claude-auth-manager 0.0.2__py3-none-any.whl

claude_auth_manager/__init__.py

@@ -0,0 +1,3 @@
+"""Manage multiple Claude subscriptions and provider keys in Claude Code."""
+
+__version__ = "0.0.2"

claude_auth_manager/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+raise SystemExit(main())

claude_auth_manager/agents.py

@@ -0,0 +1,180 @@
+"""Managed Claude Code subagents for exact provider/account favorites."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+import shlex
+import sys
+from pathlib import Path
+from typing import Any
+
+from .models import claude_model, compact_model_name, managed_model
+from .paths import agent_manifest_path, claude_agents_dir
+from .storage import atomic_write_json, atomic_write_text, read_json_object
+
+MANIFEST_VERSION = 1
+MANAGED_MARKER = "<!-- Managed by claude-auth-manager; regenerated by setup/select. -->"
+HOOK_COMMAND_SUFFIX = "-m claude_auth_manager _agent-hook"
+
+
+def agent_name(model_id: str) -> str:
+    """Return a readable, collision-resistant Claude subagent name."""
+    slug = re.sub(r"[^a-z0-9]+", "-", model_id.casefold()).strip("-")
+    slug = slug[:48].rstrip("-") or "model"
+    digest = hashlib.sha256(model_id.encode()).hexdigest()[:8]
+    return f"cam-{slug}-{digest}"
+
+
+def _agent_document(model: dict[str, Any], name: str) -> str:
+    model_id = str(model["id"])
+    label = compact_model_name(model)
+    description = (
+        f"Run a delegated task with the exact {model.get('provider')} favorite "
+        f"{label} ({model_id}) using {model.get('credential')}. "
+        "Choose this subagent when that model is requested. Do not pass the Agent model "
+        "parameter; this definition owns the exact model route."
+    )
+    return f"""---
+name: {json.dumps(name)}
+description: {json.dumps(description)}
+model: {json.dumps(claude_model(model))}
+---
+
+{MANAGED_MARKER}
+
+Complete the delegated task using this configured provider route. Be explicit about
+limitations and identify the provider accurately when asked.
+"""
+
+
+def hook_command() -> str:
+    executable = shlex.quote(str(Path(sys.executable).resolve()))
+    return f"{executable} {HOOK_COMMAND_SUFFIX}"
+
+
+def managed_hook_group() -> dict[str, Any]:
+    return {
+        "matcher": "Agent",
+        "hooks": [{"type": "command", "command": hook_command()}],
+    }
+
+
+def is_managed_hook_group(value: Any) -> bool:
+    if not isinstance(value, dict) or value.get("matcher") != "Agent":
+        return False
+    hooks = value.get("hooks")
+    return isinstance(hooks, list) and any(
+        isinstance(hook, dict)
+        and isinstance(hook.get("command"), str)
+        and hook["command"].endswith(HOOK_COMMAND_SUFFIX)
+        for hook in hooks
+    )
+
+
+def _safe_managed_path(filename: str) -> Path | None:
+    if Path(filename).name != filename:
+        return None
+    path = claude_agents_dir() / filename
+    if path.resolve().parent != claude_agents_dir().resolve():
+        return None
+    return path
+
+
+def _remove_manifest_files(manifest: dict[str, Any]) -> None:
+    agents = manifest.get("agents")
+    if not isinstance(agents, dict):
+        return
+    for entry in agents.values():
+        if not isinstance(entry, dict) or not isinstance(entry.get("file"), str):
+            continue
+        path = _safe_managed_path(entry["file"])
+        if path is None or not path.exists():
+            continue
+        try:
+            managed = MANAGED_MARKER in path.read_text(encoding="utf-8")
+        except OSError:
+            managed = False
+        if managed:
+            path.unlink()
+
+
+def sync_managed_agents(models: list[dict[str, Any]]) -> dict[str, str]:
+    """Replace cam-owned subagent definitions and return name-to-model routes."""
+    manifest_path = agent_manifest_path()
+    old_manifest = read_json_object(manifest_path, missing_ok=True)
+    _remove_manifest_files(old_manifest)
+
+    entries: dict[str, dict[str, str]] = {}
+    routes: dict[str, str] = {}
+    for model in models:
+        route = managed_model(model)
+        # The credential is part of the agent identity. Two OpenRouter or
+        # Google keys can expose the same upstream model and must still produce
+        # two independently selectable subagents.
+        name = agent_name(route)
+        filename = f"{name}.md"
+        path = _safe_managed_path(filename)
+        assert path is not None
+        if path.exists() and MANAGED_MARKER not in path.read_text(encoding="utf-8"):
+            raise RuntimeError(f"refusing to replace non-cam Claude subagent: {path}")
+        atomic_write_text(path, _agent_document(model, name), 0o600)
+        entries[name] = {"file": filename, "model": claude_model(model)}
+        routes[name] = claude_model(model)
+
+    atomic_write_json(
+        manifest_path,
+        {"version": MANIFEST_VERSION, "agents": entries},
+    )
+    return routes
+
+
+def remove_managed_agents() -> None:
+    manifest_path = agent_manifest_path()
+    manifest = read_json_object(manifest_path, missing_ok=True)
+    _remove_manifest_files(manifest)
+    manifest_path.unlink(missing_ok=True)
+    directory = claude_agents_dir()
+    if directory.exists() and not any(directory.iterdir()):
+        directory.rmdir()
+
+
+def rewrite_agent_input(event: Any) -> dict[str, Any] | None:
+    """Pin a cam custom subagent to its definition instead of a native alias."""
+    if not isinstance(event, dict) or event.get("tool_name") != "Agent":
+        return None
+    tool_input = event.get("tool_input")
+    if not isinstance(tool_input, dict):
+        return None
+    subagent_type = tool_input.get("subagent_type")
+    if not isinstance(subagent_type, str):
+        return None
+    manifest = read_json_object(agent_manifest_path(), missing_ok=True)
+    agents = manifest.get("agents")
+    if not isinstance(agents, dict) or subagent_type not in agents:
+        return None
+    updated = dict(tool_input)
+    updated.pop("model", None)
+    return {
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": "allow",
+            "permissionDecisionReason": (
+                "Using the exact provider/account model selected by this cam subagent."
+            ),
+            "updatedInput": updated,
+        }
+    }
+
+
+def run_agent_hook() -> int:
+    """Best-effort Claude Code hook entry point; never disrupt unrelated tools."""
+    try:
+        event = json.load(sys.stdin)
+        result = rewrite_agent_input(event)
+        if result is not None:
+            print(json.dumps(result, separators=(",", ":")))
+    except (OSError, RuntimeError, ValueError, json.JSONDecodeError):
+        return 0
+    return 0

claude_auth_manager/anthropic.py

@@ -0,0 +1,30 @@
+"""Private Anthropic API credential storage for optional API-billed routing."""
+
+from __future__ import annotations
+
+import re
+
+from .paths import anthropic_credential_path
+from .storage import atomic_write_text
+
+KEY_PATTERN = re.compile(r"^sk-ant-[^\s]{10,}$")
+
+
+def validate_anthropic_key_shape(key: str) -> None:
+    if not KEY_PATTERN.fullmatch(key):
+        raise ValueError("the Anthropic key has an unexpected format (expected sk-ant-...)")
+
+
+def read_anthropic_credential() -> str:
+    path = anthropic_credential_path()
+    try:
+        key = path.read_text(encoding="utf-8").strip()
+    except FileNotFoundError as exc:
+        raise RuntimeError(f"Anthropic API credential not found at {path}") from exc
+    validate_anthropic_key_shape(key)
+    return key
+
+
+def write_anthropic_credential(key: str) -> None:
+    validate_anthropic_key_shape(key)
+    atomic_write_text(anthropic_credential_path(), f"{key}\n", 0o600)

claude_auth_manager/catalogs.py

@@ -0,0 +1,259 @@
+"""Unified model catalog across subscriptions and API-key providers."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from . import google, openrouter
+from .models import claude_model, compact_model_name, managed_model, search_models
+from .registry import key_entry, list_accounts, list_keys, read_key
+
+ANTHROPIC_MODELS: tuple[dict[str, Any], ...] = (
+    {
+        "id": "claude-fable-5-1",
+        "name": "Claude Fable 5.1",
+        "description": "Most capable Claude model for long-running agents",
+        "context_length": 1_000_000,
+        "supported_parameters": ["tools", "tool_choice", "images"],
+        "architecture": {"input_modalities": ["text", "image"]},
+    },
+    {
+        "id": "claude-opus-5",
+        "name": "Claude Opus 5",
+        "description": "Latest flagship Claude model",
+        "context_length": 1_000_000,
+        "supported_parameters": ["tools", "tool_choice", "images"],
+        "architecture": {"input_modalities": ["text", "image"]},
+    },
+    {
+        "id": "claude-sonnet-5",
+        "name": "Claude Sonnet 5",
+        "description": "Latest balanced Claude model",
+        "context_length": 1_000_000,
+        "supported_parameters": ["tools", "tool_choice", "images"],
+        "architecture": {"input_modalities": ["text", "image"]},
+    },
+    {
+        "id": "claude-fable-5",
+        "name": "Claude Fable 5",
+        "description": "Fast agentic Claude 5 model",
+        "context_length": 1_000_000,
+        "supported_parameters": ["tools", "tool_choice", "images"],
+        "architecture": {"input_modalities": ["text", "image"]},
+    },
+    {
+        "id": "claude-opus-4-8",
+        "name": "Claude Opus 4.8",
+        "description": "High-capability Claude model",
+        "context_length": 1_000_000,
+        "supported_parameters": ["tools", "tool_choice", "images"],
+        "architecture": {"input_modalities": ["text", "image"]},
+    },
+    {
+        "id": "claude-opus-4-7",
+        "name": "Claude Opus 4.7",
+        "description": "High-capability Claude model",
+        "context_length": 1_000_000,
+        "supported_parameters": ["tools", "tool_choice", "images"],
+        "architecture": {"input_modalities": ["text", "image"]},
+    },
+    {
+        "id": "claude-opus-4-6",
+        "name": "Claude Opus 4.6",
+        "description": "Most capable Claude model",
+        "context_length": 1_000_000,
+        "supported_parameters": ["tools", "tool_choice", "images"],
+        "architecture": {"input_modalities": ["text", "image"]},
+    },
+    {
+        "id": "claude-sonnet-4-6",
+        "name": "Claude Sonnet 4.6",
+        "description": "Balanced Claude coding model",
+        "context_length": 1_000_000,
+        "supported_parameters": ["tools", "tool_choice", "images"],
+        "architecture": {"input_modalities": ["text", "image"]},
+    },
+    {
+        "id": "claude-haiku-4-5-20251001",
+        "name": "Claude Haiku 4.5",
+        "description": "Fast Claude model",
+        "context_length": 200_000,
+        "supported_parameters": ["tools", "tool_choice", "images"],
+        "architecture": {"input_modalities": ["text", "image"]},
+    },
+)
+
+
+def _decorate(
+    models: list[dict[str, Any]] | tuple[dict[str, Any], ...],
+    provider: str,
+    credential: str,
+    credential_label: str | None = None,
+) -> list[dict[str, Any]]:
+    result: list[dict[str, Any]] = []
+    for source in models:
+        model = dict(source)
+        model["provider"] = provider
+        model["credential"] = credential
+        if credential_label:
+            model["credential_label"] = credential_label
+        model["name"] = compact_model_name(model)
+        model["route"] = managed_model(model)
+        result.append(model)
+    return result
+
+
+def account_models() -> list[dict[str, Any]]:
+    models: list[dict[str, Any]] = []
+    for account in list_accounts():
+        label = str(account.get("label") or account["id"])
+        account_catalog = _decorate(
+            ANTHROPIC_MODELS,
+            "anthropic",
+            str(account["id"]),
+            label,
+        )
+        for field in ("subscription", "rate_limit_tier"):
+            value = account.get(field)
+            if isinstance(value, str) and value:
+                for model in account_catalog:
+                    model[field] = value
+        models.extend(account_catalog)
+    return models
+
+
+def anthropic_api_models() -> list[dict[str, Any]]:
+    result: list[dict[str, Any]] = []
+    for entry in list_keys("anthropic-api"):
+        result.extend(
+            _decorate(
+                ANTHROPIC_MODELS,
+                "anthropic-api",
+                str(entry["id"]),
+                str(entry.get("label") or entry["id"]),
+            )
+        )
+    return result
+
+
+def refresh_key_catalog(key_id: str) -> list[dict[str, Any]]:
+    entry = key_entry(key_id)
+    provider = str(entry["provider"])
+    key = read_key(key_id, provider=provider)
+    if provider == "openrouter":
+        models = openrouter.refresh_catalog(key, key_id)
+    elif provider == "google":
+        models = google.refresh_catalog(key_id, key)
+    elif provider == "anthropic-api":
+        models = list(ANTHROPIC_MODELS)
+    else:  # registry validation should make this unreachable
+        raise RuntimeError(f"unsupported provider: {provider}")
+    return _decorate(models, provider, key_id, str(entry.get("label") or key_id))
+
+
+def load_key_catalog(key_id: str) -> list[dict[str, Any]]:
+    entry = key_entry(key_id)
+    provider = str(entry["provider"])
+    if provider == "openrouter":
+        models = openrouter.load_catalog(key_id)
+    elif provider == "google":
+        models = google.load_catalog(key_id)
+    elif provider == "anthropic-api":
+        models = list(ANTHROPIC_MODELS)
+    else:
+        raise RuntimeError(f"unsupported provider: {provider}")
+    return _decorate(models, provider, key_id, str(entry.get("label") or key_id))
+
+
+def refresh_all_catalogs() -> list[dict[str, Any]]:
+    models = account_models() + anthropic_api_models()
+    for entry in list_keys():
+        if entry.get("provider") in {"openrouter", "google"}:
+            models.extend(refresh_key_catalog(str(entry["id"])))
+    return models
+
+
+def refresh_select_catalogs() -> list[dict[str, Any]]:
+    """Refresh key-filtered OpenRouter catalogs and load every other route.
+
+    Selection must not offer stale OpenRouter routes because the effective
+    model allowlist can change when a key's guardrails change. Other provider
+    catalogs retain their existing explicit refresh behavior.
+    """
+    models = account_models() + anthropic_api_models()
+    for entry in list_keys():
+        key_id = str(entry["id"])
+        if entry.get("provider") == "openrouter":
+            models.extend(refresh_key_catalog(key_id))
+        elif entry.get("provider") == "google":
+            models.extend(load_key_catalog(key_id))
+    return models
+
+
+def load_all_catalogs(*, tolerate_missing: bool = False) -> list[dict[str, Any]]:
+    models = account_models() + anthropic_api_models()
+    for entry in list_keys():
+        if entry.get("provider") not in {"openrouter", "google"}:
+            continue
+        try:
+            models.extend(load_key_catalog(str(entry["id"])))
+        except RuntimeError:
+            if not tolerate_missing:
+                raise
+    return models
+
+
+def exact_routes(models: list[dict[str, Any]], requested: list[str]) -> list[dict[str, Any]]:
+    """Resolve exact managed ids or convenient provider/credential/model specs."""
+    by_route = {managed_model(model): model for model in models}
+    by_route.update({claude_model(model): model for model in models})
+    by_spec = {
+        f"{model['provider']}/{model['credential']}/{model['id']}": model for model in models
+    }
+    by_plain: dict[str, list[dict[str, Any]]] = {}
+    for model in models:
+        by_plain.setdefault(str(model["id"]), []).append(model)
+    selected: list[dict[str, Any]] = []
+    missing: list[str] = []
+    for request in requested:
+        model = by_route.get(request) or by_spec.get(request)
+        if model is None:
+            candidates = by_plain.get(request, [])
+            if len(candidates) == 1:
+                model = candidates[0]
+            elif len(candidates) > 1:
+                choices = ", ".join(
+                    f"{item['provider']}/{item['credential']}/{item['id']}" for item in candidates
+                )
+                raise ValueError(f"model {request} is ambiguous; choose one of: {choices}")
+        if model is None:
+            missing.append(request)
+        elif managed_model(model) not in {managed_model(item) for item in selected}:
+            selected.append(model)
+    if missing:
+        raise ValueError(f"model route not found in the current indexes: {', '.join(missing)}")
+    if not selected:
+        raise ValueError("select at least one model")
+    return selected
+
+
+def search_all(models: list[dict[str, Any]], queries: list[str]) -> list[dict[str, Any]]:
+    """Search regular fields plus provider and credential labels."""
+    augmented: list[dict[str, Any]] = []
+    for model in models:
+        copy = dict(model)
+        extra = " ".join(
+            str(value)
+            for value in (
+                model.get("description"),
+                model.get("provider"),
+                model.get("credential"),
+                model.get("credential_label"),
+            )
+            if value
+        )
+        copy["description"] = extra
+        augmented.append(copy)
+    found = search_models(augmented, queries)
+    routes = {managed_model(model) for model in found}
+    return [model for model in models if managed_model(model) in routes]

claude_auth_manager/check.py

@@ -0,0 +1,216 @@
+"""Live Claude Code tool-compatibility probe for an OpenRouter model."""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import secrets
+import subprocess
+import tempfile
+import threading
+from dataclasses import dataclass, replace
+from decimal import Decimal, InvalidOperation
+from pathlib import Path
+from typing import Any
+
+from .launcher import find_claude
+from .models import managed_model
+from .proxy import LOCAL_TOKEN_HEADER, HybridRouterServer, router_base_url
+
+PROBE_MARKER = "CAM_TOOL_CHECK_OK"
+PROBE_FILENAME = "cam-tool-probe.txt"
+PROBE_INPUT_TOKEN_ESTIMATE = 15_000
+PROBE_OUTPUT_TOKEN_ESTIMATE = 500
+PROBE_INPUT_TOKEN_PLANNING_MAX = 500_000
+PROBE_OUTPUT_TOKEN_PLANNING_MAX = 2_000
+
+
+@dataclass(frozen=True)
+class ToolProbeResult:
+    tool_called: bool
+    tool_completed: bool
+    acknowledged_result: bool
+    returncode: int
+    total_cost_usd: float | None
+    final_text: str
+    diagnostic: str
+
+    @property
+    def passed(self) -> bool:
+        return (
+            self.returncode == 0
+            and self.tool_called
+            and self.tool_completed
+            and self.acknowledged_result
+        )
+
+
+def estimate_probe_cost(
+    model: dict[str, Any],
+    *,
+    input_tokens: int = PROBE_INPUT_TOKEN_ESTIMATE,
+    output_tokens: int = PROBE_OUTPUT_TOKEN_ESTIMATE,
+) -> Decimal | None:
+    """Estimate a probe from catalog rates and the expected Claude Code context."""
+    pricing = model.get("pricing")
+    if not isinstance(pricing, dict):
+        return None
+    try:
+        prompt = Decimal(str(pricing["prompt"]))
+        completion = Decimal(str(pricing["completion"]))
+    except (InvalidOperation, KeyError, TypeError, ValueError):
+        return None
+    if not prompt.is_finite() or not completion.is_finite() or prompt < 0 or completion < 0:
+        return None
+    return prompt * input_tokens + completion * output_tokens
+
+
+def _stream_events(output: str) -> list[dict[str, Any]]:
+    events: list[dict[str, Any]] = []
+    for line in output.splitlines():
+        try:
+            event = json.loads(line)
+        except json.JSONDecodeError:
+            continue
+        if isinstance(event, dict):
+            events.append(event)
+    return events
+
+
+def parse_probe_result(
+    output: str, debug_log: str, *, returncode: int, stderr: str = ""
+) -> ToolProbeResult:
+    events = _stream_events(output)
+    tool_ids: set[str] = set()
+    completed_ids: set[str] = set()
+    final_text = ""
+    total_cost: float | None = None
+    for event in events:
+        message = event.get("message")
+        if isinstance(message, dict):
+            content = message.get("content")
+            if isinstance(content, list):
+                for block in content:
+                    if not isinstance(block, dict):
+                        continue
+                    if block.get("type") == "tool_use" and block.get("name") == "Glob":
+                        tool_id = block.get("id")
+                        if isinstance(tool_id, str):
+                            tool_ids.add(tool_id)
+                    if block.get("type") == "tool_result":
+                        tool_id = block.get("tool_use_id")
+                        if isinstance(tool_id, str) and not block.get("is_error", False):
+                            completed_ids.add(tool_id)
+        if event.get("type") == "result":
+            result = event.get("result")
+            if isinstance(result, str):
+                final_text = result
+            cost = event.get("total_cost_usd")
+            if isinstance(cost, int | float):
+                total_cost = float(cost)
+
+    debug_called = re.search(r"tool_dispatch_start\s+tool=Glob\b", debug_log) is not None
+    debug_completed = (
+        re.search(r"tool_dispatch_end\s+tool=Glob\b[^\n]*\boutcome=ok\b", debug_log) is not None
+    )
+    tool_called = bool(tool_ids) or debug_called
+    tool_completed = bool(tool_ids & completed_ids) or debug_completed
+    diagnostics = [stderr.strip(), final_text.strip()]
+    diagnostic = "\n".join(part for part in diagnostics if part)[-2000:]
+    return ToolProbeResult(
+        tool_called=tool_called,
+        tool_completed=tool_completed,
+        acknowledged_result=PROBE_MARKER in final_text,
+        returncode=returncode,
+        total_cost_usd=total_cost,
+        final_text=final_text,
+        diagnostic=diagnostic,
+    )
+
+
+def probe_model(model: dict[str, Any], *, timeout: int = 180) -> ToolProbeResult:
+    """Run an isolated, billable Glob round-trip through real Claude Code."""
+    route = managed_model(model)
+    token = secrets.token_urlsafe(32)
+    server = HybridRouterServer(
+        ("127.0.0.1", 0),
+        local_token=token,
+        routes={route: model},
+        record_status=False,
+    )
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    try:
+        with tempfile.TemporaryDirectory(prefix="cam-tool-check-") as directory:
+            workdir = Path(directory)
+            (workdir / PROBE_FILENAME).write_text("tool round-trip probe\n", encoding="utf-8")
+            debug_path = workdir / "claude-debug.log"
+            environment = dict(os.environ)
+            for name in (
+                "CLAUDE_CODE_USE_BEDROCK",
+                "CLAUDE_CODE_USE_FOUNDRY",
+                "CLAUDE_CODE_USE_VERTEX",
+            ):
+                environment.pop(name, None)
+            environment.update(
+                {
+                    "ANTHROPIC_BASE_URL": router_base_url(server.server_port),
+                    "ANTHROPIC_API_KEY": "",
+                    "ANTHROPIC_AUTH_TOKEN": token,
+                    "ANTHROPIC_CUSTOM_HEADERS": f"{LOCAL_TOKEN_HEADER}: {token}",
+                    "ENABLE_TOOL_SEARCH": "false",
+                }
+            )
+            command = [
+                find_claude(),
+                "-p",
+                "--model",
+                route,
+                "--name",
+                "cam-tool-check",
+                "--setting-sources",
+                "project,local",
+                "--tools",
+                "Glob",
+                "--permission-mode",
+                "dontAsk",
+                "--no-session-persistence",
+                "--output-format",
+                "stream-json",
+                "--verbose",
+                "--debug-file",
+                str(debug_path),
+                (
+                    f"Use the Glob tool exactly once to find {PROBE_FILENAME} in the current "
+                    f"directory. Only after reading the tool result, reply exactly {PROBE_MARKER}."
+                ),
+            ]
+            try:
+                completed = subprocess.run(
+                    command,
+                    cwd=workdir,
+                    env=environment,
+                    stdin=subprocess.DEVNULL,
+                    capture_output=True,
+                    text=True,
+                    check=False,
+                    timeout=timeout,
+                )
+            except subprocess.TimeoutExpired as exc:
+                output = exc.stdout if isinstance(exc.stdout, str) else ""
+                stderr = exc.stderr if isinstance(exc.stderr, str) else ""
+                debug_log = debug_path.read_text(errors="replace") if debug_path.exists() else ""
+                result = parse_probe_result(output, debug_log, returncode=124, stderr=stderr)
+                return replace(result, diagnostic="tool check timed out")
+            debug_log = debug_path.read_text(errors="replace") if debug_path.exists() else ""
+            return parse_probe_result(
+                completed.stdout,
+                debug_log,
+                returncode=completed.returncode,
+                stderr=completed.stderr,
+            )
+    finally:
+        server.shutdown()
+        server.server_close()
+        thread.join(timeout=2)