@cortexkit/anthropic-auth-core 1.2.5 → 1.4.0

package/README.md

@@ -1,6 +1,6 @@
 # @cortexkit/anthropic-auth-core
 
-Shared Anthropic OAuth, quota, cache, cache-keepalive, fast mode, relay, dump, and request-signing helpers used by CortexKit's OpenCode and Pi integrations.
+Shared Anthropic OAuth, quota, routing, cache, cache-keepalive, fast mode, relay, dump, and request-signing helpers used by CortexKit's OpenCode and Pi integrations.
 
 User-facing packages:
 

package/dist/accounts.d.ts

@@ -30,12 +30,16 @@ export type AccountQuotaWindow = {
     resetsAt?: string;
     checkedAt: number;
 };
+export type RoutingMode = 'main-first' | 'fallback-first';
 export type AccountStorage = {
     version: 1;
     main?: {
         type: 'opencode';
         provider: 'anthropic';
     };
+    routing?: {
+        mode?: RoutingMode;
+    };
     fallbackOn?: number[];
     refresh?: {
         enabled?: boolean;
@@ -94,6 +98,8 @@ export declare function acquireRefreshFileLock(options: {
     ttlMs: number;
     path?: string;
     now?: () => number;
+    renew?: boolean;
+    renewIntervalMs?: number;
 }): Promise<{
     release: () => Promise<void>;
 } | null>;

package/dist/accounts.js

@@ -5,6 +5,8 @@ import { dirname, join } from 'node:path';
 import { ClaudeOAuthRefreshError, refreshClaudeOAuthToken } from "./auth.js";
 import { CACHE_1H_MODES, CLAUDE_CODE_VERSION, DEFAULT_CACHE_1H_MODE, } from "./constants.js";
 import { log } from "./logger.js";
+const setRefreshLockRenewalTimeout = globalThis.setTimeout.bind(globalThis);
+const clearRefreshLockRenewalTimeout = globalThis.clearTimeout.bind(globalThis);
 export const ACCOUNT_FILE_NAME = 'anthropic-auth.json';
 export const QUOTA_URL = 'https://api.anthropic.com/api/oauth/usage';
 const DEFAULT_FALLBACK_ON = [401, 403, 429];
@@ -22,7 +24,7 @@ const DEFAULT_MINIMUM_REMAINING = {
 const DEFAULT_FAIL_CLOSED_ON_UNKNOWN_QUOTA = true;
 const BACKGROUND_TICK_MS = 60_000;
 const BACKGROUND_TICK_JITTER_MS = 60_000;
-const FALLBACK_REFRESH_LOCK_TTL_MS = 2 * 60_000;
+const FALLBACK_REFRESH_LOCK_TTL_MS = 10 * 60_000;
 const FALLBACK_REFRESH_JOIN_WAIT_MS = 10_000;
 const FALLBACK_REFRESH_JOIN_POLL_MS = 100;
 function getConfigDir() {
@@ -114,6 +116,7 @@ function normalizeStorage(value) {
     return {
         version: 1,
         main: { type: 'opencode', provider: 'anthropic' },
+        routing: isRecord(value.routing) ? value.routing : undefined,
         fallbackOn: Array.isArray(value.fallbackOn)
             ? value.fallbackOn.filter((status) => Number.isInteger(status))
             : undefined,
@@ -170,6 +173,8 @@ export async function acquireRefreshFileLock(options) {
     const legacyOwnerPath = join(lockPath, 'owner.json');
     const ownerId = randomUUID();
     const now = options.now ?? Date.now;
+    let renewTimer = null;
+    let released = false;
     async function readOwner() {
         try {
             return JSON.parse(await readFile(lockPath, 'utf8'));
@@ -181,6 +186,9 @@ export async function acquireRefreshFileLock(options) {
             return JSON.parse(await readFile(legacyOwnerPath, 'utf8'));
         }
     }
+    async function writeOwner() {
+        await writeFile(lockPath, `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}\n`, { encoding: 'utf8', mode: 0o600 });
+    }
     async function tryAcquire() {
         try {
             await writeFile(lockPath, `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
@@ -193,6 +201,31 @@ export async function acquireRefreshFileLock(options) {
             throw error;
         }
     }
+    function scheduleRenewal() {
+        if (!options.renew || released)
+            return;
+        const intervalMs = options.renewIntervalMs ?? Math.max(1_000, Math.floor(options.ttlMs / 3));
+        renewTimer = setRefreshLockRenewalTimeout(() => {
+            void (async () => {
+                try {
+                    const owner = await readOwner();
+                    const currentNow = now();
+                    if (released ||
+                        owner?.ownerId !== ownerId ||
+                        Number(owner?.expiresAt) <= currentNow) {
+                        return;
+                    }
+                    await writeOwner();
+                    scheduleRenewal();
+                }
+                catch {
+                    // If renewal fails, contenders will wait until the last written expiry.
+                }
+            })();
+        }, intervalMs);
+        if ('unref' in renewTimer)
+            renewTimer.unref();
+    }
     if (!(await tryAcquire())) {
         try {
             const owner = await readOwner();
@@ -213,8 +246,14 @@ export async function acquireRefreshFileLock(options) {
         if (!(await tryAcquire()))
             return null;
     }
+    scheduleRenewal();
     return {
         release: async () => {
+            released = true;
+            if (renewTimer) {
+                clearRefreshLockRenewalTimeout(renewTimer);
+                renewTimer = null;
+            }
             try {
                 const owner = await readOwner();
                 if (owner?.ownerId !== ownerId)
@@ -850,6 +889,7 @@ export class FallbackAccountManager {
             ttlMs: FALLBACK_REFRESH_LOCK_TTL_MS,
             path: this.configPath,
             now: this.now,
+            renew: true,
         });
         if (!fileLock) {
             log('[refresh] fallback oauth refresh skipped file lock', {

package/dist/cachekeep.js

@@ -1,4 +1,4 @@
-import { CCH_PATTERN, signRequestBody } from "./cch.js";
+import { signRequestBody } from "./cch.js";
 import { orderClaudeCodeBody } from "./claude-code.js";
 export const CLAUDE_CACHE_KEEP_COMMAND_NAME = 'claude-cachekeep';
 export const CACHE_KEEP_TTL_MS = 60 * 60_000;
@@ -169,8 +169,7 @@ export async function buildCacheKeepPrewarmBody(bodyText) {
     if (toolChoice?.type === 'tool' || toolChoice?.type === 'any') {
         delete warm.tool_choice;
     }
-    const unsignedBodyText = JSON.stringify(orderClaudeCodeBody(warm)).replace(CCH_PATTERN, 'cch=00000;');
-    const signedBodyText = await signRequestBody(unsignedBodyText);
+    const signedBodyText = await signRequestBody(JSON.stringify(orderClaudeCodeBody(warm)));
     return { ok: true, bodyText: signedBodyText };
 }
 export class CacheKeepManager {

package/dist/cch.d.ts

@@ -18,6 +18,8 @@ export declare function extractFirstUserMessageText(messages: Message[]): string
  * masks to 20 bits, and writes that value into the billing-header placeholder.
  */
 export declare function computeCCH(bodyBytes: Uint8Array): Promise<string>;
+export declare function resetBillingHeaderCCH(bodyString: string): string;
+export declare function extractBillingHeaderCCH(bodyString: string): string | null;
 export declare function signRequestBody(bodyString: string): Promise<string>;
 /**
  * Compute a stable 3-character suffix for cc_version.

package/dist/cch.js

@@ -2,7 +2,10 @@ import { createHash } from 'node:crypto';
 import xxhashInit from 'xxhash-wasm';
 import { CLAUDE_CODE_BUILD_HASH, CLAUDE_CODE_VERSION } from "./constants.js";
 const CCH_SEED = 0x6e52736ac806831en;
+const CCH_PLACEHOLDER = 'cch=00000;';
 export const CCH_PATTERN = /\bcch=([0-9a-f]{5});/;
+const BILLING_HEADER_CCH_PATTERN = /("system":\[\{"type":"text","text":"x-anthropic-billing-header: cc_version=[^;"]+; cc_entrypoint=[^;"]+; )cch=([0-9a-f]{5});/;
+const BILLING_HEADER_CCH_PLACEHOLDER_PATTERN = /("system":\[\{"type":"text","text":"x-anthropic-billing-header: cc_version=[^;"]+; cc_entrypoint=[^;"]+; )cch=00000;/;
 let xxhashPromise = null;
 let xxhash64Raw = null;
 async function ensureXxhash() {
@@ -43,11 +46,18 @@ export async function computeCCH(bodyBytes) {
     const hash = xxhash64Raw?.(bodyBytes, CCH_SEED) ?? 0n;
     return (hash & 0xfffffn).toString(16).padStart(5, '0');
 }
+export function resetBillingHeaderCCH(bodyString) {
+    return bodyString.replace(BILLING_HEADER_CCH_PATTERN, `$1${CCH_PLACEHOLDER}`);
+}
+export function extractBillingHeaderCCH(bodyString) {
+    return BILLING_HEADER_CCH_PATTERN.exec(bodyString)?.[2] ?? null;
+}
 export async function signRequestBody(bodyString) {
-    if (!CCH_PATTERN.test(bodyString))
+    if (!BILLING_HEADER_CCH_PATTERN.test(bodyString))
         return bodyString;
-    const token = await computeCCH(new TextEncoder().encode(bodyString));
-    return bodyString.replace(CCH_PATTERN, `cch=${token};`);
+    const unsignedBodyString = resetBillingHeaderCCH(bodyString);
+    const token = await computeCCH(new TextEncoder().encode(unsignedBodyString));
+    return unsignedBodyString.replace(BILLING_HEADER_CCH_PLACEHOLDER_PATTERN, `$1cch=${token};`);
 }
 /**
  * Compute a stable 3-character suffix for cc_version.

package/dist/constants.d.ts

@@ -13,6 +13,7 @@ export declare function mergeAnthropicBetas(existing: string | null | undefined,
 export declare function isFastModeSupportedModel(model: unknown): boolean;
 export declare const OPENCODE_IDENTITY_PREFIX = "You are OpenCode";
 export declare const CLAUDE_CODE_IDENTITY = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
+export declare const PARALLEL_TOOL_CALLS_SYSTEM_PROMPT: string;
 export declare const CCH_SALT = "59cf53e54c78";
 export declare const CCH_POSITIONS: number[];
 export declare const CLAUDE_CODE_VERSION = "2.1.141";

package/dist/constants.js

@@ -28,10 +28,17 @@ export function mergeAnthropicBetas(existing, betas) {
 }
 export function isFastModeSupportedModel(model) {
     return (typeof model === 'string' &&
-        (model.startsWith('claude-opus-4-6') || model.startsWith('claude-opus-4-7')));
+        (model.startsWith('claude-opus-4-6') ||
+            model.startsWith('claude-opus-4-7') ||
+            model.startsWith('claude-opus-4-8')));
 }
 export const OPENCODE_IDENTITY_PREFIX = 'You are OpenCode';
 export const CLAUDE_CODE_IDENTITY = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
+export const PARALLEL_TOOL_CALLS_SYSTEM_PROMPT = [
+    '<use_parallel_tool_calls>',
+    'For maximum efficiency, whenever you perform multiple independent operations, invoke all relevant tools simultaneously rather than sequentially. Prioritize calling tools in parallel whenever possible. For example, when reading 3 files, run 3 tool calls in parallel to read all 3 files into context at the same time. When running multiple read-only commands like `ls` or `list_dir`, always run all of the commands in parallel. Err on the side of maximizing parallel tool calls rather than running too many tools sequentially.',
+    '</use_parallel_tool_calls>',
+].join('\n');
 export const CCH_SALT = '59cf53e54c78';
 export const CCH_POSITIONS = [4, 7, 20];
 export const CLAUDE_CODE_VERSION = '2.1.141';

package/dist/dump.js

@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto';
 import { mkdir, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { extractBillingHeaderCCH } from "./cch.js";
 import { relayLog } from "./logger.js";
 export const CLAUDE_DUMP_COMMAND_NAME = 'claude-dump';
 const DUMP_STATUS_TITLE = '## Claude Dump Status';
@@ -9,7 +10,8 @@ const DUMP_ENABLED_TITLE = '## Claude Dump Enabled';
 const DUMP_DISABLED_TITLE = '## Claude Dump Disabled';
 const DUMP_USAGE_TITLE = '## Claude Dump Usage';
 const DUMP_USAGE = 'Usage: `/claude-dump`, `/claude-dump on`, or `/claude-dump off`.';
-const DUMP_DIR = join(tmpdir(), 'opencode-anthropic-auth-dumps');
+const DUMP_DIR_ENV = 'OPENCODE_ANTHROPIC_AUTH_DUMP_DIR';
+const DEFAULT_DUMP_DIR = join(tmpdir(), 'opencode-anthropic-auth-dumps');
 let dumpEnabled = false;
 let nextDumpId = 0;
 export function isDumpEnabled() {
@@ -22,7 +24,7 @@ export function resetDumpState() {
     dumpEnabled = false;
 }
 export function getDumpDirectory() {
-    return DUMP_DIR;
+    return process.env[DUMP_DIR_ENV] || DEFAULT_DUMP_DIR;
 }
 export function parseDumpCommandAction(argumentsText) {
     const normalized = argumentsText.trim().split(/\s+/).filter(Boolean);
@@ -40,7 +42,7 @@ export function buildDumpStatusSummary(input) {
         DUMP_STATUS_TITLE,
         '',
         `- Enabled: ${enabled ? 'enabled' : 'disabled'}`,
-        `- Directory: ${DUMP_DIR}`,
+        `- Directory: ${getDumpDirectory()}`,
         '- Persisted: ~/.config/opencode/anthropic-auth.json',
         '- Captures: final rewritten Anthropic body plus redacted relay payload metadata',
         '- Warning: body dumps may contain prompt/session content; turn this off after debugging',
@@ -80,7 +82,7 @@ function hashText(value) {
     return createHash('sha256').update(value).digest('hex');
 }
 function cchToken(bodyText) {
-    return bodyText.match(/\bcch=([0-9a-f]{5});/)?.[1] ?? null;
+    return extractBillingHeaderCCH(bodyText);
 }
 function diffSummary(previousBodyText, bodyText) {
     if (previousBodyText == null)
@@ -183,9 +185,10 @@ export async function dumpRelayRequest(input) {
         return;
     nextDumpId += 1;
     const id = `${new Date().toISOString().replace(/[:.]/g, '-')}-${String(nextDumpId).padStart(5, '0')}-${input.transport}-p${input.protocol}-${input.mode}`;
-    const prefix = join(DUMP_DIR, id);
+    const dumpDir = getDumpDirectory();
+    const prefix = join(dumpDir, id);
     try {
-        await mkdir(DUMP_DIR, { recursive: true });
+        await mkdir(dumpDir, { recursive: true });
         const metadata = {
             id,
             createdAt: new Date().toISOString(),

package/dist/fast.js

@@ -32,7 +32,7 @@ export function buildFastModeStatusSummary(input) {
         `- Enabled: ${enabled ? 'enabled' : 'disabled'}`,
         '- Persisted: ~/.config/opencode/anthropic-auth.json',
         '- Scope: adds Anthropic fast mode to supported Opus requests',
-        '- Supported models: claude-opus-4-6 and claude-opus-4-7',
+        '- Supported models: claude-opus-4-6, claude-opus-4-7, and claude-opus-4-8',
         '- Request changes: adds `speed: "fast"` and the `fast-mode-2026-02-01` beta header',
         '- Note: fast and standard speeds do not share prompt-cache prefixes',
     ].join('\n');

package/dist/index.d.ts

@@ -11,3 +11,4 @@ export * from './logger.ts';
 export * from './pkce.ts';
 export * from './quotas.ts';
 export * from './relay.ts';
+export * from './routing.ts';

package/dist/index.js

@@ -11,3 +11,4 @@ export * from "./logger.js";
 export * from "./pkce.js";
 export * from "./quotas.js";
 export * from "./relay.js";
+export * from "./routing.js";

package/dist/routing.d.ts

@@ -0,0 +1,23 @@
+import { type AccountStorage, type RoutingMode } from './accounts.ts';
+export declare const CLAUDE_ROUTING_COMMAND_NAME = "claude-routing";
+export declare const ROUTING_MODES: readonly ["main-first", "fallback-first"];
+export declare const DEFAULT_ROUTING_MODE: RoutingMode;
+type RoutingCommandAction = {
+    type: 'status';
+} | {
+    type: 'mode';
+    mode: RoutingMode;
+} | {
+    type: 'usage';
+};
+export declare function getRoutingMode(storage: AccountStorage | null): RoutingMode;
+export declare function setRoutingMode(mode: RoutingMode, path?: string): Promise<AccountStorage>;
+export declare function parseRoutingCommandAction(argumentsText: string): RoutingCommandAction;
+export declare function buildRoutingStatusSummary(input?: {
+    mode?: RoutingMode;
+}): string;
+export declare function executeRoutingCommand(input: {
+    argumentsText: string;
+    mode?: RoutingMode;
+}): string;
+export {};

package/dist/routing.js

@@ -0,0 +1,80 @@
+import { getAccountStoragePath, loadAccounts, saveAccounts, } from "./accounts.js";
+export const CLAUDE_ROUTING_COMMAND_NAME = 'claude-routing';
+export const ROUTING_MODES = ['main-first', 'fallback-first'];
+export const DEFAULT_ROUTING_MODE = 'main-first';
+const ROUTING_USAGE = 'Usage: `/claude-routing`, `/claude-routing main-first`, or `/claude-routing fallback-first`.';
+function normalizeRoutingMode(value) {
+    return typeof value === 'string' &&
+        ROUTING_MODES.includes(value)
+        ? value
+        : DEFAULT_ROUTING_MODE;
+}
+export function getRoutingMode(storage) {
+    return normalizeRoutingMode(storage?.routing?.mode);
+}
+export async function setRoutingMode(mode, path = getAccountStoragePath()) {
+    const storage = (await loadAccounts(path)) ?? {
+        version: 1,
+        main: { type: 'opencode', provider: 'anthropic' },
+        accounts: [],
+    };
+    storage.routing = {
+        ...(storage.routing ?? {}),
+        mode,
+    };
+    await saveAccounts(storage, path);
+    return storage;
+}
+export function parseRoutingCommandAction(argumentsText) {
+    const tokens = argumentsText.trim().toLowerCase().split(/\s+/).filter(Boolean);
+    if (tokens.length === 0)
+        return { type: 'status' };
+    if (tokens.length === 1 && ROUTING_MODES.includes(tokens[0])) {
+        return { type: 'mode', mode: tokens[0] };
+    }
+    if (tokens.length === 2 &&
+        tokens[0] === 'mode' &&
+        ROUTING_MODES.includes(tokens[1])) {
+        return { type: 'mode', mode: tokens[1] };
+    }
+    return { type: 'usage' };
+}
+function routingDescription(mode) {
+    if (mode === 'fallback-first') {
+        return 'Try usable fallback accounts before the main account. If no fallback succeeds, try the main account.';
+    }
+    return 'Try the main account first. Use fallback accounts only when quota policy or fallback errors require it.';
+}
+export function buildRoutingStatusSummary(input) {
+    const mode = input?.mode ?? DEFAULT_ROUTING_MODE;
+    return [
+        '## Claude Routing Status',
+        '',
+        `- Mode: \`${mode}\``,
+        `- Behavior: ${routingDescription(mode)}`,
+        '',
+        ROUTING_USAGE,
+    ].join('\n');
+}
+export function executeRoutingCommand(input) {
+    const action = parseRoutingCommandAction(input.argumentsText);
+    const mode = input.mode ?? DEFAULT_ROUTING_MODE;
+    if (action.type === 'status')
+        return buildRoutingStatusSummary({ mode });
+    if (action.type === 'mode') {
+        return [
+            '## Claude Routing Updated',
+            '',
+            `Mode updated to \`${action.mode}\`.`,
+            '',
+            ...buildRoutingStatusSummary({ mode: action.mode }).split('\n').slice(2),
+        ].join('\n');
+    }
+    return [
+        '## Claude Routing Usage',
+        '',
+        ROUTING_USAGE,
+        '',
+        ...buildRoutingStatusSummary({ mode }).split('\n').slice(2),
+    ].join('\n');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "1.2.5",
+  "version": "1.4.0",
   "type": "module",
   "repository": {
     "type": "git",