@cortexkit/anthropic-auth-core 1.0.0 → 1.1.1

package/README.md

@@ -1,6 +1,6 @@
 # @cortexkit/anthropic-auth-core
 
-Shared Anthropic OAuth, quota, cache, relay, dump, and request-signing helpers used by CortexKit's OpenCode and Pi integrations.
+Shared Anthropic OAuth, quota, cache, fast mode, relay, dump, and request-signing helpers used by CortexKit's OpenCode and Pi integrations.
 
 User-facing packages:
 

package/dist/accounts.d.ts

@@ -20,6 +20,9 @@ export type OAuthAccount = {
 export type AccountOperationError = {
     message: string;
     checkedAt: number;
+    nextRetryAt?: number;
+    retryCount?: number;
+    tokenHash?: string;
 };
 export type AccountQuotaWindow = {
     usedPercent: number;
@@ -38,6 +41,10 @@ export type AccountStorage = {
         enabled?: boolean;
         intervalMinutes?: number;
         refreshBeforeExpiryMinutes?: number;
+        mainLastRefreshError?: AccountOperationError;
+        mainRefreshLeaseId?: string;
+        mainRefreshLeaseUntil?: number;
+        mainRefreshLeaseTokenHash?: string;
     };
     quota?: {
         enabled?: boolean;
@@ -52,6 +59,9 @@ export type AccountStorage = {
     dump?: {
         enabled?: boolean;
     };
+    claudeFast?: {
+        enabled?: boolean;
+    };
     relay?: {
         enabled?: boolean;
         url?: string;
@@ -80,7 +90,19 @@ export declare function setCache1hPersistentEnabled(enabled: boolean, mode?: Cac
 export declare function setCache1hPersistentMode(mode: Cache1hMode, path?: string): Promise<AccountStorage>;
 export declare function isDumpPersistentlyEnabled(storage: AccountStorage | null): boolean;
 export declare function setDumpPersistentEnabled(enabled: boolean, path?: string): Promise<AccountStorage>;
+export declare function isFastModePersistentlyEnabled(storage: AccountStorage | null): boolean;
+export declare function setFastModePersistentEnabled(enabled: boolean, path?: string): Promise<AccountStorage>;
 export declare function shouldFallbackStatus(status: number, storage: AccountStorage | null): boolean;
+export declare function getRefreshIntervalMs(storage: AccountStorage | null): number;
+export declare function hashRefreshToken(refreshToken: string): string;
+export declare function buildRefreshOperationError(input: {
+    error: unknown;
+    now: number;
+    refreshToken: string;
+    previous?: AccountOperationError;
+}): AccountOperationError;
+export declare function refreshBackoffActive(error: AccountOperationError | undefined, refreshToken: string | undefined, now: number): boolean;
+export declare function formatRefreshBackoffMessage(error: AccountOperationError, now: number): string;
 export declare function getQuotaCheckIntervalMs(storage: AccountStorage | null): number;
 export declare function quotaSnapshotPassesPolicy(quota: OAuthQuotaSnapshot | undefined, storage: AccountStorage | null): boolean;
 export declare function getQuotaNextRefreshAt(quota: OAuthQuotaSnapshot | undefined, storage: AccountStorage | null, now: number): number;

package/dist/accounts.js

@@ -1,12 +1,17 @@
-import { randomUUID } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { CACHE_1H_MODES, CLAUDE_CODE_VERSION, CLIENT_ID, DEFAULT_CACHE_1H_MODE, TOKEN_URL, } from "./constants.js";
+import { ClaudeOAuthRefreshError, refreshClaudeOAuthToken } from "./auth.js";
+import { CACHE_1H_MODES, CLAUDE_CODE_VERSION, DEFAULT_CACHE_1H_MODE, } from "./constants.js";
 export const ACCOUNT_FILE_NAME = 'anthropic-auth.json';
 export const QUOTA_URL = 'https://api.anthropic.com/api/oauth/usage';
 const DEFAULT_FALLBACK_ON = [401, 403, 429];
 const DEFAULT_REFRESH_BEFORE_EXPIRY_MINUTES = 30;
+const DEFAULT_REFRESH_INTERVAL_MINUTES = 10;
+const MIN_REFRESH_RETRY_DELAY_MS = 5 * 60_000;
+const MAX_REFRESH_RETRY_DELAY_MS = 60 * 60_000;
+const NON_TRANSIENT_REFRESH_RETRY_DELAY_MS = 24 * 60 * 60_000;
 const DEFAULT_QUOTA_CHECK_INTERVAL_MINUTES = 5;
 const DEFAULT_MINIMUM_REMAINING = {
     five_hour: 0,
@@ -62,7 +67,15 @@ function normalizeOperationError(value) {
     const checkedAt = Number(value.checkedAt);
     if (!Number.isFinite(checkedAt))
         return undefined;
-    return { message: value.message, checkedAt };
+    const nextRetryAt = Number(value.nextRetryAt);
+    const retryCount = Number(value.retryCount);
+    return {
+        message: value.message,
+        checkedAt,
+        nextRetryAt: Number.isFinite(nextRetryAt) ? nextRetryAt : undefined,
+        retryCount: Number.isFinite(retryCount) ? retryCount : undefined,
+        tokenHash: typeof value.tokenHash === 'string' ? value.tokenHash : undefined,
+    };
 }
 function normalizeQuota(value) {
     if (!isRecord(value))
@@ -102,6 +115,7 @@ function normalizeStorage(value) {
         quota: isRecord(value.quota) ? value.quota : undefined,
         claudeCache: isRecord(value.claudeCache) ? value.claudeCache : undefined,
         dump: isRecord(value.dump) ? value.dump : undefined,
+        claudeFast: isRecord(value.claudeFast) ? value.claudeFast : undefined,
         relay: isRecord(value.relay) ? value.relay : undefined,
         accounts: value.accounts
             .map(normalizeAccount)
@@ -199,6 +213,22 @@ export async function setDumpPersistentEnabled(enabled, path = getAccountStorage
     await saveAccounts(storage, path);
     return storage;
 }
+export function isFastModePersistentlyEnabled(storage) {
+    return storage?.claudeFast?.enabled === true;
+}
+export async function setFastModePersistentEnabled(enabled, path = getAccountStoragePath()) {
+    const storage = (await loadAccounts(path)) ?? {
+        version: 1,
+        main: { type: 'opencode', provider: 'anthropic' },
+        accounts: [],
+    };
+    storage.claudeFast = {
+        ...(storage.claudeFast ?? {}),
+        enabled,
+    };
+    await saveAccounts(storage, path);
+    return storage;
+}
 function getFallbackStatuses(storage) {
     return storage?.fallbackOn?.length ? storage.fallbackOn : DEFAULT_FALLBACK_ON;
 }
@@ -227,6 +257,50 @@ function refreshBeforeExpiryMs(storage) {
         DEFAULT_REFRESH_BEFORE_EXPIRY_MINUTES;
     return Math.max(0, minutes) * 60_000;
 }
+export function getRefreshIntervalMs(storage) {
+    const minutes = storage?.refresh?.intervalMinutes ?? DEFAULT_REFRESH_INTERVAL_MINUTES;
+    return Math.max(1, minutes) * 60_000;
+}
+export function hashRefreshToken(refreshToken) {
+    return createHash('sha256').update(refreshToken).digest('hex');
+}
+function isTransientRefreshError(error) {
+    if (error instanceof ClaudeOAuthRefreshError) {
+        return error.status === 429 || error.status >= 500;
+    }
+    if (!(error instanceof Error))
+        return false;
+    return (error.message.includes('fetch failed') ||
+        ('code' in error &&
+            (error.code === 'ECONNRESET' ||
+                error.code === 'ECONNREFUSED' ||
+                error.code === 'ETIMEDOUT' ||
+                error.code === 'UND_ERR_CONNECT_TIMEOUT')));
+}
+export function buildRefreshOperationError(input) {
+    const retryCount = (input.previous?.retryCount ?? 0) + 1;
+    const delay = isTransientRefreshError(input.error)
+        ? Math.min(MAX_REFRESH_RETRY_DELAY_MS, MIN_REFRESH_RETRY_DELAY_MS * 2 ** Math.min(retryCount - 1, 6))
+        : NON_TRANSIENT_REFRESH_RETRY_DELAY_MS;
+    return {
+        message: formatErrorMessage(input.error),
+        checkedAt: input.now,
+        nextRetryAt: input.now + delay,
+        retryCount,
+        tokenHash: hashRefreshToken(input.refreshToken),
+    };
+}
+export function refreshBackoffActive(error, refreshToken, now) {
+    if (!error?.nextRetryAt || error.nextRetryAt <= now)
+        return false;
+    if (!refreshToken)
+        return true;
+    return error.tokenHash === hashRefreshToken(refreshToken);
+}
+export function formatRefreshBackoffMessage(error, now) {
+    const seconds = Math.max(1, Math.ceil(((error.nextRetryAt ?? now) - now) / 1000));
+    return `Claude OAuth refresh is backed off for ${seconds}s after: ${error.message}`;
+}
 export function getQuotaCheckIntervalMs(storage) {
     const minutes = storage?.quota?.checkIntervalMinutes ?? DEFAULT_QUOTA_CHECK_INTERVAL_MINUTES;
     return Math.max(1, minutes) * 60_000;
@@ -335,16 +409,21 @@ function formatErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
 function recordRefreshError(account, error, now) {
-    account.lastRefreshError = {
-        message: formatErrorMessage(error),
-        checkedAt: now,
-    };
+    account.lastRefreshError = buildRefreshOperationError({
+        error,
+        now,
+        refreshToken: account.refresh,
+        previous: account.lastRefreshError,
+    });
 }
 function recordQuotaRefreshError(account, error, now) {
     account.lastQuotaRefreshError = {
         message: formatErrorMessage(error),
         checkedAt: now,
     };
+    if (error instanceof ClaudeOAuthRefreshError) {
+        recordRefreshError(account, error, now);
+    }
 }
 export class FallbackAccountManager {
     now;
@@ -365,22 +444,18 @@ export class FallbackAccountManager {
         await saveAccounts(storage, this.configPath);
     }
     startBackgroundRefresh() {
-        void this.refreshDueAccounts().catch(() => { });
-        void this.refreshQuotaForDueAccounts().catch(() => { });
+        const run = async () => {
+            await this.refreshDueAccounts();
+            await this.refreshQuotaForDueAccounts();
+        };
+        void run().catch(() => { });
         if (!this.refreshTimer) {
             this.refreshTimer = setInterval(() => {
-                void this.refreshDueAccounts().catch(() => { });
+                void run().catch(() => { });
             }, BACKGROUND_TICK_MS);
             if ('unref' in this.refreshTimer)
                 this.refreshTimer.unref();
         }
-        if (!this.quotaTimer) {
-            this.quotaTimer = setInterval(() => {
-                void this.refreshQuotaForDueAccounts().catch(() => { });
-            }, BACKGROUND_TICK_MS);
-            if ('unref' in this.quotaTimer)
-                this.quotaTimer.unref();
-        }
     }
     stopBackgroundRefresh() {
         if (this.refreshTimer)
@@ -402,6 +477,11 @@ export class FallbackAccountManager {
             try {
                 let next = account;
                 if (tokenNeedsRefresh(next, storage, this.now())) {
+                    const refreshError = next.lastRefreshError;
+                    if (refreshError &&
+                        refreshBackoffActive(refreshError, next.refresh, this.now())) {
+                        throw new Error(formatRefreshBackoffMessage(refreshError, this.now()));
+                    }
                     next = await this.refreshAccount(next, storage);
                     changed = true;
                 }
@@ -444,6 +524,9 @@ export class FallbackAccountManager {
                 continue;
             if (!tokenNeedsRefresh(account, storage, this.now()))
                 continue;
+            if (refreshBackoffActive(account.lastRefreshError, account.refresh, this.now())) {
+                continue;
+            }
             try {
                 await this.refreshAccount(account, storage);
                 changed = true;
@@ -469,6 +552,9 @@ export class FallbackAccountManager {
             let next = account;
             try {
                 if (tokenNeedsRefresh(next, storage, this.now())) {
+                    if (refreshBackoffActive(next.lastRefreshError, next.refresh, this.now())) {
+                        continue;
+                    }
                     next = await this.refreshAccount(next, storage);
                     changed = true;
                 }
@@ -499,6 +585,11 @@ export class FallbackAccountManager {
             let next = account;
             try {
                 if (tokenNeedsRefresh(next, storage, this.now())) {
+                    const refreshError = next.lastRefreshError;
+                    if (refreshError &&
+                        refreshBackoffActive(refreshError, next.refresh, this.now())) {
+                        throw new Error(formatRefreshBackoffMessage(refreshError, this.now()));
+                    }
                     next = await this.refreshAccount(next, storage);
                     changed = true;
                 }
@@ -545,29 +636,16 @@ export class FallbackAccountManager {
         }
         const sourceAccount = latestAccount ?? account;
         const refreshToken = sourceAccount.refresh;
-        const response = await this.fetchImpl(TOKEN_URL, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                Accept: 'application/json, text/plain, */*',
-                'User-Agent': 'axios/1.13.6',
-            },
-            body: JSON.stringify({
-                grant_type: 'refresh_token',
-                refresh_token: refreshToken,
-                client_id: CLIENT_ID,
-            }),
+        const refreshed = await refreshClaudeOAuthToken({
+            refreshToken,
+            fetchImpl: this.fetchImpl,
+            now: this.now,
         });
-        if (!response.ok) {
-            const body = await response.text().catch(() => '');
-            throw new Error(`Fallback token refresh failed: ${response.status} — ${body}`);
-        }
-        const json = (await response.json());
-        const refreshedAt = this.now();
-        sourceAccount.access = json.access_token;
-        sourceAccount.refresh = json.refresh_token ?? refreshToken;
-        sourceAccount.expires = refreshedAt + json.expires_in * 1000;
-        sourceAccount.lastRefreshedAt = refreshedAt;
+        sourceAccount.access = refreshed.access;
+        sourceAccount.refresh = refreshed.refresh;
+        sourceAccount.expires = refreshed.expires;
+        sourceAccount.lastRefreshedAt =
+            refreshed.expires - refreshed.expiresIn * 1000;
         sourceAccount.lastRefreshError = undefined;
         updateStoredAccount(storage, sourceAccount);
         return sourceAccount;

package/dist/auth.d.ts

@@ -1,3 +1,19 @@
+export declare class ClaudeOAuthRefreshError extends Error {
+    readonly status: number;
+    readonly body: string;
+    constructor(status: number, body: string);
+}
+export type ClaudeOAuthRefreshResult = {
+    access: string;
+    refresh: string;
+    expires: number;
+    expiresIn: number;
+};
+export declare function refreshClaudeOAuthToken(input: {
+    refreshToken: string;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+}): Promise<ClaudeOAuthRefreshResult>;
 export type AuthorizationResult = {
     url: string;
     redirectUri: string;

package/dist/auth.js

@@ -1,5 +1,42 @@
 import { AUTHORIZE_URLS, CLIENT_ID, CODE_CALLBACK_URL, OAUTH_SCOPES, TOKEN_URL, } from "./constants.js";
 import { generatePKCE } from "./pkce.js";
+export class ClaudeOAuthRefreshError extends Error {
+    status;
+    body;
+    constructor(status, body) {
+        super(`Claude OAuth refresh failed: ${status} — ${body}`);
+        this.status = status;
+        this.body = body;
+        this.name = 'ClaudeOAuthRefreshError';
+    }
+}
+export async function refreshClaudeOAuthToken(input) {
+    const fetchImpl = input.fetchImpl ?? fetch;
+    const response = await fetchImpl(TOKEN_URL, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            Accept: 'application/json',
+        },
+        body: JSON.stringify({
+            grant_type: 'refresh_token',
+            refresh_token: input.refreshToken,
+            client_id: CLIENT_ID,
+        }),
+    });
+    if (!response.ok) {
+        const body = await response.text().catch(() => '');
+        throw new ClaudeOAuthRefreshError(response.status, body);
+    }
+    const json = (await response.json());
+    const refreshedAt = input.now?.() ?? Date.now();
+    return {
+        access: json.access_token,
+        refresh: json.refresh_token ?? input.refreshToken,
+        expires: refreshedAt + json.expires_in * 1000,
+        expiresIn: json.expires_in,
+    };
+}
 function generateState() {
     return crypto.randomUUID().replace(/-/g, '');
 }

package/dist/cch.js

@@ -1,6 +1,6 @@
 import { createHash } from 'node:crypto';
 import xxhashInit from 'xxhash-wasm';
-import { CLAUDE_CODE_VERSION } from "./constants.js";
+import { CLAUDE_CODE_BUILD_HASH, CLAUDE_CODE_VERSION } from "./constants.js";
 const CCH_SEED = 0x6e52736ac806831en;
 export const CCH_PATTERN = /\bcch=([0-9a-f]{5});/;
 let xxhashPromise = null;
@@ -58,6 +58,8 @@ export async function signRequestBody(bodyString) {
  * busting prompt-cache prefixes on every turn.
  */
 export function computeVersionSuffix(version = CLAUDE_CODE_VERSION, date = new Date()) {
+    if (version === CLAUDE_CODE_VERSION)
+        return CLAUDE_CODE_BUILD_HASH;
     const dayStamp = date.toISOString().slice(0, 10);
     return createHash('sha256')
         .update(`${dayStamp}${version}`)

package/dist/claude-code.d.ts

@@ -0,0 +1,19 @@
+export type ClaudeCodeIdentity = {
+    deviceId: string;
+    accountUuid?: string;
+    sessionId: string;
+};
+export declare function getClaudeCodeIdentity(seed: string): ClaudeCodeIdentity;
+export declare function resolveClaudeCodeIdentity(accessToken: string, model?: string): Promise<ClaudeCodeIdentity>;
+export declare function buildClaudeCodeMetadataUserId(identity: ClaudeCodeIdentity): string | null;
+export declare function applyClaudeCodeMetadata(body: Record<string, unknown>, identity: ClaudeCodeIdentity): boolean;
+export declare const CLAUDE_CODE_FULL_AGENT_BETAS: readonly ["claude-code-20250219", "oauth-2025-04-20", "interleaved-thinking-2025-05-14", "context-management-2025-06-27", "prompt-caching-scope-2026-01-05", "advisor-tool-2026-03-01", "advanced-tool-use-2025-11-20", "context-1m-2025-08-07", "effort-2025-11-24", "extended-cache-ttl-2025-04-11", "cache-diagnosis-2026-04-07"];
+export declare function selectClaudeCodeBetas(body?: Record<string, unknown> | null, extraBetas?: string[]): string;
+export declare function applyClaudeCodeHeaders(headers: Headers, accessToken: string, options?: {
+    body?: Record<string, unknown> | null;
+    identity?: ClaudeCodeIdentity;
+    extraBetas?: string[];
+}): Headers;
+export declare function orderClaudeCodeBody<T extends Record<string, unknown>>(body: T): T;
+export declare function claudeCodeBuildHash(): string;
+export declare function claudeCodeEntrypoint(): string;

package/dist/claude-code.js

@@ -0,0 +1,258 @@
+import { randomBytes, randomUUID } from 'node:crypto';
+import { CLAUDE_CODE_BUILD_HASH, CLAUDE_CODE_ENTRYPOINT, CLAUDE_CODE_STAINLESS_PACKAGE_VERSION, CLAUDE_CODE_STAINLESS_RUNTIME_VERSION, CLAUDE_CODE_VERSION, FAST_MODE_BETA, USER_AGENT, } from "./constants.js";
+const IDENTITY_CACHE_LIMIT = 1_000;
+const identityCache = new Map();
+function setBounded(map, key, value) {
+    if (!map.has(key) && map.size >= IDENTITY_CACHE_LIMIT) {
+        const oldest = map.keys().next().value;
+        if (oldest !== undefined)
+            map.delete(oldest);
+    }
+    map.set(key, value);
+}
+export function getClaudeCodeIdentity(seed) {
+    const cacheKey = seed || 'anonymous';
+    const cached = identityCache.get(cacheKey);
+    if (cached)
+        return cached;
+    const identity = {
+        deviceId: randomBytes(32).toString('hex'),
+        sessionId: randomUUID(),
+    };
+    setBounded(identityCache, cacheKey, identity);
+    return identity;
+}
+const bootstrapFetches = new Map();
+async function fetchClaudeCodeAccountUuid(accessToken, model) {
+    if (!accessToken.startsWith('sk-ant-oat'))
+        return null;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 5_000);
+    try {
+        const url = new URL('https://api.anthropic.com/api/claude_cli/bootstrap');
+        url.searchParams.set('entrypoint', CLAUDE_CODE_ENTRYPOINT);
+        if (model)
+            url.searchParams.set('model', model);
+        const response = await fetch(url, {
+            method: 'GET',
+            headers: {
+                accept: 'application/json, text/plain, */*',
+                authorization: `Bearer ${accessToken}`,
+                'content-type': 'application/json',
+                'anthropic-beta': 'oauth-2025-04-20',
+                'user-agent': `claude-code/${CLAUDE_CODE_VERSION}`,
+            },
+            signal: controller.signal,
+        });
+        if (!response.ok)
+            return null;
+        const data = (await response.json().catch(() => null));
+        const accountUuid = data?.oauth_account?.account_uuid;
+        return typeof accountUuid === 'string' && accountUuid ? accountUuid : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+export async function resolveClaudeCodeIdentity(accessToken, model) {
+    const identity = getClaudeCodeIdentity(accessToken);
+    if (!accessToken.startsWith('sk-ant-oat'))
+        return identity;
+    let fetchPromise = bootstrapFetches.get(accessToken);
+    if (!fetchPromise) {
+        fetchPromise = fetchClaudeCodeAccountUuid(accessToken, model);
+        bootstrapFetches.set(accessToken, fetchPromise);
+    }
+    const accountUuid = await fetchPromise;
+    if (!accountUuid) {
+        bootstrapFetches.delete(accessToken);
+        return identity;
+    }
+    const accountCacheKey = `account:${accountUuid}`;
+    const accountIdentity = identityCache.get(accountCacheKey);
+    if (accountIdentity) {
+        setBounded(identityCache, accessToken, accountIdentity);
+        return accountIdentity;
+    }
+    identity.accountUuid = accountUuid;
+    setBounded(identityCache, accountCacheKey, identity);
+    return identity;
+}
+function isRecord(value) {
+    return value != null && typeof value === 'object' && !Array.isArray(value);
+}
+export function buildClaudeCodeMetadataUserId(identity) {
+    if (!identity.accountUuid)
+        return null;
+    return JSON.stringify({
+        device_id: identity.deviceId,
+        account_uuid: identity.accountUuid,
+        session_id: identity.sessionId,
+    });
+}
+export function applyClaudeCodeMetadata(body, identity) {
+    const userId = buildClaudeCodeMetadataUserId(identity);
+    if (!userId) {
+        if (isRecord(body.metadata))
+            delete body.metadata.user_id;
+        return false;
+    }
+    if (!isRecord(body.metadata))
+        body.metadata = {};
+    const metadata = body.metadata;
+    if (isRecord(metadata))
+        metadata.user_id = userId;
+    return true;
+}
+export const CLAUDE_CODE_FULL_AGENT_BETAS = [
+    'claude-code-20250219',
+    'oauth-2025-04-20',
+    'interleaved-thinking-2025-05-14',
+    'context-management-2025-06-27',
+    'prompt-caching-scope-2026-01-05',
+    'advisor-tool-2026-03-01',
+    'advanced-tool-use-2025-11-20',
+    'context-1m-2025-08-07',
+    'effort-2025-11-24',
+    'extended-cache-ttl-2025-04-11',
+    'cache-diagnosis-2026-04-07',
+];
+const CLAUDE_CODE_STRUCTURED_OUTPUT_BETAS = [
+    'oauth-2025-04-20',
+    'interleaved-thinking-2025-05-14',
+    'context-management-2025-06-27',
+    'prompt-caching-scope-2026-01-05',
+    'advisor-tool-2026-03-01',
+    'structured-outputs-2025-12-15',
+    'cache-diagnosis-2026-04-07',
+];
+const CLAUDE_CODE_BASE_BETAS = [
+    'oauth-2025-04-20',
+    'interleaved-thinking-2025-05-14',
+    'context-management-2025-06-27',
+    'prompt-caching-scope-2026-01-05',
+    'advisor-tool-2026-03-01',
+    'cache-diagnosis-2026-04-07',
+];
+function hasStructuredOutput(body) {
+    const outputConfig = body.output_config;
+    const format = outputConfig?.format;
+    return format?.type === 'json_schema';
+}
+function hasFullAgentShape(body) {
+    return (Array.isArray(body.tools) &&
+        body.tools.length > 0 &&
+        Array.isArray(body.system) &&
+        isRecord(body.thinking) &&
+        isRecord(body.context_management) &&
+        isRecord(body.output_config) &&
+        isRecord(body.diagnostics));
+}
+export function selectClaudeCodeBetas(body, extraBetas = []) {
+    const selected = body
+        ? hasFullAgentShape(body)
+            ? [...CLAUDE_CODE_FULL_AGENT_BETAS]
+            : hasStructuredOutput(body)
+                ? [...CLAUDE_CODE_STRUCTURED_OUTPUT_BETAS]
+                : [...CLAUDE_CODE_BASE_BETAS]
+        : [...CLAUDE_CODE_BASE_BETAS];
+    if (body?.speed === 'fast')
+        selected.push(FAST_MODE_BETA);
+    for (const beta of extraBetas) {
+        const trimmed = beta.trim();
+        if (trimmed)
+            selected.push(trimmed);
+    }
+    return [...new Set(selected)].join(',');
+}
+function stainlessOS() {
+    switch (process.platform) {
+        case 'darwin':
+            return 'MacOS';
+        case 'win32':
+            return 'Windows';
+        case 'linux':
+            return 'Linux';
+        case 'freebsd':
+            return 'FreeBSD';
+        default:
+            return 'Unknown';
+    }
+}
+function stainlessArch() {
+    switch (process.arch) {
+        case 'arm64':
+            return 'arm64';
+        case 'x64':
+            return 'x64';
+        case 'ia32':
+            return 'x32';
+        default:
+            return process.arch;
+    }
+}
+export function applyClaudeCodeHeaders(headers, accessToken, options = {}) {
+    const identity = options.identity ?? getClaudeCodeIdentity(accessToken);
+    const incomingBetas = (headers.get('anthropic-beta') ?? '')
+        .split(',')
+        .map((beta) => beta.trim())
+        .filter(Boolean);
+    const extraBetas = [...incomingBetas, ...(options.extraBetas ?? [])];
+    headers.set('accept', 'application/json');
+    headers.set('authorization', `Bearer ${accessToken}`);
+    headers.set('content-type', 'application/json');
+    headers.set('user-agent', USER_AGENT);
+    headers.set('anthropic-beta', selectClaudeCodeBetas(options.body, extraBetas));
+    headers.set('anthropic-dangerous-direct-browser-access', 'true');
+    headers.set('anthropic-version', '2023-06-01');
+    headers.set('x-app', 'cli');
+    headers.set('x-client-request-id', randomUUID());
+    headers.set('x-claude-code-session-id', identity.sessionId);
+    headers.set('x-stainless-arch', stainlessArch());
+    headers.set('x-stainless-lang', 'js');
+    headers.set('x-stainless-os', stainlessOS());
+    headers.set('x-stainless-package-version', CLAUDE_CODE_STAINLESS_PACKAGE_VERSION);
+    headers.set('x-stainless-retry-count', '0');
+    headers.set('x-stainless-runtime', 'node');
+    headers.set('x-stainless-runtime-version', CLAUDE_CODE_STAINLESS_RUNTIME_VERSION);
+    headers.set('x-stainless-timeout', '600');
+    headers.delete('x-api-key');
+    return headers;
+}
+const BODY_FIELD_ORDER = [
+    'model',
+    'messages',
+    'system',
+    'tools',
+    'tool_choice',
+    'metadata',
+    'max_tokens',
+    'temperature',
+    'thinking',
+    'context_management',
+    'output_config',
+    'diagnostics',
+    'stream',
+    'speed',
+];
+export function orderClaudeCodeBody(body) {
+    const ordered = {};
+    for (const key of BODY_FIELD_ORDER) {
+        if (Object.hasOwn(body, key))
+            ordered[key] = body[key];
+    }
+    for (const [key, value] of Object.entries(body)) {
+        if (!Object.hasOwn(ordered, key))
+            ordered[key] = value;
+    }
+    return ordered;
+}
+export function claudeCodeBuildHash() {
+    return CLAUDE_CODE_BUILD_HASH;
+}
+export function claudeCodeEntrypoint() {
+    return CLAUDE_CODE_ENTRYPOINT;
+}

package/dist/constants.d.ts

@@ -8,13 +8,19 @@ export declare const TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
 export declare const OAUTH_SCOPES: string[];
 export declare const TOOL_PREFIX = "mcp_";
 export declare const REQUIRED_BETAS: string[];
+export declare const FAST_MODE_BETA = "fast-mode-2026-02-01";
+export declare function mergeAnthropicBetas(existing: string | null | undefined, betas: string[]): string;
+export declare function isFastModeSupportedModel(model: unknown): boolean;
 export declare const OPENCODE_IDENTITY_PREFIX = "You are OpenCode";
 export declare const CLAUDE_CODE_IDENTITY = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
 export declare const CCH_SALT = "59cf53e54c78";
 export declare const CCH_POSITIONS: number[];
-export declare const CLAUDE_CODE_VERSION = "2.1.87";
+export declare const CLAUDE_CODE_VERSION = "2.1.141";
+export declare const CLAUDE_CODE_BUILD_HASH = "67b";
 export declare const CLAUDE_CODE_ENTRYPOINT = "sdk-cli";
-export declare const USER_AGENT = "claude-cli/2.1.87 (external, cli)";
+export declare const CLAUDE_CODE_STAINLESS_PACKAGE_VERSION = "0.94.0";
+export declare const CLAUDE_CODE_STAINLESS_RUNTIME_VERSION = "v24.3.0";
+export declare const USER_AGENT = "claude-cli/2.1.141 (external, sdk-cli)";
 export declare const CACHE_1H_MODES: readonly ["explicit", "automatic", "hybrid"];
 export type Cache1hMode = (typeof CACHE_1H_MODES)[number];
 export declare const DEFAULT_CACHE_1H_MODE: Cache1hMode;

package/dist/constants.js

@@ -18,13 +18,28 @@ export const REQUIRED_BETAS = [
     'oauth-2025-04-20',
     'interleaved-thinking-2025-05-14',
 ];
+export const FAST_MODE_BETA = 'fast-mode-2026-02-01';
+export function mergeAnthropicBetas(existing, betas) {
+    const incoming = (existing ?? '')
+        .split(',')
+        .map((beta) => beta.trim())
+        .filter(Boolean);
+    return [...new Set([...incoming, ...betas])].join(',');
+}
+export function isFastModeSupportedModel(model) {
+    return (typeof model === 'string' &&
+        (model.startsWith('claude-opus-4-6') || model.startsWith('claude-opus-4-7')));
+}
 export const OPENCODE_IDENTITY_PREFIX = 'You are OpenCode';
 export const CLAUDE_CODE_IDENTITY = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
 export const CCH_SALT = '59cf53e54c78';
 export const CCH_POSITIONS = [4, 7, 20];
-export const CLAUDE_CODE_VERSION = '2.1.87';
+export const CLAUDE_CODE_VERSION = '2.1.141';
+export const CLAUDE_CODE_BUILD_HASH = '67b';
 export const CLAUDE_CODE_ENTRYPOINT = 'sdk-cli';
-export const USER_AGENT = 'claude-cli/2.1.87 (external, cli)';
+export const CLAUDE_CODE_STAINLESS_PACKAGE_VERSION = '0.94.0';
+export const CLAUDE_CODE_STAINLESS_RUNTIME_VERSION = 'v24.3.0';
+export const USER_AGENT = 'claude-cli/2.1.141 (external, sdk-cli)';
 export const CACHE_1H_MODES = ['explicit', 'automatic', 'hybrid'];
 export const DEFAULT_CACHE_1H_MODE = 'explicit';
 /**

package/dist/fast.d.ts

@@ -0,0 +1,21 @@
+export declare const CLAUDE_FAST_COMMAND_NAME = "claude-fast";
+export type FastModeCommandAction = {
+    type: 'status';
+} | {
+    type: 'enable';
+} | {
+    type: 'disable';
+} | {
+    type: 'usage';
+};
+export declare function isFastModeEnabled(): boolean;
+export declare function setFastModeEnabled(enabled: boolean): void;
+export declare function resetFastModeState(): void;
+export declare function parseFastModeCommandAction(argumentsText: string): FastModeCommandAction;
+export declare function buildFastModeStatusSummary(input?: {
+    enabled?: boolean;
+}): string;
+export declare function executeFastModeCommand(input: {
+    argumentsText: string;
+    enabled?: boolean;
+}): string;

package/dist/fast.js

@@ -0,0 +1,66 @@
+export const CLAUDE_FAST_COMMAND_NAME = 'claude-fast';
+const FAST_STATUS_TITLE = '## Claude Fast Mode Status';
+const FAST_ENABLED_TITLE = '## Claude Fast Mode Enabled';
+const FAST_DISABLED_TITLE = '## Claude Fast Mode Disabled';
+const FAST_USAGE_TITLE = '## Claude Fast Mode Usage';
+const FAST_USAGE = 'Usage: `/claude-fast`, `/claude-fast on`, or `/claude-fast off`.';
+let fastModeEnabled = false;
+export function isFastModeEnabled() {
+    return fastModeEnabled;
+}
+export function setFastModeEnabled(enabled) {
+    fastModeEnabled = enabled;
+}
+export function resetFastModeState() {
+    fastModeEnabled = false;
+}
+export function parseFastModeCommandAction(argumentsText) {
+    const normalized = argumentsText.trim().split(/\s+/).filter(Boolean);
+    if (normalized.length === 0)
+        return { type: 'status' };
+    if (normalized.length === 1 && normalized[0] === 'on')
+        return { type: 'enable' };
+    if (normalized.length === 1 && normalized[0] === 'off')
+        return { type: 'disable' };
+    return { type: 'usage' };
+}
+export function buildFastModeStatusSummary(input) {
+    const enabled = input?.enabled ?? fastModeEnabled;
+    return [
+        FAST_STATUS_TITLE,
+        '',
+        `- Enabled: ${enabled ? 'enabled' : 'disabled'}`,
+        '- Persisted: ~/.config/opencode/anthropic-auth.json',
+        '- Scope: adds Anthropic fast mode to supported Opus requests',
+        '- Supported models: claude-opus-4-6 and claude-opus-4-7',
+        '- Request changes: adds `speed: "fast"` and the `fast-mode-2026-02-01` beta header',
+        '- Note: fast and standard speeds do not share prompt-cache prefixes',
+    ].join('\n');
+}
+export function executeFastModeCommand(input) {
+    const action = parseFastModeCommandAction(input.argumentsText);
+    const enabled = input.enabled ?? fastModeEnabled;
+    if (action.type === 'status')
+        return buildFastModeStatusSummary({ enabled });
+    if (action.type === 'enable') {
+        return [
+            FAST_ENABLED_TITLE,
+            '',
+            buildFastModeStatusSummary({ enabled: true }),
+        ].join('\n');
+    }
+    if (action.type === 'disable') {
+        return [
+            FAST_DISABLED_TITLE,
+            '',
+            buildFastModeStatusSummary({ enabled: false }),
+        ].join('\n');
+    }
+    return [
+        FAST_USAGE_TITLE,
+        '',
+        FAST_USAGE,
+        '',
+        buildFastModeStatusSummary({ enabled }),
+    ].join('\n');
+}

package/dist/index.d.ts

@@ -2,8 +2,10 @@ export * from './accounts.ts';
 export * from './auth.ts';
 export * from './cache1h.ts';
 export * from './cch.ts';
+export * from './claude-code.ts';
 export * from './constants.ts';
 export * from './dump.ts';
+export * from './fast.ts';
 export * from './logger.ts';
 export * from './pkce.ts';
 export * from './quotas.ts';

package/dist/index.js

@@ -2,8 +2,10 @@ export * from "./accounts.js";
 export * from "./auth.js";
 export * from "./cache1h.js";
 export * from "./cch.js";
+export * from "./claude-code.js";
 export * from "./constants.js";
 export * from "./dump.js";
+export * from "./fast.js";
 export * from "./logger.js";
 export * from "./pkce.js";
 export * from "./quotas.js";

package/dist/relay.d.ts

@@ -22,6 +22,7 @@ export declare function sendViaRelay(options: {
     headers: Headers;
     body: RequestInit['body'] | null | undefined;
     fallback: () => Promise<Response>;
+    affinity?: string | null;
     optimisticResponse?: boolean;
 }): Promise<Response>;
-export declare const WORKER_SCRIPT = "\nasync function hashBody(body) {\n  const bytes = new TextEncoder().encode(body)\n  const digest = await crypto.subtle.digest('SHA-256', bytes)\n  const hex = [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('')\n  return 'sha256:' + hex\n}\n\nfunction applyPatch(base, patch) {\n  return base.slice(0, patch.start) + patch.insert + base.slice(patch.start + patch.deleteCount)\n}\n\nfunction applyPatchSet(base, patch) {\n  if (!Array.isArray(patch)) return applyPatch(base, patch)\n  if (patch.length === 0) return base\n\n  let result = ''\n  let cursor = 0\n  for (const item of patch) {\n    if (item.start < cursor) return { error: 'overlapping patch', status: 400 }\n    result += base.slice(cursor, item.start)\n    result += item.insert\n    cursor = item.start + item.deleteCount\n  }\n  return result + base.slice(cursor)\n}\n\nasync function readState(env, affinity) {\n  const raw = await env.RELAY_STATE.get('session:' + affinity)\n  return raw ? JSON.parse(raw) : null\n}\n\nasync function writeState(env, affinity, state) {\n  await env.RELAY_STATE.put('session:' + affinity, JSON.stringify(state), { expirationTtl: 86400 })\n}\n\nasync function resolveBody(env, payload) {\n  if (payload.mode === 'full_sync') return payload.body\n  if (payload.mode === 'patch') {\n    const state = await readState(env, payload.affinity)\n    if (!state || state.hash !== payload.base_hash) {\n      return { error: 'state mismatch', status: 409 }\n    }\n    return applyPatchSet(state.body, payload.patch)\n  }\n  return { error: 'unknown mode', status: 400 }\n}\n\nasync function prepareUpstream(env, payload) {\n  if ((payload.protocol !== 1 && payload.protocol !== 2) || payload.type !== 'request' || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {\n    return { error: 'invalid payload', status: 400 }\n  }\n\n  const body = await resolveBody(env, payload)\n  if (body && typeof body === 'object' && 'error' in body) return body\n\n  if (typeof body !== 'string' || (await hashBody(body)) !== payload.next_hash) {\n    return { error: 'hash mismatch', status: 409 }\n  }\n\n  await writeState(env, payload.affinity, { body, hash: payload.next_hash, revision: payload.revision })\n  console.log(JSON.stringify({\n    relay: 'opencode-anthropic-auth',\n    transport: 'relay',\n    mode: payload.mode,\n    revision: payload.revision,\n    affinity: String(payload.affinity).slice(0, 12),\n    bodyBytes: body.length,\n  }))\n\n  return { body }\n}\n\nfunction resolveBodyFromState(state, payload) {\n  if (payload.mode === 'full_sync') return payload.body\n  if (payload.mode === 'patch') {\n    if (!state || state.hash !== payload.base_hash) {\n      return { error: 'state mismatch', status: 409 }\n    }\n    return applyPatchSet(state.body, payload.patch)\n  }\n  return { error: 'unknown mode', status: 400 }\n}\n\nfunction deferWorkerTask(task) {\n  return new Promise((resolve) => setTimeout(resolve, 0)).then(task)\n}\n\nfunction checkpointWebSocketState(env, payload, body, nextState) {\n  return deferWorkerTask(async () => {\n    try {\n      if ((await hashBody(body)) !== payload.next_hash) {\n        throw new Error('hash mismatch')\n      }\n      await writeState(env, payload.affinity, nextState)\n    } catch (error) {\n      console.log(JSON.stringify({\n        relay: 'opencode-anthropic-auth',\n        transport: 'websocket',\n        event: 'checkpoint_write_failed',\n        affinity: String(payload.affinity).slice(0, 12),\n        message: error instanceof Error ? error.message : String(error),\n      }))\n    }\n  })\n}\n\nfunction prepareWebSocketUpstream(env, state, payload) {\n  if (payload.protocol !== 2 || payload.type !== 'request' || !payload.id || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {\n    return { error: 'invalid payload', status: 400 }\n  }\n\n  const body = resolveBodyFromState(state, payload)\n  if (body && typeof body === 'object' && 'error' in body) return body\n  if (typeof body !== 'string') return { error: 'invalid body', status: 400 }\n\n  const nextState = { body, hash: payload.next_hash, revision: payload.revision }\n  const checkpoint = checkpointWebSocketState(env, payload, body, nextState)\n  const logAccepted = () => console.log(JSON.stringify({\n    relay: 'opencode-anthropic-auth',\n    transport: 'websocket',\n    mode: payload.mode,\n    revision: payload.revision,\n    affinity: String(payload.affinity).slice(0, 12),\n    bodyBytes: body.length,\n  }))\n\n  return { body, state: nextState, checkpoint, logAccepted }\n}\n\nfunction headersToObject(headers) {\n  const result = {}\n  for (const [key, value] of headers.entries()) result[key] = value\n  return result\n}\n\nasync function handleRelayPayload(env, payload) {\n  const prepared = await prepareUpstream(env, payload)\n  if (prepared.error) return prepared\n  const upstream = await fetch(payload.upstream.url, {\n    method: payload.upstream.method || 'POST',\n    headers: payload.upstream.headers,\n    body: prepared.body,\n  })\n  return { upstream }\n}\n\nasync function handleWebSocket(socket, env, ctx, payload, getState, setState) {\n  const heartbeat = setInterval(() => {\n    try {\n      socket.send(JSON.stringify({ protocol: 2, type: 'keepalive' }))\n    } catch {\n      clearInterval(heartbeat)\n    }\n  }, 5000)\n  try {\n    const result = prepareWebSocketUpstream(env, getState(), payload)\n    if (result.error) {\n      socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: result.status, message: result.error }))\n      return\n    }\n\n    setState(result.state)\n    socket.send(JSON.stringify({ protocol: 2, type: 'accepted', id: payload.id, hash: result.state.hash, revision: result.state.revision }))\n    ctx?.waitUntil?.(deferWorkerTask(result.logAccepted))\n\n    const upstreamPromise = fetch(payload.upstream.url, {\n      method: payload.upstream.method || 'POST',\n      headers: payload.upstream.headers,\n      body: result.body,\n    })\n    ctx?.waitUntil?.(result.checkpoint)\n    const upstream = await upstreamPromise\n    socket.send(JSON.stringify({\n      protocol: 2,\n      type: 'response_start',\n      id: payload.id,\n      status: upstream.status,\n      statusText: upstream.statusText,\n      headers: headersToObject(upstream.headers),\n    }))\n\n    const reader = upstream.body?.getReader()\n    if (reader) {\n      while (true) {\n        const { done, value } = await reader.read()\n        if (done) break\n        socket.send(value)\n      }\n    }\n    socket.send(JSON.stringify({ protocol: 2, type: 'done', id: payload.id }))\n  } catch (error) {\n    socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: 500, message: error instanceof Error ? error.message : String(error) }))\n  } finally {\n    clearInterval(heartbeat)\n  }\n}\n\nexport default {\n  async fetch(request, env, ctx) {\n    if (request.headers.get('Upgrade') === 'websocket') {\n      const url = new URL(request.url)\n      const token = url.searchParams.get('token')\n      const affinity = url.searchParams.get('affinity')\n      if (token !== env.RELAY_TOKEN) return new Response('unauthorized', { status: 401 })\n      if (!affinity) return new Response('missing affinity', { status: 400 })\n      const pair = new WebSocketPair()\n      const client = pair[0]\n      const server = pair[1]\n      server.binaryType = 'arraybuffer'\n      let state = null\n      let ready = false\n      server.accept()\n      const loadState = readState(env, affinity).then((loadedState) => {\n        state = loadedState\n        ready = true\n        server.send(JSON.stringify({\n          protocol: 2,\n          type: 'ready',\n          state: state ? { hash: state.hash, revision: state.revision } : null,\n        }))\n      }).catch((error) => {\n        server.send(JSON.stringify({ protocol: 2, type: 'error', status: 500, message: error instanceof Error ? error.message : String(error) }))\n        server.close(1011, 'state load failed')\n      })\n      ctx?.waitUntil?.(loadState)\n      if (!ctx?.waitUntil) void loadState\n      let busy = false\n      server.addEventListener('message', (event) => {\n        if (!ready) {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 425, message: 'relay state is not ready' }))\n          return\n        }\n        if (busy) {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 429, message: 'request already in flight' }))\n          return\n        }\n        let payload\n        try {\n          payload = JSON.parse(event.data)\n        } catch {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 400, message: 'invalid JSON payload' }))\n          return\n        }\n        payload.affinity = affinity\n        busy = true\n        const run = handleWebSocket(server, env, ctx, payload, () => state, (nextState) => { state = nextState }).finally(() => { busy = false })\n        ctx?.waitUntil?.(run)\n        if (!ctx?.waitUntil) void run\n      })\n      return new Response(null, { status: 101, webSocket: client })\n    }\n\n    if (request.method === 'GET') return new Response('ok')\n    if (request.method !== 'POST') return new Response('method not allowed', { status: 405 })\n    if (request.headers.get('x-relay-token') !== env.RELAY_TOKEN) {\n      return new Response('unauthorized', { status: 401 })\n    }\n\n    const payload = await request.json()\n    const result = await handleRelayPayload(env, payload)\n    if (result.error) return Response.json({ error: result.error }, { status: result.status })\n\n    const upstream = result.upstream\n    return new Response(upstream.body, {\n      status: upstream.status,\n      statusText: upstream.statusText,\n      headers: upstream.headers,\n    })\n  },\n}\n";
+export declare const WORKER_SCRIPT = "\nasync function hashBody(body) {\n  const bytes = new TextEncoder().encode(body)\n  const digest = await crypto.subtle.digest('SHA-256', bytes)\n  const hex = [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('')\n  return 'sha256:' + hex\n}\n\nfunction applyPatch(base, patch) {\n  return base.slice(0, patch.start) + patch.insert + base.slice(patch.start + patch.deleteCount)\n}\n\nfunction applyPatchSet(base, patch) {\n  if (!Array.isArray(patch)) return applyPatch(base, patch)\n  if (patch.length === 0) return base\n\n  let result = ''\n  let cursor = 0\n  for (const item of patch) {\n    if (item.start < cursor) return { error: 'overlapping patch', status: 400 }\n    result += base.slice(cursor, item.start)\n    result += item.insert\n    cursor = item.start + item.deleteCount\n  }\n  return result + base.slice(cursor)\n}\n\nasync function readState(env, affinity) {\n  const raw = await env.RELAY_STATE.get('session:' + affinity)\n  return raw ? JSON.parse(raw) : null\n}\n\nasync function writeState(env, affinity, state) {\n  await env.RELAY_STATE.put('session:' + affinity, JSON.stringify(state), { expirationTtl: 86400 })\n}\n\nasync function resolveBody(env, payload) {\n  if (payload.mode === 'full_sync') return payload.body\n  if (payload.mode === 'patch') {\n    const state = await readState(env, payload.affinity)\n    if (!state || state.hash !== payload.base_hash) {\n      return { error: 'state mismatch', status: 409 }\n    }\n    return applyPatchSet(state.body, payload.patch)\n  }\n  return { error: 'unknown mode', status: 400 }\n}\n\nasync function prepareUpstream(env, payload) {\n  if ((payload.protocol !== 1 && payload.protocol !== 2) || payload.type !== 'request' || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {\n    return { error: 'invalid payload', status: 400 }\n  }\n\n  const body = await resolveBody(env, payload)\n  if (body && typeof body === 'object' && 'error' in body) return body\n\n  if (typeof body !== 'string' || (await hashBody(body)) !== payload.next_hash) {\n    return { error: 'hash mismatch', status: 409 }\n  }\n\n  await writeState(env, payload.affinity, { body, hash: payload.next_hash, revision: payload.revision })\n  console.log(JSON.stringify({\n    relay: 'opencode-anthropic-auth',\n    transport: 'relay',\n    mode: payload.mode,\n    revision: payload.revision,\n    affinity: String(payload.affinity).slice(0, 12),\n    bodyBytes: body.length,\n  }))\n\n  return { body }\n}\n\nfunction resolveBodyFromState(state, payload) {\n  if (payload.mode === 'full_sync') return payload.body\n  if (payload.mode === 'patch') {\n    if (!state || state.hash !== payload.base_hash) {\n      return { error: 'state mismatch', status: 409 }\n    }\n    return applyPatchSet(state.body, payload.patch)\n  }\n  return { error: 'unknown mode', status: 400 }\n}\n\nfunction deferWorkerTask(task) {\n  return new Promise((resolve) => setTimeout(resolve, 0)).then(task)\n}\n\nfunction checkpointWebSocketState(env, payload, body, nextState) {\n  return deferWorkerTask(async () => {\n    try {\n      if ((await hashBody(body)) !== payload.next_hash) {\n        throw new Error('hash mismatch')\n      }\n      await writeState(env, payload.affinity, nextState)\n    } catch (error) {\n      console.log(JSON.stringify({\n        relay: 'opencode-anthropic-auth',\n        transport: 'websocket',\n        event: 'checkpoint_write_failed',\n        affinity: String(payload.affinity).slice(0, 12),\n        message: error instanceof Error ? error.message : String(error),\n      }))\n    }\n  })\n}\n\nasync function prepareWebSocketUpstream(env, state, payload) {\n  if (payload.protocol !== 2 || payload.type !== 'request' || !payload.id || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {\n    return { error: 'invalid payload', status: 400 }\n  }\n\n  const body = resolveBodyFromState(state, payload)\n  if (body && typeof body === 'object' && 'error' in body) return body\n  if (typeof body !== 'string') return { error: 'invalid body', status: 400 }\n  if ((await hashBody(body)) !== payload.next_hash) {\n    return { error: 'hash mismatch', status: 409 }\n  }\n\n  const nextState = { body, hash: payload.next_hash, revision: payload.revision }\n  const checkpoint = checkpointWebSocketState(env, payload, body, nextState)\n  const logAccepted = () => console.log(JSON.stringify({\n    relay: 'opencode-anthropic-auth',\n    transport: 'websocket',\n    mode: payload.mode,\n    revision: payload.revision,\n    affinity: String(payload.affinity).slice(0, 12),\n    bodyBytes: body.length,\n  }))\n\n  return { body, state: nextState, checkpoint, logAccepted }\n}\n\nfunction headersToObject(headers) {\n  const result = {}\n  for (const [key, value] of headers.entries()) result[key] = value\n  return result\n}\n\nasync function handleRelayPayload(env, payload) {\n  const prepared = await prepareUpstream(env, payload)\n  if (prepared.error) return prepared\n  const upstream = await fetch(payload.upstream.url, {\n    method: payload.upstream.method || 'POST',\n    headers: payload.upstream.headers,\n    body: prepared.body,\n  })\n  return { upstream }\n}\n\nasync function handleWebSocket(socket, env, ctx, payload, getState, setState) {\n  const heartbeat = setInterval(() => {\n    try {\n      socket.send(JSON.stringify({ protocol: 2, type: 'keepalive' }))\n    } catch {\n      clearInterval(heartbeat)\n    }\n  }, 5000)\n  try {\n    const result = await prepareWebSocketUpstream(env, getState(), payload)\n    if (result.error) {\n      socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: result.status, message: result.error }))\n      return\n    }\n\n    setState(result.state)\n    socket.send(JSON.stringify({ protocol: 2, type: 'accepted', id: payload.id, hash: result.state.hash, revision: result.state.revision }))\n    ctx?.waitUntil?.(deferWorkerTask(result.logAccepted))\n\n    const upstreamPromise = fetch(payload.upstream.url, {\n      method: payload.upstream.method || 'POST',\n      headers: payload.upstream.headers,\n      body: result.body,\n    })\n    ctx?.waitUntil?.(result.checkpoint)\n    const upstream = await upstreamPromise\n    socket.send(JSON.stringify({\n      protocol: 2,\n      type: 'response_start',\n      id: payload.id,\n      status: upstream.status,\n      statusText: upstream.statusText,\n      headers: headersToObject(upstream.headers),\n    }))\n\n    const reader = upstream.body?.getReader()\n    if (reader) {\n      while (true) {\n        const { done, value } = await reader.read()\n        if (done) break\n        socket.send(value)\n      }\n    }\n    socket.send(JSON.stringify({ protocol: 2, type: 'done', id: payload.id }))\n  } catch (error) {\n    socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: 500, message: error instanceof Error ? error.message : String(error) }))\n  } finally {\n    clearInterval(heartbeat)\n  }\n}\n\nexport default {\n  async fetch(request, env, ctx) {\n    if (request.headers.get('Upgrade') === 'websocket') {\n      const url = new URL(request.url)\n      const token = url.searchParams.get('token')\n      const affinity = url.searchParams.get('affinity')\n      if (token !== env.RELAY_TOKEN) return new Response('unauthorized', { status: 401 })\n      if (!affinity) return new Response('missing affinity', { status: 400 })\n      const pair = new WebSocketPair()\n      const client = pair[0]\n      const server = pair[1]\n      server.binaryType = 'arraybuffer'\n      let state = null\n      let ready = false\n      server.accept()\n      const loadState = readState(env, affinity).then((loadedState) => {\n        state = loadedState\n        ready = true\n        server.send(JSON.stringify({\n          protocol: 2,\n          type: 'ready',\n          state: state ? { hash: state.hash, revision: state.revision } : null,\n        }))\n      }).catch((error) => {\n        server.send(JSON.stringify({ protocol: 2, type: 'error', status: 500, message: error instanceof Error ? error.message : String(error) }))\n        server.close(1011, 'state load failed')\n      })\n      ctx?.waitUntil?.(loadState)\n      if (!ctx?.waitUntil) void loadState\n      let busy = false\n      server.addEventListener('message', (event) => {\n        if (!ready) {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 425, message: 'relay state is not ready' }))\n          return\n        }\n        if (busy) {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 429, message: 'request already in flight' }))\n          return\n        }\n        let payload\n        try {\n          payload = JSON.parse(event.data)\n        } catch {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 400, message: 'invalid JSON payload' }))\n          return\n        }\n        payload.affinity = affinity\n        busy = true\n        const run = handleWebSocket(server, env, ctx, payload, () => state, (nextState) => { state = nextState }).finally(() => { busy = false })\n        ctx?.waitUntil?.(run)\n        if (!ctx?.waitUntil) void run\n      })\n      return new Response(null, { status: 101, webSocket: client })\n    }\n\n    if (request.method === 'GET') return new Response('ok')\n    if (request.method !== 'POST') return new Response('method not allowed', { status: 405 })\n    if (request.headers.get('x-relay-token') !== env.RELAY_TOKEN) {\n      return new Response('unauthorized', { status: 401 })\n    }\n\n    const payload = await request.json()\n    const result = await handleRelayPayload(env, payload)\n    if (result.error) return Response.json({ error: result.error }, { status: result.status })\n\n    const upstream = result.upstream\n    return new Response(upstream.body, {\n      status: upstream.status,\n      statusText: upstream.statusText,\n      headers: upstream.headers,\n    })\n  },\n}\n";

package/dist/relay.js

@@ -107,7 +107,7 @@ function isRelayableAnthropicRequest(input, body) {
         return false;
     try {
         const url = input instanceof Request ? new URL(input.url) : new URL(input.toString());
-        return url.pathname === '/v1/messages';
+        return url.pathname === '/v1/messages' || url.pathname === '/messages';
     }
     catch {
         return false;
@@ -115,8 +115,11 @@ function isRelayableAnthropicRequest(input, body) {
 }
 function jsonHeaders(headers) {
     const result = {};
-    for (const [key, value] of headers.entries())
+    for (const [key, value] of headers.entries()) {
+        if (key === 'x-session-affinity' || key === 'x-opencode-session')
+            continue;
         result[key] = value;
+    }
     return result;
 }
 async function postRelay(config, payload) {
@@ -363,6 +366,10 @@ class PersistentRelaySession {
                     this.connecting = undefined;
                 }
                 if (this.pending) {
+                    if (this.pending.retryingBeforeResponse)
+                        return;
+                    if (this.retryPendingBeforeResponse(this.pending, 'closed before response'))
+                        return;
                     const error = new Error('relay websocket closed before response');
                     this.failPending(error);
                 }
@@ -397,6 +404,8 @@ class PersistentRelaySession {
                 rejectDone,
                 sentAt,
                 optimisticResponse,
+                retryAttempts: 0,
+                retryingBeforeResponse: false,
             };
             this.pending = pending;
             this.resetPendingTimeout(pending);
@@ -415,10 +424,60 @@ class PersistentRelaySession {
         pending.timeout = setTimeout(() => {
             if (this.pending !== pending)
                 return;
+            if (this.retryPendingBeforeResponse(pending, 'response timed out'))
+                return;
             this.failPending(new Error('relay websocket response timed out'));
             this.socket?.close();
         }, 45_000);
     }
+    retryPendingBeforeResponse(pending, reason) {
+        if (pending.responseStartedAt != null)
+            return false;
+        if (pending.streamDone)
+            return false;
+        if (pending.retryAttempts >= 1)
+            return false;
+        pending.retryAttempts += 1;
+        pending.retryingBeforeResponse = true;
+        clearTimeout(pending.timeout);
+        const attempt = pending.retryAttempts;
+        const originalId = pending.payload.id;
+        relayLog(`websocket ${reason}; reconnecting and retrying full_sync session=${shortAffinity(this.affinity)} request=${originalId} retry=${attempt}`);
+        this.socket?.close();
+        this.socket = undefined;
+        this.serverState = undefined;
+        this.connecting = undefined;
+        void (async () => {
+            try {
+                await this.ensureConnected();
+                if (this.pending !== pending)
+                    return;
+                const retryPayload = createFullSyncPayload(pending.payload, pending.bodyText);
+                retryPayload.protocol = 2;
+                retryPayload.id = createRequestId();
+                retryPayload.revision = (this.serverState?.revision ?? 0) + 1;
+                pending.payload = retryPayload;
+                pending.accepted = false;
+                pending.acceptedAt = undefined;
+                pending.responseStartedAt = undefined;
+                pending.sentAt = perfNowMs();
+                pending.retryingBeforeResponse = false;
+                const socket = this.socket;
+                if (!socket || socket.readyState !== WebSocket.OPEN) {
+                    throw new Error('relay websocket is not connected');
+                }
+                this.resetPendingTimeout(pending);
+                relayLog(`perf websocket retry_send session=${shortAffinity(this.affinity)} request=${retryPayload.id} previous=${originalId} mode=full_sync retry=${attempt} bodyBytes=${pending.bodyText.length} relayBytes=${JSON.stringify(retryPayload).length}`);
+                socket.send(JSON.stringify(retryPayload));
+            }
+            catch (error) {
+                pending.retryingBeforeResponse = false;
+                if (this.pending === pending)
+                    this.failPending(error);
+            }
+        })();
+        return true;
+    }
     handleBinaryChunk(data) {
         const pending = this.pending;
         if (!pending?.responseStarted)
@@ -485,6 +544,10 @@ class PersistentRelaySession {
             return;
         }
         if (message.type === 'error') {
+            if (message.status === 409 &&
+                this.retryPendingBeforeResponse(pending, message.message || 'state mismatch')) {
+                return;
+            }
             const error = message.status === 409
                 ? new RelayStateMismatchError(message.message || 'state mismatch')
                 : new Error(message.message || 'relay websocket error');
@@ -529,10 +592,12 @@ function getPersistentRelaySession(config, affinity) {
     return session;
 }
 export async function sendViaRelay(options) {
-    const { config, input, init, headers, body, fallback, optimisticResponse } = options;
+    const { config, input, init, headers, body, fallback, affinity: explicitAffinity, optimisticResponse, } = options;
     if (!config || !isRelayableAnthropicRequest(input, body))
         return fallback();
-    const affinity = headers.get('x-session-affinity') || headers.get('x-opencode-session');
+    const affinity = explicitAffinity ||
+        headers.get('x-session-affinity') ||
+        headers.get('x-opencode-session');
     if (!affinity) {
         relayLog('skipping relay: missing x-session-affinity header');
         return fallback();
@@ -700,7 +765,7 @@ function checkpointWebSocketState(env, payload, body, nextState) {
   })
 }
 
-function prepareWebSocketUpstream(env, state, payload) {
+async function prepareWebSocketUpstream(env, state, payload) {
   if (payload.protocol !== 2 || payload.type !== 'request' || !payload.id || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {
     return { error: 'invalid payload', status: 400 }
   }
@@ -708,6 +773,9 @@ function prepareWebSocketUpstream(env, state, payload) {
   const body = resolveBodyFromState(state, payload)
   if (body && typeof body === 'object' && 'error' in body) return body
   if (typeof body !== 'string') return { error: 'invalid body', status: 400 }
+  if ((await hashBody(body)) !== payload.next_hash) {
+    return { error: 'hash mismatch', status: 409 }
+  }
 
   const nextState = { body, hash: payload.next_hash, revision: payload.revision }
   const checkpoint = checkpointWebSocketState(env, payload, body, nextState)
@@ -749,7 +817,7 @@ async function handleWebSocket(socket, env, ctx, payload, getState, setState) {
     }
   }, 5000)
   try {
-    const result = prepareWebSocketUpstream(env, getState(), payload)
+    const result = await prepareWebSocketUpstream(env, getState(), payload)
     if (result.error) {
       socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: result.status, message: result.error }))
       return

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "1.0.0",
+  "version": "1.1.1",
   "type": "module",
   "repository": {
     "type": "git",