Skip to main content

probe_oauth_status

agentmux_srv::identity::resolver::oauth_probe

Function probe_oauth_status 

Source 
pub fn probe_oauth_status(
    provider: &str,
    dir: &str,
    now_ms: i64,
) -> Option<OAuthProbeStatus>
Expand description

Cheap on-disk probe of the per-bundle OAuth token file for a provider. No network calls — just reads + parses the token JSON, then compares expiresAt against now_ms.

Provider token-file shape (spec §4.4 + §4.5):

  • claude — <dir>/.credentials.json with { "claudeAiOauth": { "accessToken", "refreshToken", "expiresAt": <ms> } } (Anthropic’s documented format — see docs/specs/agentmux-isolated-auth.md §1.6).
  • codex — <dir>/.credentials.json (MCP OAuth). Exact field layout undocumented by OpenAI; for now we treat presence-of-file as Valid and absence as NeedsReauth, deferring strict expiry parsing until the shape is pinned down. Falls through to the Claude parser as a best-effort — if the file is shape-compatible (some CLIs reuse Anthropic’s format) the expiry check still works.
  • openclaw — same fallback as codex.

Returns Some(status) on a definitive read, None when probing isn’t supported for the provider (so the caller skips status updates rather than mis-writing needs_reauth for a provider whose file we just don’t know how to parse yet).

macOS caveat (claude only): the Claude Code CLI stores OAuth credentials in the encrypted macOS Keychain, never in <dir>/.credentials.json — confirmed against Claude Code’s own docs and empirically on a real per-account auth dir on this machine (zero .credentials.json present despite a working session). Unlike Linux and Windows, this is true regardless of CLAUDE_CONFIG_DIR — see docs/retro/retro-macos-keychain-credential-isolation-gap-2026-08-17.md. So on macOS, a missing claude token file is not evidence the account needs reauth — it’s the expected, permanent shape, and reporting NeedsReauth here would be a standing false positive on every working macOS Claude account. None is returned instead (status left alone) — see the None variant’s doc above for why that’s the honest answer when this probe genuinely can’t tell. codex/openclaw are not covered by this carve-out: their macOS credential-storage behavior hasn’t been verified, so their existing file-probe semantics are unchanged.