krisyotam/proxy

examples/custom-provider/main.go+1−5

 	if dirSetter, ok := tokenStore.(interface{ SetBaseDir(string) }); ok {
 		dirSetter.SetBaseDir(cfg.AuthDir)
 	}
-	store, ok := tokenStore.(coreauth.Store)
+	core := coreauth.NewManager(tokenStore, nil, nil)
-	if !ok {
-		panic("token store does not implement coreauth.Store")
-	}
-	core := coreauth.NewManager(store, nil, nil)
 	core.RegisterExecutor(MyExecutor{})
 	hooks := cliproxy.Hooks{

internal/api/handlers/management/auth_files.go+21−11

 	}
 }
-func (h *Handler) saveTokenRecord(ctx context.Context, record *sdkAuth.TokenRecord) (string, error) {
+func (h *Handler) saveTokenRecord(ctx context.Context, record *coreauth.Auth) (string, error) {
 	if record == nil {
 		return "", fmt.Errorf("token record is nil")
 	}
 		store = sdkAuth.GetTokenStore()
 		h.tokenStore = store
 	}
-	return store.Save(ctx, h.cfg, record)
+	if h.cfg != nil {
+		if dirSetter, ok := store.(interface{ SetBaseDir(string) }); ok {
+			dirSetter.SetBaseDir(h.cfg.AuthDir)
+		}
+	}
+	return store.Save(ctx, record)
 }
 func (h *Handler) RequestAnthropicToken(c *gin.Context) {
 		// Create token storage
 		tokenStorage := anthropicAuth.CreateTokenStorage(bundle)
-		record := &sdkAuth.TokenRecord{
+		record := &coreauth.Auth{
+			ID:       fmt.Sprintf("claude-%s.json", tokenStorage.Email),
 			Provider: "claude",
 			FileName: fmt.Sprintf("claude-%s.json", tokenStorage.Email),
 			Storage:  tokenStorage,
-			Metadata: map[string]string{"email": tokenStorage.Email},
+			Metadata: map[string]any{"email": tokenStorage.Email},
 		}
 		savedPath, errSave := h.saveTokenRecord(ctx, record)
 		if errSave != nil {
 		}
 		fmt.Println("Authentication successful.")
-		record := &sdkAuth.TokenRecord{
+		record := &coreauth.Auth{
+			ID:       fmt.Sprintf("gemini-%s.json", ts.Email),
 			Provider: "gemini",
 			FileName: fmt.Sprintf("gemini-%s.json", ts.Email),
 			Storage:  &ts,
-			Metadata: map[string]string{
+			Metadata: map[string]any{
 				"email":      ts.Email,
 				"project_id": ts.ProjectID,
 			},
 	// Provide a stable label (gemini-web-<hash>) for logging and identification
 	tokenStorage.Label = strings.TrimSuffix(fileName, ".json")
-	record := &sdkAuth.TokenRecord{
+	record := &coreauth.Auth{
+		ID:       fileName,
 		Provider: "gemini-web",
 		FileName: fileName,
 		Storage:  tokenStorage,
 		// Create token storage and persist
 		tokenStorage := openaiAuth.CreateTokenStorage(bundle)
-		record := &sdkAuth.TokenRecord{
+		record := &coreauth.Auth{
+			ID:       fmt.Sprintf("codex-%s.json", tokenStorage.Email),
 			Provider: "codex",
 			FileName: fmt.Sprintf("codex-%s.json", tokenStorage.Email),
 			Storage:  tokenStorage,
-			Metadata: map[string]string{
+			Metadata: map[string]any{
 				"email":      tokenStorage.Email,
 				"account_id": tokenStorage.AccountID,
 			},
 		tokenStorage := qwenAuth.CreateTokenStorage(tokenData)
 		tokenStorage.Email = fmt.Sprintf("qwen-%d", time.Now().UnixMilli())
-		record := &sdkAuth.TokenRecord{
+		record := &coreauth.Auth{
+			ID:       fmt.Sprintf("qwen-%s.json", tokenStorage.Email),
 			Provider: "qwen",
 			FileName: fmt.Sprintf("qwen-%s.json", tokenStorage.Email),
 			Storage:  tokenStorage,
-			Metadata: map[string]string{"email": tokenStorage.Email},
+			Metadata: map[string]any{"email": tokenStorage.Email},
 		}
 		savedPath, errSave := h.saveTokenRecord(ctx, record)
 		if errSave != nil {

internal/api/handlers/management/handler.go+1−1

@@ -33,7 +33,7 @@ type Handler struct { · 32 unmodified lines
33	failedAttempts map[string]*attemptInfo // keyed by client IP	33	failedAttempts map[string]*attemptInfo // keyed by client IP
34	authManager *coreauth.Manager	34	authManager *coreauth.Manager
35	usageStats *usage.RequestStatistics	35	usageStats *usage.RequestStatistics
36	tokenStore sdkAuth.TokenStore	36	tokenStore coreauth.Store
37		37
38	localPassword string	38	localPassword string
39	}	39	}

internal/cmd/gemini-web_auth.go+9−2

 	"github.com/router-for-me/CLIProxyAPI/v6/internal/config"
 	"github.com/router-for-me/CLIProxyAPI/v6/internal/util"
 	sdkAuth "github.com/router-for-me/CLIProxyAPI/v6/sdk/auth"
+	coreauth "github.com/router-for-me/CLIProxyAPI/v6/sdk/cliproxy/auth"
 )
 // banner prints a simple ASCII banner for clarity without ANSI colors.
 		Secure1PSIDTS: secure1psidts,
 		Label:         label,
 	}
-	record := &sdkAuth.TokenRecord{
+	record := &coreauth.Auth{
+		ID:       fileName,
 		Provider: "gemini-web",
 		FileName: fileName,
 		Storage:  tokenStorage,
 	}
 	store := sdkAuth.GetTokenStore()
-	savedPath, err := store.Save(context.Background(), cfg, record)
+	if cfg != nil {
+		if dirSetter, ok := store.(interface{ SetBaseDir(string) }); ok {
+			dirSetter.SetBaseDir(cfg.AuthDir)
+		}
+	}
+	savedPath, err := store.Save(context.Background(), record)
 	if err != nil {
 		fmt.Println("!! Failed to save Gemini Web token to file:", err)
 		return

sdk/auth/claude.go+5−3

 	"github.com/router-for-me/CLIProxyAPI/v6/internal/config"
 	"github.com/router-for-me/CLIProxyAPI/v6/internal/misc"
 	"github.com/router-for-me/CLIProxyAPI/v6/internal/util"
+	coreauth "github.com/router-for-me/CLIProxyAPI/v6/sdk/cliproxy/auth"
 	log "github.com/sirupsen/logrus"
 )
 	return &d
 }
-func (a *ClaudeAuthenticator) Login(ctx context.Context, cfg *config.Config, opts *LoginOptions) (*TokenRecord, error) {
+func (a *ClaudeAuthenticator) Login(ctx context.Context, cfg *config.Config, opts *LoginOptions) (*coreauth.Auth, error) {
 	if cfg == nil {
 		return nil, fmt.Errorf("cliproxy auth: configuration is required")
 	}
 	}
 	fileName := fmt.Sprintf("claude-%s.json", tokenStorage.Email)
-	metadata := map[string]string{
+	metadata := map[string]any{
 		"email": tokenStorage.Email,
 	}
 		fmt.Println("Claude API key obtained and stored")
 	}
-	return &TokenRecord{
+	return &coreauth.Auth{
+		ID:       fileName,
 		Provider: a.Provider(),
 		FileName: fileName,
 		Storage:  tokenStorage,

sdk/auth/codex.go+5−3

 	"github.com/router-for-me/CLIProxyAPI/v6/internal/config"
 	"github.com/router-for-me/CLIProxyAPI/v6/internal/misc"
 	"github.com/router-for-me/CLIProxyAPI/v6/internal/util"
+	coreauth "github.com/router-for-me/CLIProxyAPI/v6/sdk/cliproxy/auth"
 	log "github.com/sirupsen/logrus"
 )
 	return &d
 }
-func (a *CodexAuthenticator) Login(ctx context.Context, cfg *config.Config, opts *LoginOptions) (*TokenRecord, error) {
+func (a *CodexAuthenticator) Login(ctx context.Context, cfg *config.Config, opts *LoginOptions) (*coreauth.Auth, error) {
 	if cfg == nil {
 		return nil, fmt.Errorf("cliproxy auth: configuration is required")
 	}
 	}
 	fileName := fmt.Sprintf("codex-%s.json", tokenStorage.Email)
-	metadata := map[string]string{
+	metadata := map[string]any{
 		"email": tokenStorage.Email,
 	}
 		fmt.Println("Codex API key obtained and stored")
 	}
-	return &TokenRecord{
+	return &coreauth.Auth{
+		ID:       fileName,
 		Provider: a.Provider(),
 		FileName: fileName,
 		Storage:  tokenStorage,

sdk/auth/filestore.go+70−68

@@ -11,7 +11,6 @@ import ( · 10 unmodified lines
11	"sync"	11	"sync"
12	"time"	12	"time"
13		13
14	"github.com/router-for-me/CLIProxyAPI/v6/internal/config"
15	cliproxyauth "github.com/router-for-me/CLIProxyAPI/v6/sdk/cliproxy/auth"	14	cliproxyauth "github.com/router-for-me/CLIProxyAPI/v6/sdk/cliproxy/auth"
16	)	15	)
17		16
@@ -35,27 +34,71 @@ func (s *FileTokenStore) SetBaseDir(dir string) { · 17 unmodified lines
35	s.dirLock.Unlock()	34	s.dirLock.Unlock()
36	}	35	}
37		36
38	// Save writes the token storage to the resolved file path.	37	// Save persists token storage and metadata to the resolved auth file path.
39	func (s FileTokenStore) Save(ctx context.Context, cfg config.Config, record *TokenRecord) (string, error) {	38	func (s FileTokenStore) Save(ctx context.Context, auth cliproxyauth.Auth) (string, error) {
40	if record == nil \|\| record.Storage == nil {	39	if auth == nil {
41	return "", fmt.Errorf("cliproxy auth: token record is incomplete")	40	return "", fmt.Errorf("auth filestore: auth is nil")
42	}	41	}
43	target := strings.TrimSpace(record.FileName)	42
44	if target == "" {	43	path, err := s.resolveAuthPath(auth)
45	return "", fmt.Errorf("cliproxy auth: missing file name for provider %s", record.Provider)	44	if err != nil {
46	}	45	return "", err
47	if !filepath.IsAbs(target) {	46	}
48	baseDir := s.baseDirFromConfig(cfg)	47	if path == "" {
49	if baseDir != "" {	48	return "", fmt.Errorf("auth filestore: missing file path attribute for %s", auth.ID)
50	target = filepath.Join(baseDir, target)	49	}
		50
		51	if auth.Disabled {
		52	if _, statErr := os.Stat(path); os.IsNotExist(statErr) {
		53	return "", nil
51	}	54	}
52	}	55	}
		56
53	s.mu.Lock()	57	s.mu.Lock()
54	defer s.mu.Unlock()	58	defer s.mu.Unlock()
55	if err := record.Storage.SaveTokenToFile(target); err != nil {	59
56	return "", err	60	if err = os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
		61	return "", fmt.Errorf("auth filestore: create dir failed: %w", err)
57	}	62	}
58	return target, nil	63
		64	switch {
		65	case auth.Storage != nil:
		66	if err = auth.Storage.SaveTokenToFile(path); err != nil {
		67	return "", err
		68	}
		69	case auth.Metadata != nil:
		70	raw, errMarshal := json.Marshal(auth.Metadata)
		71	if errMarshal != nil {
		72	return "", fmt.Errorf("auth filestore: marshal metadata failed: %w", errMarshal)
		73	}
		74	if existing, errRead := os.ReadFile(path); errRead == nil {
		75	if jsonEqual(existing, raw) {
		76	return path, nil
		77	}
		78	} else if errRead != nil && !os.IsNotExist(errRead) {
		79	return "", fmt.Errorf("auth filestore: read existing failed: %w", errRead)
		80	}
		81	tmp := path + ".tmp"
		82	if errWrite := os.WriteFile(tmp, raw, 0o600); errWrite != nil {
		83	return "", fmt.Errorf("auth filestore: write temp failed: %w", errWrite)
		84	}
		85	if errRename := os.Rename(tmp, path); errRename != nil {
		86	return "", fmt.Errorf("auth filestore: rename failed: %w", errRename)
		87	}
		88	default:
		89	return "", fmt.Errorf("auth filestore: nothing to persist for %s", auth.ID)
		90	}
		91
		92	if auth.Attributes == nil {
		93	auth.Attributes = make(map[string]string)
		94	}
		95	auth.Attributes["path"] = path
		96
		97	if strings.TrimSpace(auth.FileName) == "" {
		98	auth.FileName = auth.ID
		99	}
		100
		101	return path, nil
59	}	102	}
60		103
61	// List enumerates all auth JSON files under the configured directory.	104	// List enumerates all auth JSON files under the configured directory.
@@ -90,50 +133,6 @@ func (s FileTokenStore) List(ctx context.Context) ([]cliproxyauth.Auth, error) · 28 unmodified lines
90	return entries, nil	133	return entries, nil
91	}	134	}
92		135
93	// SaveAuth writes the auth metadata back to its source file location.
94	func (s FileTokenStore) SaveAuth(ctx context.Context, auth cliproxyauth.Auth) error {
95	if auth == nil {
96	return fmt.Errorf("auth filestore: auth is nil")
97	}
98	path, err := s.resolveAuthPath(auth)
99	if err != nil {
100	return err
101	}
102	if path == "" {
103	return fmt.Errorf("auth filestore: missing file path attribute for %s", auth.ID)
104	}
105	// If the auth has been disabled and the original file was removed, avoid recreating it on disk.
106	if auth.Disabled {
107	if _, statErr := os.Stat(path); statErr != nil {
108	if os.IsNotExist(statErr) {
109	return nil
110	}
111	}
112	}
113	s.mu.Lock()
114	defer s.mu.Unlock()
115	if err = os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
116	return fmt.Errorf("auth filestore: create dir failed: %w", err)
117	}
118	raw, err := json.Marshal(auth.Metadata)
119	if err != nil {
120	return fmt.Errorf("auth filestore: marshal metadata failed: %w", err)
121	}
122	if existing, errRead := os.ReadFile(path); errRead == nil {
123	if jsonEqual(existing, raw) {
124	return nil
125	}
126	}
127	tmp := path + ".tmp"
128	if err = os.WriteFile(tmp, raw, 0o600); err != nil {
129	return fmt.Errorf("auth filestore: write temp failed: %w", err)
130	}
131	if err = os.Rename(tmp, path); err != nil {
132	return fmt.Errorf("auth filestore: rename failed: %w", err)
133	}
134	return nil
135	}
136
137	// Delete removes the auth file.	136	// Delete removes the auth file.
138	func (s *FileTokenStore) Delete(ctx context.Context, id string) error {	137	func (s *FileTokenStore) Delete(ctx context.Context, id string) error {
139	id = strings.TrimSpace(id)	138	id = strings.TrimSpace(id)
@@ -185,6 +184,7 @@ func (s FileTokenStore) readAuthFile(path, baseDir string) (cliproxyauth.Auth, · 45 unmodified lines
185	auth := &cliproxyauth.Auth{	184	auth := &cliproxyauth.Auth{
186	ID: id,	185	ID: id,
187	Provider: provider,	186	Provider: provider,
		187	FileName: id,
188	Label: s.labelFor(metadata),	188	Label: s.labelFor(metadata),
189	Status: cliproxyauth.StatusActive,	189	Status: cliproxyauth.StatusActive,
190	Attributes: map[string]string{"path": path},	190	Attributes: map[string]string{"path": path},
@@ -220,6 +220,15 @@ func (s FileTokenStore) resolveAuthPath(auth cliproxyauth.Auth) (string, error · 29 unmodified lines
220	return p, nil	220	return p, nil
221	}	221	}
222	}	222	}
		223	if fileName := strings.TrimSpace(auth.FileName); fileName != "" {
		224	if filepath.IsAbs(fileName) {
		225	return fileName, nil
		226	}
		227	if dir := s.baseDirSnapshot(); dir != "" {
		228	return filepath.Join(dir, fileName), nil
		229	}
		230	return fileName, nil
		231	}
223	if auth.ID == "" {	232	if auth.ID == "" {
224	return "", fmt.Errorf("auth filestore: missing id")	233	return "", fmt.Errorf("auth filestore: missing id")
225	}	234	}
@@ -249,13 +258,6 @@ func (s *FileTokenStore) labelFor(metadata map[string]any) string { · 23 unmodified lines
249	return ""	258	return ""
250	}	259	}
251		260
252	func (s FileTokenStore) baseDirFromConfig(cfg config.Config) string {
253	if cfg != nil && strings.TrimSpace(cfg.AuthDir) != "" {
254	return strings.TrimSpace(cfg.AuthDir)
255	}
256	return s.baseDirSnapshot()
257	}
258
259	func (s *FileTokenStore) baseDirSnapshot() string {	261	func (s *FileTokenStore) baseDirSnapshot() string {
260	s.dirLock.RLock()	262	s.dirLock.RLock()
261	defer s.dirLock.RUnlock()	263	defer s.dirLock.RUnlock()

sdk/auth/gemini-web.go+2−1

 	"time"
 	"github.com/router-for-me/CLIProxyAPI/v6/internal/config"
+	coreauth "github.com/router-for-me/CLIProxyAPI/v6/sdk/cliproxy/auth"
 )
 // GeminiWebAuthenticator provides a minimal wrapper so core components can treat
 func (a *GeminiWebAuthenticator) Provider() string { return "gemini-web" }
-func (a *GeminiWebAuthenticator) Login(ctx context.Context, cfg *config.Config, opts *LoginOptions) (*TokenRecord, error) {
+func (a *GeminiWebAuthenticator) Login(ctx context.Context, cfg *config.Config, opts *LoginOptions) (*coreauth.Auth, error) {
 	_ = ctx
 	_ = cfg
 	_ = opts

sdk/auth/gemini.go+5−3

 	"github.com/router-for-me/CLIProxyAPI/v6/internal/auth/gemini"
 	// legacy client removed
 	"github.com/router-for-me/CLIProxyAPI/v6/internal/config"
+	coreauth "github.com/router-for-me/CLIProxyAPI/v6/sdk/cliproxy/auth"
 )
 // GeminiAuthenticator implements the login flow for Google Gemini CLI accounts.
 	return nil
 }
-func (a *GeminiAuthenticator) Login(ctx context.Context, cfg *config.Config, opts *LoginOptions) (*TokenRecord, error) {
+func (a *GeminiAuthenticator) Login(ctx context.Context, cfg *config.Config, opts *LoginOptions) (*coreauth.Auth, error) {
 	if cfg == nil {
 		return nil, fmt.Errorf("cliproxy auth: configuration is required")
 	}
 	// Skip onboarding here; rely on upstream configuration
 	fileName := fmt.Sprintf("%s-%s.json", ts.Email, ts.ProjectID)
-	metadata := map[string]string{
+	metadata := map[string]any{
 		"email":      ts.Email,
 		"project_id": ts.ProjectID,
 	}
 	fmt.Println("Gemini authentication successful")
-	return &TokenRecord{
+	return &coreauth.Auth{
+		ID:       fileName,
 		Provider: a.Provider(),
 		FileName: fileName,
 		Storage:  &ts,

sdk/auth/interfaces.go+2−15

 	"errors"
 	"time"
-	baseauth "github.com/router-for-me/CLIProxyAPI/v6/internal/auth"
 	"github.com/router-for-me/CLIProxyAPI/v6/internal/config"
+	coreauth "github.com/router-for-me/CLIProxyAPI/v6/sdk/cliproxy/auth"
 )
 var ErrRefreshNotSupported = errors.New("cliproxy auth: refresh not supported")
 	Prompt    func(prompt string) (string, error)
 }
-// TokenRecord represents credential material produced by an authenticator.
-type TokenRecord struct {
-	Provider string
-	FileName string
-	Storage  baseauth.TokenStorage
-	Metadata map[string]string
-}
-// TokenStore persists token records.
-type TokenStore interface {
-	Save(ctx context.Context, cfg *config.Config, record *TokenRecord) (string, error)
-}
 // Authenticator manages login and optional refresh flows for a provider.
 type Authenticator interface {
 	Provider() string
-	Login(ctx context.Context, cfg *config.Config, opts *LoginOptions) (*TokenRecord, error)
+	Login(ctx context.Context, cfg *config.Config, opts *LoginOptions) (*coreauth.Auth, error)
 	RefreshLead() *time.Duration
 }

sdk/auth/manager.go+13−6

 	"fmt"
 	"github.com/router-for-me/CLIProxyAPI/v6/internal/config"
+	coreauth "github.com/router-for-me/CLIProxyAPI/v6/sdk/cliproxy/auth"
 )
 // Manager aggregates authenticators and coordinates persistence via a token store.
 type Manager struct {
 	authenticators map[string]Authenticator
-	store          TokenStore
+	store          coreauth.Store
 }
 // NewManager constructs a manager with the provided token store and authenticators.
 // If store is nil, the caller must set it later using SetStore.
-func NewManager(store TokenStore, authenticators ...Authenticator) *Manager {
+func NewManager(store coreauth.Store, authenticators ...Authenticator) *Manager {
 	mgr := &Manager{
 		authenticators: make(map[string]Authenticator),
 		store:          store,
 }
 // SetStore updates the token store used for persistence.
-func (m *Manager) SetStore(store TokenStore) {
+func (m *Manager) SetStore(store coreauth.Store) {
 	m.store = store
 }
-// Login executes the provider login flow and persists the resulting token record.
+// Login executes the provider login flow and persists the resulting auth record.
-func (m *Manager) Login(ctx context.Context, provider string, cfg *config.Config, opts *LoginOptions) (*TokenRecord, string, error) {
+func (m *Manager) Login(ctx context.Context, provider string, cfg *config.Config, opts *LoginOptions) (*coreauth.Auth, string, error) {
 	auth, ok := m.authenticators[provider]
 	if !ok {
 		return nil, "", fmt.Errorf("cliproxy auth: authenticator %s not registered", provider)
 		return record, "", nil
 	}
-	savedPath, err := m.store.Save(ctx, cfg, record)
+	if cfg != nil {
+		if dirSetter, ok := m.store.(interface{ SetBaseDir(string) }); ok {
+			dirSetter.SetBaseDir(cfg.AuthDir)
+		}
+	}
+	savedPath, err := m.store.Save(ctx, record)
 	if err != nil {
 		return record, "", err
 	}

sdk/auth/qwen.go+5−3

 	"github.com/router-for-me/CLIProxyAPI/v6/internal/browser"
 	// legacy client removed
 	"github.com/router-for-me/CLIProxyAPI/v6/internal/config"
+	coreauth "github.com/router-for-me/CLIProxyAPI/v6/sdk/cliproxy/auth"
 	log "github.com/sirupsen/logrus"
 )
 	return &d
 }
-func (a *QwenAuthenticator) Login(ctx context.Context, cfg *config.Config, opts *LoginOptions) (*TokenRecord, error) {
+func (a *QwenAuthenticator) Login(ctx context.Context, cfg *config.Config, opts *LoginOptions) (*coreauth.Auth, error) {
 	if cfg == nil {
 		return nil, fmt.Errorf("cliproxy auth: configuration is required")
 	}
 	// no legacy client construction
 	fileName := fmt.Sprintf("qwen-%s.json", tokenStorage.Email)
-	metadata := map[string]string{
+	metadata := map[string]any{
 		"email": tokenStorage.Email,
 	}
 	fmt.Println("Qwen authentication successful")
-	return &TokenRecord{
+	return &coreauth.Auth{
+		ID:       fileName,
 		Provider: a.Provider(),
 		FileName: fileName,
 		Storage:  tokenStorage,

sdk/auth/store_registry.go+14−10

 package auth
-import "sync"
+import (
+	"sync"
+	coreauth "github.com/router-for-me/CLIProxyAPI/v6/sdk/cliproxy/auth"
+)
 var (
-	storeMu              sync.RWMutex
+	storeMu         sync.RWMutex
-	registeredTokenStore TokenStore
+	registeredStore coreauth.Store
 )
 // RegisterTokenStore sets the global token store used by the authentication helpers.
-func RegisterTokenStore(store TokenStore) {
+func RegisterTokenStore(store coreauth.Store) {
 	storeMu.Lock()
-	registeredTokenStore = store
+	registeredStore = store
 	storeMu.Unlock()
 }
 // GetTokenStore returns the globally registered token store.
-func GetTokenStore() TokenStore {
+func GetTokenStore() coreauth.Store {
 	storeMu.RLock()
-	s := registeredTokenStore
+	s := registeredStore
 	storeMu.RUnlock()
 	if s != nil {
 		return s
 	}
 	storeMu.Lock()
 	defer storeMu.Unlock()
-	if registeredTokenStore == nil {
+	if registeredStore == nil {
-		registeredTokenStore = NewFileTokenStore()
+		registeredStore = NewFileTokenStore()
 	}
-	return registeredTokenStore
+	return registeredStore
 }

sdk/cliproxy/auth/manager.go+2−1

@@ -818,7 +818,8 @@ func (m Manager) persist(ctx context.Context, auth Auth) error { · 817 unmodified lines
818	if auth.Metadata == nil {	818	if auth.Metadata == nil {
819	return nil	819	return nil
820	}	820	}
821	return m.store.SaveAuth(ctx, auth)	821	_, err := m.store.Save(ctx, auth)
		822	return err
822	}	823	}
823		824
824	// StartAutoRefresh launches a background loop that evaluates auth freshness	825	// StartAutoRefresh launches a background loop that evaluates auth freshness

sdk/cliproxy/auth/store.go+2−2

@@ -6,8 +6,8 @@ import "context" · 5 unmodified lines
6	type Store interface {	6	type Store interface {
7	// List returns all auth records stored in the backend.	7	// List returns all auth records stored in the backend.
8	List(ctx context.Context) ([]*Auth, error)	8	List(ctx context.Context) ([]*Auth, error)
9	// SaveAuth persists the provided auth record, replacing any existing one with same ID.	9	// Save persists the provided auth record, replacing any existing one with same ID.
10	SaveAuth(ctx context.Context, auth *Auth) error	10	Save(ctx context.Context, auth *Auth) (string, error)
11	// Delete removes the auth record identified by id.	11	// Delete removes the auth record identified by id.
12	Delete(ctx context.Context, id string) error	12	Delete(ctx context.Context, id string) error
13	}	13	}

sdk/cliproxy/auth/types.go+6−0

 	"strings"
 	"sync"
 	"time"
+	baseauth "github.com/router-for-me/CLIProxyAPI/v6/internal/auth"
 )
 // Auth encapsulates the runtime state and metadata associated with a single credential.
 	ID string `json:"id"`
 	// Provider is the upstream provider key (e.g. "gemini", "claude").
 	Provider string `json:"provider"`
+	// FileName stores the relative or absolute path of the backing auth file.
+	FileName string `json:"-"`
+	// Storage holds the token persistence implementation used during login flows.
+	Storage baseauth.TokenStorage `json:"-"`
 	// Label is an optional human readable label for logging.
 	Label string `json:"label,omitempty"`
 	// Status is the lifecycle status managed by the AuthManager.

sdk/cliproxy/builder.go+1−5

 		if dirSetter, ok := tokenStore.(interface{ SetBaseDir(string) }); ok && b.cfg != nil {
 			dirSetter.SetBaseDir(b.cfg.AuthDir)
 		}
-		store, ok := tokenStore.(coreauth.Store)
+		coreManager = coreauth.NewManager(tokenStore, nil, nil)
-		if !ok {
-			return nil, fmt.Errorf("cliproxy: token store does not implement coreauth.Store")
-		}
-		coreManager = coreauth.NewManager(store, nil, nil)
 	}
 	// Attach a default RoundTripper provider so providers can opt-in per-auth transports.
 	coreManager.SetRoundTripperProvider(newDefaultRoundTripperProvider())