Cache OAuth token in app-owned Keychain

[dmelo]

Summary

• Cache the extracted OAuth access token in a ClaudeCodeStats-credentials Keychain item owned by the app, avoiding repeated macOS authorization prompts from reading Claude Code's Keychain item
• Add in-memory token cache to skip all I/O on subsequent polls within the same session
• Invalidate both caches on 401/403 so the next fetch re-reads from the source

Test plan

• Build and install locally
• Verify first launch reads from Claude Code's Keychain (one-time prompt) and caches to app Keychain
• Verify subsequent polls use cached token with no prompt
• Verify 401/403 clears cache and re-prompts on next fetch

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR reduces repeated macOS Keychain authorization prompts by caching Claude Code’s OAuth access token in an app-owned Keychain item and also caching it in-memory for the current session, with cache invalidation on 401/403 responses.

Changes:

• Add an in-memory access token cache to avoid repeated file/Keychain reads during a session.
• Add an app-owned Keychain item (ClaudeCodeStats-credentials) to persist the token and avoid repeatedly reading Claude Code’s Keychain item.
• Clear both the in-memory and app Keychain caches when the API returns 401/403.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

ClaudeCodeStats/ClaudeCodeStats/Services/OAuthUsageService.swift:22

• @MainActor on the whole service forces all synchronous file/keychain I/O in readAccessToken() (and any hasCredentials evaluation) to run on the main actor. FileManager.default.contents(atPath:) and SecItemCopyMatching can block, which may cause UI hitching during SwiftUI body evaluation or refresh. Consider removing the class-level @MainActor (or narrowing actor isolation) and performing the keychain/file reads off the main thread while keeping only UI-facing state updates on the main actor.

@MainActor
class OAuthUsageService {
    static let shared = OAuthUsageService()

    private let apiURL = "https://api.anthropic.com/v1/messages"
    private let credentialsPath: String = {
        let home = FileManager.default.homeDirectoryForCurrentUser.path
        return "\(home)/.claude/.credentials.json"
    }()
    private let keychainService = "Claude Code-credentials"
    private let appKeychainService = "ClaudeCodeStats-credentials"
    private let appKeychainAccount = "oauth-token"
    private var cachedToken: String?

    private init() {}

    var hasCredentials: Bool {
        readAccessToken() != nil
    }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.