@cortexkit/anthropic-auth-core 1.3.0 → 1.4.1

package/dist/accounts.d.ts

@@ -98,6 +98,8 @@ export declare function acquireRefreshFileLock(options: {
     ttlMs: number;
     path?: string;
     now?: () => number;
+    renew?: boolean;
+    renewIntervalMs?: number;
 }): Promise<{
     release: () => Promise<void>;
 } | null>;

package/dist/accounts.js

@@ -5,6 +5,8 @@ import { dirname, join } from 'node:path';
 import { ClaudeOAuthRefreshError, refreshClaudeOAuthToken } from "./auth.js";
 import { CACHE_1H_MODES, CLAUDE_CODE_VERSION, DEFAULT_CACHE_1H_MODE, } from "./constants.js";
 import { log } from "./logger.js";
+const setRefreshLockRenewalTimeout = globalThis.setTimeout.bind(globalThis);
+const clearRefreshLockRenewalTimeout = globalThis.clearTimeout.bind(globalThis);
 export const ACCOUNT_FILE_NAME = 'anthropic-auth.json';
 export const QUOTA_URL = 'https://api.anthropic.com/api/oauth/usage';
 const DEFAULT_FALLBACK_ON = [401, 403, 429];
@@ -22,7 +24,7 @@ const DEFAULT_MINIMUM_REMAINING = {
 const DEFAULT_FAIL_CLOSED_ON_UNKNOWN_QUOTA = true;
 const BACKGROUND_TICK_MS = 60_000;
 const BACKGROUND_TICK_JITTER_MS = 60_000;
-const FALLBACK_REFRESH_LOCK_TTL_MS = 2 * 60_000;
+const FALLBACK_REFRESH_LOCK_TTL_MS = 10 * 60_000;
 const FALLBACK_REFRESH_JOIN_WAIT_MS = 10_000;
 const FALLBACK_REFRESH_JOIN_POLL_MS = 100;
 function getConfigDir() {
@@ -171,6 +173,8 @@ export async function acquireRefreshFileLock(options) {
     const legacyOwnerPath = join(lockPath, 'owner.json');
     const ownerId = randomUUID();
     const now = options.now ?? Date.now;
+    let renewTimer = null;
+    let released = false;
     async function readOwner() {
         try {
             return JSON.parse(await readFile(lockPath, 'utf8'));
@@ -182,6 +186,9 @@ export async function acquireRefreshFileLock(options) {
             return JSON.parse(await readFile(legacyOwnerPath, 'utf8'));
         }
     }
+    async function writeOwner() {
+        await writeFile(lockPath, `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}\n`, { encoding: 'utf8', mode: 0o600 });
+    }
     async function tryAcquire() {
         try {
             await writeFile(lockPath, `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
@@ -194,6 +201,31 @@ export async function acquireRefreshFileLock(options) {
             throw error;
         }
     }
+    function scheduleRenewal() {
+        if (!options.renew || released)
+            return;
+        const intervalMs = options.renewIntervalMs ?? Math.max(1_000, Math.floor(options.ttlMs / 3));
+        renewTimer = setRefreshLockRenewalTimeout(() => {
+            void (async () => {
+                try {
+                    const owner = await readOwner();
+                    const currentNow = now();
+                    if (released ||
+                        owner?.ownerId !== ownerId ||
+                        Number(owner?.expiresAt) <= currentNow) {
+                        return;
+                    }
+                    await writeOwner();
+                    scheduleRenewal();
+                }
+                catch {
+                    // If renewal fails, contenders will wait until the last written expiry.
+                }
+            })();
+        }, intervalMs);
+        if ('unref' in renewTimer)
+            renewTimer.unref();
+    }
     if (!(await tryAcquire())) {
         try {
             const owner = await readOwner();
@@ -214,8 +246,14 @@ export async function acquireRefreshFileLock(options) {
         if (!(await tryAcquire()))
             return null;
     }
+    scheduleRenewal();
     return {
         release: async () => {
+            released = true;
+            if (renewTimer) {
+                clearRefreshLockRenewalTimeout(renewTimer);
+                renewTimer = null;
+            }
             try {
                 const owner = await readOwner();
                 if (owner?.ownerId !== ownerId)
@@ -851,6 +889,7 @@ export class FallbackAccountManager {
             ttlMs: FALLBACK_REFRESH_LOCK_TTL_MS,
             path: this.configPath,
             now: this.now,
+            renew: true,
         });
         if (!fileLock) {
             log('[refresh] fallback oauth refresh skipped file lock', {

package/dist/cachekeep.js

@@ -1,4 +1,4 @@
-import { CCH_PATTERN, signRequestBody } from "./cch.js";
+import { signRequestBody } from "./cch.js";
 import { orderClaudeCodeBody } from "./claude-code.js";
 export const CLAUDE_CACHE_KEEP_COMMAND_NAME = 'claude-cachekeep';
 export const CACHE_KEEP_TTL_MS = 60 * 60_000;
@@ -169,8 +169,7 @@ export async function buildCacheKeepPrewarmBody(bodyText) {
     if (toolChoice?.type === 'tool' || toolChoice?.type === 'any') {
         delete warm.tool_choice;
     }
-    const unsignedBodyText = JSON.stringify(orderClaudeCodeBody(warm)).replace(CCH_PATTERN, 'cch=00000;');
-    const signedBodyText = await signRequestBody(unsignedBodyText);
+    const signedBodyText = await signRequestBody(JSON.stringify(orderClaudeCodeBody(warm)));
     return { ok: true, bodyText: signedBodyText };
 }
 export class CacheKeepManager {

package/dist/cch.d.ts

@@ -18,6 +18,8 @@ export declare function extractFirstUserMessageText(messages: Message[]): string
  * masks to 20 bits, and writes that value into the billing-header placeholder.
  */
 export declare function computeCCH(bodyBytes: Uint8Array): Promise<string>;
+export declare function resetBillingHeaderCCH(bodyString: string): string;
+export declare function extractBillingHeaderCCH(bodyString: string): string | null;
 export declare function signRequestBody(bodyString: string): Promise<string>;
 /**
  * Compute a stable 3-character suffix for cc_version.

package/dist/cch.js

@@ -2,7 +2,10 @@ import { createHash } from 'node:crypto';
 import xxhashInit from 'xxhash-wasm';
 import { CLAUDE_CODE_BUILD_HASH, CLAUDE_CODE_VERSION } from "./constants.js";
 const CCH_SEED = 0x6e52736ac806831en;
+const CCH_PLACEHOLDER = 'cch=00000;';
 export const CCH_PATTERN = /\bcch=([0-9a-f]{5});/;
+const BILLING_HEADER_CCH_PATTERN = /("system":\[\{"type":"text","text":"x-anthropic-billing-header: cc_version=[^;"]+; cc_entrypoint=[^;"]+; )cch=([0-9a-f]{5});/;
+const BILLING_HEADER_CCH_PLACEHOLDER_PATTERN = /("system":\[\{"type":"text","text":"x-anthropic-billing-header: cc_version=[^;"]+; cc_entrypoint=[^;"]+; )cch=00000;/;
 let xxhashPromise = null;
 let xxhash64Raw = null;
 async function ensureXxhash() {
@@ -43,11 +46,18 @@ export async function computeCCH(bodyBytes) {
     const hash = xxhash64Raw?.(bodyBytes, CCH_SEED) ?? 0n;
     return (hash & 0xfffffn).toString(16).padStart(5, '0');
 }
+export function resetBillingHeaderCCH(bodyString) {
+    return bodyString.replace(BILLING_HEADER_CCH_PATTERN, `$1${CCH_PLACEHOLDER}`);
+}
+export function extractBillingHeaderCCH(bodyString) {
+    return BILLING_HEADER_CCH_PATTERN.exec(bodyString)?.[2] ?? null;
+}
 export async function signRequestBody(bodyString) {
-    if (!CCH_PATTERN.test(bodyString))
+    if (!BILLING_HEADER_CCH_PATTERN.test(bodyString))
         return bodyString;
-    const token = await computeCCH(new TextEncoder().encode(bodyString));
-    return bodyString.replace(CCH_PATTERN, `cch=${token};`);
+    const unsignedBodyString = resetBillingHeaderCCH(bodyString);
+    const token = await computeCCH(new TextEncoder().encode(unsignedBodyString));
+    return unsignedBodyString.replace(BILLING_HEADER_CCH_PLACEHOLDER_PATTERN, `$1cch=${token};`);
 }
 /**
  * Compute a stable 3-character suffix for cc_version.

package/dist/constants.d.ts

@@ -13,6 +13,7 @@ export declare function mergeAnthropicBetas(existing: string | null | undefined,
 export declare function isFastModeSupportedModel(model: unknown): boolean;
 export declare const OPENCODE_IDENTITY_PREFIX = "You are OpenCode";
 export declare const CLAUDE_CODE_IDENTITY = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
+export declare const PARALLEL_TOOL_CALLS_SYSTEM_PROMPT: string;
 export declare const CCH_SALT = "59cf53e54c78";
 export declare const CCH_POSITIONS: number[];
 export declare const CLAUDE_CODE_VERSION = "2.1.141";

package/dist/constants.js

@@ -28,10 +28,19 @@ export function mergeAnthropicBetas(existing, betas) {
 }
 export function isFastModeSupportedModel(model) {
     return (typeof model === 'string' &&
-        (model.startsWith('claude-opus-4-6') || model.startsWith('claude-opus-4-7')));
+        (model.startsWith('claude-opus-4-6') ||
+            model.startsWith('claude-opus-4-7') ||
+            model.startsWith('claude-opus-4-8')));
 }
 export const OPENCODE_IDENTITY_PREFIX = 'You are OpenCode';
 export const CLAUDE_CODE_IDENTITY = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
+export const PARALLEL_TOOL_CALLS_SYSTEM_PROMPT = [
+    '<use_parallel_tool_calls>',
+    'For maximum efficiency, whenever you perform multiple independent operations, invoke all relevant tools simultaneously rather than sequentially. Prioritize calling independent tools in parallel whenever possible. For example, when reading 3 known files, run 3 tool calls in parallel to read all 3 files into context at the same time. When running multiple independent read-only commands like `ls` or `list_dir`, run all of those commands in parallel. Err on the side of maximizing parallel tool calls for independent work rather than running too many tools sequentially.',
+    '',
+    'Do not parallelize tool calls when one call depends on the output of another call. If a tool call needs an ID, filename, search result, or any other value returned by a previous tool call, run the first call, wait for its result, then run the dependent call using the real returned value. Never invent placeholder IDs, guessed task IDs, or other guessed values for dependent tool calls just to place them in the same parallel block.',
+    '</use_parallel_tool_calls>',
+].join('\n');
 export const CCH_SALT = '59cf53e54c78';
 export const CCH_POSITIONS = [4, 7, 20];
 export const CLAUDE_CODE_VERSION = '2.1.141';

package/dist/dump.js

@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto';
 import { mkdir, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { extractBillingHeaderCCH } from "./cch.js";
 import { relayLog } from "./logger.js";
 export const CLAUDE_DUMP_COMMAND_NAME = 'claude-dump';
 const DUMP_STATUS_TITLE = '## Claude Dump Status';
@@ -9,7 +10,8 @@ const DUMP_ENABLED_TITLE = '## Claude Dump Enabled';
 const DUMP_DISABLED_TITLE = '## Claude Dump Disabled';
 const DUMP_USAGE_TITLE = '## Claude Dump Usage';
 const DUMP_USAGE = 'Usage: `/claude-dump`, `/claude-dump on`, or `/claude-dump off`.';
-const DUMP_DIR = join(tmpdir(), 'opencode-anthropic-auth-dumps');
+const DUMP_DIR_ENV = 'OPENCODE_ANTHROPIC_AUTH_DUMP_DIR';
+const DEFAULT_DUMP_DIR = join(tmpdir(), 'opencode-anthropic-auth-dumps');
 let dumpEnabled = false;
 let nextDumpId = 0;
 export function isDumpEnabled() {
@@ -22,7 +24,7 @@ export function resetDumpState() {
     dumpEnabled = false;
 }
 export function getDumpDirectory() {
-    return DUMP_DIR;
+    return process.env[DUMP_DIR_ENV] || DEFAULT_DUMP_DIR;
 }
 export function parseDumpCommandAction(argumentsText) {
     const normalized = argumentsText.trim().split(/\s+/).filter(Boolean);
@@ -40,7 +42,7 @@ export function buildDumpStatusSummary(input) {
         DUMP_STATUS_TITLE,
         '',
         `- Enabled: ${enabled ? 'enabled' : 'disabled'}`,
-        `- Directory: ${DUMP_DIR}`,
+        `- Directory: ${getDumpDirectory()}`,
         '- Persisted: ~/.config/opencode/anthropic-auth.json',
         '- Captures: final rewritten Anthropic body plus redacted relay payload metadata',
         '- Warning: body dumps may contain prompt/session content; turn this off after debugging',
@@ -80,7 +82,7 @@ function hashText(value) {
     return createHash('sha256').update(value).digest('hex');
 }
 function cchToken(bodyText) {
-    return bodyText.match(/\bcch=([0-9a-f]{5});/)?.[1] ?? null;
+    return extractBillingHeaderCCH(bodyText);
 }
 function diffSummary(previousBodyText, bodyText) {
     if (previousBodyText == null)
@@ -183,9 +185,10 @@ export async function dumpRelayRequest(input) {
         return;
     nextDumpId += 1;
     const id = `${new Date().toISOString().replace(/[:.]/g, '-')}-${String(nextDumpId).padStart(5, '0')}-${input.transport}-p${input.protocol}-${input.mode}`;
-    const prefix = join(DUMP_DIR, id);
+    const dumpDir = getDumpDirectory();
+    const prefix = join(dumpDir, id);
     try {
-        await mkdir(DUMP_DIR, { recursive: true });
+        await mkdir(dumpDir, { recursive: true });
         const metadata = {
             id,
             createdAt: new Date().toISOString(),

package/dist/fast.js

@@ -32,7 +32,7 @@ export function buildFastModeStatusSummary(input) {
         `- Enabled: ${enabled ? 'enabled' : 'disabled'}`,
         '- Persisted: ~/.config/opencode/anthropic-auth.json',
         '- Scope: adds Anthropic fast mode to supported Opus requests',
-        '- Supported models: claude-opus-4-6 and claude-opus-4-7',
+        '- Supported models: claude-opus-4-6, claude-opus-4-7, and claude-opus-4-8',
         '- Request changes: adds `speed: "fast"` and the `fast-mode-2026-02-01` beta header',
         '- Note: fast and standard speeds do not share prompt-cache prefixes',
     ].join('\n');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "1.3.0",
+  "version": "1.4.1",
   "type": "module",
   "repository": {
     "type": "git",