agentwrangler 0.1.0

package/dist/ingest/tail.js

@@ -0,0 +1,152 @@
+/**
+ * src/ingest/tail.ts — offset-persisting byte tailer.
+ *
+ * Promoted from the proven spike (spikes/s2-live-tail/s2-core.mjs). Pure file
+ * logic; offsets persist in the `ingest_offsets` SQLite table.
+ *
+ * Invariants:
+ *  - only complete lines (terminated by \n) are emitted; a partial trailing line
+ *    waits for the next pass (offset is not advanced past it);
+ *  - truncation (fileSize < storedOffset) ⇒ reset to 0 + re-scan;
+ *  - rotation (head-hash mismatch) ⇒ reset to 0 + re-scan;
+ *  - re-scans are made safe by message_id dedupe downstream (idempotent).
+ */
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+const HEAD_BYTES = 256; // bytes hashed for rotation detection
+/** SHA-256 of the first n bytes of a file (or fewer if the file is shorter). */
+function headHashN(filePath, n) {
+    let fd;
+    try {
+        fd = fs.openSync(filePath, "r");
+        const buf = Buffer.alloc(n);
+        const bytesRead = fs.readSync(fd, buf, 0, n, 0);
+        return crypto.createHash("sha256").update(buf.subarray(0, bytesRead)).digest("hex");
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}
+/**
+ * SHA-256 of the first HEAD_BYTES bytes (or fewer if the file is shorter).
+ * Returns "<bytesRead>:<hexHash>" so comparisons can re-use the same byte count
+ * and avoid false rotation signals when a small file grows.
+ */
+export function headHash(filePath) {
+    let fd;
+    try {
+        fd = fs.openSync(filePath, "r");
+        const buf = Buffer.alloc(HEAD_BYTES);
+        const n = fs.readSync(fd, buf, 0, HEAD_BYTES, 0);
+        const hex = crypto.createHash("sha256").update(buf.subarray(0, n)).digest("hex");
+        return `${n}:${hex}`;
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}
+/**
+ * Tail one file from its stored offset. Returns complete lines only.
+ * See module header for the rotation/truncation contract.
+ */
+export function tailFile(filePath, stored) {
+    let storedOffset = stored?.offset ?? 0;
+    let storedHead = stored?.headHash ?? null;
+    let stat;
+    try {
+        stat = fs.statSync(filePath);
+    }
+    catch {
+        return {
+            lines: [],
+            newOffset: storedOffset,
+            newHeadHash: storedHead ?? "",
+            event: null,
+            wasReset: false,
+        };
+    }
+    const fileSize = stat.size;
+    let event = null;
+    let wasReset = false;
+    const curHead = fileSize > 0 ? headHash(filePath) : "";
+    // Re-hash using the stored byte count so a growing file doesn't appear to
+    // rotate. headHash always width-prefixes ("<n>:<hex>"), so storedHead carries
+    // the byte count we hashed originally.
+    let headChanged = false;
+    if (storedHead !== null && storedHead !== "") {
+        const colonIdx = storedHead.indexOf(":");
+        const storedN = Number.parseInt(storedHead.slice(0, colonIdx), 10);
+        const storedHex = storedHead.slice(colonIdx + 1);
+        if (fileSize >= storedN) {
+            headChanged = headHashN(filePath, storedN) !== storedHex;
+        }
+        // fileSize < storedN: size regression — headChanged stays false; handled below.
+    }
+    if (storedOffset > fileSize) {
+        // Size regression always means truncation, regardless of head change.
+        event = "TRUNCATION";
+        storedOffset = 0;
+        wasReset = true;
+        storedHead = curHead;
+    }
+    else if (headChanged) {
+        event = "ROTATION";
+        storedOffset = 0;
+        wasReset = true;
+        storedHead = curHead;
+    }
+    else if (storedHead === null) {
+        storedHead = curHead;
+    }
+    if (fileSize === storedOffset) {
+        return { lines: [], newOffset: storedOffset, newHeadHash: curHead, event, wasReset };
+    }
+    const toRead = fileSize - storedOffset;
+    const buf = Buffer.alloc(toRead);
+    let bytesRead;
+    let fd;
+    try {
+        fd = fs.openSync(filePath, "r");
+        bytesRead = fs.readSync(fd, buf, 0, toRead, storedOffset);
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+    // Find last newline (0x0A is a single byte in UTF-8, so this is safe).
+    let lastNl = -1;
+    for (let i = bytesRead - 1; i >= 0; i--) {
+        if (buf[i] === 0x0a) {
+            lastNl = i;
+            break;
+        }
+    }
+    if (lastNl === -1) {
+        // Entire read is a partial line — hold it, do not advance.
+        return { lines: [], newOffset: storedOffset, newHeadHash: curHead, event, wasReset };
+    }
+    const completeStr = buf.subarray(0, lastNl).toString("utf8");
+    const newOffset = storedOffset + lastNl + 1;
+    const lines = completeStr.split("\n").filter((l) => l.length > 0);
+    return { lines, newOffset, newHeadHash: curHead, event, wasReset };
+}
+/** Read the persisted offset for a file, or null if never tailed. */
+export function loadOffset(db, filePath) {
+    const row = db
+        .prepare("SELECT byte_offset, file_hash_head FROM ingest_offsets WHERE file_path = ?")
+        .get(filePath);
+    if (row === undefined)
+        return null;
+    return { offset: row.byte_offset, headHash: row.file_hash_head };
+}
+/** Upsert the persisted offset for a file. */
+export function saveOffset(db, filePath, offset, headHash) {
+    db.prepare(`INSERT INTO ingest_offsets (file_path, byte_offset, file_hash_head, updated_at)
+     VALUES (?,?,?,?)
+     ON CONFLICT(file_path) DO UPDATE SET
+       byte_offset = excluded.byte_offset,
+       file_hash_head = excluded.file_hash_head,
+       updated_at = excluded.updated_at`).run(filePath, offset, headHash, new Date().toISOString());
+}

package/dist/ingest/types.js

@@ -0,0 +1,24 @@
+/**
+ * src/ingest/types.ts — shared types for the ingestion pipeline (WP1).
+ *
+ * SEC-101: none of these projections carry transcript content. Content is read
+ * in-process for size/SHA computation and then discarded; only tokens, ids,
+ * sizes, model names, and structural markers survive into these shapes.
+ */
+/** Parser projection version, stamped on every turn row (NFR-106 drift signal). */
+export const PARSER_VERSION = "ingest-2";
+/** EF3 long-gap threshold in seconds; UI declares it in its tooltip. */
+export const LONG_GAP_THRESHOLD_S = 300;
+/** Create a zeroed health-counter block. */
+export function newHealthCounters() {
+    return {
+        filesSeen: 0,
+        filesParsed: 0,
+        linesQuarantined: 0,
+        syntheticExcluded: 0,
+        duplicateDrops: 0,
+        turnsIngested: 0,
+        unknownFieldKinds: {},
+        parserVersionMix: {},
+    };
+}

package/dist/ingest/workspace-mapping.js

@@ -0,0 +1,114 @@
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+/** Parse a GitHub SSH or HTTPS remote into its canonical owner/repo pair. */
+export function parseRemoteUrl(url) {
+    const match = /^(?:git@github\.com:|https:\/\/github\.com\/)([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/i.exec(url.trim());
+    if (match === null)
+        return null;
+    const owner = match[1];
+    const repo = match[2]?.replace(/\.git$/i, "");
+    if (owner === undefined || repo === undefined || repo === "")
+        return null;
+    return { owner, repo };
+}
+/** Read the origin URL from a local checkout without exposing git output. */
+export function defaultReadRemote(repoPath) {
+    try {
+        const result = spawnSync("git", ["-C", repoPath, "remote", "get-url", "origin"], {
+            encoding: "utf8",
+            windowsHide: true,
+        });
+        if (result.error !== undefined || result.status !== 0)
+            return null;
+        return result.stdout.trim();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read the recorded `cwd` (a top-level field, not transcript content) from the first line that
+ * carries one, scanning only the head of the file so a large transcript is never fully read.
+ */
+export function defaultReadCwd(filePath) {
+    let fd;
+    try {
+        fd = fs.openSync(filePath, "r");
+    }
+    catch {
+        return null;
+    }
+    try {
+        const buf = Buffer.alloc(65536);
+        const bytes = fs.readSync(fd, buf, 0, buf.length, 0);
+        for (const line of buf.toString("utf8", 0, bytes).split("\n")) {
+            const trimmed = line.trim();
+            if (trimmed === "")
+                continue;
+            try {
+                const rec = JSON.parse(trimmed);
+                if (typeof rec.cwd === "string" && rec.cwd !== "")
+                    return rec.cwd;
+            }
+            catch {
+                // A truncated trailing line (or a malformed one) is skipped; cwd is in the head anyway.
+            }
+        }
+        return null;
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+/**
+ * Backfill `discovered_cwd` for workspaces that have none yet — needed on existing installs where
+ * the boot back-scan skips already-ingested files (so ingestor.ts never re-captures their cwd).
+ * Reads at most one cwd-bearing transcript per unmapped workspace; self-limiting once all are filled.
+ */
+export function backfillDiscoveredCwd(db, files, readCwd) {
+    const needed = new Set(db
+        .prepare("SELECT project_slug FROM workspaces WHERE discovered_cwd IS NULL")
+        .all().map((r) => r.project_slug));
+    if (needed.size === 0)
+        return;
+    const setCwd = db.prepare("UPDATE workspaces SET discovered_cwd=? WHERE project_slug=? AND discovered_cwd IS NULL");
+    const done = new Set();
+    for (const f of files) {
+        if (!needed.has(f.projectSlug) || done.has(f.projectSlug))
+            continue;
+        const cwd = readCwd(f.filePath);
+        if (cwd === null)
+            continue;
+        setCwd.run(cwd, f.projectSlug);
+        done.add(f.projectSlug);
+    }
+}
+export function resolveWorkspaceMappings(db, opts) {
+    db.prepare("UPDATE workspaces SET repo_path=discovered_cwd WHERE repo_path IS NULL AND discovered_cwd IS NOT NULL").run();
+    const workspaces = db
+        .prepare("SELECT workspace_id, repo_path FROM workspaces WHERE repo_path IS NOT NULL AND repo_owner IS NULL")
+        .all();
+    const setCanonical = db.prepare("UPDATE workspaces SET repo_owner=?, repo_name=? WHERE workspace_id=? AND repo_owner IS NULL AND repo_name IS NULL");
+    let newlyMapped = 0;
+    for (const workspace of workspaces) {
+        // Skip known failures for the daemon lifetime. A GitHub remote added to a previously
+        // remote-less repo while it runs is not picked up until the next daemon restart; this is an
+        // acceptable tradeoff for this non-blocking perf fix.
+        if (opts.unresolved?.has(workspace.workspace_id))
+            continue;
+        const remote = opts.readRemote(workspace.repo_path);
+        if (remote === null) {
+            opts.unresolved?.add(workspace.workspace_id);
+            continue;
+        }
+        const mapping = parseRemoteUrl(remote);
+        if (mapping === null) {
+            opts.unresolved?.add(workspace.workspace_id);
+            continue;
+        }
+        const result = setCanonical.run(mapping.owner, mapping.repo, workspace.workspace_id);
+        if (result.changes === 1)
+            newlyMapped += 1;
+    }
+    return newlyMapped;
+}

package/dist/oauth/anthropic-api-key.js

@@ -0,0 +1,88 @@
+/**
+ * src/oauth/anthropic-api-key.ts — Anthropic API-key reader for the G2 judge.
+ *
+ * Resolves a raw Anthropic Console API key so the judge can authenticate with
+ * `x-api-key` (a separate rate-limit pool) instead of the Claude Code
+ * subscription OAuth token, which it shares with live Claude Code generation.
+ *
+ * Sources, first match wins:
+ *   - ANTHROPIC_API_KEY env var → {ok:true, source:'env'}
+ *   - Windows Credential Manager Generic cred "AgentWrangler-AnthropicKey"
+ *       → {ok:true, source:'credential-manager'}
+ *
+ * SEC-101: the key VALUE is never logged; callers report only `source`.
+ * Never throws.
+ */
+import * as os from "node:os";
+import { runPowerShell } from "../outcomes/github/credential.js";
+const CREDENTIAL_TARGET = "AgentWrangler-AnthropicKey";
+/** CredRead P/Invoke for the Anthropic key blob (mirrors the GitHub reader). */
+const PS_SCRIPT = `
+$ErrorActionPreference = 'Stop'
+Add-Type @"
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+public class AnthKeyCredMgr {
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+  public struct CREDENTIAL {
+    public int Flags;
+    public int Type;
+    public string TargetName;
+    public string Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public int CredentialBlobSize;
+    public IntPtr CredentialBlob;
+    public int Persist;
+    public int AttributeCount;
+    public IntPtr Attributes;
+    public string TargetAlias;
+    public string UserName;
+  }
+  [DllImport("advapi32.dll", SetLastError=true, CharSet=CharSet.Unicode)]
+  public static extern bool CredRead(string target, int type, int flags, out IntPtr credential);
+  [DllImport("advapi32.dll", SetLastError=true)]
+  public static extern void CredFree([In] IntPtr buffer);
+}
+"@
+$ptr = [IntPtr]::Zero
+if ([AnthKeyCredMgr]::CredRead("${CREDENTIAL_TARGET}", 1, 0, [ref]$ptr)) {
+  $cred = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ptr, [type][AnthKeyCredMgr+CREDENTIAL])
+  if ($cred.CredentialBlobSize -gt 0) {
+    $bytes = New-Object byte[] $cred.CredentialBlobSize
+    [System.Runtime.InteropServices.Marshal]::Copy($cred.CredentialBlob, $bytes, 0, $cred.CredentialBlobSize)
+    [AnthKeyCredMgr]::CredFree($ptr)
+    $key = [System.Text.Encoding]::Unicode.GetString($bytes).Trim()
+    if ($key.Length -gt 0) { Write-Output $key }
+  } else {
+    [AnthKeyCredMgr]::CredFree($ptr)
+  }
+}
+`.trim();
+/**
+ * Read the Anthropic API key from the env or Windows Credential Manager.
+ * `raw` is injectable for tests. Never throws.
+ */
+export async function readAnthropicApiKey(raw) {
+    const envKey = process.env.ANTHROPIC_API_KEY;
+    if (typeof envKey === "string" && envKey.trim().length > 0) {
+        return { ok: true, data: envKey.trim(), source: "env" };
+    }
+    if (raw === undefined && os.platform() !== "win32") {
+        return { ok: false, reason: "non-windows-platform" };
+    }
+    try {
+        const key = await runPowerShell(PS_SCRIPT, raw);
+        if (key.length === 0) {
+            return { ok: false, reason: "anthropic-key-not-found" };
+        }
+        return { ok: true, data: key, source: "credential-manager" };
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        if (msg.includes("ENOENT") || msg.includes("not found") || msg.includes("spawn")) {
+            return { ok: false, reason: "powershell-unavailable" };
+        }
+        return { ok: false, reason: `credential-read-failed: ${msg}` };
+    }
+}

package/dist/oauth/count-tokens.js

@@ -0,0 +1,86 @@
+/**
+ * src/oauth/count-tokens.ts — Anthropic count_tokens API client.
+ *
+ * Calls POST https://api.anthropic.com/v1/messages/count_tokens using the local
+ * Claude Code OAuth token. The endpoint is free (no generation) and returns
+ * {input_tokens: N} for a given model + message text.
+ *
+ * Used by the bytes→token calibration path (R12). Text passes through this
+ * call only; nothing is persisted or logged (SEC-101).
+ *
+ * Mirrors the structure of src/oauth/usage.ts.
+ */
+import { fileCredentialSource } from "./credentials.js";
+const COUNT_TOKENS_URL = "https://api.anthropic.com/v1/messages/count_tokens";
+/**
+ * Count the tokens in `text` for the given `model` using Anthropic's free
+ * count_tokens endpoint, authenticated via the local OAuth credential.
+ *
+ * Returns ok:false (no network call) when credentials are missing or expired.
+ * Treats any non-200 (including 404 from an old model id) as ok:false.
+ * Never throws.
+ *
+ * @param text       The text to count tokens for (tool-result sample).
+ * @param model      A current model id (e.g. "claude-sonnet-4-6").
+ * @param credSource Credential source — injectable for tests.
+ */
+export async function countTokens(text, model, credSource = fileCredentialSource) {
+    // 1. Read credential; fail closed if unavailable.
+    const credResult = credSource.read();
+    if (!credResult.ok) {
+        return { ok: false, reason: credResult.reason };
+    }
+    const { accessToken } = credResult.credential;
+    // 2. Call count_tokens (text lives in memory only for this call — SEC-101).
+    try {
+        const res = await fetch(COUNT_TOKENS_URL, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                "anthropic-beta": "oauth-2025-04-20",
+                "anthropic-version": "2023-06-01",
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({
+                model,
+                messages: [{ role: "user", content: text }],
+            }),
+        });
+        if (!res.ok) {
+            if (res.status === 401) {
+                return {
+                    ok: false,
+                    reason: "OAuth token rejected (401) — re-login to Claude Code.",
+                    status: 401,
+                };
+            }
+            if (res.status === 429) {
+                return {
+                    ok: false,
+                    reason: "Rate limited (429) — try again later.",
+                    status: 429,
+                };
+            }
+            return {
+                ok: false,
+                reason: `HTTP ${res.status} from count_tokens`,
+                status: res.status,
+            };
+        }
+        const raw = await res.json();
+        if (typeof raw !== "object" || raw === null) {
+            return { ok: false, reason: "count_tokens returned an invalid response shape." };
+        }
+        const candidate = raw;
+        if (typeof candidate.input_tokens !== "number") {
+            return { ok: false, reason: "count_tokens response missing input_tokens." };
+        }
+        return { ok: true, input_tokens: candidate.input_tokens };
+    }
+    catch (e) {
+        return {
+            ok: false,
+            reason: `Could not reach ${COUNT_TOKENS_URL}: ${e instanceof Error ? e.message : String(e)}`,
+        };
+    }
+}

package/dist/oauth/credentials.js

@@ -0,0 +1,171 @@
+/**
+ * src/oauth/credentials.ts — OAuth credential source for the usage reader.
+ *
+ * Defines a CredentialSource interface and the v1 file-based implementation
+ * that reads ~/.claude/.credentials.json → claudeAiOauth.
+ *
+ * NOTE: macOS Keychain source ("Claude Code-credentials") is a documented
+ * follow-on. Implement a KeychainCredentialSource behind this same interface
+ * using the Security framework via a native addon or `security` CLI.
+ *
+ * SEC-101: token VALUES are NEVER logged; only key names when tracing.
+ */
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+/**
+ * Derive the public auth status from a credential source without exposing the token.
+ * Safe to send to the browser.
+ */
+export function getOAuthStatus(source = fileCredentialSource) {
+    const result = source.read();
+    if (!result.ok) {
+        return { authenticated: false, tier: null, reason: result.reason };
+    }
+    return { authenticated: true, tier: result.credential.rateLimitTier };
+}
+// ---------------------------------------------------------------------------
+// File-based source (~/.claude/.credentials.json)
+// ---------------------------------------------------------------------------
+/** Default credentials file path used by Claude Code. */
+export const DEFAULT_CREDENTIALS_PATH = path.join(os.homedir(), ".claude", ".credentials.json");
+/**
+ * Parse a raw `{claudeAiOauth:{…}}` JSON blob (the shape Claude Code stores in
+ * both the credentials file and the macOS Keychain) into a CredentialResult.
+ * `noun` names the source in failure reasons so each source stays honest about
+ * where the gap is; the file source passes "Credentials file" to preserve its
+ * exact historical strings (Windows byte-identical guarantee).
+ */
+function parseOAuthBlob(raw, noun) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { ok: false, reason: `${noun} is not valid JSON — re-login to Claude Code.` };
+    }
+    if (typeof parsed !== "object" || parsed === null) {
+        return { ok: false, reason: `${noun} has unexpected shape — re-login to Claude Code.` };
+    }
+    const top = parsed;
+    const oauth = top.claudeAiOauth;
+    if (typeof oauth !== "object" || oauth === null || oauth === undefined) {
+        return { ok: false, reason: `${noun} is missing claudeAiOauth — re-login to Claude Code.` };
+    }
+    const { accessToken, expiresAt, subscriptionType, rateLimitTier } = oauth;
+    if (typeof accessToken !== "string" || accessToken.length === 0) {
+        return { ok: false, reason: `${noun} has no accessToken — re-login to Claude Code.` };
+    }
+    if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) {
+        return { ok: false, reason: `${noun} has invalid expiresAt — re-login to Claude Code.` };
+    }
+    if (Date.now() >= expiresAt) {
+        return { ok: false, reason: "OAuth token has expired — re-login to Claude Code." };
+    }
+    return {
+        ok: true,
+        credential: {
+            accessToken,
+            expiresAt,
+            subscriptionType: typeof subscriptionType === "string" ? subscriptionType : null,
+            rateLimitTier: typeof rateLimitTier === "string" ? rateLimitTier : null,
+        },
+    };
+}
+export class FileCredentialSource {
+    filePath;
+    constructor(filePath = DEFAULT_CREDENTIALS_PATH) {
+        this.filePath = filePath;
+    }
+    read() {
+        let raw;
+        try {
+            raw = fs.readFileSync(this.filePath, "utf-8");
+        }
+        catch {
+            return {
+                ok: false,
+                reason: "Credentials file not found — re-login to Claude Code.",
+            };
+        }
+        return parseOAuthBlob(raw, "Credentials file");
+    }
+}
+// ---------------------------------------------------------------------------
+// macOS Keychain source (NU6) — darwin-only, ordered AFTER the file source
+// ---------------------------------------------------------------------------
+/** The Keychain service Claude Code stores its OAuth credential under (macOS). */
+export const KEYCHAIN_SERVICE = "Claude Code-credentials";
+/**
+ * Read the credential blob from the login Keychain via the `security` CLI.
+ * `-w` prints only the password (the JSON blob) on stdout; a missing entry
+ * exits non-zero. Never throws; never logs the secret (SEC-101).
+ */
+function defaultSecurityExec() {
+    try {
+        const result = spawnSync("security", ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-w"], {
+            encoding: "utf8",
+            windowsHide: true,
+        });
+        if (result.error !== undefined || result.status !== 0)
+            return null;
+        const out = result.stdout.trim();
+        return out.length > 0 ? out : null;
+    }
+    catch {
+        return null;
+    }
+}
+export class KeychainCredentialSource {
+    exec;
+    platform;
+    constructor(exec = defaultSecurityExec, platform = os.platform()) {
+        this.exec = exec;
+        this.platform = platform;
+    }
+    read() {
+        if (this.platform !== "darwin") {
+            return { ok: false, reason: "macOS Keychain source only applies on darwin." };
+        }
+        const raw = this.exec();
+        if (raw === null) {
+            return { ok: false, reason: "Keychain lookup failed — re-login to Claude Code." };
+        }
+        return parseOAuthBlob(raw, "Keychain credential");
+    }
+}
+// ---------------------------------------------------------------------------
+// Chained source — first ok wins; on total failure the reason names every gap
+// ---------------------------------------------------------------------------
+export class ChainedCredentialSource {
+    sources;
+    constructor(sources) {
+        this.sources = sources;
+    }
+    read() {
+        const reasons = [];
+        for (const source of this.sources) {
+            const result = source.read();
+            if (result.ok)
+                return result;
+            reasons.push(result.reason);
+        }
+        return {
+            ok: false,
+            reason: reasons.join(" ") || "No credential source available.",
+        };
+    }
+}
+/**
+ * Production credential source (singleton) used as the default by every
+ * consumer (oauth/usage.ts, oauth/count-tokens.ts, oauth/judge-g2-client.ts,
+ * getOAuthStatus). On macOS it chains the file source then the Keychain so a
+ * Keychain-only login (no ~/.claude/.credentials.json) still authenticates;
+ * elsewhere it is exactly a FileCredentialSource, so Windows/Linux behavior is
+ * byte-identical to before NU6. The `fileCredentialSource` name is retained
+ * because the RI-Track-1-owned usage.ts imports it verbatim.
+ */
+export const fileCredentialSource = os.platform() === "darwin"
+    ? new ChainedCredentialSource([new FileCredentialSource(), new KeychainCredentialSource()])
+    : new FileCredentialSource();