tokentracker-cli 0.96.2 → 0.96.4

package/src/lib/skills-manager.js

@@ -15,6 +15,7 @@ const DEFAULT_REPOS = [
 const TARGETS = {
   claude: { id: "claude", label: "Claude", dir: () => path.join(os.homedir(), ".claude", "skills") },
   codex: { id: "codex", label: "Codex", dir: () => path.join(resolveCodexHome(), "skills") },
+  acode: { id: "acode", label: "AStudio", dir: () => path.join(resolveAcodeHome(), "skills") },
   grok: { id: "grok", label: "Grok", dir: () => path.join(resolveGrokHome(process.env), "skills") },
   antigravity: { id: "antigravity", label: "Antigravity", dirs: () => resolveAntigravitySkillDirs(process.env) },
   gemini: { id: "gemini", label: "Gemini", dir: () => path.join(os.homedir(), ".gemini", "skills") },
@@ -32,6 +33,10 @@ function resolveCodexHome() {
   return String(process.env.CODEX_HOME || "").trim() || path.join(os.homedir(), ".codex");
 }
 
+function resolveAcodeHome() {
+  return String(process.env.TOKENTRACKER_ACODE_HOME || "").trim() || path.join(os.homedir(), ".acode");
+}
+
 function resolveZcodeHome() {
   return String(process.env.ZCODE_HOME || "").trim() || path.join(os.homedir(), ".zcode");
 }
@@ -904,7 +909,12 @@ function listInstalledSkills() {
   });
 }
 
-async function installSkill(skillInput, targetIds = ["claude", "codex"]) {
+async function installSkill(
+  skillInput,
+  targetIds = ["claude", "codex"],
+  prefetchedTree = null,
+  { expectExistingId = null } = {},
+) {
   const skill = {
     key: String(skillInput?.key || ""),
     name: String(skillInput?.name || ""),
@@ -934,7 +944,9 @@ async function installSkill(skillInput, targetIds = ["claude", "codex"]) {
     );
   }
 
-  const { branch, tree } = await getRepoTree({
+  // Bulk update hands in the repo tree it already fetched, so N skills from one
+  // repo cost one GitHub call instead of N.
+  const { branch, tree } = prefetchedTree || await getRepoTree({
     owner: skill.repoOwner,
     name: skill.repoName,
     branch: skill.repoBranch,
@@ -945,9 +957,10 @@ async function installSkill(skillInput, targetIds = ["claude", "codex"]) {
   if (!files.some((entry) => /(^|\/)SKILL\.md$/i.test(entry.path))) throw new Error("SKILL.md not found in selected directory");
 
   const dest = managedSkillPath(installName);
-  const temp = path.join(dataDir(), "tmp", `${installName}-${Date.now()}`);
-  removePath(temp);
-  ensureDir(temp);
+  let selectedTargets = targetIds.filter((id) => TARGETS[id]);
+  const tempRoot = path.join(dataDir(), "tmp");
+  ensureDir(tempRoot);
+  const temp = fs.mkdtempSync(path.join(tempRoot, `${installName}-`));
   try {
     for (const entry of files) {
       const relative = entry.path === sourceDir ? path.basename(entry.path) : entry.path.slice(sourceDir.length + 1);
@@ -957,6 +970,17 @@ async function installSkill(skillInput, targetIds = ["claude", "codex"]) {
       ensureDir(path.dirname(out));
       fs.writeFileSync(out, await fetchText(githubRawUrl(skill.repoOwner, skill.repoName, branch, entry.path)));
     }
+    // An update must not recreate a skill that was uninstalled while we were
+    // downloading, nor overwrite whatever took its install directory in the
+    // meantime. Checked here because everything from this point to
+    // saveRegistry() is synchronous — no await can interleave a change we would
+    // then clobber.
+    if (expectExistingId) {
+      const current = readRegistry().skills.find((entry) => !entry.trashedAt && entry.id === expectExistingId);
+      if (!current) throw new Error("Skill is no longer installed");
+      // Another page or API caller may have changed target intent during a download.
+      selectedTargets = (current.targets || []).filter((id) => TARGETS[id]);
+    }
     removePath(dest);
     ensureDir(path.dirname(dest));
     fs.renameSync(temp, dest);
@@ -968,7 +992,6 @@ async function installSkill(skillInput, targetIds = ["claude", "codex"]) {
   const skillMarker = findSkillMarker(dest);
   const skillMd = skillMarker ? fs.readFileSync(skillMarker, "utf8") : "";
   const metadata = readSkillMetadata(skillMd, skill.name || installName);
-  const selectedTargets = targetIds.filter((id) => TARGETS[id]);
   const installed = {
     id: `${skill.repoOwner}/${skill.repoName}:${sourceDir}`,
     key: `${skill.repoOwner}/${skill.repoName}:${sourceDir}`,
@@ -987,9 +1010,13 @@ async function installSkill(skillInput, targetIds = ["claude", "codex"]) {
     targets: selectedTargets,
   };
 
-  registry.skills = registry.skills.filter((entry) => entry.id !== installed.id && entry.directory.toLowerCase() !== installName.toLowerCase());
-  registry.skills.push(installed);
-  saveRegistry(registry);
+  // Re-read: the downloads above can take minutes and the registry is shared
+  // with every other mutation path, so the copy fetched before them is stale by
+  // now. Reading here keeps the read/modify/write window down to this block.
+  const latest = readRegistry();
+  latest.skills = latest.skills.filter((entry) => entry.id !== installed.id && entry.directory.toLowerCase() !== installName.toLowerCase());
+  latest.skills.push(installed);
+  saveRegistry(latest);
 
   for (const id of selectedTargets) syncSkillToTarget(installName, id);
   appendActivity({ action: "install", name: installed.name, directory: installName, targets: selectedTargets, source: `${skill.repoOwner}/${skill.repoName}` });
@@ -1239,20 +1266,89 @@ function updateCachePath() {
   return path.join(dataDir(), "updates-cache.json");
 }
 
+// checkUpdates() and updateSkills() have to agree on three things: which skills
+// are candidates, how a cached verdict is keyed, and which tree a skill's
+// signature comes from. They share these so the badge and the update can never
+// disagree about the same skill.
+function managedUpdateCandidates(registry) {
+  return registry.skills.filter(
+    (skill) => !skill.trashedAt && skill.repoOwner && skill.repoName && skill.sourceSignature,
+  );
+}
+
+function updateFingerprint(managed) {
+  return managed
+    .map((skill) => `${skill.id}@${skill.sourceSignature}`)
+    .sort()
+    .join("|");
+}
+
+// Write the verdicts a round derived, carrying forward the previous map for
+// anything it could not derive — a repo whose tree failed, everything past a
+// rate-limited stop. "We could not check" must not render as "nothing is
+// stale": that clears every badge and with it the way to retry. Returns the
+// merged map. Entries for skills that are no longer installed are dropped.
+//
+// `full` says the round attempted the whole library, which only checkUpdates()
+// does. An update attempts the ids it was handed, so it may only publish an
+// entry when the carried map fills in the rest — see the guard below.
+function writeUpdateCache(verdicts, { full = false } = {}) {
+  const managed = managedUpdateCandidates(readRegistry());
+  const live = new Set(managed.map((skill) => skill.id));
+  const cached = readJson(updateCachePath(), null);
+  const carriedFresh = Boolean(
+    cached &&
+      cached.updates &&
+      typeof cached.updates === "object" &&
+      Number.isFinite(cached.checkedAt) &&
+      Date.now() - cached.checkedAt < UPDATE_CACHE_TTL_MS,
+  );
+  const updates = {};
+  if (carriedFresh) {
+    for (const [id, stale] of Object.entries(cached.updates)) if (live.has(id)) updates[id] = Boolean(stale);
+  }
+  for (const [id, stale] of Object.entries(verdicts)) if (live.has(id)) updates[id] = Boolean(stale);
+
+  // The entry is read back as a verdict for the entire library, and a missing
+  // key reads as "not stale". A partial round that stamped the library
+  // fingerprint would therefore publish silence about skills nobody looked at,
+  // and the next check would hit it. Leave the cache alone instead and let that
+  // check do the work.
+  if (!full && !managed.every((skill) => Object.prototype.hasOwnProperty.call(updates, skill.id))) {
+    return updates;
+  }
+
+  writeJson(updateCachePath(), {
+    fingerprint: updateFingerprint(managed),
+    // A prime inherits the window of the check it built on: it re-derived some
+    // ids, not the library, so it must not restart the hour for the rest.
+    checkedAt: full || !carriedFresh ? Date.now() : cached.checkedAt,
+    updates,
+  });
+  return updates;
+}
+
+function groupSkillsByRepo(skills) {
+  const byRepo = new Map();
+  for (const skill of skills) {
+    const branch = skill.repoBranch || "main";
+    const key = `${skill.repoOwner}/${skill.repoName}@${branch}`.toLowerCase();
+    if (!byRepo.has(key)) {
+      byRepo.set(key, { owner: skill.repoOwner, name: skill.repoName, branch, skills: [] });
+    }
+    byRepo.get(key).skills.push(skill);
+  }
+  return Array.from(byRepo.values());
+}
+
 // Compare each managed GitHub/skills.sh skill's stored source signature against a
 // freshly fetched repo tree. One tree call per repo (skills from the same repo
 // share it), concurrency-limited and cached for an hour so a background check
 // can't trip GitHub's unauthenticated rate limit. Returns { updates: {id:bool} }.
 // Read-only: never mutates the registry or the on-disk skills.
 async function checkUpdates({ force = false } = {}) {
-  const registry = readRegistry();
-  const managed = registry.skills.filter(
-    (skill) => !skill.trashedAt && skill.repoOwner && skill.repoName && skill.sourceSignature,
-  );
-  const fingerprint = managed
-    .map((skill) => `${skill.id}@${skill.sourceSignature}`)
-    .sort()
-    .join("|");
+  const managed = managedUpdateCandidates(readRegistry());
+  const fingerprint = updateFingerprint(managed);
 
   if (!force) {
     const cached = readJson(updateCachePath(), null);
@@ -1268,18 +1364,8 @@ async function checkUpdates({ force = false } = {}) {
     }
   }
 
-  const byRepo = new Map();
-  for (const skill of managed) {
-    const branch = skill.repoBranch || "main";
-    const key = `${skill.repoOwner}/${skill.repoName}@${branch}`.toLowerCase();
-    if (!byRepo.has(key)) {
-      byRepo.set(key, { owner: skill.repoOwner, name: skill.repoName, branch, skills: [] });
-    }
-    byRepo.get(key).skills.push(skill);
-  }
-
   const updates = {};
-  await mapWithConcurrency(Array.from(byRepo.values()), UPDATE_CHECK_CONCURRENCY, async (repo) => {
+  await mapWithConcurrency(groupSkillsByRepo(managed), UPDATE_CHECK_CONCURRENCY, async (repo) => {
     let tree;
     try {
       ({ tree } = await getRepoTree(repo));
@@ -1294,8 +1380,122 @@ async function checkUpdates({ force = false } = {}) {
   });
 
   const checkedAt = Date.now();
-  writeJson(updateCachePath(), { fingerprint, checkedAt, updates });
-  return { updates, checkedAt, cached: false };
+  return { updates: writeUpdateCache(updates, { full: true }), checkedAt, cached: false };
+}
+
+// Re-install managed skills from upstream, grouped by repo like checkUpdates()
+// so N skills from one repo cost one tree call. Sequential by necessity:
+// installSkill() read/modify/writes the registry, so parallel installs would
+// drop each other's entries. Every requested id gets a result row — including
+// ones that are no longer installed — so updated + skipped + failed always
+// reconciles with what the caller asked for.
+async function updateSkills(ids = []) {
+  // An empty or malformed list means "nothing was asked for", never "every
+  // managed skill" — the permissive reading turned one bad request field into a
+  // full re-install of the library.
+  const wanted = new Set(
+    (Array.isArray(ids) ? ids : []).map((id) => String(id || "")).filter(Boolean),
+  );
+  if (!wanted.size) return { results: [], updated: 0, skipped: 0, failed: 0, rateLimited: null };
+  const managed = readRegistry().skills.filter(
+    (skill) => !skill.trashedAt && skill.repoOwner && skill.repoName && wanted.has(skill.id),
+  );
+
+  const results = [];
+  const verdicts = {};
+  let rateLimited = null;
+
+  const known = new Set(managed.map((skill) => skill.id));
+  for (const id of wanted) {
+    if (!known.has(id)) results.push({ id, name: null, ok: false, error: "Skill is no longer installed" });
+  }
+
+  for (const repo of groupSkillsByRepo(managed)) {
+    let branch;
+    let tree;
+    try {
+      ({ branch, tree } = await getRepoTree(repo));
+    } catch (error) {
+      if (error instanceof RateLimitError) {
+        rateLimited = error;
+        break;
+      }
+      for (const skill of repo.skills) {
+        results.push({ id: skill.id, name: skill.name, ok: false, error: error?.message || "Unable to read repository" });
+      }
+      continue;
+    }
+
+    for (const skill of repo.skills) {
+      const sourceDir = skill.sourceDirectory || skill.directory;
+      const fresh = sourceSignatureFromTree(tree, sourceDir);
+      if (skill.sourceSignature && fresh === skill.sourceSignature) {
+        results.push({ id: skill.id, name: skill.name, ok: true, skipped: true });
+        verdicts[skill.id] = false;
+        continue;
+      }
+      // This loop runs for as long as the downloads take, and the registry is
+      // shared with every other mutation path — re-check rather than write back
+      // a skill that was uninstalled while we were working.
+      if (!readRegistry().skills.some((entry) => !entry.trashedAt && entry.id === skill.id)) {
+        results.push({ id: skill.id, name: skill.name, ok: false, error: "Skill is no longer installed" });
+        continue;
+      }
+      try {
+        await installSkill(
+          {
+            key: skill.key,
+            name: skill.name,
+            description: skill.description,
+            // installSkill() wants the repo path, not the flat install name.
+            directory: sourceDir,
+            readmeUrl: skill.readmeUrl,
+            repoOwner: skill.repoOwner,
+            repoName: skill.repoName,
+            repoBranch: branch,
+          },
+          skill.targets || [],
+          { branch, tree },
+          { expectExistingId: skill.id },
+        );
+        results.push({ id: skill.id, name: skill.name, ok: true, skipped: false });
+        if (fresh) verdicts[skill.id] = false;
+      } catch (error) {
+        if (error instanceof RateLimitError) {
+          rateLimited = error;
+          break;
+        }
+        results.push({ id: skill.id, name: skill.name, ok: false, error: error?.message || "Update failed" });
+        if (fresh) verdicts[skill.id] = true;
+      }
+    }
+    if (rateLimited) break;
+  }
+
+  // A rate-limited stop breaks out of both loops, leaving the skill it happened
+  // on and everything after it unreported. Backfill so every requested id comes
+  // back with a row and the counts still reconcile with what was asked for.
+  if (rateLimited) {
+    const reported = new Set(results.map((row) => row.id));
+    const nameById = new Map(managed.map((skill) => [skill.id, skill.name]));
+    for (const id of wanted) {
+      if (reported.has(id)) continue;
+      results.push({ id, name: nameById.get(id) || null, ok: false, error: rateLimited.message });
+    }
+  }
+
+  // Prime the cache from the trees this run already holds, so the refresh that
+  // follows is a cache hit rather than a second tree call per repo. Skipped when
+  // the run derived nothing — there is no fresh verdict to record.
+  if (Object.keys(verdicts).length) writeUpdateCache(verdicts);
+
+  return {
+    results,
+    updated: results.filter((entry) => entry.ok && !entry.skipped).length,
+    skipped: results.filter((entry) => entry.skipped).length,
+    failed: results.filter((entry) => !entry.ok).length,
+    rateLimited: rateLimited ? rateLimited.message : null,
+  };
 }
 
 // skills.sh exposes only /api/search (no leaderboard endpoint), so "Popular" is
@@ -1380,4 +1580,5 @@ module.exports = {
   sourceSignatureFromTree,
   targetList,
   uninstallSkill,
+  updateSkills,
 };

package/src/lib/subscriptions.js

@@ -19,6 +19,9 @@ const CLAUDE_CODE_CREDENTIALS_FILE = ".credentials.json";
 // Platforms where Claude Code stores credentials in the plain JSON file above
 // rather than the macOS Keychain.
 const CLAUDE_CODE_CREDENTIALS_FILE_PLATFORMS = new Set(["linux", "win32"]);
+// Refresh slightly before wall-clock expiry so Limits does not spend a request
+// that Anthropic answers with 429 for a real-but-expired Claude Code token.
+const CLAUDE_TOKEN_EXPIRY_SKEW_MS = 60_000;
 
 function usesClaudeCodeCredentialsFile(platform) {
   return CLAUDE_CODE_CREDENTIALS_FILE_PLATFORMS.has(platform);
@@ -164,14 +167,23 @@ async function detectOpencodeChatgptSubscription({ home, env }) {
   };
 }
 
-function probeMacosKeychainGenericPassword({ service, securityRunner, timeoutMs } = {}) {
+// Match Claude Code 2.1.267's account derivation. A service-only lookup may
+// select credentials from an older installation before the current account.
+function resolveClaudeKeychainAccount({ env = process.env, userInfo = os.userInfo } = {}) {
+  let account;
+  try { account = env.USER || userInfo().username; } catch (_error) { return "claude-code-user"; }
+  return typeof account === "string" && /^[a-zA-Z0-9._-]+$/.test(account)
+    ? account : "claude-code-user";
+}
+
+function probeMacosKeychainGenericPassword({ service, securityRunner, timeoutMs, env } = {}) {
   const svc = normalizeString(service);
   if (!svc) return false;
 
   const runner = typeof securityRunner === "function" ? securityRunner : cp.spawnSync;
   if (runner === cp.spawnSync && !fs.existsSync(MACOS_SECURITY_BIN)) return false;
 
-  const result = runner(MACOS_SECURITY_BIN, ["find-generic-password", "-s", svc], {
+  const result = runner(MACOS_SECURITY_BIN, ["find-generic-password", "-s", svc, "-a", resolveClaudeKeychainAccount({ env })], {
     stdio: "ignore",
     timeout: Number.isFinite(timeoutMs) ? timeoutMs : 2000,
   });
@@ -180,14 +192,14 @@ function probeMacosKeychainGenericPassword({ service, securityRunner, timeoutMs
   return result.status === 0;
 }
 
-function readMacosKeychainPassword({ service, securityRunner, timeoutMs } = {}) {
+function readMacosKeychainPassword({ service, securityRunner, timeoutMs, env } = {}) {
   const svc = normalizeString(service);
   if (!svc) return null;
 
   const runner = typeof securityRunner === "function" ? securityRunner : cp.spawnSync;
   if (runner === cp.spawnSync && !fs.existsSync(MACOS_SECURITY_BIN)) return null;
 
-  const result = runner(MACOS_SECURITY_BIN, ["find-generic-password", "-s", svc, "-w"], {
+  const result = runner(MACOS_SECURITY_BIN, ["find-generic-password", "-s", svc, "-a", resolveClaudeKeychainAccount({ env }), "-w"], {
     stdio: ["ignore", "pipe", "ignore"],
     timeout: Number.isFinite(timeoutMs) ? timeoutMs : 2000,
     encoding: "utf8",
@@ -217,12 +229,13 @@ function readClaudeCodeCredentialsFile({ home, fsReader } = {}) {
   }
 }
 
-function detectClaudeCodeCredentialsPresence({ platform = process.platform, securityRunner, home, fsReader } = {}) {
+function detectClaudeCodeCredentialsPresence({ platform = process.platform, securityRunner, home, fsReader, env } = {}) {
   if (platform === "darwin") {
     for (const service of CLAUDE_CODE_KEYCHAIN_SERVICES) {
       const present = probeMacosKeychainGenericPassword({
         service,
         securityRunner,
+        env,
       });
       if (!present) continue;
 
@@ -260,6 +273,31 @@ function detectClaudeCodeCredentialsPresence({ platform = process.platform, secu
   return null;
 }
 
+function parseClaudeOauthExpiryMs(value) {
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) return null;
+    if (value <= 0) return 0;
+    return value < 1e12 ? value * 1000 : value;
+  }
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    if (!trimmed) return null;
+    if (/^-?\d+(\.\d+)?$/.test(trimmed)) return parseClaudeOauthExpiryMs(Number(trimmed));
+    const ms = Date.parse(trimmed);
+    return Number.isFinite(ms) ? ms : null;
+  }
+  return null;
+}
+
+function extractClaudeCodeOauth(payload, nowMs = Date.now()) {
+  const oauth = payload?.claudeAiOauth;
+  const accessToken = normalizeString(oauth?.accessToken);
+  if (!accessToken) return null;
+  const expiresAtMs = parseClaudeOauthExpiryMs(oauth?.expiresAt);
+  if (expiresAtMs != null && expiresAtMs <= nowMs + CLAUDE_TOKEN_EXPIRY_SKEW_MS) return null;
+  return { accessToken, expiresAtMs };
+}
+
 function extractClaudeKeychainSubscription(payload) {
   if (!payload || typeof payload !== "object" || Array.isArray(payload)) return null;
 
@@ -273,11 +311,11 @@ function extractClaudeKeychainSubscription(payload) {
   return { subscriptionType, rateLimitTier };
 }
 
-function detectClaudeCodeSubscriptionDetails({ platform = process.platform, securityRunner, home, fsReader } = {}) {
+function detectClaudeCodeSubscriptionDetails({ platform = process.platform, securityRunner, home, fsReader, env } = {}) {
   const rawPayloads = [];
   if (platform === "darwin") {
     for (const service of CLAUDE_CODE_KEYCHAIN_SERVICES) {
-      const raw = readMacosKeychainPassword({ service, securityRunner });
+      const raw = readMacosKeychainPassword({ service, securityRunner, env });
       if (raw) rawPayloads.push(raw);
     }
   } else if (usesClaudeCodeCredentialsFile(platform)) {
@@ -327,14 +365,14 @@ async function collectLocalSubscriptions({
   if (opencode) out.push(opencode);
 
   if (probeKeychainDetails) {
-    const claude = detectClaudeCodeSubscriptionDetails({ platform, securityRunner, home });
+    const claude = detectClaudeCodeSubscriptionDetails({ platform, securityRunner, home, env });
     if (claude) out.push(claude);
     else if (probeKeychain) {
-      const present = detectClaudeCodeCredentialsPresence({ platform, securityRunner, home });
+      const present = detectClaudeCodeCredentialsPresence({ platform, securityRunner, home, env });
       if (present) out.push(present);
     }
   } else if (probeKeychain) {
-    const claude = detectClaudeCodeCredentialsPresence({ platform, securityRunner, home });
+    const claude = detectClaudeCodeCredentialsPresence({ platform, securityRunner, home, env });
     if (claude) out.push(claude);
   }
 
@@ -364,14 +402,25 @@ async function detectOpenclawSessionIntegration({ home, env }) {
   };
 }
 
-function readClaudeCodeAccessToken({ platform = process.platform, securityRunner, home, fsReader } = {}) {
+// Returns the live OAuth token plus its expiry stamp. The expiry doubles as a
+// rotation marker for the 429 cool-down: it changes on every refresh and, unlike
+// the token itself, is not a secret, so nothing derived from a credential has to
+// be written to disk.
+function readClaudeCodeOauthToken({
+  platform = process.platform,
+  securityRunner,
+  home,
+  fsReader,
+  env,
+  nowMs = Date.now(),
+} = {}) {
   if (platform === "darwin") {
     for (const service of CLAUDE_CODE_KEYCHAIN_SERVICES) {
       try {
-        const raw = readMacosKeychainPassword({ service, securityRunner });
+        const raw = readMacosKeychainPassword({ service, securityRunner, env });
         if (!raw) continue;
-        const payload = JSON.parse(raw);
-        return normalizeString(payload?.claudeAiOauth?.accessToken);
+        const oauth = extractClaudeCodeOauth(JSON.parse(raw), nowMs);
+        if (oauth) return oauth;
       } catch (_e) {
         continue;
       }
@@ -386,13 +435,16 @@ function readClaudeCodeAccessToken({ platform = process.platform, securityRunner
   const raw = readClaudeCodeCredentialsFile({ home, fsReader });
   if (!raw) return null;
   try {
-    const payload = JSON.parse(raw);
-    return normalizeString(payload?.claudeAiOauth?.accessToken);
+    return extractClaudeCodeOauth(JSON.parse(raw), nowMs);
   } catch (_e) {
     return null;
   }
 }
 
+function readClaudeCodeAccessToken(options = {}) {
+  return readClaudeCodeOauthToken(options)?.accessToken ?? null;
+}
+
 async function readCodexAccessToken({ home, env } = {}) {
   try {
     const codexHome = resolveCodexHome({ home, env });
@@ -445,10 +497,12 @@ async function readCodexAuthBundle({ home, env } = {}) {
 }
 
 module.exports = {
+  resolveClaudeKeychainAccount,
   collectLocalSubscriptions,
   detectClaudeCodeCredentialsPresence,
   detectClaudeCodeSubscriptionDetails,
   readClaudeCodeAccessToken,
+  readClaudeCodeOauthToken,
   readCodexAccessToken,
   readCodexAuthBundle,
 };