@cortexkit/anthropic-auth-core 1.23.0 → 2.0.0

package/dist/commands/account.js

@@ -1,368 +0,0 @@
-import { getClaustrumMode, isOAuthAccount, isOAuthAccountVaultOwned, } from '../accounts.js';
-import { formatOAuthAccountTier } from '../oauth-profile.js';
-export const CLAUDE_ACCOUNT_COMMAND_NAME = 'claude-account';
-export function parseAccountCommandAction(argumentsText) {
-    const parts = argumentsText.trim().split(/\s+/).filter(Boolean);
-    if (parts.length === 0)
-        return { type: 'status' };
-    const action = parts[0];
-    const rest = parts.slice(1).join(' ');
-    if (action === 'enable' && rest)
-        return { type: 'enable', id: rest };
-    if (action === 'disable' && rest)
-        return { type: 'disable', id: rest };
-    if (action === 'remove' && rest)
-        return { type: 'remove', id: rest };
-    if (action === 'move-up' && rest)
-        return { type: 'move-up', id: rest };
-    if (action === 'move-down' && rest)
-        return { type: 'move-down', id: rest };
-    if (action === 'reset-backoff' && !rest)
-        return { type: 'reset-backoff' };
-    if (action === 'enrollment-reset' && !rest)
-        return { type: 'enrollment-reset' };
-    if (action === 'claustrum' && !rest) {
-        return { type: 'claustrum-mode', mode: 'claustrum' };
-    }
-    if (action === 'local' && !rest) {
-        return { type: 'claustrum-mode', mode: 'local' };
-    }
-    if (action === 'add-apikey' && rest) {
-        let remaining = rest;
-        let baseURL;
-        let authHeader;
-        // Parse --base-url flag
-        const baseUrlMatch = remaining.match(/--base-url\s+(\S+)/);
-        if (baseUrlMatch) {
-            baseURL = baseUrlMatch[1];
-            remaining = remaining.replace(baseUrlMatch[0], '').trim();
-        }
-        // Parse --auth-header flag
-        const authMatch = remaining.match(/--auth-header\s+(authorization-bearer|x-api-key)/);
-        if (authMatch) {
-            authHeader = authMatch[1];
-            remaining = remaining.replace(authMatch[0], '').trim();
-        }
-        // Parse --label flag
-        let label;
-        const labelMatch = remaining.match(/--label\s+(.+)/);
-        if (labelMatch) {
-            label = labelMatch[1]?.trim() || undefined;
-            remaining = remaining.replace(labelMatch[0], '').trim();
-        }
-        // First remaining token is the API key; rest (if any) is label
-        const firstSpace = remaining.indexOf(' ');
-        if (firstSpace === -1) {
-            if (!remaining)
-                return { type: 'usage' };
-            return {
-                type: 'add-apikey',
-                apiKey: remaining,
-                baseURL,
-                authHeader,
-                label,
-            };
-        }
-        const apiKey = remaining.slice(0, firstSpace);
-        const tail = remaining.slice(firstSpace + 1).trim();
-        return {
-            type: 'add-apikey',
-            apiKey,
-            label: label ?? (tail || undefined),
-            baseURL,
-            authHeader,
-        };
-    }
-    if (action === 'add-oauth-start')
-        return { type: 'add-oauth-start' };
-    if (action === 'add-oauth-finish' && rest) {
-        let remaining = rest;
-        // Parse --label flag (mirrors add-apikey). The OAuth code is opaque (may
-        // contain a #state segment) so the label is collected via the flag, never
-        // positionally.
-        let label;
-        const labelMatch = remaining.match(/--label\s+(.+)/);
-        if (labelMatch) {
-            label = labelMatch[1]?.trim() || undefined;
-            remaining = remaining.replace(labelMatch[0], '').trim();
-        }
-        if (!remaining)
-            return { type: 'usage' };
-        return { type: 'add-oauth-finish', code: remaining, label };
-    }
-    return { type: 'usage' };
-}
-export function custodyStatusLabel(state) {
-    switch (state) {
-        case 'na':
-            return 'n/a (OpenCode-managed)';
-        case 'off':
-            return 'not enrolled';
-        case 'on-vault-served':
-            return 'vault-served';
-        case 'on-vault-reauth':
-            return 'vault reauth';
-        case 'on-cold':
-            return 'vault cold';
-        case 'unknown-identity':
-            return 'unknown identity';
-        case 'on-identity-mismatch':
-            return 'identity mismatch';
-        case 'on-corrupt-binding':
-            return 'corrupt binding';
-    }
-}
-export function formatEnrollmentStatus(status, scopedServing = false) {
-    switch (status.state) {
-        case 'idle':
-            return ['- Enrollment: not enrolled'];
-        case 'busy':
-            return ['- Enrollment: another plugin process is reconciling'];
-        case 'unavailable':
-            return ['- Enrollment: temporarily unavailable'];
-        case 'pending':
-            return status.requestId && /^[A-Za-z0-9_-]{1,128}$/.test(status.requestId)
-                ? [
-                    `- Enrollment: pending approval (${status.requestId})`,
-                    `- Approve: \`ck auth enroll approve --request-id ${status.requestId}\``,
-                ]
-                : status.requestId
-                    ? [
-                        '- Enrollment: pending approval; inspect it with `ck auth enroll list`',
-                    ]
-                    : ['- Enrollment: preparing request'];
-        case 'approved': {
-            const name = status.approvedName ?? status.proposedName;
-            return /^[A-Za-z0-9_-]{1,128}$/.test(name)
-                ? [
-                    `- Enrollment: approved as enrolled:${name} (generation ${status.tokenGeneration}${scopedServing ? '' : '; scoped serving not active yet'})`,
-                    ...(scopedServing
-                        ? []
-                        : [
-                            `- Grant: \`ck auth grant --principal enrolled:${name} --selector-kind category --selector anthropic-native --operation read\``,
-                        ]),
-                ]
-                : [
-                    `- Enrollment: approved (generation ${status.tokenGeneration}${scopedServing ? '' : '; scoped serving not active yet'})`,
-                    ...(scopedServing
-                        ? []
-                        : [
-                            '- Inspect the approved name with `ck auth enroll list` before granting access.',
-                        ]),
-                ];
-        }
-        case 'denied':
-            return ['- Enrollment: denied by operator'];
-        case 'blocked':
-            return [`- Enrollment: blocked (${status.code})`];
-    }
-}
-export function buildAccountList(storage) {
-    const list = [];
-    const fiveHour = storage.quota?.mainQuota?.five_hour;
-    list.push({
-        id: 'main',
-        label: storage.main?.provider === 'anthropic' ? 'OpenCode anthropic' : 'Main',
-        role: 'main',
-        enabled: true,
-        quotaPercent: fiveHour?.usedPercent ?? null,
-        tierLabel: formatOAuthAccountTier(storage.main?.profile),
-    });
-    for (const account of storage.accounts) {
-        const fiveHourQuota = account.quota?.five_hour;
-        list.push({
-            id: account.id,
-            label: account.label ?? account.id,
-            role: 'fallback',
-            enabled: account.enabled !== false,
-            quotaPercent: fiveHourQuota?.usedPercent ?? null,
-            tierLabel: account.type === 'oauth'
-                ? formatOAuthAccountTier(account.profile)
-                : undefined,
-        });
-    }
-    return list;
-}
-const USAGE_TEXT = [
-    'Usage:',
-    '  /claude-account                       Show account list',
-    '  /claude-account enable <id>           Enable a fallback account',
-    '  /claude-account disable <id>          Disable a fallback account',
-    '  /claude-account remove <id>           Remove a fallback account',
-    '  /claude-account claustrum             Enable Claustrum mode',
-    '  /claude-account local                 Enable local mode',
-    '  /claude-account move-up <id>          Move a fallback account up',
-    '  /claude-account move-down <id>        Move a fallback account down',
-    '  /claude-account reset-backoff          Clear main OAuth refresh and quota backoff',
-    '  /claude-account enrollment-reset       Retry a denied/blocked enrollment',
-    '  /claude-account add-apikey <key>      Add an API key fallback account',
-    '  /claude-account add-oauth-start       Start OAuth device flow',
-    '  /claude-account add-oauth-finish <code>  Complete OAuth flow',
-].join('\n');
-export async function executeAccountCommand(input) {
-    const action = parseAccountCommandAction(input.argumentsText);
-    const accounts = input.storage.accounts;
-    const mainId = 'main';
-    if (action.type === 'status') {
-        const list = input.statusProjection?.accounts ?? buildAccountList(input.storage);
-        const detection = input.statusProjection?.claustrumDetection ??
-            input.claustrum?.status ??
-            'unknown';
-        const lines = [
-            '## Claude Accounts',
-            '',
-            `- Custody mode: ${getClaustrumMode(input.storage)}`,
-            `- Claustrum: ${detection}`,
-            ...(input.statusProjection?.claustrumEnrollment
-                ? formatEnrollmentStatus(input.statusProjection.claustrumEnrollment)
-                : []),
-            '',
-        ];
-        for (const a of list) {
-            const pct = a.quotaPercent != null ? ` ${Math.round(a.quotaPercent)}%` : '';
-            const status = !a.enabled ? ' (disabled)' : '';
-            const tier = a.tierLabel ? ` · ${a.tierLabel}` : '';
-            const projected = input.statusProjection?.accounts.find((account) => account.id === a.id);
-            const storedAccount = input.storage.accounts.find((account) => account.id === a.id);
-            const binding = storedAccount
-                ? input.resolveCustodyBinding?.(storedAccount)
-                : undefined;
-            const custody = projected
-                ? custodyStatusLabel(projected.custodyState)
-                : a.id !== mainId &&
-                    storedAccount &&
-                    isOAuthAccountVaultOwned(input.storage, storedAccount, binding)
-                    ? custodyStatusLabel('on-cold')
-                    : 'local';
-            lines.push(`- **${a.label}** [${a.role}]${tier}${status}${pct} · ${custody}`);
-        }
-        lines.push('', USAGE_TEXT);
-        return { text: lines.join('\n') };
-    }
-    if (action.type === 'usage') {
-        return { text: USAGE_TEXT };
-    }
-    if (action.type === 'claustrum-mode') {
-        if (!input.transition) {
-            return { text: 'Claustrum mode transition is unavailable.' };
-        }
-        return input.transition(action.mode);
-    }
-    if (action.type === 'enrollment-reset') {
-        if (getClaustrumMode(input.storage) !== 'claustrum') {
-            return {
-                text: 'Claustrum enrollment is available only in Claustrum mode.',
-            };
-        }
-        if (!input.resetEnrollment) {
-            return { text: 'Claustrum enrollment reset is unavailable.' };
-        }
-        return input.resetEnrollment();
-    }
-    if (action.type === 'add-apikey') {
-        return { text: 'add-apikey' };
-    }
-    if (action.type === 'add-oauth-start') {
-        return { text: 'add-oauth-start' };
-    }
-    if (action.type === 'add-oauth-finish') {
-        return { text: 'add-oauth-finish' };
-    }
-    if (action.type === 'reset-backoff') {
-        return {
-            text: 'Main OAuth refresh and quota backoff cleared.',
-            updated: { id: 'main', action: 'reset-backoff' },
-        };
-    }
-    const id = action.id;
-    if (id === mainId) {
-        return {
-            text: `Cannot ${action.type} the main account (OpenCode managed).`,
-        };
-    }
-    if (action.type === 'enable' || action.type === 'disable') {
-        const target = accounts.find((a) => a.id === id);
-        if (!target) {
-            return { text: `Account "${id}" not found.` };
-        }
-        return {
-            text: `Account "${target.label ?? id}" ${action.type}d.`,
-            updated: {
-                id,
-                action: action.type,
-                enabled: action.type === 'enable',
-            },
-        };
-    }
-    if (action.type === 'remove') {
-        const target = accounts.find((a) => a.id === id);
-        if (!target) {
-            return { text: `Account "${id}" not found.` };
-        }
-        if (getClaustrumMode(input.storage) === 'claustrum' &&
-            isOAuthAccount(target) &&
-            target.claustrumScopedCredentialId) {
-            return {
-                text: `Account "${target.label ?? id}" is managed by Claustrum. Disable it to stop routing, or remove it from the vault.`,
-            };
-        }
-        const binding = input.resolveCustodyBinding?.(target);
-        if (getClaustrumMode(input.storage) === 'claustrum' &&
-            isOAuthAccount(target) &&
-            binding?.status === 'resolved' &&
-            binding.source === 'manifest') {
-            return {
-                text: `Account "${target.label ?? id}" is bound by the Claustrum manifest. Disable it to stop routing, or remove its Claustrum binding before removing the routing row.`,
-            };
-        }
-        return {
-            text: `Account "${target.label ?? id}" removed.`,
-            updated: { id, action: 'remove' },
-        };
-    }
-    if (action.type === 'move-up') {
-        const idx = accounts.findIndex((a) => a.id === id);
-        if (idx < 0) {
-            return { text: `Account "${id}" not found.` };
-        }
-        if (idx === 0) {
-            return {
-                text: `Account "${accounts[idx]?.label ?? id}" is already first.`,
-            };
-        }
-        const previousOrder = accounts.map((a) => a.id);
-        const newAccounts = [...accounts];
-        [newAccounts[idx - 1], newAccounts[idx]] = [
-            newAccounts[idx],
-            newAccounts[idx - 1],
-        ];
-        const newOrder = newAccounts.map((a) => a.id);
-        return {
-            text: `Account "${accounts[idx]?.label ?? id}" moved up.`,
-            updated: { id, action: 'reorder', previousOrder, newOrder },
-        };
-    }
-    if (action.type === 'move-down') {
-        const idx = accounts.findIndex((a) => a.id === id);
-        if (idx < 0) {
-            return { text: `Account "${id}" not found.` };
-        }
-        if (idx === accounts.length - 1) {
-            return {
-                text: `Account "${accounts[idx]?.label ?? id}" is already last.`,
-            };
-        }
-        const previousOrder = accounts.map((a) => a.id);
-        const newAccounts = [...accounts];
-        [newAccounts[idx], newAccounts[idx + 1]] = [
-            newAccounts[idx + 1],
-            newAccounts[idx],
-        ];
-        const newOrder = newAccounts.map((a) => a.id);
-        return {
-            text: `Account "${accounts[idx]?.label ?? id}" moved down.`,
-            updated: { id, action: 'reorder', previousOrder, newOrder },
-        };
-    }
-    return { text: USAGE_TEXT };
-}

package/dist/constants.js

@@ -1,83 +0,0 @@
-export const CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
-export const AUTHORIZE_URLS = {
-    console: 'https://platform.claude.com/oauth/authorize',
-    max: 'https://claude.com/cai/oauth/authorize',
-};
-export const CODE_CALLBACK_URL = 'https://platform.claude.com/oauth/code/callback';
-export const TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
-export const CUSTODY_HANDLE_PATTERN = /^ckh_[A-Za-z0-9_-]{43}$/;
-export const AXIOS_USER_AGENT = 'axios/1.15.2';
-export const OAUTH_SCOPES = [
-    'org:create_api_key',
-    'user:profile',
-    'user:inference',
-    'user:sessions:claude_code',
-    'user:mcp_servers',
-    'user:file_upload',
-];
-export const REFRESH_SCOPE = 'user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload';
-export const TOOL_PREFIX = 'mcp_';
-export const REQUIRED_BETAS = [
-    'oauth-2025-04-20',
-    'interleaved-thinking-2025-05-14',
-];
-export const FAST_MODE_BETA = 'fast-mode-2026-02-01';
-export function mergeAnthropicBetas(existing, betas) {
-    const incoming = (existing ?? '')
-        .split(',')
-        .map((beta) => beta.trim())
-        .filter(Boolean);
-    return [...new Set([...incoming, ...betas])].join(',');
-}
-export function isFastModeSupportedModel(model) {
-    return (typeof model === 'string' &&
-        (model.startsWith('claude-opus-4-6') ||
-            model.startsWith('claude-opus-4-7') ||
-            model.startsWith('claude-opus-4-8') ||
-            model.startsWith('claude-opus-5')));
-}
-export const OPENCODE_IDENTITY_PREFIX = 'You are OpenCode';
-export const CLAUDE_CODE_IDENTITY = "You are Claude Code, Anthropic's official CLI for Claude.";
-export const PARALLEL_TOOL_CALLS_SYSTEM_PROMPT = [
-    '<use_parallel_tool_calls>',
-    'For maximum efficiency, whenever you perform multiple independent operations, invoke all relevant tools simultaneously rather than sequentially. Prioritize calling independent tools in parallel whenever possible. For example, when reading 3 known files, run 3 tool calls in parallel to read all 3 files into context at the same time. When running multiple independent read-only commands like `ls` or `list_dir`, run all of those commands in parallel. Err on the side of maximizing parallel tool calls for independent work rather than running too many tools sequentially.',
-    '',
-    'Do not parallelize tool calls when one call depends on the output of another call. If a tool call needs an ID, filename, search result, or any other value returned by a previous tool call, run the first call, wait for its result, then run the dependent call using the real returned value. Never invent placeholder IDs, guessed task IDs, or other guessed values for dependent tool calls just to place them in the same parallel block.',
-    '</use_parallel_tool_calls>',
-].join('\n');
-export const CCH_SALT = '59cf53e54c78';
-export const CCH_POSITIONS = [4, 7, 20];
-export const CLAUDE_CODE_VERSION = '2.1.280';
-export const CLAUDE_CODE_ENTRYPOINT = 'cli';
-export const CLAUDE_CODE_STAINLESS_PACKAGE_VERSION = '0.112.1';
-export const CLAUDE_CODE_STAINLESS_RUNTIME_VERSION = 'v26.3.0';
-export const USER_AGENT = `claude-cli/${CLAUDE_CODE_VERSION} (external, ${CLAUDE_CODE_ENTRYPOINT})`;
-export const CACHE_1H_MODES = ['explicit', 'automatic', 'hybrid'];
-export const DEFAULT_CACHE_1H_MODE = 'explicit';
-/**
- * Anchors that identify paragraphs to remove from the system prompt.
- * Any paragraph (text between blank lines) containing one of these
- * strings is removed entirely.
- *
- * This is resilient to upstream rewording — as long as the anchor
- * string (typically a URL) still appears somewhere in the paragraph,
- * the removal works regardless of how the surrounding text changes.
- */
-export const PARAGRAPH_REMOVAL_ANCHORS = [
-    // Help/feedback block — references the OpenCode GitHub repo
-    'github.com/anomalyco/opencode',
-    // OpenCode docs guidance — references the OpenCode docs URL
-    'opencode.ai/docs',
-];
-/**
- * Inline text replacements applied after paragraph removal.
- * These handle cases where "OpenCode" appears inside a paragraph
- * we want to keep (so we can't remove the whole paragraph).
- */
-export const TEXT_REPLACEMENTS = [
-    { match: 'if OpenCode honestly', replacement: 'if the assistant honestly' },
-    {
-        match: 'Here is some useful information about the environment you are running in:',
-        replacement: 'Environment context you are running in:',
-    },
-];

package/dist/custom-headers.js

@@ -1,102 +0,0 @@
-import { parseJsonRedacted } from './json.js';
-import { logger } from './logger.js';
-export const ANTHROPIC_CUSTOM_HEADERS_ENV = 'ANTHROPIC_CUSTOM_HEADERS';
-const CUSTOM_HEADER_CACHE_LIMIT = 64;
-const parsedHeadersByRawValue = new Map();
-const warnedMalformedRawValues = new Set();
-// Proxy-specific metadata is allowed, but custom configuration must never
-// replace route authentication, protocol negotiation, body framing, or
-// plugin-internal correlation headers after those guards have run.
-const PROTECTED_HEADERS = new Set([
-    'authorization',
-    'proxy-authorization',
-    'x-api-key',
-    'host',
-    'content-length',
-    'content-type',
-    'connection',
-    'transfer-encoding',
-    'upgrade',
-    'keep-alive',
-    'te',
-    'trailer',
-    'anthropic-version',
-    'anthropic-beta',
-    'x-parent-session-id',
-    'x-session-affinity',
-    'x-opencode-session',
-    'x-anthropic-effort-plan',
-    'x-cortexkit-billing-lineage',
-]);
-function cacheParsed(raw, entries) {
-    parsedHeadersByRawValue.delete(raw);
-    parsedHeadersByRawValue.set(raw, entries);
-    while (parsedHeadersByRawValue.size > CUSTOM_HEADER_CACHE_LIMIT) {
-        const oldest = parsedHeadersByRawValue.keys().next().value;
-        if (oldest === undefined)
-            break;
-        parsedHeadersByRawValue.delete(oldest);
-        warnedMalformedRawValues.delete(oldest);
-    }
-}
-function setCustomHeader(headers, name, value) {
-    if (PROTECTED_HEADERS.has(name.trim().toLowerCase())) {
-        throw new TypeError('protected header');
-    }
-    headers.set(name, value);
-}
-export function parseCustomHeaders(raw) {
-    if (!raw?.trim())
-        return new Headers();
-    const cached = parsedHeadersByRawValue.get(raw);
-    if (cached !== undefined || parsedHeadersByRawValue.has(raw)) {
-        return new Headers(cached ?? []);
-    }
-    try {
-        const headers = new Headers();
-        const trimmed = raw.trim();
-        if (!trimmed.startsWith('{') && !trimmed.startsWith('[')) {
-            for (const entry of trimmed
-                .split(/\r?\n|,\s*(?=[^,\s:]+:)/)
-                .map((value) => value.trim())
-                .filter(Boolean)) {
-                const separator = entry.indexOf(':');
-                if (separator <= 0) {
-                    throw new TypeError('invalid header entry');
-                }
-                setCustomHeader(headers, entry.slice(0, separator).trim(), entry.slice(separator + 1).trim());
-            }
-        }
-        else {
-            const parsed = parseJsonRedacted(trimmed);
-            if (parsed == null ||
-                typeof parsed !== 'object' ||
-                Array.isArray(parsed)) {
-                throw new TypeError('invalid header object');
-            }
-            for (const [key, value] of Object.entries(parsed)) {
-                if (value == null)
-                    continue;
-                setCustomHeader(headers, key, Array.isArray(value) ? value.map(String).join(', ') : String(value));
-            }
-        }
-        const entries = [...headers.entries()];
-        cacheParsed(raw, entries);
-        return new Headers(entries);
-    }
-    catch {
-        cacheParsed(raw, null);
-        if (!warnedMalformedRawValues.has(raw)) {
-            warnedMalformedRawValues.add(raw);
-            logger.warn('custom-headers', 'ignoring malformed ANTHROPIC_CUSTOM_HEADERS', { reason: 'invalid or protected header configuration' });
-        }
-        return new Headers();
-    }
-}
-export function applyCustomHeaders(headers, raw = process.env[ANTHROPIC_CUSTOM_HEADERS_ENV]) {
-    const customHeaders = parseCustomHeaders(raw);
-    customHeaders.forEach((value, key) => {
-        headers.set(key, value);
-    });
-    return headers;
-}