@timo972/cc-router 0.12.4 → 0.13.0-rc.0

package/dist/cli/cmd-setup.js

@@ -1,17 +1,15 @@
 import { select, input, confirm, password } from "@inquirer/prompts";
 import chalk from "chalk";
 import { detectPlatform, isMacos } from "../utils/platform.js";
-import { extractFromKeychainDetailed, extractFromCredentialsFileDetailed, formatExpiry, redactToken, } from "../utils/token-extractor.js";
-import { validateToken } from "../utils/token-validator.js";
 import { writeClaudeSettings, readClaudeProxySettings } from "../utils/claude-config.js";
 import { saveAccounts } from "../proxy/token-refresher.js";
 import { loadAccounts, accountsFileExists, readConfig, writeConfig, generateProxySecret } from "../config/manager.js";
 import { PROXY_PORT } from "../config/paths.js";
-import { DEFAULT_RATE_LIMITS, ACCOUNT_USER_DEFAULTS } from "../proxy/types.js";
 import { existsSync } from "fs";
 import { checkMitmproxyInstalled, isCaCertInstalled, generateCaCert, installCaCert, writeAddonScript, getNetworkExtensionStatus, openNetworkExtensionSettings, } from "../interceptor/mitmproxy-manager.js";
 import { printDesktopSupportExplainer, printNetworkExtensionInstructions } from "./cmd-client.js";
-import { createSetupAttempt, failAttemptFromError, withSetupTelemetryFlush, } from "../telemetry/setup-diagnostics.js";
+import { collectClaudeAccount } from "./account-flows.js";
+import { withSetupTelemetryFlush, } from "../telemetry/setup-diagnostics.js";
 // ─── Public registration ──────────────────────────────────────────────────────
 export function registerSetup(program) {
     program
@@ -28,142 +26,6 @@ function printDiagnosticId(outcome) {
         return;
     console.log(chalk.gray(`  Diagnostic ID: ${outcome.diagnosticId}`));
 }
-// ─── Shared single-account setup (also used by `accounts add`) ───────────────
-/**
- * Same step, but also hands back the setup attempt so the caller can mark the
- * `persistence` stage and the final outcome once the account is written.
- */
-export async function setupSingleAccountWithAttempt(index) {
-    const choices = [];
-    if (isMacos()) {
-        choices.push({ name: "Extract automatically from macOS Keychain  (recommended)", value: "keychain" });
-    }
-    choices.push({ name: "Read from ~/.claude/.credentials.json", value: "credentials" });
-    choices.push({ name: "Paste tokens manually", value: "manual" });
-    const method = await select({
-        message: "How do you want to add the tokens?",
-        choices,
-    });
-    const attempt = createSetupAttempt({
-        provider: "anthropic",
-        method: method === "keychain"
-            ? "macos_keychain"
-            : method === "credentials" ? "claude_credentials_file" : "manual_token",
-    });
-    attempt.stageCompleted("credential_source_selection");
-    // Shared by reference: the file-extraction fallback swaps in a manual-token attempt.
-    const current = { attempt };
-    let reached = "credential_read";
-    try {
-        return await collectAnthropicAccount(index, method, current, stage => { reached = stage; });
-    }
-    catch (error) {
-        // A thrown prompt or extraction error must still close the funnel record.
-        const outcome = failAttemptFromError(current.attempt, error, reached);
-        if (outcome)
-            printDiagnosticId(outcome);
-        throw error;
-    }
-}
-async function collectAnthropicAccount(index, method, current, reached) {
-    let attempt = current.attempt;
-    let tokens = null;
-    if (method === "keychain") {
-        process.stdout.write(chalk.gray("  Extracting from Keychain... "));
-        const extraction = await extractFromKeychainDetailed();
-        if (extraction.ok) {
-            tokens = extraction.tokens;
-            console.log(chalk.green("✓"));
-            console.log(chalk.gray(`  Token: ${redactToken(tokens.accessToken)}`));
-            console.log(chalk.gray(`  Expiry: ${formatExpiry(tokens.expiresAt)}`));
-        }
-        else {
-            console.log(chalk.red("✗"));
-            console.log(chalk.yellow("  Could not find credentials in Keychain."));
-            console.log(chalk.gray("  Make sure Claude Code is logged in: run `claude login` first."));
-            printDiagnosticId(attempt.stageFailed(extraction.error, "credential_read"));
-            const retry = await confirm({ message: "Try another extraction method?", default: true });
-            attempt.cancelled();
-            if (!retry)
-                return { account: null, attempt };
-            return setupSingleAccountWithAttempt(index);
-        }
-    }
-    if (method === "credentials") {
-        const extraction = extractFromCredentialsFileDetailed();
-        if (extraction.ok) {
-            tokens = extraction.tokens;
-            console.log(chalk.green(`  ✓ Found credentials in ~/.claude/.credentials.json`));
-            console.log(chalk.gray(`    Token: ${redactToken(tokens.accessToken)}`));
-            console.log(chalk.gray(`    Expiry: ${formatExpiry(tokens.expiresAt)}`));
-        }
-        else {
-            console.log(chalk.red("  ✗ ~/.claude/.credentials.json not found or unreadable."));
-            console.log(chalk.gray("  Make sure Claude Code is installed and you've run `claude login`."));
-            const retry = await confirm({ message: "Paste tokens manually instead?", default: true });
-            if (!retry) {
-                printDiagnosticId(attempt.stageFailed(extraction.error, "credential_read"));
-                attempt.cancelled();
-                return { account: null, attempt };
-            }
-            // The file-based attempt failed; the pasted tokens are a manual-token setup.
-            printDiagnosticId(attempt.failed(extraction.error, "credential_read"));
-            attempt = createSetupAttempt({ provider: "anthropic", method: "manual_token" });
-            current.attempt = attempt;
-            attempt.stageCompleted("credential_source_selection");
-            tokens = await promptManualTokens();
-        }
-    }
-    if (method === "manual") {
-        tokens = await promptManualTokens();
-    }
-    if (!tokens) {
-        attempt.cancelled();
-        return { account: null, attempt };
-    }
-    attempt.stageCompleted("credential_read");
-    attempt.stageCompleted("credential_parse");
-    reached("token_validation");
-    const defaultId = `max-account-${index}`;
-    const accountId = await input({
-        message: "Account ID (press Enter to accept default):",
-        default: defaultId,
-        validate: (v) => /^[a-zA-Z0-9_-]+$/.test(v) || "Only letters, numbers, _ and - allowed",
-    });
-    process.stdout.write(chalk.gray("  Validating tokens against Anthropic... "));
-    const validation = await validateToken(tokens.accessToken);
-    if (validation.valid) {
-        console.log(chalk.green("✓ Valid"));
-        attempt.stageCompleted("token_validation");
-    }
-    else {
-        console.log(chalk.red("✗ Invalid"));
-        console.log(chalk.yellow(`  Reason: ${validation.reason}`));
-        printDiagnosticId(attempt.stageFailed(validation.diagnostic, "token_validation"));
-        console.log(chalk.gray("  The token will be saved but may not work until refreshed."));
-        const keepAnyway = await confirm({ message: "Save this account anyway?", default: false });
-        if (!keepAnyway) {
-            attempt.cancelled();
-            return { account: null, attempt };
-        }
-    }
-    return {
-        account: {
-            id: accountId,
-            tokens,
-            healthy: validation.valid,
-            busy: false,
-            requestCount: 0,
-            errorCount: 0,
-            lastUsed: 0,
-            lastRefresh: 0,
-            consecutiveErrors: 0,
-            rateLimits: { ...DEFAULT_RATE_LIMITS },
-            ...ACCOUNT_USER_DEFAULTS,
-        },
-        attempt,
-    };
-}
 // ─── Full wizard ──────────────────────────────────────────────────────────────
 export async function runSetupWizard({ addMode }) {
     const platform = detectPlatform();
@@ -220,13 +82,9 @@ export async function runSetupWizard({ addMode }) {
             }
         }
     }
-    if (!addMode && isMacos()) {
-        console.log(chalk.cyan("  Tip: to add multiple accounts, you need to:"));
-        console.log(chalk.gray("  1. Log in to Claude Code with account 1 (already done if you use CC normally)"));
-        console.log(chalk.gray("  2. Extract tokens → log out → log in with account 2 → extract → repeat\n"));
-    }
     let numAccounts = 1;
     if (!addMode) {
+        console.log(chalk.gray("  Tip: each account can be signed in directly with the browser method — no logging Claude Code out between them.\n"));
         const { number } = await import("@inquirer/prompts");
         numAccounts = await number({
             message: "How many accounts do you want to configure now?",
@@ -240,14 +98,8 @@ export async function runSetupWizard({ addMode }) {
     for (let i = 0; i < numAccounts; i++) {
         const label = numAccounts > 1 ? `${i + 1}/${numAccounts}` : "";
         console.log(chalk.bold(`\n${"━".repeat(40)}\n  Account ${label}\n${"━".repeat(40)}\n`));
-        if (i > 0 && isMacos()) {
-            console.log(chalk.yellow(`  Before extracting account ${i + 1}:\n` +
-                `  1. Run: ${chalk.white("claude logout")}\n` +
-                `  2. Run: ${chalk.white("claude login")}  (log in with your next Max account)\n`));
-            await confirm({ message: "Ready?", default: true });
-        }
         const existingCount = hasExisting ? loadAccounts().length : 0;
-        const { account, attempt } = await setupSingleAccountWithAttempt(i + 1 + existingCount);
+        const { account, attempt } = await collectClaudeAccount({ index: i + 1 + existingCount });
         if (account) {
             newAccounts.push(account);
             savedAttempts.push(attempt);
@@ -379,42 +231,9 @@ async function runPostSetupFlow(accountCount) {
 function printDone(accountCount) {
     console.log(chalk.bold(`\n${"━".repeat(40)}\n  All done — ${accountCount} account(s) ready\n${"━".repeat(40)}\n`));
     console.log(`  Start the proxy:   ${chalk.cyan("cc-router start")}`);
-    console.log(`  Add more accounts: ${chalk.cyan("cc-router setup --add")}`);
+    console.log(`  Add more accounts: ${chalk.cyan("cc-router accounts login")} or ${chalk.cyan("cc-router setup --add")}`);
     console.log(`  Dashboard:         ${chalk.cyan("cc-router status")}\n`);
 }
-// ─── Manual token input ───────────────────────────────────────────────────────
-async function promptManualTokens() {
-    console.log(chalk.gray("\n  You can find your tokens by running:\n" +
-        "    macOS:         security find-generic-password -s 'Claude Code-credentials' -w\n" +
-        "    Linux/Windows: cat ~/.claude/.credentials.json\n"));
-    const accessToken = await password({
-        message: "Paste accessToken (sk-ant-oat01-...):",
-        mask: "•",
-        validate: (v) => v.startsWith("sk-ant-oat01-") || v.startsWith("sk-ant-")
-            ? true
-            : "Must start with sk-ant-oat01-",
-    });
-    const refreshToken = await password({
-        message: "Paste refreshToken (sk-ant-ort01-...):",
-        mask: "•",
-        validate: (v) => v.startsWith("sk-ant-ort01-") || v.startsWith("sk-ant-")
-            ? true
-            : "Must start with sk-ant-ort01-",
-    });
-    const useDefaultExpiry = await confirm({
-        message: "Use default expiry (8 hours from now)?",
-        default: true,
-    });
-    const expiresAt = useDefaultExpiry
-        ? Date.now() + 8 * 60 * 60 * 1000
-        : new Date(await input({ message: "Paste expiresAt (ISO date or ms timestamp):" })).getTime();
-    return {
-        accessToken,
-        refreshToken,
-        expiresAt,
-        scopes: ["user:inference", "user:profile"],
-    };
-}
 // ─── Client-mode setup (from wizard) ─────────────────────────────────────────
 async function runClientSetupFromWizard() {
     console.log(chalk.bold("\n🔗 Client Mode — Connect to a CC-Router server\n"));

package/dist/cli/cmd-status.js

@@ -98,7 +98,10 @@ async function dashboardLoop(port) {
         // `pendingIntent` is set by the Dashboard component via `onIntent`;
         // it defaults to "quit" so Ctrl+C (exitOnCtrlC) does the right thing
         // without the Dashboard ever firing onIntent.
-        let pendingIntent = "quit";
+        // Kept at the full union rather than narrowed to its initializer: the
+        // real value is written from inside `onIntent`, which control-flow
+        // analysis can't see, so without the cast every later branch is `never`.
+        let pendingIntent = { kind: "quit" };
         const instance = render(createElement(Dashboard, {
             port,
             baseUrl: target.baseUrl,
@@ -121,34 +124,95 @@ async function dashboardLoop(port) {
         }
         // Ink may have paused stdin — resume it so inquirer can read input.
         process.stdin.resume();
-        if (pendingIntent === "quit")
+        if (pendingIntent.kind === "quit")
             return;
-        // Intent: addAccount — run the OAuth flow, then POST the resulting
-        // tokens to the server we're connected to (local or remote).
-        console.log();
-        console.log(chalk.cyan("→ Adding a new account..."));
+        if (pendingIntent.kind === "addAccount") {
+            // Intent: addAccount — run the OAuth flow, then POST the resulting
+            // tokens to the server we're connected to (local or remote).
+            console.log();
+            console.log(chalk.cyan("→ Adding a new account..."));
+            console.log();
+            const added = await runAddAccountFlow(target);
+            if (added) {
+                console.log(chalk.green(`\n✓ Account "${added}" added. Returning to dashboard...\n`));
+            }
+            else {
+                console.log(chalk.yellow("\n  No account added. Returning to dashboard...\n"));
+            }
+            // Fall through → loop re-renders the dashboard
+            continue;
+        }
+        // Intent: reauth — sign in again under the existing id and replace the
+        // stored credentials in place, keeping the account's caps and settings.
         console.log();
-        const added = await runAddAccountFlow(target);
-        if (added) {
-            console.log(chalk.green(`\n✓ Account "${added}" added. Returning to dashboard...\n`));
+        console.log(chalk.cyan(`→ Re-authenticating ${pendingIntent.id}...`));
+        const reauthed = await runReauthFlow(target, pendingIntent);
+        console.log(reauthed
+            ? chalk.green(`\n✓ Account "${reauthed}" re-authenticated. Returning to dashboard...\n`)
+            : chalk.yellow("\n  No account re-authenticated. Returning to dashboard...\n"));
+    }
+}
+/**
+ * Runs the provider's sign-in with the id fixed, then POSTs the replacement
+ * record to /cc-router/accounts. Returns the id on success, or null if the
+ * operator aborted / an error occurred.
+ */
+async function runReauthFlow(target, intent) {
+    let attempt;
+    try {
+        const { collectReauthRecord } = await import("./account-flows.js");
+        const result = await collectReauthRecord({
+            id: intent.id,
+            provider: intent.provider,
+            ...(intent.email ? { email: intent.email } : {}),
+        });
+        if (!result)
+            return null;
+        attempt = result.attempt;
+        const res = await fetch(`${target.baseUrl}/cc-router/accounts`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                ...target.headers,
+            },
+            // `replace: true` is what makes this an in-place re-auth rather than a
+            // duplicate-id rejection.
+            body: JSON.stringify({ ...result.record, replace: true }),
+            signal: AbortSignal.timeout(5_000),
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => "");
+            console.error(chalk.red(`\n✗ Server rejected the replacement: HTTP ${res.status}`));
+            if (text)
+                console.error(chalk.gray(`  ${text}`));
+            attempt.failed(classifyHttpSetupFailure("persistence", res.status, "dashboard re-auth rejected"), "persistence");
+            return null;
         }
-        else {
-            console.log(chalk.yellow("\n  No account added. Returning to dashboard...\n"));
+        attempt.stageCompleted("persistence");
+        attempt.succeeded();
+        return result.record.id;
+    }
+    catch (err) {
+        console.error(chalk.red(`\n✗ Re-authentication failed: ${err.message}`));
+        if (attempt) {
+            const outcome = failAttemptFromError(attempt, err, "persistence");
+            if (outcome?.unexpected)
+                console.error(chalk.gray(`  Diagnostic ID: ${outcome.diagnosticId}`));
         }
-        // Fall through → loop re-renders the dashboard
+        return null;
     }
 }
 /**
- * Runs the existing setupSingleAccount() OAuth flow, then POSTs the resulting
- * tokens to /cc-router/accounts on the active target. Returns the new id on
- * success, or null if the user aborted / an error occurred.
+ * Runs the shared Claude sign-in flow, then POSTs the resulting record to
+ * /cc-router/accounts on the active target. Returns the new id on success, or
+ * null if the user aborted / an error occurred.
  */
 async function runAddAccountFlow(target) {
     let attempt;
     try {
-        const { setupSingleAccountWithAttempt } = await import("./cmd-setup.js");
+        const { collectClaudeAccount, accountToRecord } = await import("./account-flows.js");
         // The index shown in the flow is just for display, pick something neutral.
-        const setup = await setupSingleAccountWithAttempt(1);
+        const setup = await collectClaudeAccount({ index: 1 });
         attempt = setup.attempt;
         const account = setup.account;
         if (!account)
@@ -159,13 +223,10 @@ async function runAddAccountFlow(target) {
                 "content-type": "application/json",
                 ...target.headers,
             },
-            body: JSON.stringify({
-                id: account.id,
-                accessToken: account.tokens.accessToken,
-                refreshToken: account.tokens.refreshToken,
-                expiresAt: account.tokens.expiresAt,
-                scopes: account.tokens.scopes,
-            }),
+            // The record form is what the endpoint stores, and it is the only shape
+            // that survives a `setup-token` credential: a hand-built body would have
+            // to invent a refresh token that account does not have.
+            body: JSON.stringify({ ...accountToRecord(account) }),
             signal: AbortSignal.timeout(5_000),
         });
         if (!res.ok) {

package/dist/cli/index.js

@@ -16,6 +16,7 @@ import { registerCliTargets } from "./cmd-cli-targets.js";
 import { getCurrentVersion, checkForUpdate, printUpdateBanner } from "../utils/self-update.js";
 import { recordApplicationStart, shutdownTelemetryWithin } from "../telemetry/facade.js";
 import { isTelemetryTracingActive } from "../telemetry/runtime.js";
+import { describeExpectedCliError } from "./cli-errors.js";
 const program = new Command();
 program
     .name("cc-router")
@@ -32,8 +33,8 @@ Examples:
   $ cc-router models list        # List dynamically discovered provider models
   $ cc-router logs               # View proxy logs (background mode)
   $ cc-router accounts list      # Show Claude, ChatGPT, and Grok accounts
-  $ cc-router accounts add-grok  # Import the Grok CLI login
-  $ cc-router accounts login-grok# Sign in to Grok with device code
+  $ cc-router accounts login     # Sign in to a Claude, OpenAI or Grok account
+  $ cc-router accounts reauth <id>   # Sign an existing account in again, same id
   $ cc-router revert             # Restore Claude Code to normal (remove all proxy config)
   $ cc-router docker up          # Full stack: cc-router + LiteLLM in Docker
   $ cc-router client connect <url>   # Route Claude Code through a remote CC-Router
@@ -73,7 +74,18 @@ program.hook("preAction", () => { recordApplicationStart(); });
 // that call process.exit() early simply lose their in-flight telemetry. A
 // `start` that is serving requests keeps its runtime: startServer() resolves
 // once it is listening, and its signal handler owns telemetry shutdown.
-void program.parseAsync().finally(() => {
+void program.parseAsync()
+    // A missing `claude` binary, a sign-in the operator closed, a mistyped
+    // provider or Ctrl+C at a prompt is news, not a crash: one line, no stack.
+    // Anything else is rethrown untouched so a real bug still surfaces in full.
+    .catch((error) => {
+    const expected = describeExpectedCliError(error);
+    if (!expected)
+        throw error;
+    console.error(expected.message);
+    process.exitCode = expected.exitCode;
+})
+    .finally(() => {
     if (isTelemetryTracingActive())
         return undefined;
     return shutdownTelemetryWithin(500);

package/dist/config/manager.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, copyFileSync, chmodSync } from "fs";
 import { randomBytes } from "crypto";
 import { CONFIG_DIR, ACCOUNTS_PATH, CONFIG_PATH } from "./paths.js";
-import { DEFAULT_RATE_LIMITS, ACCOUNT_USER_DEFAULTS, clampPercent } from "../proxy/types.js";
+import { DEFAULT_RATE_LIMITS, ACCOUNT_USER_DEFAULTS, clampPercent, withInheritedSettings } from "../proxy/types.js";
 export const DEFAULT_PROXY_REQUEST_TIMEOUT_MS = 5 * 60 * 1000;
 /** Owner-only permissions for files/dirs that hold OAuth tokens or the proxy secret. */
 const SECRET_FILE_MODE = 0o600;
@@ -87,9 +87,15 @@ export function writeAnthropicAccountsPreservingOtherProviders(data, path = ACCO
 export function upsertAccountRecord(record) {
     ensureConfigDir();
     const existing = readAccountsRaw();
+    // Compare normalised providers: a Claude record written before provider
+    // tags existed has none, and a strict comparison appended a tagged
+    // duplicate next to it instead of replacing it.
+    const sameAccount = (a) => a.id === record.id && normalizeAccountProvider(a) === normalizeAccountProvider(record);
+    const previous = existing.find(sameAccount);
     const next = [
-        ...existing.filter(a => !(a.id === record.id && a.provider === record.provider)),
-        record,
+        ...existing.filter(a => !sameAccount(a)),
+        // A re-authentication replaces credentials, not the operator's settings.
+        previous ? withInheritedSettings(record, previous) : record,
     ];
     writeAccountsAtomicToPath(ACCOUNTS_PATH, next);
 }
@@ -167,7 +173,9 @@ export function loadOpenAIAccounts(path) {
         id: a.id,
         provider: "openai_subscription",
         accessToken: a.accessToken,
-        refreshToken: a.refreshToken,
+        // Refresh tokens are optional on the record only for Anthropic
+        // `setup-token` credentials; OpenAI records always carry one.
+        refreshToken: a.refreshToken ?? "",
         expiresAt: a.expiresAt,
         enabled: a.enabled !== false,
         // Without this the flag is lost on restart and the dead refresh token is
@@ -210,7 +218,8 @@ export function loadXaiAccounts(path) {
         id: a.id,
         provider: "xai_subscription",
         accessToken: a.accessToken,
-        refreshToken: a.refreshToken,
+        // See loadOpenAIAccounts: xAI records always carry a refresh token.
+        refreshToken: a.refreshToken ?? "",
         expiresAt: a.expiresAt,
         enabled: a.enabled !== false,
         ...(Array.isArray(a.scopes) ? { scopes: a.scopes } : {}),
@@ -291,7 +300,7 @@ export function generateProxySecret() {
     return "cc-rtr-" + randomBytes(16).toString("hex");
 }
 // ─── Accounts ─────────────────────────────────────────────────────────────────
-function deserialize(records) {
+export function deserialize(records) {
     return records.filter(a => a.provider === undefined || a.provider === "anthropic_subscription").map(a => ({
         id: a.id,
         tokens: {
@@ -328,7 +337,7 @@ export function serialize(accounts) {
         id: a.id,
         provider: "anthropic_subscription",
         accessToken: a.tokens.accessToken,
-        refreshToken: a.tokens.refreshToken,
+        ...(a.tokens.refreshToken ? { refreshToken: a.tokens.refreshToken } : {}),
         expiresAt: a.tokens.expiresAt,
         scopes: a.tokens.scopes,
         enabled: a.enabled,

package/dist/providers/anthropic/claude-cli.js

@@ -0,0 +1,104 @@
+import { execFile as nodeExecFile, spawn as nodeSpawn } from "node:child_process";
+import { SetupDiagnosticError } from "../../telemetry/setup-diagnostics.js";
+import { extractFromCredentialsFileDetailed, extractFromKeychainDetailed, } from "../../utils/token-extractor.js";
+import { isMacos } from "../../utils/platform.js";
+/** `claude setup-token` credentials are long-lived and never refreshable. */
+export const LONG_LIVED_TOKEN_TTL_MS = 365 * 24 * 60 * 60 * 1000;
+const CLAUDE = "claude";
+const TOKEN_PATTERN = /sk-ant-oat01-[A-Za-z0-9_-]{20,}/g;
+const ANSI = /\x1b\[[0-9;?]*[ -/]*[@-~]/g;
+function defaultExtract() {
+    return isMacos()
+        ? extractFromKeychainDetailed()
+        : Promise.resolve(extractFromCredentialsFileDetailed());
+}
+/** Confirms the Claude Code CLI is runnable; the error message tells the operator the import fallback. */
+export function resolveClaudeCli(deps = {}) {
+    const execFile = deps.execFile ?? nodeExecFile;
+    return new Promise((resolve, reject) => {
+        execFile(CLAUDE, ["--version"], error => {
+            if (!error) {
+                resolve(CLAUDE);
+                return;
+            }
+            reject(new SetupDiagnosticError("Claude Code CLI not found on PATH. Install it or use `cc-router accounts add claude` to import an existing login.", { stage: "credential_read", reason: "not_found", expected: true }, { cause: error }));
+        });
+    });
+}
+/** Last token in the (ANSI-stripped) output: Ink repaints the success frame several times. */
+export function extractLongLivedToken(output) {
+    const matches = output.replace(ANSI, "").match(TOKEN_PATTERN);
+    return matches ? matches[matches.length - 1] : null;
+}
+function waitForExit(child) {
+    return new Promise((resolve, reject) => {
+        child.once("error", reject);
+        child.once("exit", code => resolve(code));
+    });
+}
+/**
+ * `claude auth login --claudeai [--email]` with the terminal handed over to
+ * Claude Code. The snapshot comparison is what stops a login that exited 0
+ * without writing from re-importing the previous account.
+ */
+export async function loginWithClaudeCli(options, deps = {}) {
+    const command = await resolveClaudeCli(deps);
+    const extract = deps.extract ?? defaultExtract;
+    const before = await extract();
+    const args = ["auth", "login", "--claudeai", ...(options.email ? ["--email", options.email] : [])];
+    const child = (deps.spawn ?? nodeSpawn)(command, args, { stdio: "inherit" });
+    const code = await waitForExit(child);
+    if (code !== 0) {
+        throw new SetupDiagnosticError("claude auth login was cancelled or failed", {
+            stage: "credential_read",
+            reason: "user_cancelled",
+            expected: true,
+        });
+    }
+    const after = await extract();
+    if (!after.ok)
+        throw after.error;
+    if (before.ok && before.tokens.accessToken === after.tokens.accessToken) {
+        throw new SetupDiagnosticError("claude auth login finished but no new credentials were stored.", {
+            stage: "credential_read",
+            reason: "not_found",
+            expected: true,
+        });
+    }
+    return after.tokens;
+}
+/**
+ * `claude setup-token` with stdout mirrored to the terminal and scanned for
+ * the token line. Ink keys raw mode on stdin, which stays inherited, and its
+ * cursor escapes pass through untouched, so the UI renders as usual. `null`
+ * means the command ended without a recognisable token; the caller falls back
+ * to a paste prompt. The captured token is never logged.
+ */
+export async function createLongLivedTokenWithClaudeCli(deps = {}) {
+    const command = await resolveClaudeCli(deps);
+    const mirror = deps.stdout ?? process.stdout;
+    const child = (deps.spawn ?? nodeSpawn)(command, ["setup-token"], {
+        stdio: ["inherit", "pipe", "inherit"],
+    });
+    let output = "";
+    const stdout = child.stdout;
+    stdout?.on("data", (chunk) => {
+        output += chunk.toString();
+        mirror.write(chunk);
+    });
+    const drained = stdout
+        ? new Promise(resolve => {
+            stdout.once("end", resolve);
+            stdout.once("close", resolve);
+            stdout.once("error", () => resolve());
+        })
+        : Promise.resolve();
+    const code = await waitForExit(child);
+    // A child can exit before the pipe has been fully read; the token often sits
+    // in that last unread chunk.
+    await drained;
+    if (code !== 0)
+        return null;
+    const accessToken = extractLongLivedToken(output);
+    return accessToken ? { accessToken } : null;
+}

package/dist/providers/anthropic/scopes.js

@@ -0,0 +1,5 @@
+/** The OAuth usage and profile endpoints need `user:profile`; a `claude
+ *  setup-token` credential carries `user:inference` only. */
+export function canReadProfile(scopes) {
+    return Array.isArray(scopes) && scopes.includes("user:profile");
+}