@cortexkit/opencode-anthropic-auth 1.0.0 → 1.1.1

package/README.md

@@ -19,14 +19,15 @@ This repo is a Bun workspace monorepo with two user-facing integrations and one
 | Primary Claude Pro/Max OAuth | OpenCode `/connect anthropic` | Pi `/login anthropic` |
 | Provider integration point | OpenCode plugin fetch/request transform | Pi `registerProvider("anthropic")` provider override |
 | Sidecar config | `~/.config/opencode/anthropic-auth.json` | `~/.pi/agent/anthropic-auth.json` |
-| Commands | `/claude-cache`, `/claude-quota`, `/claude-dump` | `/claude-cache`, `/claude-quota`, `/claude-dump` |
-| Fallback accounts, quota routing, relay, dumps | Supported | Supported through the same shared core and Pi sidecar |
+| Commands | `/claude-cache`, `/claude-fast`, `/claude-quota`, `/claude-dump` | `/claude-cache`, `/claude-fast`, `/claude-quota`, `/claude-dump` |
+| Fallback accounts, quota routing, relay, dumps, fast mode | Supported | Supported through the same shared core and Pi sidecar |
 
 ## What CortexKit adds over the original plugin
 
 - **Fallback Claude accounts**: keep each agent's normal Anthropic login as the primary account, then route to ordered fallback OAuth accounts on auth/quota/rate-limit failures.
 - **Quota-aware routing**: skip main or fallback accounts when their 5-hour or 7-day Claude quota falls below your configured minimum.
 - **Persistent Claude cache controls**: manage Anthropic 1-hour prompt caching from `/claude-cache` with explicit, automatic, or hybrid modes.
+- **Fast mode toggle**: use `/claude-fast on|off` to request Anthropic fast mode for supported Opus models.
 - **Live quota visibility**: use `/claude-quota` to see main and fallback quota state, reset times, and refresh errors.
 - **User-owned Cloudflare relay**: optionally provision your own Worker relay to reduce repeated client upload bytes for large OpenCode or Pi requests.
 - **Claude-compatible request hardening**: final-body billing signing, safer token refresh persistence, replay-safe fallback retries, and subagent cache isolation.
@@ -40,7 +41,7 @@ This repo is a Bun workspace monorepo with two user-facing integrations and one
 - Support fallback Claude accounts stored in a local per-agent sidecar file.
 - Keep fallback OAuth tokens fresh in the background.
 - Apply quota thresholds before routing to main or fallback accounts.
-- Add `/claude-cache`, `/claude-quota`, and `/claude-dump` commands.
+- Add `/claude-cache`, `/claude-fast`, `/claude-quota`, and `/claude-dump` commands.
 - Optionally relay large requests through a Cloudflare Worker owned by the user.
 
 ## Install
@@ -174,6 +175,9 @@ Example:
   "dump": {
     "enabled": false
   },
+  "claudeFast": {
+    "enabled": false
+  },
   "relay": {
     "enabled": false,
     "url": "https://opencode-anthropic-relay.example.workers.dev",
@@ -185,7 +189,7 @@ Example:
 }
 ```
 
-The `claudeCache` block controls the `/claude-cache` command's persisted mode. The `main` field identifies OpenCode's primary auth entry; Pi keeps primary OAuth credentials in Pi's own credential store, but uses the same sidecar shape for CortexKit settings and fallback accounts.
+The `claudeCache` block controls the `/claude-cache` command's persisted mode, and `claudeFast` controls `/claude-fast`. The `main` field identifies OpenCode's primary auth entry; Pi keeps primary OAuth credentials in Pi's own credential store, but uses the same sidecar shape for CortexKit settings and fallback accounts.
 
 ## Fallback accounts
 
@@ -267,10 +271,24 @@ Modes:
 
 - `explicit` keeps OpenCode's explicit cache breakpoints and adds `ttl: "1h"` to them.
 - `automatic` removes block-level cache controls and sends a top-level `cache_control` object.
-- `hybrid` (recommended) uses top-level automatic caching while keeping stable explicit anchors near the beginning of the request.
+- `hybrid` (recommended) removes top-level automatic caching and uses explicit anchors on the last stable system block, the first two messages, and `messages[n-2]` when that anchor is distinct.
 
 In OpenCode, subagent requests do not receive 1-hour TTL caching. The plugin detects child sessions through OpenCode's `x-parent-session-id` header, strips that internal header before forwarding to Anthropic, and leaves default ephemeral caching in place for those requests.
 
+## Claude fast mode
+
+Both OpenCode and Pi packages can persistently request Anthropic fast mode for supported Opus models:
+
+```text
+/claude-fast
+/claude-fast on
+/claude-fast off
+```
+
+When enabled, supported requests add `speed: "fast"` to the Anthropic JSON body and include the `fast-mode-2026-02-01` beta header. Unsupported models are left at standard speed. Anthropic currently documents fast mode for `claude-opus-4-6` and `claude-opus-4-7`.
+
+Fast and standard speeds do not share prompt-cache prefixes, so switching this setting can cause cache misses.
+
 ### Estimate cache savings from OpenCode history
 
 The repo includes an OpenCode SQLite analyzer that compares estimated Claude cost under three scenarios: no prompt cache, Anthropic's default 5-minute cache, and this plugin's 1-hour cache mode.

package/dist/index.js

@@ -1,7 +1,10 @@
-import { authorize, buildClaudeQuotaSummary, buildFallbackQuotaSummaries, CACHE_1H_COMMAND_NAME, CLAUDE_DUMP_COMMAND_NAME, CLAUDE_QUOTAS_COMMAND_NAME, CLIENT_ID, exchange, executeCache1hCommand, executeDumpCommand, FallbackAccountManager, fetchOAuthQuotaSnapshot, getCache1hMode, getCache1hPersistentMode, getQuotaCheckIntervalMs, getQuotaNextRefreshAt, getRelayConfig, isCache1hEnabled, isCache1hPersistentlyEnabled, isDumpPersistentlyEnabled, loadAccounts, log, parseCache1hCommandAction, parseDumpCommandAction, quotaSnapshotPassesPolicy, sendViaRelay, setCache1hPersistentEnabled, setCache1hPersistentMode, setCache1hState, setDumpEnabled, setDumpPersistentEnabled, shouldFallbackStatus, TOKEN_URL, } from '@cortexkit/anthropic-auth-core';
+import { randomUUID } from 'node:crypto';
+import { authorize, buildClaudeQuotaSummary, buildFallbackQuotaSummaries, buildRefreshOperationError, CACHE_1H_COMMAND_NAME, CLAUDE_DUMP_COMMAND_NAME, CLAUDE_FAST_COMMAND_NAME, CLAUDE_QUOTAS_COMMAND_NAME, ClaudeOAuthRefreshError, exchange, executeCache1hCommand, executeDumpCommand, executeFastModeCommand, FallbackAccountManager, fetchOAuthQuotaSnapshot, formatRefreshBackoffMessage, getCache1hMode, getCache1hPersistentMode, getQuotaCheckIntervalMs, getQuotaNextRefreshAt, getRelayConfig, hashRefreshToken, isCache1hEnabled, isCache1hPersistentlyEnabled, isDumpPersistentlyEnabled, isFastModeEnabled, isFastModePersistentlyEnabled, isFastModeSupportedModel, loadAccounts, log, parseCache1hCommandAction, parseDumpCommandAction, parseFastModeCommandAction, quotaSnapshotPassesPolicy, refreshBackoffActive, refreshClaudeOAuthToken, resolveClaudeCodeIdentity, saveAccounts, sendViaRelay, setCache1hPersistentEnabled, setCache1hPersistentMode, setCache1hState, setDumpEnabled, setDumpPersistentEnabled, setFastModeEnabled, setFastModePersistentEnabled, shouldFallbackStatus, } from '@cortexkit/anthropic-auth-core';
 import { resolvePromptContext } from "./prompt-context.js";
-import { createStrippedStream, isInsecure, mergeHeaders, rewriteRequestBody, rewriteUrl, setOAuthHeaders, } from "./transform.js";
+import { addFastModeBetaHeader, createStrippedStream, isInsecure, mergeHeaders, rewriteRequestBody, rewriteUrl, setOAuthHeaders, } from "./transform.js";
 const HANDLED_SENTINEL = '__OPENCODE_ANTHROPIC_AUTH_COMMAND_HANDLED__';
+const MAIN_AUTH_REFRESH_TICK_MS = 60_000;
+const DEFAULT_MAIN_REFRESH_BEFORE_EXPIRY_MINUTES = 30;
 let nextPerfRequestId = 1;
 let eventLoopLagMonitorStarted = false;
 function nowMs() {
@@ -102,7 +105,17 @@ export const AnthropicAuthPlugin = async (ctx) => {
         mode: getCache1hPersistentMode(initialCache1hStorage),
     });
     setDumpEnabled(isDumpPersistentlyEnabled(initialCache1hStorage));
+    setFastModeEnabled(isFastModePersistentlyEnabled(initialCache1hStorage));
     let latestGetAuth = null;
+    let mainBackgroundRefreshTimer = null;
+    function mainRefreshBeforeExpiryMs(storage) {
+        const minutes = storage?.refresh?.refreshBeforeExpiryMinutes ??
+            DEFAULT_MAIN_REFRESH_BEFORE_EXPIRY_MINUTES;
+        return Math.max(0, minutes) * 60_000;
+    }
+    function mainRefreshEnabled(storage) {
+        return storage?.refresh?.enabled !== false;
+    }
     async function buildQuotaCommandSummary() {
         const accounts = [];
         if (latestGetAuth) {
@@ -180,6 +193,19 @@ export const AnthropicAuthPlugin = async (ctx) => {
         setDumpEnabled(enabled);
         return executeDumpCommand({ argumentsText, enabled });
     }
+    async function executePersistentFastModeCommand(argumentsText) {
+        const action = parseFastModeCommandAction(argumentsText);
+        if (action.type === 'enable' || action.type === 'disable') {
+            const enabled = action.type === 'enable';
+            await setFastModePersistentEnabled(enabled);
+            setFastModeEnabled(enabled);
+            return executeFastModeCommand({ argumentsText, enabled });
+        }
+        const storage = await loadAccounts();
+        const enabled = isFastModePersistentlyEnabled(storage);
+        setFastModeEnabled(enabled);
+        return executeFastModeCommand({ argumentsText, enabled });
+    }
     return {
         config: async (config) => {
             config.command = {
@@ -196,6 +222,10 @@ export const AnthropicAuthPlugin = async (ctx) => {
                     template: CLAUDE_DUMP_COMMAND_NAME,
                     description: 'Show or toggle Anthropic request dump capture for debugging.',
                 },
+                [CLAUDE_FAST_COMMAND_NAME]: {
+                    template: CLAUDE_FAST_COMMAND_NAME,
+                    description: 'Show or toggle Anthropic fast mode for supported Opus models.',
+                },
             };
         },
         'command.execute.before': async (input) => {
@@ -211,6 +241,10 @@ export const AnthropicAuthPlugin = async (ctx) => {
                 await sendIgnoredMessage(ctx, input.sessionID, await executePersistentDumpCommand(input.arguments));
                 throwHandledSentinel();
             }
+            if (input.command === CLAUDE_FAST_COMMAND_NAME) {
+                await sendIgnoredMessage(ctx, input.sessionID, await executePersistentFastModeCommand(input.arguments));
+                throwHandledSentinel();
+            }
         },
         auth: {
             provider: 'anthropic',
@@ -240,7 +274,20 @@ export const AnthropicAuthPlugin = async (ctx) => {
                             refreshPromise = (async () => {
                                 const maxRetries = 2;
                                 const baseDelayMs = 500;
+                                let leaseId = null;
+                                let leaseTokenHash = null;
+                                async function updateMainRefreshState(update) {
+                                    const storage = (await loadAccounts()) ?? {
+                                        version: 1,
+                                        main: { type: 'opencode', provider: 'anthropic' },
+                                        accounts: [],
+                                    };
+                                    storage.refresh = storage.refresh ?? {};
+                                    update(storage);
+                                    await saveAccounts(storage);
+                                }
                                 for (let attempt = 0; attempt <= maxRetries; attempt++) {
+                                    let freshAuth = null;
                                     try {
                                         if (attempt > 0) {
                                             const delay = baseDelayMs * 2 ** (attempt - 1);
@@ -249,29 +296,43 @@ export const AnthropicAuthPlugin = async (ctx) => {
                                         // Re-read auth to get the latest refresh token.
                                         // The outer `auth` snapshot may be stale if tokens
                                         // were rotated since the fetch() call was made.
-                                        const freshAuth = await getAuth();
-                                        const response = await fetch(TOKEN_URL, {
-                                            method: 'POST',
-                                            headers: {
-                                                'Content-Type': 'application/json',
-                                                Accept: 'application/json, text/plain, */*',
-                                                'User-Agent': 'axios/1.13.6',
-                                            },
-                                            body: JSON.stringify({
-                                                grant_type: 'refresh_token',
-                                                refresh_token: freshAuth.refresh,
-                                                client_id: CLIENT_ID,
-                                            }),
+                                        freshAuth = await getAuth();
+                                        if (!freshAuth.refresh) {
+                                            throw new Error('Token refresh failed: missing refresh token');
+                                        }
+                                        const storage = await loadAccounts();
+                                        const refreshTokenHash = hashRefreshToken(freshAuth.refresh);
+                                        const mainError = storage?.refresh?.mainLastRefreshError;
+                                        if (mainError &&
+                                            refreshBackoffActive(mainError, freshAuth.refresh, Date.now())) {
+                                            throw new Error(formatRefreshBackoffMessage(mainError, Date.now()));
+                                        }
+                                        if (storage?.refresh?.mainRefreshLeaseUntil &&
+                                            storage.refresh.mainRefreshLeaseUntil > Date.now() &&
+                                            storage.refresh.mainRefreshLeaseTokenHash ===
+                                                refreshTokenHash) {
+                                            throw new Error('Claude OAuth refresh is already in progress');
+                                        }
+                                        leaseId = randomUUID();
+                                        leaseTokenHash = refreshTokenHash;
+                                        await updateMainRefreshState((nextStorage) => {
+                                            nextStorage.refresh = nextStorage.refresh ?? {};
+                                            nextStorage.refresh.mainRefreshLeaseId =
+                                                leaseId ?? undefined;
+                                            nextStorage.refresh.mainRefreshLeaseUntil =
+                                                Date.now() + 2 * 60_000;
+                                            nextStorage.refresh.mainRefreshLeaseTokenHash =
+                                                refreshTokenHash;
                                         });
-                                        if (!response.ok) {
-                                            if (response.status >= 500 && attempt < maxRetries) {
-                                                await response.body?.cancel();
-                                                continue;
-                                            }
-                                            const body = await response.text().catch(() => '');
-                                            throw new Error(`Token refresh failed: ${response.status} — ${body}`);
+                                        const latestLease = await loadAccounts();
+                                        if (latestLease?.refresh?.mainRefreshLeaseId !== leaseId ||
+                                            latestLease.refresh.mainRefreshLeaseTokenHash !==
+                                                refreshTokenHash) {
+                                            throw new Error('Claude OAuth refresh is already in progress');
                                         }
-                                        const json = (await response.json());
+                                        const refreshed = await refreshClaudeOAuthToken({
+                                            refreshToken: freshAuth.refresh,
+                                        });
                                         // biome-ignore lint/suspicious/noExplicitAny: SDK types don't expose auth.set
                                         await client.auth.set({
                                             path: {
@@ -279,12 +340,22 @@ export const AnthropicAuthPlugin = async (ctx) => {
                                             },
                                             body: {
                                                 type: 'oauth',
-                                                refresh: json.refresh_token,
-                                                access: json.access_token,
-                                                expires: Date.now() + json.expires_in * 1000,
+                                                refresh: refreshed.refresh,
+                                                access: refreshed.access,
+                                                expires: refreshed.expires,
                                             },
                                         });
-                                        return json.access_token;
+                                        await updateMainRefreshState((storage) => {
+                                            if (!storage?.refresh)
+                                                return;
+                                            storage.refresh.mainLastRefreshError = undefined;
+                                            if (storage.refresh.mainRefreshLeaseId === leaseId) {
+                                                storage.refresh.mainRefreshLeaseId = undefined;
+                                                storage.refresh.mainRefreshLeaseUntil = undefined;
+                                                storage.refresh.mainRefreshLeaseTokenHash = undefined;
+                                            }
+                                        });
+                                        return refreshed.access;
                                     }
                                     catch (error) {
                                         const isNetworkError = error instanceof Error &&
@@ -294,11 +365,43 @@ export const AnthropicAuthPlugin = async (ctx) => {
                                                         error.code === 'ECONNREFUSED' ||
                                                         error.code === 'ETIMEDOUT' ||
                                                         error.code === 'UND_ERR_CONNECT_TIMEOUT')));
-                                        if (attempt < maxRetries && isNetworkError) {
+                                        if (attempt < maxRetries &&
+                                            (isNetworkError ||
+                                                (error instanceof ClaudeOAuthRefreshError &&
+                                                    error.status >= 500))) {
                                             continue;
                                         }
+                                        const failedRefreshToken = freshAuth?.refresh;
+                                        if (failedRefreshToken &&
+                                            error instanceof ClaudeOAuthRefreshError) {
+                                            await updateMainRefreshState((storage) => {
+                                                storage.refresh = storage.refresh ?? {};
+                                                storage.refresh.mainLastRefreshError =
+                                                    buildRefreshOperationError({
+                                                        error,
+                                                        now: Date.now(),
+                                                        refreshToken: failedRefreshToken,
+                                                        previous: storage.refresh.mainLastRefreshError,
+                                                    });
+                                            });
+                                        }
                                         throw error;
                                     }
+                                    finally {
+                                        if (leaseId) {
+                                            await updateMainRefreshState((storage) => {
+                                                if (!storage?.refresh)
+                                                    return;
+                                                if (storage.refresh.mainRefreshLeaseId === leaseId &&
+                                                    storage.refresh.mainRefreshLeaseTokenHash ===
+                                                        leaseTokenHash) {
+                                                    storage.refresh.mainRefreshLeaseId = undefined;
+                                                    storage.refresh.mainRefreshLeaseUntil = undefined;
+                                                    storage.refresh.mainRefreshLeaseTokenHash = undefined;
+                                                }
+                                            }).catch(() => { });
+                                        }
+                                    }
                                 }
                                 // Unreachable — each iteration either returns or throws.
                                 // Kept as a TypeScript exhaustiveness guard.
@@ -309,6 +412,55 @@ export const AnthropicAuthPlugin = async (ctx) => {
                         }
                         return refreshPromise;
                     }
+                    function startMainBackgroundRefresh() {
+                        if (mainBackgroundRefreshTimer) {
+                            clearInterval(mainBackgroundRefreshTimer);
+                            mainBackgroundRefreshTimer = null;
+                        }
+                        const run = async () => {
+                            try {
+                                const storage = await loadAccounts();
+                                if (!mainRefreshEnabled(storage))
+                                    return;
+                                const latestAuth = await getAuth();
+                                if (latestAuth.type !== 'oauth')
+                                    return;
+                                if (!latestAuth.expires)
+                                    return;
+                                if (latestAuth.expires - Date.now() >
+                                    mainRefreshBeforeExpiryMs(storage)) {
+                                    return;
+                                }
+                                if (latestAuth.refresh &&
+                                    refreshBackoffActive(storage?.refresh?.mainLastRefreshError, latestAuth.refresh, Date.now())) {
+                                    return;
+                                }
+                                if (latestAuth.refresh &&
+                                    storage?.refresh?.mainRefreshLeaseUntil &&
+                                    storage.refresh.mainRefreshLeaseUntil > Date.now() &&
+                                    storage.refresh.mainRefreshLeaseTokenHash ===
+                                        hashRefreshToken(latestAuth.refresh)) {
+                                    return;
+                                }
+                                await refreshMainAccessToken();
+                                log('[refresh] opencode main oauth refreshed in background', {
+                                    expires: latestAuth.expires,
+                                });
+                            }
+                            catch (error) {
+                                log('[refresh] opencode main oauth refresh failed', {
+                                    message: error instanceof Error ? error.message : String(error),
+                                });
+                            }
+                        };
+                        mainBackgroundRefreshTimer = setInterval(() => {
+                            void run();
+                        }, MAIN_AUTH_REFRESH_TICK_MS);
+                        if ('unref' in mainBackgroundRefreshTimer) {
+                            mainBackgroundRefreshTimer.unref();
+                        }
+                    }
+                    startMainBackgroundRefresh();
                     function isReplayableRequest(input, body) {
                         if (input instanceof Request && input.body)
                             return false;
@@ -395,17 +547,54 @@ export const AnthropicAuthPlugin = async (ctx) => {
                     async function sendWithAccessToken(input, init, accessToken, trace, route = 'unknown') {
                         const start = nowMs();
                         const requestHeaders = mergeHeaders(input, init);
+                        const relayAffinity = requestHeaders.get('x-session-affinity') ||
+                            requestHeaders.get('x-opencode-session');
                         const subagentRequest = isSubagentRequest(requestHeaders);
                         requestHeaders.delete('x-parent-session-id');
-                        setOAuthHeaders(requestHeaders, accessToken);
+                        requestHeaders.delete('x-session-affinity');
+                        requestHeaders.delete('x-opencode-session');
                         let body = init?.body;
+                        let modelForIdentity;
+                        if (body && typeof body === 'string') {
+                            try {
+                                const parsedBody = JSON.parse(body);
+                                if (typeof parsedBody.model === 'string') {
+                                    modelForIdentity = parsedBody.model;
+                                }
+                            }
+                            catch { }
+                        }
+                        const identity = await resolveClaudeCodeIdentity(accessToken, modelForIdentity);
                         const originalBytes = typeof body === 'string' ? body.length : undefined;
                         if (body && typeof body === 'string') {
                             const rewriteStart = nowMs();
+                            const fastModeRequested = (() => {
+                                if (!isFastModeEnabled())
+                                    return false;
+                                try {
+                                    return isFastModeSupportedModel(JSON.parse(body).model);
+                                }
+                                catch {
+                                    return false;
+                                }
+                            })();
                             body = await rewriteRequestBody(body, {
                                 cache1hEnabled: !subagentRequest && isCache1hEnabled(),
                                 cache1hMode: getCache1hMode(),
+                                fastModeEnabled: fastModeRequested,
+                                identity,
                             });
+                            try {
+                                setOAuthHeaders(requestHeaders, accessToken, {
+                                    body: JSON.parse(body),
+                                    identity,
+                                });
+                            }
+                            catch {
+                                setOAuthHeaders(requestHeaders, accessToken, { identity });
+                            }
+                            if (fastModeRequested)
+                                addFastModeBetaHeader(requestHeaders);
                             trace?.mark('rewrite_body', {
                                 route,
                                 ms: roundMs(nowMs() - rewriteStart),
@@ -413,6 +602,7 @@ export const AnthropicAuthPlugin = async (ctx) => {
                                 rewrittenBytes: body.length,
                                 cacheEnabled: !subagentRequest && isCache1hEnabled(),
                                 cacheMode: getCache1hMode(),
+                                fastModeEnabled: fastModeRequested,
                                 subagent: subagentRequest,
                             });
                         }
@@ -431,6 +621,7 @@ export const AnthropicAuthPlugin = async (ctx) => {
                             headers: requestHeaders,
                             body,
                             fallback: directFetch,
+                            affinity: relayAffinity,
                             optimisticResponse: relayConfig?.transport === 'websocket',
                         });
                         trace?.mark('send_headers_received', {

package/dist/transform.d.ts

@@ -1,4 +1,4 @@
-import { type Cache1hMode } from '@cortexkit/anthropic-auth-core';
+import { type Cache1hMode, type ClaudeCodeIdentity } from '@cortexkit/anthropic-auth-core';
 export type FetchInput = string | URL | Request;
 /**
  * Merge headers from a Request object and/or a RequestInit headers value
@@ -9,11 +9,15 @@ export declare function mergeHeaders(input: FetchInput, init?: RequestInit): Hea
  * Merge incoming beta headers with the required OAuth betas, deduplicating.
  */
 export declare function mergeBetaHeaders(headers: Headers): string;
+export declare function addFastModeBetaHeader(headers: Headers): Headers;
 /**
  * Set OAuth-required headers on the request: authorization, beta, user-agent.
  * Removes x-api-key since we're using OAuth.
  */
-export declare function setOAuthHeaders(headers: Headers, accessToken: string): Headers;
+export declare function setOAuthHeaders(headers: Headers, accessToken: string, options?: {
+    body?: Record<string, unknown> | null;
+    identity?: ClaudeCodeIdentity;
+}): Headers;
 /**
  * Add TOOL_PREFIX to tool names in the request body.
  * Prefixes both tool definitions and tool_use blocks in messages.
@@ -69,6 +73,8 @@ export declare function prependClaudeCodeIdentity(system: unknown): SystemBlock[
 export declare function rewriteRequestBody(body: string, options?: {
     cache1hEnabled?: boolean;
     cache1hMode?: Cache1hMode;
+    fastModeEnabled?: boolean;
+    identity?: ClaudeCodeIdentity;
 }): Promise<string>;
 /**
  * Create a streaming response that strips the tool prefix from tool names.

package/dist/transform.js

@@ -1,4 +1,4 @@
-import { buildBillingHeaderValue, CLAUDE_CODE_ENTRYPOINT, CLAUDE_CODE_IDENTITY, OPENCODE_IDENTITY_PREFIX, PARAGRAPH_REMOVAL_ANCHORS, REQUIRED_BETAS, signRequestBody, TEXT_REPLACEMENTS, TOOL_PREFIX, USER_AGENT, } from '@cortexkit/anthropic-auth-core';
+import { applyClaudeCodeHeaders, applyClaudeCodeMetadata, buildBillingHeaderValue, CLAUDE_CODE_ENTRYPOINT, CLAUDE_CODE_IDENTITY, FAST_MODE_BETA, isFastModeSupportedModel, mergeAnthropicBetas, OPENCODE_IDENTITY_PREFIX, orderClaudeCodeBody, PARAGRAPH_REMOVAL_ANCHORS, REQUIRED_BETAS, signRequestBody, TEXT_REPLACEMENTS, TOOL_PREFIX, } from '@cortexkit/anthropic-auth-core';
 /**
  * Prefix a tool name with TOOL_PREFIX and uppercase the first character.
  * Claude Code uses PascalCase tool names (e.g. mcp_Bash, mcp_Read);
@@ -64,16 +64,16 @@ export function mergeBetaHeaders(headers) {
         .filter(Boolean);
     return [...new Set([...REQUIRED_BETAS, ...incomingBetasList])].join(',');
 }
+export function addFastModeBetaHeader(headers) {
+    headers.set('anthropic-beta', mergeAnthropicBetas(headers.get('anthropic-beta'), [FAST_MODE_BETA]));
+    return headers;
+}
 /**
  * Set OAuth-required headers on the request: authorization, beta, user-agent.
  * Removes x-api-key since we're using OAuth.
  */
-export function setOAuthHeaders(headers, accessToken) {
-    headers.set('authorization', `Bearer ${accessToken}`);
-    headers.set('anthropic-beta', mergeBetaHeaders(headers));
-    headers.set('user-agent', USER_AGENT);
-    headers.delete('x-api-key');
-    return headers;
+export function setOAuthHeaders(headers, accessToken, options = {}) {
+    return applyClaudeCodeHeaders(headers, accessToken, options);
 }
 /**
  * Add TOOL_PREFIX to tool names in the request body.
@@ -99,7 +99,7 @@ export function prefixToolNames(parsed) {
             return msg;
         });
     }
-    return JSON.stringify(parsed);
+    return JSON.stringify(orderClaudeCodeBody(parsed));
 }
 /**
  * Strip TOOL_PREFIX from tool names in streaming response text.
@@ -107,6 +107,33 @@ export function prefixToolNames(parsed) {
 export function stripToolPrefix(text) {
     return text.replace(/"name"\s*:\s*"mcp_([^"]+)"/g, (_match, name) => `"name": "${unprefixName(name)}"`);
 }
+function splitToolPrefixRewriteBuffer(buffer, flush = false) {
+    if (flush)
+        return { ready: stripToolPrefix(buffer), pending: '' };
+    let keepFrom = buffer.length;
+    const marker = '"name"';
+    const partialMarkerStart = Math.max(0, buffer.length - marker.length + 1);
+    for (let index = partialMarkerStart; index < buffer.length; index++) {
+        if (marker.startsWith(buffer.slice(index))) {
+            keepFrom = Math.min(keepFrom, index);
+            break;
+        }
+    }
+    const lastName = buffer.lastIndexOf(marker);
+    if (lastName !== -1) {
+        const tail = buffer.slice(lastName);
+        if (/^"name"\s*(?::\s*(?:"[^"]*)?)?$/.test(tail)) {
+            keepFrom = Math.min(keepFrom, lastName);
+        }
+    }
+    if (keepFrom < buffer.length) {
+        return {
+            ready: stripToolPrefix(buffer.slice(0, keepFrom)),
+            pending: buffer.slice(keepFrom),
+        };
+    }
+    return { ready: stripToolPrefix(buffer), pending: '' };
+}
 /**
  * Check if TLS verification should be skipped for custom API endpoints.
  * Only effective when ANTHROPIC_BASE_URL is also set.
@@ -349,32 +376,39 @@ function applyAutomaticCache1h(parsed) {
     removeAllCacheControls(parsed);
     parsed.cache_control = { ...CACHE_1H_CONTROL };
 }
+function setMessageCacheAnchor(message) {
+    if (!isRecord(message))
+        return false;
+    const content = normalizeContentToArray(message.content);
+    if (!content?.length)
+        return setWireCacheControl(message, true);
+    message.content = content;
+    const lastCacheableBlock = [...content]
+        .reverse()
+        .find((block) => isRecord(block) && block.type !== 'thinking');
+    return setWireCacheControl(lastCacheableBlock ?? message, true);
+}
 function applyHybridCache1h(parsed) {
     removeAllCacheControls(parsed);
-    parsed.cache_control = { ...CACHE_1H_CONTROL };
     if (Array.isArray(parsed.system)) {
-        for (const block of parsed.system.slice(2).filter(isRecord).slice(0, 2)) {
-            setWireCacheControl(block, true);
-        }
+        const identityIndex = parsed.system.findIndex((block) => isRecord(block) && block.text === CLAUDE_CODE_IDENTITY);
+        const cacheableSystemBlocks = parsed.system
+            .slice(identityIndex >= 0 ? identityIndex + 1 : 0)
+            .filter(isRecord);
+        const lastSystemBlock = cacheableSystemBlocks[cacheableSystemBlocks.length - 1];
+        setWireCacheControl(lastSystemBlock, true);
     }
     else {
         setWireCacheControl(parsed.system, true);
     }
     if (!Array.isArray(parsed.messages))
         return;
-    const firstMessage = parsed.messages.find((message) => isRecord(message));
-    if (!isRecord(firstMessage))
-        return;
-    const content = normalizeContentToArray(firstMessage.content);
-    if (!content?.length) {
-        setWireCacheControl(firstMessage, true);
-        return;
+    setMessageCacheAnchor(parsed.messages[0]);
+    setMessageCacheAnchor(parsed.messages[1]);
+    const movingMessageIndex = parsed.messages.length - 2;
+    if (movingMessageIndex > 1) {
+        setMessageCacheAnchor(parsed.messages[movingMessageIndex]);
     }
-    firstMessage.content = content;
-    const lastCacheableBlock = [...content]
-        .reverse()
-        .find((block) => isRecord(block) && block.type !== 'thinking');
-    setWireCacheControl(lastCacheableBlock ?? firstMessage, true);
 }
 function applyCache1hStrategy(parsed, options) {
     if (!options.enabled) {
@@ -415,6 +449,14 @@ export async function rewriteRequestBody(body, options = {}) {
             enabled: options.cache1hEnabled ?? false,
             mode: options.cache1hMode ?? 'explicit',
         });
+        if (options.fastModeEnabled && isFastModeSupportedModel(parsed.model)) {
+            parsed.speed = 'fast';
+        }
+        else if (parsed.speed === 'fast') {
+            delete parsed.speed;
+        }
+        if (options.identity)
+            applyClaudeCodeMetadata(parsed, options.identity);
         return await signRequestBody(prefixToolNames(parsed));
     }
     catch {
@@ -430,16 +472,22 @@ export function createStrippedStream(response) {
     const reader = response.body.getReader();
     const decoder = new TextDecoder();
     const encoder = new TextEncoder();
+    let pending = '';
     const stream = new ReadableStream({
         async pull(controller) {
             const { done, value } = await reader.read();
             if (done) {
+                const flushed = splitToolPrefixRewriteBuffer(`${pending}${decoder.decode()}`, true);
+                if (flushed.ready)
+                    controller.enqueue(encoder.encode(flushed.ready));
                 controller.close();
                 return;
             }
-            let text = decoder.decode(value, { stream: true });
-            text = stripToolPrefix(text);
-            controller.enqueue(encoder.encode(text));
+            const text = pending + decoder.decode(value, { stream: true });
+            const rewritten = splitToolPrefixRewriteBuffer(text);
+            pending = rewritten.pending;
+            if (rewritten.ready)
+                controller.enqueue(encoder.encode(rewritten.ready));
         },
     });
     return new Response(stream, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/opencode-anthropic-auth",
-  "version": "1.0.0",
+  "version": "1.1.1",
   "type": "module",
   "repository": {
     "type": "git",
@@ -40,6 +40,6 @@
     "@opencode-ai/plugin": "*"
   },
   "dependencies": {
-    "@cortexkit/anthropic-auth-core": "1.0.0"
+    "@cortexkit/anthropic-auth-core": "1.1.1"
   }
 }