@timo972/cc-router 0.7.0

package/dist/utils/telemetry.js

@@ -0,0 +1,88 @@
+import os from "os";
+import { isTelemetryEnabled, loadTelemetryState } from "../config/telemetry.js";
+import { detectPlatform } from "./platform.js";
+import { getCurrentVersion } from "./self-update.js";
+// ─── Aptabase configuration ──────────────────────────────────────────────────
+// Aptabase is a privacy-first, open source analytics service.
+// The full payload we send is documented below — search for "trackEvent" calls
+// in the codebase to audit every event.  Nothing here contains PII.
+const APTABASE_APP_KEY = "A-EU-1060569594";
+const APTABASE_ENDPOINT = "https://eu.aptabase.com/api/v0/event";
+const TIMEOUT_MS = 3_000;
+function getOsName() {
+    switch (detectPlatform()) {
+        case "macos": return "macOS";
+        case "linux": return "Linux";
+        case "windows": return "Windows";
+    }
+}
+function getLocale() {
+    try {
+        // Aptabase limits locale to 10 characters — truncate extended subtags
+        const raw = Intl.DateTimeFormat().resolvedOptions().locale;
+        return raw.length <= 10 ? raw : raw.slice(0, 10);
+    }
+    catch {
+        return process.env["LANG"]?.split(".")[0]?.slice(0, 10) ?? "unknown";
+    }
+}
+function getSystemProps() {
+    return {
+        isDebug: false,
+        locale: getLocale(),
+        osName: getOsName(),
+        osVersion: os.release(),
+        appVersion: getCurrentVersion(),
+        engineName: "node",
+        engineVersion: process.versions.node,
+        sdkVersion: `cc-router@${getCurrentVersion()}`,
+    };
+}
+// Session ID — use the installId directly so Aptabase always identifies the
+// same machine as the same user.  Aptabase limits sessionId to 36 characters;
+// a standard UUID with dashes is exactly 36, so we pass it through unchanged.
+function getSessionId(installId) {
+    return installId.slice(0, 36);
+}
+// ─── Public API ──────────────────────────────────────────────────────────────
+// Fire-and-forget: never throws, never blocks the caller.  If telemetry is
+// disabled (env var or opt-out) this is a synchronous no-op.
+export async function trackEvent(eventName, props) {
+    try {
+        if (!isTelemetryEnabled())
+            return;
+        const state = loadTelemetryState();
+        const body = {
+            timestamp: new Date().toISOString(),
+            sessionId: getSessionId(state.installId),
+            eventName,
+            systemProps: getSystemProps(),
+            props: props ?? {},
+        };
+        await fetch(APTABASE_ENDPOINT, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "App-Key": APTABASE_APP_KEY,
+            },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+    }
+    catch {
+        // Silently swallow — telemetry must never disrupt the proxy
+    }
+}
+// Start a heartbeat that fires every hour while the proxy is running.
+// Uses .unref() so the timer does not prevent Node from exiting.
+export function startHeartbeat(accountCount) {
+    const startTime = Date.now();
+    const timer = setInterval(() => {
+        const uptimeMinutes = Math.floor((Date.now() - startTime) / 60_000);
+        trackEvent("proxy_heartbeat", {
+            uptime_minutes: uptimeMinutes,
+            account_count: accountCount,
+        });
+    }, 60 * 60 * 1000);
+    timer.unref();
+}

package/dist/utils/token-extractor.js

@@ -0,0 +1,95 @@
+import { execFile } from "child_process";
+import { promisify } from "util";
+import { readFileSync, existsSync } from "fs";
+import { join } from "path";
+import os from "os";
+const execFileAsync = promisify(execFile);
+/**
+ * macOS: extract OAuth tokens from the macOS Keychain.
+ * Uses execFile (not exec/execSync) — args are passed as an array,
+ * preventing any shell injection.
+ */
+export async function extractFromKeychain() {
+    try {
+        const { stdout } = await execFileAsync("security", [
+            "find-generic-password",
+            "-s", "Claude Code-credentials",
+            "-w",
+        ]);
+        const raw = JSON.parse(stdout.trim());
+        // Keychain JSON can be either:
+        //   { claudeAiOauth: { accessToken, refreshToken, ... }, mcpOAuth: {...} }
+        //   { accessToken, refreshToken, ... }  (direct, older versions)
+        const oauth = raw.claudeAiOauth ?? raw;
+        return parseCredentialJson(oauth);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Linux / Windows: read from ~/.claude/.credentials.json.
+ * Claude Code writes credentials here on non-macOS platforms.
+ * No shell — pure Node.js file read.
+ */
+export function extractFromCredentialsFile() {
+    const credPath = join(os.homedir(), ".claude", ".credentials.json");
+    if (!existsSync(credPath))
+        return null;
+    try {
+        const raw = JSON.parse(readFileSync(credPath, "utf-8"));
+        // The file can have two shapes:
+        //   { claudeAiOauth: { accessToken, refreshToken, expiresAt, scopes } }
+        //   { accessToken, refreshToken, expiresAt, scopes }  (direct)
+        const oauth = raw.claudeAiOauth ?? raw;
+        return parseCredentialJson(oauth);
+    }
+    catch {
+        return null;
+    }
+}
+/** Parse and normalise either a raw JSON string or an already-parsed object. */
+function parseCredentialJson(raw) {
+    try {
+        const obj = typeof raw === "string" ? JSON.parse(raw) : raw;
+        const accessToken = obj["accessToken"];
+        const refreshToken = obj["refreshToken"];
+        const expiresAt = obj["expiresAt"];
+        if (typeof accessToken !== "string" ||
+            typeof refreshToken !== "string" ||
+            !accessToken.startsWith("sk-ant-")) {
+            return null;
+        }
+        const scopes = Array.isArray(obj["scopes"])
+            ? obj["scopes"]
+            : ["user:inference", "user:profile"];
+        let expiresAtMs;
+        if (typeof expiresAt === "number") {
+            expiresAtMs = expiresAt;
+        }
+        else if (typeof expiresAt === "string") {
+            expiresAtMs = new Date(expiresAt).getTime();
+        }
+        else {
+            // No expiry info — assume 8h from now (standard OAuth token lifetime)
+            expiresAtMs = Date.now() + 8 * 60 * 60 * 1000;
+        }
+        return { accessToken, refreshToken, expiresAt: expiresAtMs, scopes };
+    }
+    catch {
+        return null;
+    }
+}
+/** Format a token expiry timestamp as a human-readable string */
+export function formatExpiry(expiresAtMs) {
+    const ms = expiresAtMs - Date.now();
+    if (ms <= 0)
+        return "EXPIRED";
+    const h = Math.floor(ms / 3_600_000);
+    const m = Math.floor((ms % 3_600_000) / 60_000);
+    return h > 0 ? `${h}h ${m}m` : `${m}m`;
+}
+/** Redact a token for safe display: show first 20 chars + "..." */
+export function redactToken(token) {
+    return token.length > 20 ? `${token.slice(0, 20)}...` : token;
+}

package/dist/utils/token-validator.js

@@ -0,0 +1,26 @@
+export async function validateToken(accessToken) {
+    try {
+        const res = await fetch("https://api.anthropic.com/v1/models", {
+            headers: {
+                "Authorization": `Bearer ${accessToken}`,
+                "anthropic-version": "2023-06-01",
+                // Required for api.anthropic.com to accept OAuth tokens (sk-ant-oat01-*)
+                "anthropic-beta": "oauth-2025-04-20",
+            },
+        });
+        if (res.ok)
+            return { valid: true };
+        if (res.status === 401) {
+            return { valid: false, reason: "Token invalid or expired (401)" };
+        }
+        if (res.status === 403) {
+            return { valid: false, reason: "Token lacks required scopes (403) — needs user:inference" };
+        }
+        // Any other non-ok status is unexpected but the token may still work
+        return { valid: false, reason: `Unexpected HTTP ${res.status}` };
+    }
+    catch (err) {
+        // Network error — can't validate, let user decide
+        return { valid: false, reason: `Network error: ${err.message}` };
+    }
+}

package/docker-compose.yml

@@ -0,0 +1,63 @@
+services:
+  cc-router:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    ports:
+      # Bind to localhost by default. To serve other devices, set a proxySecret
+      # (see docs/security.md) and change this to "0.0.0.0:${PORT:-3456}:3456".
+      - "127.0.0.1:${PORT:-3456}:3456"
+    volumes:
+      # Mount accounts.json read-write: cc-router must update it when tokens rotate
+      - ${HOME}/.cc-router/accounts.json:/app/accounts.json
+    environment:
+      - PORT=3456
+      - LITELLM_URL=http://litellm:4000
+      - ACCOUNTS_PATH=/app/accounts.json
+      - NODE_ENV=production
+    depends_on:
+      litellm:
+        condition: service_healthy
+    restart: unless-stopped
+    # Least privilege: no capabilities, no privilege escalation.
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    healthcheck:
+      test: ["CMD-SHELL", "node -e \"fetch('http://localhost:3456/cc-router/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+  litellm:
+    # Pinned by digest (snapshot of main-stable at pin time) — a moving tag can
+    # silently ship a bad build. The BerriAI 1.82.7/1.82.8 releases contained
+    # malware; a digest pin prevents a re-tag from re-introducing that class of
+    # supply-chain risk. Update deliberately after vetting the release:
+    #   crane digest ghcr.io/berriai/litellm:main-stable
+    image: ghcr.io/berriai/litellm:main-stable@sha256:a1745e629abfb17d434426ff48b115f54f4f4c4a0f5af241de569e93c63c411e
+    ports:
+      # Localhost only — the LiteLLM admin UI/key management must not be exposed.
+      - "127.0.0.1:${LITELLM_PORT:-4000}:4000"
+    volumes:
+      - ./litellm-config.yaml:/app/config.yaml:ro
+    environment:
+      # Require an explicit master key — fail fast instead of falling back to a
+      # published, guessable default that would gate the admin plane.
+      - LITELLM_MASTER_KEY=${LITELLM_MASTER_KEY:?set LITELLM_MASTER_KEY in your .env}
+    # No --detailed_debug: with forward_client_headers_to_llm_api it would write
+    # the injected "Authorization: Bearer <oauth-token>" into container logs.
+    command: ["--config", "/app/config.yaml", "--port", "4000"]
+    restart: unless-stopped
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    healthcheck:
+      test: ["CMD-SHELL", "curl -sf http://localhost:4000/health || exit 1"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 20s

package/litellm-config.yaml

@@ -0,0 +1,44 @@
+model_list:
+  # ── Claude 4.6 (latest) ───────────────────────────────────────────────────
+  - model_name: claude-opus-4-6
+    litellm_params:
+      model: anthropic/claude-opus-4-6
+      # No api_key — Authorization header is injected by cc-router (OAuth token)
+
+  - model_name: claude-sonnet-4-6
+    litellm_params:
+      model: anthropic/claude-sonnet-4-6
+
+  # ── Claude 4.5 ────────────────────────────────────────────────────────────
+  - model_name: claude-sonnet-4-5-20250929
+    litellm_params:
+      model: anthropic/claude-sonnet-4-5-20250929
+
+  - model_name: claude-haiku-4-5-20251001
+    litellm_params:
+      model: anthropic/claude-haiku-4-5-20251001
+
+  # ── Short-name aliases (Claude Code uses these interchangeably) ───────────
+  - model_name: claude-sonnet-4-5
+    litellm_params:
+      model: anthropic/claude-sonnet-4-5-20250929
+
+  - model_name: claude-haiku-4-5
+    litellm_params:
+      model: anthropic/claude-haiku-4-5-20251001
+
+general_settings:
+  # CRITICAL: forward the Authorization header from cc-router to Anthropic.
+  # cc-router injects "Authorization: Bearer <oauth-token>" on every request.
+  # Without this setting, LiteLLM would strip it and auth would fail.
+  forward_client_headers_to_llm_api: true
+
+  # Master key for LiteLLM UI and virtual key management.
+  # Set LITELLM_MASTER_KEY in your environment or .env file.
+  master_key: os.environ/LITELLM_MASTER_KEY
+
+litellm_settings:
+  # High timeouts for Claude Code long-running requests (thinking, agents)
+  request_timeout: 300
+  # Drop params not supported by a model silently (avoids errors on older models)
+  drop_params: true

package/package.json

@@ -0,0 +1,69 @@
+{
+  "name": "@timo972/cc-router",
+  "version": "0.7.0",
+  "description": "Cache-aware session router for Claude Max OAuth tokens — use multiple Claude Max accounts with Claude Code",
+  "type": "module",
+  "bin": {
+    "cc-router": "dist/cli/index.js"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx src/cli/index.ts",
+    "start": "node dist/cli/index.js",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "tsc --noEmit"
+  },
+  "keywords": [
+    "claude",
+    "anthropic",
+    "proxy",
+    "oauth",
+    "session-routing",
+    "claude-code",
+    "claude-max"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Timo972/cc-router.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Timo972/cc-router/issues"
+  },
+  "homepage": "https://github.com/Timo972/cc-router#readme",
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist/",
+    "src/interceptor/addon.py",
+    "litellm-config.yaml",
+    "docker-compose.yml",
+    "Dockerfile",
+    "accounts.example.json",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "@inquirer/prompts": "^7.0.0",
+    "chalk": "^5.3.0",
+    "commander": "^12.0.0",
+    "express": "^4.21.0",
+    "http-proxy-middleware": "^3.0.5",
+    "ink": "^5.0.0",
+    "react": "^18.3.0"
+  },
+  "devDependencies": {
+    "@types/express": "^4.17.21",
+    "@types/node": "^20.0.0",
+    "@types/react": "^18.3.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.6.0",
+    "vitest": "^4.1.2"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}

package/src/interceptor/addon.py

@@ -0,0 +1,78 @@
+# mitmproxy addon — redirects ONLY /v1/messages traffic to CC-Router and
+# injects the proxy secret as an auth header.
+#
+# There are TWO cases to handle:
+#
+# 1. Requests to api.anthropic.com  (Claude Desktop native features)
+#    → rewrite host/port to CC-Router target + inject x-api-key
+#
+# 2. Requests already pointed at the CC-Router target host  (Claude Code
+#    inside Desktop Cowork/Agent mode, which reads ~/.claude/settings.json
+#    and goes direct to ANTHROPIC_BASE_URL)
+#    → inject x-api-key (no rewrite needed)
+#
+# Claude Desktop sends many types of requests:
+#   /v1/messages         → LLM inference (redirect + auth)
+#   /v1/messages/count_tokens → token counting (redirect + auth)
+#   /v1/oauth/*          → session auth (must NOT touch)
+#   /v1/environments/*   → bridge/cowork (must NOT touch)
+#   /v1/models           → model listing (redirect + auth)
+#   /api/*               → desktop features (must NOT touch)
+#
+# Only /v1/messages* and /v1/models are safe to touch because CC-Router
+# injects its own OAuth token. Everything else carries the user's own
+# session token for features CC-Router doesn't handle.
+
+import os
+from urllib.parse import urlparse
+
+from mitmproxy import http
+
+_target_raw = os.environ.get("CC_ROUTER_TARGET", "http://localhost:3456")
+_target = _target_raw.rstrip("/")
+_target_parsed = urlparse(_target)
+
+if not _target_parsed.scheme or not _target_parsed.netloc:
+    raise RuntimeError(f"CC_ROUTER_TARGET is not a valid URL: {_target_raw!r}")
+
+_target_host = (_target_parsed.hostname or "").lower()
+_target_port = _target_parsed.port or (443 if _target_parsed.scheme == "https" else 80)
+
+# Optional proxy secret — when set, injected as x-api-key on routed requests
+_secret = os.environ.get("CC_ROUTER_SECRET", "")
+
+# Paths that CC-Router can handle (it injects its own OAuth token)
+_REDIRECT_PREFIXES = (
+    "/v1/messages",
+    "/v1/models",
+)
+
+
+def request(flow: http.HTTPFlow) -> None:
+    host = (flow.request.pretty_host or "").lower()
+    port = flow.request.port
+    is_anthropic = host == "api.anthropic.com"
+    is_target = host == _target_host and port == _target_port
+
+    # Not a host we care about — pass through untouched
+    if not is_anthropic and not is_target:
+        return
+
+    # Only touch inference and model-listing paths
+    if not flow.request.path.startswith(_REDIRECT_PREFIXES):
+        return
+
+    # Case 1: rewrite api.anthropic.com → CC-Router target
+    if is_anthropic:
+        flow.request.scheme = _target_parsed.scheme
+        flow.request.host = _target_host or "localhost"
+        flow.request.port = _target_port
+        flow.request.headers["host"] = flow.request.host + (
+            f":{flow.request.port}"
+            if flow.request.port not in (80, 443)
+            else ""
+        )
+
+    # Case 1 and 2: authenticate against the proxy if a secret is configured
+    if _secret:
+        flow.request.headers["x-api-key"] = _secret