agent-control-plane 0.1.0

package/tools/vendor/codex-quota/lib/claude-accounts.js

@@ -0,0 +1,226 @@
+/**
+ * Claude account loading, session/OAuth resolution.
+ * Depends on: lib/constants.js, lib/container.js, lib/paths.js
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { CLAUDE_CREDENTIALS_PATH, CLAUDE_MULTI_ACCOUNT_PATHS } from "./constants.js";
+import { readMultiAccountContainer, writeMultiAccountContainer } from "./container.js";
+import { getOpencodeAuthPath } from "./paths.js";
+
+export function isClaudeSessionKey(value) {
+	return typeof value === "string" && value.startsWith("sk-ant-");
+}
+
+export function findClaudeSessionKey(value) {
+	if (isClaudeSessionKey(value)) return value;
+	if (typeof value === "string") {
+		const match = value.match(/sk-ant-[a-z0-9_-]+/i);
+		if (match) return match[0];
+	}
+	if (!value || typeof value !== "object") return null;
+
+	const direct = value.sessionKey
+		?? value.session_key
+		?? value.token
+		?? value.sessionToken
+		?? value.accessToken
+		?? value.access_token
+		?? value.oauthAccessToken;
+	if (isClaudeSessionKey(direct)) return direct;
+
+	for (const child of Object.values(value)) {
+		const found = findClaudeSessionKey(child);
+		if (found) return found;
+	}
+	return null;
+}
+
+export function normalizeClaudeAccount(raw, source) {
+	if (!raw || typeof raw !== "object") return null;
+	const label = raw.label ?? null;
+	const sessionKey = raw.sessionKey ?? raw.session_key ?? null;
+	const oauthToken = raw.oauthToken ?? raw.oauth_token ?? raw.accessToken ?? raw.access_token ?? null;
+	const cfClearance = raw.cfClearance ?? raw.cf_clearance ?? null;
+	const orgId = raw.orgId ?? raw.org_id ?? null;
+	const cookies = raw.cookies && typeof raw.cookies === "object" ? raw.cookies : null;
+	const oauthRefreshToken = raw.oauthRefreshToken ?? raw.oauth_refresh_token ?? null;
+	const oauthExpiresAt = raw.oauthExpiresAt ?? raw.oauth_expires_at ?? null;
+	const oauthScopes = raw.oauthScopes ?? raw.oauth_scopes ?? null;
+	return {
+		label,
+		sessionKey,
+		oauthToken,
+		cfClearance,
+		orgId,
+		cookies,
+		oauthRefreshToken,
+		oauthExpiresAt,
+		oauthScopes,
+		source,
+	};
+}
+
+export function isValidClaudeAccount(account) {
+	if (!account?.label) return false;
+	const sessionKey = account.sessionKey ?? findClaudeSessionKey(account.cookies);
+	const oauthToken = account.oauthToken ?? null;
+	return Boolean(sessionKey || oauthToken);
+}
+
+export function loadClaudeAccountsFromEnv() {
+	const envAccounts = process.env.CLAUDE_ACCOUNTS;
+	if (!envAccounts) return [];
+
+	try {
+		const parsed = JSON.parse(envAccounts);
+		const accounts = Array.isArray(parsed) ? parsed : parsed?.accounts ?? [];
+		return accounts
+			.map(a => normalizeClaudeAccount(a, "env"))
+			.filter(a => a && isValidClaudeAccount(a));
+	} catch {
+		console.error("Warning: CLAUDE_ACCOUNTS env var is not valid JSON");
+		return [];
+	}
+}
+
+export function loadClaudeAccountsFromFile(filePath) {
+	const container = readMultiAccountContainer(filePath);
+	if (!container.exists) return [];
+	return container.accounts
+		.map(a => normalizeClaudeAccount(a, filePath))
+		.filter(a => a && isValidClaudeAccount(a));
+}
+
+export function loadClaudeAccounts() {
+	const all = [];
+	all.push(...loadClaudeAccountsFromEnv());
+	for (const path of CLAUDE_MULTI_ACCOUNT_PATHS) {
+		all.push(...loadClaudeAccountsFromFile(path));
+	}
+	return all;
+}
+
+/**
+ * Resolve the multi-account file that stores activeLabel for Claude.
+ * @returns {string}
+ */
+export function resolveClaudeActiveStorePath() {
+	const firstPath = CLAUDE_MULTI_ACCOUNT_PATHS[0];
+	if (firstPath && existsSync(firstPath)) return firstPath;
+	return firstPath;
+}
+
+/**
+ * Read the active-label store container for Claude.
+ * @returns {{ path: string, container: ReturnType<typeof readMultiAccountContainer> }}
+ */
+export function readClaudeActiveStoreContainer() {
+	const path = resolveClaudeActiveStorePath();
+	const container = readMultiAccountContainer(path);
+	return { path, container };
+}
+
+/**
+ * Get the activeLabel stored for Claude (if any).
+ * @returns {{ activeLabel: string | null, path: string, schemaVersion: number }}
+ */
+export function getClaudeActiveLabelInfo() {
+	const { path, container } = readClaudeActiveStoreContainer();
+	return {
+		activeLabel: container.activeLabel ?? null,
+		path,
+		schemaVersion: container.schemaVersion ?? 0,
+	};
+}
+
+export function saveClaudeAccounts(accounts) {
+	const targetPath = resolveClaudeActiveStorePath();
+	const container = readMultiAccountContainer(targetPath);
+	const filtered = accounts.filter(account => !(account?.source && account.source.startsWith("env")));
+	const sanitized = filtered.map(account => {
+		if (!account || typeof account !== "object") return account;
+		const { source, ...rest } = account;
+		return rest;
+	});
+	const result = writeMultiAccountContainer(targetPath, container, sanitized, {}, { mode: 0o600 });
+	return result.path;
+}
+
+export function loadClaudeSessionFromCredentials() {
+	const credentialsPath = process.env.CLAUDE_CREDENTIALS_PATH || CLAUDE_CREDENTIALS_PATH;
+	if (!existsSync(credentialsPath)) {
+		return {
+			sessionKey: null,
+			source: credentialsPath,
+			error: `Claude credentials not found at ${credentialsPath}`,
+		};
+	}
+
+	try {
+		const raw = readFileSync(credentialsPath, "utf-8");
+		const parsed = JSON.parse(raw);
+		const sessionKey = findClaudeSessionKey(parsed);
+		if (!sessionKey) {
+			return {
+				sessionKey: null,
+				source: credentialsPath,
+				error: "No Claude sessionKey found in credentials file",
+			};
+		}
+		return { sessionKey, source: credentialsPath };
+	} catch (err) {
+		return {
+			sessionKey: null,
+			source: credentialsPath,
+			error: `Failed to read Claude credentials: ${err?.message ?? String(err)}`,
+		};
+	}
+}
+
+export function loadClaudeOAuthToken() {
+	const credentialsPath = process.env.CLAUDE_CREDENTIALS_PATH || CLAUDE_CREDENTIALS_PATH;
+	if (!existsSync(credentialsPath)) {
+		return { token: null, source: credentialsPath, error: `Claude credentials not found at ${credentialsPath}` };
+	}
+
+	try {
+		const raw = readFileSync(credentialsPath, "utf-8");
+		const parsed = JSON.parse(raw);
+		const token =
+			parsed?.claudeAiOauth?.accessToken
+			?? parsed?.claude_ai_oauth?.accessToken
+			?? parsed?.accessToken
+			?? parsed?.access_token
+			?? null;
+		if (!token) {
+			return { token: null, source: credentialsPath, error: "No Claude OAuth accessToken found" };
+		}
+		return { token, source: credentialsPath };
+	} catch (err) {
+		return {
+			token: null,
+			source: credentialsPath,
+			error: `Failed to read Claude credentials: ${err?.message ?? String(err)}`,
+		};
+	}
+}
+
+/**
+ * Find a Claude account by label from supported sources
+ * @param {string} label
+ * @returns {object | null}
+ */
+export function findClaudeAccountByLabel(label) {
+	const accounts = loadClaudeAccounts();
+	return accounts.find(account => account.label === label) ?? null;
+}
+
+/**
+ * Get all Claude labels from supported sources
+ * @returns {string[]}
+ */
+export function getClaudeLabels() {
+	const accounts = loadClaudeAccounts();
+	return [...new Set(accounts.map(account => account.label))];
+}

package/tools/vendor/codex-quota/lib/claude-oauth.js

@@ -0,0 +1,174 @@
+/**
+ * Claude OAuth browser flow.
+ * Depends on: lib/constants.js, lib/oauth.js, lib/claude-tokens.js, lib/prompts.js
+ */
+
+import {
+	CLAUDE_OAUTH_AUTHORIZE_URL,
+	CLAUDE_OAUTH_TOKEN_URL,
+	CLAUDE_OAUTH_REDIRECT_URI,
+	CLAUDE_OAUTH_CLIENT_ID,
+	CLAUDE_OAUTH_SCOPES,
+	CLAUDE_OAUTH_REFRESH_BUFFER_MS,
+	OAUTH_TIMEOUT_MS,
+} from "./constants.js";
+import { generatePKCE, generateState, openBrowser } from "./oauth.js";
+import { refreshClaudeToken, persistClaudeOAuthTokens } from "./claude-tokens.js";
+import { promptInput } from "./prompts.js";
+
+export function buildClaudeAuthUrl(codeChallenge, state) {
+	const params = new URLSearchParams({
+		response_type: "code",
+		client_id: CLAUDE_OAUTH_CLIENT_ID,
+		redirect_uri: CLAUDE_OAUTH_REDIRECT_URI,
+		scope: CLAUDE_OAUTH_SCOPES,
+		code_challenge: codeChallenge,
+		code_challenge_method: "S256",
+		state: state,
+		code: "true", // Display code in browser for user to copy
+	});
+	// Use %20 instead of + for spaces
+	return `${CLAUDE_OAUTH_AUTHORIZE_URL}?${params.toString().replace(/\+/g, "%20")}`;
+}
+
+/**
+ * Parse user input containing Claude OAuth code and state
+ * Accepts formats:
+ *   - "code#state" (code with state suffix)
+ *   - "code" (code only, state validation skipped)
+ *   - Full callback URL: https://console.anthropic.com/oauth/code/callback?code=...&state=...
+ * @param {string} input - User input string
+ * @param {string} expectedState - Expected state for CSRF validation
+ * @returns {{ code: string, state: string | null }} Parsed code and optional state
+ */
+export function parseClaudeCodeState(input) {
+	const trimmed = (input ?? "").trim();
+	if (!trimmed) {
+		return { code: null, state: null };
+	}
+
+	// Check if it's a full callback URL
+	if (trimmed.startsWith("http://") || trimmed.startsWith("https://")) {
+		try {
+			const url = new URL(trimmed);
+			const code = url.searchParams.get("code");
+			const state = url.searchParams.get("state");
+			return { code: code || null, state: state || null };
+		} catch {
+			return { code: null, state: null };
+		}
+	}
+
+	// Check for code#state format
+	if (trimmed.includes("#")) {
+		const [code, state] = trimmed.split("#", 2);
+		return { code: code || null, state: state || null };
+	}
+
+	// Plain code only
+	return { code: trimmed, state: null };
+}
+
+/**
+ * Exchange Claude authorization code for tokens
+ * @param {string} code - Authorization code from callback
+ * @param {string} codeVerifier - PKCE code verifier
+ * @param {string} state - OAuth state for CSRF validation
+ * @returns {Promise<{ accessToken: string, refreshToken: string, expiresIn: number }>}
+ */
+export async function exchangeClaudeCodeForTokens(code, codeVerifier, state) {
+	const controller = new AbortController();
+	const timeout = setTimeout(() => controller.abort(), OAUTH_TIMEOUT_MS);
+
+	try {
+		const body = {
+			grant_type: "authorization_code",
+			code: code,
+			state: state,
+			redirect_uri: CLAUDE_OAUTH_REDIRECT_URI,
+			client_id: CLAUDE_OAUTH_CLIENT_ID,
+			code_verifier: codeVerifier,
+		};
+
+		const response = await fetch(CLAUDE_OAUTH_TOKEN_URL, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+			},
+			body: JSON.stringify(body),
+			signal: controller.signal,
+		});
+
+		if (!response.ok) {
+			const text = await response.text();
+			throw new Error(`Token exchange failed: ${response.status} ${text}`);
+		}
+
+		const data = await response.json();
+
+		return {
+			accessToken: data.access_token,
+			refreshToken: data.refresh_token || null,
+			expiresIn: data.expires_in || 3600,
+		};
+	} finally {
+		clearTimeout(timeout);
+	}
+}
+
+// refreshClaudeToken, isClaudeOauthTokenExpiring, resolveClaudeOauthAccountFields,
+// ensureFreshClaudeOAuthToken are in ./claude-tokens.js
+
+/**
+ * Run the Claude OAuth browser flow to get tokens
+ * @param {{ noBrowser: boolean }} flags - CLI flags
+ * @returns {Promise<{ accessToken: string, refreshToken: string, expiresAt: number, scopes: string }>}
+ */
+export async function handleClaudeOAuthFlow(flags) {
+	// 1. Generate PKCE code verifier and challenge
+	const { verifier, challenge } = generatePKCE();
+
+	// 2. Generate random state for CSRF protection
+	const state = generateState();
+
+	// 3. Build authorization URL
+	const authUrl = buildClaudeAuthUrl(challenge, state);
+
+	// 4. Print instructions
+	console.log("\nStarting Claude OAuth authentication...\n");
+
+	// 5. Open browser or print URL
+	openBrowser(authUrl, { noBrowser: flags.noBrowser });
+
+	// 6. Prompt user to paste code
+	console.log("After authenticating in the browser, you will see a code.");
+	console.log("Copy the entire code (including any #state portion) and paste it below.\n");
+
+	const input = await promptInput("Paste code#state here: ");
+	const { code, state: returnedState } = parseClaudeCodeState(input);
+
+	if (!code) {
+		throw new Error("No authorization code provided. Authentication cancelled.");
+	}
+
+	// 7. Validate state if provided (CSRF protection)
+	if (returnedState && returnedState !== state) {
+		throw new Error("State mismatch. Possible CSRF attack. Please try again.");
+	}
+
+	// 8. Exchange code for tokens
+	console.log("\nExchanging code for tokens...");
+	const stateToSend = returnedState ?? state;
+	const tokens = await exchangeClaudeCodeForTokens(code, verifier, stateToSend);
+
+	// 9. Calculate expiry timestamp
+	const expiresAt = Date.now() + (tokens.expiresIn * 1000);
+
+	return {
+		accessToken: tokens.accessToken,
+		refreshToken: tokens.refreshToken,
+		expiresAt: expiresAt,
+		scopes: CLAUDE_OAUTH_SCOPES,
+	};
+}
+