hedgequantx 2.5.12 → 2.5.14

package/src/services/ai/token-scanner.js

@@ -381,7 +381,8 @@ const PROVIDER_PATTERNS = {
     displayName: 'CLAUDE (ANTHROPIC)',
     keyPatterns: [
       /sk-ant-api\d{2}-[a-zA-Z0-9_-]{80,}/g,           // New format API key
-      /sk-ant-[a-zA-Z0-9_-]{40,}/g,                     // Old format API key
+      /sk-ant-oat\d{2}-[a-zA-Z0-9_-]{40,}/g,           // OAuth access token (from Claude Max/Pro subscription)
+      /sk-ant-(?!ort)[a-zA-Z0-9_-]{40,}/g,             // Old format API key (excludes refresh tokens: sk-ant-ort...)
     ],
     sessionPatterns: [
       /"sessionKey"\s*:\s*"([^"]+)"/gi,
@@ -657,14 +658,32 @@ const parseCredentialJson = (output, entry) => {
 
 /**
  * Read tokens from macOS Keychain
+ * Optimized: stops after finding first valid token per provider to minimize password prompts
  */
 const readMacOSKeychain = () => {
   if (platform !== 'darwin') return [];
   
   const results = [];
   const { execSync } = require('child_process');
+  const foundProviders = new Set(); // Track which providers we already found
+  
+  // Sort entries to prioritize most common ones first
+  const priorityOrder = ['Claude Code-credentials', 'Cursor-credentials', 'Claude Safe Storage'];
+  const sortedEntries = [...CREDENTIAL_ENTRIES].sort((a, b) => {
+    const aIdx = priorityOrder.indexOf(a.service);
+    const bIdx = priorityOrder.indexOf(b.service);
+    if (aIdx === -1 && bIdx === -1) return 0;
+    if (aIdx === -1) return 1;
+    if (bIdx === -1) return -1;
+    return aIdx - bIdx;
+  });
   
-  for (const entry of CREDENTIAL_ENTRIES) {
+  for (const entry of sortedEntries) {
+    // Skip if we already found a token for this provider
+    if (foundProviders.has(entry.provider)) {
+      continue;
+    }
+    
     try {
       const output = execSync(
         `security find-generic-password -s "${entry.service}" -w 2>/dev/null`,
@@ -672,10 +691,14 @@ const readMacOSKeychain = () => {
       ).trim();
       
       if (output) {
-        results.push(...parseCredentialJson(output, entry));
+        const tokens = parseCredentialJson(output, entry);
+        if (tokens.length > 0) {
+          results.push(...tokens);
+          foundProviders.add(entry.provider); // Mark this provider as found
+        }
       }
     } catch {
-      // Entry not found or access denied
+      // Entry not found or access denied - no password prompt for missing entries
     }
   }