Documentation
¶
Overview ¶
Package subscription yields the operator's LIVE Anthropic subscription OAuth access token from the resident ~/.claude credentials, so the egress proxy can inject a fresh token per request instead of the sandbox holding a COPY that goes stale (access-token expiry + refresh-token rotation lock the copy out).
Single-owner discipline: only the resident `claude` binary ever refreshes and rotates the token (it owns the atomic write-back and coordinates with the operator's other claude sessions). This provider only ever READS the file, and on the rare near-expiry path DELEGATES the refresh to `claude` — it never reimplements Anthropic's undocumented OAuth refresh_token flow.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// CredPath is the path to the resident credentials file. Empty defaults to
// ~/.claude/.credentials.json.
CredPath string
// ClaudeBin is the resident CLI used to delegate a refresh. Empty defaults
// to "claude" (resolved against PATH).
ClaudeBin string
// RefreshMargin / RefreshTimeout override the defaults above (0 = default).
RefreshMargin time.Duration
RefreshTimeout time.Duration
// Now is overridable in tests; defaults to time.Now.
Now func() time.Time
}
Config configures the resident-credentials provider.
type Provider ¶
type Provider interface {
Current(ctx context.Context) (Token, error)
// Peek returns the resident token WITHOUT refreshing or delegating to `claude`
// (read-only). It is for status/provenance surfaces that must not trigger a
// refresh side effect; unlike Current it does NOT reject an expired token — the
// expiry is returned for the caller to interpret against its own clock.
Peek() (Token, error)
}
Provider yields the operator's current Anthropic subscription access token.
Source Files