@cortexkit/anthropic-auth-core 1.10.3 → 1.11.0

package/dist/logger.js

@@ -1,7 +1,205 @@
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
-const LOG_FILE = path.join(os.tmpdir(), 'opencode-anthropic-auth.log');
+const LEVEL_ORDER = {
+    error: 0,
+    warn: 1,
+    info: 2,
+    debug: 3,
+    trace: 4,
+};
+const VALID_LEVELS = new Set(Object.keys(LEVEL_ORDER));
+function parseLogLevel(value) {
+    if (!value)
+        return null;
+    const normalized = value.trim().toLowerCase();
+    return VALID_LEVELS.has(normalized) ? normalized : null;
+}
+const envLevel = parseLogLevel(process.env.OPENCODE_ANTHROPIC_AUTH_LOG_LEVEL);
+let currentLevel = envLevel ?? 'info';
+export function setLogLevel(level) {
+    currentLevel = level;
+}
+export function getLogLevel() {
+    return currentLevel;
+}
+export { parseLogLevel };
+// -- Emission control ------------------------------------------------------
+export function shouldEmit(level) {
+    return LEVEL_ORDER[level] <= LEVEL_ORDER[currentLevel];
+}
+// -- File path -------------------------------------------------------------
+const LOG_FILE = process.env.OPENCODE_ANTHROPIC_AUTH_LOG_FILE ??
+    path.join(os.tmpdir(), 'opencode-anthropic-auth.log');
+export function getLogFilePath() {
+    return LOG_FILE;
+}
+// -- Rotation --------------------------------------------------------------
+const MAX_FILE_SIZE = 5 * 1024 * 1024; // 5 MB
+const MAX_GENERATIONS = 3;
+function rotateLogFile() {
+    try {
+        if (!fs.existsSync(LOG_FILE))
+            return;
+        const stat = fs.statSync(LOG_FILE);
+        if (stat.size < MAX_FILE_SIZE)
+            return;
+    }
+    catch {
+        return;
+    }
+    try {
+        for (let i = MAX_GENERATIONS; i >= 1; i--) {
+            const oldPath = i === 1 ? LOG_FILE : `${LOG_FILE}.${i - 1}`;
+            const newPath = `${LOG_FILE}.${i}`;
+            try {
+                if (i === MAX_GENERATIONS) {
+                    try {
+                        fs.unlinkSync(newPath);
+                    }
+                    catch {
+                        // .3 might not exist
+                    }
+                }
+                if (fs.existsSync(oldPath)) {
+                    fs.renameSync(oldPath, newPath);
+                }
+            }
+            catch {
+                // Rotation best-effort — never throw
+            }
+        }
+    }
+    catch {
+        // Rotation must never throw
+    }
+}
+// -- Redaction ------------------------------------------------------------
+export const SECRET_KEY_EXACT = /^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i;
+export function isSecretKey(key) {
+    if (SECRET_KEY_EXACT.test(key))
+        return true;
+    const k = key.toLowerCase().replace(/[-_]/g, '');
+    if (k.includes('apikey'))
+        return true;
+    if (k.endsWith('secret') || k.endsWith('password'))
+        return true;
+    if (k.endsWith('token') && !k.endsWith('tokens'))
+        return true;
+    return false;
+}
+const REDACT_VALUE_PATTERNS = [
+    /Bearer\s+\S+/,
+    /sk-[A-Za-z0-9-]+/,
+    /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/,
+];
+function isRedactableValue(value) {
+    if (typeof value !== 'string')
+        return false;
+    return REDACT_VALUE_PATTERNS.some((pattern) => pattern.test(value));
+}
+export function redactPayload(payload) {
+    if (payload == null || Object.keys(payload).length === 0)
+        return undefined;
+    const seen = new WeakSet();
+    function walk(value) {
+        if (value == null || typeof value !== 'object') {
+            if (isRedactableValue(value))
+                return '***REDACTED***';
+            return value;
+        }
+        if (seen.has(value))
+            return '[Circular]';
+        seen.add(value);
+        try {
+            if (Array.isArray(value))
+                return value.map(walk);
+            const obj = value;
+            const result = {};
+            for (const [key, entry] of Object.entries(obj)) {
+                if (isSecretKey(key)) {
+                    result[key] = '***REDACTED***';
+                    continue;
+                }
+                result[key] = walk(entry);
+            }
+            return result;
+        }
+        finally {
+            seen.delete(value);
+        }
+    }
+    return walk(payload);
+}
+// -- Line formatting ------------------------------------------------------
+export function formatLogLine(level, channel, message, payload) {
+    const now = new Date().toISOString();
+    const levelUpper = level.toUpperCase().padEnd(5);
+    const channelSegment = channel ? ` [${channel}]` : '';
+    const payloadJson = (() => {
+        try {
+            const redacted = redactPayload(payload);
+            const withPid = redacted
+                ? { ...redacted, pid: process.pid }
+                : { pid: process.pid };
+            return ` ${JSON.stringify(withPid)}`;
+        }
+        catch {
+            return ` {"pid":${process.pid},"payload":"[unserializable]"}`;
+        }
+    })();
+    return `[${now}] ${levelUpper}${channelSegment} ${message}${payloadJson}`;
+}
+let testSink = null;
+export function __setLogTestSink(sink) {
+    testSink = sink;
+}
+// -- Leveled API ----------------------------------------------------------
+function emit(level, channel, message, payload) {
+    if (!shouldEmit(level))
+        return;
+    if (testSink) {
+        try {
+            testSink({ level, channel, message, payload: redactPayload(payload) });
+        }
+        catch {
+            // Sink must never throw into production.
+        }
+    }
+    if (isTestEnv)
+        return;
+    try {
+        const line = `${formatLogLine(level, channel, message, payload)}\n`;
+        buffer.push(line);
+        if (buffer.length >= BUFFER_SIZE_LIMIT) {
+            flush();
+        }
+        else {
+            scheduleFlush();
+        }
+    }
+    catch {
+        // Logging must never throw.
+    }
+}
+export const logger = {
+    error(channel, message, payload) {
+        emit('error', channel, message, payload);
+    },
+    warn(channel, message, payload) {
+        emit('warn', channel, message, payload);
+    },
+    info(channel, message, payload) {
+        emit('info', channel, message, payload);
+    },
+    debug(channel, message, payload) {
+        emit('debug', channel, message, payload);
+    },
+    trace(channel, message, payload) {
+        emit('trace', channel, message, payload);
+    },
+};
+// -- Buffered writes ------------------------------------------------------
 const isTestEnv = process.env.NODE_ENV === 'test';
 const FLUSH_INTERVAL_MS = 500;
 const BUFFER_SIZE_LIMIT = 50;
@@ -17,6 +215,7 @@ function flush() {
     const data = buffer.join('');
     buffer = [];
     try {
+        rotateLogFile();
         fs.appendFileSync(LOG_FILE, data);
     }
     catch {
@@ -31,36 +230,57 @@ function scheduleFlush() {
         flush();
     }, FLUSH_INTERVAL_MS);
 }
-function serialize(data) {
-    if (data === undefined)
-        return '';
-    if (data instanceof Error) {
-        return ` ${data.message}${data.stack ? `\n${data.stack}` : ''}`;
-    }
-    return ` ${JSON.stringify(data)}`;
-}
+// -- Back-compat shims ----------------------------------------------------
+const CHANNEL_REGEX = /^\[([\w-]+)\]\s*/;
 export function log(message, data) {
+    if (!shouldEmit('debug'))
+        return;
     if (isTestEnv)
         return;
     try {
-        buffer.push(`[${new Date().toISOString()}] ${message}${serialize(data)}\n`);
-        if (buffer.length >= BUFFER_SIZE_LIMIT) {
-            flush();
+        let channel = '';
+        let msg = message;
+        const match = message.match(CHANNEL_REGEX);
+        if (match) {
+            channel = match[1] ?? '';
+            msg = message.slice(match[0].length);
         }
-        else {
-            scheduleFlush();
+        let payload;
+        if (data != null) {
+            if (data instanceof Error) {
+                payload = {
+                    error: `${data.message}${data.stack ? `\n${data.stack}` : ''}`,
+                };
+            }
+            else if (typeof data === 'object') {
+                payload = data;
+            }
         }
+        emit('debug', channel, msg, payload);
     }
     catch {
         // Logging must never throw.
     }
 }
 export function relayLog(message, data) {
-    log(`[relay] ${message}`, data);
-}
-export function getLogFilePath() {
-    return LOG_FILE;
+    if (!shouldEmit('debug'))
+        return;
+    if (isTestEnv)
+        return;
+    try {
+        let payload;
+        if (data != null) {
+            if (typeof data === 'object' && !(data instanceof Error)) {
+                payload = data;
+            }
+        }
+        emit('debug', 'relay', message, payload);
+    }
+    catch {
+        // Logging must never throw.
+    }
 }
+// -- Exit flush -----------------------------------------------------------
 if (!isTestEnv) {
     process.on('exit', flush);
 }

package/dist/logging.d.ts

@@ -0,0 +1,19 @@
+import type { LogLevel } from './logger.ts';
+export declare const CLAUDE_LOGGING_COMMAND_NAME = "claude-logging";
+export declare const LOGGING_LEVELS: LogLevel[];
+export type LoggingCommandAction = {
+    type: 'status';
+} | {
+    type: 'level';
+    level: LogLevel;
+} | {
+    type: 'usage';
+};
+export declare function parseLoggingCommandAction(argumentsText: string): LoggingCommandAction;
+export declare function buildLoggingStatusSummary(input?: {
+    level?: LogLevel;
+}): string;
+export declare function executeLoggingCommand(input: {
+    argumentsText: string;
+    level?: LogLevel;
+}): string;

package/dist/logging.js

@@ -0,0 +1,59 @@
+// Known limitation: the TUI bundle is a SEPARATE module instance from the loader,
+// so /claude-logging sets the SERVER-side (loader) logger level and persists it
+// (applied on next boot); the TUI-side logger level is only raised via the
+// OPENCODE_ANTHROPIC_AUTH_LOG_LEVEL env override. The command still correctly
+// persists and applies server-side — just note this asymmetry.
+export const CLAUDE_LOGGING_COMMAND_NAME = 'claude-logging';
+export const LOGGING_LEVELS = [
+    'error',
+    'warn',
+    'info',
+    'debug',
+    'trace',
+];
+const LOGGING_USAGE = 'Usage: `/claude-logging`, `/claude-logging error|warn|info|debug|trace`.';
+export function parseLoggingCommandAction(argumentsText) {
+    const tokens = argumentsText.trim().toLowerCase().split(/\s+/).filter(Boolean);
+    if (tokens.length === 0)
+        return { type: 'status' };
+    if (tokens.length === 1 && LOGGING_LEVELS.includes(tokens[0])) {
+        return { type: 'level', level: tokens[0] };
+    }
+    return { type: 'usage' };
+}
+export function buildLoggingStatusSummary(input) {
+    const level = input?.level ?? 'info';
+    return [
+        '## Claude Log Level',
+        '',
+        `Current log level: \`${level}\``,
+        '- Persisted: ~/.config/opencode/anthropic-auth.json',
+        '- Valid levels: error, warn, info, debug, trace',
+        '',
+        LOGGING_USAGE,
+    ].join('\n');
+}
+export function executeLoggingCommand(input) {
+    const action = parseLoggingCommandAction(input.argumentsText);
+    const level = input.level ?? 'info';
+    if (action.type === 'status')
+        return buildLoggingStatusSummary({ level });
+    if (action.type === 'level') {
+        return [
+            '## Claude Log Level Updated',
+            '',
+            `Level set to \`${action.level}\`.`,
+            '',
+            ...buildLoggingStatusSummary({ level: action.level })
+                .split('\n')
+                .slice(2),
+        ].join('\n');
+    }
+    return [
+        '## Claude Log Level Usage',
+        '',
+        LOGGING_USAGE,
+        '',
+        ...buildLoggingStatusSummary({ level }).split('\n').slice(2),
+    ].join('\n');
+}

package/dist/provider.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Duck-typed error contract for provider HTTP errors.
+ *
+ * Shared-core extraction of anthropic-auth and openai-auth is mechanical
+ * when all error classification uses this contract instead of instanceof
+ * or message-regex matching on provider-specific error classes.
+ */
+export type ProviderHttpError = {
+    /** HTTP status code. */
+    status?: number;
+    /** Parsed Retry-After header value in seconds, if the server provided one. */
+    retryAfter?: number;
+    /**
+     * Provider-agnostic marker that the error originated from a token-REFRESH
+     * step (as opposed to a quota-endpoint or other non-refresh error). Consumers
+     * use this flag to arm the refresh backoff without instanceof checks.
+     */
+    isRefreshError?: boolean;
+};

package/dist/quota-manager.d.ts

@@ -30,6 +30,7 @@ export declare class QuotaManager {
     private fallbacks;
     private fallbackTokenFps;
     private inflightMain;
+    private inflightMainFp;
     private inflightFallbacks;
     private mainLastApiError;
     private fallbackApiErrors;

package/dist/quota-manager.js

@@ -6,7 +6,7 @@
  * Handles deduplication, rate-limiting (429 backoff), and staleness.
  */
 import { createHash } from 'node:crypto';
-import { acquireRefreshFileLock, buildQuotaOperationError, fetchOAuthQuotaSnapshot, getPersistedMainQuota, getQuotaCheckIntervalMs, getQuotaNextRefreshAt, getQuotaRefreshEveryNRequests, quotaBackoffActive, } from "./accounts.js";
+import { acquireRefreshFileLock, buildQuotaOperationError, fetchOAuthQuotaSnapshot, getPersistedMainQuota, getQuotaCheckIntervalMs, getQuotaNextRefreshAt, getQuotaRefreshEveryNRequests, isQuotaPolicyAuthError, quotaBackoffActive, } from "./accounts.js";
 // Capture real setTimeout before tests can mock globalThis.setTimeout
 const nativeSetTimeout = globalThis.setTimeout;
 /**
@@ -31,6 +31,7 @@ export class QuotaManager {
     fallbackTokenFps = new Map();
     // --- Inflight deduplication ---
     inflightMain = null;
+    inflightMainFp = null;
     inflightFallbacks = new Map();
     // --- Rate-limiting (scoped per route so a fallback 429 never backs off the
     // main account or vice versa) ---
@@ -127,8 +128,8 @@ export class QuotaManager {
             this.main = null;
             this.mainTokenFp = null;
         }
-        // Deduplicate — return in-flight promise if already fetching
-        if (this.inflightMain)
+        // Deduplicate — return in-flight promise only if same token fingerprint
+        if (this.inflightMain && this.inflightMainFp === fp)
             return this.inflightMain;
         // Rate-limit — if API recently 429'd, return stale or throw
         if (this.isBackedOff()) {
@@ -136,6 +137,7 @@ export class QuotaManager {
                 return this.main.quota;
             throw new Error('Quota API rate-limited — try again later');
         }
+        this.inflightMainFp = fp;
         this.inflightMain = this._fetchMain(accessToken);
         return this.inflightMain;
     }
@@ -342,6 +344,7 @@ export class QuotaManager {
         return queued;
     }
     async _fetchMain(accessToken) {
+        const thisFetchFp = tokenFingerprint(accessToken);
         return this._enqueueApiFetch(async () => {
             try {
                 // Re-check backoff inside gate — may have been set by
@@ -388,7 +391,10 @@ export class QuotaManager {
                 }
             }
             finally {
-                this.inflightMain = null;
+                if (this.inflightMainFp === thisFetchFp) {
+                    this.inflightMain = null;
+                    this.inflightMainFp = null;
+                }
             }
         });
     }
@@ -441,10 +447,13 @@ export class QuotaManager {
             }
         });
     }
-    // A 401 is an auth/token problem, not a rate limit. The caller refreshes the
-    // token and retries; backing off the quota API here would block that retry,
-    // so surface 401s without recording backoff state.
+    // A 401 is an auth/token problem and a 403 is an account/org policy problem,
+    // not quota endpoint saturation. Surface both without recording quota backoff
+    // so callers can refresh, re-auth, or try another account immediately.
     static isAuthError(error) {
+        const status = error.status;
+        if (status === 401 || isQuotaPolicyAuthError(error))
+            return true;
         const message = error instanceof Error ? error.message : String(error);
         return /quota check failed: 401\b/.test(message);
     }

package/dist/routing.js

@@ -1,4 +1,4 @@
-import { getAccountStoragePath, loadAccounts, saveAccounts, } from "./accounts.js";
+import { createEmptyStorage, getAccountStoragePath, loadAccounts, saveAccounts, } from "./accounts.js";
 export const CLAUDE_ROUTING_COMMAND_NAME = 'claude-routing';
 export const ROUTING_MODES = ['main-first', 'fallback-first'];
 export const DEFAULT_ROUTING_MODE = 'main-first';
@@ -13,11 +13,7 @@ export function getRoutingMode(storage) {
     return normalizeRoutingMode(storage?.routing?.mode);
 }
 export async function setRoutingMode(mode, path = getAccountStoragePath()) {
-    const storage = (await loadAccounts(path)) ?? {
-        version: 1,
-        main: { type: 'opencode', provider: 'anthropic' },
-        accounts: [],
-    };
+    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
     storage.routing = {
         ...(storage.routing ?? {}),
         mode,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "1.10.3",
+  "version": "1.11.0",
   "type": "module",
   "repository": {
     "type": "git",