refactor: reorganize util modules and return token source

Split src/util.ts into focused modules: src/util/uri.ts (toSafeHost,
removeTrailingSlashes, resolveUiUrl, openInBrowser) and
src/util/authority.ts (Remote SSH authority helpers), replacing
src/uri/utils.ts. Migrate all importers and mirror the unit tests.

Make CliCredentialManager.readToken return the token together with its
source ("keyring" | "files") so LoginCoordinator labels the login
method from the actual source instead of re-deriving it from whether
keyring is enabled.

Author: EhabY

src/api/authInterceptor.ts

@@ -2,7 +2,7 @@ import { type AxiosError, isAxiosError } from "axios";
 
 import { AuthTelemetry } from "../instrumentation/auth";
 import { OAuthError } from "../oauth/errors";
-import { toSafeHost } from "../util";
+import { toSafeHost } from "../util/uri";
 
 import type * as vscode from "vscode";
 

src/commands.ts

@@ -46,7 +46,8 @@ import {
 import { resolveCliAuth } from "./settings/cli";
 import { appendVsCodeLogs } from "./supportBundle/appendVsCodeLogs";
 import { runExportTelemetryCommand } from "./telemetry/export/command";
-import { openInBrowser, toRemoteAuthority, toSafeHost } from "./util";
+import { toRemoteAuthority } from "./util/authority";
+import { openInBrowser, toSafeHost } from "./util/uri";
 import { vscodeProposed } from "./vscodeProposed";
 import { parseSpeedtestResult } from "./webviews/speedtest/types";
 import {

src/core/cliCredentialManager.ts

@@ -15,8 +15,8 @@ import {
 import { isKeyringEnabled } from "../settings/cli";
 import { getHeaderArgs } from "../settings/headers";
 import { type TelemetryReporter } from "../telemetry/reporter";
-import { removeTrailingSlashes, toSafeHost } from "../uri/utils";
 import { writeAtomically } from "../util/fs";
+import { removeTrailingSlashes, toSafeHost } from "../util/uri";
 
 import { version } from "./cliExec";
 
@@ -35,6 +35,11 @@ type TokenReadSource =
 	| { mode: "keyring"; binPath: string }
 	| { mode: "none" };
 
+export interface CliCredential {
+	token: string;
+	source: "keyring" | "files";
+}
+
 const EXEC_TIMEOUT_MS = 60_000;
 const EXEC_LOG_INTERVAL_MS = 5_000;
 
@@ -128,22 +133,30 @@ export class CliCredentialManager {
 	/**
 	 * Read a token from CLI-managed credentials. Uses `coder login token --url`
 	 * when keyring auth is active, otherwise reads the file credentials under
-	 * --global-config. Returns undefined on any failure (resolver, CLI, empty
-	 * output). Throws AbortError when the signal is aborted.
+	 * --global-config. Returns the token and the source it came from, or
+	 * undefined on any failure (resolver, CLI, empty output). Throws AbortError
+	 * when the signal is aborted.
 	 */
 	public async readToken(
 		url: string,
 		configs: Pick<WorkspaceConfiguration, "get">,
 		options?: { signal?: AbortSignal },
-	): Promise<string | undefined> {
+	): Promise<CliCredential | undefined> {
 		const source = await this.resolveTokenReadSource(url, configs);
 		if (source.mode === "files") {
-			return this.readCredentialFiles(url);
+			const token = await this.readCredentialFiles(url);
+			return token ? { token, source: "files" } : undefined;
 		}
 		if (source.mode === "none") {
 			return undefined;
 		}
-		return this.readKeyringToken(source.binPath, url, configs, options);
+		const token = await this.readKeyringToken(
+			source.binPath,
+			url,
+			configs,
+			options,
+		);
+		return token ? { token, source: "keyring" } : undefined;
 	}
 
 	private async readKeyringToken(
@@ -284,7 +297,7 @@ export class CliCredentialManager {
 	private async readCredentialFiles(url: string): Promise<string | undefined> {
 		try {
 			const files = await this.readCredentialFilePair(url);
-			return sameCredentialUrl(files.url, url)
+			return sameNormalizedUrl(files.url, url)
 				? nonEmpty(files.token)
 				: undefined;
 		} catch (error) {
@@ -376,11 +389,11 @@ export class CliCredentialManager {
 	}
 }
 
-function sameCredentialUrl(storedUrl: string, expectedUrl: string): boolean {
-	return cleanCredentialUrl(storedUrl) === cleanCredentialUrl(expectedUrl);
+function sameNormalizedUrl(storedUrl: string, expectedUrl: string): boolean {
+	return normalizeUrl(storedUrl) === normalizeUrl(expectedUrl);
 }
 
-function cleanCredentialUrl(url: string): string {
+function normalizeUrl(url: string): string {
 	return removeTrailingSlashes(url.trim());
 }
 

src/core/cliManager.ts

@@ -23,8 +23,8 @@ import {
 import * as pgp from "../pgp";
 import { withCancellableProgress, withOptionalProgress } from "../progress";
 import { isKeyringEnabled } from "../settings/cli";
-import { toSafeHost } from "../util";
 import { tempFilePath } from "../util/fs";
+import { toSafeHost } from "../util/uri";
 import { vscodeProposed } from "../vscodeProposed";
 
 import { BinaryLock } from "./binaryLock";

src/core/secretsManager.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 
 import { DeploymentSchema, type Deployment } from "../deployment/types";
-import { toSafeHost } from "../util";
+import { toSafeHost } from "../util/uri";
 
 import type { OAuth2ClientRegistrationResponse } from "coder/site/src/api/typesGenerated";
 import type { Memento, SecretStorage, Disposable } from "vscode";

src/login/loginCoordinator.ts

@@ -10,7 +10,7 @@ import { buildOAuthTokenData } from "../oauth/utils";
 import { withOptionalProgress } from "../progress";
 import { maybeAskAuthMethod, maybeAskUrl } from "../promptUtils";
 import { isKeyringEnabled } from "../settings/cli";
-import { openInBrowser } from "../util";
+import { openInBrowser } from "../util/uri";
 import { vscodeProposed } from "../vscodeProposed";
 
 import type { User } from "coder/site/src/api/typesGenerated";
@@ -330,23 +330,23 @@ export class LoginCoordinator implements vscode.Disposable {
 				cancellable: true,
 			},
 		);
-		const cliCredentialToken = cliCredentialResult.ok
+		const cliCredential = cliCredentialResult.ok
 			? cliCredentialResult.value
 			: undefined;
 		if (
-			cliCredentialToken &&
-			cliCredentialToken !== providedToken &&
-			cliCredentialToken !== auth?.token
+			cliCredential &&
+			cliCredential.token !== providedToken &&
+			cliCredential.token !== auth?.token
 		) {
 			this.logger.debug("Trying token from CLI credentials");
 			const result = await this.tryTokenAuth(
 				client,
-				cliCredentialToken,
+				cliCredential.token,
 				isAutoLogin,
 			);
 			if (result !== "unauthorized") {
 				return withLoginMethod(
-					keyringEnabled ? "keyring_token" : "cli_token",
+					cliCredential.source === "keyring" ? "keyring_token" : "cli_token",
 					result,
 				);
 			}

src/oauth/authorizer.ts

@@ -1,7 +1,7 @@
 import * as vscode from "vscode";
 
 import { CoderApi } from "../api/coderApi";
-import { resolveUiUrl } from "../util";
+import { resolveUiUrl } from "../util/uri";
 
 import {
 	AUTH_GRANT_TYPE,

src/remote/remote.ts

@@ -51,13 +51,12 @@ import {
 	resolveCliAuth,
 } from "../settings/cli";
 import { getHeaderCommand } from "../settings/headers";
+import { escapeCommandArg, expandPath } from "../util";
 import {
 	AuthorityPrefix,
 	type AuthorityParts,
-	escapeCommandArg,
-	expandPath,
 	parseRemoteAuthority,
-} from "../util";
+} from "../util/authority";
 import { vscodeProposed } from "../vscodeProposed";
 import { WorkspaceMonitor } from "../workspace/workspaceMonitor";
 

src/remote/workspaceStateMachine.ts

@@ -37,7 +37,7 @@ import type { StartupMode } from "../core/mementoManager";
 import type { FeatureSet } from "../featureSet";
 import type { Logger } from "../logging/logger";
 import type { CliAuth } from "../settings/cli";
-import type { AuthorityParts } from "../util";
+import type { AuthorityParts } from "../util/authority";
 
 /**
  * Manages workspace and agent state transitions until ready for SSH connection.

src/uri/uriHandler.ts

@@ -4,10 +4,9 @@ import { errToStr } from "../api/api-helper";
 import { AuthTelemetry } from "../instrumentation/auth";
 import { CALLBACK_PATH } from "../oauth/utils";
 import { maybeAskUrl } from "../promptUtils";
+import { toSafeHost } from "../util/uri";
 import { vscodeProposed } from "../vscodeProposed";
 
-import { toSafeHost } from "./utils";
-
 import type { Commands } from "../commands";
 import type { ServiceContainer } from "../core/container";
 import type { DeploymentManager } from "../deployment/deploymentManager";