agent-control-plane 0.1.1 → 0.1.3

package/README.md

@@ -302,6 +302,9 @@ During `setup`, ACP can:
   `openclaw` when ACP knows a safe install command, and otherwise show
   backend-specific next steps, install/auth/verify examples, and a docs URL it
   can open for you on interactive machines
+- defer anchor repo sync automatically when ACP can scaffold the profile but
+  cannot reach the repo remote yet, so setup can still finish with a clear
+  follow-up instead of failing half way through
 - run one final fix-up summary at the end so you can clear whatever is still
   red instead of guessing which step to retry next
 - scaffold the profile, run doctor checks, and optionally start the runtime in
@@ -550,6 +553,9 @@ Use `--purge-paths` only when you want ACP-managed directories removed too.
   `launchd-uninstall`, and `remove`.
 - `gh` cannot access the repo
   Re-run `gh auth login` and confirm the repo slug in the profile is correct.
+- setup deferred anchor repo sync
+  ACP could not reach the repo remote yet. Fix Git access or the remote URL,
+  then rerun `setup` or `init` without `--skip-anchor-sync`.
 - backend auth failures from `codex`, `claude`, or `openclaw`
   Authenticate that backend before starting ACP in the background.
 - `node` is older than `18`

package/npm/bin/agent-control-plane.js

@@ -191,12 +191,14 @@ function runCapture(command, args, options = {}) {
   const result = spawnSync(command, args, {
     encoding: "utf8",
     env: options.env || process.env,
-    cwd: options.cwd || process.cwd()
+    cwd: options.cwd || process.cwd(),
+    timeout: options.timeoutMs || 0
   });
   return {
     status: typeof result.status === "number" ? result.status : (result.error ? 1 : 0),
     stdout: result.stdout || "",
-    stderr: result.stderr || ""
+    stderr: result.stderr || "",
+    error: result.error || null
   };
 }
 
@@ -1044,6 +1046,92 @@ function printPrereqSummary(prereq) {
   console.log(`- backend note: ${backendReadinessHint(prereq.workerCommand)}`);
 }
 
+function probeAnchorSyncReadiness(repoRoot) {
+  if (!repoRoot || !fs.existsSync(repoRoot)) {
+    return {
+      status: "deferred",
+      reason: "source-repo-missing",
+      remoteUrl: "",
+      details: ""
+    };
+  }
+
+  const remoteResult = runCapture("git", ["remote", "get-url", "origin"], {
+    cwd: repoRoot,
+    timeoutMs: 5000
+  });
+  const remoteUrl = remoteResult.stdout.trim();
+  if (remoteResult.status !== 0 || !remoteUrl) {
+    return {
+      status: "deferred",
+      reason: "no-origin-remote",
+      remoteUrl: "",
+      details: `${remoteResult.stdout}${remoteResult.stderr}`.trim()
+    };
+  }
+
+  const probeResult = runCapture("git", ["ls-remote", "--exit-code", "origin", "HEAD"], {
+    cwd: repoRoot,
+    timeoutMs: 15000
+  });
+  if (probeResult.status === 0) {
+    return {
+      status: "ready",
+      reason: "",
+      remoteUrl,
+      details: ""
+    };
+  }
+
+  const details = `${probeResult.stdout}${probeResult.stderr}`.trim();
+  let reason = "git-remote-unreachable";
+  if (probeResult.error && probeResult.error.code === "ETIMEDOUT") {
+    reason = "git-remote-timeout";
+  } else if (/could not read Username|Authentication failed|Permission denied|Repository not found|access denied|not found/i.test(details)) {
+    reason = "git-remote-auth-or-access-error";
+  } else if (/Could not resolve host|Name or service not known|Temporary failure in name resolution/i.test(details)) {
+    reason = "git-remote-dns-error";
+  }
+
+  return {
+    status: "deferred",
+    reason,
+    remoteUrl,
+    details
+  };
+}
+
+function buildAnchorSyncDecision(options, sourceRepoRoot) {
+  if (options.skipAnchorSync) {
+    return {
+      status: "skipped",
+      reason: "disabled",
+      remoteUrl: "",
+      details: "",
+      skipAnchorSync: true
+    };
+  }
+
+  const probe = probeAnchorSyncReadiness(sourceRepoRoot);
+  if (probe.status === "ready") {
+    return {
+      status: "ok",
+      reason: "",
+      remoteUrl: probe.remoteUrl,
+      details: probe.details,
+      skipAnchorSync: false
+    };
+  }
+
+  return {
+    status: "deferred",
+    reason: probe.reason,
+    remoteUrl: probe.remoteUrl,
+    details: probe.details,
+    skipAnchorSync: true
+  };
+}
+
 function profileExists(profileRegistryRoot, profileId) {
   return fs.existsSync(path.join(profileRegistryRoot, profileId, "control-plane.yaml"));
 }
@@ -1082,6 +1170,7 @@ function buildSetupDryRunPlan(options, context, config) {
   const dependencyPlan = buildDependencyInstallPlan(prereq.missingRequired);
   const workerInstallPlan = buildWorkerBackendInstallPlan(prereq.workerCommand);
   const workerGuide = backendSetupGuide(prereq.workerCommand);
+  const anchorSync = buildAnchorSyncDecision(options, config.paths.sourceRepoRoot);
 
   let dependencyAction = planStatusWithReason("not-needed");
   if (!prereq.coreToolsOk) {
@@ -1128,6 +1217,8 @@ function buildSetupDryRunPlan(options, context, config) {
       runtimeStartAction = planStatusWithReason("blocked", `missing-tools:${prereq.missingRequired.join(",")}`);
     } else if (!prereq.workerAvailable) {
       runtimeStartAction = planStatusWithReason("blocked", `missing-worker:${prereq.workerCommand}`);
+    } else if (anchorSync.status !== "ok") {
+      runtimeStartAction = planStatusWithReason("blocked", `anchor-sync-${anchorSync.reason}`);
     } else if (!prereq.ghAuthOk) {
       runtimeStartAction = planStatusWithReason("blocked", "gh-auth-not-ready");
     } else {
@@ -1156,6 +1247,7 @@ function buildSetupDryRunPlan(options, context, config) {
     workerInstallPlan,
     workerAction,
     workerGuide,
+    anchorSync,
     githubAuthAction,
     runtimeStartAction,
     launchdAction
@@ -1170,6 +1262,7 @@ function printSetupDryRunPlan(context, config, plan) {
   console.log(`- profile registry root: ${context.profileRegistryRoot}`);
   console.log(`- sync packaged runtime: would-run`);
   console.log(`- scaffold/adopt profile: would-run`);
+  console.log(`- anchor repo sync: ${plan.anchorSync.status === "ok" ? "would-run" : `${plan.anchorSync.status} (${plan.anchorSync.reason})`}`);
   console.log(`- doctor: would-run`);
   console.log(`- dependency install: ${plan.dependencyAction.status}${plan.dependencyAction.reason ? ` (${plan.dependencyAction.reason})` : ""}`);
   if (plan.dependencyAction.status !== "not-needed" && plan.dependencyPlan && plan.dependencyPlan.commands.length > 0) {
@@ -1202,6 +1295,11 @@ function buildSetupResultPayload(params) {
       status: params.coreToolsStatus,
       missingRequiredTools: params.missingRequiredTools
     },
+    anchorSync: {
+      status: params.anchorSyncStatus,
+      reason: params.anchorSyncReason,
+      remoteUrl: params.anchorSyncRemoteUrl
+    },
     workerBackend: {
       command: params.workerBackendCommand,
       status: params.workerBackendStatus,
@@ -1252,6 +1350,9 @@ function emitSetupJsonPayload(payload) {
 
 function collectFinalSetupIssues(config, prereq, doctorKv, runtimeStartStatus) {
   const issues = [];
+  if (config.anchorSync && config.anchorSync.status !== "ok") {
+    issues.push(`anchor repo sync ${config.anchorSync.status}: ${config.anchorSync.reason}`);
+  }
   if (!prereq.coreToolsOk) {
     issues.push(`missing core tools: ${prereq.missingRequired.join(", ")}`);
   }
@@ -1271,7 +1372,11 @@ function collectFinalSetupIssues(config, prereq, doctorKv, runtimeStartStatus) {
 }
 
 async function maybeRunFinalSetupFixups(options, scopedContext, config, currentState) {
-  const issues = collectFinalSetupIssues(config, currentState.prereq, currentState.doctorKv, currentState.runtimeStartStatus);
+  const effectiveConfig = {
+    ...config,
+    anchorSync: currentState.anchorSync || config.anchorSync || null
+  };
+  const issues = collectFinalSetupIssues(effectiveConfig, currentState.prereq, currentState.doctorKv, currentState.runtimeStartStatus);
   if (issues.length === 0) {
     return {
       status: "not-needed",
@@ -1315,6 +1420,7 @@ async function maybeRunFinalSetupFixups(options, scopedContext, config, currentS
   let githubAuthStep = currentState.githubAuthStep;
   let workerSetupStep = currentState.workerSetupStep;
   let doctorKv = currentState.doctorKv;
+  let anchorSync = currentState.anchorSync || effectiveConfig.anchorSync || null;
   let runtimeStartStatus = currentState.runtimeStartStatus;
   let runtimeStartReason = currentState.runtimeStartReason;
   let runtimeStatusKv = currentState.runtimeStatusKv;
@@ -1353,6 +1459,9 @@ async function maybeRunFinalSetupFixups(options, scopedContext, config, currentS
     } else if (!prereq.workerAvailable) {
       runtimeStartStatus = "skipped";
       runtimeStartReason = `missing-worker:${prereq.workerCommand}`;
+    } else if (anchorSync && anchorSync.status !== "ok") {
+      runtimeStartStatus = "skipped";
+      runtimeStartReason = `anchor-sync-${anchorSync.reason}`;
     } else if (!prereq.ghAuthOk) {
       runtimeStartStatus = "skipped";
       runtimeStartReason = "gh-auth-not-ready";
@@ -1376,7 +1485,7 @@ async function maybeRunFinalSetupFixups(options, scopedContext, config, currentS
     launchdInstallReason = "";
   }
 
-  const finalIssues = collectFinalSetupIssues(config, prereq, doctorKv, runtimeStartStatus);
+  const finalIssues = collectFinalSetupIssues({ ...effectiveConfig, anchorSync }, prereq, doctorKv, runtimeStartStatus);
   let status = "ok";
   if (dependencyInstall.status === "failed" || githubAuthStep.status === "failed" || workerSetupStep.installStatus === "failed") {
     status = "failed";
@@ -1387,6 +1496,7 @@ async function maybeRunFinalSetupFixups(options, scopedContext, config, currentS
   return {
     status,
     actions,
+    anchorSync,
     prereq,
     dependencyInstall,
     githubAuthStep,
@@ -1564,6 +1674,9 @@ async function runSetupFlow(forwardedArgs) {
         worktreeRoot: config.paths.worktreeRoot,
         coreToolsStatus: plan.prereq.coreToolsOk ? "ok" : "missing",
         missingRequiredTools: plan.prereq.missingRequired,
+        anchorSyncStatus: plan.anchorSync.status === "ok" ? "would-run" : plan.anchorSync.status,
+        anchorSyncReason: plan.anchorSync.reason || "",
+        anchorSyncRemoteUrl: plan.anchorSync.remoteUrl || "",
         workerBackendCommand: plan.prereq.workerCommand,
         workerBackendStatus: plan.prereq.workerAvailable ? "ok" : "missing",
         workerSetupGuideStatus: "planned",
@@ -1610,6 +1723,13 @@ async function runSetupFlow(forwardedArgs) {
         console.log(`PROFILE_EXISTS=${plan.profileExists ? "yes" : "no"}`);
         console.log(`CORE_TOOLS_STATUS=${plan.prereq.coreToolsOk ? "ok" : "missing"}`);
         console.log(`MISSING_REQUIRED_TOOLS=${plan.prereq.missingRequired.join(",")}`);
+        console.log(`ANCHOR_SYNC_STATUS=${plan.anchorSync.status === "ok" ? "would-run" : plan.anchorSync.status}`);
+        if (plan.anchorSync.reason) {
+          console.log(`ANCHOR_SYNC_REASON=${plan.anchorSync.reason}`);
+        }
+        if (plan.anchorSync.remoteUrl) {
+          console.log(`ANCHOR_SYNC_REMOTE_URL=${plan.anchorSync.remoteUrl}`);
+        }
         console.log(`WORKER_BACKEND_COMMAND=${plan.prereq.workerCommand}`);
         console.log(`WORKER_BACKEND_STATUS=${plan.prereq.workerAvailable ? "ok" : "missing"}`);
         console.log(`GITHUB_AUTH_STATUS=${plan.prereq.ghAuthOk ? "ok" : "not-ready"}`);
@@ -1686,6 +1806,16 @@ async function runSetupFlow(forwardedArgs) {
     prereq = collectPrereqStatus(config.codingWorker);
 
     const scopedContext = buildScopedContext(context, config.profileId);
+    const anchorSync = buildAnchorSyncDecision(options, config.paths.sourceRepoRoot);
+
+    if (anchorSync.status === "deferred") {
+      console.log("\nAnchor repo sync will be deferred for this setup run.");
+      if (anchorSync.remoteUrl) {
+        console.log(`- remote: ${anchorSync.remoteUrl}`);
+      }
+      console.log(`- reason: ${anchorSync.reason}`);
+      console.log("- next step: authenticate Git access or fix the repo remote, then rerun `setup` or `init` without skipping anchor sync.");
+    }
 
     runSetupStep(scopedContext, "Sync packaged runtime into ~/.agent-runtime", "tools/bin/sync-shared-agent-home.sh", []);
 
@@ -1704,7 +1834,7 @@ async function runSetupFlow(forwardedArgs) {
     if (options.force) {
       initArgs.push("--force");
     }
-    if (options.skipAnchorSync) {
+    if (anchorSync.skipAnchorSync) {
       initArgs.push("--skip-anchor-sync");
     }
     if (options.skipWorkspaceSync) {
@@ -1731,6 +1861,9 @@ async function runSetupFlow(forwardedArgs) {
       } else if (!prereq.workerAvailable) {
         runtimeStartReason = `missing-worker:${prereq.workerCommand}`;
         console.log(`runtime start skipped: ${prereq.workerCommand} is not available on PATH`);
+      } else if (anchorSync.status !== "ok") {
+        runtimeStartReason = `anchor-sync-${anchorSync.reason}`;
+        console.log("runtime start skipped: ACP deferred anchor repo sync for this setup run.");
       } else if (!prereq.ghAuthOk) {
         runtimeStartReason = "gh-auth-not-ready";
         console.log("runtime start skipped: GitHub CLI is not authenticated yet. Run `gh auth login` and start the runtime afterwards.");
@@ -1760,6 +1893,7 @@ async function runSetupFlow(forwardedArgs) {
     }
 
     const finalFixup = await maybeRunFinalSetupFixups(options, scopedContext, config, {
+      anchorSync,
       prereq,
       dependencyInstall,
       githubAuthStep,
@@ -1796,6 +1930,9 @@ async function runSetupFlow(forwardedArgs) {
       worktreeRoot: config.paths.worktreeRoot,
       coreToolsStatus: prereq.coreToolsOk ? "ok" : "missing",
       missingRequiredTools: prereq.missingRequired,
+      anchorSyncStatus: anchorSync.status,
+      anchorSyncReason: anchorSync.reason || "",
+      anchorSyncRemoteUrl: anchorSync.remoteUrl || "",
       workerBackendCommand: prereq.workerCommand,
       workerBackendStatus: prereq.workerAvailable ? "ok" : "missing",
       workerSetupGuideStatus: workerSetupStep.status,
@@ -1846,6 +1983,13 @@ async function runSetupFlow(forwardedArgs) {
       console.log(`CODING_WORKER=${config.codingWorker}`);
       console.log(`CORE_TOOLS_STATUS=${prereq.coreToolsOk ? "ok" : "missing"}`);
       console.log(`MISSING_REQUIRED_TOOLS=${prereq.missingRequired.join(",")}`);
+      console.log(`ANCHOR_SYNC_STATUS=${anchorSync.status}`);
+      if (anchorSync.reason) {
+        console.log(`ANCHOR_SYNC_REASON=${anchorSync.reason}`);
+      }
+      if (anchorSync.remoteUrl) {
+        console.log(`ANCHOR_SYNC_REMOTE_URL=${anchorSync.remoteUrl}`);
+      }
       console.log(`WORKER_BACKEND_COMMAND=${prereq.workerCommand}`);
       console.log(`WORKER_BACKEND_STATUS=${prereq.workerAvailable ? "ok" : "missing"}`);
       console.log(`WORKER_SETUP_GUIDE_STATUS=${workerSetupStep.status}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-control-plane",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Help a repo keep GitHub-driven coding agents running reliably without constant human babysitting",
   "homepage": "https://github.com/ducminhnguyen0319/agent-control-plane",
   "bugs": {
@@ -32,7 +32,6 @@
     "tools/dashboard/server.py",
     "tools/dashboard/styles.css",
     "tools/templates",
-    "tools/tests",
     "tools/vendor/codex-quota/LICENSE",
     "tools/vendor/codex-quota/codex-quota.js",
     "tools/vendor/codex-quota/lib",
@@ -41,7 +40,7 @@
   "scripts": {
     "doctor": "node ./npm/bin/agent-control-plane.js doctor",
     "smoke": "node ./npm/bin/agent-control-plane.js smoke",
-    "test": "bash tools/tests/test-agent-control-plane-npm-cli.sh"
+    "test": "bash tools/tests/test-agent-control-plane-npm-cli.sh && bash tools/tests/test-vendored-codex-quota-claude-oauth-only.sh"
   },
   "keywords": [
     "agents",

package/tools/vendor/codex-quota/README.md

@@ -280,7 +280,7 @@ Root-level fields are preserved on write; unknown root fields are kept intact.
 
 Claude multi-account files (`~/.claude-accounts.json`) use the same root fields
 (`schemaVersion`, `activeLabel`) and store account entries that include a
-`sessionKey` or OAuth tokens.
+Claude OAuth token and refresh metadata.
 
 ## OAuth Flow
 
@@ -400,17 +400,13 @@ To add a Claude credential interactively:
 codex-quota claude add
 ```
 
-This uses your local Claude session to call:
-- `https://claude.ai/api/organizations`
-- `https://claude.ai/api/organizations/{orgId}/usage`
-- `https://claude.ai/api/organizations/{orgId}/overage_spend_limit`
-- `https://claude.ai/api/account`
+This uses OAuth credentials to call:
+- `https://api.anthropic.com/api/oauth/usage`
 
 Authentication sources (in order):
 1. `CLAUDE_ACCOUNTS` env var (JSON array or `{ accounts: [...] }`)
-2. `~/.claude-accounts.json` (multi-account format)
-3. Browser cookies (Chromium/Chrome) to read `sessionKey` and `lastActiveOrg`
-4. `~/.claude/.credentials.json` OAuth `accessToken`
+2. `~/.claude-accounts.json` (multi-account format with `oauthToken`)
+3. `~/.claude/.credentials.json` OAuth `accessToken`
 
 Multi-account format (Claude):
 ```json
@@ -418,8 +414,6 @@ Multi-account format (Claude):
   "accounts": [
     {
       "label": "personal",
-      "sessionKey": "sk-ant-oat...",
-      "cfClearance": "cf_clearance...",
       "oauthToken": "claude-ai-access-token",
       "orgId": "org_uuid_optional"
     }
@@ -428,13 +422,12 @@ Multi-account format (Claude):
 ```
 
 Notes:
-- Only `label` plus one of `sessionKey` or `oauthToken` is required.
-- `cfClearance`, `orgId`, and `cookies` are optional.
+- `label` plus `oauthToken` is required.
+- `orgId` is optional.
 
 Environment overrides:
 - `CLAUDE_ACCOUNTS` to supply multi-account JSON directly
 - `CLAUDE_CREDENTIALS_PATH` to point to a different credentials file
-- `CLAUDE_COOKIE_DB_PATH` to point to a specific Chromium/Chrome Cookies DB
 
 Codex overrides:
 - `CODEX_ACCOUNTS` to supply multi-account JSON directly (read-only)
@@ -443,8 +436,7 @@ Codex overrides:
 - `PI_AUTH_PATH` to point to a different pi auth file
 
 Notes:
-- On Linux, cookie access requires `sqlite3` and `secret-tool` (libsecret) to decrypt cookies.
-- For best results, keep `claude.ai` logged in within your Chromium/Chrome profile.
+- Claude usage in the bundled public package is OAuth-only.
 
 ## Releasing
 

package/tools/vendor/codex-quota/lib/claude-accounts.js

@@ -1,5 +1,5 @@
 /**
- * Claude account loading, session/OAuth resolution.
+ * Claude account loading and OAuth resolution.
  * Depends on: lib/constants.js, lib/container.js, lib/paths.js
  */
 
@@ -8,52 +8,18 @@ import { CLAUDE_CREDENTIALS_PATH, CLAUDE_MULTI_ACCOUNT_PATHS } from "./constants
 import { readMultiAccountContainer, writeMultiAccountContainer } from "./container.js";
 import { getOpencodeAuthPath } from "./paths.js";
 
-export function isClaudeSessionKey(value) {
-	return typeof value === "string" && value.startsWith("sk-ant-");
-}
-
-export function findClaudeSessionKey(value) {
-	if (isClaudeSessionKey(value)) return value;
-	if (typeof value === "string") {
-		const match = value.match(/sk-ant-[a-z0-9_-]+/i);
-		if (match) return match[0];
-	}
-	if (!value || typeof value !== "object") return null;
-
-	const direct = value.sessionKey
-		?? value.session_key
-		?? value.token
-		?? value.sessionToken
-		?? value.accessToken
-		?? value.access_token
-		?? value.oauthAccessToken;
-	if (isClaudeSessionKey(direct)) return direct;
-
-	for (const child of Object.values(value)) {
-		const found = findClaudeSessionKey(child);
-		if (found) return found;
-	}
-	return null;
-}
-
 export function normalizeClaudeAccount(raw, source) {
 	if (!raw || typeof raw !== "object") return null;
 	const label = raw.label ?? null;
-	const sessionKey = raw.sessionKey ?? raw.session_key ?? null;
 	const oauthToken = raw.oauthToken ?? raw.oauth_token ?? raw.accessToken ?? raw.access_token ?? null;
-	const cfClearance = raw.cfClearance ?? raw.cf_clearance ?? null;
 	const orgId = raw.orgId ?? raw.org_id ?? null;
-	const cookies = raw.cookies && typeof raw.cookies === "object" ? raw.cookies : null;
 	const oauthRefreshToken = raw.oauthRefreshToken ?? raw.oauth_refresh_token ?? null;
 	const oauthExpiresAt = raw.oauthExpiresAt ?? raw.oauth_expires_at ?? null;
 	const oauthScopes = raw.oauthScopes ?? raw.oauth_scopes ?? null;
 	return {
 		label,
-		sessionKey,
 		oauthToken,
-		cfClearance,
 		orgId,
-		cookies,
 		oauthRefreshToken,
 		oauthExpiresAt,
 		oauthScopes,
@@ -63,9 +29,8 @@ export function normalizeClaudeAccount(raw, source) {
 
 export function isValidClaudeAccount(account) {
 	if (!account?.label) return false;
-	const sessionKey = account.sessionKey ?? findClaudeSessionKey(account.cookies);
 	const oauthToken = account.oauthToken ?? null;
-	return Boolean(sessionKey || oauthToken);
+	return Boolean(oauthToken);
 }
 
 export function loadClaudeAccountsFromEnv() {
@@ -147,37 +112,6 @@ export function saveClaudeAccounts(accounts) {
 	return result.path;
 }
 
-export function loadClaudeSessionFromCredentials() {
-	const credentialsPath = process.env.CLAUDE_CREDENTIALS_PATH || CLAUDE_CREDENTIALS_PATH;
-	if (!existsSync(credentialsPath)) {
-		return {
-			sessionKey: null,
-			source: credentialsPath,
-			error: `Claude credentials not found at ${credentialsPath}`,
-		};
-	}
-
-	try {
-		const raw = readFileSync(credentialsPath, "utf-8");
-		const parsed = JSON.parse(raw);
-		const sessionKey = findClaudeSessionKey(parsed);
-		if (!sessionKey) {
-			return {
-				sessionKey: null,
-				source: credentialsPath,
-				error: "No Claude sessionKey found in credentials file",
-			};
-		}
-		return { sessionKey, source: credentialsPath };
-	} catch (err) {
-		return {
-			sessionKey: null,
-			source: credentialsPath,
-			error: `Failed to read Claude credentials: ${err?.message ?? String(err)}`,
-		};
-	}
-}
-
 export function loadClaudeOAuthToken() {
 	const credentialsPath = process.env.CLAUDE_CREDENTIALS_PATH || CLAUDE_CREDENTIALS_PATH;
 	if (!existsSync(credentialsPath)) {