@ex-machina/opencode-anthropic-auth 1.8.4 → 2.0.0-next.1

package/dist/auth.d.ts

@@ -14,3 +14,19 @@ export type ExchangeResult = {
     type: 'failed';
 };
 export declare function exchange(input: string, verifier: string, redirectUri: string, expectedState?: string): Promise<ExchangeResult>;
+export type RefreshResult = {
+    type: 'success';
+    refresh: string;
+    access: string;
+    expires: number;
+} | {
+    type: 'failed';
+    status: number;
+};
+/**
+ * Exchange a refresh token for a new access/refresh token pair.
+ * Retries transient (5xx, network) failures with exponential backoff;
+ * non-transient failures (e.g. 403 on a revoked/rotated-away token)
+ * are returned immediately as `{ type: 'failed' }`.
+ */
+export declare function refreshToken(refreshTokenValue: string): Promise<RefreshResult>;

package/dist/auth.js

@@ -1,5 +1,41 @@
 import { AUTHORIZE_URLS, CLIENT_ID, CODE_CALLBACK_URL, OAUTH_SCOPES, TOKEN_URL, } from "./constants.js";
 import { generatePKCE } from "./pkce.js";
+const REFRESH_TIMEOUT_MS = 30_000;
+function isTokenResponse(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    if (!('refresh_token' in value) || !('access_token' in value))
+        return false;
+    if (!('expires_in' in value))
+        return false;
+    return (typeof value.refresh_token === 'string' &&
+        value.refresh_token.length > 0 &&
+        typeof value.access_token === 'string' &&
+        value.access_token.length > 0 &&
+        typeof value.expires_in === 'number' &&
+        Number.isSafeInteger(value.expires_in) &&
+        value.expires_in > 0);
+}
+async function parseTokenResponse(response) {
+    try {
+        const value = await response.json();
+        if (!isTokenResponse(value))
+            return undefined;
+        const expires = Date.now() + value.expires_in * 1000;
+        if (!Number.isSafeInteger(expires))
+            return undefined;
+        return {
+            refresh: value.refresh_token,
+            access: value.access_token,
+            expires,
+        };
+    }
+    catch (error) {
+        if (error instanceof SyntaxError)
+            return undefined;
+        throw error;
+    }
+}
 function generateState() {
     return crypto.randomUUID().replace(/-/g, '');
 }
@@ -50,12 +86,12 @@ async function exchangeCode(callback, verifier, redirectUri) {
             type: 'failed',
         };
     }
-    const json = (await result.json());
+    const tokens = await parseTokenResponse(result);
+    if (!tokens)
+        return { type: 'failed' };
     return {
         type: 'success',
-        refresh: json.refresh_token,
-        access: json.access_token,
-        expires: Date.now() + json.expires_in * 1000,
+        ...tokens,
     };
 }
 export async function authorize(mode) {
@@ -91,3 +127,71 @@ export async function exchange(input, verifier, redirectUri, expectedState) {
     }
     return exchangeCode(callback, verifier, redirectUri);
 }
+/**
+ * Exchange a refresh token for a new access/refresh token pair.
+ * Retries transient (5xx, network) failures with exponential backoff;
+ * non-transient failures (e.g. 403 on a revoked/rotated-away token)
+ * are returned immediately as `{ type: 'failed' }`.
+ */
+export async function refreshToken(refreshTokenValue) {
+    const maxRetries = 2;
+    const baseDelayMs = 500;
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+        try {
+            if (attempt > 0) {
+                const delay = baseDelayMs * 2 ** (attempt - 1);
+                await new Promise((resolve) => setTimeout(resolve, delay));
+            }
+            const response = await fetch(TOKEN_URL, {
+                method: 'POST',
+                signal: AbortSignal.timeout(REFRESH_TIMEOUT_MS),
+                headers: {
+                    'Content-Type': 'application/json',
+                    Accept: 'application/json, text/plain, */*',
+                    'User-Agent': 'axios/1.13.6',
+                },
+                body: JSON.stringify({
+                    grant_type: 'refresh_token',
+                    refresh_token: refreshTokenValue,
+                    client_id: CLIENT_ID,
+                }),
+            });
+            if (!response.ok) {
+                if (response.status >= 500 && attempt < maxRetries) {
+                    await response.body?.cancel();
+                    continue;
+                }
+                await response.body?.cancel();
+                return { type: 'failed', status: response.status };
+            }
+            const tokens = await parseTokenResponse(response);
+            if (!tokens) {
+                return { type: 'failed', status: response.status };
+            }
+            return {
+                type: 'success',
+                ...tokens,
+            };
+        }
+        catch (error) {
+            const isNetworkError = (typeof error === 'object' &&
+                error !== null &&
+                'name' in error &&
+                (error.name === 'TimeoutError' || error.name === 'AbortError')) ||
+                (error instanceof Error &&
+                    (error.message.includes('fetch failed') ||
+                        ('code' in error &&
+                            (error.code === 'ECONNRESET' ||
+                                error.code === 'ECONNREFUSED' ||
+                                error.code === 'ETIMEDOUT' ||
+                                error.code === 'UND_ERR_CONNECT_TIMEOUT'))));
+            if (attempt < maxRetries && isNetworkError) {
+                continue;
+            }
+            throw error;
+        }
+    }
+    // Unreachable — each iteration either returns or throws.
+    // Kept as a TypeScript exhaustiveness guard.
+    throw new Error('Token refresh exhausted all retries');
+}

package/dist/config.d.ts

@@ -16,15 +16,15 @@ export declare const ANTHROPIC_CLAUDE_CODE_VERSION_ENV_VAR = "ANTHROPIC_CLAUDE_C
  * it with the warning explaining why reporting it is risky.
  */
 export type ClaudeCodeVersionResolution = {
-    type: 'success';
-    version: string;
+    readonly type: 'success';
+    readonly version: string;
 } | {
-    type: 'outdated';
-    version: string;
-    warning: string;
+    readonly type: 'outdated';
+    readonly version: string;
+    readonly warning: string;
 } | {
-    type: 'invalid';
-    error: string;
+    readonly type: 'invalid';
+    readonly error: string;
 };
 /**
  * Resolve the Claude Code version to report to Anthropic.

package/dist/config.js

@@ -8,8 +8,13 @@ import { CLAUDE_CODE_VERSION } from "./constants.js";
  * waiting for a published bump.
  */
 export const ANTHROPIC_CLAUDE_CODE_VERSION_ENV_VAR = 'ANTHROPIC_CLAUDE_CODE_VERSION';
-/** Claude Code releases are `major.minor.patch` with numeric components. */
-const VERSION_PATTERN = /^\d+\.\d+\.\d+$/;
+/**
+ * Claude Code releases are `major.minor.patch` with numeric components.
+ *
+ * Leading zeros are rejected: `02.1.258` is not a release Anthropic publishes,
+ * so accepting it would report a version string no server-side gate expects.
+ */
+const VERSION_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
 /**
  * Is `candidate` an older Claude Code release than `baseline`?
  *
@@ -52,8 +57,8 @@ export function resolveClaudeCodeVersion(raw = process.env[ANTHROPIC_CLAUDE_CODE
         return {
             type: 'invalid',
             error: `${ANTHROPIC_CLAUDE_CODE_VERSION_ENV_VAR} is set to ${JSON.stringify(raw)}, which is not a ` +
-                `Claude Code version. Expected major.minor.patch (e.g. ${CLAUDE_CODE_VERSION}). ` +
-                `Reporting the bundled version ${CLAUDE_CODE_VERSION} instead — correct or unset ` +
+                `Claude Code version. Expected major.minor.patch (for example, ${CLAUDE_CODE_VERSION}). ` +
+                `Reporting the bundled version ${CLAUDE_CODE_VERSION} instead; correct or unset ` +
                 `${ANTHROPIC_CLAUDE_CODE_VERSION_ENV_VAR} and restart OpenCode to use the override.`,
         };
     }

package/dist/index.d.ts

@@ -1,2 +1,3 @@
-import type { Plugin } from '@opencode-ai/plugin';
-export declare const AnthropicAuthPlugin: Plugin;
+import { Plugin } from '@opencode-ai/plugin';
+declare const _default: Plugin.Plugin;
+export default _default;

package/dist/index.js

@@ -1,210 +1,162 @@
-import { authorize, exchange } from "./auth.js";
+import { Plugin } from '@opencode-ai/plugin';
+import { authorize, exchange, refreshToken } from "./auth.js";
 import { resolveClaudeCodeVersion } from "./config.js";
-import { CLAUDE_CODE_VERSION, CLIENT_ID, TOKEN_URL } from "./constants.js";
+import { CLAUDE_CODE_VERSION, REQUIRED_BETAS } from "./constants.js";
 import { createStrippedStream, isInsecure, mergeHeaders, rewriteRequestBody, rewriteUrl, setOAuthHeaders, } from "./transform.js";
-/**
- * Report a problem with the version override to the server log.
- *
- * Best-effort: a misconfigured override either degrades to the bundled version
- * or is honoured as set, so a logging failure must not take the plugin down
- * with it.
- */
-async function logVersionOverrideIssue(client, level, message) {
-    try {
-        // biome-ignore lint/suspicious/noExplicitAny: SDK types don't expose app.log
-        await client?.app?.log({
-            body: {
-                service: 'anthropic-auth',
-                level,
-                message,
-            },
-        });
-    }
-    catch {
-        /* Logging is best-effort; the resolved version still applies. */
-    }
+const PLUGIN_ID = 'ex-machina.anthropic-auth';
+const INTEGRATION_ID = 'anthropic';
+const REFRESH_CACHE_GRACE_MS = 30_000;
+// `methodID` is a branded `Integration.MethodID` at the type level (a
+// compile-time-only tag — there's no runtime representation), so a plain
+// string literal needs a cast to satisfy the branded field.
+const METHOD_ID = 'claude-max';
+function toCredential(exchanged) {
+    return {
+        type: 'oauth',
+        methodID: METHOD_ID,
+        refresh: exchanged.refresh,
+        access: exchanged.access,
+        expires: exchanged.expires,
+    };
 }
-export const AnthropicAuthPlugin = async ({ client }) => {
-    // Resolved once per plugin instance so every request reports the same
-    // version in both the user-agent and the billing header.
-    const resolution = resolveClaudeCodeVersion();
-    if (resolution.type === 'invalid') {
-        await logVersionOverrideIssue(client, 'error', resolution.error);
-    }
-    else if (resolution.type === 'outdated') {
-        await logVersionOverrideIssue(client, 'warn', resolution.warning);
+async function resolveActiveOAuth(ctx) {
+    const connection = await ctx.integration.connection.active(INTEGRATION_ID);
+    if (!connection)
+        return undefined;
+    const credential = await ctx.integration.connection.resolve(connection);
+    if (credential?.type === 'oauth' && credential.methodID === METHOD_ID) {
+        return credential;
     }
-    // Only a malformed override lacks a usable version; an outdated one was set
-    // deliberately, so it is reported as configured.
-    const claudeCodeVersion = resolution.type === 'invalid' ? CLAUDE_CODE_VERSION : resolution.version;
-    return {
-        auth: {
-            provider: 'anthropic',
-            async loader(getAuth, provider) {
-                const auth = await getAuth();
-                if (auth.type === 'oauth') {
-                    // zero out cost for max plan
-                    for (const model of Object.values(provider.models)) {
-                        model.cost = {
-                            input: 0,
-                            output: 0,
-                            cache: {
-                                read: 0,
-                                write: 0,
-                            },
-                        };
+    return undefined;
+}
+function warnIfInsecureUnsupported() {
+    if (!isInsecure())
+        return;
+    console.warn('[ex-machina.anthropic-auth] ANTHROPIC_INSECURE is set, but OpenCode v2 ' +
+        'plugin request hooks cannot disable TLS verification for a custom ' +
+        'ANTHROPIC_BASE_URL endpoint. TLS verification remains enabled — ' +
+        'requests to an untrusted/self-signed endpoint will fail.');
+}
+function isTransformedOAuthRequest(request) {
+    const betas = new Set((request.headers.get('anthropic-beta') ?? '')
+        .split(',')
+        .map((beta) => beta.trim()));
+    return (request.headers.get('authorization')?.startsWith('Bearer ') === true &&
+        REQUIRED_BETAS.every((beta) => betas.has(beta)) &&
+        new URL(request.url).searchParams.get('beta') === 'true');
+}
+export default Plugin.define({
+    id: PLUGIN_ID,
+    setup: async (ctx) => {
+        warnIfInsecureUnsupported();
+        // Resolved once per plugin instance so every request reports the same
+        // version in both the user-agent and the billing header.
+        const versionResolution = resolveClaudeCodeVersion();
+        if (versionResolution.type === 'invalid') {
+            console.error(`[ex-machina.anthropic-auth] ${versionResolution.error}`);
+        }
+        else if (versionResolution.type === 'outdated') {
+            console.warn(`[ex-machina.anthropic-auth] ${versionResolution.warning}`);
+        }
+        // Only a malformed override lacks a usable version; an outdated one was
+        // set deliberately, so it is reported as configured.
+        const claudeCodeVersion = versionResolution.type === 'invalid'
+            ? CLAUDE_CODE_VERSION
+            : versionResolution.version;
+        // Retain successful refreshes for this plugin generation so a host call
+        // holding the rotated token cannot submit it again before persistence.
+        const refreshInFlight = new Map();
+        const refreshCredential = async (credential) => {
+            const existing = refreshInFlight.get(credential.refresh);
+            if (existing)
+                return existing;
+            const pending = (async () => {
+                const result = await refreshToken(credential.refresh);
+                if (result.type === 'failed') {
+                    throw new Error(`Anthropic token refresh failed: ${result.status}`);
+                }
+                return toCredential(result);
+            })();
+            refreshInFlight.set(credential.refresh, pending);
+            try {
+                const rotated = await pending;
+                const timer = setTimeout(() => {
+                    if (refreshInFlight.get(credential.refresh) === pending) {
+                        refreshInFlight.delete(credential.refresh);
                     }
-                    // Shared inflight refresh promise — prevents concurrent token refreshes
-                    // from racing against each other (and causing 401 cascades with token rotation)
-                    let refreshPromise = null;
+                }, REFRESH_CACHE_GRACE_MS);
+                timer.unref?.();
+                return rotated;
+            }
+            catch (error) {
+                if (refreshInFlight.get(credential.refresh) === pending) {
+                    refreshInFlight.delete(credential.refresh);
+                }
+                throw error;
+            }
+        };
+        await ctx.integration.transform((draft) => {
+            draft.method.update({
+                integrationID: INTEGRATION_ID,
+                method: {
+                    id: METHOD_ID,
+                    type: 'oauth',
+                    label: 'Claude Pro/Max',
+                },
+                authorize: async () => {
+                    const result = await authorize('max');
                     return {
-                        apiKey: '',
-                        async fetch(input, init) {
-                            const auth = await getAuth();
-                            if (auth.type !== 'oauth')
-                                return fetch(input, init);
-                            if (!auth.access || !auth.expires || auth.expires < Date.now()) {
-                                if (!refreshPromise) {
-                                    refreshPromise = (async () => {
-                                        const maxRetries = 2;
-                                        const baseDelayMs = 500;
-                                        for (let attempt = 0; attempt <= maxRetries; attempt++) {
-                                            try {
-                                                if (attempt > 0) {
-                                                    const delay = baseDelayMs * 2 ** (attempt - 1);
-                                                    await new Promise((resolve) => setTimeout(resolve, delay));
-                                                }
-                                                // Re-read auth to get the latest refresh token.
-                                                // The outer `auth` snapshot may be stale if tokens
-                                                // were rotated since the fetch() call was made.
-                                                const freshAuth = await getAuth();
-                                                const response = await fetch(TOKEN_URL, {
-                                                    method: 'POST',
-                                                    headers: {
-                                                        'Content-Type': 'application/json',
-                                                        Accept: 'application/json, text/plain, */*',
-                                                        'User-Agent': 'axios/1.13.6',
-                                                    },
-                                                    body: JSON.stringify({
-                                                        grant_type: 'refresh_token',
-                                                        refresh_token: freshAuth.refresh,
-                                                        client_id: CLIENT_ID,
-                                                    }),
-                                                });
-                                                if (!response.ok) {
-                                                    if (response.status >= 500 && attempt < maxRetries) {
-                                                        await response.body?.cancel();
-                                                        continue;
-                                                    }
-                                                    const body = await response.text().catch(() => '');
-                                                    throw new Error(`Token refresh failed: ${response.status} — ${body}`);
-                                                }
-                                                const json = (await response.json());
-                                                // biome-ignore lint/suspicious/noExplicitAny: SDK types don't expose auth.set
-                                                await client.auth.set({
-                                                    path: {
-                                                        id: 'anthropic',
-                                                    },
-                                                    body: {
-                                                        type: 'oauth',
-                                                        refresh: json.refresh_token,
-                                                        access: json.access_token,
-                                                        expires: Date.now() + json.expires_in * 1000,
-                                                    },
-                                                });
-                                                return json.access_token;
-                                            }
-                                            catch (error) {
-                                                const isNetworkError = error instanceof Error &&
-                                                    (error.message.includes('fetch failed') ||
-                                                        ('code' in error &&
-                                                            (error.code === 'ECONNRESET' ||
-                                                                error.code === 'ECONNREFUSED' ||
-                                                                error.code === 'ETIMEDOUT' ||
-                                                                error.code === 'UND_ERR_CONNECT_TIMEOUT')));
-                                                if (attempt < maxRetries && isNetworkError) {
-                                                    continue;
-                                                }
-                                                throw error;
-                                            }
-                                        }
-                                        // Unreachable — each iteration either returns or throws.
-                                        // Kept as a TypeScript exhaustiveness guard.
-                                        throw new Error('Token refresh exhausted all retries');
-                                    })().finally(() => {
-                                        refreshPromise = null;
-                                    });
-                                }
-                                auth.access = await refreshPromise;
+                        url: result.url,
+                        instructions: 'Paste the authorization code here:',
+                        mode: 'code',
+                        callback: async (code) => {
+                            const exchanged = await exchange(code, result.verifier, result.redirectUri, result.state);
+                            if (exchanged.type === 'failed') {
+                                throw new Error('Failed to exchange the Claude Pro/Max authorization code. ' +
+                                    'Double-check that you pasted the full code and try again.');
                             }
-                            const requestHeaders = mergeHeaders(input, init);
-                            // biome-ignore lint/style/noNonNullAssertion: access is guaranteed set above
-                            setOAuthHeaders(requestHeaders, auth.access, claudeCodeVersion);
-                            let body = init?.body;
-                            if (body && typeof body === 'string') {
-                                body = rewriteRequestBody(body, claudeCodeVersion);
-                            }
-                            const rewritten = rewriteUrl(input);
-                            const response = await fetch(rewritten.input, {
-                                ...init,
-                                body,
-                                headers: requestHeaders,
-                                ...(isInsecure() && { tls: { rejectUnauthorized: false } }),
-                            });
-                            return createStrippedStream(response);
+                            return toCredential(exchanged);
                         },
                     };
-                }
-                return {};
-            },
-            methods: [
-                {
-                    label: 'Claude Pro/Max',
-                    type: 'oauth',
-                    authorize: async () => {
-                        const result = await authorize('max');
-                        return {
-                            url: result.url,
-                            instructions: 'Paste the authorization code here:',
-                            method: 'code',
-                            callback: async (code) => {
-                                return exchange(code, result.verifier, result.redirectUri, result.state);
-                            },
-                        };
-                    },
                 },
-                {
-                    label: 'Create an API Key',
-                    type: 'oauth',
-                    authorize: async () => {
-                        const result = await authorize('console');
-                        return {
-                            url: result.url,
-                            instructions: 'Paste the authorization code here:',
-                            method: 'code',
-                            callback: async (code) => {
-                                const credentials = await exchange(code, result.verifier, result.redirectUri, result.state);
-                                if (credentials.type === 'failed')
-                                    return credentials;
-                                const apiKey = await fetch(`https://api.anthropic.com/api/oauth/claude_cli/create_api_key`, {
-                                    method: 'POST',
-                                    headers: {
-                                        'Content-Type': 'application/json',
-                                        authorization: `Bearer ${credentials.access}`,
-                                    },
-                                }).then((r) => r.json());
-                                return { type: 'success', key: apiKey.raw_key };
-                            },
-                        };
-                    },
-                },
-                {
-                    provider: 'anthropic',
-                    label: 'Manually enter API Key',
-                    type: 'api',
-                },
-            ],
-        },
-        // biome-ignore lint/suspicious/noExplicitAny: Plugin type doesn't include undocumented auth/hooks
-    };
-};
+                refresh: refreshCredential,
+            });
+        });
+        await ctx.session.hook('http.request', async (event) => {
+            if (event.model.providerID !== INTEGRATION_ID)
+                return;
+            const credential = await resolveActiveOAuth(ctx);
+            if (!credential)
+                return;
+            const request = event.request;
+            const hasBody = request.method !== 'GET' && request.method !== 'HEAD';
+            const bodyText = hasBody ? await request.clone().text() : undefined;
+            const rewrittenBody = bodyText !== undefined
+                ? rewriteRequestBody(bodyText, claudeCodeVersion)
+                : undefined;
+            const headers = mergeHeaders(request);
+            setOAuthHeaders(headers, credential.access, claudeCodeVersion);
+            if (rewrittenBody !== undefined)
+                headers.delete('content-length');
+            const { input: rewrittenInput } = rewriteUrl(request.url);
+            const url = typeof rewrittenInput === 'string'
+                ? rewrittenInput
+                : rewrittenInput instanceof Request
+                    ? rewrittenInput.url
+                    : rewrittenInput.toString();
+            event.request = new Request(url, {
+                method: request.method,
+                headers,
+                body: rewrittenBody,
+                signal: request.signal,
+            });
+        });
+        await ctx.session.hook('http.response', (event) => {
+            if (event.model.providerID !== INTEGRATION_ID)
+                return;
+            if (!isTransformedOAuthRequest(event.request))
+                return;
+            event.response = createStrippedStream(event.response);
+        });
+    },
+});

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@ex-machina/opencode-anthropic-auth",
-  "version": "1.8.4",
+  "version": "2.0.0-next.1",
+  "type": "module",
   "repository": {
     "type": "git",
     "url": "https://github.com/ex-machina-co/opencode-anthropic-auth"
@@ -23,20 +24,21 @@
     "check": "bun turbo check:all",
     "test": "bun test",
     "types": "tsc",
+    "check:package": "bun run build && bun scripts/check-package.ts",
     "format": "biome check --write --unsafe",
     "format:check": "biome format .",
     "lint": "biome lint --error-on-warnings .",
     "change": "changeset",
-    "release": "bun run build && bun change publish"
+    "release": "bun run build && bun change publish",
+    "release:next": "bun scripts/validate-next-release.ts && bun run release"
   },
-  "peerDependencies": {
-    "@opencode-ai/plugin": "*"
+  "dependencies": {
+    "@opencode-ai/plugin": "0.0.0-next-17444"
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.2",
     "@changesets/changelog-github": "^0.7.0",
     "@changesets/cli": "^2.31.0",
-    "@opencode-ai/plugin": "1.17.13",
     "@tsconfig/bun": "1.0.10",
     "@types/bun": "1.3.14",
     "dedent": "^1.7.2",