@ex-machina/opencode-anthropic-auth 1.1.0 → 1.1.2

package/README.md

@@ -12,6 +12,19 @@ Add the plugin to your OpenCode configuration:
 }
 ```
 
+> [!TIP]
+> It is STRONGLY advised that you pin the plugin to a version. This will keep you from getting automatic updates; however, this will protect you from nefarious updates.
+>
+> This holds true for ANY OpenCode plugin. If you do not pin them, OpenCode will automatically update them on startup. It's a massive vulnerability waiting to happen.
+
+#### Example of pinned version
+
+```json
+{
+  "plugin": ["@ex-machina/opencode-anthropic-auth@1.1.1"]
+}
+```
+
 ## Authentication Methods
 
 The plugin provides three authentication options:

package/dist/constants.d.ts

@@ -8,3 +8,4 @@ export declare const TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
 export declare const OAUTH_SCOPES: string[];
 export declare const TOOL_PREFIX = "mcp_";
 export declare const REQUIRED_BETAS: string[];
+export declare const USER_AGENT = "claude-cli/2.1.2 (external, cli)";

package/dist/constants.js

@@ -18,3 +18,4 @@ export const REQUIRED_BETAS = [
     'oauth-2025-04-20',
     'interleaved-thinking-2025-05-14',
 ];
+export const USER_AGENT = 'claude-cli/2.1.2 (external, cli)';

package/dist/index.js

@@ -65,7 +65,8 @@ export const AnthropicAuthPlugin = async ({ client }) => {
                                                         await response.body?.cancel();
                                                         continue;
                                                     }
-                                                    throw new Error(`Token refresh failed: ${response.status}`);
+                                                    const body = await response.text().catch(() => '');
+                                                    throw new Error(`Token refresh failed: ${response.status} — ${body}`);
                                                 }
                                                 const json = (await response.json());
                                                 // biome-ignore lint/suspicious/noExplicitAny: SDK types don't expose auth.set

package/dist/transform.js

@@ -1,4 +1,4 @@
-import { REQUIRED_BETAS, TOOL_PREFIX } from './constants';
+import { REQUIRED_BETAS, TOOL_PREFIX, USER_AGENT } from './constants';
 /**
  * Merge headers from a Request object and/or a RequestInit headers value
  * into a single Headers instance.
@@ -53,7 +53,7 @@ export function mergeBetaHeaders(headers) {
 export function setOAuthHeaders(headers, accessToken) {
     headers.set('authorization', `Bearer ${accessToken}`);
     headers.set('anthropic-beta', mergeBetaHeaders(headers));
-    headers.set('user-agent', 'claude-cli/2.1.2 (external, cli)');
+    headers.set('user-agent', USER_AGENT);
     headers.delete('x-api-key');
     return headers;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ex-machina/opencode-anthropic-auth",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "repository": {
     "type": "git",
     "url": "https://github.com/ex-machina-co/opencode-anthropic-auth"
@@ -11,6 +11,7 @@
     "dist"
   ],
   "scripts": {
+    "prepare": "tsc -p tsconfig.build.json",
     "build": "tsc -p tsconfig.build.json",
     "test": "bun test",
     "types": "tsc",