@ex-machina/opencode-anthropic-auth 2.0.0-next.0 → 2.0.0-next.1

package/README.md

@@ -1,80 +1,137 @@
 # OpenCode Anthropic Auth Plugin
 
+[![OpenCode v1 — npm latest tag](https://img.shields.io/npm/v/%40ex-machina%2Fopencode-anthropic-auth/latest?label=OpenCode%20v1%20(latest))](https://www.npmjs.com/package/@ex-machina/opencode-anthropic-auth?activeTab=versions)
+[![OpenCode v2 — npm next tag](https://img.shields.io/npm/v/%40ex-machina%2Fopencode-anthropic-auth/next?label=OpenCode%20v2%20(next))](https://www.npmjs.com/package/@ex-machina/opencode-anthropic-auth?activeTab=versions)
+
 > [!WARNING]
 > This plugin comes with no guarantees. You might be banned for breaking the TOS, you might not be. I don't work at Anthropic, nor am I an attorney.
 >
 > Use your best judgment and don't try to abuse the subscriptions. Plugins like oh-my-openagent are _known_ to trigger bans. Please be careful when using Ralph loops or insanely heavy usage patterns.
 
 > [!IMPORTANT]
-> If you are seeing issues, please try to `rm -rf ~/.cache/opencode/packages/@ex-machina` and check your `opencode.json` config to make sure you're on the latest version.
+> If you are seeing issues, try `rm -rf ~/.cache/opencode/packages/@ex-machina` and confirm that your `opencode.json` uses the plugin release line for your OpenCode version.
 >
 > Try this FIRST before making an Issue. Thanks!
 
 An [OpenCode](https://github.com/anomalyco/opencode) plugin that provides Anthropic OAuth authentication, enabling Claude Pro/Max users to use their subscription directly with OpenCode.
 
-## Version compatibility
+> [!NOTE]
+> This repository uses [Agent Facets](https://agentfacets.io) to manage agent capabilities. See the [quickstart](https://docs.agentfacets.io/quickstart) to install the CLI and get started.
+
+## Version support
 
-| Plugin version | OpenCode version | Package                                     |
-|-----------------|-------------------|---------------------------------------------|
-| 2.x (this readme) | OpenCode v2 (beta plugin API) | `@ex-machina/opencode-anthropic-auth` |
-| 1.x               | OpenCode v1       | `@ex-machina/opencode-anthropic-auth@1` |
+| OpenCode version | Plugin release | Support branch | npm dist-tag | Configuration key |
+|------------------|----------------|----------------|--------------|-------------------|
+| OpenCode v1 | 1.x | [`main`](https://github.com/ex-machina-co/opencode-anthropic-auth/tree/main) | `latest` | `plugin` |
+| OpenCode v2 | 2.x prereleases | [`v2/main`](https://github.com/ex-machina-co/opencode-anthropic-auth/tree/v2/main) | `next` | `plugins` |
 
-OpenCode v2's plugin API is still beta, and this plugin currently targets the `@opencode-ai/plugin@0.0.0-next-17444` prerelease of it — pin the plugin version and keep an eye on the changelog when bumping either side. If you're still on OpenCode v1, keep using a `1.x` release; v1 plugins are **not** loadable by OpenCode v2, and this v2 port is not loadable by OpenCode v1.
+Both release lines use the same npm package. They are not cross-compatible: the v1 plugin does not load in OpenCode v2, and the v2 plugin does not load in OpenCode v1. OpenCode v2's plugin API is still beta, so review the changelog before upgrading either side.
 
 ## Usage
 
-Add the plugin to your OpenCode configuration:
+> [!TIP]
+> Pin an exact plugin version for a stable setup that changes only when you choose to upgrade. If you intentionally want automatic updates, use the moving npm tag for your OpenCode release line.
+>
+> This applies to every OpenCode plugin: an unpinned or moving-tag dependency can install new code on startup, so only track automatic updates from publishers you trust.
+
+### OpenCode v1 (`latest`)
+
+OpenCode v1 uses the singular `plugin` configuration key. A bare package spec tracks npm's `latest` tag:
 
 ```json
 {
-  "plugins": ["@ex-machina/opencode-anthropic-auth"]
+  "plugin": ["@ex-machina/opencode-anthropic-auth"]
 }
 ```
 
-> [!TIP]
-> It is STRONGLY advised that you pin the plugin to a version. This will keep you from getting automatic updates; however, this will protect you from nefarious updates.
->
-> This holds true for ANY OpenCode plugin. If you do not pin them, OpenCode will automatically update them on startup. It's a massive vulnerability waiting to happen.
+You can also write the moving tag explicitly as `@ex-machina/opencode-anthropic-auth@latest`.
 
-#### Example of pinned version
+For a stable setup, look up the exact version currently published on `latest`:
+
+```bash
+npm view @ex-machina/opencode-anthropic-auth dist-tags.latest
+```
+
+Substitute the command output for `<version>`:
+
+```json
+{
+  "plugin": ["@ex-machina/opencode-anthropic-auth@<version>"]
+}
+```
+
+### OpenCode v2 (`next`)
+
+OpenCode v2 uses the plural `plugins` configuration key. Because npm's default tag points to the v1 line, specify `@next` if you want to track the newest v2 prerelease:
 
 ```json
 {
-  "plugins": ["@ex-machina/opencode-anthropic-auth@<2.x.y-next.N>"]
+  "plugins": ["@ex-machina/opencode-anthropic-auth@next"]
 }
 ```
 
-The v2 line ships as prereleases on npm's `next` tag, so substitute a version that actually exists — `npm view @ex-machina/opencode-anthropic-auth dist-tags` shows the current one. Pin that exact version rather than tracking `@next`, which moves on every prerelease publish.
+For a stable setup, look up the exact version currently published on `next`:
+
+```bash
+npm view @ex-machina/opencode-anthropic-auth dist-tags.next
+```
+
+Substitute the command output for `<version>`:
+
+```json
+{
+  "plugins": ["@ex-machina/opencode-anthropic-auth@<version>"]
+}
+```
 
 ## Authentication Methods
 
-- **Claude Pro/Max** - OAuth flow via `claude.ai` for Pro/Max subscribers. Uses your existing subscription at no additional API cost.
-    - run the `/connect` command, select `Anthropic` -> `Claude Pro/Max` and do OAuth
-- **Manually enter API Key / `ANTHROPIC_API_KEY`** - Handled by OpenCode's built-in Anthropic integration, not by this plugin.
+### OpenCode v1
+
+OpenCode v1 provides three authentication options:
+
+- **Claude Pro/Max** — OAuth flow via `claude.ai` for Pro/Max subscribers. Uses your existing subscription at no additional API cost.
+    - Run `/connect`, select `Anthropic (API key)` -> `Claude Pro/Max`, and complete OAuth.
+- **Create an API Key** — OAuth flow via `console.anthropic.com` that creates an API key on your behalf.
+- **Manually enter API Key** — Standard API-key entry for users who already have one.
+
+### OpenCode v2
+
+OpenCode v2 provides:
+
+- **Claude Pro/Max** — OAuth flow via `claude.ai` for Pro/Max subscribers. Uses your existing subscription at no additional API cost.
+    - Run `/connect`, select `Anthropic` -> `Claude Pro/Max`, and complete OAuth.
+- **Manually enter API Key / `ANTHROPIC_API_KEY`** — Handled by OpenCode's built-in Anthropic integration, not by this plugin.
 
 > [!NOTE]
-> The v1 release of this plugin also offered a "Create an API Key" OAuth flow (via `console.anthropic.com`) that minted and stored an API key for you. OpenCode v2's plugin API does not yet support an OAuth authorization flow that ends in a stored API key, so that flow isn't available in this v2 release. Use manual API key entry (or `ANTHROPIC_API_KEY`) in the meantime — see [issue #203](https://github.com/ex-machina-co/opencode-anthropic-auth/issues/203) for status.
->
-> OpenCode v2 continues to display Anthropic's API prices for these models even though requests authenticated through Claude Pro/Max use the subscription. Dynamic cost display is deferred until the beta plugin API can safely cancel the required connection event subscription.
+> OpenCode v1 also offers a "Create an API Key" OAuth flow that mints and stores an API key. OpenCode v2's plugin API cannot yet complete an OAuth flow by storing a generated API key, so that option is unavailable in v2. Use manual API-key entry or `ANTHROPIC_API_KEY` in the meantime; see [issue #203](https://github.com/ex-machina-co/opencode-anthropic-auth/issues/203) for status.
 
 ## Configuration
 
-The plugin supports the following environment variables:
+The plugin reads the following environment variables:
+
+- **`ANTHROPIC_BASE_URL`** — Overrides the Anthropic API endpoint for both release lines, such as when using a proxy. Must be a valid HTTP(S) URL.
+- **`ANTHROPIC_INSECURE`** — Skips TLS certificate verification. Behavior differs by OpenCode version:
+    - **OpenCode v1** — Set to `1` or `true` to skip verification. Only effective when `ANTHROPIC_BASE_URL` is also set.
+    - **OpenCode v2** — Not supported. OpenCode v2 plugin request hooks cannot disable TLS verification. If set, the plugin logs a warning and leaves verification enabled; requests to an untrusted or self-signed `ANTHROPIC_BASE_URL` will fail.
+- **`ANTHROPIC_CLAUDE_CODE_VERSION`** — Overrides the Claude Code version reported to Anthropic for both release lines. Must be `major.minor.patch` (for example, `2.1.258`). Defaults to the bundled version; a malformed value is logged and the bundled version is used instead. A value older than the bundled version is honored but logs a warning, since reporting an older version can make newer models reject the request. Read once when the plugin loads, so restart OpenCode after changing it.
 
-| Variable                          | Description                                                                                                                                                                                 |
-|-----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `ANTHROPIC_BASE_URL`              | Override the API endpoint URL (e.g. for proxying). Must be a valid HTTP(S) URL.                                                                                                             |
-| `ANTHROPIC_INSECURE`              | **Not supported under OpenCode v2.** OpenCode v2 plugin request hooks can rewrite a request but cannot disable TLS verification for it. If this is set, the plugin logs a warning and leaves TLS verification enabled — requests to a self-signed/untrusted `ANTHROPIC_BASE_URL` will fail. |
+Anthropic gates model access on the reported Claude Code version server-side, returning a 400 `claude_code_version_too_old` error for models that require a newer client. `ANTHROPIC_CLAUDE_CODE_VERSION` lets you raise the reported version without waiting for a plugin release.
 
 ## How It Works
 
-For Claude Pro/Max authentication, the plugin:
+For Claude Pro/Max authentication, both release lines:
 
-1. Initiates a PKCE OAuth flow against Anthropic's authorization endpoint
-2. Exchanges the authorization code for access and refresh tokens
-3. Automatically refreshes expired tokens
-4. Injects the required OAuth headers and beta flags into API requests
-5. Sanitizes the system prompt for compatibility (see below)
+1. Initiate a PKCE OAuth flow against Anthropic's authorization endpoint
+2. Exchange the authorization code for access and refresh tokens
+3. Automatically refresh expired tokens
+4. Inject the required OAuth headers and beta flags into API requests
+5. Sanitize the system prompt for compatibility (see below)
+
+Model-cost display differs by OpenCode version:
+
+- **OpenCode v1** — The plugin zeros out displayed model costs because usage is covered by the subscription.
+- **OpenCode v2** — OpenCode continues to display Anthropic's API prices even though requests authenticated through Claude Pro/Max use the subscription. Dynamic cost display is deferred until the beta plugin API can safely cancel the required connection event subscription.
 
 ### System Prompt Sanitization
 
@@ -102,9 +159,14 @@ This does three things:
 2. Symlinks the build output into `.opencode/plugins/` so OpenCode loads it as a local plugin
 3. Starts `tsc --watch` for automatic rebuilds on source changes
 
-After starting the dev script, restart OpenCode v2 (`opencode2`) in this project directory to pick up the local build. Any edits to `src/` will trigger a rebuild — restart OpenCode again to load the new version.
+After starting the dev script:
+
+- On the `main` branch, restart OpenCode in this project directory.
+- On the `v2/main` branch, restart OpenCode v2 (`opencode2`) in this project directory.
 
-You can confirm the plugin loaded correctly via the OpenCode v2 API:
+Edits to `src/` trigger a rebuild; restart the corresponding OpenCode version again to load the new build.
+
+You can confirm that the v2 plugin loaded through the OpenCode v2 API:
 
 ```bash
 opencode2 api get /api/plugin        # should list "ex-machina.anthropic-auth"
@@ -128,9 +190,12 @@ This project uses [changesets](https://github.com/changesets/changesets) for ver
 bun change          # create a changeset describing your changes
 ```
 
-Changesets merged to a release branch cause CI to open a release PR; merging that PR publishes to npm. This repository runs two release trains — `main` publishes the v1 line to npm's `latest`, and `v2/main` publishes the v2 line to `next` as `2.x.y-next.N` prereleases.
+Changesets merged to a release branch cause CI to open a release PR; merging that PR publishes to npm. The repository has two release trains:
+
+- `main` publishes plugin v1 for OpenCode v1 to npm's `latest` tag.
+- `v2/main` publishes plugin v2 prereleases for OpenCode v2 to npm's `next` tag.
 
-Maintainers: see [RELEASING.md](RELEASING.md) for the full runbook, including how `main` is synced into `v2/main`.
+Maintainers can find the complete two-train release and branch-sync process in the [release runbook](https://github.com/ex-machina-co/opencode-anthropic-auth/blob/v2/main/RELEASING.md).
 
 ## License
 

package/dist/config.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Environment variable that overrides the reported Claude Code version.
+ *
+ * Anthropic gates model access on the reported version server-side, and that
+ * gate moves on Anthropic's schedule rather than this plugin's release
+ * schedule. The override lets users unblock a newly-gated model without
+ * waiting for a published bump.
+ */
+export declare const ANTHROPIC_CLAUDE_CODE_VERSION_ENV_VAR = "ANTHROPIC_CLAUDE_CODE_VERSION";
+/**
+ * Outcome of reading the version override.
+ *
+ * The invalid arm carries no version: a malformed override must never reach
+ * the request path, so callers cannot accidentally report one. The outdated
+ * arm does carry one — an explicit older version is still honoured — but pairs
+ * it with the warning explaining why reporting it is risky.
+ */
+export type ClaudeCodeVersionResolution = {
+    readonly type: 'success';
+    readonly version: string;
+} | {
+    readonly type: 'outdated';
+    readonly version: string;
+    readonly warning: string;
+} | {
+    readonly type: 'invalid';
+    readonly error: string;
+};
+/**
+ * Resolve the Claude Code version to report to Anthropic.
+ *
+ * Returns the bundled version when the override is unset. A set override is
+ * trimmed and must look like a Claude Code release; anything else resolves to
+ * `invalid` with a message describing how to correct it. An override older
+ * than the bundled version resolves to `outdated`: it is still reported, since
+ * it was set deliberately, but it can lock the user out of newer models.
+ * Never throws.
+ */
+export declare function resolveClaudeCodeVersion(raw?: string | undefined): ClaudeCodeVersionResolution;

package/dist/config.js

@@ -0,0 +1,77 @@
+import { CLAUDE_CODE_VERSION } from "./constants.js";
+/**
+ * Environment variable that overrides the reported Claude Code version.
+ *
+ * Anthropic gates model access on the reported version server-side, and that
+ * gate moves on Anthropic's schedule rather than this plugin's release
+ * schedule. The override lets users unblock a newly-gated model without
+ * waiting for a published bump.
+ */
+export const ANTHROPIC_CLAUDE_CODE_VERSION_ENV_VAR = 'ANTHROPIC_CLAUDE_CODE_VERSION';
+/**
+ * Claude Code releases are `major.minor.patch` with numeric components.
+ *
+ * Leading zeros are rejected: `02.1.258` is not a release Anthropic publishes,
+ * so accepting it would report a version string no server-side gate expects.
+ */
+const VERSION_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+/**
+ * Is `candidate` an older Claude Code release than `baseline`?
+ *
+ * Both arguments must already match `VERSION_PATTERN`. Components are compared
+ * numerically rather than lexically — `2.1.99` sorts after `2.1.258` as a
+ * string but is the older release — and as `BigInt`, so an unbounded component
+ * cannot silently lose precision the way `Number` would.
+ */
+function isOlderVersion(candidate, baseline) {
+    // The `0n` defaults are unreachable — `VERSION_PATTERN` guarantees exactly
+    // three components — but they keep the destructuring free of assertions.
+    const [major = 0n, minor = 0n, patch = 0n] = candidate
+        .split('.')
+        .map((part) => BigInt(part));
+    const [baseMajor = 0n, baseMinor = 0n, basePatch = 0n] = baseline
+        .split('.')
+        .map((part) => BigInt(part));
+    if (major !== baseMajor)
+        return major < baseMajor;
+    if (minor !== baseMinor)
+        return minor < baseMinor;
+    return patch < basePatch;
+}
+/**
+ * Resolve the Claude Code version to report to Anthropic.
+ *
+ * Returns the bundled version when the override is unset. A set override is
+ * trimmed and must look like a Claude Code release; anything else resolves to
+ * `invalid` with a message describing how to correct it. An override older
+ * than the bundled version resolves to `outdated`: it is still reported, since
+ * it was set deliberately, but it can lock the user out of newer models.
+ * Never throws.
+ */
+export function resolveClaudeCodeVersion(raw = process.env[ANTHROPIC_CLAUDE_CODE_VERSION_ENV_VAR]) {
+    if (raw === undefined) {
+        return { type: 'success', version: CLAUDE_CODE_VERSION };
+    }
+    const trimmed = raw.trim();
+    if (!VERSION_PATTERN.test(trimmed)) {
+        return {
+            type: 'invalid',
+            error: `${ANTHROPIC_CLAUDE_CODE_VERSION_ENV_VAR} is set to ${JSON.stringify(raw)}, which is not a ` +
+                `Claude Code version. Expected major.minor.patch (for example, ${CLAUDE_CODE_VERSION}). ` +
+                `Reporting the bundled version ${CLAUDE_CODE_VERSION} instead; correct or unset ` +
+                `${ANTHROPIC_CLAUDE_CODE_VERSION_ENV_VAR} and restart OpenCode to use the override.`,
+        };
+    }
+    if (isOlderVersion(trimmed, CLAUDE_CODE_VERSION)) {
+        return {
+            type: 'outdated',
+            version: trimmed,
+            warning: `${ANTHROPIC_CLAUDE_CODE_VERSION_ENV_VAR} is set to ${JSON.stringify(trimmed)}, which is older ` +
+                `than the bundled Claude Code version ${CLAUDE_CODE_VERSION}. Anthropic gates model access on ` +
+                `the reported version, so reporting an older one can make newer models reject the request. ` +
+                `Set ${ANTHROPIC_CLAUDE_CODE_VERSION_ENV_VAR} to ${CLAUDE_CODE_VERSION} or newer — or unset it ` +
+                `to use the bundled version — and restart OpenCode.`,
+        };
+    }
+    return { type: 'success', version: trimmed };
+}

package/dist/constants.d.ts

@@ -24,7 +24,15 @@ export declare const CCH_POSITIONS: number[];
  */
 export declare const CLAUDE_CODE_VERSION = "2.1.258";
 export declare const CLAUDE_CODE_ENTRYPOINT = "sdk-cli";
-export declare const USER_AGENT = "claude-cli/2.1.258 (external, cli)";
+/**
+ * Build the `user-agent` value for a reported Claude Code version.
+ *
+ * Both places we report the version (this header and the billing header's
+ * `cc_version`) must agree, so callers pass the same resolved version to each
+ * rather than reading a second, independently-derived constant.
+ */
+export declare function formatUserAgent(version: string): string;
+export declare const USER_AGENT: string;
 /**
  * Anchors that identify paragraphs to remove from the system prompt.
  * Any paragraph (text between blank lines) containing one of these

package/dist/constants.js

@@ -34,7 +34,17 @@ export const CCH_POSITIONS = [4, 7, 20];
  */
 export const CLAUDE_CODE_VERSION = '2.1.258';
 export const CLAUDE_CODE_ENTRYPOINT = 'sdk-cli';
-export const USER_AGENT = `claude-cli/${CLAUDE_CODE_VERSION} (external, cli)`;
+/**
+ * Build the `user-agent` value for a reported Claude Code version.
+ *
+ * Both places we report the version (this header and the billing header's
+ * `cc_version`) must agree, so callers pass the same resolved version to each
+ * rather than reading a second, independently-derived constant.
+ */
+export function formatUserAgent(version) {
+    return `claude-cli/${version} (external, cli)`;
+}
+export const USER_AGENT = formatUserAgent(CLAUDE_CODE_VERSION);
 /**
  * Anchors that identify paragraphs to remove from the system prompt.
  * Any paragraph (text between blank lines) containing one of these

package/dist/index.js

@@ -1,6 +1,7 @@
 import { Plugin } from '@opencode-ai/plugin';
 import { authorize, exchange, refreshToken } from "./auth.js";
-import { REQUIRED_BETAS } from "./constants.js";
+import { resolveClaudeCodeVersion } from "./config.js";
+import { CLAUDE_CODE_VERSION, REQUIRED_BETAS } from "./constants.js";
 import { createStrippedStream, isInsecure, mergeHeaders, rewriteRequestBody, rewriteUrl, setOAuthHeaders, } from "./transform.js";
 const PLUGIN_ID = 'ex-machina.anthropic-auth';
 const INTEGRATION_ID = 'anthropic';
@@ -48,6 +49,20 @@ export default Plugin.define({
     id: PLUGIN_ID,
     setup: async (ctx) => {
         warnIfInsecureUnsupported();
+        // Resolved once per plugin instance so every request reports the same
+        // version in both the user-agent and the billing header.
+        const versionResolution = resolveClaudeCodeVersion();
+        if (versionResolution.type === 'invalid') {
+            console.error(`[ex-machina.anthropic-auth] ${versionResolution.error}`);
+        }
+        else if (versionResolution.type === 'outdated') {
+            console.warn(`[ex-machina.anthropic-auth] ${versionResolution.warning}`);
+        }
+        // Only a malformed override lacks a usable version; an outdated one was
+        // set deliberately, so it is reported as configured.
+        const claudeCodeVersion = versionResolution.type === 'invalid'
+            ? CLAUDE_CODE_VERSION
+            : versionResolution.version;
         // Retain successful refreshes for this plugin generation so a host call
         // holding the rotated token cannot submit it again before persistence.
         const refreshInFlight = new Map();
@@ -116,9 +131,11 @@ export default Plugin.define({
             const request = event.request;
             const hasBody = request.method !== 'GET' && request.method !== 'HEAD';
             const bodyText = hasBody ? await request.clone().text() : undefined;
-            const rewrittenBody = bodyText !== undefined ? rewriteRequestBody(bodyText) : undefined;
+            const rewrittenBody = bodyText !== undefined
+                ? rewriteRequestBody(bodyText, claudeCodeVersion)
+                : undefined;
             const headers = mergeHeaders(request);
-            setOAuthHeaders(headers, credential.access);
+            setOAuthHeaders(headers, credential.access, claudeCodeVersion);
             if (rewrittenBody !== undefined)
                 headers.delete('content-length');
             const { input: rewrittenInput } = rewriteUrl(request.url);

package/dist/transform.d.ts

@@ -13,8 +13,11 @@ export declare function mergeBetaHeaders(headers: Headers): string;
 /**
  * Set OAuth-required headers on the request: authorization, beta, user-agent.
  * Removes x-api-key since we're using OAuth.
+ *
+ * `version` must be the same value passed to rewriteRequestBody for the same
+ * request, otherwise the two reported versions disagree.
  */
-export declare function setOAuthHeaders(headers: Headers, accessToken: string): Headers;
+export declare function setOAuthHeaders(headers: Headers, accessToken: string, version?: string): Headers;
 /**
  * Add TOOL_PREFIX to tool names in the request body.
  * Prefixes both tool definitions and tool_use blocks in messages.
@@ -66,8 +69,11 @@ type SystemBlock = {
 export declare function prependClaudeCodeIdentity(system: unknown): SystemBlock[];
 /**
  * Rewrite the full request body: sanitize system prompt and prefix tool names.
+ *
+ * `version` must be the same value passed to setOAuthHeaders for the same
+ * request, otherwise the two reported versions disagree.
  */
-export declare function rewriteRequestBody(body: string): string;
+export declare function rewriteRequestBody(body: string, version?: string): string;
 /**
  * Create a streaming response that strips the tool prefix from tool names.
  */

package/dist/transform.js

@@ -1,5 +1,5 @@
 import { buildBillingHeaderValue } from "./cch.js";
-import { CLAUDE_CODE_ENTRYPOINT, CLAUDE_CODE_IDENTITY, OPENCODE_IDENTITY_PREFIX, PARAGRAPH_REMOVAL_ANCHORS, REQUIRED_BETAS, TEXT_REPLACEMENTS, TOOL_PREFIX, USER_AGENT, } from "./constants.js";
+import { CLAUDE_CODE_ENTRYPOINT, CLAUDE_CODE_IDENTITY, CLAUDE_CODE_VERSION, formatUserAgent, OPENCODE_IDENTITY_PREFIX, PARAGRAPH_REMOVAL_ANCHORS, REQUIRED_BETAS, TEXT_REPLACEMENTS, TOOL_PREFIX, } from "./constants.js";
 // Bound an incomplete SSE line so malformed streams cannot grow memory forever.
 export const MAX_SSE_LINE_BYTES = 5 * 1024 * 1024;
 function headersAfterBodyTransform(source) {
@@ -271,11 +271,14 @@ export function mergeBetaHeaders(headers) {
 /**
  * Set OAuth-required headers on the request: authorization, beta, user-agent.
  * Removes x-api-key since we're using OAuth.
+ *
+ * `version` must be the same value passed to rewriteRequestBody for the same
+ * request, otherwise the two reported versions disagree.
  */
-export function setOAuthHeaders(headers, accessToken) {
+export function setOAuthHeaders(headers, accessToken, version = CLAUDE_CODE_VERSION) {
     headers.set('authorization', `Bearer ${accessToken}`);
     headers.set('anthropic-beta', mergeBetaHeaders(headers));
-    headers.set('user-agent', USER_AGENT);
+    headers.set('user-agent', formatUserAgent(version));
     headers.delete('x-api-key');
     return headers;
 }
@@ -467,13 +470,16 @@ export function prependClaudeCodeIdentity(system) {
 }
 /**
  * Rewrite the full request body: sanitize system prompt and prefix tool names.
+ *
+ * `version` must be the same value passed to setOAuthHeaders for the same
+ * request, otherwise the two reported versions disagree.
  */
-export function rewriteRequestBody(body) {
+export function rewriteRequestBody(body, version = CLAUDE_CODE_VERSION) {
     try {
         const parsed = JSON.parse(body);
         const billingHeader = Array.isArray(parsed.messages) &&
             parsed.messages.some((message) => message.role === 'user')
-            ? buildBillingHeaderValue(parsed.messages, undefined, CLAUDE_CODE_ENTRYPOINT)
+            ? buildBillingHeaderValue(parsed.messages, version, CLAUDE_CODE_ENTRYPOINT)
             : null;
         // Sanitize system prompt and prepend Claude Code identity
         parsed.system = prependClaudeCodeIdentity(parsed.system);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ex-machina/opencode-anthropic-auth",
-  "version": "2.0.0-next.0",
+  "version": "2.0.0-next.1",
   "type": "module",
   "repository": {
     "type": "git",
@@ -24,6 +24,7 @@
     "check": "bun turbo check:all",
     "test": "bun test",
     "types": "tsc",
+    "check:package": "bun run build && bun scripts/check-package.ts",
     "format": "biome check --write --unsafe",
     "format:check": "biome format .",
     "lint": "biome lint --error-on-warnings .",