@evalops/maestro 0.10.23 → 0.10.24

package/dist/providers/anthropic-auth.js

@@ -1,221 +0,0 @@
-/**
- * Anthropic OAuth Authentication
- *
- * This module implements OAuth 2.0 with PKCE for authenticating with
- * Anthropic's Claude API. It supports both claude.ai (Pro) and
- * console.anthropic.com (Console) login modes.
- *
- * ## Authentication Flow
- *
- * ```
- * ┌─────────────────────────────────────────────────────────────┐
- * │                    Anthropic OAuth Flow                     │
- * ├─────────────────────────────────────────────────────────────┤
- * │  1. Generate PKCE challenge (verifier + challenge)          │
- * │  2. Generate login URL → User opens in browser              │
- * │  3. User authenticates at claude.ai or console.anthropic.com│
- * │  4. Receive authorization code from redirect                │
- * │  5. Exchange code + verifier for access/refresh tokens      │
- * │  6. Store credentials in ~/.maestro/anthropic-oauth.json   │
- * │  7. Auto-refresh tokens when they expire                    │
- * └─────────────────────────────────────────────────────────────┘
- * ```
- *
- * ## Login Modes
- *
- * | Mode    | Host                    | Description              |
- * |---------|-------------------------|--------------------------|
- * | pro     | claude.ai               | Claude Pro subscriptions |
- * | console | console.anthropic.com   | API Console access       |
- *
- * ## Token Storage
- *
- * Credentials are stored at:
- * - Default: `~/.maestro/anthropic-oauth.json`
- * - Custom: `$ANTHROPIC_OAUTH_FILE`
- *
- * File is created with mode 0o600 (owner read/write only).
- *
- * ## Key Functions
- *
- * - `generateAnthropicLoginUrl()`: Create OAuth URL for browser
- * - `exchangeAnthropicAuthorizationCode()`: Exchange code for tokens
- * - `getFreshAnthropicOAuthCredential()`: Get valid token (auto-refresh)
- * - `fetchClaudeApiKey()`: Convert OAuth token to API key
- *
- * @module providers/anthropic-auth
- */
-import { createHash, randomBytes } from "node:crypto";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { rm } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
-import { getAgentDir } from "../config/constants.js";
-import { safeJsonParse } from "../utils/json.js";
-import { fetchOAuthHttp } from "../utils/oauth-http.js";
-const CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
-const ANTHROPIC_OAUTH_SERVICE_NAME = "Anthropic OAuth service";
-const CLAUDE_LOGIN_HOST = {
-    pro: "claude.ai",
-    console: "console.anthropic.com",
-};
-const DEFAULT_BASE_DIR = resolve(getAgentDir(), "..");
-const AUTH_FILE = resolve(process.env.ANTHROPIC_OAUTH_FILE ??
-    join(DEFAULT_BASE_DIR, "anthropic-oauth.json"));
-export const CLAUDE_CODE_BETA_HEADER = "oauth-2025-04-20,claude-code-20250219,interleaved-thinking-2025-05-14,fine-grained-tool-streaming-2025-05-14,advanced-tool-use-2025-11-20";
-function toBase64Url(buffer) {
-    return buffer
-        .toString("base64")
-        .replace(/\+/g, "-")
-        .replace(/\//g, "_")
-        .replace(/=+$/g, "");
-}
-async function generatePKCE() {
-    const verifier = toBase64Url(randomBytes(32));
-    const challenge = toBase64Url(createHash("sha256").update(verifier).digest());
-    return { verifier, challenge };
-}
-function ensureAuthDir() {
-    mkdirSync(dirname(AUTH_FILE), { recursive: true });
-}
-export async function getStoredAnthropicOAuthCredential() {
-    try {
-        const contents = readFileSync(AUTH_FILE, "utf8");
-        const result = safeJsonParse(contents, "Anthropic auth credentials");
-        if (!result.success) {
-            return null;
-        }
-        const parsed = result.data;
-        if (typeof parsed.accessToken === "string" &&
-            typeof parsed.refreshToken === "string" &&
-            typeof parsed.expiresAt === "number") {
-            return {
-                accessToken: parsed.accessToken,
-                refreshToken: parsed.refreshToken,
-                expiresAt: parsed.expiresAt,
-                mode: parsed.mode === "console" ? "console" : "pro",
-            };
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-export async function saveAnthropicOAuthCredential(credential) {
-    ensureAuthDir();
-    writeFileSync(AUTH_FILE, JSON.stringify(credential, null, 2), {
-        encoding: "utf8",
-        mode: 0o600,
-    });
-}
-export async function deleteAnthropicOAuthCredential() {
-    try {
-        await rm(AUTH_FILE);
-    }
-    catch {
-        // ignore when file does not exist
-    }
-}
-export async function getFreshAnthropicOAuthCredential() {
-    const stored = await getStoredAnthropicOAuthCredential();
-    if (!stored) {
-        return null;
-    }
-    if (stored.expiresAt - Date.now() > 60_000) {
-        return stored;
-    }
-    const refreshed = await refreshAnthropicOAuthToken(stored.refreshToken);
-    if (!refreshed) {
-        await deleteAnthropicOAuthCredential();
-        return null;
-    }
-    const next = {
-        ...stored,
-        accessToken: refreshed.accessToken,
-        refreshToken: refreshed.refreshToken ?? stored.refreshToken,
-        expiresAt: refreshed.expiresAt,
-    };
-    await saveAnthropicOAuthCredential(next);
-    return next;
-}
-export async function generateAnthropicLoginUrl(mode = "pro") {
-    const pkce = await generatePKCE();
-    const base = new URL(`https://${CLAUDE_LOGIN_HOST[mode]}/oauth/authorize`, `https://${CLAUDE_LOGIN_HOST[mode]}`);
-    base.searchParams.set("code", "true");
-    base.searchParams.set("client_id", CLIENT_ID);
-    base.searchParams.set("response_type", "code");
-    base.searchParams.set("redirect_uri", "https://console.anthropic.com/oauth/code/callback");
-    base.searchParams.set("scope", "org:create_api_key user:profile user:inference");
-    base.searchParams.set("code_challenge", pkce.challenge);
-    base.searchParams.set("code_challenge_method", "S256");
-    base.searchParams.set("state", pkce.verifier);
-    return { url: base.toString(), verifier: pkce.verifier };
-}
-export async function exchangeAnthropicAuthorizationCode(code, verifier) {
-    const [actualCode, state] = code.trim().split("#");
-    if (!actualCode || !state) {
-        return null;
-    }
-    const response = await fetchOAuthHttp("https://console.anthropic.com/v1/oauth/token", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-            code: actualCode,
-            state,
-            grant_type: "authorization_code",
-            client_id: CLIENT_ID,
-            redirect_uri: "https://console.anthropic.com/oauth/code/callback",
-            code_verifier: verifier,
-        }),
-    }, { serviceName: ANTHROPIC_OAUTH_SERVICE_NAME });
-    if (!response.ok) {
-        return null;
-    }
-    const payload = (await response.json());
-    if (!payload.access_token || !payload.refresh_token) {
-        return null;
-    }
-    return {
-        accessToken: payload.access_token,
-        refreshToken: payload.refresh_token,
-        expiresAt: Date.now() + (payload.expires_in ?? 0) * 1000,
-    };
-}
-export async function refreshAnthropicOAuthToken(refreshToken) {
-    const response = await fetchOAuthHttp("https://console.anthropic.com/v1/oauth/token", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-            grant_type: "refresh_token",
-            refresh_token: refreshToken,
-            client_id: CLIENT_ID,
-        }),
-    }, { serviceName: ANTHROPIC_OAUTH_SERVICE_NAME });
-    if (!response.ok) {
-        return null;
-    }
-    const payload = (await response.json());
-    if (!payload.access_token) {
-        return null;
-    }
-    return {
-        accessToken: payload.access_token,
-        refreshToken: payload.refresh_token,
-        expiresAt: Date.now() + (payload.expires_in ?? 0) * 1000,
-    };
-}
-export async function fetchClaudeApiKey(accessToken) {
-    const response = await fetchOAuthHttp("https://api.anthropic.com/api/oauth/claude_cli/create_api_key", {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-            authorization: `Bearer ${accessToken}`,
-        },
-    }, { serviceName: ANTHROPIC_OAUTH_SERVICE_NAME });
-    if (!response.ok) {
-        return null;
-    }
-    const payload = (await response.json());
-    return typeof payload.raw_key === "string" ? payload.raw_key : null;
-}
-//# sourceMappingURL=anthropic-auth.js.map

package/dist/providers/anthropic-auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"anthropic-auth.js","sourceRoot":"","sources":["../../src/providers/anthropic-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAaxD,MAAM,SAAS,GAAG,sCAAsC,CAAC;AACzD,MAAM,4BAA4B,GAAG,yBAAyB,CAAC;AAE/D,MAAM,iBAAiB,GAAuC;IAC7D,GAAG,EAAE,WAAW;IAChB,OAAO,EAAE,uBAAuB;CAChC,CAAC;AAaF,MAAM,gBAAgB,GAAG,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;AAEtD,MAAM,SAAS,GAAG,OAAO,CACxB,OAAO,CAAC,GAAG,CAAC,oBAAoB;IAC/B,IAAI,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,CAC/C,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GACnC,2IAA2I,CAAC;AAO7I,SAAS,WAAW,CAAC,MAAc;IAClC,OAAO,MAAM;SACX,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,aAAa;IACrB,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC;IACtD,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,aAAa,CAKzB,QAAQ,EAAE,4BAA4B,CAAC,CAAC;QAE3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;QAC3B,IACC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;YACvC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EACnC,CAAC;YACF,OAAO;gBACN,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;aACnD,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,UAAoC;IAEpC,aAAa,EAAE,CAAC;IAChB,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QAC7D,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACX,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B;IACnD,IAAI,CAAC;QACJ,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,kCAAkC;IACnC,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC;IACrD,MAAM,MAAM,GAAG,MAAM,iCAAiC,EAAE,CAAC;IACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACxE,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,MAAM,8BAA8B,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,IAAI,GAA6B;QACtC,GAAG,MAAM;QACT,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,YAAY,EAAE,SAAS,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY;QAC3D,SAAS,EAAE,SAAS,CAAC,SAAS;KAC9B,CAAC;IACF,MAAM,4BAA4B,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAA2B,KAAK;IAEhC,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,CACnB,WAAW,iBAAiB,CAAC,IAAI,CAAC,kBAAkB,EACpD,WAAW,iBAAiB,CAAC,IAAI,CAAC,EAAE,CACpC,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,YAAY,CAAC,GAAG,CACpB,cAAc,EACd,mDAAmD,CACnD,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,GAAG,CACpB,OAAO,EACP,gDAAgD,CAChD,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACvD,IAAY,EACZ,QAAgB;IAMhB,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,cAAc,CACpC,8CAA8C,EAC9C;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,IAAI,EAAE,UAAU;YAChB,KAAK;YACL,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,mDAAmD;YACjE,aAAa,EAAE,QAAQ;SACvB,CAAC;KACF,EACD,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAC7C,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;IAClE,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO;QACN,WAAW,EAAE,OAAO,CAAC,YAAY;QACjC,YAAY,EAAE,OAAO,CAAC,aAAa;QACnC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,IAAI;KACxD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC/C,YAAoB;IAMpB,MAAM,QAAQ,GAAG,MAAM,cAAc,CACpC,8CAA8C,EAC9C;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,SAAS;SACpB,CAAC;KACF,EACD,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAC7C,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;IAClE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO;QACN,WAAW,EAAE,OAAO,CAAC,YAAY;QACjC,YAAY,EAAE,OAAO,CAAC,aAAa;QACnC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,IAAI;KACxD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,WAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,cAAc,CACpC,+DAA+D,EAC/D;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,WAAW,EAAE;SACtC;KACD,EACD,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAC7C,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAC;IAChE,OAAO,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC","sourcesContent":["/**\n * Anthropic OAuth Authentication\n *\n * This module implements OAuth 2.0 with PKCE for authenticating with\n * Anthropic's Claude API. It supports both claude.ai (Pro) and\n * console.anthropic.com (Console) login modes.\n *\n * ## Authentication Flow\n *\n * ```\n * ┌─────────────────────────────────────────────────────────────┐\n * │                    Anthropic OAuth Flow                     │\n * ├─────────────────────────────────────────────────────────────┤\n * │  1. Generate PKCE challenge (verifier + challenge)          │\n * │  2. Generate login URL → User opens in browser              │\n * │  3. User authenticates at claude.ai or console.anthropic.com│\n * │  4. Receive authorization code from redirect                │\n * │  5. Exchange code + verifier for access/refresh tokens      │\n * │  6. Store credentials in ~/.maestro/anthropic-oauth.json   │\n * │  7. Auto-refresh tokens when they expire                    │\n * └─────────────────────────────────────────────────────────────┘\n * ```\n *\n * ## Login Modes\n *\n * | Mode    | Host                    | Description              |\n * |---------|-------------------------|--------------------------|\n * | pro     | claude.ai               | Claude Pro subscriptions |\n * | console | console.anthropic.com   | API Console access       |\n *\n * ## Token Storage\n *\n * Credentials are stored at:\n * - Default: `~/.maestro/anthropic-oauth.json`\n * - Custom: `$ANTHROPIC_OAUTH_FILE`\n *\n * File is created with mode 0o600 (owner read/write only).\n *\n * ## Key Functions\n *\n * - `generateAnthropicLoginUrl()`: Create OAuth URL for browser\n * - `exchangeAnthropicAuthorizationCode()`: Exchange code for tokens\n * - `getFreshAnthropicOAuthCredential()`: Get valid token (auto-refresh)\n * - `fetchClaudeApiKey()`: Convert OAuth token to API key\n *\n * @module providers/anthropic-auth\n */\n\nimport { createHash, randomBytes } from \"node:crypto\";\nimport { mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { rm } from \"node:fs/promises\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { getAgentDir } from \"../config/constants.js\";\nimport { safeJsonParse } from \"../utils/json.js\";\nimport { fetchOAuthHttp } from \"../utils/oauth-http.js\";\n\n// Portions of this module are derived from https://github.com/sst/opencode-anthropic-auth (MIT).\n\nexport type AnthropicLoginMode = \"pro\" | \"console\";\n\nexport interface AnthropicOAuthCredential {\n\taccessToken: string;\n\trefreshToken: string;\n\texpiresAt: number;\n\tmode: AnthropicLoginMode;\n}\n\nconst CLIENT_ID = \"9d1c250a-e61b-44d9-88ed-5944d1962f5e\";\nconst ANTHROPIC_OAUTH_SERVICE_NAME = \"Anthropic OAuth service\";\n\nconst CLAUDE_LOGIN_HOST: Record<AnthropicLoginMode, string> = {\n\tpro: \"claude.ai\",\n\tconsole: \"console.anthropic.com\",\n};\n\ninterface AnthropicTokenResponse {\n\taccess_token?: string;\n\trefresh_token?: string;\n\texpires_in?: number;\n\terror?: string;\n}\n\ninterface ClaudeApiKeyResponse {\n\traw_key?: string;\n}\n\nconst DEFAULT_BASE_DIR = resolve(getAgentDir(), \"..\");\n\nconst AUTH_FILE = resolve(\n\tprocess.env.ANTHROPIC_OAUTH_FILE ??\n\t\tjoin(DEFAULT_BASE_DIR, \"anthropic-oauth.json\"),\n);\n\nexport const CLAUDE_CODE_BETA_HEADER =\n\t\"oauth-2025-04-20,claude-code-20250219,interleaved-thinking-2025-05-14,fine-grained-tool-streaming-2025-05-14,advanced-tool-use-2025-11-20\";\n\ninterface PKCEPair {\n\tverifier: string;\n\tchallenge: string;\n}\n\nfunction toBase64Url(buffer: Buffer): string {\n\treturn buffer\n\t\t.toString(\"base64\")\n\t\t.replace(/\\+/g, \"-\")\n\t\t.replace(/\\//g, \"_\")\n\t\t.replace(/=+$/g, \"\");\n}\n\nasync function generatePKCE(): Promise<PKCEPair> {\n\tconst verifier = toBase64Url(randomBytes(32));\n\tconst challenge = toBase64Url(createHash(\"sha256\").update(verifier).digest());\n\treturn { verifier, challenge };\n}\n\nfunction ensureAuthDir(): void {\n\tmkdirSync(dirname(AUTH_FILE), { recursive: true });\n}\n\nexport async function getStoredAnthropicOAuthCredential(): Promise<AnthropicOAuthCredential | null> {\n\ttry {\n\t\tconst contents = readFileSync(AUTH_FILE, \"utf8\");\n\t\tconst result = safeJsonParse<{\n\t\t\taccessToken?: unknown;\n\t\t\trefreshToken?: unknown;\n\t\t\texpiresAt?: unknown;\n\t\t\tmode?: unknown;\n\t\t}>(contents, \"Anthropic auth credentials\");\n\n\t\tif (!result.success) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst parsed = result.data;\n\t\tif (\n\t\t\ttypeof parsed.accessToken === \"string\" &&\n\t\t\ttypeof parsed.refreshToken === \"string\" &&\n\t\t\ttypeof parsed.expiresAt === \"number\"\n\t\t) {\n\t\t\treturn {\n\t\t\t\taccessToken: parsed.accessToken,\n\t\t\t\trefreshToken: parsed.refreshToken,\n\t\t\t\texpiresAt: parsed.expiresAt,\n\t\t\t\tmode: parsed.mode === \"console\" ? \"console\" : \"pro\",\n\t\t\t};\n\t\t}\n\t\treturn null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nexport async function saveAnthropicOAuthCredential(\n\tcredential: AnthropicOAuthCredential,\n): Promise<void> {\n\tensureAuthDir();\n\twriteFileSync(AUTH_FILE, JSON.stringify(credential, null, 2), {\n\t\tencoding: \"utf8\",\n\t\tmode: 0o600,\n\t});\n}\n\nexport async function deleteAnthropicOAuthCredential(): Promise<void> {\n\ttry {\n\t\tawait rm(AUTH_FILE);\n\t} catch {\n\t\t// ignore when file does not exist\n\t}\n}\n\nexport async function getFreshAnthropicOAuthCredential(): Promise<AnthropicOAuthCredential | null> {\n\tconst stored = await getStoredAnthropicOAuthCredential();\n\tif (!stored) {\n\t\treturn null;\n\t}\n\tif (stored.expiresAt - Date.now() > 60_000) {\n\t\treturn stored;\n\t}\n\tconst refreshed = await refreshAnthropicOAuthToken(stored.refreshToken);\n\tif (!refreshed) {\n\t\tawait deleteAnthropicOAuthCredential();\n\t\treturn null;\n\t}\n\tconst next: AnthropicOAuthCredential = {\n\t\t...stored,\n\t\taccessToken: refreshed.accessToken,\n\t\trefreshToken: refreshed.refreshToken ?? stored.refreshToken,\n\t\texpiresAt: refreshed.expiresAt,\n\t};\n\tawait saveAnthropicOAuthCredential(next);\n\treturn next;\n}\n\nexport async function generateAnthropicLoginUrl(\n\tmode: AnthropicLoginMode = \"pro\",\n) {\n\tconst pkce = await generatePKCE();\n\tconst base = new URL(\n\t\t`https://${CLAUDE_LOGIN_HOST[mode]}/oauth/authorize`,\n\t\t`https://${CLAUDE_LOGIN_HOST[mode]}`,\n\t);\n\tbase.searchParams.set(\"code\", \"true\");\n\tbase.searchParams.set(\"client_id\", CLIENT_ID);\n\tbase.searchParams.set(\"response_type\", \"code\");\n\tbase.searchParams.set(\n\t\t\"redirect_uri\",\n\t\t\"https://console.anthropic.com/oauth/code/callback\",\n\t);\n\tbase.searchParams.set(\n\t\t\"scope\",\n\t\t\"org:create_api_key user:profile user:inference\",\n\t);\n\tbase.searchParams.set(\"code_challenge\", pkce.challenge);\n\tbase.searchParams.set(\"code_challenge_method\", \"S256\");\n\tbase.searchParams.set(\"state\", pkce.verifier);\n\treturn { url: base.toString(), verifier: pkce.verifier };\n}\n\nexport async function exchangeAnthropicAuthorizationCode(\n\tcode: string,\n\tverifier: string,\n): Promise<{\n\taccessToken: string;\n\trefreshToken: string;\n\texpiresAt: number;\n} | null> {\n\tconst [actualCode, state] = code.trim().split(\"#\");\n\tif (!actualCode || !state) {\n\t\treturn null;\n\t}\n\tconst response = await fetchOAuthHttp(\n\t\t\"https://console.anthropic.com/v1/oauth/token\",\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\tcode: actualCode,\n\t\t\t\tstate,\n\t\t\t\tgrant_type: \"authorization_code\",\n\t\t\t\tclient_id: CLIENT_ID,\n\t\t\t\tredirect_uri: \"https://console.anthropic.com/oauth/code/callback\",\n\t\t\t\tcode_verifier: verifier,\n\t\t\t}),\n\t\t},\n\t\t{ serviceName: ANTHROPIC_OAUTH_SERVICE_NAME },\n\t);\n\tif (!response.ok) {\n\t\treturn null;\n\t}\n\tconst payload = (await response.json()) as AnthropicTokenResponse;\n\tif (!payload.access_token || !payload.refresh_token) {\n\t\treturn null;\n\t}\n\treturn {\n\t\taccessToken: payload.access_token,\n\t\trefreshToken: payload.refresh_token,\n\t\texpiresAt: Date.now() + (payload.expires_in ?? 0) * 1000,\n\t};\n}\n\nexport async function refreshAnthropicOAuthToken(\n\trefreshToken: string,\n): Promise<{\n\taccessToken: string;\n\trefreshToken?: string;\n\texpiresAt: number;\n} | null> {\n\tconst response = await fetchOAuthHttp(\n\t\t\"https://console.anthropic.com/v1/oauth/token\",\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\tgrant_type: \"refresh_token\",\n\t\t\t\trefresh_token: refreshToken,\n\t\t\t\tclient_id: CLIENT_ID,\n\t\t\t}),\n\t\t},\n\t\t{ serviceName: ANTHROPIC_OAUTH_SERVICE_NAME },\n\t);\n\tif (!response.ok) {\n\t\treturn null;\n\t}\n\tconst payload = (await response.json()) as AnthropicTokenResponse;\n\tif (!payload.access_token) {\n\t\treturn null;\n\t}\n\treturn {\n\t\taccessToken: payload.access_token,\n\t\trefreshToken: payload.refresh_token,\n\t\texpiresAt: Date.now() + (payload.expires_in ?? 0) * 1000,\n\t};\n}\n\nexport async function fetchClaudeApiKey(\n\taccessToken: string,\n): Promise<string | null> {\n\tconst response = await fetchOAuthHttp(\n\t\t\"https://api.anthropic.com/api/oauth/claude_cli/create_api_key\",\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\tauthorization: `Bearer ${accessToken}`,\n\t\t\t},\n\t\t},\n\t\t{ serviceName: ANTHROPIC_OAUTH_SERVICE_NAME },\n\t);\n\tif (!response.ok) {\n\t\treturn null;\n\t}\n\tconst payload = (await response.json()) as ClaudeApiKeyResponse;\n\treturn typeof payload.raw_key === \"string\" ? payload.raw_key : null;\n}\n"]}