@sahiljassal/opencode-anthropic-auth 2.1.1 → 2.4.0

package/README.md

@@ -33,7 +33,7 @@ This fork applies **hybrid 1-hour ephemeral prompt caching** on every request, p
 |---|---|
 | **System anchor** | Last system block after the identity block (skipped when bridge occupies the slot) |
 | **messages[0]** | Magic-context split: anchors block[0] + block[1] when stable prefix and volatile delta are merged; otherwise anchors the last cacheable block |
-| **messages[1] / bridge** | Last cacheable block of messages[1]; replaced by a bridge anchor when a tool-heavy session pushes the latest user boundary outside Anthropic's 20-block lookback window |
+| **messages[1] / bridge** | Last cacheable block of messages[1]; replaced by a bridge anchor when the block count between two user anchors (counting ALL block types across every role) exceeds Anthropic's 20-block lookback window |
 | **Rolling latest** | Most recent user message beyond index 1, keeping cache hot across long sessions |
 
 Additional behaviours:

package/dist/constants.d.ts

@@ -8,10 +8,12 @@ export declare const TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
 export declare const OAUTH_SCOPES: string[];
 export declare const TOOL_PREFIX = "mcp_";
 /**
- * Anthropic's sliding-window lookback for cache breakpoints.
- * If the distance (in content blocks) between the previous user-role
- * message anchor and the latest one exceeds this threshold, a bridge
- * anchor is needed so the earlier slots are still within the window.
+ * Anthropic's cache lookback window size. Each explicit breakpoint scans at
+ * most this many content blocks backward (counting the breakpoint block as
+ * position 1, across all roles and types — text, thinking, tool_use,
+ * tool_result, …). When the estimated block count between two user-role anchors
+ * would exceed this threshold, a bridge anchor is inserted to keep the older
+ * breakpoint inside the window and the cached prefix reachable.
  */
 export declare const ANTHROPIC_CACHE_LOOKBACK_BLOCKS = 20;
 export declare const REQUIRED_BETAS: string[];

package/dist/constants.js

@@ -15,15 +15,19 @@ export const OAUTH_SCOPES = [
 ];
 export const TOOL_PREFIX = 'mcp_';
 /**
- * Anthropic's sliding-window lookback for cache breakpoints.
- * If the distance (in content blocks) between the previous user-role
- * message anchor and the latest one exceeds this threshold, a bridge
- * anchor is needed so the earlier slots are still within the window.
+ * Anthropic's cache lookback window size. Each explicit breakpoint scans at
+ * most this many content blocks backward (counting the breakpoint block as
+ * position 1, across all roles and types — text, thinking, tool_use,
+ * tool_result, …). When the estimated block count between two user-role anchors
+ * would exceed this threshold, a bridge anchor is inserted to keep the older
+ * breakpoint inside the window and the cached prefix reachable.
  */
 export const ANTHROPIC_CACHE_LOOKBACK_BLOCKS = 20;
 export const REQUIRED_BETAS = [
     'oauth-2025-04-20',
+    'claude-code-20250219',
     'interleaved-thinking-2025-05-14',
+    'fine-grained-tool-streaming-2025-05-14',
 ];
 export const OPENCODE_IDENTITY_PREFIX = 'You are OpenCode';
 export const CLAUDE_CODE_IDENTITY = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";

package/dist/index.js

@@ -1,6 +1,7 @@
 import { authorize, exchange } from "./auth.js";
 import { CLIENT_ID, TOKEN_URL } from "./constants.js";
-import { createStrippedStream, isInsecure, mergeHeaders, rewriteRequestBody, rewriteUrl, setOAuthHeaders, } from "./transform.js";
+import { computeRetryAfterDelayMs, createStrippedStream, extractModelId, isInsecure, mergeHeaders, rewriteRequestBody, rewriteUrl, setOAuthHeaders, } from "./transform.js";
+const MAX_429_RETRIES = 3;
 export const AnthropicAuthPlugin = async ({ client }) => {
     return {
         auth: {
@@ -103,19 +104,32 @@ export const AnthropicAuthPlugin = async ({ client }) => {
                                 auth.access = await refreshPromise;
                             }
                             const requestHeaders = mergeHeaders(input, init);
+                            const rawBody = init?.body;
+                            const modelId = typeof rawBody === 'string'
+                                ? extractModelId(rawBody)
+                                : undefined;
                             // biome-ignore lint/style/noNonNullAssertion: access is guaranteed set above
-                            setOAuthHeaders(requestHeaders, auth.access);
-                            let body = init?.body;
+                            setOAuthHeaders(requestHeaders, auth.access, modelId);
+                            let body = rawBody;
                             if (body && typeof body === 'string') {
                                 body = rewriteRequestBody(body);
                             }
                             const rewritten = rewriteUrl(input);
-                            const response = await fetch(rewritten.input, {
-                                ...init,
-                                body,
-                                headers: requestHeaders,
-                                ...(isInsecure() && { tls: { rejectUnauthorized: false } }),
-                            });
+                            let response;
+                            for (let attempt = 0;; attempt++) {
+                                response = await fetch(rewritten.input, {
+                                    ...init,
+                                    body,
+                                    headers: requestHeaders,
+                                    ...(isInsecure() && { tls: { rejectUnauthorized: false } }),
+                                });
+                                if (response.status !== 429 || attempt >= MAX_429_RETRIES) {
+                                    break;
+                                }
+                                const delay = computeRetryAfterDelayMs(response.headers.get('retry-after'), attempt);
+                                await response.body?.cancel();
+                                await new Promise((resolve) => setTimeout(resolve, delay));
+                            }
                             return createStrippedStream(response);
                         },
                     };

package/dist/transform.d.ts

@@ -6,13 +6,21 @@ export type FetchInput = string | URL | Request;
 export declare function mergeHeaders(input: FetchInput, init?: RequestInit): Headers;
 /**
  * Merge incoming beta headers with the required OAuth betas, deduplicating.
+ * Excludes betas unsupported by the target model (e.g. interleaved-thinking
+ * on Haiku models).
  */
-export declare function mergeBetaHeaders(headers: Headers): string;
+export declare function mergeBetaHeaders(headers: Headers, modelId?: string): string;
 /**
- * Set OAuth-required headers on the request: authorization, beta, user-agent.
+ * Set OAuth-required headers: authorization, beta, user-agent.
  * Removes x-api-key since we're using OAuth.
  */
-export declare function setOAuthHeaders(headers: Headers, accessToken: string): Headers;
+export declare function setOAuthHeaders(headers: Headers, accessToken: string, modelId?: string): Headers;
+/**
+ * Extract the `model` field from a JSON request body string, if present.
+ * Used to make header rewriting (e.g. beta exclusions) model-aware before
+ * the body itself is parsed and transformed.
+ */
+export declare function extractModelId(body: string): string | undefined;
 /**
  * Add TOOL_PREFIX to tool names in the request body.
  * Prefixes both tool definitions and tool_use blocks in messages.
@@ -31,7 +39,6 @@ export declare function isInsecure(): boolean;
  * Rewrite the request URL to add ?beta=true for /v1/messages requests.
  * When ANTHROPIC_BASE_URL is set, overrides the origin (protocol + host)
  * for all API requests flowing through the fetch wrapper.
- * Returns the modified input and URL (if applicable).
  */
 export declare function rewriteUrl(input: FetchInput): {
     input: FetchInput;
@@ -57,19 +64,22 @@ type SystemBlock = {
     text: string;
     [k: string]: unknown;
 };
+/**
+ * Compute the delay before retrying a 429 response. Prefers the
+ * `retry-after` header (seconds) when present and valid, otherwise falls
+ * back to exponential backoff. Always capped at RETRY_AFTER_CAP_MS to avoid
+ * honouring an excessively long server-provided wait.
+ */
+export declare function computeRetryAfterDelayMs(retryAfterHeader: string | null, attempt: number): number;
 /**
  * Sanitize system prompt and prepend Claude Code identity.
  * Handles all Anthropic API system formats: undefined, string, or array of text blocks.
  */
 export declare function prependClaudeCodeIdentity(system: unknown): SystemBlock[];
-/**
- * Rewrite the full request body: sanitize system prompt, prefix tool names,
- * and apply hybrid 1h prompt caching.
- */
 export declare function rewriteRequestBody(body: string): string;
 /**
- * Error thrown when Anthropic emits a retryable server-side error *inside*
- * an HTTP 200 stream.  OpenCode recognises ECONNRESET + anthropic-sse syscall
+ * Error thrown when Anthropic emits a retryable server-side error inside
+ * an HTTP 200 stream. OpenCode recognises ECONNRESET + anthropic-sse syscall
  * and applies its normal auto-retry flow instead of surfacing an unknown error.
  */
 export type RetryableAnthropicStreamError = Error & {

package/dist/transform.js

@@ -1,17 +1,8 @@
 import { ANTHROPIC_CACHE_LOOKBACK_BLOCKS, CLAUDE_CODE_IDENTITY, OPENCODE_IDENTITY_PREFIX, PARAGRAPH_REMOVAL_ANCHORS, REQUIRED_BETAS, TEXT_REPLACEMENTS, TOOL_PREFIX, USER_AGENT, } from "./constants.js";
-/**
- * Prefix a tool name with TOOL_PREFIX and uppercase the first character.
- * Claude Code uses PascalCase tool names (e.g. mcp_Bash, mcp_Read);
- * lowercase names (mcp_bash, mcp_read) are flagged as non-Claude-Code clients.
- */
 function prefixName(name) {
     return `${TOOL_PREFIX}${name.charAt(0).toUpperCase()}${name.slice(1)}`;
 }
-/**
- * Reverse prefixName: strip TOOL_PREFIX and restore the original leading case.
- */
 function unprefixName(name) {
-    // StructuredOutput is still used as StructuredOutput
     if (name === 'StructuredOutput') {
         return name;
     }
@@ -53,28 +44,54 @@ export function mergeHeaders(input, init) {
     }
     return headers;
 }
+/**
+ * Anthropic rejects interleaved-thinking on Haiku models — this checks
+ * whether a model id refers to a Haiku model.
+ */
+function isHaikuModel(modelId) {
+    return /haiku/i.test(modelId ?? '');
+}
 /**
  * Merge incoming beta headers with the required OAuth betas, deduplicating.
+ * Excludes betas unsupported by the target model (e.g. interleaved-thinking
+ * on Haiku models).
  */
-export function mergeBetaHeaders(headers) {
+export function mergeBetaHeaders(headers, modelId) {
     const incomingBeta = headers.get('anthropic-beta') || '';
     const incomingBetasList = incomingBeta
         .split(',')
         .map((b) => b.trim())
         .filter(Boolean);
-    return [...new Set([...REQUIRED_BETAS, ...incomingBetasList])].join(',');
+    const requiredBetas = isHaikuModel(modelId)
+        ? REQUIRED_BETAS.filter((beta) => beta !== 'interleaved-thinking-2025-05-14')
+        : REQUIRED_BETAS;
+    return [...new Set([...requiredBetas, ...incomingBetasList])].join(',');
 }
 /**
- * Set OAuth-required headers on the request: authorization, beta, user-agent.
+ * Set OAuth-required headers: authorization, beta, user-agent.
  * Removes x-api-key since we're using OAuth.
  */
-export function setOAuthHeaders(headers, accessToken) {
+export function setOAuthHeaders(headers, accessToken, modelId) {
     headers.set('authorization', `Bearer ${accessToken}`);
-    headers.set('anthropic-beta', mergeBetaHeaders(headers));
+    headers.set('anthropic-beta', mergeBetaHeaders(headers, modelId));
     headers.set('user-agent', USER_AGENT);
     headers.delete('x-api-key');
     return headers;
 }
+/**
+ * Extract the `model` field from a JSON request body string, if present.
+ * Used to make header rewriting (e.g. beta exclusions) model-aware before
+ * the body itself is parsed and transformed.
+ */
+export function extractModelId(body) {
+    try {
+        const parsed = JSON.parse(body);
+        return typeof parsed?.model === 'string' ? parsed.model : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Add TOOL_PREFIX to tool names in the request body.
  * Prefixes both tool definitions and tool_use blocks in messages.
@@ -142,7 +159,6 @@ function resolveBaseUrl() {
  * Rewrite the request URL to add ?beta=true for /v1/messages requests.
  * When ANTHROPIC_BASE_URL is set, overrides the origin (protocol + host)
  * for all API requests flowing through the fetch wrapper.
- * Returns the modified input and URL (if applicable).
  */
 export function rewriteUrl(input) {
     let requestUrl = null;
@@ -192,14 +208,11 @@ export function rewriteUrl(input) {
  * somewhere in the paragraph, the removal works.
  */
 export function sanitizeSystemText(text) {
-    // Split into paragraphs (separated by one or more blank lines)
     const paragraphs = text.split(/\n\n+/);
     const filtered = paragraphs.filter((paragraph) => {
         if (paragraph.includes(OPENCODE_IDENTITY_PREFIX)) {
-            // If the paragraph contains the identity, drop it entirely
             return false;
         }
-        // Remove paragraphs containing any removal anchor
         for (const anchor of PARAGRAPH_REMOVAL_ANCHORS) {
             if (paragraph.includes(anchor))
                 return false;
@@ -207,7 +220,6 @@ export function sanitizeSystemText(text) {
         return true;
     });
     let result = filtered.join('\n\n');
-    // Apply inline text replacements
     for (const rule of TEXT_REPLACEMENTS) {
         result = result.replace(rule.match, rule.replacement);
     }
@@ -217,9 +229,6 @@ function isRecord(value) {
     return value != null && typeof value === 'object' && !Array.isArray(value);
 }
 const CACHE_1H = { type: 'ephemeral', ttl: '1h' };
-// ---------------------------------------------------------------------------
-// Cache control primitives
-// ---------------------------------------------------------------------------
 function removeCacheControl(value) {
     if (!isRecord(value))
         return;
@@ -248,21 +257,23 @@ function setWireCacheControl(value) {
     value.cache_control = { ...CACHE_1H };
     return true;
 }
-// ---------------------------------------------------------------------------
-// Content-block helpers
-// ---------------------------------------------------------------------------
 /**
  * Returns true for content block types that accept cache_control.
- * Anthropic rejects cache_control on thinking / redacted_thinking blocks.
+ * Anthropic rejects cache_control on thinking / redacted_thinking blocks
+ * and silently skips empty text blocks without caching them.
  */
 function isCacheableContentBlock(block) {
     if (!isRecord(block))
         return false;
-    return block.type !== 'thinking' && block.type !== 'redacted_thinking';
+    if (block.type === 'thinking' || block.type === 'redacted_thinking')
+        return false;
+    if (block.type === 'text' && !String(block.text ?? '').trim())
+        return false;
+    return true;
 }
 /**
  * Normalises message content to an array of blocks, then filters to only
- * cacheable types.  Returns undefined when there is nothing to anchor.
+ * cacheable types. Returns undefined when there is nothing to anchor.
  */
 function getCacheableContentBlocks(message) {
     if (!isRecord(message))
@@ -272,7 +283,6 @@ function getCacheableContentBlocks(message) {
         blocks = message.content;
     }
     else if (typeof message.content === 'string') {
-        // Normalise inline string to block array in place so downstream sees array
         const normalised = [{ type: 'text', text: message.content }];
         message.content = normalised;
         blocks = normalised;
@@ -283,38 +293,21 @@ function getCacheableContentBlocks(message) {
     const cacheable = blocks.filter(isCacheableContentBlock);
     return cacheable.length > 0 ? cacheable : undefined;
 }
-/**
- * Total cacheable content-block count for a message (used for lookback math).
- */
 function messageContentBlockCount(message) {
     return getCacheableContentBlocks(message)?.length ?? 0;
 }
-// ---------------------------------------------------------------------------
-// Message-anchor setters
-// ---------------------------------------------------------------------------
-/**
- * Anchor the last cacheable block of a message.
- * Returns false (and sets nothing) when there are no cacheable blocks.
- */
 function setMessageCacheAnchor(message) {
     const blocks = getCacheableContentBlocks(message);
     if (!blocks)
         return false;
     return setWireCacheControl(blocks[blocks.length - 1]);
 }
-/**
- * Anchor the FIRST cacheable block of a message (for magic-context split).
- */
 function setFirstMessageCacheAnchor(message) {
     const blocks = getCacheableContentBlocks(message);
     if (!blocks)
         return false;
     return setWireCacheControl(blocks[0]);
 }
-/**
- * Anchor the SECOND cacheable block of a message (for magic-context split).
- * Returns false when fewer than two cacheable blocks exist.
- */
 function setSecondMessageCacheAnchor(message) {
     const blocks = getCacheableContentBlocks(message);
     if (!blocks || blocks.length < 2)
@@ -322,49 +315,60 @@ function setSecondMessageCacheAnchor(message) {
     return setWireCacheControl(blocks[1]);
 }
 /**
- * Walk all messages and collect user-role (or tool_result) anchor positions.
- * Returns the `latest` position (index > 1) and a `bridge` position placed
- * whenever the cumulative block distance from bridge→latest exceeds
- * ANTHROPIC_CACHE_LOOKBACK_BLOCKS, ensuring both are within the sliding window.
+ * Total positional block count for a message regardless of role or type.
+ * Anthropic's cache lookback window counts every content block (text,
+ * thinking, tool_use, tool_result, …), so distance math must use raw counts,
+ * not the cacheable-only filter used to validate anchor placement.
+ */
+function rawBlockCount(message) {
+    if (!isRecord(message))
+        return 0;
+    const { content } = message;
+    if (Array.isArray(content))
+        return content.length;
+    if (typeof content === 'string')
+        return 1;
+    return 0;
+}
+/**
+ * Collect user-role anchor indices that hold at least one cacheable block,
+ * then pick the `latest` (index > 1) and a `bridge`. The bridge is the
+ * furthest-back valid user anchor where the block count between it and
+ * `latest` — counting ALL content blocks across user and assistant turns,
+ * excluding the anchor's own blocks — does not exceed
+ * ANTHROPIC_CACHE_LOOKBACK_BLOCKS. This keeps the older breakpoint inside
+ * Anthropic's sliding lookback window so the cached prefix stays reachable.
  */
 function selectHybridMessageAnchors(messages) {
-    // Collect positions of user-role messages that have cacheable content
-    const userPositions = messages
-        .map((msg, index) => {
-        if (!isRecord(msg))
-            return null;
-        if (msg.role !== 'user')
-            return null;
-        const blockCount = messageContentBlockCount(msg);
-        if (blockCount === 0)
-            return null;
-        return { index, blockCount };
-    })
-        .filter((p) => p !== null);
-    // We only care about positions beyond index 1 (0 and 1 are always anchored)
-    const rollingPositions = userPositions.filter((p) => p.index > 1);
-    if (rollingPositions.length === 0) {
+    // Collect indices of user messages beyond index 1 that have ≥1 cacheable block.
+    // Indices 0 and 1 are handled as fixed slots in applyHybridCache1h, not rolling.
+    const rollingIndices = [];
+    messages.forEach((msg, index) => {
+        if (index > 1 &&
+            isRecord(msg) &&
+            msg.role === 'user' &&
+            messageContentBlockCount(msg) > 0) {
+            rollingIndices.push(index);
+        }
+    });
+    if (rollingIndices.length === 0) {
         return { latest: undefined, bridge: undefined };
     }
-    // Non-null: rollingPositions is non-empty (early return guards above)
     // biome-ignore lint/style/noNonNullAssertion: guarded by length check above
-    const latest = rollingPositions[rollingPositions.length - 1];
-    // Find a bridge: walk back from latest until cumulative blocks exceed window
+    const latestIndex = rollingIndices[rollingIndices.length - 1];
+    const rollingSet = new Set(rollingIndices);
     let bridge;
-    let cumulativeBlocks = latest.blockCount;
-    for (let i = rollingPositions.length - 2; i >= 0; i--) {
-        // biome-ignore lint/style/noNonNullAssertion: index is within bounds
-        cumulativeBlocks += rollingPositions[i].blockCount;
-        if (cumulativeBlocks > ANTHROPIC_CACHE_LOOKBACK_BLOCKS) {
-            bridge = rollingPositions[i];
-            break;
+    let cumulativeBlocks = 0;
+    for (let i = latestIndex - 1; i >= 0; i--) {
+        if (rollingSet.has(i)) {
+            if (cumulativeBlocks > ANTHROPIC_CACHE_LOOKBACK_BLOCKS)
+                break;
+            bridge = i;
         }
+        cumulativeBlocks += rawBlockCount(messages[i]);
     }
-    return { latest, bridge };
+    return { latest: latestIndex, bridge };
 }
-// ---------------------------------------------------------------------------
-// System-anchor setter
-// ---------------------------------------------------------------------------
 function systemBlockText(block) {
     return isRecord(block) && typeof block.text === 'string' ? block.text : '';
 }
@@ -374,7 +378,7 @@ function systemBlockText(block) {
  * system cache anchor.
  *
  * OpenCode normally emits these as one merged block, but some hooks can cause
- * them to arrive split across multiple blocks.  Without coalescing, byte-
+ * them to arrive split across multiple blocks. Without coalescing, byte-
  * identical system text flips between merged/split layouts and moves the
  * cache_control breakpoint — busting the cache every turn.
  *
@@ -388,15 +392,12 @@ function coalesceHybridSystemTail(parsed) {
         return;
     const system = parsed.system;
     let prefixCount = 0;
-    // Skip optional billing-header block (not present in this fork but guard is safe)
     if (systemBlockText(system[prefixCount]).startsWith('x-anthropic-billing-header:')) {
         prefixCount++;
     }
-    // Skip identity block
     if (systemBlockText(system[prefixCount]) === CLAUDE_CODE_IDENTITY) {
         prefixCount++;
     }
-    // tailStart points to the first plugin-added block (one after primary prompt)
     const tailStart = prefixCount + 1;
     if (tailStart >= system.length - 1)
         return;
@@ -412,8 +413,8 @@ function coalesceHybridSystemTail(parsed) {
 }
 /**
  * Place a cache anchor on the last system block that follows the
- * CLAUDE_CODE_IDENTITY block.  When there are no system blocks, or all
- * system blocks precede the identity, nothing is anchored.
+ * CLAUDE_CODE_IDENTITY block. When there are no system blocks after the
+ * identity, nothing is anchored.
  */
 function setHybridSystemAnchor(parsed) {
     if (!Array.isArray(parsed.system))
@@ -424,11 +425,90 @@ function setHybridSystemAnchor(parsed) {
         .filter(isRecord);
     setWireCacheControl(afterIdentity[afterIdentity.length - 1]);
 }
-// ---------------------------------------------------------------------------
-// Trailing-assistant strip (Tier 2)
-// ---------------------------------------------------------------------------
+const RETRY_AFTER_CAP_MS = 30000;
+const RETRY_BASE_DELAY_MS = 500;
 /**
- * Remove trailing assistant-role messages.  OAuth endpoints reject requests
+ * Compute the delay before retrying a 429 response. Prefers the
+ * `retry-after` header (seconds) when present and valid, otherwise falls
+ * back to exponential backoff. Always capped at RETRY_AFTER_CAP_MS to avoid
+ * honouring an excessively long server-provided wait.
+ */
+export function computeRetryAfterDelayMs(retryAfterHeader, attempt) {
+    const seconds = retryAfterHeader ? Number(retryAfterHeader) : Number.NaN;
+    const delay = Number.isFinite(seconds)
+        ? seconds * 1000
+        : RETRY_BASE_DELAY_MS * 2 ** attempt;
+    return Math.min(delay, RETRY_AFTER_CAP_MS);
+}
+/**
+ * Anthropic rejects the `effort` parameter for Haiku models. Strips
+ * `output_config.effort` and `thinking.effort`, removing the parent object
+ * entirely if `effort` was its only field.
+ */
+function stripUnsupportedEffortForHaiku(parsed) {
+    if (!isHaikuModel(typeof parsed.model === 'string' ? parsed.model : undefined))
+        return;
+    const outputConfig = parsed.output_config;
+    if (isRecord(outputConfig) && 'effort' in outputConfig) {
+        delete outputConfig.effort;
+        if (Object.keys(outputConfig).length === 0)
+            delete parsed.output_config;
+    }
+    const thinking = parsed.thinking;
+    if (isRecord(thinking) && 'effort' in thinking) {
+        delete thinking.effort;
+        if (Object.keys(thinking).length === 0)
+            delete parsed.thinking;
+    }
+}
+/**
+ * Remove tool_use blocks with no matching tool_result, and tool_result
+ * blocks that reference a non-existent tool_use. Anthropic rejects requests
+ * with unpaired tool_use/tool_result blocks — this can happen when OpenCode
+ * truncates or reconstructs conversation history after an interruption.
+ * Messages left with no content blocks are dropped entirely.
+ */
+function repairOrphanedToolPairs(parsed) {
+    if (!Array.isArray(parsed.messages))
+        return;
+    const toolUseIds = new Set();
+    const toolResultIds = new Set();
+    for (const msg of parsed.messages) {
+        if (!isRecord(msg) || !Array.isArray(msg.content))
+            continue;
+        for (const block of msg.content) {
+            if (!isRecord(block))
+                continue;
+            if (block.type === 'tool_use' && typeof block.id === 'string') {
+                toolUseIds.add(block.id);
+            }
+            else if (block.type === 'tool_result' &&
+                typeof block.tool_use_id === 'string') {
+                toolResultIds.add(block.tool_use_id);
+            }
+        }
+    }
+    parsed.messages = parsed.messages.filter((msg) => {
+        if (!isRecord(msg) || !Array.isArray(msg.content))
+            return true;
+        const filteredContent = msg.content.filter((block) => {
+            if (!isRecord(block))
+                return true;
+            if (block.type === 'tool_use' && typeof block.id === 'string') {
+                return toolResultIds.has(block.id);
+            }
+            if (block.type === 'tool_result' &&
+                typeof block.tool_use_id === 'string') {
+                return toolUseIds.has(block.tool_use_id);
+            }
+            return true;
+        });
+        msg.content = filteredContent;
+        return filteredContent.length > 0;
+    });
+}
+/**
+ * Remove trailing assistant-role messages. OAuth endpoints reject requests
  * that end with an assistant turn (assistant prefill is not supported).
  */
 function stripTrailingAssistantMessages(parsed) {
@@ -440,52 +520,60 @@ function stripTrailingAssistantMessages(parsed) {
         parsed.messages.pop();
     }
 }
-// ---------------------------------------------------------------------------
-// Main hybrid cache logic
-// ---------------------------------------------------------------------------
+/**
+ * Returns true when messages[0] carries a merged stable-prefix layout
+ * (≥2 cacheable blocks). In that case anchoring the last block would bust
+ * the cache every turn because the tail is volatile; instead we anchor
+ * block[0] and block[1] (the two stable-prefix blocks).
+ */
+function isMagicContextLayout(blocks) {
+    return blocks.length >= 2;
+}
 /**
  * Apply hybrid 1h prompt-caching breakpoints to parsed request body.
  *
- * Breakpoint slots (Anthropic supports max 4 per request):
- *   1. Last system block after the identity block  (skipped when bridge used)
- *   2. messages[0] — first cacheable block         (magic-context: slot 2a)
- *   3. messages[0] — second cacheable block        (magic-context split only)
- *      OR messages[1] last cacheable block         (normal path)
- *      OR bridge user message                      (when bridge detected)
- *   4. Latest user/tool-result message (index > 1) (when present)
+ * Anthropic supports max 4 cache breakpoints per request. Slot allocation:
+ *
+ *   Slot 1 — system anchor: last block after identity.
+ *             Skipped when a bridge is used (bridge takes that slot).
+ *
+ *   Slots 2+3 — messages[0]:
+ *     • Normal layout (1 cacheable block): slot 2 = last block of msg[0];
+ *       slot 3 = bridge message OR messages[1] (no bridge).
+ *     • Magic-context layout (≥2 cacheable blocks): slot 2 = block[0],
+ *       slot 3 = block[1]. messages[1] is skipped (msg[0] uses both slots).
+ *
+ *   Slot 4 — rolling latest: last user/tool-result message beyond index 1.
+ *
+ * Bridge and magic-context are independent: when both apply simultaneously,
+ * the slot budget is: system(skipped) + msg0-block0 + bridge + latest = 4.
+ * The bridge anchor is ALWAYS placed when detected, regardless of msg0 layout.
  */
 function applyHybridCache1h(parsed) {
     removeAllCacheControls(parsed);
     coalesceHybridSystemTail(parsed);
     const messages = Array.isArray(parsed.messages) ? parsed.messages : [];
     const { latest, bridge } = selectHybridMessageAnchors(messages);
-    // --- Slot 1: system anchor (skip when bridge will occupy a slot) ---
-    if (!bridge) {
+    if (bridge === undefined) {
         setHybridSystemAnchor(parsed);
     }
-    // --- Slots 2 & 3: messages[0] ---
     const msg0 = messages[0];
     const msg0Blocks = getCacheableContentBlocks(msg0);
-    if (msg0Blocks && msg0Blocks.length >= 2) {
-        // Magic-context split: stable prefix is in block[0] and block[1];
-        // anchoring last block would bust cache every turn.
+    if (msg0Blocks && isMagicContextLayout(msg0Blocks)) {
         setFirstMessageCacheAnchor(msg0);
         setSecondMessageCacheAnchor(msg0);
     }
     else {
         setMessageCacheAnchor(msg0);
-        // --- Slot 3 (normal): messages[1] or bridge ---
-        if (bridge) {
-            setHybridSystemAnchor(parsed); // system anchor reclaimed for bridge support
-            setMessageCacheAnchor(messages[bridge.index]);
-        }
-        else {
+        if (bridge === undefined) {
             setMessageCacheAnchor(messages[1]);
         }
     }
-    // --- Slot 4: rolling latest user anchor ---
-    if (latest) {
-        setMessageCacheAnchor(messages[latest.index]);
+    if (bridge !== undefined) {
+        setMessageCacheAnchor(messages[bridge]);
+    }
+    if (latest !== undefined) {
+        setMessageCacheAnchor(messages[latest]);
     }
 }
 /**
@@ -527,20 +615,17 @@ export function prependClaudeCodeIdentity(system) {
         }
         return { type: 'text', text: String(item) };
     });
-    // Idempotency: don't double-prepend if first block already has the identity
     if (sanitized[0]?.text === CLAUDE_CODE_IDENTITY) {
         return sanitized;
     }
     return [identityBlock, ...sanitized];
 }
-/**
- * Rewrite the full request body: sanitize system prompt, prefix tool names,
- * and apply hybrid 1h prompt caching.
- */
 export function rewriteRequestBody(body) {
     try {
         const parsed = JSON.parse(body);
         parsed.system = prependClaudeCodeIdentity(parsed.system);
+        repairOrphanedToolPairs(parsed);
+        stripUnsupportedEffortForHaiku(parsed);
         stripTrailingAssistantMessages(parsed);
         applyHybridCache1h(parsed);
         return prefixToolNames(parsed);
@@ -549,7 +634,6 @@ export function rewriteRequestBody(body) {
         return body;
     }
 }
-/** Find the first SSE event boundary (\n\n or \r\n\r\n) in a text buffer. */
 function findSseBoundary(value) {
     const lf = value.indexOf('\n\n');
     const crlf = value.indexOf('\r\n\r\n');
@@ -615,9 +699,7 @@ function retryableAnthropicStreamErrorFromRawEvent(rawEvent) {
     if (eventName !== 'error' && stringField(data, 'type') !== 'error')
         return null;
     const errorObj = asDiagnosticRecord(data?.error);
-    const errorType = stringField(errorObj, 'type') ??
-        stringField(errorObj, 'code') ??
-        undefined;
+    const errorType = stringField(errorObj, 'type') ?? stringField(errorObj, 'code') ?? undefined;
     const message = stringField(errorObj, 'message') ??
         stringField(data, 'message') ??
         errorType ??
@@ -645,20 +727,16 @@ function updateSseErrorState(state, text) {
     }
     return null;
 }
-// ---------------------------------------------------------------------------
-// Buffered tool-prefix rewriting (v1.10.0)
-// ---------------------------------------------------------------------------
 /**
  * Rewrite the tool prefix from the safe portion of a text buffer.
  * Holds back any suffix that could be the start of a partial `"name"` marker
- * spanning a chunk boundary.  Pass flush=true on stream end to emit everything.
+ * spanning a chunk boundary. Pass flush=true on stream end to emit everything.
  */
 function splitToolPrefixRewriteBuffer(buffer, flush = false) {
     if (flush)
         return { ready: stripToolPrefix(buffer), pending: '' };
     let keepFrom = buffer.length;
     const marker = '"name"';
-    // Hold back any suffix that starts a partial marker
     const partialStart = Math.max(0, buffer.length - marker.length + 1);
     for (let i = partialStart; i < buffer.length; i++) {
         if (marker.startsWith(buffer.slice(i))) {
@@ -666,7 +744,6 @@ function splitToolPrefixRewriteBuffer(buffer, flush = false) {
             break;
         }
     }
-    // Also hold back if the last occurrence of the marker is incomplete
     const lastMarker = buffer.lastIndexOf(marker);
     if (lastMarker !== -1) {
         const tail = buffer.slice(lastMarker);
@@ -682,9 +759,6 @@ function splitToolPrefixRewriteBuffer(buffer, flush = false) {
     }
     return { ready: stripToolPrefix(buffer), pending: '' };
 }
-// ---------------------------------------------------------------------------
-// Stream response wrapper
-// ---------------------------------------------------------------------------
 /**
  * Create a streaming response that strips the tool prefix from tool names.
  * Detects retryable Anthropic server errors inside HTTP 200 streams and
@@ -711,8 +785,17 @@ export function createStrippedStream(response) {
                 const { done, value } = await reader.read();
                 if (done) {
                     const finalDecoded = decoder.decode();
-                    const retryableError = updateSseErrorState(sseErrors, finalDecoded);
+                    let retryableError = updateSseErrorState(sseErrors, finalDecoded);
+                    if (!retryableError && sseErrors.pending) {
+                        retryableError = retryableAnthropicStreamErrorFromRawEvent(sseErrors.pending);
+                    }
                     if (retryableError) {
+                        try {
+                            await reader.cancel();
+                        }
+                        catch {
+                            /* ignore cancel failure */
+                        }
                         releaseReader();
                         throw retryableError;
                     }
@@ -726,6 +809,12 @@ export function createStrippedStream(response) {
                 const decoded = decoder.decode(value, { stream: true });
                 const retryableError = updateSseErrorState(sseErrors, decoded);
                 if (retryableError) {
+                    try {
+                        await reader.cancel();
+                    }
+                    catch {
+                        /* ignore cancel failure */
+                    }
                     releaseReader();
                     throw retryableError;
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sahiljassal/opencode-anthropic-auth",
-  "version": "2.1.1",
+  "version": "2.4.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/shljsl75891/opencode-anthropic-auth.git"
@@ -31,10 +31,10 @@
     "@opencode-ai/plugin": "*"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.4.16",
+    "@biomejs/biome": "2.5.0",
     "@changesets/changelog-github": "^0.7.0",
     "@changesets/cli": "^2.31.0",
-    "@opencode-ai/plugin": "1.17.3",
+    "@opencode-ai/plugin": "1.17.8",
     "@tsconfig/bun": "1.0.10",
     "@types/bun": "1.3.14",
     "dedent": "^1.7.2",