refactor(config): remove claude_credentials, add default credential path

internal/config/config.go

@@ -13,7 +13,6 @@ import (
 type Config struct {
 	Port         int            `yaml:"port"`
 	APIKeys      []string       `yaml:"api_keys"`
-	ClaudeCredentials string         `yaml:"claude_credentials"`
 	ClaudeBinary string         `yaml:"claude_binary"`
 	Sanitize     SanitizeConfig `yaml:"sanitize"`
 }
@@ -54,25 +53,38 @@ func Load(path string) (*Config, error) {
 		return nil, fmt.Errorf("parse config: %w", err)
 	}
 
+	// Check for deprecated claude_credentials field
+	var rawCfg map[string]interface{}
+	if err := yaml.Unmarshal(data, &rawCfg); err == nil {
+		if _, exists := rawCfg["claude_credentials"]; exists {
+			if val, ok := rawCfg["claude_credentials"].(string); ok && val != "" {
+				return nil, fmt.Errorf("claude_credentials is no longer supported, remove it from config.yaml — the proxy now manages credentials at ~/.claude/.credentials.json")
+			}
+		}
+	}
+
 	return cfg, nil
 }
 
-func LoadCredentials(cfg *Config) ([]*auth.Credential, error) {
+func DefaultCredentialPath() string {
-	if cfg.ClaudeCredentials == "" {
+	home, err := os.UserHomeDir()
-		return nil, fmt.Errorf("claude_credentials not set")
-	}
-
-	cred, err := loadCredentials(cfg.ClaudeCredentials)
 	if err != nil {
-		return nil, err
+		return ""
+	}
+	return home + "/.claude/.credentials.json"
 }
 
-	return []*auth.Credential{cred}, nil
+func LoadDefaultCredentials() ([]*auth.Credential, error) {
+	path := DefaultCredentialPath()
+	if path == "" {
+		return nil, nil
 	}
 
-func loadCredentials(path string) (*auth.Credential, error) {
 	data, err := os.ReadFile(path)
 	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
 		return nil, err
 	}
 
@@ -86,12 +98,14 @@ func loadCredentials(path string) (*auth.Credential, error) {
 		return nil, fmt.Errorf("no access token in %s", path)
 	}
 
-	return &auth.Credential{
+	cred := &auth.Credential{
 		ID:           "claude-native",
 		Email:        oauth.SubscriptionType,
 		AccessToken:  oauth.AccessToken,
 		RefreshToken: oauth.RefreshToken,
 		ExpiresAt:    time.UnixMilli(oauth.ExpiresAt),
 		FilePath:     path,
-	}, nil
+	}
+
+	return []*auth.Credential{cred}, nil
 }