@modelprofile.com/authswitch 6.0.0 → 6.1.0

package/ts/classes.opencodeharness.ts

@@ -4,7 +4,9 @@ import { CredentialStore, credentialHash, credentialRecord, credentialText, read
 import { HarnessProcesses } from './classes.harnessprocesses.js';
 import { ClaudeAccountStatus } from './classes.claudestatus.js';
 import { CLAUDE_REFRESH_MARGIN_MS } from './classes.claudetokenrefresh.js';
+import { ClaudeLoginRejectedError, ClaudeRateLimitError } from './claudehttp.js';
 import { CodexAccountStatus } from './classes.codexstatus.js';
+import { OpenCodeAnthropicRefresh } from './classes.opencodeanthropicrefresh.js';
 import { writeSecretFileAtomically } from './helpers.js';
 import type { IHarnessAccountStatus, IHarnessLoginOptions, IHarnessLoginProvider, IHarnessProcessControl, IHarnessStatusOptions } from './interfaces.harness.js';
 import { beginSavedOpenAiLogin, openCodeCredentialFromLogin } from './classes.login.js';
@@ -21,6 +23,11 @@ export interface IOpenCodeHarnessOptions {
   now?: () => number;
 }
 
+/** Anthropic refused the grant OpenCode's entry holds; no retry and no other account changes that answer. */
+const ANTHROPIC_LOGIN_REJECTED = 'Login expired or was rejected. Log in again with opencode auth login.';
+/** A saved copy is not the login OpenCode uses, so renewing it would rotate a token OpenCode's own entry still holds. */
+const SAVED_ANTHROPIC_EXPIRED = 'This saved Anthropic login\'s access token has expired. authswitch renews the Anthropic login OpenCode has active; activate this one to have it renewed, or log in again with opencode auth login.';
+
 /** OpenCode owns one login per provider. Replacing a slot never replaces the whole provider set. */
 export class OpenCodeHarness extends FileHarness {
   public readonly id = 'opencode';
@@ -30,12 +37,17 @@ export class OpenCodeHarness extends FileHarness {
   public readonly liveSwap = false;
   /** Only its OpenAI login reports usage, and a supervisor (AGL) restarts it around a switch, so a watch leaves it alone. */
   public readonly autoSwitch = false;
+  /** OpenCode re-reads its credential file on every request; only a request already in flight still holds the previous login. */
+  protected override runningRetention(): string {
+    return 'They re-read the credential file on every request, but a request already in flight still holds the previous login, and its token refresh can ';
+  }
   public readonly loginProviders: IHarnessLoginProvider[] = [{ providerId: 'openai', label: 'OpenAI', flows: ['device'] }];
   protected readonly store: CredentialStore;
   private readonly file: string;
   private readonly env: NodeJS.ProcessEnv;
   private readonly status: CodexAccountStatus;
   private readonly claudeStatus: ClaudeAccountStatus;
+  private readonly anthropicRefresh: OpenCodeAnthropicRefresh;
   public readonly processes: IHarnessProcessControl;
   private readonly fetcher?: typeof fetch;
   private readonly now: () => number;
@@ -47,6 +59,7 @@ export class OpenCodeHarness extends FileHarness {
     this.store = new CredentialStore(this.id, options.stashRoot);
     this.status = new CodexAccountStatus(options.fetch);
     this.claudeStatus = new ClaudeAccountStatus(options.fetch, options.now);
+    this.anthropicRefresh = new OpenCodeAnthropicRefresh(options.fetch, options.now);
     this.fetcher = options.fetch;
     this.now = options.now ?? Date.now;
     this.processes = options.processes ?? new HarnessProcesses('opencode');
@@ -112,35 +125,87 @@ export class OpenCodeHarness extends FileHarness {
     writeSecretFileAtomically(this.file, raw);
     if (readCredentialDocument(this.file).raw !== raw) throw new Error('Active login verification failed. The outgoing login remains saved.');
   }
+  /** The login OpenCode has in a provider slot, read from its file; undefined where the file holds none it can read. */
+  private activeSlot(slotIdArg: string): IFileAccount | undefined {
+    return this.snapshot().accounts.find(account => account.slotId === slotIdArg);
+  }
+  /** Whether this login's access token is inside Claude Code's five-minute margin, the margin Claude's own logins use. */
+  private renewalDue(credentialArg: Record<string, unknown>): boolean {
+    const expires = credentialArg.expires;
+    return typeof expires === 'number' && Number.isFinite(expires) && this.now() + CLAUDE_REFRESH_MARGIN_MS >= expires;
+  }
+
+  /**
+   * Renews OpenCode's active Anthropic login and writes the rotated pair back into OpenCode's own credential file.
+   *
+   * Nothing is stranded by that write. OpenCode's auth service reads `auth.json` on every `Auth.all()`, `Auth.get()`
+   * is that read (1.18.15 @99100961, 1.18.31 @103733929), and its Anthropic provider -- `opencode-anthropic-auth`
+   * 0.0.13, since the binary carries no Anthropic OAuth code -- calls the `getAuth()` it was initialised with
+   * (@98017331) inside the `fetch` wrapper of every single request. A running OpenCode therefore holds no refresh
+   * token in memory and picks up this rotation on its next request, exactly as it picks up its own.
+   *
+   * The renewal is the only authswitch operation on the store while it runs, and the rotated pair replaces the
+   * entry only while OpenCode still holds the refresh token that was sent: a login OpenCode renewed meanwhile is
+   * returned as it now stands. The write itself is `apply`'s verified compare-and-swap, which preserves every other
+   * provider and replaces the file atomically -- OpenCode writes the same file in place. The slot's switch record
+   * follows that write, because an `anthropic` login's identity is its refresh token and this rotation is
+   * authswitch's own: without that, the next read would report this write as a different account.
+   */
+  private renewAnthropic(accountArg: IFileAccount, signalArg?: AbortSignal): Promise<IFileAccount> {
+    return this.store.locked(async () => {
+      const current = this.activeSlot(accountArg.slotId) ?? accountArg;
+      if (!this.renewalDue(current.credential)) return current;
+      const refreshToken = credentialText(current.credential.refresh);
+      if (refreshToken === undefined) throw new Error('This Anthropic login holds no refresh token; log in again with opencode auth login.');
+      signalArg?.throwIfAborted();
+      const tokens = await this.anthropicRefresh.refresh(refreshToken);
+      const latest = this.activeSlot(accountArg.slotId);
+      if (!latest || credentialText(latest.credential.refresh) !== refreshToken) return latest ?? current;
+      const renewed = this.inspect({ ...latest.credential, access: tokens.access, refresh: tokens.refresh, expires: tokens.expires }, latest.slotId);
+      this.apply(latest.slotId, latest, renewed);
+      this.recordRenewal(latest.slotId);
+      return renewed;
+    }, { signal: signalArg });
+  }
+
   /**
    * The subscription and usage of an OpenCode `anthropic` OAuth login.
    *
    * That entry holds the same Claude subscriber grant Claude Code stores, so Claude's own account endpoints answer
    * for it and the account reports real windows instead of no quota API at all. OpenCode keeps no scopes and no
-   * account identity with it, so the service decides both; the token is used exactly as stored. Renewing it is
-   * OpenCode's, because the renewal rotates the refresh token a running OpenCode holds in memory, and authswitch
-   * cannot write that rotation into an instance it does not manage.
+   * account identity with it, so the service decides both. A due access token is renewed first, with OpenCode's own
+   * request; a refusal is reported and nothing is written, so the entry OpenCode owns is left exactly as it was.
+   *
+   * A saved copy is never renewed: OpenCode's entry holds the same refresh token, and rotating it here would leave
+   * the login OpenCode actually uses holding a token the service has replaced.
    */
-  private anthropicStatus(credentialArg: Record<string, unknown>, optionsArg?: IHarnessStatusOptions): Promise<IHarnessAccountStatus> {
-    const accessToken = credentialText(credentialArg.access);
-    const expires = credentialArg.expires;
-    if (accessToken === undefined || typeof expires !== 'number') {
-      return Promise.resolve(this.claudeStatus.unavailable({}, 'This Anthropic login holds no usable access token; log in again with opencode auth login.'));
-    }
-    if (this.now() + CLAUDE_REFRESH_MARGIN_MS >= expires) {
-      return Promise.resolve(this.claudeStatus.unavailable({}, 'This Anthropic login\'s access token has expired. OpenCode renews it while it runs; authswitch does not, because the renewal rotates the refresh token a running OpenCode keeps in memory. Start OpenCode, or log in again with opencode auth login.'));
+  private async anthropicStatus(accountArg: IFileAccount, isActiveArg: boolean, optionsArg: IHarnessStatusOptions): Promise<IHarnessAccountStatus> {
+    let account = accountArg;
+    if (this.renewalDue(account.credential)) {
+      if (!isActiveArg) return this.claudeStatus.unavailable({}, SAVED_ANTHROPIC_EXPIRED);
+      try { account = await this.renewAnthropic(account, optionsArg.signal); }
+      catch (error) {
+        if (optionsArg.signal?.aborted) throw error;
+        const problem = error instanceof ClaudeLoginRejectedError ? ANTHROPIC_LOGIN_REJECTED
+          : error instanceof Error ? error.message : 'the login could not be renewed.';
+        return this.claudeStatus.unavailable({}, `Login refresh: ${problem}`,
+          error instanceof ClaudeRateLimitError ? { retryAt: error.retryAt } : undefined);
+      }
     }
+    const accessToken = credentialText(account.credential.access);
+    if (accessToken === undefined) return this.claudeStatus.unavailable({}, 'This Anthropic login holds no usable access token; log in again with opencode auth login.');
     return this.claudeStatus.read({ accessToken, scopes: [] }, optionsArg);
   }
 
-  public async readAccountStatus(id: string, optionsArg?: IHarnessStatusOptions): Promise<IHarnessAccountStatus> {
-    const account = this.readCredential(id);
+  public async readAccountStatus(id: string, optionsArg: IHarnessStatusOptions = {}): Promise<IHarnessAccountStatus> {
+    const active = this.activeCredential(id);
+    const account = active ?? this.savedCredential(id);
     if (account.slotId === 'openai' && account.credential.type === 'oauth') {
       const info = this.openAiInfo(account.credential);
       if (!info.accountId) return { facts: [], problems: ['The OpenAI login has no account ID for a status lookup.'] };
       return this.status.readCredential(credentialText(account.credential.access)!, info.accountId, info.plan, optionsArg);
     }
-    if (account.slotId === 'anthropic' && account.credential.type === 'oauth') return this.anthropicStatus(account.credential, optionsArg);
+    if (account.slotId === 'anthropic' && account.credential.type === 'oauth') return this.anthropicStatus(account, active !== undefined, optionsArg);
     return { facts: [
       { section: 'Authentication', label: 'Provider', value: account.slotId },
       { section: 'Authentication', label: 'Login type', value: String(account.credential.type) },

package/ts/interfaces.harness.ts

@@ -239,9 +239,13 @@ export interface IAuthHarness {
    */
   readonly autoSwitch?: boolean;
   /**
-   * The account's live status. It must never activate, switch or clear a login. It may renew the tokens of the
-   * saved copy it reads when the provider leaves it no other way to answer -- the Claude Code adapter does, for
-   * saved and inactive logins only, under its store's lock -- and must leave the active login's credential alone.
+   * The account's live status. It must never activate, switch or clear a login.
+   *
+   * It may renew the tokens of the credential it reads when the provider leaves it no other way to answer, under
+   * its store's lock and with a compare-and-swap on the refresh token it sent. A saved copy is always its own to
+   * renew -- the Claude Code adapter renews one, because Claude Code's active login is Claude Code's. The active
+   * login may only be renewed where the owning harness re-reads its credential file on every request, so that the
+   * rotation strands nothing: OpenCode's Anthropic provider does, and authswitch renews that entry.
    */
   readAccountStatus(accountIdArg: string, optionsArg?: IHarnessStatusOptions): Promise<IHarnessAccountStatus>;
   readonly loginProviders?: IHarnessLoginProvider[];