allow-keychain.sh

#!/bin/bash
# Get the limit gauges a credential, then PROVE it works (macOS).
#
# 1. If the Claude Code CLI Keychain item exists, trigger the one-time access
#    dialog: click "Always Allow" and every later read is silent.
# 2. Otherwise (Claude Code desktop app keeps its login inside the app) mint a
#    long-lived token with `claude setup-token` and store it in your login
#    Keychain under "SlashCogs-limits-token".
# 3. Always finish with an end-to-end test: read the credential back the same
#    way the board does and query Anthropic's usage endpoint for real numbers.
#
# No token value is ever printed by this script.

cd "$(dirname "$0")" || exit 1

if [ "$(uname)" != "Darwin" ]; then
  echo "This is only needed on macOS. On Linux the board reads ~/.claude/.credentials.json directly."
  exit 0
fi

run_test() {
  echo ""
  echo "Testing end to end (credential read + usage endpoint)..."
  if ! command -v node >/dev/null 2>&1; then
    echo "⚠ node is not on PATH so the test cannot run. Start the board to see the result."
    exit 0
  fi
  if node menubar/limits-cli.js --test; then
    echo "✓ Verified. The gauges go live within 2 min, or restart the board / refresh the menu bar."
    exit 0
  fi
  echo "✗ A credential exists but the limits lookup failed. See the FAIL line above,"
  echo "  and paste it back to Claude to debug."
  exit 1
}

echo "Step 1: checking for the Claude Code CLI Keychain item (click 'Always Allow' if macOS asks)..."
if security find-generic-password -s "Claude Code-credentials" -w >/dev/null 2>&1; then
  echo "✓ CLI Keychain item readable."
  run_test
fi
echo "  Not found. This Mac's Claude Code likely runs inside the desktop app, which keeps its login internal."

if security find-generic-password -s "SlashCogs-limits-token" -w >/dev/null 2>&1; then
  echo "✓ A SlashCogs token is already stored."
  echo "  (If the test below fails with an auth error, the token may be revoked. Delete it and re-run:"
  echo "   security delete-generic-password -s SlashCogs-limits-token)"
  run_test
fi

if ! command -v claude >/dev/null 2>&1; then
  echo "✗ The 'claude' CLI is not on PATH, so a token cannot be minted here."
  echo "  Install the Claude Code CLI, or set CLAUDE_CODE_OAUTH_TOKEN before starting the board."
  exit 1
fi

echo "Step 2: minting a long-lived token with 'claude setup-token'."
echo "  A browser window will open; approve the request, then come back here."
OUT="$(claude setup-token 2>&1)"
TOKEN="$(printf '%s' "$OUT" | grep -oE 'sk-ant-[A-Za-z0-9_-]+' | head -1)"

if [ -z "$TOKEN" ]; then
  echo "✗ 'claude setup-token' did not produce a token. Its output ended with:"
  printf '%s\n' "$OUT" | grep -v 'sk-ant-' | tail -5
  exit 1
fi

if ! security add-generic-password -U -s "SlashCogs-limits-token" -a "$USER" -w "$TOKEN"; then
  echo "✗ Could not store the token in the Keychain."
  exit 1
fi

echo "✓ Token stored in your login Keychain (service: SlashCogs-limits-token)."
echo "  Remove it anytime with: security delete-generic-password -s SlashCogs-limits-token"
run_test