hedgequantx 2.5.12 → 2.5.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hedgequantx",
-  "version": "2.5.12",
+  "version": "2.5.13",
   "description": "HedgeQuantX - Prop Futures Trading CLI",
   "main": "src/app.js",
   "bin": {

package/src/services/ai/index.js

@@ -156,40 +156,30 @@ const validateAnthropic = async (credentials) => {
     const isOAuthToken = token && token.startsWith('sk-ant-oat');
     
     if (isOAuthToken) {
-      // OAuth tokens use Bearer auth and claude.ai endpoint
-      const response = await fetch('https://api.claude.ai/api/organizations', {
-        method: 'GET',
-        headers: {
-          'Authorization': `Bearer ${token}`,
-          'Content-Type': 'application/json',
-          'User-Agent': 'HQX-CLI/1.0'
-        }
-      });
-      
-      if (response.ok) {
-        return { valid: true, tokenType: 'oauth', subscriptionType: credentials.subscriptionType || 'max' };
-      }
-      
-      // Try alternate endpoint
-      const altResponse = await fetch('https://claude.ai/api/auth/session', {
-        method: 'GET',
-        headers: {
-          'Authorization': `Bearer ${token}`,
-          'Cookie': `sessionKey=${token}`
-        }
-      });
-      
-      if (altResponse.ok) {
-        return { valid: true, tokenType: 'oauth', subscriptionType: credentials.subscriptionType || 'max' };
+      // For OAuth tokens from Keychain/SecureStorage, trust them directly
+      // No need to validate - they come from a trusted source (OS secure storage)
+      if (credentials.fromKeychain) {
+        return { 
+          valid: true, 
+          tokenType: 'oauth', 
+          subscriptionType: credentials.subscriptionType || 'max', 
+          trusted: true 
+        };
       }
       
-      // For OAuth tokens from Keychain, trust them without validation
-      // since the Keychain already verified the user
-      if (credentials.fromKeychain) {
-        return { valid: true, tokenType: 'oauth', subscriptionType: credentials.subscriptionType || 'max', trusted: true };
+      // For manually entered OAuth tokens, we can't validate them easily
+      // Claude doesn't have a public API for OAuth token validation
+      // Just check the format and accept
+      if (token.length > 50) {
+        return { 
+          valid: true, 
+          tokenType: 'oauth', 
+          subscriptionType: 'max',
+          warning: 'Token format looks valid, but could not verify online'
+        };
       }
       
-      return { valid: false, error: 'OAuth token expired or invalid' };
+      return { valid: false, error: 'Invalid OAuth token format' };
     }
     
     // Standard API key validation
@@ -214,6 +204,16 @@ const validateAnthropic = async (credentials) => {
     const error = await response.json();
     return { valid: false, error: error.error?.message || 'Invalid API key' };
   } catch (e) {
+    // If validation fails but token is from Keychain, still trust it
+    if (credentials.fromKeychain) {
+      return { 
+        valid: true, 
+        tokenType: 'oauth', 
+        subscriptionType: credentials.subscriptionType || 'max', 
+        trusted: true,
+        warning: 'Could not validate online, but trusted from Keychain'
+      };
+    }
     return { valid: false, error: e.message };
   }
 };

package/src/services/ai/token-scanner.js

@@ -657,14 +657,32 @@ const parseCredentialJson = (output, entry) => {
 
 /**
  * Read tokens from macOS Keychain
+ * Optimized: stops after finding first valid token per provider to minimize password prompts
  */
 const readMacOSKeychain = () => {
   if (platform !== 'darwin') return [];
   
   const results = [];
   const { execSync } = require('child_process');
+  const foundProviders = new Set(); // Track which providers we already found
+  
+  // Sort entries to prioritize most common ones first
+  const priorityOrder = ['Claude Code-credentials', 'Cursor-credentials', 'Claude Safe Storage'];
+  const sortedEntries = [...CREDENTIAL_ENTRIES].sort((a, b) => {
+    const aIdx = priorityOrder.indexOf(a.service);
+    const bIdx = priorityOrder.indexOf(b.service);
+    if (aIdx === -1 && bIdx === -1) return 0;
+    if (aIdx === -1) return 1;
+    if (bIdx === -1) return -1;
+    return aIdx - bIdx;
+  });
   
-  for (const entry of CREDENTIAL_ENTRIES) {
+  for (const entry of sortedEntries) {
+    // Skip if we already found a token for this provider
+    if (foundProviders.has(entry.provider)) {
+      continue;
+    }
+    
     try {
       const output = execSync(
         `security find-generic-password -s "${entry.service}" -w 2>/dev/null`,
@@ -672,10 +690,14 @@ const readMacOSKeychain = () => {
       ).trim();
       
       if (output) {
-        results.push(...parseCredentialJson(output, entry));
+        const tokens = parseCredentialJson(output, entry);
+        if (tokens.length > 0) {
+          results.push(...tokens);
+          foundProviders.add(entry.provider); // Mark this provider as found
+        }
       }
     } catch {
-      // Entry not found or access denied
+      // Entry not found or access denied - no password prompt for missing entries
     }
   }