@timo972/cc-router 0.12.4 → 0.13.0-rc.1

package/CHANGELOG.md

@@ -8,6 +8,47 @@ This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+### ⚠️ Breaking
+
+- `cc-router accounts add-openai`, `login-openai`, `add-grok` and `login-grok`
+  are gone. Use `accounts login openai`, `accounts add openai`,
+  `accounts login grok` and `accounts add grok`. `accounts add` now takes the
+  provider as its first argument (`accounts add claude` for the old behaviour)
+  and only imports existing credentials; browser sign-in is `accounts login`.
+- The dashboard's `onIntent` callback receives an object (`{ kind: "quit" }`,
+  `{ kind: "addAccount" }`, `{ kind: "reauth", ... }`) instead of a string.
+
+### Added
+
+- `cc-router accounts login claude` drives `claude auth login --claudeai`
+  (with `--email` prefill) and imports the new credentials; `--long-lived`
+  drives `claude setup-token` for a one-year, refresh-less token.
+- `cc-router accounts reauth <id>` re-signs an account in under the same id,
+  looking up its provider and cached email. The dashboard does the same on
+  `l` with an account selected.
+- Device-code sign-ins (OpenAI, Grok) open the verification page in the
+  browser; the OpenAI page receives the code and, on re-auth, the email.
+  `CC_ROUTER_NO_BROWSER=1` keeps the browser closed and prints the URL only.
+- Claude accounts without a refresh token (`claude setup-token`) are
+  accepted, never refreshed, skipped by the usage and identity fetchers, and
+  marked `token-only`; they flip to `re-auth required` when they expire.
+- `POST /cc-router/accounts/:id/refresh` refreshes one account. The
+  dashboard's `R` uses it when an account is selected and reloads the whole
+  pool otherwise.
+
+### Fixed
+
+- Pressing `n` (and now `l`) in the dashboard no longer kills the process
+  before the sign-in prompt can take input. Ink unrefs stdin when it
+  unmounts and nothing ref'd it again, so with no other work pending the
+  process exited while inquirer was still waiting — reported as
+  `User force closed the prompt with 0 null`. The dashboard now refs stdin
+  for the duration of the interactive flow.
+- Re-authenticating an account replaces its credentials only. Previously the
+  replacement was built from the freshly collected record, so a disabled
+  account came back enabled and custom session/weekly caps reset to 100 —
+  both on the live pool and in `accounts.json`.
+
 ---
 
 ## [0.12.4] — 2026-09-18

package/README.md

@@ -103,8 +103,8 @@ claude
 
 That's it. On first `start` you're asked how to run the router (background, foreground, or
 auto-start on boot) and the choice is remembered; `cc-router start --reconfigure` changes
-it later. Adding more accounts is `cc-router setup --add`, and `cc-router status` opens the
-dashboard.
+it later. Adding more accounts is `cc-router accounts login`, re-signing one in is
+`cc-router accounts reauth <id>`, and `cc-router status` opens the dashboard.
 
 Per-platform token extraction, Codex CLI, Docker and everything else lives in
 [the docs](docs/).

package/dist/cli/account-flows.js

@@ -0,0 +1,422 @@
+/**
+ * Every interactive "get me a credential for this provider" flow, in one place.
+ *
+ * These functions collect an account and hand it back — they never persist.
+ * The commands that call them decide where the record goes (disk, a running
+ * proxy, or both), which is what lets `setup`, `accounts add`, the dashboard's
+ * add-account key and the re-authentication path all share one sign-in.
+ */
+import { select, input, confirm, password } from "@inquirer/prompts";
+import chalk from "chalk";
+import { isMacos } from "../utils/platform.js";
+import { extractFromKeychainDetailed, extractFromCredentialsFileDetailed, formatExpiry, redactToken, } from "../utils/token-extractor.js";
+import { validateToken } from "../utils/token-validator.js";
+import { parseExpiryInput } from "../utils/expiry-input.js";
+import { serialize, loadOpenAIAccounts, loadXaiAccounts } from "../config/manager.js";
+import { DEFAULT_RATE_LIMITS, ACCOUNT_USER_DEFAULTS } from "../proxy/types.js";
+import { loginWithClaudeCli, createLongLivedTokenWithClaudeCli, LONG_LIVED_TOKEN_TTL_MS, } from "../providers/anthropic/claude-cli.js";
+import { createOpenAIAccountRecord } from "../providers/openai/account-record.js";
+import { loginOpenAIWithDeviceCode } from "../providers/openai/device-oauth.js";
+import { importGrokCliAuth } from "../providers/xai/import-auth.js";
+import { loginXaiWithDeviceCode } from "../providers/xai/device-oauth.js";
+import { createSetupAttempt, failAttemptFromError, SetupDiagnosticError, } from "../telemetry/setup-diagnostics.js";
+/**
+ * The only place a Claude sign-in method is translated into a telemetry method
+ * name. Keeping the map here means a new method cannot reach the wire under an
+ * ad-hoc string.
+ */
+const CLAUDE_METHOD_TELEMETRY = {
+    cli_login: "claude_cli_login",
+    setup_token: "claude_setup_token",
+    keychain: "macos_keychain",
+    credentials: "claude_credentials_file",
+    manual: "manual_token",
+};
+function claudeMethodChoices(offer) {
+    const login = [
+        { name: "Sign in with the browser  (claude auth login — recommended)", value: "cli_login" },
+        { name: "Create a long-lived token (claude setup-token — does not change Claude Code's login)", value: "setup_token" },
+    ];
+    const imports = [
+        ...(isMacos() ? [{ name: "Extract automatically from macOS Keychain", value: "keychain" }] : []),
+        { name: "Read from ~/.claude/.credentials.json", value: "credentials" },
+        { name: "Paste tokens manually", value: "manual" },
+    ];
+    return offer === "login" ? login : offer === "import" ? imports : [...login, ...imports];
+}
+/** Only an unexpected failure gets a diagnostic ID worth quoting in a bug report. */
+function printDiagnosticId(outcome) {
+    if (!outcome.unexpected)
+        return;
+    console.log(chalk.gray(`  Diagnostic ID: ${outcome.diagnosticId}`));
+}
+/**
+ * Collect one Claude account. Also hands back the setup attempt so the caller
+ * can mark the `persistence` stage and the final outcome once the account is
+ * written.
+ */
+export async function collectClaudeAccount(options) {
+    const method = options.method ?? await select({
+        message: "How do you want to add the account?",
+        choices: claudeMethodChoices(options.offer ?? "all"),
+    });
+    const attempt = createSetupAttempt({ provider: "anthropic", method: CLAUDE_METHOD_TELEMETRY[method] });
+    attempt.stageCompleted("credential_source_selection");
+    // Shared by reference: the file-extraction fallback swaps in a manual-token attempt.
+    const current = { attempt };
+    let reached = "credential_read";
+    try {
+        return await collectAnthropicAccount(options, method, current, stage => { reached = stage; });
+    }
+    catch (error) {
+        // A thrown prompt or extraction error must still close the funnel record.
+        // `failAttemptFromError` is terminal-guarded, so the attempt ends exactly
+        // once here, and `printDiagnosticId` stays silent for an expected failure.
+        const outcome = failAttemptFromError(current.attempt, error, reached);
+        if (outcome)
+            printDiagnosticId(outcome);
+        // An expected failure — `claude` missing, or a browser sign-in the operator
+        // closed — is this one account declined, not a dead run. Returning null
+        // puts it on the same footing as the import methods, which already do, so
+        // the setup wizard prints "Skipped account N" and keeps the accounts it
+        // collected before this one instead of losing them to a stack trace.
+        if (error instanceof SetupDiagnosticError && error.classification.expected) {
+            console.log(chalk.yellow(`\n  ✗ ${error.message}\n`));
+            return { account: null, attempt: current.attempt };
+        }
+        throw error;
+    }
+}
+async function collectAnthropicAccount(options, method, current, reached) {
+    let attempt = current.attempt;
+    let tokens = null;
+    if (method === "cli_login") {
+        console.log(chalk.gray("\n  Handing the terminal to Claude Code. Sign in with the account you want to add.\n"));
+        tokens = await loginWithClaudeCli({ email: options.email }, undefined);
+        console.log(chalk.green(`  ✓ Signed in — token ${redactToken(tokens.accessToken)}, expires ${formatExpiry(tokens.expiresAt)}`));
+        console.log(chalk.gray("  Note: Claude Code on this machine is now logged in as this account."));
+    }
+    if (method === "setup_token") {
+        console.log(chalk.gray("\n  Handing the terminal to Claude Code to create a long-lived token.\n"));
+        const captured = await createLongLivedTokenWithClaudeCli(undefined);
+        let accessToken = captured?.accessToken;
+        if (!accessToken) {
+            console.log(chalk.yellow("\n  Could not read the token from claude setup-token's output."));
+            accessToken = await password({
+                message: "Paste the token (sk-ant-oat01-...):",
+                mask: "•",
+                validate: v => v.startsWith("sk-ant-oat01-") || "Must start with sk-ant-oat01-",
+            });
+        }
+        const useDefaultExpiry = await confirm({ message: "Token valid for 1 year (default)?", default: true });
+        const expiresAt = useDefaultExpiry
+            ? Date.now() + LONG_LIVED_TOKEN_TTL_MS
+            : await promptExpiry();
+        tokens = { accessToken, refreshToken: undefined, expiresAt, scopes: ["user:inference"] };
+        console.log(chalk.gray("  This token has no refresh token and the inference scope only: usage and identity metadata are unavailable for it."));
+    }
+    if (method === "keychain") {
+        process.stdout.write(chalk.gray("  Extracting from Keychain... "));
+        const extraction = await extractFromKeychainDetailed();
+        if (extraction.ok) {
+            tokens = extraction.tokens;
+            console.log(chalk.green("✓"));
+            console.log(chalk.gray(`  Token: ${redactToken(tokens.accessToken)}`));
+            console.log(chalk.gray(`  Expiry: ${formatExpiry(tokens.expiresAt)}`));
+        }
+        else {
+            console.log(chalk.red("✗"));
+            console.log(chalk.yellow("  Could not find credentials in Keychain."));
+            console.log(chalk.gray("  Make sure Claude Code is logged in: run `claude login` first."));
+            printDiagnosticId(attempt.stageFailed(extraction.error, "credential_read"));
+            const retry = await confirm({ message: "Try another extraction method?", default: true });
+            attempt.cancelled();
+            if (!retry)
+                return { account: null, attempt };
+            return collectClaudeAccount({ ...options, method: undefined });
+        }
+    }
+    if (method === "credentials") {
+        const extraction = extractFromCredentialsFileDetailed();
+        if (extraction.ok) {
+            tokens = extraction.tokens;
+            console.log(chalk.green(`  ✓ Found credentials in ~/.claude/.credentials.json`));
+            console.log(chalk.gray(`    Token: ${redactToken(tokens.accessToken)}`));
+            console.log(chalk.gray(`    Expiry: ${formatExpiry(tokens.expiresAt)}`));
+        }
+        else {
+            console.log(chalk.red("  ✗ ~/.claude/.credentials.json not found or unreadable."));
+            console.log(chalk.gray("  Make sure Claude Code is installed and you've run `claude login`."));
+            const retry = await confirm({ message: "Paste tokens manually instead?", default: true });
+            if (!retry) {
+                printDiagnosticId(attempt.stageFailed(extraction.error, "credential_read"));
+                attempt.cancelled();
+                return { account: null, attempt };
+            }
+            // The file-based attempt failed; the pasted tokens are a manual-token setup.
+            printDiagnosticId(attempt.failed(extraction.error, "credential_read"));
+            attempt = createSetupAttempt({ provider: "anthropic", method: "manual_token" });
+            current.attempt = attempt;
+            attempt.stageCompleted("credential_source_selection");
+            tokens = await promptManualTokens();
+        }
+    }
+    if (method === "manual") {
+        tokens = await promptManualTokens();
+    }
+    if (!tokens) {
+        attempt.cancelled();
+        return { account: null, attempt };
+    }
+    attempt.stageCompleted("credential_read");
+    attempt.stageCompleted("credential_parse");
+    reached("token_validation");
+    const accountId = options.fixedId ?? await input({
+        message: "Account ID (press Enter to accept default):",
+        default: `max-account-${options.index}`,
+        validate: v => /^[a-zA-Z0-9_-]+$/.test(v) || "Only letters, numbers, _ and - allowed",
+    });
+    process.stdout.write(chalk.gray("  Validating tokens against Anthropic... "));
+    const validation = await validateToken(tokens.accessToken);
+    if (validation.valid) {
+        console.log(chalk.green("✓ Valid"));
+        attempt.stageCompleted("token_validation");
+    }
+    else {
+        console.log(chalk.red("✗ Invalid"));
+        console.log(chalk.yellow(`  Reason: ${validation.reason}`));
+        printDiagnosticId(attempt.stageFailed(validation.diagnostic, "token_validation"));
+        console.log(chalk.gray("  The token will be saved but may not work until refreshed."));
+        const keepAnyway = await confirm({ message: "Save this account anyway?", default: false });
+        if (!keepAnyway) {
+            attempt.cancelled();
+            return { account: null, attempt };
+        }
+    }
+    return {
+        account: {
+            id: accountId,
+            tokens,
+            healthy: validation.valid,
+            busy: false,
+            requestCount: 0,
+            errorCount: 0,
+            lastUsed: 0,
+            lastRefresh: 0,
+            consecutiveErrors: 0,
+            rateLimits: { ...DEFAULT_RATE_LIMITS },
+            ...ACCOUNT_USER_DEFAULTS,
+        },
+        attempt,
+    };
+}
+// ─── Manual token input ───────────────────────────────────────────────────────
+/**
+ * The refresh token stays required here: a pasted long-lived `setup-token`
+ * credential has none, and it has its own method rather than this one.
+ */
+async function promptManualTokens() {
+    console.log(chalk.gray("\n  You can find your tokens by running:\n" +
+        "    macOS:         security find-generic-password -s 'Claude Code-credentials' -w\n" +
+        "    Linux/Windows: cat ~/.claude/.credentials.json\n"));
+    const accessToken = await password({
+        message: "Paste accessToken (sk-ant-oat01-...):",
+        mask: "•",
+        validate: (v) => v.startsWith("sk-ant-oat01-") || v.startsWith("sk-ant-")
+            ? true
+            : "Must start with sk-ant-oat01-",
+    });
+    const refreshToken = await password({
+        message: "Paste refreshToken (sk-ant-ort01-...):",
+        mask: "•",
+        validate: (v) => v.startsWith("sk-ant-ort01-") || v.startsWith("sk-ant-")
+            ? true
+            : "Must start with sk-ant-ort01-",
+    });
+    const useDefaultExpiry = await confirm({
+        message: "Use default expiry (8 hours from now)?",
+        default: true,
+    });
+    const expiresAt = useDefaultExpiry
+        ? Date.now() + 8 * 60 * 60 * 1000
+        : await promptExpiry();
+    return {
+        accessToken,
+        refreshToken,
+        expiresAt,
+        scopes: ["user:inference", "user:profile"],
+    };
+}
+function promptOpenAIAccountId(fixed) {
+    if (fixed)
+        return Promise.resolve(fixed);
+    return input({
+        message: "OpenAI account ID:",
+        default: `openai-account-${loadOpenAIAccounts().length + 1}`,
+        validate: (v) => /^[a-zA-Z0-9_-]+$/.test(v) || "Only letters, numbers, _ and - allowed",
+    });
+}
+/** Device-code sign-in. The browser is opened by the device flow itself. */
+export async function loginOpenAIAccount(options = {}) {
+    const attempt = createSetupAttempt({ provider: "openai", method: "device_oauth" });
+    let reached = "device_code_request";
+    try {
+        const accountId = await promptOpenAIAccountId(options.accountId);
+        console.log(chalk.cyan("\nOpenAI Codex device login"));
+        console.log(chalk.gray("This will open no local callback server. You will approve the login in your browser.\n"));
+        const record = await loginOpenAIWithDeviceCode({
+            accountId,
+            ...(options.email ? { loginHint: options.email } : {}),
+            onDeviceCode: (code) => {
+                console.log(chalk.bold("1. Open this URL (opening it for you if possible):"));
+                console.log(`   ${chalk.cyan(code.verificationUrl)}`);
+                console.log(chalk.bold("2. Enter this code if the page does not fill it in:"));
+                console.log(`   ${chalk.cyan(code.userCode)}`);
+                if (options.email)
+                    console.log(chalk.bold(`3. Sign in as ${chalk.cyan(options.email)}`));
+                console.log(chalk.gray("\nWaiting for authorization..."));
+            },
+            onStageCompleted: (stage) => {
+                attempt.stageCompleted(stage);
+                reached = stage;
+            },
+        });
+        return { record, attempt };
+    }
+    catch (error) {
+        endFailedAttempt(attempt, error, reached);
+        throw error;
+    }
+}
+/** Hand-pasted OpenAI credentials, for when the device flow is not an option. */
+export async function importOpenAIAccount(options = {}) {
+    const attempt = createSetupAttempt({ provider: "openai", method: "manual_token" });
+    attempt.stageCompleted("credential_source_selection");
+    let reached = "credential_read";
+    try {
+        const id = await promptOpenAIAccountId(options.accountId);
+        const accessToken = await password({
+            message: "OpenAI access token:",
+            mask: "*",
+            validate: (v) => v.trim().length > 0 || "Access token is required",
+        });
+        const refreshToken = await password({
+            message: "OpenAI refresh token:",
+            mask: "*",
+            validate: (v) => v.trim().length > 0 || "Refresh token is required",
+        });
+        const expiresAt = await input({
+            message: "Access token expiry (Unix ms):",
+            default: String(Date.now() + 60 * 60 * 1000),
+            validate: (v) => Number.isFinite(Number(v)) && Number(v) > 0 || "Enter a positive Unix timestamp in milliseconds",
+        });
+        const scopes = await input({
+            message: "Scopes:",
+            default: "openid profile email offline_access",
+        });
+        attempt.stageCompleted("credential_read");
+        reached = "credential_parse";
+        const record = createOpenAIAccountRecord({ id, accessToken, refreshToken, expiresAt, scopes });
+        attempt.stageCompleted("credential_parse");
+        return { record, attempt };
+    }
+    catch (error) {
+        endFailedAttempt(attempt, error, reached);
+        throw error;
+    }
+}
+// ─── Grok / xAI ───────────────────────────────────────────────────────────────
+function promptGrokAccountId(fixed, fallback) {
+    if (fixed)
+        return Promise.resolve(fixed);
+    return input({
+        message: "Grok account ID:",
+        default: fallback,
+        validate: (v) => /^[a-zA-Z0-9_-]+$/.test(v) || "Only letters, numbers, _ and - allowed",
+    });
+}
+/** Device-code sign-in for a Grok / xAI account. */
+export async function loginGrokAccount(options = {}) {
+    const accountId = await promptGrokAccountId(options.accountId, loadXaiAccounts().length === 0 ? "grok" : `grok-${loadXaiAccounts().length + 1}`);
+    console.log(chalk.cyan("\nGrok device login"));
+    console.log(chalk.gray("Approve the login in your browser. No local callback server is used.\n"));
+    return loginXaiWithDeviceCode({
+        accountId,
+        onDeviceCode: (code) => {
+            console.log(chalk.bold("1. Open this URL:"));
+            console.log(`   ${chalk.cyan(code.verificationUrl)}`);
+            console.log(chalk.bold("2. Enter this code if the page does not fill it in:"));
+            console.log(`   ${chalk.cyan(code.userCode)}\n`);
+            console.log(chalk.gray("Waiting for authorization..."));
+        },
+    });
+}
+/** Copy an existing Grok CLI login out of ~/.grok/auth.json. */
+export async function importGrokAccount(options = {}) {
+    let imported;
+    try {
+        imported = importGrokCliAuth();
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.log(chalk.red(`\n✗ ${message}\n`));
+        console.log(chalk.gray("  Or sign in here: cc-router accounts login grok\n"));
+        process.exit(1);
+    }
+    const id = await promptGrokAccountId(options.accountId, imported.id);
+    return { ...imported, id };
+}
+/** Runs the provider's login with the id fixed. Returns null when the operator cancels. */
+export async function collectReauthRecord(target, options = {}) {
+    console.log(chalk.cyan(`\nRe-authenticating "${target.id}" (${target.provider === "openai_subscription" ? "openai" : "claude"})`
+        + (target.email ? ` — sign in as ${chalk.bold(target.email)}` : "") + "\n"));
+    if (target.provider === "openai_subscription") {
+        const { record, attempt } = await loginOpenAIAccount({
+            accountId: target.id,
+            ...(target.email ? { email: target.email } : {}),
+        });
+        return { record: credentialsOnly(record), attempt };
+    }
+    const { account, attempt } = await collectClaudeAccount({
+        index: 1,
+        fixedId: target.id,
+        ...(target.email ? { email: target.email } : {}),
+        offer: "login",
+        ...(options.longLived ? { method: "setup_token" } : {}),
+    });
+    return account ? { record: credentialsOnly(accountToRecord(account)), attempt } : null;
+}
+/** An explicit expiry: ISO date or Unix milliseconds, validated as typed. */
+async function promptExpiry() {
+    const raw = await input({
+        message: "Paste expiresAt (ISO date or ms timestamp):",
+        validate: v => parseExpiryInput(v) !== null || "Enter an ISO date (2027-01-01) or a Unix timestamp in milliseconds",
+    });
+    return parseExpiryInput(raw);
+}
+/**
+ * A re-authentication hands over new credentials and nothing else: the
+ * replaced account's enabled state and caps are the operator's, and both the
+ * live replace and the on-disk upsert carry them over when the record omits
+ * them. A freshly collected account would otherwise ship the defaults.
+ */
+function credentialsOnly(record) {
+    const { enabled: _enabled, sessionLimitPercent: _session, weeklyLimitPercent: _weekly, ...credentials } = record;
+    return credentials;
+}
+/** The on-disk form of a collected Claude account. */
+export function accountToRecord(account) {
+    return serialize([account])[0];
+}
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+/**
+ * Close a setup attempt that ended in a thrown error. A cancelled prompt is a
+ * user decision, not a failure, and only an unexpected failure gets a
+ * diagnostic ID worth quoting in a bug report.
+ */
+function endFailedAttempt(attempt, error, fallbackStage) {
+    const outcome = failAttemptFromError(attempt, error, fallbackStage);
+    if (outcome?.unexpected) {
+        console.log(chalk.gray(`  Diagnostic ID: ${outcome.diagnosticId}`));
+    }
+}

package/dist/cli/cli-errors.js

@@ -0,0 +1,37 @@
+/**
+ * The line between "the operator needs to read one sentence" and "this is a
+ * bug worth a stack trace".
+ *
+ * Keeping the decision here — rather than inline in `index.ts` — is what lets
+ * it be tested without parsing a command line, and what keeps the entry point
+ * to a single `.catch()`.
+ */
+import chalk from "chalk";
+import { SetupDiagnosticError, isPromptCancellation } from "../telemetry/setup-diagnostics.js";
+/**
+ * A wrong argument, not a failure: the command never started work, so there is
+ * nothing to diagnose beyond the sentence telling the operator what to type.
+ */
+export class CliUsageError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "CliUsageError";
+    }
+}
+/**
+ * Describe an error the CLI expects to hit — a missing `claude` binary, a
+ * sign-in the operator closed, a mistyped provider, Ctrl+C at a prompt — or
+ * `null` for anything else, which must keep surfacing with its stack so a real
+ * bug is never quietly downgraded to a one-liner.
+ */
+export function describeExpectedCliError(error) {
+    // 130 = terminated by SIGINT, which is what Ctrl+C at a prompt means.
+    if (isPromptCancellation(error))
+        return { message: chalk.gray("Cancelled."), exitCode: 130 };
+    if (error instanceof CliUsageError)
+        return { message: chalk.red(`✗ ${error.message}`), exitCode: 1 };
+    if (error instanceof SetupDiagnosticError && error.classification.expected) {
+        return { message: chalk.red(`✗ ${error.message}`), exitCode: 1 };
+    }
+    return null;
+}