@modelprofile.com/authswitch 5.2.0 → 6.1.0

package/ts/classes.claudestatus.ts

@@ -110,6 +110,21 @@ type TClaudeProfile =
   | { kind: 'mismatch' }
   | { kind: 'unavailable'; problem: string };
 
+/**
+ * One Claude OAuth login as a status lookup needs it: the token to ask with, and what the store that keeps it knows
+ * about it. Claude Code's own store keeps the scopes and the account the login belongs to; another harness holding
+ * the same kind of grant (OpenCode's `anthropic` provider entry) keeps neither, and leaves both to the service.
+ */
+export interface IClaudeLogin {
+  accessToken: string;
+  /** The scopes the login is stored with. An empty list means the store keeps none, not that the login has none. */
+  scopes: readonly string[];
+  /** The account the login must belong to; an answer about another account is refused. Omitted where no store keeps it. */
+  identity?: { accountUuid: string; organizationUuid: string };
+  /** The plan the login was saved with, the only one known while the service cannot be asked. */
+  plan?: string;
+}
+
 /**
  * How long a session reuses an account's profile. The watch polls every few minutes, and the profile (plan,
  * organization, billing type) changes far more rarely, so it is read at most hourly there.
@@ -119,9 +134,12 @@ const REQUEST_TIMEOUT_MS = 10_000;
 const MISMATCH = 'Claude returned a different account or organization; no account data was displayed.';
 
 /**
- * Claude Code's read-only OAuth account endpoints: the profile and usage of one login, with the access token it
- * carries. It never refreshes that token; `ClaudeCodeHarness` refreshes a saved login first, and leaves the active
- * login's tokens to Claude Code. No inference or browser session is used.
+ * Claude Code's read-only OAuth account endpoints: the profile and usage of one Claude OAuth login, asked with the
+ * access token that login carries and with the headers Claude Code 2.1.273 sends (`_ke`, bundle offset @191153494,
+ * and the `anthropic-beta` value `Vu`, @188533107). Any harness holding such a grant is served, not only Claude Code's own store.
+ *
+ * It never refreshes that token; `ClaudeCodeHarness` refreshes a saved login first, and leaves the active login's
+ * tokens to Claude Code. No inference or browser session is used.
  */
 export class ClaudeAccountStatus {
   constructor(private readonly fetcher: typeof fetch = globalThis.fetch, private readonly now: () => number = Date.now) {}
@@ -139,15 +157,15 @@ export class ClaudeAccountStatus {
   }
 
   /** The profile, from the session while it is younger than an hour; the session key is a hash of the token, never the token. */
-  private profile(token: string, account: Record<string, unknown>, optionsArg: IHarnessStatusOptions): Promise<TClaudeProfile> {
-    const lookup = () => this.lookupProfile(token, account, optionsArg.signal);
-    return optionsArg.session ? optionsArg.session.reuse(`claude:profile:${credentialHash(token)}`, PROFILE_REUSE_MS, lookup) : lookup();
+  private profile(loginArg: IClaudeLogin, optionsArg: IHarnessStatusOptions): Promise<TClaudeProfile> {
+    const lookup = () => this.lookupProfile(loginArg, optionsArg.signal);
+    return optionsArg.session ? optionsArg.session.reuse(`claude:profile:${credentialHash(loginArg.accessToken)}`, PROFILE_REUSE_MS, lookup) : lookup();
   }
 
   /** A rejected login and an unsupported or foreign profile are answers; a rate limit or a failed request is thrown. */
-  private async lookupProfile(token: string, account: Record<string, unknown>, signal?: AbortSignal): Promise<TClaudeProfile> {
+  private async lookupProfile(loginArg: IClaudeLogin, signal?: AbortSignal): Promise<TClaudeProfile> {
     let body: Record<string, unknown>;
-    try { body = await this.get('profile', token, signal); }
+    try { body = await this.get('profile', loginArg.accessToken, signal); }
     catch (error) {
       if (error instanceof ClaudeLoginRejectedError) return { kind: 'unavailable', problem: `Profile: ${error.message}` };
       throw error;
@@ -155,7 +173,9 @@ export class ClaudeAccountStatus {
     try {
       const user = credentialRecord(body.account);
       const organization = credentialRecord(body.organization);
-      if (user.uuid !== account.accountUuid || organization.uuid !== account.organizationUuid) return { kind: 'mismatch' };
+      // A store that keeps no account identity has none to compare; the service's answer is about the token that was sent.
+      const identity = loginArg.identity;
+      if (identity !== undefined && (user.uuid !== identity.accountUuid || organization.uuid !== identity.organizationUuid)) return { kind: 'mismatch' };
       const facts: IHarnessStatusFact[] = [];
       for (const [label, value] of [['Email', user.email], ['Organization', organization.name], ['Billing type', organization.billing_type], ['Seat tier', organization.seat_tier]]) {
         if (credentialText(value)) facts.push({ section: 'Account', label: String(label), value: String(value) });
@@ -165,25 +185,25 @@ export class ClaudeAccountStatus {
   }
 
   /** The plan the login was saved with, the only one known while the service cannot be asked. */
-  private storedSummary(oauth: Record<string, unknown>): Pick<IHarnessAccountStatus, 'summary'> {
-    const plan = credentialText(oauth.subscriptionType);
-    return plan ? { summary: { subscription: { plan, source: 'stored' } } } : {};
+  private storedSummary(loginArg: Pick<IClaudeLogin, 'plan'>): Pick<IHarnessAccountStatus, 'summary'> {
+    return loginArg.plan ? { summary: { subscription: { plan: loginArg.plan, source: 'stored' } } } : {};
   }
 
   /** A login that could not be made usable for a lookup: its stored plan and why, with the service's retry time for a rate limit. */
-  public unavailable(oauth: Record<string, unknown>, problem: string, rateLimit?: IHarnessAccountStatus['rateLimit']): IHarnessAccountStatus {
-    return { facts: [], problems: [problem], ...this.storedSummary(oauth), ...(rateLimit ? { rateLimit } : {}) };
+  public unavailable(loginArg: Pick<IClaudeLogin, 'plan'>, problem: string, rateLimit?: IHarnessAccountStatus['rateLimit']): IHarnessAccountStatus {
+    return { facts: [], problems: [problem], ...this.storedSummary(loginArg), ...(rateLimit ? { rateLimit } : {}) };
   }
 
-  public async read(oauth: Record<string, unknown>, account: Record<string, unknown>, optionsArg: IHarnessStatusOptions = {}): Promise<IHarnessAccountStatus> {
-    const result: IHarnessAccountStatus = { facts: [], problems: [], ...this.storedSummary(oauth) };
-    if (!Array.isArray(oauth.scopes) || !oauth.scopes.includes('user:profile')) {
+  public async read(loginArg: IClaudeLogin, optionsArg: IHarnessStatusOptions = {}): Promise<IHarnessAccountStatus> {
+    const result: IHarnessAccountStatus = { facts: [], problems: [], ...this.storedSummary(loginArg) };
+    // Only a store that keeps the login's scopes can tell beforehand that the service will not answer about the account.
+    if (loginArg.scopes.length && !loginArg.scopes.includes('user:profile')) {
       result.facts.push({ section: 'Availability', label: 'Live account status', value: 'This login lacks the user:profile scope. Log in through Claude Code to obtain subscriber status.' });
       return result;
     }
-    const token = credentialText(oauth.accessToken);
+    const token = credentialText(loginArg.accessToken);
     if (!token) return { facts: [], problems: ['No usable Claude Code access token is available.'] };
-    const [profile, usage] = await Promise.allSettled([this.profile(token, account, optionsArg), this.get('usage', token, optionsArg.signal)]);
+    const [profile, usage] = await Promise.allSettled([this.profile(loginArg, optionsArg), this.get('usage', token, optionsArg.signal)]);
     const failure = (reason: unknown): string => reason instanceof ClaudeRequestError ? reason.message : 'Lookup failed.';
     if (profile.status === 'fulfilled') {
       const found = profile.value;

package/ts/classes.claudetokenrefresh.ts

@@ -1,18 +1,31 @@
 import { credentialText } from './classes.credentialstore.js';
-import { claudeRequest, ClaudeLoginRejectedError, ClaudeRequestError } from './claudehttp.js';
+import { claudeRequest, ClaudeAccountOnHoldError, ClaudeLoginRejectedError, ClaudeRequestError, oauthErrorCode } from './claudehttp.js';
 
-/** Claude Code 2.1.273's token endpoint (`TOKEN_URL`, bundle offset @12733057; see hints.md). */
+/** Claude Code 2.1.273's token endpoint (`TOKEN_URL`, bundle offset @188533776). */
 const TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
-/** Claude Code 2.1.273's public OAuth client (`CLIENT_ID`, @12733057), used when a login does not name its own. */
+/** Claude Code 2.1.273's public OAuth client (`CLIENT_ID`, @188534240), used when a login does not name its own. */
 export const CLAUDE_CODE_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
-/** Claude Code 2.1.273 refreshes an access token that expires within five minutes (`cF`, @15359182). */
-const REFRESH_MARGIN_MS = 300_000;
+/** Claude Code 2.1.273 refreshes an access token that expires within five minutes (`cF`, @191161107). */
+export const CLAUDE_REFRESH_MARGIN_MS = 300_000;
 /**
  * Claude Code 2.1.273 allows a refresh 30 seconds. A refresh is never cut shorter than that, nor cancelled once sent:
  * the service may already have replaced the refresh token the request carries.
  */
 const REFRESH_TIMEOUT_MS = 30_000;
 
+/**
+ * The scopes Claude Code 2.1.273 asks for when it refreshes a login of its own OAuth client (`bFe`, @188533214,
+ * with the plugins scope its production build registers). It sends this set whatever the login was stored with,
+ * so a login saved under an older or wider set is renewed exactly as Claude Code renews it.
+ */
+export const CLAUDE_CODE_SCOPES: readonly string[] = [
+  'user:profile', 'user:inference', 'user:sessions:claude_code', 'user:mcp_servers', 'user:file_upload', 'user:plugins',
+];
+/** The only stored scopes Claude Code carries into that set (`Dyn`, @188533421). */
+const CARRIED_SCOPES: readonly string[] = ['user:projects:read', 'user:projects:write'];
+/** The scope that marks a login as one of Claude Code's own subscriber logins (`NS`/`YWt`, @188532967). */
+const INFERENCE_SCOPE = 'user:inference';
+
 /** The token fields a refresh replaces in a stored `claudeAiOauth`; every other field is kept. */
 export interface IClaudeTokens {
   accessToken: string;
@@ -23,11 +36,64 @@ export interface IClaudeTokens {
   scopes?: string[];
 }
 
+/** How Claude Code 2.1.273 builds one refresh request for a stored login. */
+export interface IClaudeGrant {
+  /** The login's own OAuth client, or Claude Code's public one. */
+  clientId: string;
+  /** The scopes the request asks for. */
+  scopes: readonly string[];
+  /**
+   * The stored scopes the request falls back to once the service refuses the set above as `invalid_scope`
+   * (`hg`, @191228494); null where Claude Code sends no second request.
+   */
+  fallbackScopes: readonly string[] | null;
+}
+
+/** The scopes a stored login carries, or none when it carries nothing a scope list can be read from. */
+const storedScopes = (oauthArg: Record<string, unknown>): string[] =>
+  Array.isArray(oauthArg.scopes) && oauthArg.scopes.every(scope => typeof scope === 'string') ? [...oauthArg.scopes as string[]] : [];
+
+/**
+ * How Claude Code 2.1.273 would renew this login, or null where it would not send a refresh at all: a login without
+ * a refresh token, and one that is neither a subscriber login (`user:inference`) nor stored with a plan, which
+ * Claude Code reports as `not_refreshable` (`hg`, @191228494).
+ *
+ * A login of Claude Code's own client is renewed with Claude Code's current scope set plus the project scopes it
+ * carries (`DQn`, @188533511) -- not with the set it was stored under. A login that names its own OAuth client is
+ * renewed with exactly the scopes it was stored with, because only that client's grant knows them.
+ */
+export const claudeGrant = (oauthArg: Record<string, unknown>): IClaudeGrant | null => {
+  if (!credentialText(oauthArg.refreshToken)) return null;
+  const stored = storedScopes(oauthArg);
+  const isSubscriberLogin = stored.includes(INFERENCE_SCOPE);
+  if (!isSubscriberLogin && !credentialText(oauthArg.subscriptionType)) return null;
+  const clientId = credentialText(oauthArg.clientId);
+  if (clientId !== undefined) return { clientId, scopes: stored, fallbackScopes: null };
+  return {
+    clientId: CLAUDE_CODE_CLIENT_ID,
+    scopes: [...new Set([...CLAUDE_CODE_SCOPES, ...stored.filter(scope => CARRIED_SCOPES.includes(scope))])],
+    fallbackScopes: isSubscriberLogin ? stored : null,
+  };
+};
+
+/** The `scope` value one request carries: Claude Code sends its own set for an empty scope list (`RQ`, @191156785). */
+export const grantScope = (scopesArg: readonly string[]): string => (scopesArg.length ? scopesArg : CLAUDE_CODE_SCOPES).join(' ');
+
 const seconds = (valueArg: unknown): number | undefined =>
   typeof valueArg === 'number' && Number.isFinite(valueArg) && valueArg >= 0 ? valueArg : undefined;
 
 /**
- * Refreshes a saved Claude Code login with the refresh-token grant Claude Code 2.1.273 uses (`RQ`, @15355055).
+ * Whether the service refused this grant because the account is on hold (`Pfn`, @191165493, over `fgt`, @190071426):
+ * an `invalid_grant` or `access_denied` whose description is the service's `account_on_hold` marker. Claude Code keeps
+ * such a login and retries it later; only a refusal without that marker means the grant itself is dead.
+ */
+const accountOnHold = (statusArg: number, bodyArg: Record<string, unknown> | null): boolean =>
+  (statusArg === 400 || statusArg === 401 || statusArg === 403)
+  && (oauthErrorCode(bodyArg) === 'invalid_grant' || oauthErrorCode(bodyArg) === 'access_denied')
+  && bodyArg?.error_description === 'account_on_hold';
+
+/**
+ * Refreshes a saved Claude Code login with the refresh-token grant Claude Code 2.1.273 uses (`RQ`, @191156785).
  *
  * It only talks to the token endpoint; which login is refreshed, and how the result is stored, belongs to the harness.
  */
@@ -41,29 +107,39 @@ export class ClaudeTokenRefresh {
   public due(oauthArg: Record<string, unknown>): boolean {
     const expiresAt = oauthArg.expiresAt;
     return typeof expiresAt === 'number' && Number.isFinite(expiresAt) && credentialText(oauthArg.refreshToken) !== undefined
-      && this.now() + REFRESH_MARGIN_MS >= expiresAt;
+      && this.now() + CLAUDE_REFRESH_MARGIN_MS >= expiresAt;
+  }
+
+  /** One refresh request, as Claude Code sends it: a JSON body, the login's client, and the scopes of this attempt. */
+  private attempt(refreshTokenArg: string, grantArg: IClaudeGrant, scopesArg: readonly string[]) {
+    return claudeRequest(this.fetcher, {
+      url: TOKEN_URL, method: 'POST', headers: { 'Content-Type': 'application/json' }, subject: 'Claude sign-in',
+      body: JSON.stringify({
+        grant_type: 'refresh_token', refresh_token: refreshTokenArg, client_id: grantArg.clientId, scope: grantScope(scopesArg),
+      }),
+      timeoutMs: REFRESH_TIMEOUT_MS, readErrorBody: true, now: this.now,
+    });
   }
 
   /**
    * New tokens for the login. A response without a refresh token keeps the one sent, and one without a scope keeps the
    * stored scopes, as Claude Code merges them. Throws `ClaudeRequestError` with a fixed diagnostic; a grant the service
-   * rejects is `ClaudeLoginRejectedError`, and a rate limit is `ClaudeRateLimitError`.
+   * rejects is `ClaudeLoginRejectedError`, an account the service put on hold is `ClaudeAccountOnHoldError`, and a rate
+   * limit is `ClaudeRateLimitError`.
    */
   public async refresh(oauthArg: Record<string, unknown>): Promise<IClaudeTokens> {
     const refreshToken = credentialText(oauthArg.refreshToken);
-    const scopes = oauthArg.scopes;
-    if (!refreshToken || !Array.isArray(scopes) || !scopes.every(scope => typeof scope === 'string')) {
-      throw new ClaudeRequestError('This saved login has no refresh token or scopes to refresh with. Log in again with Claude Code and save it.');
+    const grant = claudeGrant(oauthArg);
+    if (!refreshToken || !grant) {
+      throw new ClaudeRequestError('This saved login has no refresh token, and no subscriber scope or plan to refresh with. Log in again with Claude Code and save it.');
     }
-    const { status, body } = await claudeRequest(this.fetcher, {
-      url: TOKEN_URL, method: 'POST', headers: { 'Content-Type': 'application/json' }, subject: 'Claude sign-in',
-      body: JSON.stringify({
-        grant_type: 'refresh_token', refresh_token: refreshToken,
-        client_id: credentialText(oauthArg.clientId) ?? CLAUDE_CODE_CLIENT_ID, scope: scopes.join(' '),
-      }),
-      timeoutMs: REFRESH_TIMEOUT_MS, readErrorBody: true, now: this.now,
-    });
-    if ((status === 400 || status === 401) && body?.error === 'invalid_grant') throw new ClaudeLoginRejectedError();
+    let { status, body } = await this.attempt(refreshToken, grant, grant.scopes);
+    // The service refusing Claude Code's current scope set is the one failure it sends a second request for.
+    if (status === 400 && oauthErrorCode(body) === 'invalid_scope' && grant.fallbackScopes !== null) {
+      ({ status, body } = await this.attempt(refreshToken, grant, grant.fallbackScopes));
+    }
+    if (accountOnHold(status, body)) throw new ClaudeAccountOnHoldError();
+    if ((status === 400 || status === 401) && oauthErrorCode(body) === 'invalid_grant') throw new ClaudeLoginRejectedError();
     if (status < 200 || status > 299) throw new ClaudeRequestError(`The Claude sign-in service returned HTTP ${status}.`);
     const receivedAt = this.now();
     const accessToken = credentialText(body?.access_token);

package/ts/classes.cli.ts

@@ -108,9 +108,9 @@ ${bold('Options')}
 
 A switch works while OpenCode or Claude Code is running. Claude Code picks the new login
 up on its next request, so its sessions are stopped only on --stop or --force-stop.
-OpenCode keeps the previous login in memory and can write it back at its next token
-refresh, so an OpenCode switch offers to stop it first; without a terminal it leaves
-it running and says so.
+OpenCode caches no login either, but a request already in flight can write the previous
+login's own rotation back, so an OpenCode switch offers to stop it first; without a
+terminal it leaves it running and says so.
 
 Watch covers the harnesses that support automatic switching (${[...this.harnesses.values()].filter(harness => harness.autoSwitch === true).map(harness => harness.id).join(', ') || 'none registered'}).
 --interval takes seconds or a unit (120, 90s, 2m; from 1m to 1d); --threshold takes 50 to 100.

package/ts/classes.credentialstore.ts

@@ -164,8 +164,8 @@ export class CredentialStore {
         && typeof record.switchedAt === 'string' && Number.isFinite(Date.parse(record.switchedAt));
     });
   }
-  public recordSwitch(entry: Omit<ISwitchRecord, 'switchedAt'>): void {
-    this.writeSwitchRecords([...this.switchRecords().filter(item => item.slotId !== entry.slotId), { ...entry, switchedAt: new Date().toISOString() }]);
+  public recordSwitch(entry: Omit<ISwitchRecord, 'switchedAt'> & { switchedAt?: string }): void {
+    this.writeSwitchRecords([...this.switchRecords().filter(item => item.slotId !== entry.slotId), { ...entry, switchedAt: entry.switchedAt ?? new Date().toISOString() }]);
   }
   public clearSwitch(slotId: string): void {
     const remaining = this.switchRecords().filter(item => item.slotId !== slotId);

package/ts/classes.fileharness.ts

@@ -99,9 +99,10 @@ export abstract class FileHarness implements IAuthHarness {
    * Credential slots that no longer hold the account the last switch wrote.
    *
    * The login can change outside authswitch -- a new native login, or, for a harness that does not pick
-   * up swaps live, a running instance writing its previous login back at its next refresh. The recorded
+   * up swaps live, a request already in flight writing the previous login's own rotation back. The recorded
    * hash detects that the file changed at all; comparing the account distinguishes the benign case -- the
-   * switched-in account rotating its own token -- from a different account. Detection is advisory and
+   * switched-in account rotating its own token -- from a different account. A rotation authswitch performed
+   * itself is not drift at all: `recordRenewal` moves the record onto it. Detection is advisory and
    * never turns a read into a failure.
    */
   private credentialDrift(snapshotArg: IFileHarnessSnapshot): IHarnessCredentialDrift[] {
@@ -127,14 +128,18 @@ export abstract class FileHarness implements IAuthHarness {
   private savedLabel(accountIdArg: string): string | null {
     try { return this.store.read(accountIdArg).label; } catch { return null; }
   }
-  /** Instances that keep a replaced or cleared login in memory until they are restarted; none for a live-swap harness. */
+  /** How a running instance still holds the previous login and can write it back; stated per harness. */
+  protected runningRetention(): string {
+    return 'They keep the previous login in memory until they are restarted, and a token refresh by one of them can ';
+  }
+  /** Instances that can still write a replaced or cleared login back; none for a live-swap harness. */
   private runningCaveat(kindArg: 'replaced' | 'cleared'): string[] {
     if (this.liveSwap) return [];
     let count: number;
     try { count = this.processes.list().length; }
     catch { return [`Could not check for running ${this.label} processes. If any are running, restart them: an unrestarted instance can write its previous login back.`]; }
     if (!count) return [];
-    return [`${count} ${this.label} process(es) are still running. They keep the previous login in memory until they are restarted, and a token refresh by one of them can `
+    return [`${count} ${this.label} process(es) are still running. ${this.runningRetention()}`
       + `${kindArg === 'replaced' ? 'overwrite the credential file with the previous account' : 'write the cleared login back into the credential file'}. `
       + `Restart them, then check authswitch ${this.id} active.`];
   }
@@ -154,6 +159,25 @@ export abstract class FileHarness implements IAuthHarness {
       return [];
     } catch { return [`The login was written, but this switch could not be recorded for later credential checks.`]; }
   }
+  /**
+   * Let a slot's switch record follow a credential authswitch itself renewed in place.
+   *
+   * The record must name what authswitch last wrote, or the next read reports authswitch's own rotation as a
+   * login someone else put there -- an account whose identity is its refresh token changes id on every rotation.
+   * A slot no switch armed keeps no record: a renewal never starts watching one. The record is advisory, so an
+   * update that fails costs at most the drift note the next read would have shown anyway; a status read has
+   * nowhere to report it.
+   */
+  protected recordRenewal(slotIdArg: string): void {
+    try {
+      const record = this.store.switchRecords().find(item => item.slotId === slotIdArg);
+      const active = this.snapshot().accounts.find(account => account.slotId === slotIdArg);
+      if (!record || !active) return;
+      // The switch time stays the switch time: a renewal changes what the record names, not when the login was put there.
+      this.store.recordSwitch({ slotId: slotIdArg, accountId: this.store.id(active.slotId, active.identity),
+        credentialHash: credentialHash(JSON.stringify(active.credential)), switchedAt: record.switchedAt });
+    } catch { /* Advisory state only. */ }
+  }
   /** The active login with this account id, read from the native files; undefined when the account is not active. */
   protected activeCredential(id: string): IFileAccount | undefined {
     return this.snapshot().accounts.find(account => this.store.id(account.slotId, account.identity) === id);
@@ -162,10 +186,6 @@ export abstract class FileHarness implements IAuthHarness {
   protected savedCredential(id: string): IFileAccount {
     return this.saved(this.store.read(id));
   }
-  /** The account's current credential: the active login when it is active, which may be newer than its saved copy. */
-  protected readCredential(id: string): IFileAccount {
-    return this.activeCredential(id) ?? this.savedCredential(id);
-  }
   /** Save a newly authenticated credential without changing a native harness's login. */
   public importCredential(slotId: string, credential: Record<string, unknown>): Promise<{ accountId: string }> {
     return this.store.locked(() => ({ accountId: this.store.save(this.inspect(credential, slotId)).id }));

package/ts/classes.opencodeanthropicrefresh.ts

@@ -0,0 +1,64 @@
+import { credentialText } from './classes.credentialstore.js';
+import { claudeRequest, ClaudeLoginRejectedError, ClaudeRequestError, oauthErrorCode } from './claudehttp.js';
+
+/** The token endpoint `opencode-anthropic-auth` 0.0.13 renews an OpenCode `anthropic` login at (`index.mjs`). */
+const TOKEN_URL = 'https://console.anthropic.com/v1/oauth/token';
+/** The OAuth client that plugin sends, Claude Code's public one (`CLIENT_ID`, `index.mjs`). */
+const CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
+/**
+ * How long one renewal may take. A renewal is never cut shorter than that, nor cancelled once sent: the service may
+ * already have replaced the refresh token the request carries.
+ */
+const REFRESH_TIMEOUT_MS = 30_000;
+
+/** The token fields OpenCode keeps for an OAuth login, as one renewal replaces them. */
+export interface IOpenCodeAnthropicTokens {
+  access: string;
+  refresh: string;
+  /** Milliseconds since the epoch, as OpenCode stores them. */
+  expires: number;
+}
+
+const seconds = (valueArg: unknown): number | undefined =>
+  typeof valueArg === 'number' && Number.isFinite(valueArg) && valueArg >= 0 ? valueArg : undefined;
+
+/**
+ * Renews an OpenCode `anthropic` OAuth login with the request OpenCode's own Anthropic provider sends for it.
+ *
+ * `opencode-anthropic-auth` 0.0.13 -- the plugin that gives OpenCode 1.18.x its `anthropic` OAuth provider; the
+ * binary carries no Anthropic OAuth code of its own -- posts a JSON body of `grant_type`, `refresh_token` and
+ * Claude Code's public client to `console.anthropic.com`, with no scope, and stores `{access, refresh, expires}`
+ * from the answer. This sends exactly that request, so a login renewed here is renewed the way OpenCode renews it.
+ *
+ * It only talks to the token endpoint; which login is renewed, and where the rotated pair is written, belongs to
+ * the harness.
+ */
+export class OpenCodeAnthropicRefresh {
+  constructor(private readonly fetcher: typeof fetch = globalThis.fetch, private readonly now: () => number = Date.now) {}
+
+  /**
+   * New tokens for the login. A response without a refresh token keeps the one that was sent, as the service's own
+   * answer to a grant it did not rotate. Throws `ClaudeRequestError` with a fixed diagnostic; a grant the service
+   * rejects is `ClaudeLoginRejectedError`, and a rate limit is `ClaudeRateLimitError`.
+   */
+  public async refresh(refreshTokenArg: string): Promise<IOpenCodeAnthropicTokens> {
+    const { status, body } = await claudeRequest(this.fetcher, {
+      url: TOKEN_URL, method: 'POST', headers: { 'Content-Type': 'application/json' }, subject: 'Claude sign-in',
+      body: JSON.stringify({ grant_type: 'refresh_token', refresh_token: refreshTokenArg, client_id: CLIENT_ID }),
+      timeoutMs: REFRESH_TIMEOUT_MS, readErrorBody: true, now: this.now,
+    });
+    if ((status === 400 || status === 401) && oauthErrorCode(body) === 'invalid_grant') throw new ClaudeLoginRejectedError();
+    if (status < 200 || status > 299) throw new ClaudeRequestError(`The Claude sign-in service returned HTTP ${status}.`);
+    const receivedAt = this.now();
+    const access = credentialText(body?.access_token);
+    const tokenType = body?.token_type;
+    const expiresIn = seconds(body?.expires_in);
+    const rotated = body?.refresh_token == null ? null : credentialText(body.refresh_token);
+    // Only a response every field of the stored entry can be taken from is written back into a file OpenCode owns.
+    if (!access || (tokenType != null && (typeof tokenType !== 'string' || tokenType.toLowerCase() !== 'bearer'))
+      || expiresIn === undefined || rotated === undefined) {
+      throw new ClaudeRequestError('The Claude sign-in service returned an unsupported token response; the stored login was not changed.');
+    }
+    return { access, refresh: rotated ?? refreshTokenArg, expires: receivedAt + expiresIn * 1000 };
+  }
+}

package/ts/classes.opencodeharness.ts

@@ -2,7 +2,11 @@ import * as plugins from './plugins.js';
 import { FileHarness, type IFileAccount, type IFileHarnessSnapshot } from './classes.fileharness.js';
 import { CredentialStore, credentialHash, credentialRecord, credentialText, readCredentialDocument, readCredentialRaw } from './classes.credentialstore.js';
 import { HarnessProcesses } from './classes.harnessprocesses.js';
+import { ClaudeAccountStatus } from './classes.claudestatus.js';
+import { CLAUDE_REFRESH_MARGIN_MS } from './classes.claudetokenrefresh.js';
+import { ClaudeLoginRejectedError, ClaudeRateLimitError } from './claudehttp.js';
 import { CodexAccountStatus } from './classes.codexstatus.js';
+import { OpenCodeAnthropicRefresh } from './classes.opencodeanthropicrefresh.js';
 import { writeSecretFileAtomically } from './helpers.js';
 import type { IHarnessAccountStatus, IHarnessLoginOptions, IHarnessLoginProvider, IHarnessProcessControl, IHarnessStatusOptions } from './interfaces.harness.js';
 import { beginSavedOpenAiLogin, openCodeCredentialFromLogin } from './classes.login.js';
@@ -15,8 +19,15 @@ export interface IOpenCodeHarnessOptions {
   fetch?: typeof fetch;
   /** Running-instance inspection, injectable for isolated installations and tests. */
   processes?: IHarnessProcessControl;
+  /** The clock that decides whether a provider's stored access token is still usable; `Date.now` by default. */
+  now?: () => number;
 }
 
+/** Anthropic refused the grant OpenCode's entry holds; no retry and no other account changes that answer. */
+const ANTHROPIC_LOGIN_REJECTED = 'Login expired or was rejected. Log in again with opencode auth login.';
+/** A saved copy is not the login OpenCode uses, so renewing it would rotate a token OpenCode's own entry still holds. */
+const SAVED_ANTHROPIC_EXPIRED = 'This saved Anthropic login\'s access token has expired. authswitch renews the Anthropic login OpenCode has active; activate this one to have it renewed, or log in again with opencode auth login.';
+
 /** OpenCode owns one login per provider. Replacing a slot never replaces the whole provider set. */
 export class OpenCodeHarness extends FileHarness {
   public readonly id = 'opencode';
@@ -26,13 +37,20 @@ export class OpenCodeHarness extends FileHarness {
   public readonly liveSwap = false;
   /** Only its OpenAI login reports usage, and a supervisor (AGL) restarts it around a switch, so a watch leaves it alone. */
   public readonly autoSwitch = false;
+  /** OpenCode re-reads its credential file on every request; only a request already in flight still holds the previous login. */
+  protected override runningRetention(): string {
+    return 'They re-read the credential file on every request, but a request already in flight still holds the previous login, and its token refresh can ';
+  }
   public readonly loginProviders: IHarnessLoginProvider[] = [{ providerId: 'openai', label: 'OpenAI', flows: ['device'] }];
   protected readonly store: CredentialStore;
   private readonly file: string;
   private readonly env: NodeJS.ProcessEnv;
   private readonly status: CodexAccountStatus;
+  private readonly claudeStatus: ClaudeAccountStatus;
+  private readonly anthropicRefresh: OpenCodeAnthropicRefresh;
   public readonly processes: IHarnessProcessControl;
   private readonly fetcher?: typeof fetch;
+  private readonly now: () => number;
 
   constructor(options: IOpenCodeHarnessOptions = {}) {
     super();
@@ -40,7 +58,10 @@ export class OpenCodeHarness extends FileHarness {
     this.file = plugins.path.join(options.dataHome ?? (this.env.XDG_DATA_HOME || plugins.path.join(plugins.os.homedir(), '.local', 'share')), 'opencode', 'auth.json');
     this.store = new CredentialStore(this.id, options.stashRoot);
     this.status = new CodexAccountStatus(options.fetch);
+    this.claudeStatus = new ClaudeAccountStatus(options.fetch, options.now);
+    this.anthropicRefresh = new OpenCodeAnthropicRefresh(options.fetch, options.now);
     this.fetcher = options.fetch;
+    this.now = options.now ?? Date.now;
     this.processes = options.processes ?? new HarnessProcesses('opencode');
   }
   /** Every provider entry lives in one file, so its bytes are the whole stability proof. */
@@ -104,13 +125,87 @@ export class OpenCodeHarness extends FileHarness {
     writeSecretFileAtomically(this.file, raw);
     if (readCredentialDocument(this.file).raw !== raw) throw new Error('Active login verification failed. The outgoing login remains saved.');
   }
-  public async readAccountStatus(id: string, optionsArg?: IHarnessStatusOptions): Promise<IHarnessAccountStatus> {
-    const account = this.readCredential(id);
+  /** The login OpenCode has in a provider slot, read from its file; undefined where the file holds none it can read. */
+  private activeSlot(slotIdArg: string): IFileAccount | undefined {
+    return this.snapshot().accounts.find(account => account.slotId === slotIdArg);
+  }
+  /** Whether this login's access token is inside Claude Code's five-minute margin, the margin Claude's own logins use. */
+  private renewalDue(credentialArg: Record<string, unknown>): boolean {
+    const expires = credentialArg.expires;
+    return typeof expires === 'number' && Number.isFinite(expires) && this.now() + CLAUDE_REFRESH_MARGIN_MS >= expires;
+  }
+
+  /**
+   * Renews OpenCode's active Anthropic login and writes the rotated pair back into OpenCode's own credential file.
+   *
+   * Nothing is stranded by that write. OpenCode's auth service reads `auth.json` on every `Auth.all()`, `Auth.get()`
+   * is that read (1.18.15 @99100961, 1.18.31 @103733929), and its Anthropic provider -- `opencode-anthropic-auth`
+   * 0.0.13, since the binary carries no Anthropic OAuth code -- calls the `getAuth()` it was initialised with
+   * (@98017331) inside the `fetch` wrapper of every single request. A running OpenCode therefore holds no refresh
+   * token in memory and picks up this rotation on its next request, exactly as it picks up its own.
+   *
+   * The renewal is the only authswitch operation on the store while it runs, and the rotated pair replaces the
+   * entry only while OpenCode still holds the refresh token that was sent: a login OpenCode renewed meanwhile is
+   * returned as it now stands. The write itself is `apply`'s verified compare-and-swap, which preserves every other
+   * provider and replaces the file atomically -- OpenCode writes the same file in place. The slot's switch record
+   * follows that write, because an `anthropic` login's identity is its refresh token and this rotation is
+   * authswitch's own: without that, the next read would report this write as a different account.
+   */
+  private renewAnthropic(accountArg: IFileAccount, signalArg?: AbortSignal): Promise<IFileAccount> {
+    return this.store.locked(async () => {
+      const current = this.activeSlot(accountArg.slotId) ?? accountArg;
+      if (!this.renewalDue(current.credential)) return current;
+      const refreshToken = credentialText(current.credential.refresh);
+      if (refreshToken === undefined) throw new Error('This Anthropic login holds no refresh token; log in again with opencode auth login.');
+      signalArg?.throwIfAborted();
+      const tokens = await this.anthropicRefresh.refresh(refreshToken);
+      const latest = this.activeSlot(accountArg.slotId);
+      if (!latest || credentialText(latest.credential.refresh) !== refreshToken) return latest ?? current;
+      const renewed = this.inspect({ ...latest.credential, access: tokens.access, refresh: tokens.refresh, expires: tokens.expires }, latest.slotId);
+      this.apply(latest.slotId, latest, renewed);
+      this.recordRenewal(latest.slotId);
+      return renewed;
+    }, { signal: signalArg });
+  }
+
+  /**
+   * The subscription and usage of an OpenCode `anthropic` OAuth login.
+   *
+   * That entry holds the same Claude subscriber grant Claude Code stores, so Claude's own account endpoints answer
+   * for it and the account reports real windows instead of no quota API at all. OpenCode keeps no scopes and no
+   * account identity with it, so the service decides both. A due access token is renewed first, with OpenCode's own
+   * request; a refusal is reported and nothing is written, so the entry OpenCode owns is left exactly as it was.
+   *
+   * A saved copy is never renewed: OpenCode's entry holds the same refresh token, and rotating it here would leave
+   * the login OpenCode actually uses holding a token the service has replaced.
+   */
+  private async anthropicStatus(accountArg: IFileAccount, isActiveArg: boolean, optionsArg: IHarnessStatusOptions): Promise<IHarnessAccountStatus> {
+    let account = accountArg;
+    if (this.renewalDue(account.credential)) {
+      if (!isActiveArg) return this.claudeStatus.unavailable({}, SAVED_ANTHROPIC_EXPIRED);
+      try { account = await this.renewAnthropic(account, optionsArg.signal); }
+      catch (error) {
+        if (optionsArg.signal?.aborted) throw error;
+        const problem = error instanceof ClaudeLoginRejectedError ? ANTHROPIC_LOGIN_REJECTED
+          : error instanceof Error ? error.message : 'the login could not be renewed.';
+        return this.claudeStatus.unavailable({}, `Login refresh: ${problem}`,
+          error instanceof ClaudeRateLimitError ? { retryAt: error.retryAt } : undefined);
+      }
+    }
+    const accessToken = credentialText(account.credential.access);
+    if (accessToken === undefined) return this.claudeStatus.unavailable({}, 'This Anthropic login holds no usable access token; log in again with opencode auth login.');
+    return this.claudeStatus.read({ accessToken, scopes: [] }, optionsArg);
+  }
+
+  public async readAccountStatus(id: string, optionsArg: IHarnessStatusOptions = {}): Promise<IHarnessAccountStatus> {
+    const active = this.activeCredential(id);
+    const account = active ?? this.savedCredential(id);
     if (account.slotId === 'openai' && account.credential.type === 'oauth') {
       const info = this.openAiInfo(account.credential);
       if (!info.accountId) return { facts: [], problems: ['The OpenAI login has no account ID for a status lookup.'] };
       return this.status.readCredential(credentialText(account.credential.access)!, info.accountId, info.plan, optionsArg);
     }
+    if (account.slotId === 'anthropic' && account.credential.type === 'oauth') return this.anthropicStatus(account, active !== undefined, optionsArg);
     return { facts: [
       { section: 'Authentication', label: 'Provider', value: account.slotId },
       { section: 'Authentication', label: 'Login type', value: String(account.credential.type) },

package/ts/claudehttp.ts

@@ -13,6 +13,28 @@ export class ClaudeLoginRejectedError extends ClaudeRequestError {
   constructor() { super(CLAUDE_LOGIN_REJECTED); }
 }
 
+/**
+ * Where Claude Code 2.1.273 sends an account the service put on hold (`T5e`, bundle offset @190070402). A hold is
+ * not a dead login: the service refuses the grant while it lasts and accepts it again once it is lifted.
+ */
+export const CLAUDE_ACCOUNT_ON_HOLD_URL = 'https://claude.ai/restricted';
+
+/** The service put this account on hold. The login itself is intact, so it is never remembered as refused. */
+export class ClaudeAccountOnHoldError extends ClaudeRequestError {
+  constructor() { super(`This Claude account is on hold and cannot sign in. View details or appeal: ${CLAUDE_ACCOUNT_ON_HOLD_URL}`); }
+}
+
+/**
+ * The OAuth error code a response names, read as Claude Code 2.1.273 reads it (`xc`, @191165290): the `error` field
+ * as a string, or the `type` of the object some Anthropic endpoints send it as.
+ */
+export const oauthErrorCode = (bodyArg: Record<string, unknown> | null): string | undefined => {
+  const error = bodyArg?.error;
+  if (typeof error === 'string') return error;
+  const type = typeof error === 'object' && error !== null ? (error as Record<string, unknown>).type : undefined;
+  return typeof type === 'string' ? type : undefined;
+};
+
 /** The service refused a request for too many requests. That says nothing about the account's usage or login. */
 export class ClaudeRateLimitError extends ClaudeRequestError {
   constructor(subjectArg: string, public readonly retryAt: string | null) {

package/ts/interfaces.harness.ts

@@ -239,9 +239,13 @@ export interface IAuthHarness {
    */
   readonly autoSwitch?: boolean;
   /**
-   * The account's live status. It must never activate, switch or clear a login. It may renew the tokens of the
-   * saved copy it reads when the provider leaves it no other way to answer -- the Claude Code adapter does, for
-   * saved and inactive logins only, under its store's lock -- and must leave the active login's credential alone.
+   * The account's live status. It must never activate, switch or clear a login.
+   *
+   * It may renew the tokens of the credential it reads when the provider leaves it no other way to answer, under
+   * its store's lock and with a compare-and-swap on the refresh token it sent. A saved copy is always its own to
+   * renew -- the Claude Code adapter renews one, because Claude Code's active login is Claude Code's. The active
+   * login may only be renewed where the owning harness re-reads its credential file on every request, so that the
+   * rotation strands nothing: OpenCode's Anthropic provider does, and authswitch renews that entry.
    */
   readAccountStatus(accountIdArg: string, optionsArg?: IHarnessStatusOptions): Promise<IHarnessAccountStatus>;
   readonly loginProviders?: IHarnessLoginProvider[];