@sahiljassal/opencode-anthropic-auth 2.4.1 → 2.5.0

package/dist/constants.d.ts

@@ -18,7 +18,15 @@ export declare const TOOL_PREFIX = "mcp_";
 export declare const ANTHROPIC_CACHE_LOOKBACK_BLOCKS = 20;
 export declare const REQUIRED_BETAS: string[];
 export declare const OPENCODE_IDENTITY_PREFIX = "You are OpenCode";
-export declare const CLAUDE_CODE_IDENTITY = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
+export declare const CLAUDE_CODE_IDENTITY = "You are Claude Code, Anthropic's official CLI for Claude.";
+/**
+ * Model families with adaptive thinking (thinking defaults on, display
+ * defaults to "omitted"). These models reject legacy manual thinking
+ * (type: enabled + budget_tokens) and non-default temperature/top_p/top_k.
+ */
+export declare const ADAPTIVE_THINKING_MODEL_PATTERN: RegExp;
+/** Proactive OAuth refresh margin — refresh this long before actual expiry. */
+export declare const OAUTH_REFRESH_SKEW_MS: number;
 export declare const CCH_SALT = "59cf53e54c78";
 export declare const CCH_POSITIONS: number[];
 export declare const CLAUDE_CODE_VERSION = "2.1.177";

package/dist/constants.js

@@ -27,10 +27,17 @@ export const REQUIRED_BETAS = [
     'oauth-2025-04-20',
     'claude-code-20250219',
     'interleaved-thinking-2025-05-14',
-    'fine-grained-tool-streaming-2025-05-14',
 ];
 export const OPENCODE_IDENTITY_PREFIX = 'You are OpenCode';
-export const CLAUDE_CODE_IDENTITY = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
+export const CLAUDE_CODE_IDENTITY = "You are Claude Code, Anthropic's official CLI for Claude.";
+/**
+ * Model families with adaptive thinking (thinking defaults on, display
+ * defaults to "omitted"). These models reject legacy manual thinking
+ * (type: enabled + budget_tokens) and non-default temperature/top_p/top_k.
+ */
+export const ADAPTIVE_THINKING_MODEL_PATTERN = /claude-(opus-5|opus-4-8|opus-4-7|sonnet-5|fable-5|mythos-5)/i;
+/** Proactive OAuth refresh margin — refresh this long before actual expiry. */
+export const OAUTH_REFRESH_SKEW_MS = 5 * 60_000;
 export const CCH_SALT = '59cf53e54c78';
 export const CCH_POSITIONS = [4, 7, 20];
 export const CLAUDE_CODE_VERSION = '2.1.177';

package/dist/index.js

@@ -1,5 +1,5 @@
 import { authorize, exchange } from "./auth.js";
-import { CLIENT_ID, TOKEN_URL } from "./constants.js";
+import { CLIENT_ID, OAUTH_REFRESH_SKEW_MS, TOKEN_URL } from "./constants.js";
 import { computeRetryAfterDelayMs, createStrippedStream, extractModelId, isInsecure, mergeHeaders, rewriteRequestBody, rewriteUrl, setOAuthHeaders, } from "./transform.js";
 const MAX_429_RETRIES = 3;
 export const AnthropicAuthPlugin = async ({ client }) => {
@@ -23,85 +23,98 @@ export const AnthropicAuthPlugin = async ({ client }) => {
                     // Shared inflight refresh promise — prevents concurrent token refreshes
                     // from racing against each other (and causing 401 cascades with token rotation)
                     let refreshPromise = null;
+                    function triggerRefresh() {
+                        if (!refreshPromise) {
+                            refreshPromise = (async () => {
+                                const maxRetries = 2;
+                                const baseDelayMs = 500;
+                                for (let attempt = 0; attempt <= maxRetries; attempt++) {
+                                    try {
+                                        if (attempt > 0) {
+                                            const delay = baseDelayMs * 2 ** (attempt - 1);
+                                            await new Promise((resolve) => setTimeout(resolve, delay));
+                                        }
+                                        // Re-read auth to get the latest refresh token.
+                                        // The outer `auth` snapshot may be stale if tokens
+                                        // were rotated since the fetch() call was made.
+                                        const freshAuth = await getAuth();
+                                        const response = await fetch(TOKEN_URL, {
+                                            method: 'POST',
+                                            headers: {
+                                                'Content-Type': 'application/json',
+                                                Accept: 'application/json, text/plain, */*',
+                                                'User-Agent': 'axios/1.13.6',
+                                            },
+                                            body: JSON.stringify({
+                                                grant_type: 'refresh_token',
+                                                refresh_token: freshAuth.refresh,
+                                                client_id: CLIENT_ID,
+                                            }),
+                                        });
+                                        if (!response.ok) {
+                                            if (response.status === 429 && attempt < maxRetries) {
+                                                // Honor the token endpoint's own backoff hint instead
+                                                // of the generic exponential delay below.
+                                                const retryAfterDelay = computeRetryAfterDelayMs(response.headers.get('retry-after'), attempt);
+                                                await response.body?.cancel();
+                                                await new Promise((resolve) => setTimeout(resolve, retryAfterDelay));
+                                                continue;
+                                            }
+                                            if (response.status >= 500 && attempt < maxRetries) {
+                                                await response.body?.cancel();
+                                                continue;
+                                            }
+                                            const body = await response.text().catch(() => '');
+                                            throw new Error(`Token refresh failed: ${response.status} — ${body}`);
+                                        }
+                                        const json = (await response.json());
+                                        // biome-ignore lint/suspicious/noExplicitAny: SDK types don't expose auth.set
+                                        await client.auth.set({
+                                            path: {
+                                                id: 'anthropic',
+                                            },
+                                            body: {
+                                                type: 'oauth',
+                                                refresh: json.refresh_token,
+                                                access: json.access_token,
+                                                expires: Date.now() + json.expires_in * 1000,
+                                            },
+                                        });
+                                        return json.access_token;
+                                    }
+                                    catch (error) {
+                                        const isNetworkError = error instanceof Error &&
+                                            (error.message.includes('fetch failed') ||
+                                                ('code' in error &&
+                                                    (error.code === 'ECONNRESET' ||
+                                                        error.code === 'ECONNREFUSED' ||
+                                                        error.code === 'ETIMEDOUT' ||
+                                                        error.code === 'UND_ERR_CONNECT_TIMEOUT')));
+                                        if (attempt < maxRetries && isNetworkError) {
+                                            continue;
+                                        }
+                                        throw error;
+                                    }
+                                }
+                                // Unreachable — each iteration either returns or throws.
+                                // Kept as a TypeScript exhaustiveness guard.
+                                throw new Error('Token refresh exhausted all retries');
+                            })().finally(() => {
+                                refreshPromise = null;
+                            });
+                        }
+                        return refreshPromise;
+                    }
                     return {
                         apiKey: '',
                         async fetch(input, init) {
                             const auth = await getAuth();
                             if (auth.type !== 'oauth')
                                 return fetch(input, init);
-                            if (!auth.access || !auth.expires || auth.expires < Date.now()) {
-                                if (!refreshPromise) {
-                                    refreshPromise = (async () => {
-                                        const maxRetries = 2;
-                                        const baseDelayMs = 500;
-                                        for (let attempt = 0; attempt <= maxRetries; attempt++) {
-                                            try {
-                                                if (attempt > 0) {
-                                                    const delay = baseDelayMs * 2 ** (attempt - 1);
-                                                    await new Promise((resolve) => setTimeout(resolve, delay));
-                                                }
-                                                // Re-read auth to get the latest refresh token.
-                                                // The outer `auth` snapshot may be stale if tokens
-                                                // were rotated since the fetch() call was made.
-                                                const freshAuth = await getAuth();
-                                                const response = await fetch(TOKEN_URL, {
-                                                    method: 'POST',
-                                                    headers: {
-                                                        'Content-Type': 'application/json',
-                                                        Accept: 'application/json, text/plain, */*',
-                                                        'User-Agent': 'axios/1.13.6',
-                                                    },
-                                                    body: JSON.stringify({
-                                                        grant_type: 'refresh_token',
-                                                        refresh_token: freshAuth.refresh,
-                                                        client_id: CLIENT_ID,
-                                                    }),
-                                                });
-                                                if (!response.ok) {
-                                                    if (response.status >= 500 && attempt < maxRetries) {
-                                                        await response.body?.cancel();
-                                                        continue;
-                                                    }
-                                                    const body = await response.text().catch(() => '');
-                                                    throw new Error(`Token refresh failed: ${response.status} — ${body}`);
-                                                }
-                                                const json = (await response.json());
-                                                // biome-ignore lint/suspicious/noExplicitAny: SDK types don't expose auth.set
-                                                await client.auth.set({
-                                                    path: {
-                                                        id: 'anthropic',
-                                                    },
-                                                    body: {
-                                                        type: 'oauth',
-                                                        refresh: json.refresh_token,
-                                                        access: json.access_token,
-                                                        expires: Date.now() + json.expires_in * 1000,
-                                                    },
-                                                });
-                                                return json.access_token;
-                                            }
-                                            catch (error) {
-                                                const isNetworkError = error instanceof Error &&
-                                                    (error.message.includes('fetch failed') ||
-                                                        ('code' in error &&
-                                                            (error.code === 'ECONNRESET' ||
-                                                                error.code === 'ECONNREFUSED' ||
-                                                                error.code === 'ETIMEDOUT' ||
-                                                                error.code === 'UND_ERR_CONNECT_TIMEOUT')));
-                                                if (attempt < maxRetries && isNetworkError) {
-                                                    continue;
-                                                }
-                                                throw error;
-                                            }
-                                        }
-                                        // Unreachable — each iteration either returns or throws.
-                                        // Kept as a TypeScript exhaustiveness guard.
-                                        throw new Error('Token refresh exhausted all retries');
-                                    })().finally(() => {
-                                        refreshPromise = null;
-                                    });
-                                }
-                                auth.access = await refreshPromise;
+                            if (!auth.access ||
+                                !auth.expires ||
+                                auth.expires < Date.now() + OAUTH_REFRESH_SKEW_MS) {
+                                auth.access = await triggerRefresh();
                             }
                             const requestHeaders = mergeHeaders(input, init);
                             const rawBody = init?.body;
@@ -115,6 +128,8 @@ export const AnthropicAuthPlugin = async ({ client }) => {
                                 body = rewriteRequestBody(body);
                             }
                             const rewritten = rewriteUrl(input);
+                            let accessToken = auth.access;
+                            let forcedRefreshAttempted = false;
                             let response;
                             for (let attempt = 0;; attempt++) {
                                 response = await fetch(rewritten.input, {
@@ -123,6 +138,21 @@ export const AnthropicAuthPlugin = async ({ client }) => {
                                     headers: requestHeaders,
                                     ...(isInsecure() && { tls: { rejectUnauthorized: false } }),
                                 });
+                                if (response.status === 401 && !forcedRefreshAttempted) {
+                                    forcedRefreshAttempted = true;
+                                    await response.body?.cancel();
+                                    // Force a refresh regardless of the cached expiry — the
+                                    // token may have been rejected before local expiry (e.g.
+                                    // revoked, or clock skew). Only retry if the refreshed
+                                    // token actually changed, to avoid looping forever
+                                    // against a permanently-rejected grant.
+                                    const refreshed = await triggerRefresh();
+                                    if (refreshed === accessToken)
+                                        break;
+                                    accessToken = refreshed;
+                                    setOAuthHeaders(requestHeaders, refreshed, modelId);
+                                    continue;
+                                }
                                 if (response.status !== 429 || attempt >= MAX_429_RETRIES) {
                                     break;
                                 }

package/dist/transform.d.ts

@@ -6,8 +6,8 @@ export type FetchInput = string | URL | Request;
 export declare function mergeHeaders(input: FetchInput, init?: RequestInit): Headers;
 /**
  * Merge incoming beta headers with the required OAuth betas, deduplicating.
- * Excludes betas unsupported by the target model (e.g. interleaved-thinking
- * on Haiku models).
+ * Excludes betas that are no-ops on the target model (e.g. interleaved-thinking
+ * on Haiku models, which don't support it).
  */
 export declare function mergeBetaHeaders(headers: Headers, modelId?: string): string;
 /**

package/dist/transform.js

@@ -1,4 +1,4 @@
-import { ANTHROPIC_CACHE_LOOKBACK_BLOCKS, CLAUDE_CODE_IDENTITY, OPENCODE_IDENTITY_PREFIX, PARAGRAPH_REMOVAL_ANCHORS, REQUIRED_BETAS, TEXT_REPLACEMENTS, TOOL_PREFIX, USER_AGENT, } from "./constants.js";
+import { ADAPTIVE_THINKING_MODEL_PATTERN, ANTHROPIC_CACHE_LOOKBACK_BLOCKS, CLAUDE_CODE_IDENTITY, OPENCODE_IDENTITY_PREFIX, PARAGRAPH_REMOVAL_ANCHORS, REQUIRED_BETAS, TEXT_REPLACEMENTS, TOOL_PREFIX, USER_AGENT, } from "./constants.js";
 function prefixName(name) {
     return `${TOOL_PREFIX}${name.charAt(0).toUpperCase()}${name.slice(1)}`;
 }
@@ -45,16 +45,16 @@ export function mergeHeaders(input, init) {
     return headers;
 }
 /**
- * Anthropic rejects interleaved-thinking on Haiku models — this checks
- * whether a model id refers to a Haiku model.
+ * Haiku models don't support interleaved thinking — checks whether a model
+ * id refers to a Haiku model.
  */
 function isHaikuModel(modelId) {
     return /haiku/i.test(modelId ?? '');
 }
 /**
  * Merge incoming beta headers with the required OAuth betas, deduplicating.
- * Excludes betas unsupported by the target model (e.g. interleaved-thinking
- * on Haiku models).
+ * Excludes betas that are no-ops on the target model (e.g. interleaved-thinking
+ * on Haiku models, which don't support it).
  */
 export function mergeBetaHeaders(headers, modelId) {
     const incomingBeta = headers.get('anthropic-beta') || '';
@@ -461,45 +461,92 @@ function stripUnsupportedEffortForHaiku(parsed) {
             delete parsed.thinking;
     }
 }
+const ADAPTIVE_THINKING_DEFAULT = { type: 'adaptive', display: 'summarized' };
 /**
- * Remove tool_use blocks with no matching tool_result, and tool_result
- * blocks that reference a non-existent tool_use. Anthropic rejects requests
- * with unpaired tool_use/tool_result blocks — this can happen when OpenCode
- * truncates or reconstructs conversation history after an interruption.
+ * Adaptive-thinking models (Opus 5, Sonnet 5, …) default to hidden thinking
+ * and reject legacy manual `thinking.type: "enabled"` + budget_tokens (400
+ * on 4.7+). Normalizes to adaptive+summarized, canonicalizes disabled
+ * thinking to a bare object (extra fields 400), and demotes xhigh/max
+ * effort to high when thinking is disabled (that combination always 400s).
+ */
+function normalizeAdaptiveThinking(parsed) {
+    if (!ADAPTIVE_THINKING_MODEL_PATTERN.test(String(parsed.model ?? '')))
+        return;
+    const thinking = parsed.thinking;
+    if (isRecord(thinking) && thinking.type === 'disabled') {
+        parsed.thinking = { type: 'disabled' };
+        const outputConfig = parsed.output_config;
+        if (isRecord(outputConfig) &&
+            (outputConfig.effort === 'xhigh' || outputConfig.effort === 'max')) {
+            outputConfig.effort = 'high';
+        }
+        return;
+    }
+    parsed.thinking = { ...ADAPTIVE_THINKING_DEFAULT };
+}
+/**
+ * Adaptive-thinking models reject non-default temperature/top_p/top_k with
+ * a 400, regardless of whether thinking is enabled. Anthropic's default
+ * temperature is 1 — anything else is non-default and must be stripped.
+ * top_p/top_k have no usable default on these models, so always stripped.
+ */
+function stripRestrictedSamplingParams(parsed) {
+    if (!ADAPTIVE_THINKING_MODEL_PATTERN.test(String(parsed.model ?? '')))
+        return;
+    if (parsed.temperature !== undefined && parsed.temperature !== 1) {
+        delete parsed.temperature;
+    }
+    delete parsed.top_p;
+    delete parsed.top_k;
+}
+/**
+ * Remove tool_use/tool_result blocks that are not adjacent pairs. Anthropic
+ * requires a tool_result to be the first content in the message immediately
+ * following its tool_use — a summary inserted by /undo or /compact can leave
+ * the ids matched but no longer adjacent, which the API rejects with a 400.
  * Messages left with no content blocks are dropped entirely.
  */
 function repairOrphanedToolPairs(parsed) {
     if (!Array.isArray(parsed.messages))
         return;
-    const toolUseIds = new Set();
-    const toolResultIds = new Set();
-    for (const msg of parsed.messages) {
+    const messages = parsed.messages;
+    const useMsgIndex = new Map();
+    const resultMsgIndex = new Map();
+    messages.forEach((msg, index) => {
         if (!isRecord(msg) || !Array.isArray(msg.content))
-            continue;
+            return;
         for (const block of msg.content) {
             if (!isRecord(block))
                 continue;
-            if (block.type === 'tool_use' && typeof block.id === 'string') {
-                toolUseIds.add(block.id);
+            if (block.type === 'tool_use' &&
+                typeof block.id === 'string' &&
+                !useMsgIndex.has(block.id)) {
+                useMsgIndex.set(block.id, index);
             }
             else if (block.type === 'tool_result' &&
-                typeof block.tool_use_id === 'string') {
-                toolResultIds.add(block.tool_use_id);
+                typeof block.tool_use_id === 'string' &&
+                !resultMsgIndex.has(block.tool_use_id)) {
+                resultMsgIndex.set(block.tool_use_id, index);
             }
         }
-    }
-    parsed.messages = parsed.messages.filter((msg) => {
+    });
+    const isAdjacentPair = (id) => {
+        const useIndex = useMsgIndex.get(id);
+        return useIndex !== undefined && resultMsgIndex.get(id) === useIndex + 1;
+    };
+    parsed.messages = messages.filter((msg, index) => {
         if (!isRecord(msg) || !Array.isArray(msg.content))
             return true;
         const filteredContent = msg.content.filter((block) => {
             if (!isRecord(block))
                 return true;
             if (block.type === 'tool_use' && typeof block.id === 'string') {
-                return toolResultIds.has(block.id);
+                return isAdjacentPair(block.id) && useMsgIndex.get(block.id) === index;
             }
             if (block.type === 'tool_result' &&
                 typeof block.tool_use_id === 'string') {
-                return toolUseIds.has(block.tool_use_id);
+                return (isAdjacentPair(block.tool_use_id) &&
+                    resultMsgIndex.get(block.tool_use_id) === index);
             }
             return true;
         });
@@ -508,8 +555,27 @@ function repairOrphanedToolPairs(parsed) {
     });
 }
 /**
- * Remove trailing assistant-role messages. OAuth endpoints reject requests
- * that end with an assistant turn (assistant prefill is not supported).
+ * Anthropic requires tool_result blocks to precede any text in a message
+ * (text-before-tool_result is a 400). Reorder in place when both are present.
+ */
+function reorderToolResultBlocks(parsed) {
+    if (!Array.isArray(parsed.messages))
+        return;
+    for (const msg of parsed.messages) {
+        if (!isRecord(msg) || !Array.isArray(msg.content))
+            continue;
+        const hasToolResult = msg.content.some((block) => isRecord(block) && block.type === 'tool_result');
+        if (!hasToolResult)
+            continue;
+        const results = msg.content.filter((block) => isRecord(block) && block.type === 'tool_result');
+        const rest = msg.content.filter((block) => !(isRecord(block) && block.type === 'tool_result'));
+        msg.content = [...results, ...rest];
+    }
+}
+/**
+ * Remove trailing assistant-role messages. Claude 4.6+ models reject
+ * requests that end with an assistant turn (assistant prefill is not
+ * supported on these model generations).
  */
 function stripTrailingAssistantMessages(parsed) {
     if (!Array.isArray(parsed.messages))
@@ -625,6 +691,9 @@ export function rewriteRequestBody(body) {
         const parsed = JSON.parse(body);
         parsed.system = prependClaudeCodeIdentity(parsed.system);
         repairOrphanedToolPairs(parsed);
+        reorderToolResultBlocks(parsed);
+        normalizeAdaptiveThinking(parsed);
+        stripRestrictedSamplingParams(parsed);
         stripUnsupportedEffortForHaiku(parsed);
         stripTrailingAssistantMessages(parsed);
         applyHybridCache1h(parsed);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sahiljassal/opencode-anthropic-auth",
-  "version": "2.4.1",
+  "version": "2.5.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/shljsl75891/opencode-anthropic-auth.git"