@ex-machina/opencode-anthropic-auth 0.0.15

package/.github/workflows/publish.yml

@@ -0,0 +1,34 @@
+name: Publish to npm
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "package.json"
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Publish
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: false

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 SST
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/bun.lock

@@ -0,0 +1,43 @@
+{
+  "lockfileVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "opencode-anthropic-auth",
+      "dependencies": {
+        "@openauthjs/openauth": "^0.4.3",
+      },
+      "devDependencies": {
+        "@opencode-ai/plugin": "^0.4.45",
+      },
+    },
+  },
+  "packages": {
+    "@openauthjs/openauth": ["@openauthjs/openauth@0.4.3", "", { "dependencies": { "@standard-schema/spec": "1.0.0-beta.3", "aws4fetch": "1.0.20", "jose": "5.9.6" }, "peerDependencies": { "arctic": "^2.2.2", "hono": "^4.0.0" } }, "sha512-RlnjqvHzqcbFVymEwhlUEuac4utA5h4nhSK/i2szZuQmxTIqbGUxZ+nM+avM+VV4Ing+/ZaNLKILoXS3yrkOOw=="],
+
+    "@opencode-ai/plugin": ["@opencode-ai/plugin@0.4.45", "", { "dependencies": { "@opencode-ai/sdk": "0.4.19" } }, "sha512-TuD+FNmA6vN+/B82qayCvOyTXRuAtfvU0U95UKSZoNrYgIBhpD/sW/oS65iUv5QwQqzO8BxI4DYWjmLIqCz8uw=="],
+
+    "@opencode-ai/sdk": ["@opencode-ai/sdk@0.4.19", "", {}, "sha512-7V+wDR1+m+TQZAraAh/bOSObiA/uysG1YIXZVe6gl1sQAXDtkG2FYCzs0gTZ/ORdkUKEnr3vyQIk895Mu0CC/w=="],
+
+    "@oslojs/asn1": ["@oslojs/asn1@1.0.0", "", { "dependencies": { "@oslojs/binary": "1.0.0" } }, "sha512-zw/wn0sj0j0QKbIXfIlnEcTviaCzYOY3V5rAyjR6YtOByFtJiT574+8p9Wlach0lZH9fddD4yb9laEAIl4vXQA=="],
+
+    "@oslojs/binary": ["@oslojs/binary@1.0.0", "", {}, "sha512-9RCU6OwXU6p67H4NODbuxv2S3eenuQ4/WFLrsq+K/k682xrznH5EVWA7N4VFk9VYVcbFtKqur5YQQZc0ySGhsQ=="],
+
+    "@oslojs/crypto": ["@oslojs/crypto@1.0.1", "", { "dependencies": { "@oslojs/asn1": "1.0.0", "@oslojs/binary": "1.0.0" } }, "sha512-7n08G8nWjAr/Yu3vu9zzrd0L9XnrJfpMioQcvCMxBIiF5orECHe5/3J0jmXRVvgfqMm/+4oxlQ+Sq39COYLcNQ=="],
+
+    "@oslojs/encoding": ["@oslojs/encoding@1.1.0", "", {}, "sha512-70wQhgYmndg4GCPxPPxPGevRKqTIJ2Nh4OkiMWmDAVYsTQ+Ta7Sq+rPevXyXGdzr30/qZBnyOalCszoMxlyldQ=="],
+
+    "@oslojs/jwt": ["@oslojs/jwt@0.2.0", "", { "dependencies": { "@oslojs/encoding": "0.4.1" } }, "sha512-bLE7BtHrURedCn4Mco3ma9L4Y1GR2SMBuIvjWr7rmQ4/W/4Jy70TIAgZ+0nIlk0xHz1vNP8x8DCns45Sb2XRbg=="],
+
+    "@standard-schema/spec": ["@standard-schema/spec@1.0.0-beta.3", "", {}, "sha512-0ifF3BjA1E8SY9C+nUew8RefNOIq0cDlYALPty4rhUm8Rrl6tCM8hBT4bhGhx7I7iXD0uAgt50lgo8dD73ACMw=="],
+
+    "arctic": ["arctic@2.3.4", "", { "dependencies": { "@oslojs/crypto": "1.0.1", "@oslojs/encoding": "1.1.0", "@oslojs/jwt": "0.2.0" } }, "sha512-+p30BOWsctZp+CVYCt7oAean/hWGW42sH5LAcRQX56ttEkFJWbzXBhmSpibbzwSJkRrotmsA+oAoJoVsU0f5xA=="],
+
+    "aws4fetch": ["aws4fetch@1.0.20", "", {}, "sha512-/djoAN709iY65ETD6LKCtyyEI04XIBP5xVvfmNxsEP0uJB5tyaGBztSryRr4HqMStr9R06PisQE7m9zDTXKu6g=="],
+
+    "hono": ["hono@4.9.1", "", {}, "sha512-qfvdJ42t6CQE0N/iSCa8KsW8SQqYD67YB+TYbwPHlnALvX+s7ynh8otR1NEk5jXtUg73gpV/B82OSufDmwtX3w=="],
+
+    "jose": ["jose@5.9.6", "", {}, "sha512-AMlnetc9+CV9asI19zHmrgS/WYsWUwCn2R7RzlbJWD7F9eWYUTGyBmU9o6PxngtLGOiDGPRu+Uc4fhKzbpteZQ=="],
+
+    "@oslojs/jwt/@oslojs/encoding": ["@oslojs/encoding@0.4.1", "", {}, "sha512-hkjo6MuIK/kQR5CrGNdAPZhS01ZCXuWDRJ187zh6qqF2+yMHZpD9fAYpX8q2bOO6Ryhl3XpCT6kUX76N8hhm4Q=="],
+  }
+}

package/index.mjs

@@ -0,0 +1,365 @@
+import { generatePKCE } from "@openauthjs/openauth/pkce";
+
+const CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+
+/**
+ * @param {"max" | "console"} mode
+ */
+async function authorize(mode) {
+  const pkce = await generatePKCE();
+
+  const url = new URL(
+    `https://${mode === "console" ? "console.anthropic.com" : "claude.ai"}/oauth/authorize`,
+    import.meta.url,
+  );
+  url.searchParams.set("code", "true");
+  url.searchParams.set("client_id", CLIENT_ID);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set(
+    "redirect_uri",
+    "https://console.anthropic.com/oauth/code/callback",
+  );
+  url.searchParams.set(
+    "scope",
+    "org:create_api_key user:profile user:inference",
+  );
+  url.searchParams.set("code_challenge", pkce.challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("state", pkce.verifier);
+  return {
+    url: url.toString(),
+    verifier: pkce.verifier,
+  };
+}
+
+/**
+ * @param {string} code
+ * @param {string} verifier
+ */
+async function exchange(code, verifier) {
+  const splits = code.split("#");
+  const result = await fetch("https://console.anthropic.com/v1/oauth/token", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({
+      code: splits[0],
+      state: splits[1],
+      grant_type: "authorization_code",
+      client_id: CLIENT_ID,
+      redirect_uri: "https://console.anthropic.com/oauth/code/callback",
+      code_verifier: verifier,
+    }),
+  });
+  if (!result.ok)
+    return {
+      type: "failed",
+    };
+  const json = await result.json();
+  return {
+    type: "success",
+    refresh: json.refresh_token,
+    access: json.access_token,
+    expires: Date.now() + json.expires_in * 1000,
+  };
+}
+
+/**
+ * @type {import('@opencode-ai/plugin').Plugin}
+ */
+export async function AnthropicAuthPlugin({ client }) {
+  return {
+    "experimental.chat.system.transform": (input, output) => {
+      const prefix =
+        "You are Claude Code, Anthropic's official CLI for Claude.";
+      if (input.model?.providerID === "anthropic") {
+        output.system.unshift(prefix);
+        if (output.system[1])
+          output.system[1] = prefix + "\n\n" + output.system[1];
+      }
+    },
+    auth: {
+      provider: "anthropic",
+      async loader(getAuth, provider) {
+        const auth = await getAuth();
+        if (auth.type === "oauth") {
+          // zero out cost for max plan
+          for (const model of Object.values(provider.models)) {
+            model.cost = {
+              input: 0,
+              output: 0,
+              cache: {
+                read: 0,
+                write: 0,
+              },
+            };
+          }
+          return {
+            apiKey: "",
+            /**
+             * @param {any} input
+             * @param {any} init
+             */
+            async fetch(input, init) {
+              const auth = await getAuth();
+              if (auth.type !== "oauth") return fetch(input, init);
+              if (!auth.access || auth.expires < Date.now()) {
+                const response = await fetch(
+                  "https://console.anthropic.com/v1/oauth/token",
+                  {
+                    method: "POST",
+                    headers: {
+                      "Content-Type": "application/json",
+                    },
+                    body: JSON.stringify({
+                      grant_type: "refresh_token",
+                      refresh_token: auth.refresh,
+                      client_id: CLIENT_ID,
+                    }),
+                  },
+                );
+                if (!response.ok) {
+                  throw new Error(`Token refresh failed: ${response.status}`);
+                }
+                const json = await response.json();
+                await client.auth.set({
+                  path: {
+                    id: "anthropic",
+                  },
+                  body: {
+                    type: "oauth",
+                    refresh: json.refresh_token,
+                    access: json.access_token,
+                    expires: Date.now() + json.expires_in * 1000,
+                  },
+                });
+                auth.access = json.access_token;
+              }
+              const requestInit = init ?? {};
+
+              const requestHeaders = new Headers();
+              if (input instanceof Request) {
+                input.headers.forEach((value, key) => {
+                  requestHeaders.set(key, value);
+                });
+              }
+              if (requestInit.headers) {
+                if (requestInit.headers instanceof Headers) {
+                  requestInit.headers.forEach((value, key) => {
+                    requestHeaders.set(key, value);
+                  });
+                } else if (Array.isArray(requestInit.headers)) {
+                  for (const [key, value] of requestInit.headers) {
+                    if (typeof value !== "undefined") {
+                      requestHeaders.set(key, String(value));
+                    }
+                  }
+                } else {
+                  for (const [key, value] of Object.entries(
+                    requestInit.headers,
+                  )) {
+                    if (typeof value !== "undefined") {
+                      requestHeaders.set(key, String(value));
+                    }
+                  }
+                }
+              }
+
+              // Preserve all incoming beta headers while ensuring OAuth requirements
+              const incomingBeta = requestHeaders.get("anthropic-beta") || "";
+              const incomingBetasList = incomingBeta
+                .split(",")
+                .map((b) => b.trim())
+                .filter(Boolean);
+
+              const requiredBetas = [
+                "oauth-2025-04-20",
+                "interleaved-thinking-2025-05-14",
+              ];
+              const mergedBetas = [
+                ...new Set([...requiredBetas, ...incomingBetasList]),
+              ].join(",");
+
+              requestHeaders.set("authorization", `Bearer ${auth.access}`);
+              requestHeaders.set("anthropic-beta", mergedBetas);
+              requestHeaders.set(
+                "user-agent",
+                "claude-cli/2.1.2 (external, cli)",
+              );
+              requestHeaders.delete("x-api-key");
+
+              const TOOL_PREFIX = "mcp_";
+              let body = requestInit.body;
+              if (body && typeof body === "string") {
+                try {
+                  const parsed = JSON.parse(body);
+
+                  // Sanitize system prompt - server blocks "OpenCode" string
+                  // Note: (?<!\/) preserves paths like /path/to/opencode-foo
+                  if (parsed.system && Array.isArray(parsed.system)) {
+                    parsed.system = parsed.system.map((item) => {
+                      if (item.type === "text" && item.text) {
+                        return {
+                          ...item,
+                          text: item.text
+                            .replace(/OpenCode/g, "Claude Code")
+                            .replace(/(?<!\/)opencode/gi, "Claude"),
+                        };
+                      }
+                      return item;
+                    });
+                  }
+
+                  // Add prefix to tools definitions
+                  if (parsed.tools && Array.isArray(parsed.tools)) {
+                    parsed.tools = parsed.tools.map((tool) => ({
+                      ...tool,
+                      name: tool.name
+                        ? `${TOOL_PREFIX}${tool.name}`
+                        : tool.name,
+                    }));
+                  }
+                  // Add prefix to tool_use blocks in messages
+                  if (parsed.messages && Array.isArray(parsed.messages)) {
+                    parsed.messages = parsed.messages.map((msg) => {
+                      if (msg.content && Array.isArray(msg.content)) {
+                        msg.content = msg.content.map((block) => {
+                          if (block.type === "tool_use" && block.name) {
+                            return {
+                              ...block,
+                              name: `${TOOL_PREFIX}${block.name}`,
+                            };
+                          }
+                          return block;
+                        });
+                      }
+                      return msg;
+                    });
+                  }
+                  body = JSON.stringify(parsed);
+                } catch (e) {
+                  // ignore parse errors
+                }
+              }
+
+              let requestInput = input;
+              let requestUrl = null;
+              try {
+                if (typeof input === "string" || input instanceof URL) {
+                  requestUrl = new URL(input.toString());
+                } else if (input instanceof Request) {
+                  requestUrl = new URL(input.url);
+                }
+              } catch {
+                requestUrl = null;
+              }
+
+              if (
+                requestUrl &&
+                requestUrl.pathname === "/v1/messages" &&
+                !requestUrl.searchParams.has("beta")
+              ) {
+                requestUrl.searchParams.set("beta", "true");
+                requestInput =
+                  input instanceof Request
+                    ? new Request(requestUrl.toString(), input)
+                    : requestUrl;
+              }
+
+              const response = await fetch(requestInput, {
+                ...requestInit,
+                body,
+                headers: requestHeaders,
+              });
+
+              // Transform streaming response to rename tools back
+              if (response.body) {
+                const reader = response.body.getReader();
+                const decoder = new TextDecoder();
+                const encoder = new TextEncoder();
+
+                const stream = new ReadableStream({
+                  async pull(controller) {
+                    const { done, value } = await reader.read();
+                    if (done) {
+                      controller.close();
+                      return;
+                    }
+
+                    let text = decoder.decode(value, { stream: true });
+                    text = text.replace(
+                      /"name"\s*:\s*"mcp_([^"]+)"/g,
+                      '"name": "$1"',
+                    );
+                    controller.enqueue(encoder.encode(text));
+                  },
+                });
+
+                return new Response(stream, {
+                  status: response.status,
+                  statusText: response.statusText,
+                  headers: response.headers,
+                });
+              }
+
+              return response;
+            },
+          };
+        }
+
+        return {};
+      },
+      methods: [
+        {
+          label: "Claude Pro/Max",
+          type: "oauth",
+          authorize: async () => {
+            const { url, verifier } = await authorize("max");
+            return {
+              url: url,
+              instructions: "Paste the authorization code here: ",
+              method: "code",
+              callback: async (code) => {
+                const credentials = await exchange(code, verifier);
+                return credentials;
+              },
+            };
+          },
+        },
+        {
+          label: "Create an API Key",
+          type: "oauth",
+          authorize: async () => {
+            const { url, verifier } = await authorize("console");
+            return {
+              url: url,
+              instructions: "Paste the authorization code here: ",
+              method: "code",
+              callback: async (code) => {
+                const credentials = await exchange(code, verifier);
+                if (credentials.type === "failed") return credentials;
+                const result = await fetch(
+                  `https://api.anthropic.com/api/oauth/claude_cli/create_api_key`,
+                  {
+                    method: "POST",
+                    headers: {
+                      "Content-Type": "application/json",
+                      authorization: `Bearer ${credentials.access}`,
+                    },
+                  },
+                ).then((r) => r.json());
+                return { type: "success", key: result.raw_key };
+              },
+            };
+          },
+        },
+        {
+          provider: "anthropic",
+          label: "Manually enter API Key",
+          type: "api",
+        },
+      ],
+    },
+  };
+}

package/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "@ex-machina/opencode-anthropic-auth",
+  "version": "0.0.15",
+  "main": "./index.mjs",
+  "scripts": {
+    "bump": "bun script/bump.ts"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/ex-machina-co/opencode-anthropic-auth"
+  },
+  "devDependencies": {
+    "@opencode-ai/plugin": "^0.4.45"
+  },
+  "dependencies": {
+    "@openauthjs/openauth": "^0.4.3"
+  }
+}

package/script/bump.ts

@@ -0,0 +1,43 @@
+#!/usr/bin/env bun
+/**
+ * Bumps the version in package.json, commits, and pushes.
+ * Pushing the version change to main triggers the CI publish workflow.
+ *
+ * Usage: bun script/bump.ts [patch|minor|major] [--dry-run]
+ */
+
+import { $ } from "bun";
+
+const dir = new URL("..", import.meta.url).pathname;
+process.chdir(dir);
+
+const args = process.argv.slice(2).filter((a) => !a.startsWith("--"));
+const bumpType = args[0] || "patch";
+const dry = process.argv.includes("--dry-run");
+
+const log = (msg: string) => console.log(dry ? `[DRY RUN] ${msg}` : msg);
+
+// Read current version
+const currentPkg = await Bun.file("./package.json").json();
+log(`Current version: ${currentPkg.version}`);
+log(`Bumping ${bumpType}...`);
+
+// Bump version in package.json
+if (!dry) {
+  await $`npm version ${bumpType} --no-git-tag-version`;
+}
+
+// Read the new version
+const pkg = await Bun.file("./package.json").json();
+const version = pkg.version;
+
+log(`New version: ${version}`);
+
+// Commit and push — CI will handle npm publish
+if (!dry) {
+  await $`git add package.json`;
+  await $`git commit -m ${"chore: bump to " + version}`;
+  await $`git push`;
+}
+
+log(`Done!`);