@moxxy/plugin-provider-anthropic 0.2.0

package/src/oauth-refresh.test.ts

@@ -0,0 +1,310 @@
+import { describe, it, expect } from 'vitest';
+import type Anthropic from '@anthropic-ai/sdk';
+import type { ProviderEvent, ProviderRequest } from '@moxxy/sdk';
+import { AnthropicProvider } from './provider.js';
+
+/**
+ * Coverage for the OAuth token-refresh paths in provider.ts:
+ *  - ensureFreshOauth()  : proactive near-expiry refresh BEFORE the request.
+ *  - 401 -> refreshOauthNow() -> replay : reactive single refresh + replay.
+ *  - refresh-failure surfacing without an infinite replay loop.
+ *
+ * Harness notes
+ * -------------
+ * `refreshOauthNow()` rebuilds `this.client` via the PRIVATE `makeOauthClient`,
+ * which constructs a REAL `Anthropic` SDK client. To keep every attempt routed
+ * at our fake (and off the network) across a refresh, we stub `makeOauthClient`
+ * on the instance so it returns the fake — faithfully exercising the real
+ * "refresh -> rebuild client -> replay" flow while staying offline. Reaching
+ * into a private member for TEST SETUP mirrors the existing oauth-mode.test.ts
+ * pattern (which casts to read `client`); production code is never touched.
+ */
+
+/** Install the fake on a provider, including across refresh-driven client rebuilds. */
+function pinClient(p: AnthropicProvider, client: Anthropic): void {
+  const internals = p as unknown as {
+    client: Anthropic;
+    makeOauthClient: (token: string) => Anthropic;
+  };
+  internals.client = client;
+  internals.makeOauthClient = () => client;
+}
+
+const DONE_EVENTS = [
+  { type: 'message_start', message: { usage: { input_tokens: 1, output_tokens: 0 } } },
+  { type: 'message_delta', delta: { stop_reason: 'end_turn' }, usage: { output_tokens: 2 } },
+  { type: 'message_stop' },
+];
+
+/** An error shaped like the Anthropic SDK's APIError for a 401 (carries `status`). */
+function unauthorizedError(): Error {
+  return Object.assign(new Error('Unauthorized'), { status: 401 });
+}
+
+interface FakeClient {
+  client: Anthropic;
+  /** Number of times `messages.stream` was invoked (i.e. request attempts). */
+  streamCalls: number;
+}
+
+/**
+ * A fake SDK client whose `messages.stream` behaviour is driven by a per-call
+ * factory. The factory receives the 1-based attempt number and returns either
+ * the events to yield (success) or throws (transport/HTTP error).
+ */
+function fakeClient(
+  perAttempt: (attempt: number) => ReadonlyArray<unknown>,
+): FakeClient {
+  const state: FakeClient = { client: undefined as unknown as Anthropic, streamCalls: 0 };
+  state.client = {
+    messages: {
+      stream: () => {
+        state.streamCalls += 1;
+        const attempt = state.streamCalls;
+        // Resolve the events eagerly so a thrown error surfaces from the
+        // generator body (matching how the SDK throws mid-iteration).
+        return (async function* () {
+          const events = perAttempt(attempt);
+          for (const e of events) yield e;
+        })();
+      },
+    },
+  } as unknown as Anthropic;
+  return state;
+}
+
+async function drain(it: AsyncIterable<ProviderEvent>): Promise<ProviderEvent[]> {
+  const out: ProviderEvent[] = [];
+  for await (const e of it) out.push(e);
+  return out;
+}
+
+const baseReq: ProviderRequest = {
+  model: 'claude-x',
+  messages: [{ role: 'user', content: [{ type: 'text', text: 'hi' }] }],
+};
+
+describe('AnthropicProvider OAuth token refresh', () => {
+  it('proactively refreshes a near-expiry token before the request', async () => {
+    const fake = fakeClient(() => DONE_EVENTS);
+    let refreshCalls = 0;
+    const refreshedAt = Date.now() + 3_600_000;
+
+    const p = new AnthropicProvider({
+      oauthToken: 'tok-old',
+      oauthExpiresAt: Date.now() + 10_000, // inside the 60s skew window -> refresh
+      oauthRefresh: async () => {
+        refreshCalls += 1;
+        return { token: 'tok-new', expiresAt: refreshedAt };
+      },
+      client: fake.client,
+    });
+    pinClient(p, fake.client);
+
+    const out = await drain(p.stream(baseReq));
+
+    expect(refreshCalls).toBe(1);
+    // The provider swapped in the new bearer and recorded the new expiry.
+    const internals = p as unknown as { oauthToken?: string; oauthExpiresAt?: number };
+    expect(internals.oauthToken).toBe('tok-new');
+    expect(internals.oauthExpiresAt).toBe(refreshedAt);
+    // Exactly one request attempt, ending cleanly.
+    expect(fake.streamCalls).toBe(1);
+    expect(out.filter((e) => e.type === 'message_start')).toHaveLength(1);
+    expect(out.at(-1)).toMatchObject({ type: 'message_end', stopReason: 'end_turn' });
+    expect(out.some((e) => e.type === 'error')).toBe(false);
+  });
+
+  it('does NOT refresh a token that is comfortably fresh', async () => {
+    const fake = fakeClient(() => DONE_EVENTS);
+    let refreshCalls = 0;
+    const p = new AnthropicProvider({
+      oauthToken: 'tok-fresh',
+      oauthExpiresAt: Date.now() + 3_600_000, // far outside the skew window
+      oauthRefresh: async () => {
+        refreshCalls += 1;
+        return { token: 'tok-new' };
+      },
+      client: fake.client,
+    });
+    pinClient(p, fake.client);
+
+    const out = await drain(p.stream(baseReq));
+
+    expect(refreshCalls).toBe(0);
+    expect(fake.streamCalls).toBe(1);
+    expect(out.at(-1)).toMatchObject({ type: 'message_end' });
+  });
+
+  it('on a 401 refreshes once and replays, emitting exactly one message_start/message_end', async () => {
+    // First attempt 401s; second attempt (post-refresh) succeeds.
+    const fake = fakeClient((attempt) => {
+      if (attempt === 1) throw unauthorizedError();
+      return DONE_EVENTS;
+    });
+    let refreshCalls = 0;
+    const p = new AnthropicProvider({
+      oauthToken: 'tok-old',
+      oauthExpiresAt: Date.now() + 3_600_000, // fresh -> no proactive refresh; the 401 drives it
+      oauthRefresh: async () => {
+        refreshCalls += 1;
+        return { token: 'tok-new', expiresAt: Date.now() + 3_600_000 };
+      },
+      client: fake.client,
+    });
+    pinClient(p, fake.client);
+
+    const out = await drain(p.stream(baseReq));
+
+    // Refreshed exactly once; replayed exactly once (two stream attempts total).
+    expect(refreshCalls).toBe(1);
+    expect(fake.streamCalls).toBe(2);
+    expect((p as unknown as { oauthToken?: string }).oauthToken).toBe('tok-new');
+    // The provider yields a single message_start (from stream()) regardless of
+    // the internal replay, and a single terminal message_end from the successful
+    // attempt. No error event on a recovered 401.
+    expect(out.filter((e) => e.type === 'message_start')).toHaveLength(1);
+    expect(out.filter((e) => e.type === 'message_end')).toHaveLength(1);
+    expect(out.some((e) => e.type === 'error')).toBe(false);
+    expect(out.at(-1)).toMatchObject({ type: 'message_end', stopReason: 'end_turn' });
+  });
+
+  it('surfaces a single error and does NOT replay again when the replay also 401s', async () => {
+    // Every attempt 401s. The provider must refresh once, replay once, then
+    // surface the error — never loop.
+    const fake = fakeClient(() => {
+      throw unauthorizedError();
+    });
+    let refreshCalls = 0;
+    const p = new AnthropicProvider({
+      oauthToken: 'tok-old',
+      oauthExpiresAt: Date.now() + 3_600_000,
+      oauthRefresh: async () => {
+        refreshCalls += 1;
+        return { token: 'tok-new' };
+      },
+      client: fake.client,
+    });
+    pinClient(p, fake.client);
+
+    const out = await drain(p.stream(baseReq));
+
+    // Refreshed once, two attempts (original + single replay), then stop.
+    expect(refreshCalls).toBe(1);
+    expect(fake.streamCalls).toBe(2);
+    const errors = out.filter((e) => e.type === 'error');
+    expect(errors).toHaveLength(1);
+    // The terminal event is the error; no second message_end.
+    expect(out.at(-1)).toMatchObject({ type: 'error' });
+    expect(out.filter((e) => e.type === 'message_end')).toHaveLength(0);
+  });
+
+  it('surfaces a clear error when the refresh callback itself throws (no replay)', async () => {
+    const fake = fakeClient((attempt) => {
+      if (attempt === 1) throw unauthorizedError();
+      return DONE_EVENTS;
+    });
+    let refreshCalls = 0;
+    const p = new AnthropicProvider({
+      oauthToken: 'tok-old',
+      oauthExpiresAt: Date.now() + 3_600_000,
+      oauthRefresh: async () => {
+        refreshCalls += 1;
+        throw new Error('refresh endpoint down');
+      },
+      client: fake.client,
+    });
+    pinClient(p, fake.client);
+
+    const out = await drain(p.stream(baseReq));
+
+    // Attempted the refresh once after the 401; it threw, so NO replay attempt.
+    expect(refreshCalls).toBe(1);
+    expect(fake.streamCalls).toBe(1);
+    const errors = out.filter((e): e is Extract<ProviderEvent, { type: 'error' }> => e.type === 'error');
+    expect(errors).toHaveLength(1);
+    expect(errors[0]!.message).toContain('refresh endpoint down');
+    expect(out.filter((e) => e.type === 'message_end')).toHaveLength(0);
+  });
+
+  it('surfaces a clear error when a proactive (pre-request) refresh throws, and does not send a request', async () => {
+    const fake = fakeClient(() => DONE_EVENTS);
+    let refreshCalls = 0;
+    const p = new AnthropicProvider({
+      oauthToken: 'tok-old',
+      oauthExpiresAt: Date.now() + 5_000, // near expiry -> proactive refresh fires
+      oauthRefresh: async () => {
+        refreshCalls += 1;
+        throw new Error('proactive refresh failed');
+      },
+      client: fake.client,
+    });
+    pinClient(p, fake.client);
+
+    const out = await drain(p.stream(baseReq));
+
+    expect(refreshCalls).toBe(1);
+    // Proactive refresh failed before the request — no stream attempt at all.
+    expect(fake.streamCalls).toBe(0);
+    const errors = out.filter((e): e is Extract<ProviderEvent, { type: 'error' }> => e.type === 'error');
+    expect(errors).toHaveLength(1);
+    expect(errors[0]!.message).toContain('proactive refresh failed');
+  });
+
+  it('countTokens proactively refreshes a near-expiry token before counting', async () => {
+    let countCalls = 0;
+    const client = {
+      messages: {
+        countTokens: async () => {
+          countCalls += 1;
+          return { input_tokens: 42 };
+        },
+      },
+    } as unknown as Anthropic;
+    let refreshCalls = 0;
+    const refreshedAt = Date.now() + 3_600_000;
+    const p = new AnthropicProvider({
+      oauthToken: 'tok-old',
+      oauthExpiresAt: Date.now() + 10_000, // inside the 60s skew window -> refresh
+      oauthRefresh: async () => {
+        refreshCalls += 1;
+        return { token: 'tok-new', expiresAt: refreshedAt };
+      },
+      client,
+    });
+    pinClient(p, client);
+
+    const n = await p.countTokens(baseReq);
+
+    expect(n).toBe(42);
+    expect(refreshCalls).toBe(1);
+    expect(countCalls).toBe(1);
+    const internals = p as unknown as { oauthToken?: string; oauthExpiresAt?: number };
+    expect(internals.oauthToken).toBe('tok-new');
+    expect(internals.oauthExpiresAt).toBe(refreshedAt);
+  });
+
+  it('does not refresh on a non-401 error (surfaces it directly, single attempt)', async () => {
+    const serverError = Object.assign(new Error('boom'), { status: 500 });
+    const fake = fakeClient(() => {
+      throw serverError;
+    });
+    let refreshCalls = 0;
+    const p = new AnthropicProvider({
+      oauthToken: 'tok-old',
+      oauthExpiresAt: Date.now() + 3_600_000,
+      oauthRefresh: async () => {
+        refreshCalls += 1;
+        return { token: 'tok-new' };
+      },
+      client: fake.client,
+    });
+    pinClient(p, fake.client);
+
+    const out = await drain(p.stream(baseReq));
+
+    expect(refreshCalls).toBe(0);
+    expect(fake.streamCalls).toBe(1);
+    expect(out.filter((e) => e.type === 'error')).toHaveLength(1);
+  });
+});

package/src/provider.test.ts

@@ -0,0 +1,198 @@
+import { describe, expect, it } from 'vitest';
+import { AnthropicProvider } from './provider.js';
+
+// A minimal fake Anthropic SDK client to drive the translator without HTTP.
+function fakeAnthropic(stream: ReadonlyArray<unknown>): { messages: { stream: () => AsyncIterable<unknown>; countTokens: () => Promise<{ input_tokens: number }> } } {
+  return {
+    messages: {
+      stream: () => {
+        return (async function* () {
+          for (const e of stream) yield e;
+        })();
+      },
+      countTokens: async () => ({ input_tokens: 42 }),
+    },
+  };
+}
+
+describe('AnthropicProvider.stream', () => {
+  it('translates content_block_delta text into text_delta events', async () => {
+    const fake = fakeAnthropic([
+      { type: 'message_start', message: { usage: { input_tokens: 10, output_tokens: 0 } } },
+      { type: 'content_block_delta', delta: { type: 'text_delta', text: 'hi' } },
+      { type: 'message_delta', delta: { stop_reason: 'end_turn' }, usage: { output_tokens: 5 } },
+      { type: 'message_stop' },
+    ]);
+    const p = new AnthropicProvider({ client: fake as never });
+    const events = [];
+    for await (const e of p.stream({ model: 'm', messages: [] })) events.push(e);
+    expect(events[0]).toMatchObject({ type: 'message_start' });
+    expect(events.find((e) => e.type === 'text_delta')).toMatchObject({ delta: 'hi' });
+    expect(events[events.length - 1]).toMatchObject({ type: 'message_end', stopReason: 'end_turn' });
+  });
+
+  it('translates tool_use blocks with streamed input_json', async () => {
+    const fake = fakeAnthropic([
+      { type: 'message_start', message: { usage: { input_tokens: 1, output_tokens: 0 } } },
+      { type: 'content_block_start', content_block: { type: 'tool_use', id: 'c1', name: 'Read' } },
+      { type: 'content_block_delta', delta: { type: 'input_json_delta', partial_json: '{"file' } },
+      { type: 'content_block_delta', delta: { type: 'input_json_delta', partial_json: '_path":"a"}' } },
+      { type: 'content_block_stop' },
+      { type: 'message_delta', delta: { stop_reason: 'tool_use' }, usage: { output_tokens: 2 } },
+      { type: 'message_stop' },
+    ]);
+    const p = new AnthropicProvider({ client: fake as never });
+    const events = [];
+    for await (const e of p.stream({ model: 'm', messages: [] })) events.push(e);
+    const start = events.find((e) => e.type === 'tool_use_start');
+    expect(start).toMatchObject({ id: 'c1', name: 'Read' });
+    const end = events.find((e) => e.type === 'tool_use_end');
+    expect(end).toMatchObject({ id: 'c1', input: { file_path: 'a' } });
+    const last = events[events.length - 1];
+    expect(last).toMatchObject({ type: 'message_end', stopReason: 'tool_use' });
+  });
+
+  it('routes deltas correctly with two parallel tool_use blocks', async () => {
+    // Anthropic emits content_block events with an `index` field that
+    // distinguishes parallel blocks. Before the fix, idOfBlock returned
+    // the first pending map key for every delta, so block B's deltas
+    // would land on block A's partial input.
+    const fake = fakeAnthropic([
+      { type: 'message_start', message: { usage: { input_tokens: 1, output_tokens: 0 } } },
+      { type: 'content_block_start', index: 0, content_block: { type: 'tool_use', id: 'A', name: 'Read' } },
+      { type: 'content_block_start', index: 1, content_block: { type: 'tool_use', id: 'B', name: 'Glob' } },
+      // Interleave deltas across the two blocks.
+      { type: 'content_block_delta', index: 0, delta: { type: 'input_json_delta', partial_json: '{"file_path":' } },
+      { type: 'content_block_delta', index: 1, delta: { type: 'input_json_delta', partial_json: '{"pattern":' } },
+      { type: 'content_block_delta', index: 0, delta: { type: 'input_json_delta', partial_json: '"a"}' } },
+      { type: 'content_block_delta', index: 1, delta: { type: 'input_json_delta', partial_json: '"*.ts"}' } },
+      { type: 'content_block_stop', index: 0 },
+      { type: 'content_block_stop', index: 1 },
+      { type: 'message_delta', delta: { stop_reason: 'tool_use' }, usage: { output_tokens: 3 } },
+      { type: 'message_stop' },
+    ]);
+    const p = new AnthropicProvider({ client: fake as never });
+    const events = [];
+    for await (const e of p.stream({ model: 'm', messages: [] })) events.push(e);
+
+    const ends = events.filter((e) => e.type === 'tool_use_end');
+    expect(ends).toHaveLength(2);
+    const endA = ends.find((e) => 'id' in e && e.id === 'A');
+    const endB = ends.find((e) => 'id' in e && e.id === 'B');
+    expect(endA).toMatchObject({ id: 'A', input: { file_path: 'a' } });
+    expect(endB).toMatchObject({ id: 'B', input: { pattern: '*.ts' } });
+  });
+
+  it('translates a thinking block into reasoning_delta then a concatenated reasoning_signature', async () => {
+    const fake = fakeAnthropic([
+      { type: 'message_start', message: { usage: { input_tokens: 1, output_tokens: 0 } } },
+      { type: 'content_block_start', index: 0, content_block: { type: 'thinking' } },
+      { type: 'content_block_delta', index: 0, delta: { type: 'thinking_delta', thinking: 'let me ' } },
+      { type: 'content_block_delta', index: 0, delta: { type: 'thinking_delta', thinking: 'think' } },
+      { type: 'content_block_delta', index: 0, delta: { type: 'signature_delta', signature: 'sig-' } },
+      { type: 'content_block_delta', index: 0, delta: { type: 'signature_delta', signature: 'part2' } },
+      { type: 'content_block_stop', index: 0 },
+      { type: 'message_delta', delta: { stop_reason: 'end_turn' }, usage: { output_tokens: 2 } },
+      { type: 'message_stop' },
+    ]);
+    const p = new AnthropicProvider({ client: fake as never });
+    const events = [];
+    for await (const e of p.stream({ model: 'm', messages: [] })) events.push(e);
+    const reasoning = events
+      .filter((e) => e.type === 'reasoning_delta')
+      .map((e) => (e as { delta: string }).delta)
+      .join('');
+    expect(reasoning).toBe('let me think');
+    const sig = events.find((e) => e.type === 'reasoning_signature');
+    // Signature deltas accumulate and flush once at content_block_stop.
+    expect(sig).toMatchObject({ signature: 'sig-part2' });
+    expect(events.filter((e) => e.type === 'reasoning_signature')).toHaveLength(1);
+  });
+
+  it('passes through a redacted_thinking block as an encrypted reasoning_signature', async () => {
+    const fake = fakeAnthropic([
+      { type: 'message_start', message: { usage: { input_tokens: 1, output_tokens: 0 } } },
+      { type: 'content_block_start', index: 0, content_block: { type: 'redacted_thinking', data: 'OPAQUE' } },
+      { type: 'content_block_stop', index: 0 },
+      { type: 'message_delta', delta: { stop_reason: 'end_turn' }, usage: { output_tokens: 1 } },
+      { type: 'message_stop' },
+    ]);
+    const p = new AnthropicProvider({ client: fake as never });
+    const events = [];
+    for await (const e of p.stream({ model: 'm', messages: [] })) events.push(e);
+    const sig = events.find((e) => e.type === 'reasoning_signature');
+    expect(sig).toMatchObject({ redacted: true, encrypted: 'OPAQUE' });
+  });
+
+  it('preserves cache_read/creation token counts from message_start through message_end', async () => {
+    const fake = fakeAnthropic([
+      {
+        type: 'message_start',
+        message: {
+          usage: {
+            input_tokens: 100,
+            output_tokens: 0,
+            cache_read_input_tokens: 80,
+            cache_creation_input_tokens: 20,
+          },
+        },
+      },
+      { type: 'content_block_delta', delta: { type: 'text_delta', text: 'hi' } },
+      // The delta usage only carries the final output_tokens; cache fields must survive.
+      { type: 'message_delta', delta: { stop_reason: 'end_turn' }, usage: { output_tokens: 5 } },
+      { type: 'message_stop' },
+    ]);
+    const p = new AnthropicProvider({ client: fake as never });
+    const events = [];
+    for await (const e of p.stream({ model: 'm', messages: [] })) events.push(e);
+    expect(events[events.length - 1]).toMatchObject({
+      type: 'message_end',
+      usage: {
+        inputTokens: 100,
+        outputTokens: 5,
+        cacheReadTokens: 80,
+        cacheCreationTokens: 20,
+      },
+    });
+  });
+
+  it('yields exactly one clean aborted error when the signal is already aborted', async () => {
+    const controller = new AbortController();
+    controller.abort();
+    const fake = fakeAnthropic([
+      { type: 'message_start', message: { usage: { input_tokens: 1, output_tokens: 0 } } },
+      { type: 'content_block_delta', delta: { type: 'text_delta', text: 'should not arrive' } },
+      { type: 'message_stop' },
+    ]);
+    const p = new AnthropicProvider({ client: fake as never });
+    const events = [];
+    for await (const e of p.stream({ model: 'm', messages: [], signal: controller.signal })) {
+      events.push(e);
+    }
+    const errors = events.filter((e) => e.type === 'error');
+    expect(errors).toHaveLength(1);
+    expect(errors[0]).toMatchObject({ message: 'aborted', retryable: false });
+    expect(events.some((e) => e.type === 'text_delta')).toBe(false);
+  });
+
+  it('emits error event when stream throws', async () => {
+    const fake = {
+      messages: {
+        stream: () => {
+          throw new Error('boom');
+        },
+        countTokens: async () => ({ input_tokens: 0 }),
+      },
+    };
+    const p = new AnthropicProvider({ client: fake as never });
+    const events = [];
+    for await (const e of p.stream({ model: 'm', messages: [] })) events.push(e);
+    expect(events.find((e) => e.type === 'error')).toBeDefined();
+  });
+
+  it('countTokens proxies to the SDK', async () => {
+    const fake = fakeAnthropic([]);
+    const p = new AnthropicProvider({ client: fake as never });
+    expect(await p.countTokens({ model: 'm', messages: [] })).toBe(42);
+  });
+});