From e916d5942bfb61534aab09f2668d3f8f0a879ba4 Mon Sep 17 00:00:00 2001
From: Vantz Stockwell <vstockwell@predator-mini.local>
Date: Tue, 17 Mar 2026 12:48:30 -0400
Subject: [PATCH] =?UTF-8?q?feat:=20"Use=20Claude=20Code=20Token"=20button?=
 =?UTF-8?q?=20=E2=80=94=20imports=20credentials.json=20as=20OAuth=20fallba?=
 =?UTF-8?q?ck?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reads %USERPROFILE%\.claude\.credentials.json (or ~/.claude/.credentials.json),
extracts the access and refresh tokens, stores them encrypted in Wraith's vault.
Works when Wraith's own OAuth exchange fails. If Claude Code is authenticated
on the same machine, Wraith piggybacks on the existing token.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .../components/copilot/CopilotSettings.vue    | 23 +++++++-
 internal/ai/oauth.go                          | 53 +++++++++++++++++++
 internal/app/app.go                           |  9 ++++
 3 files changed, 84 insertions(+), 1 deletion(-)

diff --git a/frontend/src/components/copilot/CopilotSettings.vue b/frontend/src/components/copilot/CopilotSettings.vue
index 716465b..d5a50d0 100644
--- a/frontend/src/components/copilot/CopilotSettings.vue
+++ b/frontend/src/components/copilot/CopilotSettings.vue
@@ -27,7 +27,14 @@
             class="w-full px-3 py-2 text-sm font-medium text-white bg-[#1f6feb] hover:bg-[#388bfd] rounded transition-colors cursor-pointer"
             @click="handleLogin"
           >
-            Connect to Claude
+            Connect to Claude (OAuth)
+          </button>
+
+          <button
+            class="w-full mt-2 px-3 py-2 text-sm font-medium text-[#58a6ff] border border-[#30363d] hover:bg-[#1c2128] rounded transition-colors cursor-pointer"
+            @click="handleImportClaudeCode"
+          >
+            Use Claude Code Token
           </button>
 
           <div class="mt-3">
@@ -97,6 +104,7 @@
 
 <script setup lang="ts">
 import { ref, watch } from "vue";
+import { Call } from "@wailsio/runtime";
 import { useCopilotStore } from "@/stores/copilot.store";
 import { useCopilot } from "@/composables/useCopilot";
 
@@ -108,6 +116,8 @@ const emit = defineEmits<{
   (e: "close"): void;
 }>();
 
+const APP = "github.com/vstockwell/wraith/internal/app.WraithApp";
+
 async function handleLogin(): Promise<void> {
   await startLogin();
   // Auth state will be updated when the OAuth callback completes
@@ -116,6 +126,17 @@ async function handleLogin(): Promise<void> {
   emit("close");
 }
 
+async function handleImportClaudeCode(): Promise<void> {
+  try {
+    await Call.ByName(`${APP}.ImportClaudeCodeToken`);
+    store.isAuthenticated = true;
+    alert("Claude Code token imported successfully.");
+    emit("close");
+  } catch (err: any) {
+    alert(`Failed to import token: ${err?.message ?? err}`);
+  }
+}
+
 function handleApiKey(): void {
   if (!apiKey.value.trim()) return;
   // TODO: Wails AIService.SetApiKey(apiKey)
diff --git a/internal/ai/oauth.go b/internal/ai/oauth.go
index ed40153..3e8ef06 100644
--- a/internal/ai/oauth.go
+++ b/internal/ai/oauth.go
@@ -13,6 +13,8 @@ import (
 	"net"
 	"net/http"
 	"net/url"
+	"os"
+	"path/filepath"
 	"strconv"
 	"sync"
 	"time"
@@ -401,6 +403,57 @@ func generateState() (string, error) {
 	return base64.RawURLEncoding.EncodeToString(b), nil
 }
 
+// ImportClaudeCodeToken reads the Claude Code credentials.json file and imports
+// the OAuth tokens. This is the fallback when Wraith's own OAuth flow fails.
+// Path: %USERPROFILE%\.claude\.credentials.json (Windows) or ~/.claude/.credentials.json (macOS/Linux)
+func (o *OAuthManager) ImportClaudeCodeToken() error {
+	home := os.Getenv("USERPROFILE")
+	if home == "" {
+		var err error
+		home, err = os.UserHomeDir()
+		if err != nil {
+			return fmt.Errorf("find home directory: %w", err)
+		}
+	}
+
+	credPath := filepath.Join(home, ".claude", ".credentials.json")
+	data, err := os.ReadFile(credPath)
+	if err != nil {
+		return fmt.Errorf("read credentials.json at %s: %w", credPath, err)
+	}
+
+	var creds struct {
+		ClaudeAiOAuth struct {
+			AccessToken  string `json:"accessToken"`
+			RefreshToken string `json:"refreshToken"`
+			ExpiresAt    int64  `json:"expiresAt"`
+		} `json:"claudeAiOauth"`
+	}
+
+	if err := json.Unmarshal(data, &creds); err != nil {
+		return fmt.Errorf("parse credentials.json: %w", err)
+	}
+
+	if creds.ClaudeAiOAuth.AccessToken == "" {
+		return fmt.Errorf("no access token found in credentials.json")
+	}
+
+	// Convert millisecond timestamp to seconds-based ExpiresIn
+	expiresIn := int((creds.ClaudeAiOAuth.ExpiresAt / 1000) - time.Now().Unix())
+	if expiresIn < 0 {
+		expiresIn = 0
+	}
+
+	tokens := tokenResponse{
+		AccessToken:  creds.ClaudeAiOAuth.AccessToken,
+		RefreshToken: creds.ClaudeAiOAuth.RefreshToken,
+		ExpiresIn:    expiresIn,
+	}
+
+	slog.Info("imported Claude Code token", "expiresInSeconds", expiresIn)
+	return o.storeTokens(tokens)
+}
+
 // SetVault updates the vault reference (called after vault unlock).
 func (o *OAuthManager) SetVault(v *vault.VaultService) {
 	o.mu.Lock()
diff --git a/internal/app/app.go b/internal/app/app.go
index 2b0e4ec..334adb3 100644
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -516,6 +516,15 @@ func (a *WraithApp) DeleteCredential(id int64) error {
 	return a.Credentials.DeleteCredential(id)
 }
 
+// ImportClaudeCodeToken reads the local Claude Code credentials.json and imports
+// the OAuth token into Wraith's vault. Fallback for when Wraith's own OAuth fails.
+func (a *WraithApp) ImportClaudeCodeToken() error {
+	if a.oauthMgr == nil {
+		return fmt.Errorf("OAuth manager not initialized")
+	}
+	return a.oauthMgr.ImportClaudeCodeToken()
+}
+
 // ImportMobaConf parses a MobaXTerm .mobaconf file and imports its contents
 // (groups, connections, host keys) into the database.
 func (a *WraithApp) ImportMobaConf(fileContent string) (*plugin.ImportResult, error) {