fluxy-bot 0.2.33 → 0.2.34

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fluxy-bot",
-  "version": "0.2.33",
+  "version": "0.2.34",
   "description": "Self-hosted AI bot — run your own AI assistant from anywhere",
   "type": "module",
   "license": "MIT",

package/worker/claude-auth.ts

@@ -120,32 +120,42 @@ export function readClaudeAccessToken(): string | null {
 /* ── Helpers ── */
 
 /**
- * Read the OAuth block from credentials file or macOS Keychain.
+ * Read the OAuth block from the most reliable source.
+ * On macOS: Keychain is the source of truth (Claude Code reads/writes there on refresh).
+ *           If Keychain has no valid entry, stale files are not trusted.
+ * On Linux/Windows: credentials file is the source of truth.
  * Handles both formats:
  *   - Claude Code format: { claudeAiOauth: { accessToken, refreshToken, expiresAt, ... } }
  *   - Legacy flat format:  { accessToken, refreshToken, expiresAt }
  */
 function readOAuthBlock(): { accessToken?: string; refreshToken?: string; expiresAt?: number } | null {
-  // Primary: credentials file
-  try {
-    if (fs.existsSync(CREDENTIALS_FILE)) {
-      const creds = JSON.parse(fs.readFileSync(CREDENTIALS_FILE, 'utf-8'));
-      const oauth = creds.claudeAiOauth || creds;
-      if (oauth.accessToken) return oauth;
-    }
-  } catch {}
-
-  // macOS Keychain fallback
+  // macOS: Keychain is the source of truth
   if (process.platform === 'darwin') {
     try {
       const result = execFileSync('security', [
         'find-generic-password', '-s', 'Claude Code-credentials', '-w',
       ], { stdio: ['pipe', 'pipe', 'pipe'] }).toString().trim();
       const parsed = JSON.parse(result);
-      if (parsed.claudeAiOauth?.accessToken) return parsed.claudeAiOauth;
+      const oauth = parsed.claudeAiOauth || parsed;
+      if (oauth.accessToken) {
+        log.ok('Read credentials from macOS Keychain');
+        return oauth;
+      }
     } catch {}
+    // On macOS, if Keychain has no valid entry, don't trust stale files
+    log.warn('No valid credentials in macOS Keychain');
+    return null;
   }
 
+  // Linux/Windows: credentials file
+  try {
+    if (fs.existsSync(CREDENTIALS_FILE)) {
+      const creds = JSON.parse(fs.readFileSync(CREDENTIALS_FILE, 'utf-8'));
+      const oauth = creds.claudeAiOauth || creds;
+      if (oauth.accessToken) return oauth;
+    }
+  } catch {}
+
   return null;
 }