@cortexkit/anthropic-auth-core 1.7.0 → 1.9.0

package/dist/accounts.d.ts

@@ -1,22 +1,35 @@
 import { type Cache1hMode } from './constants.ts';
 export declare const ACCOUNT_FILE_NAME = "anthropic-auth.json";
+export declare const ACCOUNT_STATE_FILE_NAME = "anthropic-auth-state.json";
 export declare const QUOTA_URL = "https://api.anthropic.com/api/oauth/usage";
 export type QuotaWindowName = 'five_hour' | 'seven_day';
-export type OAuthAccount = {
+export type AccountBase = {
     id: string;
     label?: string;
+    enabled?: boolean;
+    addedAt?: number;
+    lastUsed?: number;
+};
+export type OAuthAccount = AccountBase & {
     type: 'oauth';
     access?: string;
     refresh: string;
     expires?: number;
-    enabled?: boolean;
-    addedAt?: number;
-    lastUsed?: number;
     lastRefreshedAt?: number;
     lastRefreshError?: AccountOperationError;
     lastQuotaRefreshError?: AccountOperationError;
     quota?: Partial<Record<QuotaWindowName, AccountQuotaWindow>>;
 };
+export type ApiKeyAccount = AccountBase & {
+    type: 'api';
+    apiKey?: string;
+    baseURL: string;
+    authHeader?: 'authorization-bearer' | 'x-api-key';
+};
+export type FallbackAccount = OAuthAccount | ApiKeyAccount;
+export declare function isOAuthAccount(account: FallbackAccount): account is OAuthAccount;
+export declare function isApiKeyAccount(account: FallbackAccount): account is ApiKeyAccount;
+export declare function isValidApiBaseURL(value: string | undefined): boolean;
 export type AccountOperationError = {
     message: string;
     checkedAt: number;
@@ -81,6 +94,14 @@ export type AccountStorage = {
     claudeFast?: {
         enabled?: boolean;
     };
+    /**
+     * Zero out Anthropic OAuth model costs in the provider hook. Default: enabled
+     * (OAuth usage is quota-based, not per-token billed, so costs show as $0).
+     * Set `enabled: false` to opt out and display the provider's real model costs.
+     */
+    costZeroing?: {
+        enabled?: boolean;
+    };
     cacheKeep?: {
         enabled?: boolean;
         startHour?: number;
@@ -94,7 +115,33 @@ export type AccountStorage = {
         transport?: 'http' | 'websocket';
     };
     killswitch?: KillswitchConfig;
-    accounts: OAuthAccount[];
+    accounts: FallbackAccount[];
+};
+/**
+ * Whether Anthropic OAuth model costs should be zeroed in the provider hook.
+ * Defaults to enabled; only an explicit `costZeroing.enabled === false` opts out
+ * (to display the provider's real model costs).
+ */
+export declare function isCostZeroingEnabled(storage: Pick<AccountStorage, 'costZeroing'>): boolean;
+export type AccountRuntimeEntry = Partial<Pick<OAuthAccount, 'access' | 'refresh' | 'expires' | 'lastUsed' | 'lastRefreshedAt' | 'lastRefreshError' | 'lastQuotaRefreshError' | 'quota'> & Pick<ApiKeyAccount, 'apiKey' | 'lastUsed'>>;
+export type AccountRuntimeState = {
+    version: 1;
+    main?: {
+        quota?: OAuthQuotaSnapshot;
+        quotaCheckedAt?: number;
+        quotaToken?: string;
+        lastQuotaApiError?: AccountOperationError;
+        lastRefreshError?: AccountOperationError;
+        refreshLeaseId?: string;
+        refreshLeaseUntil?: number;
+        refreshLeaseTokenHash?: string;
+    };
+    accounts?: Record<string, AccountRuntimeEntry>;
+};
+export type AccountStateSaveScope = {
+    mainQuota?: boolean;
+    mainRefresh?: boolean;
+    accounts?: true | string[];
 };
 export type OAuthQuotaSnapshot = Partial<Record<QuotaWindowName, AccountQuotaWindow>>;
 export type AccountManagerOptions = {
@@ -109,8 +156,10 @@ export type AccountRefreshError = {
     message: string;
 };
 export declare function getAccountStoragePath(): string;
+export declare function getAccountStatePath(configPath?: string): string;
 export declare function loadAccounts(path?: string): Promise<AccountStorage | null>;
 export declare function saveAccounts(storage: AccountStorage, path?: string): Promise<void>;
+export declare function saveAccountState(storage: AccountStorage, path?: string, scope?: AccountStateSaveScope): Promise<void>;
 export declare function acquireRefreshFileLock(options: {
     name: string;
     ttlMs: number;
@@ -202,11 +251,11 @@ export declare class FallbackAccountManager {
      */
     private seedFallbackQuota;
     load(): Promise<AccountStorage | null>;
-    save(storage: AccountStorage): Promise<void>;
+    save(storage: AccountStorage, accountIds?: string[]): Promise<void>;
     startBackgroundRefresh(): void;
     stopBackgroundRefresh(): void;
     getUsableFallbackAccounts(existingStorage?: AccountStorage | null): Promise<OAuthAccount[]>;
-    markUsed(account: OAuthAccount): Promise<void>;
+    markUsed(account: FallbackAccount): Promise<void>;
     accountPassesQuotaPolicy(account: OAuthAccount, storage: AccountStorage | null): boolean;
     /**
      * Return the account with its quota overlaid from the unified QuotaManager

package/dist/accounts.js

@@ -8,7 +8,36 @@ import { log } from "./logger.js";
 const setRefreshLockRenewalTimeout = globalThis.setTimeout.bind(globalThis);
 const clearRefreshLockRenewalTimeout = globalThis.clearTimeout.bind(globalThis);
 export const ACCOUNT_FILE_NAME = 'anthropic-auth.json';
+export const ACCOUNT_STATE_FILE_NAME = 'anthropic-auth-state.json';
 export const QUOTA_URL = 'https://api.anthropic.com/api/oauth/usage';
+export function isOAuthAccount(account) {
+    return account.type === 'oauth';
+}
+export function isApiKeyAccount(account) {
+    return account.type === 'api';
+}
+export function isValidApiBaseURL(value) {
+    const raw = value?.trim();
+    if (!raw)
+        return false;
+    try {
+        const url = new URL(raw);
+        return ((url.protocol === 'http:' || url.protocol === 'https:') &&
+            !url.username &&
+            !url.password);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether Anthropic OAuth model costs should be zeroed in the provider hook.
+ * Defaults to enabled; only an explicit `costZeroing.enabled === false` opts out
+ * (to display the provider's real model costs).
+ */
+export function isCostZeroingEnabled(storage) {
+    return storage.costZeroing?.enabled !== false;
+}
 const DEFAULT_FALLBACK_ON = [401, 403, 429];
 const MIN_REFRESH_BEFORE_EXPIRY_MINUTES = 240;
 const DEFAULT_REFRESH_BEFORE_EXPIRY_MINUTES = MIN_REFRESH_BEFORE_EXPIRY_MINUTES;
@@ -40,28 +69,55 @@ export function getAccountStoragePath() {
     return (process.env.OPENCODE_ANTHROPIC_AUTH_FILE?.trim() ||
         join(getConfigDir(), ACCOUNT_FILE_NAME));
 }
+export function getAccountStatePath(configPath = getAccountStoragePath()) {
+    const explicit = process.env.OPENCODE_ANTHROPIC_AUTH_STATE_FILE?.trim();
+    if (explicit)
+        return explicit;
+    return configPath.endsWith(ACCOUNT_FILE_NAME)
+        ? join(dirname(configPath), ACCOUNT_STATE_FILE_NAME)
+        : `${configPath}.state.json`;
+}
 function isRecord(value) {
     return value != null && typeof value === 'object' && !Array.isArray(value);
 }
+function normalizeAccountBase(value) {
+    return {
+        id: typeof value.id === 'string' && value.id.trim()
+            ? value.id.trim()
+            : randomUUID(),
+        label: typeof value.label === 'string' ? value.label : undefined,
+        enabled: typeof value.enabled === 'boolean' ? value.enabled : undefined,
+        addedAt: typeof value.addedAt === 'number' ? value.addedAt : undefined,
+        lastUsed: typeof value.lastUsed === 'number' ? value.lastUsed : undefined,
+    };
+}
 function normalizeAccount(value) {
     if (!isRecord(value))
         return null;
+    if (value.type === 'api') {
+        const baseURL = typeof value.baseURL === 'string' ? value.baseURL.trim() : '';
+        const apiKey = typeof value.apiKey === 'string' ? value.apiKey.trim() : '';
+        if (!isValidApiBaseURL(baseURL))
+            return null;
+        const authHeader = value.authHeader === 'x-api-key' ? 'x-api-key' : 'authorization-bearer';
+        return {
+            ...normalizeAccountBase(value),
+            type: 'api',
+            apiKey: apiKey || undefined,
+            baseURL,
+            authHeader,
+        };
+    }
     if (value.type !== 'oauth')
         return null;
     if (typeof value.refresh !== 'string' || !value.refresh.trim())
         return null;
     return {
-        id: typeof value.id === 'string' && value.id.trim()
-            ? value.id.trim()
-            : randomUUID(),
-        label: typeof value.label === 'string' ? value.label : undefined,
+        ...normalizeAccountBase(value),
         type: 'oauth',
         access: typeof value.access === 'string' ? value.access : undefined,
         refresh: value.refresh,
         expires: typeof value.expires === 'number' ? value.expires : undefined,
-        enabled: typeof value.enabled === 'boolean' ? value.enabled : undefined,
-        addedAt: typeof value.addedAt === 'number' ? value.addedAt : undefined,
-        lastUsed: typeof value.lastUsed === 'number' ? value.lastUsed : undefined,
         lastRefreshedAt: typeof value.lastRefreshedAt === 'number'
             ? value.lastRefreshedAt
             : undefined,
@@ -128,6 +184,7 @@ function normalizeStorage(value) {
         claudeCache: isRecord(value.claudeCache) ? value.claudeCache : undefined,
         dump: isRecord(value.dump) ? value.dump : undefined,
         claudeFast: isRecord(value.claudeFast) ? value.claudeFast : undefined,
+        costZeroing: isRecord(value.costZeroing) ? value.costZeroing : undefined,
         cacheKeep: isRecord(value.cacheKeep) ? value.cacheKeep : undefined,
         relay: isRecord(value.relay) ? value.relay : undefined,
         killswitch: isRecord(value.killswitch) ? value.killswitch : undefined,
@@ -136,41 +193,227 @@ function normalizeStorage(value) {
             .filter((account) => account != null),
     };
 }
-export async function loadAccounts(path = getAccountStoragePath()) {
+async function readJsonIfPresent(path) {
     try {
-        const raw = await readFile(path, 'utf8');
-        return normalizeStorage(JSON.parse(raw));
+        return { exists: true, value: JSON.parse(await readFile(path, 'utf8')) };
     }
     catch (error) {
-        if (error.code === 'ENOENT')
-            return null;
-        return null;
+        if (error.code === 'ENOENT') {
+            return { exists: false, value: null };
+        }
+        return { exists: false, value: null };
     }
 }
+function objectWithDefinedEntries(value) {
+    return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined));
+}
+function mergeConfigAndState(configValue, stateValue) {
+    if (!isRecord(configValue))
+        return configValue;
+    const state = isRecord(stateValue) ? stateValue : {};
+    const mainState = isRecord(state.main) ? state.main : undefined;
+    const stateAccounts = isRecord(state.accounts) ? state.accounts : {};
+    const quotaConfig = isRecord(configValue.quota) ? configValue.quota : {};
+    const refreshConfig = isRecord(configValue.refresh) ? configValue.refresh : {};
+    const mainQuotaSource = mainState ?? quotaConfig;
+    const mainRefreshSource = mainState ?? refreshConfig;
+    const accounts = Array.isArray(configValue.accounts)
+        ? configValue.accounts.map((account) => {
+            if (!isRecord(account))
+                return account;
+            const stateAccount = typeof account.id === 'string' && isRecord(stateAccounts[account.id])
+                ? stateAccounts[account.id]
+                : {};
+            return { ...account, ...stateAccount };
+        })
+        : [];
+    return {
+        ...configValue,
+        refresh: objectWithDefinedEntries({
+            ...refreshConfig,
+            mainLastRefreshError: mainRefreshSource.lastRefreshError,
+            mainRefreshLeaseId: mainRefreshSource.refreshLeaseId,
+            mainRefreshLeaseUntil: mainRefreshSource.refreshLeaseUntil,
+            mainRefreshLeaseTokenHash: mainRefreshSource.refreshLeaseTokenHash,
+        }),
+        quota: objectWithDefinedEntries({
+            ...quotaConfig,
+            mainQuota: mainQuotaSource.quota,
+            mainQuotaCheckedAt: mainQuotaSource.quotaCheckedAt,
+            mainQuotaToken: mainQuotaSource.quotaToken,
+            mainLastQuotaApiError: mainQuotaSource.lastQuotaApiError,
+        }),
+        accounts,
+    };
+}
+export async function loadAccounts(path = getAccountStoragePath()) {
+    const config = await readJsonIfPresent(path);
+    if (!config.exists)
+        return null;
+    const state = await readJsonIfPresent(getAccountStatePath(path));
+    return normalizeStorage(mergeConfigAndState(config.value, state.value));
+}
 async function loadExistingTopLevelFields(path) {
-    try {
-        const raw = await readFile(path, 'utf8');
-        const parsed = JSON.parse(raw);
-        return isRecord(parsed) ? parsed : {};
-    }
-    catch {
-        return {};
-    }
+    const existing = await readJsonIfPresent(path);
+    return isRecord(existing.value) ? existing.value : {};
 }
 function omitUndefinedTopLevel(value) {
     return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined));
 }
-export async function saveAccounts(storage, path = getAccountStoragePath()) {
+function accountConfig(account) {
+    return objectWithDefinedEntries({
+        id: account.id,
+        label: account.label,
+        type: account.type,
+        enabled: account.enabled,
+        addedAt: account.addedAt,
+        baseURL: account.type === 'api' ? account.baseURL : undefined,
+        authHeader: account.type === 'api' ? account.authHeader : undefined,
+    });
+}
+function accountRuntimeState(account) {
+    if (account.type === 'api') {
+        return objectWithDefinedEntries({
+            apiKey: account.apiKey,
+            lastUsed: account.lastUsed,
+        });
+    }
+    return objectWithDefinedEntries({
+        access: account.access,
+        refresh: account.refresh,
+        expires: account.expires,
+        lastUsed: account.lastUsed,
+        lastRefreshedAt: account.lastRefreshedAt,
+        lastRefreshError: account.lastRefreshError,
+        lastQuotaRefreshError: account.lastQuotaRefreshError,
+        quota: account.quota,
+    });
+}
+function configFromStorage(storage) {
+    const refresh = storage.refresh
+        ? objectWithDefinedEntries({
+            enabled: storage.refresh.enabled,
+            intervalMinutes: storage.refresh.intervalMinutes,
+            refreshBeforeExpiryMinutes: storage.refresh.refreshBeforeExpiryMinutes,
+        })
+        : undefined;
+    const quota = storage.quota
+        ? objectWithDefinedEntries({
+            enabled: storage.quota.enabled,
+            checkIntervalMinutes: storage.quota.checkIntervalMinutes,
+            refreshEveryNRequests: storage.quota.refreshEveryNRequests,
+            minimumRemaining: storage.quota.minimumRemaining,
+            failClosedOnUnknownQuota: storage.quota.failClosedOnUnknownQuota,
+            showToasts: storage.quota.showToasts,
+        })
+        : undefined;
+    return omitUndefinedTopLevel({
+        version: 1,
+        main: storage.main,
+        routing: storage.routing,
+        fallbackOn: storage.fallbackOn,
+        refresh,
+        quota,
+        claudeCache: storage.claudeCache,
+        dump: storage.dump,
+        claudeFast: storage.claudeFast,
+        costZeroing: storage.costZeroing,
+        cacheKeep: storage.cacheKeep,
+        relay: storage.relay,
+        killswitch: storage.killswitch,
+        accounts: storage.accounts.map(accountConfig),
+    });
+}
+function stateFromStorage(storage) {
+    const accounts = Object.fromEntries(storage.accounts.map((account) => [
+        account.id,
+        accountRuntimeState(account),
+    ]));
+    return {
+        version: 1,
+        main: objectWithDefinedEntries({
+            quota: storage.quota?.mainQuota,
+            quotaCheckedAt: storage.quota?.mainQuotaCheckedAt,
+            quotaToken: storage.quota?.mainQuotaToken,
+            lastQuotaApiError: storage.quota?.mainLastQuotaApiError,
+            lastRefreshError: storage.refresh?.mainLastRefreshError,
+            refreshLeaseId: storage.refresh?.mainRefreshLeaseId,
+            refreshLeaseUntil: storage.refresh?.mainRefreshLeaseUntil,
+            refreshLeaseTokenHash: storage.refresh?.mainRefreshLeaseTokenHash,
+        }),
+        accounts,
+    };
+}
+async function writeJsonAtomic(path, value) {
     await mkdir(dirname(path), { recursive: true });
-    const existing = await loadExistingTopLevelFields(path);
-    const next = { ...existing, ...omitUndefinedTopLevel(storage) };
     const tempPath = `${path}.${randomUUID()}.tmp`;
-    await writeFile(tempPath, `${JSON.stringify(next, null, 2)}\n`, {
+    await writeFile(tempPath, `${JSON.stringify(value, null, 2)}\n`, {
         encoding: 'utf8',
         mode: 0o600,
     });
     await rename(tempPath, path);
 }
+export async function saveAccounts(storage, path = getAccountStoragePath()) {
+    const existing = await loadExistingTopLevelFields(path);
+    const nextConfig = { ...existing, ...configFromStorage(storage) };
+    await writeJsonAtomic(path, nextConfig);
+    await writeJsonAtomic(getAccountStatePath(path), stateFromStorage(storage));
+}
+function applyMainQuotaStatePatch(state, storage) {
+    state.main = state.main ?? {};
+    state.main.quota = storage.quota?.mainQuota;
+    state.main.quotaCheckedAt = storage.quota?.mainQuotaCheckedAt;
+    state.main.quotaToken = storage.quota?.mainQuotaToken;
+    state.main.lastQuotaApiError = storage.quota?.mainLastQuotaApiError;
+}
+function applyMainRefreshStatePatch(state, storage) {
+    state.main = state.main ?? {};
+    state.main.lastRefreshError = storage.refresh?.mainLastRefreshError;
+    state.main.refreshLeaseId = storage.refresh?.mainRefreshLeaseId;
+    state.main.refreshLeaseUntil = storage.refresh?.mainRefreshLeaseUntil;
+    state.main.refreshLeaseTokenHash = storage.refresh?.mainRefreshLeaseTokenHash;
+}
+function pruneUndefined(value) {
+    if (Array.isArray(value))
+        return value.map(pruneUndefined);
+    if (!isRecord(value))
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .filter(([, entry]) => entry !== undefined)
+        .map(([key, entry]) => [key, pruneUndefined(entry)]));
+}
+export async function saveAccountState(storage, path = getAccountStoragePath(), scope = {
+    mainQuota: true,
+    mainRefresh: true,
+    accounts: true,
+}) {
+    const statePath = getAccountStatePath(path);
+    const existing = (await readJsonIfPresent(statePath)).value;
+    const next = isRecord(existing)
+        ? { ...existing, version: 1 }
+        : { version: 1 };
+    if (scope.mainQuota)
+        applyMainQuotaStatePatch(next, storage);
+    if (scope.mainRefresh)
+        applyMainRefreshStatePatch(next, storage);
+    if (scope.accounts) {
+        const ids = scope.accounts === true ? null : new Set(scope.accounts);
+        next.accounts = { ...(isRecord(next.accounts) ? next.accounts : {}) };
+        for (const account of storage.accounts) {
+            if (ids && !ids.has(account.id))
+                continue;
+            next.accounts[account.id] = accountRuntimeState(account);
+        }
+        if (ids) {
+            for (const id of ids) {
+                if (!storage.accounts.some((account) => account.id === id)) {
+                    delete next.accounts[id];
+                }
+            }
+        }
+    }
+    await writeJsonAtomic(statePath, pruneUndefined(next));
+}
 export async function acquireRefreshFileLock(options) {
     const accountPath = options.path ?? getAccountStoragePath();
     const lockPath = `${accountPath}.${options.name}.lock`;
@@ -786,8 +1029,10 @@ export class FallbackAccountManager {
     async load() {
         return loadAccounts(this.configPath);
     }
-    async save(storage) {
-        await saveAccounts(storage, this.configPath);
+    async save(storage, accountIds) {
+        await saveAccountState(storage, this.configPath, {
+            accounts: accountIds ?? true,
+        });
     }
     startBackgroundRefresh() {
         const run = async () => {
@@ -818,7 +1063,7 @@ export class FallbackAccountManager {
         const usable = [];
         let changed = false;
         for (const account of storage.accounts) {
-            if (account.enabled === false)
+            if (account.enabled === false || !isOAuthAccount(account))
                 continue;
             try {
                 let next = account;
@@ -898,7 +1143,7 @@ export class FallbackAccountManager {
             return;
         let changed = false;
         for (const account of storage.accounts) {
-            if (account.enabled === false)
+            if (account.enabled === false || !isOAuthAccount(account))
                 continue;
             if (!tokenNeedsRefresh(account, storage, this.now()))
                 continue;
@@ -940,7 +1185,7 @@ export class FallbackAccountManager {
             return;
         let changed = false;
         for (const account of storage.accounts) {
-            if (account.enabled === false)
+            if (account.enabled === false || !isOAuthAccount(account))
                 continue;
             let next = account;
             try {
@@ -985,7 +1230,7 @@ export class FallbackAccountManager {
         const force = options.force ?? false;
         let changed = false;
         for (const account of storage.accounts) {
-            if (account.enabled === false)
+            if (account.enabled === false || !isOAuthAccount(account))
                 continue;
             let next = account;
             try {
@@ -1046,7 +1291,7 @@ export class FallbackAccountManager {
         while (Date.now() < deadline) {
             await new Promise((resolve) => setTimeout(resolve, FALLBACK_REFRESH_JOIN_POLL_MS));
             const latestStorage = await this.load();
-            const latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id);
+            const latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id && isOAuthAccount(candidate));
             if (!latestAccount)
                 continue;
             const changed = latestAccount.access !== previous.access ||
@@ -1075,7 +1320,7 @@ export class FallbackAccountManager {
     }
     async refreshAccountNow(account, storage, options) {
         let latestStorage = await this.load();
-        let latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id);
+        let latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id && isOAuthAccount(candidate));
         if (latestAccount &&
             !options.force &&
             !tokenNeedsRefresh(latestAccount, latestStorage, this.now())) {
@@ -1101,7 +1346,7 @@ export class FallbackAccountManager {
         }
         try {
             latestStorage = await this.load();
-            latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id);
+            latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id && isOAuthAccount(candidate));
             if (latestAccount &&
                 !options.force &&
                 !tokenNeedsRefresh(latestAccount, latestStorage, this.now())) {

package/dist/cachekeep.d.ts

@@ -4,6 +4,9 @@ export declare const CACHE_KEEP_TTL_MS: number;
 export declare const CACHE_KEEP_PREWARM_LEAD_MS: number;
 export declare const CACHE_KEEP_TICK_MS = 60000;
 export declare const CACHE_KEEP_EXTENDED_TTL_BETA = "extended-cache-ttl-2025-04-11";
+export declare const CACHE_KEEP_MAX_TARGETS = 32;
+export declare const CACHE_KEEP_MAX_BODY_BYTES: number;
+export declare const CACHE_KEEP_STALE_TARGET_MS: number;
 export type CacheKeepWindow = {
     startHour: number;
     endHour: number;
@@ -74,6 +77,9 @@ export declare class CacheKeepManager {
         nextPrewarmAt: number | undefined;
     };
     trackedCount(): number;
+    private totalBodyBytes;
+    private evictOldestTarget;
+    private pruneTargets;
     track(input: {
         sessionId?: string | null;
         url: string;

package/dist/cachekeep.js

@@ -5,6 +5,9 @@ export const CACHE_KEEP_TTL_MS = 60 * 60_000;
 export const CACHE_KEEP_PREWARM_LEAD_MS = 5 * 60_000;
 export const CACHE_KEEP_TICK_MS = 60_000;
 export const CACHE_KEEP_EXTENDED_TTL_BETA = 'extended-cache-ttl-2025-04-11';
+export const CACHE_KEEP_MAX_TARGETS = 32;
+export const CACHE_KEEP_MAX_BODY_BYTES = 16 * 1024 * 1024;
+export const CACHE_KEEP_STALE_TARGET_MS = 2 * CACHE_KEEP_TTL_MS;
 const STATUS_TITLE = '## Claude Cache Keep Status';
 const ENABLED_TITLE = '## Claude Cache Keep Enabled';
 const DISABLED_TITLE = '## Claude Cache Keep Disabled';
@@ -208,6 +211,33 @@ export class CacheKeepManager {
     trackedCount() {
         return this.targets.size;
     }
+    totalBodyBytes() {
+        return [...this.targets.values()].reduce((sum, target) => sum + target.bodyText.length, 0);
+    }
+    evictOldestTarget() {
+        const oldest = this.targets.keys().next().value;
+        if (oldest !== undefined)
+            this.targets.delete(oldest);
+    }
+    pruneTargets(now, today) {
+        for (const [id, target] of this.targets) {
+            if (today && target.dayKey !== today) {
+                this.targets.delete(id);
+                continue;
+            }
+            if (now - target.cacheExpiresAt > CACHE_KEEP_STALE_TARGET_MS) {
+                this.targets.delete(id);
+            }
+        }
+        while (this.targets.size > CACHE_KEEP_MAX_TARGETS)
+            this.evictOldestTarget();
+        while (this.totalBodyBytes() > CACHE_KEEP_MAX_BODY_BYTES) {
+            const before = this.targets.size;
+            this.evictOldestTarget();
+            if (this.targets.size === before)
+                break;
+        }
+    }
     track(input) {
         if (!input.sessionId)
             return { tracked: false, reason: 'missing session id' };
@@ -217,11 +247,18 @@ export class CacheKeepManager {
         if (input.cacheMode !== 'hybrid') {
             return { tracked: false, reason: 'cache mode is not hybrid' };
         }
+        if (input.bodyText.length > CACHE_KEEP_MAX_BODY_BYTES) {
+            return { tracked: false, reason: 'body exceeds cachekeep memory budget' };
+        }
         const now = this.options.now?.() ?? Date.now();
         const window = getCacheKeepWindow(input.storage);
         if (!isWithinCacheKeepWindow(window, new Date(now))) {
             return { tracked: false, reason: 'outside configured window' };
         }
+        const today = localWindowKey(window, new Date(now));
+        this.pruneTargets(now, today);
+        if (this.targets.has(input.sessionId))
+            this.targets.delete(input.sessionId);
         const headers = {};
         input.headers.forEach((value, key) => {
             headers[key] = value;
@@ -232,8 +269,9 @@ export class CacheKeepManager {
             headers,
             bodyText: input.bodyText,
             cacheExpiresAt: now + CACHE_KEEP_TTL_MS,
-            dayKey: localWindowKey(window, new Date(now)),
+            dayKey: today,
         });
+        this.pruneTargets(now, today);
         this.start();
         return { tracked: true };
     }
@@ -242,10 +280,7 @@ export class CacheKeepManager {
         const window = getCacheKeepWindow(storage);
         const now = this.options.now?.() ?? Date.now();
         const today = localWindowKey(window, new Date(now));
-        for (const [id, target] of this.targets) {
-            if (target.dayKey !== today)
-                this.targets.delete(id);
-        }
+        this.pruneTargets(now, today);
         if (!this.targets.size) {
             this.stop();
             return;

package/dist/claude-code.js

@@ -22,7 +22,10 @@ export function getClaudeCodeIdentity(seed) {
     setBounded(identityCache, cacheKey, identity);
     return identity;
 }
+const BOOTSTRAP_IDENTITY_CACHE_TTL_MS = 24 * 60 * 60_000;
+const BOOTSTRAP_IDENTITY_NEGATIVE_TTL_MS = 5 * 60_000;
 const bootstrapFetches = new Map();
+const bootstrapResults = new Map();
 async function fetchClaudeCodeAccountUuid(accessToken, model) {
     if (!accessToken.startsWith('sk-ant-oat'))
         return null;
@@ -61,16 +64,35 @@ export async function resolveClaudeCodeIdentity(accessToken, model) {
     const identity = getClaudeCodeIdentity(accessToken);
     if (!accessToken.startsWith('sk-ant-oat'))
         return identity;
+    const now = Date.now();
+    const cachedResult = bootstrapResults.get(accessToken);
+    if (cachedResult && cachedResult.expiresAt > now) {
+        if (!cachedResult.accountUuid)
+            return identity;
+        const accountCacheKey = `account:${cachedResult.accountUuid}`;
+        const accountIdentity = identityCache.get(accountCacheKey);
+        if (accountIdentity) {
+            setBounded(identityCache, accessToken, accountIdentity);
+            return accountIdentity;
+        }
+    }
     let fetchPromise = bootstrapFetches.get(accessToken);
     if (!fetchPromise) {
         fetchPromise = fetchClaudeCodeAccountUuid(accessToken, model);
         bootstrapFetches.set(accessToken, fetchPromise);
     }
-    const accountUuid = await fetchPromise;
-    if (!accountUuid) {
+    const accountUuid = await fetchPromise.finally(() => {
         bootstrapFetches.delete(accessToken);
+    });
+    setBounded(bootstrapResults, accessToken, {
+        accountUuid,
+        expiresAt: now +
+            (accountUuid
+                ? BOOTSTRAP_IDENTITY_CACHE_TTL_MS
+                : BOOTSTRAP_IDENTITY_NEGATIVE_TTL_MS),
+    });
+    if (!accountUuid)
         return identity;
-    }
     const accountCacheKey = `account:${accountUuid}`;
     const accountIdentity = identityCache.get(accountCacheKey);
     if (accountIdentity) {

package/dist/index.d.ts

@@ -9,6 +9,7 @@ export * from './dump.ts';
 export * from './fast.ts';
 export * from './killswitch.ts';
 export * from './logger.ts';
+export * from './models.ts';
 export * from './pkce.ts';
 export * from './quota-manager.ts';
 export * from './quotas.ts';

package/dist/index.js

@@ -9,6 +9,7 @@ export * from "./dump.js";
 export * from "./fast.js";
 export * from "./killswitch.js";
 export * from "./logger.js";
+export * from "./models.js";
 export * from "./pkce.js";
 export * from "./quota-manager.js";
 export * from "./quotas.js";

package/dist/models.d.ts

@@ -0,0 +1,20 @@
+export declare const CLAUDE_FABLE_5_MODEL_ID = "claude-fable-5";
+export declare const CLAUDE_MYTHOS_5_MODEL_ID = "claude-mythos-5";
+export declare const CLAUDE_FABLE_MYTHOS_5_MODEL_IDS: readonly ["claude-fable-5", "claude-mythos-5"];
+export type ClaudeFableMythos5ModelId = (typeof CLAUDE_FABLE_MYTHOS_5_MODEL_IDS)[number];
+export declare const CLAUDE_FABLE_MYTHOS_5_PRICING: {
+    readonly input: 10;
+    readonly output: 50;
+    readonly cacheRead: 1;
+    readonly cacheWrite5m: 12.5;
+    readonly cacheWrite1h: 20;
+};
+export declare const CLAUDE_FABLE_MYTHOS_5_CONTEXT_WINDOW = 1000000;
+export declare const CLAUDE_FABLE_MYTHOS_5_MAX_OUTPUT_TOKENS = 128000;
+export declare const CLAUDE_FABLE_MYTHOS_5_RELEASE_DATE = "2026-06-09";
+export declare const CLAUDE_FABLE_MYTHOS_5_MODEL_SPECS: Record<ClaudeFableMythos5ModelId, {
+    id: ClaudeFableMythos5ModelId;
+    name: string;
+    limited?: boolean;
+}>;
+export declare function isClaudeFableOrMythos5Model(model: unknown): boolean;

package/dist/models.js

@@ -0,0 +1,31 @@
+export const CLAUDE_FABLE_5_MODEL_ID = 'claude-fable-5';
+export const CLAUDE_MYTHOS_5_MODEL_ID = 'claude-mythos-5';
+export const CLAUDE_FABLE_MYTHOS_5_MODEL_IDS = [
+    CLAUDE_FABLE_5_MODEL_ID,
+    CLAUDE_MYTHOS_5_MODEL_ID,
+];
+export const CLAUDE_FABLE_MYTHOS_5_PRICING = {
+    input: 10,
+    output: 50,
+    cacheRead: 1,
+    cacheWrite5m: 12.5,
+    cacheWrite1h: 20,
+};
+export const CLAUDE_FABLE_MYTHOS_5_CONTEXT_WINDOW = 1_000_000;
+export const CLAUDE_FABLE_MYTHOS_5_MAX_OUTPUT_TOKENS = 128_000;
+export const CLAUDE_FABLE_MYTHOS_5_RELEASE_DATE = '2026-06-09';
+export const CLAUDE_FABLE_MYTHOS_5_MODEL_SPECS = {
+    [CLAUDE_FABLE_5_MODEL_ID]: {
+        id: CLAUDE_FABLE_5_MODEL_ID,
+        name: 'Claude Fable 5',
+    },
+    [CLAUDE_MYTHOS_5_MODEL_ID]: {
+        id: CLAUDE_MYTHOS_5_MODEL_ID,
+        name: 'Claude Mythos 5',
+        limited: true,
+    },
+};
+export function isClaudeFableOrMythos5Model(model) {
+    return (typeof model === 'string' &&
+        CLAUDE_FABLE_MYTHOS_5_MODEL_IDS.some((id) => model === id || model.startsWith(`${id}-`)));
+}

package/dist/quota-manager.d.ts

@@ -94,6 +94,7 @@ export declare class QuotaManager {
     /** Minimum gap between consecutive quota API calls (ms). */
     private static readonly API_CALL_GAP_MS;
     private static fallbackInflightKey;
+    private static quotaLockName;
     /**
      * Serialize API calls through a shared gate so only one
      * quota API request runs at a time, with a minimum gap

package/dist/quota-manager.js

@@ -284,6 +284,10 @@ export class QuotaManager {
     static fallbackInflightKey(accountId, accessToken) {
         return JSON.stringify([accountId, tokenFingerprint(accessToken)]);
     }
+    static quotaLockName(accountId) {
+        const safeId = accountId.replace(/[^a-zA-Z0-9._-]+/g, '-');
+        return `opencode-fallback-quota-refresh-${safeId || 'account'}`;
+    }
     /**
      * Serialize API calls through a shared gate so only one
      * quota API request runs at a time, with a minimum gap
@@ -367,20 +371,35 @@ export class QuotaManager {
                         return cached.quota;
                     throw new Error('Quota API rate-limited — try again later');
                 }
-                const quota = await fetchOAuthQuotaSnapshot({
-                    accessToken,
-                    fetchImpl: this.fetchImpl,
-                    now: this.now,
+                const fileLock = await acquireRefreshFileLock({
+                    name: QuotaManager.quotaLockName(accountId),
+                    ttlMs: 30_000,
                 });
-                const now = this.now();
-                this.setFallback(accountId, {
-                    quota,
-                    refreshAfter: now + getQuotaCheckIntervalMs(this.storage),
-                    checkedAt: now,
-                }, accessToken);
-                this.fallbackApiErrors.delete(accountId);
-                this.fallbackErrorTokenFps.delete(accountId);
-                return quota;
+                if (!fileLock) {
+                    const cached = this.getFallback(accountId, accessToken);
+                    if (cached)
+                        return cached.quota;
+                    throw new Error('Quota refresh is already in progress');
+                }
+                try {
+                    const quota = await fetchOAuthQuotaSnapshot({
+                        accessToken,
+                        fetchImpl: this.fetchImpl,
+                        now: this.now,
+                    });
+                    const now = this.now();
+                    this.setFallback(accountId, {
+                        quota,
+                        refreshAfter: now + getQuotaCheckIntervalMs(this.storage),
+                        checkedAt: now,
+                    }, accessToken);
+                    this.fallbackApiErrors.delete(accountId);
+                    this.fallbackErrorTokenFps.delete(accountId);
+                    return quota;
+                }
+                finally {
+                    await fileLock.release();
+                }
             }
             catch (error) {
                 this._handleFallbackFetchError(accountId, accessToken, error);

package/dist/quotas.js

@@ -1,3 +1,4 @@
+import { isOAuthAccount } from "./accounts.js";
 export const CLAUDE_QUOTAS_COMMAND_NAME = 'claude-quota';
 const WINDOW_LABELS = {
     five_hour: '5h',
@@ -60,7 +61,7 @@ function accountStoredError(account) {
 export function buildFallbackQuotaSummaries(storage, errors = new Map()) {
     if (!storage?.accounts.length)
         return [];
-    return storage.accounts.map((account) => {
+    return storage.accounts.filter(isOAuthAccount).map((account) => {
         const error = errors.get(account.id) ?? accountStoredError(account);
         return {
             name: accountName(account),

package/dist/relay.d.ts

@@ -25,4 +25,4 @@ export declare function sendViaRelay(options: {
     affinity?: string | null;
     optimisticResponse?: boolean;
 }): Promise<Response>;
-export declare const WORKER_SCRIPT = "\nasync function hashBody(body) {\n  const bytes = new TextEncoder().encode(body)\n  const digest = await crypto.subtle.digest('SHA-256', bytes)\n  const hex = [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('')\n  return 'sha256:' + hex\n}\n\nfunction applyPatch(base, patch) {\n  return base.slice(0, patch.start) + patch.insert + base.slice(patch.start + patch.deleteCount)\n}\n\nfunction applyPatchSet(base, patch) {\n  if (!Array.isArray(patch)) return applyPatch(base, patch)\n  if (patch.length === 0) return base\n\n  let result = ''\n  let cursor = 0\n  for (const item of patch) {\n    if (item.start < cursor) return { error: 'overlapping patch', status: 400 }\n    result += base.slice(cursor, item.start)\n    result += item.insert\n    cursor = item.start + item.deleteCount\n  }\n  return result + base.slice(cursor)\n}\n\nasync function readState(env, affinity) {\n  const raw = await env.RELAY_STATE.get('session:' + affinity)\n  return raw ? JSON.parse(raw) : null\n}\n\nasync function writeState(env, affinity, state) {\n  await env.RELAY_STATE.put('session:' + affinity, JSON.stringify(state), { expirationTtl: 86400 })\n}\n\nasync function resolveBody(env, payload) {\n  if (payload.mode === 'full_sync') return payload.body\n  if (payload.mode === 'patch') {\n    const state = await readState(env, payload.affinity)\n    if (!state || state.hash !== payload.base_hash) {\n      return { error: 'state mismatch', status: 409 }\n    }\n    return applyPatchSet(state.body, payload.patch)\n  }\n  return { error: 'unknown mode', status: 400 }\n}\n\nasync function prepareUpstream(env, payload) {\n  if ((payload.protocol !== 1 && payload.protocol !== 2) || payload.type !== 'request' || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {\n    return { error: 'invalid payload', status: 400 }\n  }\n\n  const body = await resolveBody(env, payload)\n  if (body && typeof body === 'object' && 'error' in body) return body\n\n  if (typeof body !== 'string' || (await hashBody(body)) !== payload.next_hash) {\n    return { error: 'hash mismatch', status: 409 }\n  }\n\n  const stateWrite = writeState(env, payload.affinity, { body, hash: payload.next_hash, revision: payload.revision }).catch(() => {})\n  console.log(JSON.stringify({\n    relay: 'opencode-anthropic-auth',\n    transport: 'relay',\n    mode: payload.mode,\n    revision: payload.revision,\n    affinity: String(payload.affinity).slice(0, 12),\n    bodyBytes: body.length,\n  }))\n\n  return { body, stateWrite }\n}\n\nfunction resolveBodyFromState(state, payload) {\n  if (payload.mode === 'full_sync') return payload.body\n  if (payload.mode === 'patch') {\n    if (!state || state.hash !== payload.base_hash) {\n      return { error: 'state mismatch', status: 409 }\n    }\n    return applyPatchSet(state.body, payload.patch)\n  }\n  return { error: 'unknown mode', status: 400 }\n}\n\nfunction deferWorkerTask(task) {\n  return new Promise((resolve) => setTimeout(resolve, 0)).then(task)\n}\n\nfunction checkpointWebSocketState(env, payload, body, nextState) {\n  return deferWorkerTask(async () => {\n    try {\n      if ((await hashBody(body)) !== payload.next_hash) {\n        throw new Error('hash mismatch')\n      }\n      await writeState(env, payload.affinity, nextState)\n    } catch (error) {\n      console.log(JSON.stringify({\n        relay: 'opencode-anthropic-auth',\n        transport: 'websocket',\n        event: 'checkpoint_write_failed',\n        affinity: String(payload.affinity).slice(0, 12),\n        message: error instanceof Error ? error.message : String(error),\n      }))\n    }\n  })\n}\n\nasync function prepareWebSocketUpstream(env, state, payload) {\n  if (payload.protocol !== 2 || payload.type !== 'request' || !payload.id || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {\n    return { error: 'invalid payload', status: 400 }\n  }\n\n  const body = resolveBodyFromState(state, payload)\n  if (body && typeof body === 'object' && 'error' in body) return body\n  if (typeof body !== 'string') return { error: 'invalid body', status: 400 }\n  if ((await hashBody(body)) !== payload.next_hash) {\n    return { error: 'hash mismatch', status: 409 }\n  }\n\n  const nextState = { body, hash: payload.next_hash, revision: payload.revision }\n  const checkpoint = checkpointWebSocketState(env, payload, body, nextState)\n  const logAccepted = () => console.log(JSON.stringify({\n    relay: 'opencode-anthropic-auth',\n    transport: 'websocket',\n    mode: payload.mode,\n    revision: payload.revision,\n    affinity: String(payload.affinity).slice(0, 12),\n    bodyBytes: body.length,\n  }))\n\n  return { body, state: nextState, checkpoint, logAccepted }\n}\n\nfunction headersToObject(headers) {\n  const result = {}\n  for (const [key, value] of headers.entries()) result[key] = value\n  return result\n}\n\nasync function handleRelayPayload(env, payload) {\n  const prepared = await prepareUpstream(env, payload)\n  if (prepared.error) return prepared\n  const upstream = await fetch(payload.upstream.url, {\n    method: payload.upstream.method || 'POST',\n    headers: payload.upstream.headers,\n    body: prepared.body,\n  })\n  return { upstream, stateWrite: prepared.stateWrite }\n}\n\nasync function handleWebSocket(socket, env, ctx, payload, getState, setState) {\n  const heartbeat = setInterval(() => {\n    try {\n      socket.send(JSON.stringify({ protocol: 2, type: 'keepalive' }))\n    } catch {\n      clearInterval(heartbeat)\n    }\n  }, 15000)\n  try {\n    const result = await prepareWebSocketUpstream(env, getState(), payload)\n    if (result.error) {\n      socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: result.status, message: result.error }))\n      return\n    }\n\n    setState(result.state)\n    socket.send(JSON.stringify({ protocol: 2, type: 'accepted', id: payload.id, hash: result.state.hash, revision: result.state.revision }))\n    ctx?.waitUntil?.(deferWorkerTask(result.logAccepted))\n\n    const upstreamPromise = fetch(payload.upstream.url, {\n      method: payload.upstream.method || 'POST',\n      headers: payload.upstream.headers,\n      body: result.body,\n    })\n    ctx?.waitUntil?.(result.checkpoint)\n    const upstream = await upstreamPromise\n    socket.send(JSON.stringify({\n      protocol: 2,\n      type: 'response_start',\n      id: payload.id,\n      status: upstream.status,\n      statusText: upstream.statusText,\n      headers: headersToObject(upstream.headers),\n    }))\n\n    const reader = upstream.body?.getReader()\n    if (reader) {\n      while (true) {\n        const { done, value } = await reader.read()\n        if (done) break\n        socket.send(value)\n      }\n    }\n    socket.send(JSON.stringify({ protocol: 2, type: 'done', id: payload.id }))\n  } catch (error) {\n    socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: 500, message: error instanceof Error ? error.message : String(error) }))\n  } finally {\n    clearInterval(heartbeat)\n  }\n}\n\nexport default {\n  async fetch(request, env, ctx) {\n    if (request.headers.get('Upgrade') === 'websocket') {\n      const url = new URL(request.url)\n      const token = url.searchParams.get('token')\n      const affinity = url.searchParams.get('affinity')\n      if (token !== env.RELAY_TOKEN) return new Response('unauthorized', { status: 401 })\n      if (!affinity) return new Response('missing affinity', { status: 400 })\n      const pair = new WebSocketPair()\n      const client = pair[0]\n      const server = pair[1]\n      server.binaryType = 'arraybuffer'\n      let state = null\n      let ready = false\n      server.accept()\n      const loadState = readState(env, affinity).then((loadedState) => {\n        state = loadedState\n        ready = true\n        server.send(JSON.stringify({\n          protocol: 2,\n          type: 'ready',\n          state: state ? { hash: state.hash, revision: state.revision } : null,\n        }))\n      }).catch((error) => {\n        server.send(JSON.stringify({ protocol: 2, type: 'error', status: 500, message: error instanceof Error ? error.message : String(error) }))\n        server.close(1011, 'state load failed')\n      })\n      ctx?.waitUntil?.(loadState)\n      if (!ctx?.waitUntil) void loadState\n      let busy = false\n      server.addEventListener('message', (event) => {\n        if (!ready) {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 425, message: 'relay state is not ready' }))\n          return\n        }\n        if (busy) {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 429, message: 'request already in flight' }))\n          return\n        }\n        let payload\n        try {\n          payload = JSON.parse(event.data)\n        } catch {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 400, message: 'invalid JSON payload' }))\n          return\n        }\n        payload.affinity = affinity\n        busy = true\n        const run = handleWebSocket(server, env, ctx, payload, () => state, (nextState) => { state = nextState }).finally(() => { busy = false })\n        ctx?.waitUntil?.(run)\n        if (!ctx?.waitUntil) void run\n      })\n      return new Response(null, { status: 101, webSocket: client })\n    }\n\n    if (request.method === 'GET') {\n      return Response.json({ status: 'ok', transports: ['http', 'websocket'] })\n    }\n    if (request.method !== 'POST') return new Response('method not allowed', { status: 405 })\n    if (request.headers.get('x-relay-token') !== env.RELAY_TOKEN) {\n      return new Response('unauthorized', { status: 401 })\n    }\n\n    try {\n      const payload = await request.json()\n      const result = await handleRelayPayload(env, payload)\n      if (result.error) return Response.json({ error: result.error }, { status: result.status })\n\n      if (result.stateWrite) ctx.waitUntil(result.stateWrite)\n\n      const upstream = result.upstream\n      return new Response(upstream.body, {\n        status: upstream.status,\n        statusText: upstream.statusText,\n        headers: upstream.headers,\n      })\n    } catch (error) {\n      return Response.json(\n        { error: error instanceof Error ? error.message : 'internal relay error' },\n        { status: 502 },\n      )\n    }\n  },\n}\n";
+export declare const WORKER_SCRIPT = "\nasync function hashBody(body) {\n  const bytes = new TextEncoder().encode(body)\n  const digest = await crypto.subtle.digest('SHA-256', bytes)\n  const hex = [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('')\n  return 'sha256:' + hex\n}\n\nfunction applyPatch(base, patch) {\n  return base.slice(0, patch.start) + patch.insert + base.slice(patch.start + patch.deleteCount)\n}\n\nfunction applyPatchSet(base, patch) {\n  if (!Array.isArray(patch)) return applyPatch(base, patch)\n  if (patch.length === 0) return base\n\n  let result = ''\n  let cursor = 0\n  for (const item of patch) {\n    if (item.start < cursor) return { error: 'overlapping patch', status: 400 }\n    result += base.slice(cursor, item.start)\n    result += item.insert\n    cursor = item.start + item.deleteCount\n  }\n  return result + base.slice(cursor)\n}\n\nasync function readState(env, affinity) {\n  const raw = await env.RELAY_STATE.get('session:' + affinity)\n  return raw ? JSON.parse(raw) : null\n}\n\nasync function writeState(env, affinity, state) {\n  await env.RELAY_STATE.put('session:' + affinity, JSON.stringify(state), { expirationTtl: 86400 })\n}\n\nasync function resolveBody(env, payload) {\n  if (payload.mode === 'full_sync') return payload.body\n  if (payload.mode === 'patch') {\n    const state = await readState(env, payload.affinity)\n    if (!state || state.hash !== payload.base_hash) {\n      return { error: 'state mismatch', status: 409 }\n    }\n    return applyPatchSet(state.body, payload.patch)\n  }\n  return { error: 'unknown mode', status: 400 }\n}\n\nasync function prepareUpstream(env, payload) {\n  if ((payload.protocol !== 1 && payload.protocol !== 2) || payload.type !== 'request' || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {\n    return { error: 'invalid payload', status: 400 }\n  }\n\n  const body = await resolveBody(env, payload)\n  if (body && typeof body === 'object' && 'error' in body) return body\n\n  if (typeof body !== 'string' || (await hashBody(body)) !== payload.next_hash) {\n    return { error: 'hash mismatch', status: 409 }\n  }\n\n  const stateWrite = writeState(env, payload.affinity, { body, hash: payload.next_hash, revision: payload.revision }).catch(() => {})\n  console.log(JSON.stringify({\n    relay: 'opencode-anthropic-auth',\n    transport: 'relay',\n    mode: payload.mode,\n    revision: payload.revision,\n    affinity: String(payload.affinity).slice(0, 12),\n    bodyBytes: body.length,\n  }))\n\n  return { body, stateWrite }\n}\n\nfunction resolveBodyFromState(state, payload) {\n  if (payload.mode === 'full_sync') return payload.body\n  if (payload.mode === 'patch') {\n    if (!state || state.hash !== payload.base_hash) {\n      return { error: 'state mismatch', status: 409 }\n    }\n    return applyPatchSet(state.body, payload.patch)\n  }\n  return { error: 'unknown mode', status: 400 }\n}\n\nfunction deferWorkerTask(task) {\n  return new Promise((resolve) => setTimeout(resolve, 0)).then(task)\n}\n\nconst WEBSOCKET_STREAM_FLUSH_BYTES = 1024\nconst WEBSOCKET_STREAM_FLUSH_MS = 20\n\nfunction createWebSocketStreamCoalescer(socket, options = {}) {\n  const flushBytes = options.flushBytes || WEBSOCKET_STREAM_FLUSH_BYTES\n  const flushMs = options.flushMs ?? WEBSOCKET_STREAM_FLUSH_MS\n  let chunks = []\n  let byteLength = 0\n  let flushTimer = null\n  const stats = {\n    upstreamChunks: 0,\n    upstreamBytes: 0,\n    frames: 0,\n    frameBytes: 0,\n  }\n\n  const clearFlushTimer = () => {\n    if (flushTimer === null) return\n    clearTimeout(flushTimer)\n    flushTimer = null\n  }\n\n  const mergeChunks = () => {\n    if (chunks.length === 1) return chunks[0]\n    const frame = new Uint8Array(byteLength)\n    let offset = 0\n    for (const chunk of chunks) {\n      frame.set(chunk, offset)\n      offset += chunk.byteLength\n    }\n    return frame\n  }\n\n  const flush = () => {\n    clearFlushTimer()\n    if (byteLength === 0) return\n    const frame = mergeChunks()\n    chunks = []\n    byteLength = 0\n    socket.send(frame)\n    stats.frames += 1\n    stats.frameBytes += frame.byteLength\n  }\n\n  const scheduleFlush = () => {\n    if (flushTimer !== null) return\n    flushTimer = setTimeout(flush, flushMs)\n  }\n\n  return {\n    push(value) {\n      const chunk = value instanceof Uint8Array ? value : new Uint8Array(value)\n      if (chunk.byteLength === 0) return\n      stats.upstreamChunks += 1\n      stats.upstreamBytes += chunk.byteLength\n      chunks.push(chunk)\n      byteLength += chunk.byteLength\n      if (byteLength >= flushBytes) flush()\n      else scheduleFlush()\n    },\n    flush,\n    stats() {\n      return { ...stats, pendingBytes: byteLength }\n    },\n  }\n}\n\nfunction checkpointWebSocketState(env, payload, body, nextState) {\n  return deferWorkerTask(async () => {\n    try {\n      if ((await hashBody(body)) !== payload.next_hash) {\n        throw new Error('hash mismatch')\n      }\n      await writeState(env, payload.affinity, nextState)\n    } catch (error) {\n      console.log(JSON.stringify({\n        relay: 'opencode-anthropic-auth',\n        transport: 'websocket',\n        event: 'checkpoint_write_failed',\n        affinity: String(payload.affinity).slice(0, 12),\n        message: error instanceof Error ? error.message : String(error),\n      }))\n    }\n  })\n}\n\nasync function prepareWebSocketUpstream(env, state, payload) {\n  if (payload.protocol !== 2 || payload.type !== 'request' || !payload.id || !payload.affinity || !payload.upstream?.url || !payload.next_hash) {\n    return { error: 'invalid payload', status: 400 }\n  }\n\n  const body = resolveBodyFromState(state, payload)\n  if (body && typeof body === 'object' && 'error' in body) return body\n  if (typeof body !== 'string') return { error: 'invalid body', status: 400 }\n  if ((await hashBody(body)) !== payload.next_hash) {\n    return { error: 'hash mismatch', status: 409 }\n  }\n\n  const nextState = { body, hash: payload.next_hash, revision: payload.revision }\n  const checkpoint = checkpointWebSocketState(env, payload, body, nextState)\n  const logAccepted = () => console.log(JSON.stringify({\n    relay: 'opencode-anthropic-auth',\n    transport: 'websocket',\n    mode: payload.mode,\n    revision: payload.revision,\n    affinity: String(payload.affinity).slice(0, 12),\n    bodyBytes: body.length,\n  }))\n\n  return { body, state: nextState, checkpoint, logAccepted }\n}\n\nfunction headersToObject(headers) {\n  const result = {}\n  for (const [key, value] of headers.entries()) result[key] = value\n  return result\n}\n\nasync function handleRelayPayload(env, payload) {\n  const prepared = await prepareUpstream(env, payload)\n  if (prepared.error) return prepared\n  const upstream = await fetch(payload.upstream.url, {\n    method: payload.upstream.method || 'POST',\n    headers: payload.upstream.headers,\n    body: prepared.body,\n  })\n  return { upstream, stateWrite: prepared.stateWrite }\n}\n\nasync function handleWebSocket(socket, env, ctx, payload, getState, setState) {\n  const heartbeat = setInterval(() => {\n    try {\n      socket.send(JSON.stringify({ protocol: 2, type: 'keepalive' }))\n    } catch {\n      clearInterval(heartbeat)\n    }\n  }, 15000)\n  let streamCoalescer = null\n  try {\n    const result = await prepareWebSocketUpstream(env, getState(), payload)\n    if (result.error) {\n      socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: result.status, message: result.error }))\n      return\n    }\n\n    setState(result.state)\n    socket.send(JSON.stringify({ protocol: 2, type: 'accepted', id: payload.id, hash: result.state.hash, revision: result.state.revision }))\n    ctx?.waitUntil?.(deferWorkerTask(result.logAccepted))\n\n    const upstreamPromise = fetch(payload.upstream.url, {\n      method: payload.upstream.method || 'POST',\n      headers: payload.upstream.headers,\n      body: result.body,\n    })\n    ctx?.waitUntil?.(result.checkpoint)\n    const upstream = await upstreamPromise\n    socket.send(JSON.stringify({\n      protocol: 2,\n      type: 'response_start',\n      id: payload.id,\n      status: upstream.status,\n      statusText: upstream.statusText,\n      headers: headersToObject(upstream.headers),\n    }))\n\n    const reader = upstream.body?.getReader()\n    if (reader) {\n      streamCoalescer = createWebSocketStreamCoalescer(socket)\n      while (true) {\n        const { done, value } = await reader.read()\n        if (done) break\n        streamCoalescer.push(value)\n      }\n      streamCoalescer.flush()\n    }\n    const stats = streamCoalescer?.stats?.() || {}\n    socket.send(JSON.stringify({ protocol: 2, type: 'done', id: payload.id, ...stats }))\n  } catch (error) {\n    try {\n      streamCoalescer?.flush?.()\n    } catch {}\n    socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: 500, message: error instanceof Error ? error.message : String(error) }))\n  } finally {\n    clearInterval(heartbeat)\n  }\n}\n\nexport default {\n  async fetch(request, env, ctx) {\n    if (request.headers.get('Upgrade') === 'websocket') {\n      const url = new URL(request.url)\n      const token = url.searchParams.get('token')\n      const affinity = url.searchParams.get('affinity')\n      if (token !== env.RELAY_TOKEN) return new Response('unauthorized', { status: 401 })\n      if (!affinity) return new Response('missing affinity', { status: 400 })\n      const pair = new WebSocketPair()\n      const client = pair[0]\n      const server = pair[1]\n      server.binaryType = 'arraybuffer'\n      let state = null\n      let ready = false\n      server.accept()\n      const loadState = readState(env, affinity).then((loadedState) => {\n        state = loadedState\n        ready = true\n        server.send(JSON.stringify({\n          protocol: 2,\n          type: 'ready',\n          state: state ? { hash: state.hash, revision: state.revision } : null,\n        }))\n      }).catch((error) => {\n        server.send(JSON.stringify({ protocol: 2, type: 'error', status: 500, message: error instanceof Error ? error.message : String(error) }))\n        server.close(1011, 'state load failed')\n      })\n      ctx?.waitUntil?.(loadState)\n      if (!ctx?.waitUntil) void loadState\n      let busy = false\n      server.addEventListener('message', (event) => {\n        if (!ready) {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 425, message: 'relay state is not ready' }))\n          return\n        }\n        if (busy) {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 429, message: 'request already in flight' }))\n          return\n        }\n        let payload\n        try {\n          payload = JSON.parse(event.data)\n        } catch {\n          server.send(JSON.stringify({ protocol: 2, type: 'error', status: 400, message: 'invalid JSON payload' }))\n          return\n        }\n        payload.affinity = affinity\n        busy = true\n        const run = handleWebSocket(server, env, ctx, payload, () => state, (nextState) => { state = nextState }).finally(() => { busy = false })\n        ctx?.waitUntil?.(run)\n        if (!ctx?.waitUntil) void run\n      })\n      return new Response(null, { status: 101, webSocket: client })\n    }\n\n    if (request.method === 'GET') {\n      return Response.json({ status: 'ok', transports: ['http', 'websocket'] })\n    }\n    if (request.method !== 'POST') return new Response('method not allowed', { status: 405 })\n    if (request.headers.get('x-relay-token') !== env.RELAY_TOKEN) {\n      return new Response('unauthorized', { status: 401 })\n    }\n\n    try {\n      const payload = await request.json()\n      const result = await handleRelayPayload(env, payload)\n      if (result.error) return Response.json({ error: result.error }, { status: result.status })\n\n      if (result.stateWrite) ctx.waitUntil(result.stateWrite)\n\n      const upstream = result.upstream\n      return new Response(upstream.body, {\n        status: upstream.status,\n        statusText: upstream.statusText,\n        headers: upstream.headers,\n      })\n    } catch (error) {\n      return Response.json(\n        { error: error instanceof Error ? error.message : 'internal relay error' },\n        { status: 502 },\n      )\n    }\n  },\n}\n";

package/dist/relay.js

@@ -21,6 +21,10 @@ class RelayWebSocketConnectionResetError extends Error {
 const sessionState = new Map();
 const websocketSessions = new Map();
 const loggedRelayConfigMessages = new Set();
+const RELAY_SESSION_STATE_TTL_MS = 2 * 60 * 60_000;
+const RELAY_WEBSOCKET_IDLE_TTL_MS = 30 * 60_000;
+const MAX_RELAY_SESSION_STATES = 128;
+const MAX_RELAY_WEBSOCKET_SESSIONS = 32;
 let nextRequestId = 0;
 function createRequestId() {
     nextRequestId += 1;
@@ -136,14 +140,23 @@ function jsonHeaders(headers) {
     }
     return result;
 }
-async function postRelay(config, payload) {
+async function postRelay(config, payload, signal) {
+    const stringifyStart = perfNowMs();
+    const body = JSON.stringify(payload);
+    relayPerfLog('http_payload_stringify', {
+        session: shortAffinity(payload.affinity),
+        ms: formatMs(perfNowMs() - stringifyStart),
+        relayBytes: body.length,
+        mode: payload.mode,
+    });
     return fetch(config.url, {
         method: 'POST',
         headers: {
             'content-type': 'application/json',
             'x-relay-token': config.token,
         },
-        body: JSON.stringify(payload),
+        body,
+        signal: signal ?? undefined,
     });
 }
 function shortAffinity(affinity) {
@@ -155,6 +168,14 @@ function perfNowMs() {
 function formatMs(value) {
     return Math.round(value * 10) / 10;
 }
+function relayPerfLoggingEnabled() {
+    return process.env.OPENCODE_ANTHROPIC_AUTH_PERF === '1';
+}
+function relayPerfLog(stage, data) {
+    if (!relayPerfLoggingEnabled())
+        return;
+    relayLog(`[perf] relay ${stage} ${JSON.stringify(data)}`);
+}
 function createRelayPayload(options) {
     const { input, init, headers, bodyText, affinity, previous, nextHash } = options;
     const rewrittenUrl = input instanceof Request ? input.url : input.toString();
@@ -197,21 +218,25 @@ function createFullSyncPayload(payload, bodyText) {
     };
 }
 function updateLocalRelayState(affinity, bodyText, nextHash, revision) {
+    const now = Date.now();
+    sessionState.delete(affinity);
     sessionState.set(affinity, {
         body: bodyText,
         hash: nextHash,
         revision,
+        updatedAt: now,
     });
+    cleanupRelaySessionCaches(now);
 }
 async function sendRelayHttp(options) {
-    const { config, payload, bodyText, fallback } = options;
+    const { config, payload, bodyText, fallback, signal } = options;
     let actualPayload = payload;
-    let response = await postRelay(config, actualPayload);
+    let response = await postRelay(config, actualPayload, signal);
     if (response.status === 409 && actualPayload.mode === 'patch') {
         relayLog(`state mismatch from relay session=${shortAffinity(actualPayload.affinity)}; retrying full_sync`);
         await response.body?.cancel().catch(() => { });
         actualPayload = createFullSyncPayload(actualPayload, bodyText);
-        response = await postRelay(config, actualPayload);
+        response = await postRelay(config, actualPayload, signal);
     }
     if (!response.ok && response.status >= 500 && config.fallbackToDirect) {
         relayLog(`relay returned ${response.status}; falling back direct session=${shortAffinity(actualPayload.affinity)}`);
@@ -279,11 +304,27 @@ class PersistentRelaySession {
     queue = Promise.resolve();
     pending;
     serverState;
+    lastUsedAt = Date.now();
     constructor(config, affinity) {
         this.config = config;
         this.affinity = affinity;
     }
+    touch(now = Date.now()) {
+        this.lastUsedAt = now;
+    }
+    canEvict(now = Date.now()) {
+        return (!this.pending &&
+            !this.connecting &&
+            now - this.lastUsedAt > RELAY_WEBSOCKET_IDLE_TTL_MS);
+    }
+    dispose() {
+        this.socket?.close();
+        this.socket = undefined;
+        this.serverState = undefined;
+        this.connecting = undefined;
+    }
     send(payload, bodyText, optimisticResponse = false) {
+        this.touch();
         const enqueuedAt = perfNowMs();
         const start = this.queue
             .catch(() => { })
@@ -584,7 +625,7 @@ class PersistentRelaySession {
             return;
         }
         if (message.type === 'done') {
-            this.finishPending();
+            this.finishPending(message);
             return;
         }
         if (message.type === 'error') {
@@ -609,12 +650,15 @@ class PersistentRelaySession {
             this.failPending(error);
         }
     }
-    finishPending() {
+    finishPending(done) {
         const pending = this.pending;
         if (!pending)
             return;
         const finishedAt = perfNowMs();
-        relayLog(`perf websocket done session=${shortAffinity(this.affinity)} request=${pending.payload.id} sentMs=${formatMs(finishedAt - pending.sentAt)} streamMs=${pending.responseStartedAt == null ? 'unknown' : formatMs(finishedAt - pending.responseStartedAt)} chunks=${pending.streamChunkCount} bytes=${pending.streamByteCount}`);
+        const workerStats = done && 'frames' in done
+            ? ` upstreamChunks=${done.upstreamChunks ?? 'unknown'} upstreamBytes=${done.upstreamBytes ?? 'unknown'} frames=${done.frames} frameBytes=${done.frameBytes ?? 'unknown'}`
+            : '';
+        relayLog(`perf websocket done session=${shortAffinity(this.affinity)} request=${pending.payload.id} sentMs=${formatMs(finishedAt - pending.sentAt)} streamMs=${pending.responseStartedAt == null ? 'unknown' : formatMs(finishedAt - pending.responseStartedAt)} chunks=${pending.streamChunkCount} bytes=${pending.streamByteCount}${workerStats}`);
         clearTimeout(pending.timeout);
         if (!pending.streamDone) {
             pending.streamDone = true;
@@ -638,12 +682,48 @@ class PersistentRelaySession {
         pending.rejectDone(error);
     }
 }
+function cleanupRelaySessionCaches(now = Date.now()) {
+    for (const [affinity, state] of sessionState) {
+        if (now - state.updatedAt > RELAY_SESSION_STATE_TTL_MS) {
+            sessionState.delete(affinity);
+        }
+    }
+    while (sessionState.size > MAX_RELAY_SESSION_STATES) {
+        const oldest = sessionState.keys().next().value;
+        if (oldest === undefined)
+            break;
+        sessionState.delete(oldest);
+    }
+    for (const [affinity, session] of websocketSessions) {
+        if (session.canEvict(now)) {
+            session.dispose();
+            websocketSessions.delete(affinity);
+        }
+    }
+    while (websocketSessions.size > MAX_RELAY_WEBSOCKET_SESSIONS) {
+        let evicted = false;
+        for (const [affinity, session] of websocketSessions) {
+            if (!session.canEvict(now))
+                continue;
+            session.dispose();
+            websocketSessions.delete(affinity);
+            evicted = true;
+            break;
+        }
+        if (!evicted)
+            break;
+    }
+}
 function getPersistentRelaySession(config, affinity) {
+    cleanupRelaySessionCaches();
     const existing = websocketSessions.get(affinity);
-    if (existing)
+    if (existing) {
+        existing.touch();
         return existing;
+    }
     const session = new PersistentRelaySession(config, affinity);
     websocketSessions.set(affinity, session);
+    cleanupRelaySessionCaches();
     return session;
 }
 export async function sendViaRelay(options) {
@@ -658,8 +738,15 @@ export async function sendViaRelay(options) {
         return fallback();
     }
     const bodyText = body;
+    const hashStart = perfNowMs();
     const nextHash = hashBody(bodyText);
+    relayPerfLog('hash_body', {
+        session: shortAffinity(affinity),
+        ms: formatMs(perfNowMs() - hashStart),
+        bodyBytes: bodyText.length,
+    });
     const previous = sessionState.get(affinity);
+    const payloadStart = perfNowMs();
     const payload = createRelayPayload({
         input,
         init,
@@ -669,8 +756,16 @@ export async function sendViaRelay(options) {
         previous,
         nextHash,
     });
+    relayPerfLog('create_payload', {
+        session: shortAffinity(affinity),
+        ms: formatMs(perfNowMs() - payloadStart),
+        mode: payload.mode,
+        bodyBytes: bodyText.length,
+        previousBytes: previous?.body.length,
+    });
     try {
         let result;
+        const sendStart = perfNowMs();
         if (config.transport === 'websocket') {
             try {
                 const session = getPersistentRelaySession(config, affinity);
@@ -678,19 +773,47 @@ export async function sendViaRelay(options) {
             }
             catch (error) {
                 relayLog(`websocket relay failed session=${shortAffinity(affinity)}; trying http relay: ${error instanceof Error ? error.message : String(error)}`);
-                result = await sendRelayHttp({ config, payload, bodyText, fallback });
+                result = await sendRelayHttp({
+                    config,
+                    payload,
+                    bodyText,
+                    fallback,
+                    signal: init?.signal,
+                });
             }
         }
         else {
-            result = await sendRelayHttp({ config, payload, bodyText, fallback });
+            result = await sendRelayHttp({
+                config,
+                payload,
+                bodyText,
+                fallback,
+                signal: init?.signal,
+            });
         }
+        relayPerfLog('send', {
+            session: shortAffinity(affinity),
+            ms: formatMs(perfNowMs() - sendStart),
+            transport: result.transport,
+            protocol: result.protocol,
+            mode: result.payload.mode,
+            status: result.response.status,
+            usedRelay: result.usedRelay,
+        });
         if (!result.usedRelay)
             return result.response;
         if (result.transport === 'http') {
             updateLocalRelayState(affinity, bodyText, result.payload.next_hash, result.payload.revision);
         }
+        const payloadStringifyStart = perfNowMs();
         const actualPayloadBytes = JSON.stringify(result.payload).length;
+        relayPerfLog('payload_stringify', {
+            session: shortAffinity(affinity),
+            ms: formatMs(perfNowMs() - payloadStringifyStart),
+            relayBytes: actualPayloadBytes,
+        });
         relayLog(`used relay transport=${result.transport} protocol=${result.protocol} mode=${result.payload.mode} status=${result.response.status} session=${shortAffinity(affinity)} bodyBytes=${bodyText.length} relayBytes=${actualPayloadBytes}`);
+        const dumpStart = perfNowMs();
         await dumpRelayRequest({
             affinity,
             transport: result.transport,
@@ -702,6 +825,11 @@ export async function sendViaRelay(options) {
             payload: result.payload,
             relayBytes: actualPayloadBytes,
         });
+        relayPerfLog('dump', {
+            session: shortAffinity(affinity),
+            ms: formatMs(perfNowMs() - dumpStart),
+            enabled: true,
+        });
         return result.response;
     }
     catch (error) {
@@ -801,6 +929,73 @@ function deferWorkerTask(task) {
   return new Promise((resolve) => setTimeout(resolve, 0)).then(task)
 }
 
+const WEBSOCKET_STREAM_FLUSH_BYTES = 1024
+const WEBSOCKET_STREAM_FLUSH_MS = 20
+
+function createWebSocketStreamCoalescer(socket, options = {}) {
+  const flushBytes = options.flushBytes || WEBSOCKET_STREAM_FLUSH_BYTES
+  const flushMs = options.flushMs ?? WEBSOCKET_STREAM_FLUSH_MS
+  let chunks = []
+  let byteLength = 0
+  let flushTimer = null
+  const stats = {
+    upstreamChunks: 0,
+    upstreamBytes: 0,
+    frames: 0,
+    frameBytes: 0,
+  }
+
+  const clearFlushTimer = () => {
+    if (flushTimer === null) return
+    clearTimeout(flushTimer)
+    flushTimer = null
+  }
+
+  const mergeChunks = () => {
+    if (chunks.length === 1) return chunks[0]
+    const frame = new Uint8Array(byteLength)
+    let offset = 0
+    for (const chunk of chunks) {
+      frame.set(chunk, offset)
+      offset += chunk.byteLength
+    }
+    return frame
+  }
+
+  const flush = () => {
+    clearFlushTimer()
+    if (byteLength === 0) return
+    const frame = mergeChunks()
+    chunks = []
+    byteLength = 0
+    socket.send(frame)
+    stats.frames += 1
+    stats.frameBytes += frame.byteLength
+  }
+
+  const scheduleFlush = () => {
+    if (flushTimer !== null) return
+    flushTimer = setTimeout(flush, flushMs)
+  }
+
+  return {
+    push(value) {
+      const chunk = value instanceof Uint8Array ? value : new Uint8Array(value)
+      if (chunk.byteLength === 0) return
+      stats.upstreamChunks += 1
+      stats.upstreamBytes += chunk.byteLength
+      chunks.push(chunk)
+      byteLength += chunk.byteLength
+      if (byteLength >= flushBytes) flush()
+      else scheduleFlush()
+    },
+    flush,
+    stats() {
+      return { ...stats, pendingBytes: byteLength }
+    },
+  }
+}
+
 function checkpointWebSocketState(env, payload, body, nextState) {
   return deferWorkerTask(async () => {
     try {
@@ -871,6 +1066,7 @@ async function handleWebSocket(socket, env, ctx, payload, getState, setState) {
       clearInterval(heartbeat)
     }
   }, 15000)
+  let streamCoalescer = null
   try {
     const result = await prepareWebSocketUpstream(env, getState(), payload)
     if (result.error) {
@@ -900,14 +1096,20 @@ async function handleWebSocket(socket, env, ctx, payload, getState, setState) {
 
     const reader = upstream.body?.getReader()
     if (reader) {
+      streamCoalescer = createWebSocketStreamCoalescer(socket)
       while (true) {
         const { done, value } = await reader.read()
         if (done) break
-        socket.send(value)
+        streamCoalescer.push(value)
       }
+      streamCoalescer.flush()
     }
-    socket.send(JSON.stringify({ protocol: 2, type: 'done', id: payload.id }))
+    const stats = streamCoalescer?.stats?.() || {}
+    socket.send(JSON.stringify({ protocol: 2, type: 'done', id: payload.id, ...stats }))
   } catch (error) {
+    try {
+      streamCoalescer?.flush?.()
+    } catch {}
     socket.send(JSON.stringify({ protocol: 2, type: 'error', id: payload.id, status: 500, message: error instanceof Error ? error.message : String(error) }))
   } finally {
     clearInterval(heartbeat)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "1.7.0",
+  "version": "1.9.0",
   "type": "module",
   "repository": {
     "type": "git",