shraga 0.1.61 → 0.1.62

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shraga",
-  "version": "0.1.61",
+  "version": "0.1.62",
   "description": "The teammate you delegate coding to — a self-hostable, multi-user AI coding agent web UI (Claude Code, with a pluggable engine seam).",
   "type": "module",
   "main": "./src/index.ts",

package/src/server/claude-usage.ts

@@ -1,10 +1,14 @@
 // Claude Code subscription usage, read from Anthropic's OAuth usage endpoint using the credentials
 // the Claude Code CLI maintains on this box. Fails CLOSED: every error path returns null, and the
 // caller renders nothing — a broken or zeroed gauge is worse than no gauge.
+import { execFile } from 'node:child_process';
 import { readFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import path from 'node:path';
 import { createRequire } from 'node:module';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
 
 const TAG = '[claude-usage]';
 
@@ -39,6 +43,33 @@ export class ClaudeUsageOptions {
    *  on the same terms, so a 403/API-key box does not retry on every client poll. */
   ttlMs = 60_000;
   timeoutMs = 8_000;
+  /** macOS stores Claude Code's OAuth credentials in the login Keychain and writes NO credentials
+   *  file, so on darwin an absent file is not proof of an API-key deployment — we look there second.
+   *  Linux keeps the file as the only source; we never shell out there. */
+  platform: string = process.platform;
+  keychainService = 'Claude Code-credentials';
+  /** A locked keychain can block (or prompt) indefinitely — never let that stall a client poll. */
+  keychainTimeoutMs = 3_000;
+  /** Seam: hands back the raw secret string, or null on ANY failure. Tests inject here so the suite
+   *  never shells out to the real `security` binary. */
+  readKeychain: (options: ClaudeUsageOptions) => Promise<string | null> = readKeychainSecret;
+}
+
+/** `security` writes the secret to stdout with -w. The value is never logged or returned upward;
+ *  only the parsed, scope-gated accessToken leaves this module. */
+async function readKeychainSecret(options: ClaudeUsageOptions): Promise<string | null> {
+  try {
+    const { stdout } = await execFileAsync('security', ['find-generic-password', '-s', options.keychainService, '-w'], {
+      timeout: options.keychainTimeoutMs,
+      killSignal: 'SIGKILL',
+      encoding: 'utf8',
+    });
+    return stdout.trim() || null;
+  } catch (err) {
+    // Missing binary, non-zero exit (no such item), locked keychain, timeout — all the same answer.
+    console.debug(`${TAG} keychain lookup failed: ${(err as Error).message}`);
+    return null;
+  }
 }
 
 export class ClaudeUsageReader {
@@ -67,8 +98,6 @@ export class ClaudeUsageReader {
   }
 
   private async fetchUsage(): Promise<ClaudeUsage | null> {
-    // Re-read the file EVERY time: accessToken lives ~8h and the Claude Code SDK rewrites this file
-    // when it refreshes. A token cached in memory goes stale; a fresh file read never does.
     const creds = await this.readCredentials();
     if (!creds) return null;
 
@@ -101,24 +130,57 @@ export class ClaudeUsageReader {
     }
   }
 
+  /** Re-read per poll from whichever source holds them — the token lives ~8h and Claude Code
+   *  refreshes it in place, so nothing here may be cached in a field. File first, Keychain second. */
   private async readCredentials(): Promise<{ accessToken: string; subscriptionType: string | null } | null> {
+    let fileAbsent = false;
     try {
-      const raw = await readFile(this.options.credentialsPath, 'utf8');
-      const oauth = JSON.parse(raw)?.claudeAiOauth;
-      if (!oauth?.accessToken || typeof oauth.accessToken !== 'string') return null;
-      if (!Array.isArray(oauth.scopes) || !oauth.scopes.includes(REQUIRED_SCOPE)) {
-        console.warn(`${TAG} oauth token lacks the ${REQUIRED_SCOPE} scope; hiding widget`);
-        return null;
-      }
-      return { accessToken: oauth.accessToken, subscriptionType: oauth.subscriptionType ?? null };
+      return parseCredentials(await readFile(this.options.credentialsPath, 'utf8'), 'credentials file');
     } catch (err) {
-      // ENOENT is the ordinary API-key deployment, not a fault — keep it quiet at debug level.
+      // ENOENT is the ordinary API-key deployment on Linux, not a fault — keep it quiet at debug level.
       const code = (err as NodeJS.ErrnoException).code;
-      if (code === 'ENOENT') console.debug(`${TAG} no credentials file at ${this.options.credentialsPath} (API-key deployment)`);
-      else console.warn(`${TAG} could not read credentials:`, (err as Error).message);
+      if (code === 'ENOENT') {
+        fileAbsent = true;
+        console.debug(`${TAG} no credentials file at ${this.options.credentialsPath}`);
+      } else {
+        console.warn(`${TAG} could not read credentials:`, (err as Error).message);
+      }
+    }
+
+    if (!fileAbsent || this.options.platform !== 'darwin') return null;
+    // The seam is contractually fail-closed, but readCredentials runs OUTSIDE fetchUsage's try —
+    // an unexpected rejection here would surface as a 500 rather than a hidden widget.
+    const secret = await this.options.readKeychain(this.options).catch((err: Error) => {
+      console.warn(`${TAG} keychain reader threw:`, err.message);
+      return null;
+    });
+    if (!secret) {
+      console.debug(`${TAG} keychain held no "${this.options.keychainService}" secret (API-key deployment)`);
       return null;
     }
+    return parseCredentials(secret, 'keychain');
+  }
+}
+
+/** The ONE gate, shared by both sources: a usable accessToken carrying user:profile. Never throws —
+ *  every rejection is a logged null, i.e. hidden widget and zero upstream calls. */
+function parseCredentials(raw: string, source: string): { accessToken: string; subscriptionType: string | null } | null {
+  let oauth: any;
+  try {
+    oauth = JSON.parse(raw)?.claudeAiOauth;
+  } catch {
+    console.warn(`${TAG} ${source} did not hold valid JSON; hiding widget`);
+    return null;
+  }
+  if (!oauth?.accessToken || typeof oauth.accessToken !== 'string') {
+    console.debug(`${TAG} ${source} carried no claudeAiOauth accessToken; hiding widget`);
+    return null;
+  }
+  if (!Array.isArray(oauth.scopes) || !oauth.scopes.includes(REQUIRED_SCOPE)) {
+    console.warn(`${TAG} oauth token lacks the ${REQUIRED_SCOPE} scope; hiding widget`);
+    return null;
   }
+  return { accessToken: oauth.accessToken, subscriptionType: oauth.subscriptionType ?? null };
 }
 
 function toLimit(l: any): ClaudeUsageLimit | null {