeJwtClaims(token: string): { email?: string; sub?: string; org_id?: string } {
-  try {
-    const payload = token.split(".")[1];
-    if (!payload) return {};
-    const json = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as Record<string, unknown>;
-    return {
-      email: typeof json["email"] === "string" ? json["email"] : undefined,
-      sub: typeof json["sub"] === "string" ? json["sub"] : undefined,
-      org_id: typeof json["org_id"] === "string" ? json["org_id"] : undefined,
-    };
-  } catch {
-    return {};
-  }
-}
-
-function decodeJwtExpiry(token: string): number | undefined {
-  try {
-    const payload = token.split(".")[1];
-    if (!payload) return undefined;
-    const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as Record<string, unknown>;
-    return typeof claims["exp"] === "number" && Number.isFinite(claims["exp"])
-      ? claims["exp"] * 1_000
-      : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-function parseTimestamp(value: unknown): number | undefined {
-  if (typeof value !== "string") return undefined;
-  const timestamp = Date.parse(value);
-  return Number.isNaN(timestamp) ? undefined : timestamp;
-}
-
-export function isCodexCredentialFresh(
-  credentials: CodexOAuthCredentials,
-  now = Date.now(),
-): boolean {
-  if (credentials.tokenExpiresAt !== undefined) {
-    return credentials.tokenExpiresAt > now + NATIVE_EXPIRY_MARGIN_MS;
-  }
-  if (credentials.lastRefreshAt !== undefined) {
-    return now - credentials.lastRefreshAt < NATIVE_REFRESH_MAX_AGE_MS;
-  }
-  return false;
-}
-
-/**
- * Extract access_token and related fields from Codex auth.json.
- * Codex CLI writes credentials in a nested "tokens" object, e.g.:
- *   { "tokens": { "access_token": "...", "refresh_token": "...", "account_id": "..." } }
- * Some versions may write flat keys. This helper supports both formats.
- */
-function extractTokens(raw: Record<string, unknown>): {
-  accessToken: string | undefined;
-  accountId: string | undefined;
-  refreshToken: string | undefined;
-} {
-  const tokens =
-    typeof raw["tokens"] === "object" && raw["tokens"] !== null
-      ? (raw["tokens"] as Record<string, unknown>)
-      : undefined;
-
-  const accessToken =
-    typeof tokens?.["access_token"] === "string"
-      ? tokens["access_token"]
-      : typeof raw["access_token"] === "string"
-        ? raw["access_token"]
-        : undefined;
-
-  const accountId =
-    typeof tokens?.["account_id"] === "string" ? tokens["account_id"] : undefined;
-
-  const refreshToken =
-    typeof raw["refresh_token"] === "string"
-      ? raw["refresh_token"]
-      : typeof tokens?.["refresh_token"] === "string"
-        ? tokens["refresh_token"]
-        : undefined;
-
-  return { accessToken, accountId, refreshToken };
-}
-
-export class CodexAuthResolver implements TokenResolver<CodexOAuthCredentials> {
-  constructor(private readonly configuredBaseUrl?: string) {}
-
-  async resolve(): Promise<CodexOAuthCredentials | null> {
-    const codexDir = getCodexDir();
-    const authPath = join(codexDir, "auth.json");
-    let content: string;
-    try {
-      content = readFileSync(authPath, "utf8");
-    } catch (error) {
-      if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
-      throw new CodexCredentialSourceError("unreadable", "Codex auth.json could not be read");
-    }
-
-    try {
-      const parsed = JSON.parse(content) as unknown;
-      if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-        throw new Error("expected a JSON object");
-      }
-      const raw = parsed as Record<string, unknown>;
-      const tokens = extractTokens(raw);
-      if (!tokens.accessToken) return null;
-
-      const claims = decodeJwtClaims(tokens.accessToken);
-      const tokenExpiresAt = decodeJwtExpiry(tokens.accessToken) ?? parseTimestamp(raw["expires_at"]);
-      const lastRefreshAt = parseTimestamp(raw["last_refresh"]);
-      const chatgptBaseUrl = this.configuredBaseUrl ?? readConfigToml(codexDir);
-
-      return {
-        accessToken: tokens.accessToken,
-        refreshToken: tokens.refreshToken,
-        expiresAt: typeof raw["expires_at"] === "string" ? raw["expires_at"] : undefined,
-        ...(tokenExpiresAt !== undefined ? { tokenExpiresAt } : {}),
-        ...(lastRefreshAt !== undefined ? { lastRefreshAt } : {}),
-        accountEmail: claims.email ?? null,
-        accountId: tokens.accountId ?? claims.sub ?? claims.org_id ?? null,
-        ...(chatgptBaseUrl ? { chatgptBaseUrl } : {}),
-      };
-    } catch (error) {
-      if (error instanceof CodexCredentialSourceError) throw error;
-      throw new CodexCredentialSourceError("malformed", "Codex auth.json is malformed");
-    }
-  }
-
-  async isAvailable(): Promise<boolean> {
-    try {
-      return (await this.resolve()) !== null;
-    } catch {
-      return false;
-    }
-  }
-}