@cortexkit/anthropic-auth-core 1.1.2 → 1.2.0

package/dist/accounts.d.ts

@@ -89,6 +89,14 @@ export type AccountRefreshError = {
 export declare function getAccountStoragePath(): string;
 export declare function loadAccounts(path?: string): Promise<AccountStorage | null>;
 export declare function saveAccounts(storage: AccountStorage, path?: string): Promise<void>;
+export declare function acquireRefreshFileLock(options: {
+    name: string;
+    ttlMs: number;
+    path?: string;
+    now?: () => number;
+}): Promise<{
+    release: () => Promise<void>;
+} | null>;
 export declare function isCache1hPersistentlyEnabled(storage: AccountStorage | null): boolean;
 export declare function getCache1hPersistentMode(storage: AccountStorage | null): Cache1hMode;
 export declare function setCache1hPersistentEnabled(enabled: boolean, mode?: Cache1hMode, path?: string): Promise<AccountStorage>;
@@ -133,7 +141,7 @@ export declare class FallbackAccountManager {
     save(storage: AccountStorage): Promise<void>;
     startBackgroundRefresh(): void;
     stopBackgroundRefresh(): void;
-    getUsableFallbackAccounts(): Promise<OAuthAccount[]>;
+    getUsableFallbackAccounts(existingStorage?: AccountStorage | null): Promise<OAuthAccount[]>;
     markUsed(account: OAuthAccount): Promise<void>;
     accountPassesQuotaPolicy(account: OAuthAccount, storage: AccountStorage | null): boolean;
     refreshDueAccounts(): Promise<void>;

package/dist/accounts.js

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from 'node:crypto';
-import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { ClaudeOAuthRefreshError, refreshClaudeOAuthToken } from "./auth.js";
@@ -8,7 +8,8 @@ import { log } from "./logger.js";
 export const ACCOUNT_FILE_NAME = 'anthropic-auth.json';
 export const QUOTA_URL = 'https://api.anthropic.com/api/oauth/usage';
 const DEFAULT_FALLBACK_ON = [401, 403, 429];
-const DEFAULT_REFRESH_BEFORE_EXPIRY_MINUTES = 30;
+const MIN_REFRESH_BEFORE_EXPIRY_MINUTES = 240;
+const DEFAULT_REFRESH_BEFORE_EXPIRY_MINUTES = MIN_REFRESH_BEFORE_EXPIRY_MINUTES;
 const DEFAULT_REFRESH_INTERVAL_MINUTES = 10;
 const MIN_REFRESH_RETRY_DELAY_MS = 5 * 60_000;
 const MAX_REFRESH_RETRY_DELAY_MS = 60 * 60_000;
@@ -159,6 +160,51 @@ export async function saveAccounts(storage, path = getAccountStoragePath()) {
     });
     await rename(tempPath, path);
 }
+export async function acquireRefreshFileLock(options) {
+    const accountPath = options.path ?? getAccountStoragePath();
+    const lockDir = `${accountPath}.${options.name}.lock`;
+    const ownerPath = join(lockDir, 'owner.json');
+    const ownerId = randomUUID();
+    const now = options.now ?? Date.now;
+    async function tryAcquire() {
+        try {
+            await mkdir(lockDir, { mode: 0o700 });
+            await writeFile(ownerPath, `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}\n`, { encoding: 'utf8', mode: 0o600 });
+            return true;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            return false;
+        }
+    }
+    if (!(await tryAcquire())) {
+        try {
+            const owner = JSON.parse(await readFile(ownerPath, 'utf8'));
+            if (Number(owner?.expiresAt) > now())
+                return null;
+        }
+        catch {
+            // Broken owner metadata is treated as stale.
+        }
+        await rm(lockDir, { recursive: true, force: true }).catch(() => { });
+        if (!(await tryAcquire()))
+            return null;
+    }
+    return {
+        release: async () => {
+            try {
+                const owner = JSON.parse(await readFile(ownerPath, 'utf8'));
+                if (owner?.ownerId !== ownerId)
+                    return;
+            }
+            catch {
+                return;
+            }
+            await rm(lockDir, { recursive: true, force: true }).catch(() => { });
+        },
+    };
+}
 export function isCache1hPersistentlyEnabled(storage) {
     return storage?.claudeCache?.enabled === true;
 }
@@ -284,7 +330,7 @@ function refreshEnabled(storage) {
 function refreshBeforeExpiryMs(storage) {
     const minutes = storage?.refresh?.refreshBeforeExpiryMinutes ??
         DEFAULT_REFRESH_BEFORE_EXPIRY_MINUTES;
-    return Math.max(0, minutes) * 60_000;
+    return Math.max(MIN_REFRESH_BEFORE_EXPIRY_MINUTES, minutes) * 60_000;
 }
 export function getRefreshIntervalMs(storage) {
     const minutes = storage?.refresh?.intervalMinutes ?? DEFAULT_REFRESH_INTERVAL_MINUTES;
@@ -498,8 +544,8 @@ export class FallbackAccountManager {
         this.refreshTimer = null;
         this.quotaTimer = null;
     }
-    async getUsableFallbackAccounts() {
-        const storage = await this.load();
+    async getUsableFallbackAccounts(existingStorage) {
+        const storage = existingStorage !== undefined ? existingStorage : await this.load();
         if (!storage)
             return [];
         const usable = [];

package/dist/auth.d.ts

@@ -13,6 +13,8 @@ export declare function refreshClaudeOAuthToken(input: {
     refreshToken: string;
     fetchImpl?: typeof fetch;
     now?: () => number;
+    maxRetries?: number;
+    baseDelayMs?: number;
 }): Promise<ClaudeOAuthRefreshResult>;
 export type AuthorizationResult = {
     url: string;

package/dist/auth.js

@@ -10,32 +10,64 @@ export class ClaudeOAuthRefreshError extends Error {
         this.name = 'ClaudeOAuthRefreshError';
     }
 }
+function isTransientNetworkError(error) {
+    if (!(error instanceof Error))
+        return false;
+    const code = error.code;
+    return (error.message.includes('fetch failed') ||
+        code === 'ECONNRESET' ||
+        code === 'ECONNREFUSED' ||
+        code === 'ETIMEDOUT' ||
+        code === 'UND_ERR_CONNECT_TIMEOUT');
+}
 export async function refreshClaudeOAuthToken(input) {
     const fetchImpl = input.fetchImpl ?? fetch;
-    const response = await fetchImpl(TOKEN_URL, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            Accept: 'application/json',
-        },
-        body: JSON.stringify({
-            grant_type: 'refresh_token',
-            refresh_token: input.refreshToken,
-            client_id: CLIENT_ID,
-        }),
-    });
-    if (!response.ok) {
-        const body = await response.text().catch(() => '');
-        throw new ClaudeOAuthRefreshError(response.status, body);
+    const maxRetries = input.maxRetries ?? 2;
+    const baseDelayMs = input.baseDelayMs ?? 500;
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+        try {
+            if (attempt > 0) {
+                const delay = baseDelayMs * 2 ** (attempt - 1);
+                await new Promise((resolve) => setTimeout(resolve, delay));
+            }
+            const response = await fetchImpl(TOKEN_URL, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Accept: 'application/json',
+                },
+                body: JSON.stringify({
+                    grant_type: 'refresh_token',
+                    refresh_token: input.refreshToken,
+                    client_id: CLIENT_ID,
+                }),
+            });
+            if (!response.ok) {
+                if (response.status >= 500 && attempt < maxRetries) {
+                    await response.body?.cancel().catch(() => { });
+                    continue;
+                }
+                const body = await response.text().catch(() => '');
+                throw new ClaudeOAuthRefreshError(response.status, body);
+            }
+            const json = (await response.json());
+            const refreshedAt = input.now?.() ?? Date.now();
+            return {
+                access: json.access_token,
+                refresh: json.refresh_token ?? input.refreshToken,
+                expires: refreshedAt + json.expires_in * 1000,
+                expiresIn: json.expires_in,
+            };
+        }
+        catch (error) {
+            if (error instanceof ClaudeOAuthRefreshError)
+                throw error;
+            if (attempt < maxRetries && isTransientNetworkError(error))
+                continue;
+            throw error;
+        }
     }
-    const json = (await response.json());
-    const refreshedAt = input.now?.() ?? Date.now();
-    return {
-        access: json.access_token,
-        refresh: json.refresh_token ?? input.refreshToken,
-        expires: refreshedAt + json.expires_in * 1000,
-        expiresIn: json.expires_in,
-    };
+    throw new Error('Token refresh exhausted all retries');
 }
 function generateState() {
     return crypto.randomUUID().replace(/-/g, '');

package/dist/relay.d.ts

@@ -25,4 +25,4 @@ export declare function sendViaRelay(options: {
     affinity?: string | null;
     optimisticResponse?: boolean;
 }): Promise<Response>;
-export declare const WORKER_SCRIPT = "\nasync function hashBody(body) {\n  const bytes = new TextEncoder().encode(body)\n  const digest = await crypto.subtle.digest('SHA-256', bytes)\n  const hex = [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('')\n  return 'sha256:' + hex\n}\n\nfunction applyPatch(base, patch) {\n  return base.slice(0, patch.start) + patch.insert + base.slice(patch.start + patch.deleteCount)\n}\n\nfunction applyPatchSet(base, patch) {\n  if (!Array.isArray(patch)) return applyPatch(base, patch)\n  if (patch.length === 0) return base\n\n  let result = ''\n  let cursor = 0\n  for (const item of patch) {\n    if (item.start < cursor) return { error: 'overlapping patch', status: 400 }\n    result += base.slice(cursor, item.start)\n    result += item.insert\n    cursor = item.start + item.deleteCount\n  }\n  return result + base.slice(cursor)\n}\n\nasync function readState(env, affinity) {\n  const raw = await env.RELAY_STATE.get('session:' + affinity)\n  return raw ? JSON.parse(raw) : null\n}\n\nasync function writeState(env, affinity, state) {\n  await env.RELAY_STATE.put('session:' + affinity, JSON.stringify(state), { expirationTtl: 86400 })\n}\n\nasync function resolveBody(env, payload) {\n  if (payload.mode === 'full_sync') return payload.body\n  if (payload.mode === 'patch') {\n    const state = await readState(env, payload.affinity)\n    if (!state || state.hash !== payload.base_hash) {\n      return { error: 'state mismatch', status: 409 }\n    }\n    return applyPatchSet(state.body, payload.patch)\n  }\n  return { error: 'unknown mode', status: 400 }\n}\n\nasync function prepareUpstream(env, payload) {\n  if ((payload.protocol !== 1 && payload.protocol !== 2) || payload.type !== 'request' || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {\n    return { error: 'invalid payload', status: 400 }\n  }\n\n  const body = await resolveBody(env, payload)\n  if (body && typeof body === 'object' && 'error' in body) return body\n\n  if (typeof body !== 'string' || (await hashBody(body)) !== payload.next_hash) {\n    return { error: 'hash mismatch', status: 409 }\n  }\n\n  await writeState(env, payload.affinity, { body, hash: payload.next_hash, revision: payload.revision })\n  console.log(JSON.stringify({\n    relay: 'opencode-anthropic-auth',\n    transport: 'relay',\n    mode: payload.mode,\n    revision: payload.revision,\n    affinity: String(payload.affinity).slice(0, 12),\n    bodyBytes: body.length,\n  }))\n\n  return { body }\n}\n\nfunction resolveBodyFromState(state, payload) {\n  if (payload.mode === 'full_sync') return payload.body\n  if (payload.mode === 'patch') {\n    if (!state || state.hash !== payload.base_hash) {\n      return { error: 'state mismatch', status: 409 }\n    }\n    return applyPatchSet(state.body, payload.patch)\n  }\n  return { error: 'unknown mode', status: 400 }\n}\n\nfunction deferWorkerTask(task) {\n  return new Promise((resolve) => setTimeout(resolve, 0)).then(task)\n}\n\nfunction checkpointWebSocketState(env, payload, body, nextState) {\n  return deferWorkerTask(async () => {\n    try {\n      if ((await hashBody(body)) !== payload.next_hash) {\n        throw new Error('hash mismatch')\n      }\n      await writeState(env, payload.affinity, nextState)\n    } catch (error) {\n      console.log(JSON.stringify({\n        relay: 'opencode-anthropic-auth',\n        transport: 'websocket',\n        event: 'checkpoint_write_failed',\n        affinity: String(payload.affinity).slice(0, 12),\n        message: error instanceof Error ? error.message : String(error),\n      }))\n    }\n  })\n}\n\nasync function prepareWebSocketUpstream(env, state, payload) {\n  if (payload.protocol !== 2 || payload.type !== 'request' || !payload.id || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {\n    return { error: 'invalid payload', status: 400 }\n  }\n\n  const body = resolveBodyFromState(state, payload)\n  if (body && typeof body === 'object' && 'error' in body) return body\n  if (typeof body !== 'string') return { error: 'invalid body', status: 400 }\n  if ((await hashBody(body)) !== payload.next_hash) {\n    return { error: 'hash mismatch', status: 409 }\n  }\n\n  const nextState = { body, hash: payload.next_hash, revision: payload.revision }\n  const checkpoint = checkpointWebSocketState(env, payload, body, nextState)\n  const logAccepted = () => console.log(JSON.stringify({\n    relay: 'opencode-anthropic-auth',\n    transport: 'websocket',\n    mode: payload.mode,\n    revision: payload.revision,\n    affinity: String(payload.affinity).slice(0, 12),\n    bodyBytes: body.length,\n  }))\n\n  return { body, state: nextState, checkpoint, logAccepted }\n}\n\nfunction headersToObject(headers) {\n  const result = {}\n  for (const [key, value] of headers.entries()) result[key] = value\n  return result\n}\n\nasync function handleRelayPayload(env, payload) {\n  const prepared = await prepareUpstream(env, payload)\n  if (prepared.error) return prepared\n  const upstream = await fetch(payload.upstream.url, {\n    method: payload.upstream.method || 'POST',\n    headers: payload.upstream.headers,\n    body: prepared.body,\n  })\n  return { upstream }\n}\n\nasync function handleWebSocket(socket, env, ctx, payload, getState, setState) {\n  const heartbeat = setInterval(() => {\n    try {\n      socket.send(JSON.stringify({ protocol: 2, type: 'keepalive' }))\n    } catch {\n      clearInterval(heartbeat)\n    }\n  }, 5000)\n  try {\n    const result = await prepareWebSocketUpstream(env, getState(), payload)\n    if (result.error) {\n      socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: result.status, message: result.error }))\n      return\n    }\n\n    setState(result.state)\n    socket.send(JSON.stringify({ protocol: 2, type: 'accepted', id: payload.id, hash: result.state.hash, revision: result.state.revision }))\n    ctx?.waitUntil?.(deferWorkerTask(result.logAccepted))\n\n    const upstreamPromise = fetch(payload.upstream.url, {\n      method: payload.upstream.method || 'POST',\n      headers: payload.upstream.headers,\n      body: result.body,\n    })\n    ctx?.waitUntil?.(result.checkpoint)\n    const upstream = await upstreamPromise\n    socket.send(JSON.stringify({\n      protocol: 2,\n      type: 'response_start',\n      id: payload.id,\n      status: upstream.status,\n      statusText: upstream.statusText,\n      headers: headersToObject(upstream.headers),\n    }))\n\n    const reader = upstream.body?.getReader()\n    if (reader) {\n      while (true) {\n        const { done, value } = await reader.read()\n        if (done) break\n        socket.send(value)\n      }\n    }\n    socket.send(JSON.stringify({ protocol: 2, type: 'done', id: payload.id }))\n  } catch (error) {\n    socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: 500, message: error instanceof Error ? error.message : String(error) }))\n  } finally {\n    clearInterval(heartbeat)\n  }\n}\n\nexport default {\n  async fetch(request, env, ctx) {\n    if (request.headers.get('Upgrade') === 'websocket') {\n      const url = new URL(request.url)\n      const token = url.searchParams.get('token')\n      const affinity = url.searchParams.get('affinity')\n      if (token !== env.RELAY_TOKEN) return new Response('unauthorized', { status: 401 })\n      if (!affinity) return new Response('missing affinity', { status: 400 })\n      const pair = new WebSocketPair()\n      const client = pair[0]\n      const server = pair[1]\n      server.binaryType = 'arraybuffer'\n      let state = null\n      let ready = false\n      server.accept()\n      const loadState = readState(env, affinity).then((loadedState) => {\n        state = loadedState\n        ready = true\n        server.send(JSON.stringify({\n          protocol: 2,\n          type: 'ready',\n          state: state ? { hash: state.hash, revision: state.revision } : null,\n        }))\n      }).catch((error) => {\n        server.send(JSON.stringify({ protocol: 2, type: 'error', status: 500, message: error instanceof Error ? error.message : String(error) }))\n        server.close(1011, 'state load failed')\n      })\n      ctx?.waitUntil?.(loadState)\n      if (!ctx?.waitUntil) void loadState\n      let busy = false\n      server.addEventListener('message', (event) => {\n        if (!ready) {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 425, message: 'relay state is not ready' }))\n          return\n        }\n        if (busy) {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 429, message: 'request already in flight' }))\n          return\n        }\n        let payload\n        try {\n          payload = JSON.parse(event.data)\n        } catch {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 400, message: 'invalid JSON payload' }))\n          return\n        }\n        payload.affinity = affinity\n        busy = true\n        const run = handleWebSocket(server, env, ctx, payload, () => state, (nextState) => { state = nextState }).finally(() => { busy = false })\n        ctx?.waitUntil?.(run)\n        if (!ctx?.waitUntil) void run\n      })\n      return new Response(null, { status: 101, webSocket: client })\n    }\n\n    if (request.method === 'GET') return new Response('ok')\n    if (request.method !== 'POST') return new Response('method not allowed', { status: 405 })\n    if (request.headers.get('x-relay-token') !== env.RELAY_TOKEN) {\n      return new Response('unauthorized', { status: 401 })\n    }\n\n    const payload = await request.json()\n    const result = await handleRelayPayload(env, payload)\n    if (result.error) return Response.json({ error: result.error }, { status: result.status })\n\n    const upstream = result.upstream\n    return new Response(upstream.body, {\n      status: upstream.status,\n      statusText: upstream.statusText,\n      headers: upstream.headers,\n    })\n  },\n}\n";
+export declare const WORKER_SCRIPT = "\nasync function hashBody(body) {\n  const bytes = new TextEncoder().encode(body)\n  const digest = await crypto.subtle.digest('SHA-256', bytes)\n  const hex = [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('')\n  return 'sha256:' + hex\n}\n\nfunction applyPatch(base, patch) {\n  return base.slice(0, patch.start) + patch.insert + base.slice(patch.start + patch.deleteCount)\n}\n\nfunction applyPatchSet(base, patch) {\n  if (!Array.isArray(patch)) return applyPatch(base, patch)\n  if (patch.length === 0) return base\n\n  let result = ''\n  let cursor = 0\n  for (const item of patch) {\n    if (item.start < cursor) return { error: 'overlapping patch', status: 400 }\n    result += base.slice(cursor, item.start)\n    result += item.insert\n    cursor = item.start + item.deleteCount\n  }\n  return result + base.slice(cursor)\n}\n\nasync function readState(env, affinity) {\n  const raw = await env.RELAY_STATE.get('session:' + affinity)\n  return raw ? JSON.parse(raw) : null\n}\n\nasync function writeState(env, affinity, state) {\n  await env.RELAY_STATE.put('session:' + affinity, JSON.stringify(state), { expirationTtl: 86400 })\n}\n\nasync function resolveBody(env, payload) {\n  if (payload.mode === 'full_sync') return payload.body\n  if (payload.mode === 'patch') {\n    const state = await readState(env, payload.affinity)\n    if (!state || state.hash !== payload.base_hash) {\n      return { error: 'state mismatch', status: 409 }\n    }\n    return applyPatchSet(state.body, payload.patch)\n  }\n  return { error: 'unknown mode', status: 400 }\n}\n\nasync function prepareUpstream(env, payload) {\n  if ((payload.protocol !== 1 && payload.protocol !== 2) || payload.type !== 'request' || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {\n    return { error: 'invalid payload', status: 400 }\n  }\n\n  const body = await resolveBody(env, payload)\n  if (body && typeof body === 'object' && 'error' in body) return body\n\n  if (typeof body !== 'string' || (await hashBody(body)) !== payload.next_hash) {\n    return { error: 'hash mismatch', status: 409 }\n  }\n\n  const stateWrite = writeState(env, payload.affinity, { body, hash: payload.next_hash, revision: payload.revision }).catch(() => {})\n  console.log(JSON.stringify({\n    relay: 'opencode-anthropic-auth',\n    transport: 'relay',\n    mode: payload.mode,\n    revision: payload.revision,\n    affinity: String(payload.affinity).slice(0, 12),\n    bodyBytes: body.length,\n  }))\n\n  return { body, stateWrite }\n}\n\nfunction resolveBodyFromState(state, payload) {\n  if (payload.mode === 'full_sync') return payload.body\n  if (payload.mode === 'patch') {\n    if (!state || state.hash !== payload.base_hash) {\n      return { error: 'state mismatch', status: 409 }\n    }\n    return applyPatchSet(state.body, payload.patch)\n  }\n  return { error: 'unknown mode', status: 400 }\n}\n\nfunction deferWorkerTask(task) {\n  return new Promise((resolve) => setTimeout(resolve, 0)).then(task)\n}\n\nfunction checkpointWebSocketState(env, payload, body, nextState) {\n  return deferWorkerTask(async () => {\n    try {\n      if ((await hashBody(body)) !== payload.next_hash) {\n        throw new Error('hash mismatch')\n      }\n      await writeState(env, payload.affinity, nextState)\n    } catch (error) {\n      console.log(JSON.stringify({\n        relay: 'opencode-anthropic-auth',\n        transport: 'websocket',\n        event: 'checkpoint_write_failed',\n        affinity: String(payload.affinity).slice(0, 12),\n        message: error instanceof Error ? error.message : String(error),\n      }))\n    }\n  })\n}\n\nasync function prepareWebSocketUpstream(env, state, payload) {\n  if (payload.protocol !== 2 || payload.type !== 'request' || !payload.id || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {\n    return { error: 'invalid payload', status: 400 }\n  }\n\n  const body = resolveBodyFromState(state, payload)\n  if (body && typeof body === 'object' && 'error' in body) return body\n  if (typeof body !== 'string') return { error: 'invalid body', status: 400 }\n  if ((await hashBody(body)) !== payload.next_hash) {\n    return { error: 'hash mismatch', status: 409 }\n  }\n\n  const nextState = { body, hash: payload.next_hash, revision: payload.revision }\n  const checkpoint = checkpointWebSocketState(env, payload, body, nextState)\n  const logAccepted = () => console.log(JSON.stringify({\n    relay: 'opencode-anthropic-auth',\n    transport: 'websocket',\n    mode: payload.mode,\n    revision: payload.revision,\n    affinity: String(payload.affinity).slice(0, 12),\n    bodyBytes: body.length,\n  }))\n\n  return { body, state: nextState, checkpoint, logAccepted }\n}\n\nfunction headersToObject(headers) {\n  const result = {}\n  for (const [key, value] of headers.entries()) result[key] = value\n  return result\n}\n\nasync function handleRelayPayload(env, payload) {\n  const prepared = await prepareUpstream(env, payload)\n  if (prepared.error) return prepared\n  const upstream = await fetch(payload.upstream.url, {\n    method: payload.upstream.method || 'POST',\n    headers: payload.upstream.headers,\n    body: prepared.body,\n  })\n  return { upstream, stateWrite: prepared.stateWrite }\n}\n\nasync function handleWebSocket(socket, env, ctx, payload, getState, setState) {\n  const heartbeat = setInterval(() => {\n    try {\n      socket.send(JSON.stringify({ protocol: 2, type: 'keepalive' }))\n    } catch {\n      clearInterval(heartbeat)\n    }\n  }, 15000)\n  try {\n    const result = await prepareWebSocketUpstream(env, getState(), payload)\n    if (result.error) {\n      socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: result.status, message: result.error }))\n      return\n    }\n\n    setState(result.state)\n    socket.send(JSON.stringify({ protocol: 2, type: 'accepted', id: payload.id, hash: result.state.hash, revision: result.state.revision }))\n    ctx?.waitUntil?.(deferWorkerTask(result.logAccepted))\n\n    const upstreamPromise = fetch(payload.upstream.url, {\n      method: payload.upstream.method || 'POST',\n      headers: payload.upstream.headers,\n      body: result.body,\n    })\n    ctx?.waitUntil?.(result.checkpoint)\n    const upstream = await upstreamPromise\n    socket.send(JSON.stringify({\n      protocol: 2,\n      type: 'response_start',\n      id: payload.id,\n      status: upstream.status,\n      statusText: upstream.statusText,\n      headers: headersToObject(upstream.headers),\n    }))\n\n    const reader = upstream.body?.getReader()\n    if (reader) {\n      while (true) {\n        const { done, value } = await reader.read()\n        if (done) break\n        socket.send(value)\n      }\n    }\n    socket.send(JSON.stringify({ protocol: 2, type: 'done', id: payload.id }))\n  } catch (error) {\n    socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: 500, message: error instanceof Error ? error.message : String(error) }))\n  } finally {\n    clearInterval(heartbeat)\n  }\n}\n\nexport default {\n  async fetch(request, env, ctx) {\n    if (request.headers.get('Upgrade') === 'websocket') {\n      const url = new URL(request.url)\n      const token = url.searchParams.get('token')\n      const affinity = url.searchParams.get('affinity')\n      if (token !== env.RELAY_TOKEN) return new Response('unauthorized', { status: 401 })\n      if (!affinity) return new Response('missing affinity', { status: 400 })\n      const pair = new WebSocketPair()\n      const client = pair[0]\n      const server = pair[1]\n      server.binaryType = 'arraybuffer'\n      let state = null\n      let ready = false\n      server.accept()\n      const loadState = readState(env, affinity).then((loadedState) => {\n        state = loadedState\n        ready = true\n        server.send(JSON.stringify({\n          protocol: 2,\n          type: 'ready',\n          state: state ? { hash: state.hash, revision: state.revision } : null,\n        }))\n      }).catch((error) => {\n        server.send(JSON.stringify({ protocol: 2, type: 'error', status: 500, message: error instanceof Error ? error.message : String(error) }))\n        server.close(1011, 'state load failed')\n      })\n      ctx?.waitUntil?.(loadState)\n      if (!ctx?.waitUntil) void loadState\n      let busy = false\n      server.addEventListener('message', (event) => {\n        if (!ready) {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 425, message: 'relay state is not ready' }))\n          return\n        }\n        if (busy) {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 429, message: 'request already in flight' }))\n          return\n        }\n        let payload\n        try {\n          payload = JSON.parse(event.data)\n        } catch {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 400, message: 'invalid JSON payload' }))\n          return\n        }\n        payload.affinity = affinity\n        busy = true\n        const run = handleWebSocket(server, env, ctx, payload, () => state, (nextState) => { state = nextState }).finally(() => { busy = false })\n        ctx?.waitUntil?.(run)\n        if (!ctx?.waitUntil) void run\n      })\n      return new Response(null, { status: 101, webSocket: client })\n    }\n\n    if (request.method === 'GET') {\n      return Response.json({ status: 'ok', transports: ['http', 'websocket'] })\n    }\n    if (request.method !== 'POST') return new Response('method not allowed', { status: 405 })\n    if (request.headers.get('x-relay-token') !== env.RELAY_TOKEN) {\n      return new Response('unauthorized', { status: 401 })\n    }\n\n    try {\n      const payload = await request.json()\n      const result = await handleRelayPayload(env, payload)\n      if (result.error) return Response.json({ error: result.error }, { status: result.status })\n\n      if (result.stateWrite) ctx.waitUntil(result.stateWrite)\n\n      const upstream = result.upstream\n      return new Response(upstream.body, {\n        status: upstream.status,\n        statusText: upstream.statusText,\n        headers: upstream.headers,\n      })\n    } catch (error) {\n      return Response.json(\n        { error: error instanceof Error ? error.message : 'internal relay error' },\n        { status: 502 },\n      )\n    }\n  },\n}\n";

package/dist/relay.js

@@ -544,6 +544,17 @@ class PersistentRelaySession {
             return;
         }
         if (message.type === 'error') {
+            // If an optimistic response is already streaming (responseStartedAt is
+            // set), the pending promise was already resolved — calling failPending
+            // would reject a settled promise and leave the stream hanging. Instead,
+            // inject an SSE error event and close cleanly.
+            if (pending.optimisticResponse && pending.responseStartedAt != null) {
+                relayLog(`websocket relay error during optimistic response session=${shortAffinity(this.affinity)} request=${pending.payload.id} status=${message.status} message=${message.message || 'unknown'}`);
+                pending.streamController?.enqueue(new TextEncoder().encode(`event: error\ndata: ${JSON.stringify({ type: 'error', error: { type: 'relay_error', message: message.message || 'relay error' } })}\n\n`));
+                this.finishPending();
+                this.socket?.close();
+                return;
+            }
             if (message.status === 409 &&
                 this.retryPendingBeforeResponse(pending, message.message || 'state mismatch')) {
                 return;
@@ -718,7 +729,7 @@ async function prepareUpstream(env, payload) {
     return { error: 'hash mismatch', status: 409 }
   }
 
-  await writeState(env, payload.affinity, { body, hash: payload.next_hash, revision: payload.revision })
+  const stateWrite = writeState(env, payload.affinity, { body, hash: payload.next_hash, revision: payload.revision }).catch(() => {})
   console.log(JSON.stringify({
     relay: 'opencode-anthropic-auth',
     transport: 'relay',
@@ -728,7 +739,7 @@ async function prepareUpstream(env, payload) {
     bodyBytes: body.length,
   }))
 
-  return { body }
+  return { body, stateWrite }
 }
 
 function resolveBodyFromState(state, payload) {
@@ -805,7 +816,7 @@ async function handleRelayPayload(env, payload) {
     headers: payload.upstream.headers,
     body: prepared.body,
   })
-  return { upstream }
+  return { upstream, stateWrite: prepared.stateWrite }
 }
 
 async function handleWebSocket(socket, env, ctx, payload, getState, setState) {
@@ -815,7 +826,7 @@ async function handleWebSocket(socket, env, ctx, payload, getState, setState) {
     } catch {
       clearInterval(heartbeat)
     }
-  }, 5000)
+  }, 15000)
   try {
     const result = await prepareWebSocketUpstream(env, getState(), payload)
     if (result.error) {
@@ -914,22 +925,33 @@ export default {
       return new Response(null, { status: 101, webSocket: client })
     }
 
-    if (request.method === 'GET') return new Response('ok')
+    if (request.method === 'GET') {
+      return Response.json({ status: 'ok', transports: ['http', 'websocket'] })
+    }
     if (request.method !== 'POST') return new Response('method not allowed', { status: 405 })
     if (request.headers.get('x-relay-token') !== env.RELAY_TOKEN) {
       return new Response('unauthorized', { status: 401 })
     }
 
-    const payload = await request.json()
-    const result = await handleRelayPayload(env, payload)
-    if (result.error) return Response.json({ error: result.error }, { status: result.status })
+    try {
+      const payload = await request.json()
+      const result = await handleRelayPayload(env, payload)
+      if (result.error) return Response.json({ error: result.error }, { status: result.status })
 
-    const upstream = result.upstream
-    return new Response(upstream.body, {
-      status: upstream.status,
-      statusText: upstream.statusText,
-      headers: upstream.headers,
-    })
+      if (result.stateWrite) ctx.waitUntil(result.stateWrite)
+
+      const upstream = result.upstream
+      return new Response(upstream.body, {
+        status: upstream.status,
+        statusText: upstream.statusText,
+        headers: upstream.headers,
+      })
+    } catch (error) {
+      return Response.json(
+        { error: error instanceof Error ? error.message : 'internal relay error' },
+        { status: 502 },
+      )
+    }
   },
 }
 `;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "1.1.2",
+  "version": "1.2.0",
   "type": "module",
   "repository": {
     "type": "git",