@cortexkit/anthropic-auth-core 1.10.3 → 1.11.0

package/dist/auth.d.ts

@@ -1,8 +1,16 @@
+export declare function parseRetryAfterHeader(value: string | undefined | null): number | undefined;
 export declare class ClaudeOAuthRefreshError extends Error {
     readonly status: number;
     readonly body: string;
     /** Parsed Retry-After value in seconds, if the server provided one. */
     readonly retryAfter: number | undefined;
+    /**
+     * Duck-typed marker: any error carrying `isRefreshError: true` arms the
+     * refresh backoff in consumers that receive it (recordQuotaRefreshError).
+     * Provider-agnostic — shared-core extraction of anthropic-auth and
+     * openai-auth relies on this field instead of instanceof.
+     */
+    readonly isRefreshError = true;
     constructor(status: number, body: string, retryAfterHeader?: string | null);
 }
 export type ClaudeOAuthRefreshResult = {

package/dist/auth.js

@@ -1,6 +1,6 @@
 import { AUTHORIZE_URLS, AXIOS_USER_AGENT, CLIENT_ID, CODE_CALLBACK_URL, OAUTH_SCOPES, REFRESH_SCOPE, TOKEN_URL, } from "./constants.js";
 import { generatePKCE } from "./pkce.js";
-function parseRetryAfterHeader(value) {
+export function parseRetryAfterHeader(value) {
     if (!value)
         return undefined;
     const seconds = Number(value);
@@ -18,6 +18,13 @@ export class ClaudeOAuthRefreshError extends Error {
     body;
     /** Parsed Retry-After value in seconds, if the server provided one. */
     retryAfter;
+    /**
+     * Duck-typed marker: any error carrying `isRefreshError: true` arms the
+     * refresh backoff in consumers that receive it (recordQuotaRefreshError).
+     * Provider-agnostic — shared-core extraction of anthropic-auth and
+     * openai-auth relies on this field instead of instanceof.
+     */
+    isRefreshError = true;
     constructor(status, body, retryAfterHeader) {
         super(`Claude OAuth refresh failed: ${status} — ${body}`);
         this.status = status;

package/dist/cachekeep.d.ts

@@ -21,6 +21,9 @@ export type CacheKeepCommandAction = {
     endHour: number;
 } | {
     type: 'usage';
+} | {
+    type: 'subagents';
+    enabled: boolean;
 };
 export type CacheKeepStatus = {
     enabled: boolean;
@@ -68,7 +71,6 @@ export declare class CacheKeepManager {
         fetchImpl?: typeof fetch;
         now?: () => number;
         prepareHeaders?: (headers: Headers, target: CacheKeepTarget) => Promise<Headers> | Headers;
-        log?: (message: string, data?: Record<string, unknown>) => void;
     });
     start(): void;
     stop(): void;

package/dist/cachekeep.js

@@ -1,5 +1,6 @@
 import { signRequestBody } from "./cch.js";
 import { orderClaudeCodeBody } from "./claude-code.js";
+import { logger } from "./logger.js";
 export const CLAUDE_CACHE_KEEP_COMMAND_NAME = 'claude-cachekeep';
 export const CACHE_KEEP_TTL_MS = 60 * 60_000;
 export const CACHE_KEEP_PREWARM_LEAD_MS = 5 * 60_000;
@@ -22,6 +23,10 @@ export function parseCacheKeepCommandAction(input) {
         return { type: 'status' };
     if (trimmed === 'off')
         return { type: 'disable' };
+    if (trimmed === 'subagents on')
+        return { type: 'subagents', enabled: true };
+    if (trimmed === 'subagents off')
+        return { type: 'subagents', enabled: false };
     const match = /^(\d{1,2})-(\d{1,2})$/.exec(trimmed);
     if (!match)
         return { type: 'usage' };
@@ -132,6 +137,15 @@ export function executeCacheKeepCommand(input) {
             }),
         ].join('\n');
     }
+    if (action.type === 'subagents') {
+        return [
+            STATUS_TITLE,
+            '',
+            buildCacheKeepStatusSummary(status),
+            '',
+            `Subagent tracking: ${action.enabled ? 'enabled' : 'disabled'}`,
+        ].join('\n');
+    }
     return [USAGE_TITLE, '', USAGE, '', buildCacheKeepStatusSummary(status)].join('\n');
 }
 function hasExplicitCacheControl(value) {
@@ -185,9 +199,10 @@ export class CacheKeepManager {
     start() {
         if (this.timer)
             return;
+        logger.debug('cachekeep', 'started');
         this.timer = setInterval(() => {
             void this.tick().catch((error) => {
-                this.options.log?.('[cachekeep] tick failed', {
+                logger.warn('cachekeep', 'tick failed', {
                     error: error instanceof Error ? error.message : String(error),
                 });
             });
@@ -196,8 +211,10 @@ export class CacheKeepManager {
             this.timer.unref();
     }
     stop() {
-        if (this.timer)
-            clearInterval(this.timer);
+        if (!this.timer)
+            return;
+        logger.debug('cachekeep', 'stopped');
+        clearInterval(this.timer);
         this.timer = null;
     }
     stats(window, now = this.options.now?.() ?? Date.now()) {
@@ -289,6 +306,7 @@ export class CacheKeepManager {
             return;
         if (!isWithinCacheKeepWindow(window, new Date(now)))
             return;
+        logger.debug('cachekeep', 'fired', { targets: this.targets.size });
         const dueAt = now + CACHE_KEEP_PREWARM_LEAD_MS;
         for (const target of this.targets.values()) {
             if (target.cacheExpiresAt > dueAt)
@@ -299,7 +317,7 @@ export class CacheKeepManager {
     async prewarm(target, now) {
         const prewarm = await buildCacheKeepPrewarmBody(target.bodyText);
         if (!prewarm.ok) {
-            this.options.log?.('[cachekeep] prewarm skipped', {
+            logger.debug('cachekeep', 'prewarm skipped', {
                 session: target.id,
                 reason: prewarm.reason,
             });
@@ -319,7 +337,7 @@ export class CacheKeepManager {
             body: prewarm.bodyText,
         });
         if (!response.ok) {
-            this.options.log?.('[cachekeep] prewarm failed', {
+            logger.warn('cachekeep', 'prewarm failed', {
                 session: target.id,
                 status: response.status,
                 body: await response.text().catch(() => ''),
@@ -327,8 +345,17 @@ export class CacheKeepManager {
             target.cacheExpiresAt = now + CACHE_KEEP_PREWARM_LEAD_MS + 5 * 60_000;
             return;
         }
-        await response.body?.cancel().catch(() => { });
+        const data = (await response.json().catch(() => null));
+        const usage = data?.usage;
         target.cacheExpiresAt = now + CACHE_KEEP_TTL_MS;
-        this.options.log?.('[cachekeep] prewarm succeeded', { session: target.id });
+        if (usage) {
+            logger.debug('cachekeep', 'prewarm succeeded', {
+                session: target.id,
+                usage,
+            });
+        }
+        else {
+            logger.debug('cachekeep', 'prewarm succeeded', { session: target.id });
+        }
     }
 }

package/dist/commands/account.d.ts

@@ -0,0 +1,56 @@
+import type { AccountStorage } from '../accounts.ts';
+export declare const CLAUDE_ACCOUNT_COMMAND_NAME = "claude-account";
+export type AccountCommandAction = {
+    type: 'status';
+} | {
+    type: 'enable';
+    id: string;
+} | {
+    type: 'disable';
+    id: string;
+} | {
+    type: 'remove';
+    id: string;
+} | {
+    type: 'move-up';
+    id: string;
+} | {
+    type: 'move-down';
+    id: string;
+} | {
+    type: 'add-apikey';
+    apiKey: string;
+    label?: string;
+    baseURL?: string;
+    authHeader?: 'authorization-bearer' | 'x-api-key';
+} | {
+    type: 'add-oauth-start';
+} | {
+    type: 'add-oauth-finish';
+    code: string;
+    label?: string;
+} | {
+    type: 'usage';
+};
+export declare function parseAccountCommandAction(argumentsText: string): AccountCommandAction;
+export interface AccountListItem {
+    id: string;
+    label: string;
+    role: 'main' | 'fallback';
+    enabled: boolean;
+    quotaPercent: number | null;
+}
+export declare function buildAccountList(storage: AccountStorage): AccountListItem[];
+export declare function executeAccountCommand(input: {
+    argumentsText: string;
+    storage: AccountStorage;
+}): {
+    text: string;
+    updated?: {
+        id: string;
+        action: 'enable' | 'disable' | 'remove' | 'reorder';
+        enabled?: boolean;
+        previousOrder?: string[];
+        newOrder?: string[];
+    };
+};

package/dist/commands/account.js

@@ -0,0 +1,219 @@
+export const CLAUDE_ACCOUNT_COMMAND_NAME = 'claude-account';
+export function parseAccountCommandAction(argumentsText) {
+    const parts = argumentsText.trim().split(/\s+/).filter(Boolean);
+    if (parts.length === 0)
+        return { type: 'status' };
+    const action = parts[0];
+    const rest = parts.slice(1).join(' ');
+    if (action === 'enable' && rest)
+        return { type: 'enable', id: rest };
+    if (action === 'disable' && rest)
+        return { type: 'disable', id: rest };
+    if (action === 'remove' && rest)
+        return { type: 'remove', id: rest };
+    if (action === 'move-up' && rest)
+        return { type: 'move-up', id: rest };
+    if (action === 'move-down' && rest)
+        return { type: 'move-down', id: rest };
+    if (action === 'add-apikey' && rest) {
+        let remaining = rest;
+        let baseURL;
+        let authHeader;
+        // Parse --base-url flag
+        const baseUrlMatch = remaining.match(/--base-url\s+(\S+)/);
+        if (baseUrlMatch) {
+            baseURL = baseUrlMatch[1];
+            remaining = remaining.replace(baseUrlMatch[0], '').trim();
+        }
+        // Parse --auth-header flag
+        const authMatch = remaining.match(/--auth-header\s+(authorization-bearer|x-api-key)/);
+        if (authMatch) {
+            authHeader = authMatch[1];
+            remaining = remaining.replace(authMatch[0], '').trim();
+        }
+        // Parse --label flag
+        let label;
+        const labelMatch = remaining.match(/--label\s+(.+)/);
+        if (labelMatch) {
+            label = labelMatch[1]?.trim() || undefined;
+            remaining = remaining.replace(labelMatch[0], '').trim();
+        }
+        // First remaining token is the API key; rest (if any) is label
+        const firstSpace = remaining.indexOf(' ');
+        if (firstSpace === -1) {
+            if (!remaining)
+                return { type: 'usage' };
+            return {
+                type: 'add-apikey',
+                apiKey: remaining,
+                baseURL,
+                authHeader,
+                label,
+            };
+        }
+        const apiKey = remaining.slice(0, firstSpace);
+        const tail = remaining.slice(firstSpace + 1).trim();
+        return {
+            type: 'add-apikey',
+            apiKey,
+            label: label ?? (tail || undefined),
+            baseURL,
+            authHeader,
+        };
+    }
+    if (action === 'add-oauth-start')
+        return { type: 'add-oauth-start' };
+    if (action === 'add-oauth-finish' && rest) {
+        let remaining = rest;
+        // Parse --label flag (mirrors add-apikey). The OAuth code is opaque (may
+        // contain a #state segment) so the label is collected via the flag, never
+        // positionally.
+        let label;
+        const labelMatch = remaining.match(/--label\s+(.+)/);
+        if (labelMatch) {
+            label = labelMatch[1]?.trim() || undefined;
+            remaining = remaining.replace(labelMatch[0], '').trim();
+        }
+        if (!remaining)
+            return { type: 'usage' };
+        return { type: 'add-oauth-finish', code: remaining, label };
+    }
+    return { type: 'usage' };
+}
+export function buildAccountList(storage) {
+    const list = [];
+    const fiveHour = storage.quota?.mainQuota?.five_hour;
+    list.push({
+        id: 'main',
+        label: storage.main?.provider === 'anthropic' ? 'OpenCode anthropic' : 'Main',
+        role: 'main',
+        enabled: true,
+        quotaPercent: fiveHour?.usedPercent ?? null,
+    });
+    for (const account of storage.accounts) {
+        const fiveHourQuota = account.quota?.five_hour;
+        list.push({
+            id: account.id,
+            label: account.label ?? account.id,
+            role: 'fallback',
+            enabled: account.enabled !== false,
+            quotaPercent: fiveHourQuota?.usedPercent ?? null,
+        });
+    }
+    return list;
+}
+const USAGE_TEXT = [
+    'Usage:',
+    '  /claude-account                       Show account list',
+    '  /claude-account enable <id>           Enable a fallback account',
+    '  /claude-account disable <id>          Disable a fallback account',
+    '  /claude-account remove <id>           Remove a fallback account',
+    '  /claude-account move-up <id>          Move a fallback account up',
+    '  /claude-account move-down <id>        Move a fallback account down',
+    '  /claude-account add-apikey <key>      Add an API key fallback account',
+    '  /claude-account add-oauth-start       Start OAuth device flow',
+    '  /claude-account add-oauth-finish <code>  Complete OAuth flow',
+].join('\n');
+export function executeAccountCommand(input) {
+    const action = parseAccountCommandAction(input.argumentsText);
+    const accounts = input.storage.accounts;
+    const mainId = 'main';
+    if (action.type === 'status') {
+        const list = buildAccountList(input.storage);
+        const lines = ['## Claude Accounts', ''];
+        for (const a of list) {
+            const pct = a.quotaPercent != null ? ` ${Math.round(a.quotaPercent)}%` : '';
+            const status = !a.enabled ? ' (disabled)' : '';
+            lines.push(`- **${a.label}** [${a.role}]${status}${pct}`);
+        }
+        lines.push('', USAGE_TEXT);
+        return { text: lines.join('\n') };
+    }
+    if (action.type === 'usage') {
+        return { text: USAGE_TEXT };
+    }
+    if (action.type === 'add-apikey') {
+        return { text: 'add-apikey' };
+    }
+    if (action.type === 'add-oauth-start') {
+        return { text: 'add-oauth-start' };
+    }
+    if (action.type === 'add-oauth-finish') {
+        return { text: 'add-oauth-finish' };
+    }
+    const id = action.id;
+    if (id === mainId) {
+        return {
+            text: `Cannot ${action.type} the main account (OpenCode managed).`,
+        };
+    }
+    if (action.type === 'enable' || action.type === 'disable') {
+        const target = accounts.find((a) => a.id === id);
+        if (!target) {
+            return { text: `Account "${id}" not found.` };
+        }
+        return {
+            text: `Account "${target.label ?? id}" ${action.type}d.`,
+            updated: {
+                id,
+                action: action.type,
+                enabled: action.type === 'enable',
+            },
+        };
+    }
+    if (action.type === 'remove') {
+        const target = accounts.find((a) => a.id === id);
+        if (!target) {
+            return { text: `Account "${id}" not found.` };
+        }
+        return {
+            text: `Account "${target.label ?? id}" removed.`,
+            updated: { id, action: 'remove' },
+        };
+    }
+    if (action.type === 'move-up') {
+        const idx = accounts.findIndex((a) => a.id === id);
+        if (idx < 0) {
+            return { text: `Account "${id}" not found.` };
+        }
+        if (idx === 0) {
+            return {
+                text: `Account "${accounts[idx]?.label ?? id}" is already first.`,
+            };
+        }
+        const previousOrder = accounts.map((a) => a.id);
+        const newAccounts = [...accounts];
+        [newAccounts[idx - 1], newAccounts[idx]] = [
+            newAccounts[idx],
+            newAccounts[idx - 1],
+        ];
+        const newOrder = newAccounts.map((a) => a.id);
+        return {
+            text: `Account "${accounts[idx]?.label ?? id}" moved up.`,
+            updated: { id, action: 'reorder', previousOrder, newOrder },
+        };
+    }
+    if (action.type === 'move-down') {
+        const idx = accounts.findIndex((a) => a.id === id);
+        if (idx < 0) {
+            return { text: `Account "${id}" not found.` };
+        }
+        if (idx === accounts.length - 1) {
+            return {
+                text: `Account "${accounts[idx]?.label ?? id}" is already last.`,
+            };
+        }
+        const previousOrder = accounts.map((a) => a.id);
+        const newAccounts = [...accounts];
+        [newAccounts[idx], newAccounts[idx + 1]] = [
+            newAccounts[idx + 1],
+            newAccounts[idx],
+        ];
+        const newOrder = newAccounts.map((a) => a.id);
+        return {
+            text: `Account "${accounts[idx]?.label ?? id}" moved down.`,
+            updated: { id, action: 'reorder', previousOrder, newOrder },
+        };
+    }
+    return { text: USAGE_TEXT };
+}

package/dist/dump.js

@@ -3,7 +3,7 @@ import { mkdir, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { extractBillingHeaderCCH } from "./cch.js";
-import { relayLog } from "./logger.js";
+import { isSecretKey, relayLog } from "./logger.js";
 export const CLAUDE_DUMP_COMMAND_NAME = 'claude-dump';
 const DUMP_STATUS_TITLE = '## Claude Dump Status';
 const DUMP_ENABLED_TITLE = '## Claude Dump Enabled';
@@ -214,7 +214,8 @@ function redactForDump(value) {
         if (lower === 'authorization' ||
             lower === 'x-api-key' ||
             lower === 'cookie' ||
-            lower === 'set-cookie') {
+            lower === 'set-cookie' ||
+            isSecretKey(key)) {
             redacted[key] = '[redacted]';
             continue;
         }

package/dist/index.d.ts

@@ -4,13 +4,16 @@ export * from './cache1h.ts';
 export * from './cachekeep.ts';
 export * from './cch.ts';
 export * from './claude-code.ts';
+export * from './commands/account.ts';
 export * from './constants.ts';
 export * from './dump.ts';
 export * from './fast.ts';
 export * from './killswitch.ts';
 export * from './logger.ts';
+export * from './logging.ts';
 export * from './models.ts';
 export * from './pkce.ts';
+export * from './provider.ts';
 export * from './quota-manager.ts';
 export * from './quotas.ts';
 export * from './relay.ts';

package/dist/index.js

@@ -4,13 +4,16 @@ export * from "./cache1h.js";
 export * from "./cachekeep.js";
 export * from "./cch.js";
 export * from "./claude-code.js";
+export * from "./commands/account.js";
 export * from "./constants.js";
 export * from "./dump.js";
 export * from "./fast.js";
 export * from "./killswitch.js";
 export * from "./logger.js";
+export * from "./logging.js";
 export * from "./models.js";
 export * from "./pkce.js";
+export * from "./provider.js";
 export * from "./quota-manager.js";
 export * from "./quotas.js";
 export * from "./relay.js";

package/dist/logger.d.ts

@@ -1,3 +1,27 @@
+export type LogLevel = 'error' | 'warn' | 'info' | 'debug' | 'trace';
+declare function parseLogLevel(value: string | undefined): LogLevel | null;
+export declare function setLogLevel(level: LogLevel): void;
+export declare function getLogLevel(): LogLevel;
+export { parseLogLevel };
+export declare function shouldEmit(level: LogLevel): boolean;
+export declare function getLogFilePath(): string;
+export declare const SECRET_KEY_EXACT: RegExp;
+export declare function isSecretKey(key: string): boolean;
+export declare function redactPayload(payload?: Record<string, unknown>): Record<string, unknown> | undefined;
+export declare function formatLogLine(level: LogLevel, channel: string, message: string, payload?: Record<string, unknown>): string;
+export type LogTestRecord = {
+    level: LogLevel;
+    channel: string;
+    message: string;
+    payload?: Record<string, unknown>;
+};
+export declare function __setLogTestSink(sink: ((record: LogTestRecord) => void) | null): void;
+export declare const logger: {
+    error(channel: string, message: string, payload?: Record<string, unknown>): void;
+    warn(channel: string, message: string, payload?: Record<string, unknown>): void;
+    info(channel: string, message: string, payload?: Record<string, unknown>): void;
+    debug(channel: string, message: string, payload?: Record<string, unknown>): void;
+    trace(channel: string, message: string, payload?: Record<string, unknown>): void;
+};
 export declare function log(message: string, data?: unknown): void;
 export declare function relayLog(message: string, data?: unknown): void;
-export declare function getLogFilePath(): string;