@gotgenes/pi-anthropic-auth 0.4.6 → 0.5.1

package/CHANGELOG.md

@@ -0,0 +1,185 @@
+# Changelog
+
+## [0.5.1](https://github.com/gotgenes/pi-anthropic-auth/compare/v0.5.0...v0.5.1) (2026-06-11)
+
+
+### Bug Fixes
+
+* shape Anthropic OAuth requests at the transport layer ([a8c2015](https://github.com/gotgenes/pi-anthropic-auth/commit/a8c2015c293c6b60d1110f73620dd3825057c6e6))
+
+
+### Documentation
+
+* document the OAuth transport-wrapper architecture ([6ce28a4](https://github.com/gotgenes/pi-anthropic-auth/commit/6ce28a484189a3f1500bc0eb3e18c87fcb1e5c6f))
+* note prek rumdl-fmt pre-commit hook in markdown-conventions skill ([5838075](https://github.com/gotgenes/pi-anthropic-auth/commit/58380753961e3fa1bb0b10c1cd72ca936b926e48))
+* port reusable skills from pi-packages ([1e606a9](https://github.com/gotgenes/pi-anthropic-auth/commit/1e606a97d2dfd509ad4b8c5b29f9b2eea2771afc))
+
+
+### Miscellaneous Chores
+
+* bump dependencies and establish Pi 0.79.1 base ([62696c9](https://github.com/gotgenes/pi-anthropic-auth/commit/62696c97934a3bdbd67091fb30ee2af7d8959f8b))
+
+## [0.5.0](https://github.com/gotgenes/pi-anthropic-auth/compare/v0.4.6...v0.5.0) (2026-05-24)
+
+
+### Features
+
+* add ESLint with type-aware rules matching pi-packages ([645e145](https://github.com/gotgenes/pi-anthropic-auth/commit/645e14517681c3ff37e798a5d8c8db94374b3fa1))
+
+
+### Documentation
+
+* clarify that non-OAuth requests pass through untouched ([1706c1f](https://github.com/gotgenes/pi-anthropic-auth/commit/1706c1f188af2dee2ec1229596d169e61ff2f0a4))
+* update AGENTS.md for new build and import conventions ([01c923a](https://github.com/gotgenes/pi-anthropic-auth/commit/01c923a41405641485ec95f454d4962058a8d72f))
+
+
+### Miscellaneous Chores
+
+* bump CLAUDE_CODE_VERSION to 2.1.150 ([76081d2](https://github.com/gotgenes/pi-anthropic-auth/commit/76081d2f57b2809ef7eba49bc7703b55689129f2))
+* bump pi packages to 0.75.5 and update tooling deps ([23e360d](https://github.com/gotgenes/pi-anthropic-auth/commit/23e360d408640e12b65ff92bd9ac8a893444bcec))
+* update linting toolchain to match pi-packages ([40ddc5a](https://github.com/gotgenes/pi-anthropic-auth/commit/40ddc5aa6f9f18b69a6340c0bcf1a92c8614cbd8))
+* update pnpm ([629f2b7](https://github.com/gotgenes/pi-anthropic-auth/commit/629f2b78c8730a2a64f1941d0d1607c6bd6ef7c3))
+
+## [0.4.6](https://github.com/gotgenes/pi-anthropic-auth/compare/v0.4.5...v0.4.6) (2026-05-08)
+
+
+### Bug Fixes
+
+* bump CLAUDE_CODE_VERSION to 2.1.119 ([119e8e5](https://github.com/gotgenes/pi-anthropic-auth/commit/119e8e5b6c725dd20907747d52852b15bbeafc83))
+
+## [0.4.5](https://github.com/gotgenes/pi-anthropic-auth/compare/v0.4.4...v0.4.5) (2026-05-08)
+
+
+### Bug Fixes
+
+* pin pnpm to 11.0.6 via packageManager field ([0fa7cea](https://github.com/gotgenes/pi-anthropic-auth/commit/0fa7cea1e1622db75448c4d8ccebc730daf7b021))
+
+## [0.4.4](https://github.com/gotgenes/pi-anthropic-auth/compare/v0.4.3...v0.4.4) (2026-05-08)
+
+
+### Miscellaneous Chores
+
+* approve build of "@google/genai" ([30d595e](https://github.com/gotgenes/pi-anthropic-auth/commit/30d595e0168a038aae45d8c4e338a96b5c168bf6))
+* update dev dependencies to latest ([c5c6d69](https://github.com/gotgenes/pi-anthropic-auth/commit/c5c6d6921b108b63f70aa2280852b9ede3926cc2))
+
+## [0.4.3](https://github.com/gotgenes/pi-anthropic-auth/compare/v0.4.2...v0.4.3) (2026-05-08)
+
+
+### Miscellaneous Chores
+
+* migrate from [@mariozechner](https://github.com/mariozechner) to [@earendil-works](https://github.com/earendil-works) pi packages ([e36ab59](https://github.com/gotgenes/pi-anthropic-auth/commit/e36ab598733a2ff6501d007363a4398fff15140c))
+
+## [0.4.2](https://github.com/gotgenes/pi-anthropic-auth/compare/v0.4.1...v0.4.2) (2026-05-02)
+
+
+### Documentation
+
+* update badge to pnpm 10 ([77b0ae8](https://github.com/gotgenes/pi-anthropic-auth/commit/77b0ae8964ef857d4094df09bf099dc27dc862a4))
+
+
+### Miscellaneous Chores
+
+* bump CLAUDE_CODE_VERSION to 2.1.112 ([be65bc8](https://github.com/gotgenes/pi-anthropic-auth/commit/be65bc85822bc1752bc0d75bd2fd44cca7da8342))
+
+## [0.4.1](https://github.com/gotgenes/pi-anthropic-auth/compare/v0.4.0...v0.4.1) (2026-04-27)
+
+
+### Bug Fixes
+
+* refine OAuth prompt shaping and add debug logging ([7c2b2af](https://github.com/gotgenes/pi-anthropic-auth/commit/7c2b2afb351a18fbb3569b8552d59a9d321ef7f8))
+
+
+### Documentation
+
+* add comparison notes for similar Anthropic OAuth projects ([b6ab2de](https://github.com/gotgenes/pi-anthropic-auth/commit/b6ab2defa7f7b220d159692ed39598a84d8a8197))
+* add final pull step after release merge ([9f33ca4](https://github.com/gotgenes/pi-anthropic-auth/commit/9f33ca4d06813a1a35a0821e77b7f951e775edb3))
+* add git workflow and Haiku repro guidance ([a2a193a](https://github.com/gotgenes/pi-anthropic-auth/commit/a2a193a03ded63029009a57de197759ccf00d816))
+* capture repo workflow and model alias gotchas ([99aa8f6](https://github.com/gotgenes/pi-anthropic-auth/commit/99aa8f6e80b40e28c5c8ee67d87aef2205459b75))
+* clarify release-please end-of-workflow ([c1f83a6](https://github.com/gotgenes/pi-anthropic-auth/commit/c1f83a63691f4403e9c8333c85b87e6d9f07a68b))
+* refine release workflow steps ([17480a1](https://github.com/gotgenes/pi-anthropic-auth/commit/17480a1d8605d2273e21ddc5754b546d87c0ab73))
+* require explicit PR number for release merge ([59a8665](https://github.com/gotgenes/pi-anthropic-auth/commit/59a86655d9e02fe3ab45b0484975fcbf4211ab1e))
+
+
+### Miscellaneous Chores
+
+* remove pi-ask-user package ([0e51ce0](https://github.com/gotgenes/pi-anthropic-auth/commit/0e51ce05f87019bd063d99dd05e011876fe8bd68))
+
+## [0.4.0](https://github.com/gotgenes/pi-anthropic-auth/compare/v0.3.0...v0.4.0) (2026-04-25)
+
+
+### Features
+
+* adopt anchor-driven sanitizer for system prompt shaping (issue [#10](https://github.com/gotgenes/pi-anthropic-auth/issues/10)) ([f740a35](https://github.com/gotgenes/pi-anthropic-auth/commit/f740a3524e255b9153227e1f67eef342a5b57196))
+
+
+### Bug Fixes
+
+* preserve content appended after Pi default preamble for OAuth shaping ([52b2ca8](https://github.com/gotgenes/pi-anthropic-auth/commit/52b2ca83903d84c63471841c6ff90f3971c8643d)), closes [#9](https://github.com/gotgenes/pi-anthropic-auth/issues/9)
+* remove body-level anthropic-beta injection that caused 400 rejection ([4ab21db](https://github.com/gotgenes/pi-anthropic-auth/commit/4ab21dbafd30f2e1d8190370cfa04a7417e5f2c5))
+
+
+### Documentation
+
+* refresh AGENTS.md testing guidance for vitest harness ([ed1b344](https://github.com/gotgenes/pi-anthropic-auth/commit/ed1b3444e001dbff74ee5197d1c37b4fe21f7602))
+
+
+### Miscellaneous Chores
+
+* switch test runner from node:test to vitest ([e0200f9](https://github.com/gotgenes/pi-anthropic-auth/commit/e0200f9308b5ee2cb31a085ac1aa256ccc3f95dd))
+
+## [0.3.0](https://github.com/gotgenes/pi-anthropic-auth/compare/v0.2.1...v0.3.0) (2026-04-24)
+
+
+### Features
+
+* add ask_user tool via pi-ask-user plugin ([8cb181a](https://github.com/gotgenes/pi-anthropic-auth/commit/8cb181a6824074f9fe3ad1f0e16bf608f3a99f68))
+
+
+### Bug Fixes
+
+* always inject required OAuth betas regardless of upstream anthropic-beta header ([a048535](https://github.com/gotgenes/pi-anthropic-auth/commit/a048535098d5ed8cfd189ac9c6e146e044b135b1))
+* bump CLAUDE_CODE_VERSION to 2.1.108 ([641c406](https://github.com/gotgenes/pi-anthropic-auth/commit/641c40628f9c665790da9f3ebbab492d133b1f78))
+
+
+### Documentation
+
+* add Conventional Commits guidelines to AGENTS.md ([72dc990](https://github.com/gotgenes/pi-anthropic-auth/commit/72dc990e154a708600902ed95a11c5d6e8a45c4d))
+* simplify README to focus on what, not how ([2becbd8](https://github.com/gotgenes/pi-anthropic-auth/commit/2becbd8b5c23a06ba2b52e39c5513bea4a311d6f))
+
+## [0.2.1](https://github.com/gotgenes/pi-anthropic-auth/compare/v0.2.0...v0.2.1) (2026-04-22)
+
+
+### Documentation
+
+* add badges and acknowledgments to README ([e963e64](https://github.com/gotgenes/pi-anthropic-auth/commit/e963e642414e73e1724d7ee3e28bc00cc9a73e5b))
+
+
+### Miscellaneous Chores
+
+* upgrade TypeScript 5 -> 6.0.3 ([bd227e0](https://github.com/gotgenes/pi-anthropic-auth/commit/bd227e0bfd8165d7dd68a517fd405f1bb1ecb33a))
+
+## [0.2.0](https://github.com/gotgenes/pi-anthropic-auth/compare/v0.1.0...v0.2.0) (2026-04-22)
+
+
+### Features
+
+* add minimal anthropic oauth compatibility override ([092da47](https://github.com/gotgenes/pi-anthropic-auth/commit/092da47c6390dff82cbf98b0e42acc473b69e41a))
+
+
+### Bug Fixes
+
+* avoid extra cached anthropic billing block ([a0e1c7e](https://github.com/gotgenes/pi-anthropic-auth/commit/a0e1c7eb70676e703bf5d7d4945ebf5211bd8a1e))
+* move system prompt shaping into before_provider_request ([23e68e5](https://github.com/gotgenes/pi-anthropic-auth/commit/23e68e5c5e18a32846c17f9098e363eef91a6cbe))
+* stabilize anthropic oauth prompt and payload shaping ([52819a9](https://github.com/gotgenes/pi-anthropic-auth/commit/52819a941573c64e440fddbcc4a828c4fa30609a))
+* sync lockfile with package.json dependencies ([8db4a45](https://github.com/gotgenes/pi-anthropic-auth/commit/8db4a458a05d97b3e829b453f3093c90fd9a30a5))
+
+
+### Documentation
+
+* fix license copyright year ([75c2995](https://github.com/gotgenes/pi-anthropic-auth/commit/75c29954ea5b62f977be910eb174953a0abe07ce))
+* update README with pi install instructions and NPM usage ([5cbdab8](https://github.com/gotgenes/pi-anthropic-auth/commit/5cbdab84017e619984dcccf8aa38e8e30fb0871c))
+
+
+### Miscellaneous Chores
+
+* fix prek hook ordering and add auto-fix flags ([204676d](https://github.com/gotgenes/pi-anthropic-auth/commit/204676d4c12732cee42c0110ce5d5e7bee54534b))

package/README.md

@@ -16,6 +16,11 @@ This extension fills in the gaps for users who want to use their **Claude Pro or
 
 It keeps everything you'd expect — the built-in `anthropic` provider, the full model list, API-key behavior, and the native `/login anthropic` flow — and layers on the compatibility fixes needed to make OAuth subscriptions work reliably.
 
+Requests to non-Anthropic providers and plain API-key Anthropic requests pass through completely untouched — the extension only activates when it detects an Anthropic OAuth access token (`sk-ant-oat`).
+
+Shaping runs in a thin transport wrapper around Pi's own Anthropic transport, so it applies to every OAuth call path — the interactive loop, compaction, and any background-agent work — not just the main turn.
+See [docs/architecture.md](docs/architecture.md) for how this works.
+
 ## Install
 
 ```bash

package/package.json

@@ -1,20 +1,20 @@
 {
   "name": "@gotgenes/pi-anthropic-auth",
-  "version": "0.4.6",
+  "version": "0.5.1",
   "description": "Pi extension package for Anthropic OAuth compatibility",
   "author": {
     "name": "Chris Lasher"
   },
   "type": "module",
-  "main": "./dist/index.js",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
-    }
+  "imports": {
+    "#src/*": "./src/*",
+    "#test/*": "./test/*"
   },
   "files": [
-    "dist"
+    "src",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
   ],
   "keywords": [
     "pi",
@@ -27,35 +27,43 @@
     "type": "git",
     "url": "git+https://github.com/gotgenes/pi-anthropic-auth.git"
   },
+  "homepage": "https://github.com/gotgenes/pi-anthropic-auth#readme",
+  "bugs": {
+    "url": "https://github.com/gotgenes/pi-anthropic-auth/issues"
+  },
+  "engines": {
+    "node": ">=22"
+  },
   "publishConfig": {
     "access": "public"
   },
   "pi": {
     "extensions": [
-      "./dist/index.js"
+      "./src/index.ts"
     ]
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": "*",
-    "@earendil-works/pi-coding-agent": "*"
+    "@earendil-works/pi-ai": ">=0.79.1",
+    "@earendil-works/pi-coding-agent": ">=0.79.1"
   },
   "devDependencies": {
-    "@anthropic-ai/sdk": "^0.95.0",
-    "@biomejs/biome": "^2.4.14",
-    "@earendil-works/pi-ai": "^0.74.0",
-    "@earendil-works/pi-coding-agent": "^0.74.0",
-    "markdownlint-cli2": "^0.22.1",
+    "@anthropic-ai/sdk": "^0.104.1",
+    "@biomejs/biome": "^2.4.16",
+    "@earendil-works/pi-ai": "0.79.1",
+    "@earendil-works/pi-coding-agent": "0.79.1",
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^22.15.3",
+    "eslint": "^10.4.1",
+    "globals": "^17.6.0",
+    "rumdl": "^0.2.14",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.5"
+    "typescript-eslint": "^8.61.0",
+    "vitest": "^4.1.8"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "check": "tsc -p tsconfig.check.json --noEmit",
-    "lint": "biome check .",
-    "lint:fix": "biome check --write .",
-    "lint:md": "markdownlint-cli2 '*.md'",
-    "lint:all": "pnpm run lint && pnpm run lint:md",
-    "format": "biome format --write .",
+    "check": "tsc --noEmit",
+    "lint:md": "rumdl check *.md docs/**/*.md",
+    "lint": "biome check . && eslint . && pnpm run lint:md",
     "test": "vitest run",
     "test:watch": "vitest"
   }

package/src/anthropic-oauth.ts

@@ -0,0 +1,38 @@
+import type {
+  OAuthCredentials,
+  OAuthLoginCallbacks,
+} from "@earendil-works/pi-ai";
+import {
+  loginAnthropic,
+  refreshAnthropicToken,
+} from "@earendil-works/pi-ai/oauth";
+
+export function mergeRefreshedCredentials(
+  credentials: OAuthCredentials,
+  refreshed: Partial<OAuthCredentials>,
+): OAuthCredentials {
+  return {
+    ...credentials,
+    ...refreshed,
+    refresh:
+      typeof refreshed.refresh === "string" &&
+      refreshed.refresh.trim().length > 0
+        ? refreshed.refresh
+        : credentials.refresh,
+  };
+}
+
+export const anthropicOAuthOverride = {
+  name: "Anthropic (Claude Pro/Max)",
+  login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {
+    return loginAnthropic(callbacks);
+  },
+  async refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {
+    const refreshed = await refreshAnthropicToken(credentials.refresh);
+
+    return mergeRefreshedCredentials(credentials, refreshed);
+  },
+  getApiKey(credentials: OAuthCredentials): string {
+    return credentials.access;
+  },
+} as const;

package/{dist/constants.js → src/constants.ts}

@@ -4,7 +4,9 @@
  * Used to detect whether a system block contains Pi's original verbose
  * preamble so it can be replaced with the minimal neutral prompt.
  */
-export const PI_DEFAULT_PROMPT_PREFIX = "You are an expert coding assistant operating inside pi, a coding agent harness.";
+export const PI_DEFAULT_PROMPT_PREFIX =
+  "You are an expert coding assistant operating inside pi, a coding agent harness.";
+
 /**
  * Final line of Pi's built-in default system prompt preamble.
  *
@@ -12,7 +14,9 @@ export const PI_DEFAULT_PROMPT_PREFIX = "You are an expert coding assistant oper
  * neutral Anthropic OAuth prompt while preserving anything appended after the
  * preamble (project context, skills, and date/cwd footer).
  */
-export const PI_DEFAULT_PROMPT_TERMINATOR = "- Always read pi .md files completely and follow links to related docs (e.g., tui.md for TUI API details)";
+export const PI_DEFAULT_PROMPT_TERMINATOR =
+  "- Always read pi .md files completely and follow links to related docs (e.g., tui.md for TUI API details)";
+
 /**
  * Prefix of the minimal neutral Anthropic OAuth system prompt.
  *
@@ -20,7 +24,9 @@ export const PI_DEFAULT_PROMPT_TERMINATOR = "- Always read pi .md files complete
  * that have already been shaped.  Must match the first line of
  * MINIMAL_ANTHROPIC_OAUTH_PROMPT.
  */
-export const MINIMAL_ANTHROPIC_OAUTH_PROMPT_PREFIX = "You are an expert coding assistant.";
+export const MINIMAL_ANTHROPIC_OAUTH_PROMPT_PREFIX =
+  "You are an expert coding assistant.";
+
 /**
  * Minimal neutral system prompt used for Anthropic OAuth requests.
  *
@@ -28,11 +34,12 @@ export const MINIMAL_ANTHROPIC_OAUTH_PROMPT_PREFIX = "You are an expert coding a
  * while preserving any project context that follows.
  */
 export const MINIMAL_ANTHROPIC_OAUTH_PROMPT = [
-    MINIMAL_ANTHROPIC_OAUTH_PROMPT_PREFIX,
-    "Be concise and helpful.",
-    "Use the available tools to answer the user's request.",
-    "Show file paths clearly when working with files.",
+  MINIMAL_ANTHROPIC_OAUTH_PROMPT_PREFIX,
+  "Be concise and helpful.",
+  "Use the available tools to answer the user's request.",
+  "Show file paths clearly when working with files.",
 ].join("\n");
+
 /**
  * Prefix of Claude Code's identity injection block.
  *
@@ -40,7 +47,9 @@ export const MINIMAL_ANTHROPIC_OAUTH_PROMPT = [
  * provider, which injects a "You are Claude Code, Anthropic's official CLI"
  * system block for OAuth sessions.
  */
-export const CLAUDE_CODE_IDENTITY_PREFIX = "You are Claude Code, Anthropic's official CLI";
+export const CLAUDE_CODE_IDENTITY_PREFIX =
+  "You are Claude Code, Anthropic's official CLI";
+
 // ---------------------------------------------------------------------------
 // Billing header constants
 //
@@ -53,6 +62,7 @@ export const CLAUDE_CODE_IDENTITY_PREFIX = "You are Claude Code, Anthropic's off
 // version at https://github.com/anthropics/claude-code or in a working Claude
 // Code installation (`claude --version`).
 // ---------------------------------------------------------------------------
+
 /**
  * Claude Code version string embedded in the billing header.
  *
@@ -61,13 +71,17 @@ export const CLAUDE_CODE_IDENTITY_PREFIX = "You are Claude Code, Anthropic's off
  * too far from what Anthropic expects, OAuth requests may be rejected or
  * counted incorrectly.
  */
-export const CLAUDE_CODE_VERSION = "2.1.119";
+export const CLAUDE_CODE_VERSION = "2.1.150";
+
 /** Salt used in the billing header suffix hash. */
 export const BILLING_HEADER_SALT = "59cf53e54c78";
+
 /** Character positions sampled from the first user message for the billing hash. */
-export const BILLING_HEADER_POSITIONS = [4, 7, 20];
+export const BILLING_HEADER_POSITIONS = [4, 7, 20] as const;
+
 /** Entrypoint identifier included in the billing header. */
 export const CLAUDE_CODE_ENTRYPOINT = "sdk-cli";
+
 // ---------------------------------------------------------------------------
 // Anchor-driven sanitizer constants
 //
@@ -80,19 +94,21 @@ export const CLAUDE_CODE_ENTRYPOINT = "sdk-cli";
 // rewording — as long as the anchor still appears somewhere in the paragraph,
 // removal works regardless of surrounding text changes.
 // ---------------------------------------------------------------------------
+
 /**
  * Strings whose presence in a paragraph marks it as Pi-specific and droppable.
  *
  * Each entry is checked with `paragraph.includes(anchor)`.
  */
-export const PARAGRAPH_REMOVAL_ANCHORS = [
-    // Pi identity sentence
-    "operating inside pi, a coding agent harness",
-    // Pi-specific filler about custom tools
-    "In addition to the tools above",
-    // Pi documentation block — references Pi-specific docs/paths
-    "Pi documentation (read only when the user asks about pi itself",
+export const PARAGRAPH_REMOVAL_ANCHORS: readonly string[] = [
+  // Pi identity sentence
+  "operating inside pi, a coding agent harness",
+  // Pi-specific filler about custom tools
+  "In addition to the tools above",
+  // Pi documentation block — references Pi-specific docs/paths
+  "Pi documentation (read only when the user asks about pi itself",
 ];
+
 /**
  * Inline text replacements applied after paragraph removal.
  *
@@ -108,9 +124,13 @@ export const PARAGRAPH_REMOVAL_ANCHORS = [
  * We don't currently emit this phrase, but it's included as a documented
  * future risk per Issue #10.
  */
-export const TEXT_REPLACEMENTS = [
-    {
-        match: "Here is some useful information about the environment you are running in:",
-        replacement: "Environment context you are running in:",
-    },
+export const TEXT_REPLACEMENTS: readonly {
+  match: string;
+  replacement: string;
+}[] = [
+  {
+    match:
+      "Here is some useful information about the environment you are running in:",
+    replacement: "Environment context you are running in:",
+  },
 ];

package/src/debug.ts

@@ -0,0 +1,38 @@
+type DebugMode = "off" | "all" | "tool-use";
+
+function getDebugMode(value: string | undefined): DebugMode {
+  if (!value) return "off";
+
+  switch (value.trim().toLowerCase()) {
+    case "1":
+    case "true":
+    case "yes":
+    case "on":
+    case "debug":
+    case "all":
+      return "all";
+    case "tool":
+    case "tools":
+    case "tool-use":
+    case "tool_use":
+      return "tool-use";
+    default:
+      return "off";
+  }
+}
+
+export function isDebugEnabled(): boolean {
+  return getDebugMode(process.env.PI_ANTHROPIC_AUTH_DEBUG) !== "off";
+}
+
+export function isToolUseOnlyDebugEnabled(): boolean {
+  return getDebugMode(process.env.PI_ANTHROPIC_AUTH_DEBUG) === "tool-use";
+}
+
+export function debugLog(scope: string, data: unknown): void {
+  if (!isDebugEnabled()) {
+    return;
+  }
+
+  console.error(`[pi-anthropic-auth][debug] ${scope} ${JSON.stringify(data)}`);
+}

package/src/index.ts

@@ -0,0 +1,36 @@
+import { getApiProvider } from "@earendil-works/pi-ai";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { anthropicOAuthOverride } from "./anthropic-oauth";
+import { createAnthropicOAuthStreamSimple } from "./oauth-transport";
+
+export default function (pi: ExtensionAPI) {
+  // Capture Pi's built-in anthropic-messages transport BEFORE we override it,
+  // so our wrapper can delegate to it (delegating to the registered wrapper
+  // instead would recurse).  pi-ai registers its built-ins on import, so this
+  // is resolved by the time extensions load.
+  const builtinTransport = getApiProvider("anthropic-messages");
+
+  // Re-register the built-in `anthropic` provider with:
+  //   1. our OAuth login + refresh override (`oauth`), and
+  //   2. a thin transport wrapper (`streamSimple`) that applies Claude Code
+  //      OAuth request shaping on every Anthropic call path.
+  //
+  // Omitting `models` preserves Pi's built-in Anthropic model list.  The
+  // transport wrapper replaces our previous `before_provider_request` handler:
+  // that hook only fires for the interactive agent loop, so auxiliary OAuth
+  // requests (built-in compaction, third-party background agents) bypassed it
+  // and failed with Anthropic "extra usage" 400s.  Registering `streamSimple`
+  // routes through Pi's singleton API registry, so the same shaping now covers
+  // the main loop, `completeSimple` compaction, and `agentLoop` background work.
+  pi.registerProvider("anthropic", {
+    oauth: anthropicOAuthOverride,
+    ...(builtinTransport
+      ? {
+          api: "anthropic-messages",
+          streamSimple: createAnthropicOAuthStreamSimple(
+            builtinTransport.streamSimple,
+          ),
+        }
+      : {}),
+  });
+}

package/src/oauth-transport.ts

@@ -0,0 +1,97 @@
+import type {
+  Api,
+  AssistantMessageEventStream,
+  Context,
+  Model,
+  SimpleStreamOptions,
+} from "@earendil-works/pi-ai";
+import { shapeAnthropicOAuthPayload } from "./request-shaping";
+
+/**
+ * Anthropic OAuth access tokens are issued with an `sk-ant-oat` prefix.
+ *
+ * This is the same signal Pi's built-in Anthropic provider uses internally to
+ * decide whether to emit Claude Code identity headers, so gating on it keeps
+ * our shaping aligned with Pi's own OAuth detection.
+ */
+const ANTHROPIC_OAUTH_TOKEN_MARKER = "sk-ant-oat";
+
+/**
+ * The transport-level `streamSimple` handler shape Pi's API registry uses.
+ *
+ * It matches `ApiStreamSimpleFunction` from `@earendil-works/pi-ai` and is
+ * intentionally wider than a single concrete model type because Pi registers
+ * it per `Api`, not per model.
+ */
+export type AnthropicStreamSimple = (
+  model: Model<Api>,
+  context: Context,
+  options?: SimpleStreamOptions,
+) => AssistantMessageEventStream;
+
+/**
+ * Returns true when the resolved API key is an Anthropic OAuth access token.
+ *
+ * API-key requests (and OAuth tokens for other providers) return false, so the
+ * caller leaves their payloads untouched.
+ */
+export function isAnthropicOAuthToken(
+  apiKey: string | undefined,
+): apiKey is string {
+  return (
+    typeof apiKey === "string" && apiKey.includes(ANTHROPIC_OAUTH_TOKEN_MARKER)
+  );
+}
+
+/**
+ * Wraps Pi's built-in Anthropic `streamSimple` transport so OAuth request
+ * shaping runs on **every** Anthropic call path, not only the main agent loop.
+ *
+ * Pi only threads its `before_provider_request` hook into the interactive agent
+ * loop.  Auxiliary calls — built-in compaction/summarization (`completeSimple`)
+ * and third-party background agents (e.g. pi-observational-memory's observer /
+ * reflector / dropper running via `agentLoop`) — issue requests through the
+ * same singleton API-registry transport but without that hook.  Those OAuth
+ * requests then reach Anthropic with no Claude Code billing header and are
+ * classified as third-party app usage, producing the misleading "extra usage"
+ * HTTP 400.
+ *
+ * By injecting our shaping as an `onPayload` on the underlying transport, every
+ * Anthropic OAuth request is shaped regardless of which Pi code path issued it.
+ * The wrapper composes (does not replace) any caller-provided `onPayload`, so
+ * other extensions' `before_provider_request` handlers continue to run on the
+ * main loop, and our shaping is applied last — closest to the wire.
+ *
+ * Gating is strictly OAuth-only: when the request is not an Anthropic OAuth
+ * token, the payload passes through untouched, preserving Pi's normal
+ * API-key and non-Anthropic transport behavior.
+ *
+ * @param delegate The built-in Anthropic `streamSimple` transport, captured via
+ *   `getApiProvider("anthropic-messages")` **before** this wrapper is
+ *   registered.  It must be the underlying transport, never the registered
+ *   wrapper, otherwise calls would recurse.
+ */
+export function createAnthropicOAuthStreamSimple(
+  delegate: AnthropicStreamSimple,
+): AnthropicStreamSimple {
+  return (model, context, options) => {
+    const callerOnPayload = options?.onPayload;
+
+    const onPayload: SimpleStreamOptions["onPayload"] = async (
+      payload,
+      payloadModel,
+    ) => {
+      const upstream = callerOnPayload
+        ? ((await callerOnPayload(payload, payloadModel)) ?? payload)
+        : payload;
+
+      if (!isAnthropicOAuthToken(options?.apiKey)) {
+        return upstream;
+      }
+
+      return shapeAnthropicOAuthPayload(upstream);
+    };
+
+    return delegate(model, context, { ...options, onPayload });
+  };
+}