@cortexkit/opencode-anthropic-auth 1.0.0

package/dist/index.js

@@ -0,0 +1,665 @@
+import { authorize, buildClaudeQuotaSummary, buildFallbackQuotaSummaries, CACHE_1H_COMMAND_NAME, CLAUDE_DUMP_COMMAND_NAME, CLAUDE_QUOTAS_COMMAND_NAME, CLIENT_ID, exchange, executeCache1hCommand, executeDumpCommand, FallbackAccountManager, fetchOAuthQuotaSnapshot, getCache1hMode, getCache1hPersistentMode, getQuotaCheckIntervalMs, getQuotaNextRefreshAt, getRelayConfig, isCache1hEnabled, isCache1hPersistentlyEnabled, isDumpPersistentlyEnabled, loadAccounts, log, parseCache1hCommandAction, parseDumpCommandAction, quotaSnapshotPassesPolicy, sendViaRelay, setCache1hPersistentEnabled, setCache1hPersistentMode, setCache1hState, setDumpEnabled, setDumpPersistentEnabled, shouldFallbackStatus, TOKEN_URL, } from '@cortexkit/anthropic-auth-core';
+import { resolvePromptContext } from "./prompt-context.js";
+import { createStrippedStream, isInsecure, mergeHeaders, rewriteRequestBody, rewriteUrl, setOAuthHeaders, } from "./transform.js";
+const HANDLED_SENTINEL = '__OPENCODE_ANTHROPIC_AUTH_COMMAND_HANDLED__';
+let nextPerfRequestId = 1;
+let eventLoopLagMonitorStarted = false;
+function nowMs() {
+    return performance.now();
+}
+function roundMs(value) {
+    return Math.round(value * 10) / 10;
+}
+function startEventLoopLagMonitor() {
+    if (eventLoopLagMonitorStarted || process.env.NODE_ENV === 'test')
+        return;
+    eventLoopLagMonitorStarted = true;
+    const intervalMs = 100;
+    const thresholdMs = 250;
+    let expected = nowMs() + intervalMs;
+    setInterval(() => {
+        const current = nowMs();
+        const lag = current - expected;
+        expected = current + intervalMs;
+        if (lag < thresholdMs)
+            return;
+        log('[perf] opencode event_loop_lag', {
+            lagMs: roundMs(lag),
+            thresholdMs,
+        });
+    }, intervalMs).unref?.();
+}
+function createPerfTrace(data) {
+    const start = nowMs();
+    const trace = {
+        requestId: String(nextPerfRequestId++),
+        start,
+        last: start,
+        mark(stage, stageData) {
+            const current = nowMs();
+            log('[perf] opencode request stage', {
+                requestId: trace.requestId,
+                stage,
+                deltaMs: roundMs(current - trace.last),
+                totalMs: roundMs(current - trace.start),
+                ...stageData,
+            });
+            trace.last = current;
+        },
+        done(stage, stageData) {
+            const current = nowMs();
+            log('[perf] opencode request done', {
+                requestId: trace.requestId,
+                stage,
+                deltaMs: roundMs(current - trace.last),
+                totalMs: roundMs(current - trace.start),
+                ...stageData,
+            });
+            trace.last = current;
+        },
+    };
+    log('[perf] opencode request start', { requestId: trace.requestId, ...data });
+    return trace;
+}
+async function sendIgnoredMessage(ctx, sessionId, text) {
+    const session = ctx.client.session;
+    const promptContext = await resolvePromptContext(ctx.client, sessionId);
+    const request = {
+        path: { id: sessionId },
+        body: {
+            noReply: true,
+            parts: [{ type: 'text', text, ignored: true }],
+        },
+    };
+    if (promptContext?.agent)
+        request.body.agent = promptContext.agent;
+    if (promptContext?.model)
+        request.body.model = promptContext.model;
+    if (promptContext?.variant)
+        request.body.variant = promptContext.variant;
+    if (typeof session?.promptAsync === 'function') {
+        await session.promptAsync(request);
+        return;
+    }
+    if (typeof session?.prompt === 'function') {
+        await Promise.resolve(session.prompt(request));
+        return;
+    }
+    throw new Error('OpenCode session prompt API is unavailable for ignored replies.');
+}
+function throwHandledSentinel() {
+    throw new Error(HANDLED_SENTINEL);
+}
+export const AnthropicAuthPlugin = async (ctx) => {
+    startEventLoopLagMonitor();
+    const { client } = ctx;
+    const fallbackManager = new FallbackAccountManager();
+    fallbackManager.startBackgroundRefresh();
+    const initialCache1hStorage = await loadAccounts();
+    const relayConfig = getRelayConfig(initialCache1hStorage);
+    setCache1hState({
+        enabled: isCache1hPersistentlyEnabled(initialCache1hStorage),
+        mode: getCache1hPersistentMode(initialCache1hStorage),
+    });
+    setDumpEnabled(isDumpPersistentlyEnabled(initialCache1hStorage));
+    let latestGetAuth = null;
+    async function buildQuotaCommandSummary() {
+        const accounts = [];
+        if (latestGetAuth) {
+            try {
+                const auth = await latestGetAuth();
+                if (auth.type === 'oauth' && auth.access) {
+                    accounts.push({
+                        name: 'OpenCode anthropic',
+                        role: 'main',
+                        quota: await fetchOAuthQuotaSnapshot({ accessToken: auth.access }),
+                    });
+                }
+                else if (auth.type === 'oauth') {
+                    accounts.push({
+                        name: 'OpenCode anthropic',
+                        role: 'main',
+                        error: 'missing access token; send a request first or reconnect auth',
+                    });
+                }
+            }
+            catch (error) {
+                accounts.push({
+                    name: 'OpenCode anthropic',
+                    role: 'main',
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+        const { storage, errors } = await fallbackManager.refreshQuotaForAllAccounts();
+        accounts.push(...buildFallbackQuotaSummaries(storage, new Map(errors.map((error) => [error.accountId, error.message]))));
+        if (!latestGetAuth) {
+            accounts.unshift({
+                name: 'OpenCode anthropic',
+                role: 'main',
+                error: 'auth loader has not run yet; send a request first',
+            });
+        }
+        return buildClaudeQuotaSummary({ accounts, refreshedAt: Date.now() });
+    }
+    async function executePersistentCache1hCommand(argumentsText) {
+        const action = parseCache1hCommandAction(argumentsText);
+        if (action.type === 'enable' || action.type === 'disable') {
+            const enabled = action.type === 'enable';
+            const storage = await setCache1hPersistentEnabled(enabled);
+            const mode = getCache1hPersistentMode(storage);
+            setCache1hState({ enabled, mode });
+            return executeCache1hCommand({ argumentsText, enabled, mode });
+        }
+        if (action.type === 'mode') {
+            const storage = await setCache1hPersistentMode(action.mode);
+            const enabled = isCache1hPersistentlyEnabled(storage);
+            setCache1hState({ enabled, mode: action.mode });
+            return executeCache1hCommand({
+                argumentsText,
+                enabled,
+                mode: action.mode,
+            });
+        }
+        const storage = await loadAccounts();
+        const enabled = isCache1hPersistentlyEnabled(storage);
+        const mode = getCache1hPersistentMode(storage);
+        setCache1hState({ enabled, mode });
+        return executeCache1hCommand({ argumentsText, enabled, mode });
+    }
+    async function executePersistentDumpCommand(argumentsText) {
+        const action = parseDumpCommandAction(argumentsText);
+        if (action.type === 'enable' || action.type === 'disable') {
+            const enabled = action.type === 'enable';
+            await setDumpPersistentEnabled(enabled);
+            setDumpEnabled(enabled);
+            return executeDumpCommand({ argumentsText, enabled });
+        }
+        const storage = await loadAccounts();
+        const enabled = isDumpPersistentlyEnabled(storage);
+        setDumpEnabled(enabled);
+        return executeDumpCommand({ argumentsText, enabled });
+    }
+    return {
+        config: async (config) => {
+            config.command = {
+                ...(config.command ?? {}),
+                [CACHE_1H_COMMAND_NAME]: {
+                    template: CACHE_1H_COMMAND_NAME,
+                    description: 'Show or toggle 1-hour Anthropic ephemeral prompt cache TTL.',
+                },
+                [CLAUDE_QUOTAS_COMMAND_NAME]: {
+                    template: CLAUDE_QUOTAS_COMMAND_NAME,
+                    description: 'Show current Claude OAuth quota usage for all accounts.',
+                },
+                [CLAUDE_DUMP_COMMAND_NAME]: {
+                    template: CLAUDE_DUMP_COMMAND_NAME,
+                    description: 'Show or toggle Anthropic request dump capture for debugging.',
+                },
+            };
+        },
+        'command.execute.before': async (input) => {
+            if (input.command === CACHE_1H_COMMAND_NAME) {
+                await sendIgnoredMessage(ctx, input.sessionID, await executePersistentCache1hCommand(input.arguments));
+                throwHandledSentinel();
+            }
+            if (input.command === CLAUDE_QUOTAS_COMMAND_NAME) {
+                await sendIgnoredMessage(ctx, input.sessionID, await buildQuotaCommandSummary());
+                throwHandledSentinel();
+            }
+            if (input.command === CLAUDE_DUMP_COMMAND_NAME) {
+                await sendIgnoredMessage(ctx, input.sessionID, await executePersistentDumpCommand(input.arguments));
+                throwHandledSentinel();
+            }
+        },
+        auth: {
+            provider: 'anthropic',
+            async loader(getAuth, provider) {
+                latestGetAuth = getAuth;
+                const auth = await getAuth();
+                if (auth.type === 'oauth') {
+                    // zero out cost for max plan
+                    for (const model of Object.values(provider.models)) {
+                        model.cost = {
+                            input: 0,
+                            output: 0,
+                            cache: {
+                                read: 0,
+                                write: 0,
+                            },
+                        };
+                    }
+                    // Shared inflight refresh promise — prevents concurrent token refreshes
+                    // from racing against each other (and causing 401 cascades with token rotation)
+                    let refreshPromise = null;
+                    let mainQuotaCache = null;
+                    let mainQuotaRefreshPromise = null;
+                    let mainQuotaRetryAfter = 0;
+                    async function refreshMainAccessToken() {
+                        if (!refreshPromise) {
+                            refreshPromise = (async () => {
+                                const maxRetries = 2;
+                                const baseDelayMs = 500;
+                                for (let attempt = 0; attempt <= maxRetries; attempt++) {
+                                    try {
+                                        if (attempt > 0) {
+                                            const delay = baseDelayMs * 2 ** (attempt - 1);
+                                            await new Promise((resolve) => setTimeout(resolve, delay));
+                                        }
+                                        // Re-read auth to get the latest refresh token.
+                                        // The outer `auth` snapshot may be stale if tokens
+                                        // were rotated since the fetch() call was made.
+                                        const freshAuth = await getAuth();
+                                        const response = await fetch(TOKEN_URL, {
+                                            method: 'POST',
+                                            headers: {
+                                                'Content-Type': 'application/json',
+                                                Accept: 'application/json, text/plain, */*',
+                                                'User-Agent': 'axios/1.13.6',
+                                            },
+                                            body: JSON.stringify({
+                                                grant_type: 'refresh_token',
+                                                refresh_token: freshAuth.refresh,
+                                                client_id: CLIENT_ID,
+                                            }),
+                                        });
+                                        if (!response.ok) {
+                                            if (response.status >= 500 && attempt < maxRetries) {
+                                                await response.body?.cancel();
+                                                continue;
+                                            }
+                                            const body = await response.text().catch(() => '');
+                                            throw new Error(`Token refresh failed: ${response.status} — ${body}`);
+                                        }
+                                        const json = (await response.json());
+                                        // biome-ignore lint/suspicious/noExplicitAny: SDK types don't expose auth.set
+                                        await client.auth.set({
+                                            path: {
+                                                id: 'anthropic',
+                                            },
+                                            body: {
+                                                type: 'oauth',
+                                                refresh: json.refresh_token,
+                                                access: json.access_token,
+                                                expires: Date.now() + json.expires_in * 1000,
+                                            },
+                                        });
+                                        return json.access_token;
+                                    }
+                                    catch (error) {
+                                        const isNetworkError = error instanceof Error &&
+                                            (error.message.includes('fetch failed') ||
+                                                ('code' in error &&
+                                                    (error.code === 'ECONNRESET' ||
+                                                        error.code === 'ECONNREFUSED' ||
+                                                        error.code === 'ETIMEDOUT' ||
+                                                        error.code === 'UND_ERR_CONNECT_TIMEOUT')));
+                                        if (attempt < maxRetries && isNetworkError) {
+                                            continue;
+                                        }
+                                        throw error;
+                                    }
+                                }
+                                // Unreachable — each iteration either returns or throws.
+                                // Kept as a TypeScript exhaustiveness guard.
+                                throw new Error('Token refresh exhausted all retries');
+                            })().finally(() => {
+                                refreshPromise = null;
+                            });
+                        }
+                        return refreshPromise;
+                    }
+                    function isReplayableRequest(input, body) {
+                        if (input instanceof Request && input.body)
+                            return false;
+                        return body == null || typeof body === 'string';
+                    }
+                    function isSubagentRequest(headers) {
+                        return headers.has('x-parent-session-id');
+                    }
+                    function isStreamingRateLimitText(text) {
+                        return (text.includes('rate_limit_error') ||
+                            /exceed your account'?s rate limit/i.test(text));
+                    }
+                    function mainQuotaRoutingEnabled(storage) {
+                        return storage?.quota?.enabled === true;
+                    }
+                    async function inspectStreamingRateLimit(response, trace) {
+                        if (!response.body || response.status !== 200) {
+                            trace?.mark('inspect_stream_skip', { status: response.status });
+                            return { response, rateLimited: false };
+                        }
+                        if (response.headers.get('x-cortexkit-relay-optimistic') === 'true') {
+                            trace?.mark('inspect_stream_skip', {
+                                status: response.status,
+                                reason: 'optimistic_relay',
+                            });
+                            return { response, rateLimited: false };
+                        }
+                        const start = nowMs();
+                        const reader = response.body.getReader();
+                        const chunks = [];
+                        const decoder = new TextDecoder();
+                        let text = '';
+                        let bytes = 0;
+                        while (!text.includes('\n\n') && text.length < 65_536) {
+                            const { done, value } = await reader.read();
+                            if (done)
+                                break;
+                            chunks.push(value);
+                            bytes += value.byteLength;
+                            text += decoder.decode(value, { stream: true });
+                            if (isStreamingRateLimitText(text))
+                                break;
+                        }
+                        if (isStreamingRateLimitText(text)) {
+                            await reader.cancel().catch(() => { });
+                            trace?.mark('inspect_stream_first_event', {
+                                ms: roundMs(nowMs() - start),
+                                bytes,
+                                rateLimited: true,
+                            });
+                            return { response, rateLimited: true };
+                        }
+                        const stream = new ReadableStream({
+                            start(controller) {
+                                for (const chunk of chunks)
+                                    controller.enqueue(chunk);
+                            },
+                            async pull(controller) {
+                                const { done, value } = await reader.read();
+                                if (done) {
+                                    controller.close();
+                                    return;
+                                }
+                                controller.enqueue(value);
+                            },
+                            cancel(reason) {
+                                return reader.cancel(reason);
+                            },
+                        });
+                        trace?.mark('inspect_stream_first_event', {
+                            ms: roundMs(nowMs() - start),
+                            bytes,
+                            rateLimited: false,
+                        });
+                        return {
+                            response: new Response(stream, {
+                                status: response.status,
+                                statusText: response.statusText,
+                                headers: response.headers,
+                            }),
+                            rateLimited: false,
+                        };
+                    }
+                    async function sendWithAccessToken(input, init, accessToken, trace, route = 'unknown') {
+                        const start = nowMs();
+                        const requestHeaders = mergeHeaders(input, init);
+                        const subagentRequest = isSubagentRequest(requestHeaders);
+                        requestHeaders.delete('x-parent-session-id');
+                        setOAuthHeaders(requestHeaders, accessToken);
+                        let body = init?.body;
+                        const originalBytes = typeof body === 'string' ? body.length : undefined;
+                        if (body && typeof body === 'string') {
+                            const rewriteStart = nowMs();
+                            body = await rewriteRequestBody(body, {
+                                cache1hEnabled: !subagentRequest && isCache1hEnabled(),
+                                cache1hMode: getCache1hMode(),
+                            });
+                            trace?.mark('rewrite_body', {
+                                route,
+                                ms: roundMs(nowMs() - rewriteStart),
+                                originalBytes,
+                                rewrittenBytes: body.length,
+                                cacheEnabled: !subagentRequest && isCache1hEnabled(),
+                                cacheMode: getCache1hMode(),
+                                subagent: subagentRequest,
+                            });
+                        }
+                        const rewritten = rewriteUrl(input);
+                        const directFetch = () => fetch(rewritten.input, {
+                            ...init,
+                            body,
+                            headers: requestHeaders,
+                            ...(isInsecure() && { tls: { rejectUnauthorized: false } }),
+                        });
+                        const sendStart = nowMs();
+                        const response = await sendViaRelay({
+                            config: relayConfig,
+                            input: rewritten.input,
+                            init,
+                            headers: requestHeaders,
+                            body,
+                            fallback: directFetch,
+                            optimisticResponse: relayConfig?.transport === 'websocket',
+                        });
+                        trace?.mark('send_headers_received', {
+                            route,
+                            ms: roundMs(nowMs() - sendStart),
+                            status: response.status,
+                            relayConfigured: relayConfig != null,
+                            totalSendWithAccessMs: roundMs(nowMs() - start),
+                        });
+                        return response;
+                    }
+                    async function refreshMainQuotaCache(accessToken, storage) {
+                        const now = Date.now();
+                        const quota = await fetchOAuthQuotaSnapshot({ accessToken });
+                        mainQuotaCache = {
+                            accessToken,
+                            refreshAfter: getQuotaNextRefreshAt(quota, storage, now),
+                            quota,
+                        };
+                        return quota;
+                    }
+                    function refreshMainQuotaCacheInBackground(accessToken, storage) {
+                        const now = Date.now();
+                        if (mainQuotaRefreshPromise || now < mainQuotaRetryAfter)
+                            return;
+                        mainQuotaRefreshPromise = refreshMainQuotaCache(accessToken, storage)
+                            .catch((error) => {
+                            mainQuotaRetryAfter = now + getQuotaCheckIntervalMs(storage);
+                            throw error;
+                        })
+                            .finally(() => {
+                            mainQuotaRefreshPromise = null;
+                        });
+                        void mainQuotaRefreshPromise.catch(() => { });
+                    }
+                    async function getMainQuotaForRouting(accessToken, storage) {
+                        const now = Date.now();
+                        if (mainQuotaCache?.accessToken !== accessToken) {
+                            return await refreshMainQuotaCache(accessToken, storage);
+                        }
+                        if (now >= mainQuotaCache.refreshAfter) {
+                            refreshMainQuotaCacheInBackground(accessToken, storage);
+                        }
+                        return mainQuotaCache.quota;
+                    }
+                    async function tryUsableFallbackAccounts(input, init, accounts, storage, currentResponse, trace) {
+                        if (!accounts.length)
+                            return currentResponse ?? null;
+                        await currentResponse?.body?.cancel().catch(() => { });
+                        let lastResponse = currentResponse ?? null;
+                        for (const [index, account] of accounts.entries()) {
+                            const access = account.access;
+                            if (!access)
+                                continue;
+                            let response = await sendWithAccessToken(input, init, access, trace, `fallback_${index}`);
+                            lastResponse = response;
+                            let fallbackAgain = shouldFallbackStatus(response.status, storage);
+                            if (!fallbackAgain) {
+                                const inspected = await inspectStreamingRateLimit(response, trace);
+                                response = inspected.response;
+                                lastResponse = response;
+                                fallbackAgain = inspected.rateLimited;
+                            }
+                            if (!fallbackAgain) {
+                                await fallbackManager.markUsed(account);
+                                return response;
+                            }
+                            if (index < accounts.length - 1) {
+                                await response.body?.cancel().catch(() => { });
+                            }
+                        }
+                        return lastResponse;
+                    }
+                    async function tryFallbackAccounts(input, init, mainResponse, preselectedAccounts, trace) {
+                        if (!isReplayableRequest(input, init?.body))
+                            return mainResponse;
+                        const loadStart = nowMs();
+                        const storage = await loadAccounts();
+                        trace?.mark('fallback_load_storage', {
+                            ms: roundMs(nowMs() - loadStart),
+                        });
+                        let currentResponse = mainResponse;
+                        let shouldFallback = shouldFallbackStatus(currentResponse.status, storage);
+                        if (!shouldFallback) {
+                            const inspected = await inspectStreamingRateLimit(currentResponse, trace);
+                            currentResponse = inspected.response;
+                            shouldFallback = inspected.rateLimited;
+                        }
+                        if (!shouldFallback) {
+                            return currentResponse;
+                        }
+                        let accounts = preselectedAccounts;
+                        if (!accounts) {
+                            const accountsStart = nowMs();
+                            accounts = await fallbackManager.getUsableFallbackAccounts();
+                            trace?.mark('fallback_get_accounts', {
+                                ms: roundMs(nowMs() - accountsStart),
+                                accounts: accounts.length,
+                            });
+                        }
+                        return ((await tryUsableFallbackAccounts(input, init, accounts, storage, currentResponse, trace)) ?? currentResponse);
+                    }
+                    return {
+                        apiKey: '',
+                        async fetch(input, init) {
+                            const initialBody = init?.body;
+                            const trace = createPerfTrace({
+                                bodyBytes: typeof initialBody === 'string'
+                                    ? initialBody.length
+                                    : undefined,
+                                relayConfigured: relayConfig != null,
+                            });
+                            const authStart = nowMs();
+                            const auth = await getAuth();
+                            trace.mark('get_auth', {
+                                ms: roundMs(nowMs() - authStart),
+                                authType: auth.type,
+                                hasAccess: Boolean(auth.access),
+                            });
+                            if (auth.type !== 'oauth') {
+                                const response = await fetch(input, init);
+                                trace.done('non_oauth_passthrough', { status: response.status });
+                                return response;
+                            }
+                            if (!auth.access || !auth.expires || auth.expires < Date.now()) {
+                                const refreshStart = nowMs();
+                                auth.access = await refreshMainAccessToken();
+                                trace.mark('refresh_main_access', {
+                                    ms: roundMs(nowMs() - refreshStart),
+                                });
+                            }
+                            if (!auth.access) {
+                                trace.done('missing_access_error');
+                                throw new Error('OAuth access token is missing after refresh');
+                            }
+                            const loadStart = nowMs();
+                            const storage = await loadAccounts();
+                            trace.mark('load_storage', { ms: roundMs(nowMs() - loadStart) });
+                            let preselectedFallbackAccounts;
+                            if (isReplayableRequest(input, init?.body) &&
+                                mainQuotaRoutingEnabled(storage)) {
+                                try {
+                                    const quotaStart = nowMs();
+                                    const mainQuota = await getMainQuotaForRouting(auth.access, storage);
+                                    trace.mark('main_quota_for_routing', {
+                                        ms: roundMs(nowMs() - quotaStart),
+                                        passes: quotaSnapshotPassesPolicy(mainQuota, storage),
+                                    });
+                                    if (!quotaSnapshotPassesPolicy(mainQuota, storage)) {
+                                        const fallbackStart = nowMs();
+                                        preselectedFallbackAccounts =
+                                            await fallbackManager.getUsableFallbackAccounts();
+                                        trace.mark('preselect_fallback_accounts', {
+                                            ms: roundMs(nowMs() - fallbackStart),
+                                            accounts: preselectedFallbackAccounts.length,
+                                        });
+                                        const fallbackResponse = await tryUsableFallbackAccounts(input, init, preselectedFallbackAccounts, storage, undefined, trace);
+                                        if (fallbackResponse) {
+                                            trace.done('return_preselected_fallback', {
+                                                status: fallbackResponse.status,
+                                            });
+                                            return createStrippedStream(fallbackResponse);
+                                        }
+                                    }
+                                }
+                                catch (error) {
+                                    trace.mark('main_quota_for_routing_error', {
+                                        error: error instanceof Error ? error.message : String(error),
+                                    });
+                                    // Main quota checks should optimize routing, not break requests.
+                                }
+                            }
+                            const mainResponse = await sendWithAccessToken(input, init, auth.access, trace, 'main');
+                            const response = await tryFallbackAccounts(input, init, mainResponse, preselectedFallbackAccounts, trace);
+                            trace.done('return_response', { status: response.status });
+                            return createStrippedStream(response);
+                        },
+                    };
+                }
+                return {};
+            },
+            methods: [
+                {
+                    label: 'Claude Pro/Max',
+                    type: 'oauth',
+                    authorize: async () => {
+                        const result = await authorize('max');
+                        return {
+                            url: result.url,
+                            instructions: 'Paste the authorization code here:',
+                            method: 'code',
+                            callback: async (code) => {
+                                return exchange(code, result.verifier, result.redirectUri, result.state);
+                            },
+                        };
+                    },
+                },
+                {
+                    label: 'Create an API Key',
+                    type: 'oauth',
+                    authorize: async () => {
+                        const result = await authorize('console');
+                        return {
+                            url: result.url,
+                            instructions: 'Paste the authorization code here:',
+                            method: 'code',
+                            callback: async (code) => {
+                                const credentials = await exchange(code, result.verifier, result.redirectUri, result.state);
+                                if (credentials.type === 'failed')
+                                    return credentials;
+                                const apiKey = await fetch(`https://api.anthropic.com/api/oauth/claude_cli/create_api_key`, {
+                                    method: 'POST',
+                                    headers: {
+                                        'Content-Type': 'application/json',
+                                        authorization: `Bearer ${credentials.access}`,
+                                    },
+                                }).then((r) => r.json());
+                                return { type: 'success', key: apiKey.raw_key };
+                            },
+                        };
+                    },
+                },
+                {
+                    provider: 'anthropic',
+                    label: 'Manually enter API Key',
+                    type: 'api',
+                },
+            ],
+        },
+        // biome-ignore lint/suspicious/noExplicitAny: Plugin type doesn't include undocumented auth/hooks
+    };
+};