@slkiser/opencode-quota 5.0.3 → 6.0.0-beta.1

package/dist/lib/anthropic.js

@@ -16,6 +16,7 @@ import { join } from "path";
 import { resolveAnthropicOAuthCached } from "./anthropic-auth.js";
 import { sanitizeDisplaySnippet, sanitizeDisplayText } from "./display-sanitize.js";
 import { fetchWithTimeout } from "./http.js";
+import { asRecord, finiteNumber, nonEmptyString } from "./json-guards.js";
 import { composeResolvedAuthIdentities, deriveResolvedAuthIdentity, } from "./resolved-auth-identity.js";
 const DEFAULT_CLAUDE_BINARY = "claude";
 /** How `binaryPath` reads when the default `claude` ran from PATH. */
@@ -28,15 +29,51 @@ const ANTHROPIC_OAUTH_COOLDOWN_MAX_ENTRIES = 16;
 const ANTHROPIC_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
 const ANTHROPIC_BETA_HEADER = "oauth-2025-04-20";
 const CLAUDE_CODE_CREDENTIALS_SERVICE = "Claude Code-credentials";
+const CLAUDE_KEYCHAIN_LOCATION = `macOS Keychain service ${CLAUDE_CODE_CREDENTIALS_SERVICE}`;
+const CLAUDE_NOT_AUTHENTICATED_MESSAGE = "Claude is not authenticated. Run `claude auth login` and try again.";
 const CLAUDE_NO_LOCAL_QUOTA_MESSAGE = "Claude CLI auth detected, but local quota windows were not exposed.";
 const ANTHROPIC_NO_QUOTA_MESSAGE = "Claude CLI auth detected, but quota was unavailable from the local CLI and OAuth credential sources.";
+const USED_PERCENT_KEYS = [
+    "utilization",
+    "used_percentage",
+    "usedPercentage",
+    "used_percent",
+    "usedPercent",
+    "percent_used",
+    "percentUsed",
+];
+const NESTED_USAGE_KEYS = [
+    "quota",
+    "usage",
+    "rate_limits",
+    "rateLimits",
+    "oauth_usage",
+    "oauthUsage",
+];
+const UNSUPPORTED_COMMAND_TEXT = ["unknown command", "unrecognized command", "unexpected argument"];
+const UNAUTHENTICATED_TEXT = [
+    "not logged in",
+    "login required",
+    "authentication required",
+    "run `claude login`",
+    "run `claude auth login`",
+    "run claude login",
+    "run claude auth login",
+];
+const COMMAND_MISSING_TEXT = [
+    "command not found",
+    "not recognized as an internal or external command",
+    "no such file or directory",
+];
 const diagnosticsCache = new Map();
 const localDiagnosticsCache = new Map();
 const anthropicOAuthCooldowns = new Map();
 const anthropicOAuthInFlight = new Map();
-export function resolveAnthropicBinaryPath(binaryPath) {
-    const trimmed = binaryPath?.trim();
-    return trimmed ? trimmed : DEFAULT_CLAUDE_BINARY;
+function errorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function resolveAnthropicBinaryPath(binaryPath) {
+    return binaryPath?.trim() || DEFAULT_CLAUDE_BINARY;
 }
 /**
  * Usual Claude CLI install locations, tried in order when `anthropicBinaryPath`
@@ -57,219 +94,114 @@ function formatCommandDisplayArg(value) {
     const sanitized = sanitizeDisplayText(value);
     return /[\s"]/u.test(sanitized) ? JSON.stringify(sanitized) : sanitized;
 }
-function formatCommandDisplay(parts) {
-    return parts.map(formatCommandDisplayArg).join(" ");
-}
 function quoteWindowsCmdArg(value) {
     const escaped = value.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/g, "$1$1");
     return `"${escaped}"`;
 }
-function shouldBridgeClaudeCommandThroughWindowsShell(binaryPath) {
-    const normalized = binaryPath.trim().toLowerCase();
-    if (!/[\\/]/u.test(normalized)) {
-        return true;
-    }
-    return /\.(?:cmd|bat)$/u.test(normalized);
-}
 export function buildClaudeCommandInvocation(binaryPath, args, runtime = {}) {
     const resolvedBinaryPath = resolveAnthropicBinaryPath(binaryPath);
-    const display = formatCommandDisplay([resolvedBinaryPath, ...args]);
-    if ((runtime.platform ?? process.platform) === "win32" &&
-        shouldBridgeClaudeCommandThroughWindowsShell(resolvedBinaryPath)) {
+    const display = [resolvedBinaryPath, ...args].map(formatCommandDisplayArg).join(" ");
+    // On Windows, PATH lookups and .cmd/.bat shims only run through cmd.exe.
+    const needsWindowsShell = !/[\\/]/u.test(resolvedBinaryPath) || /\.(?:cmd|bat)$/iu.test(resolvedBinaryPath);
+    if ((runtime.platform ?? process.platform) === "win32" && needsWindowsShell) {
         return {
             file: runtime.comspec?.trim() || process.env["ComSpec"]?.trim() || "cmd.exe",
             args: ["/d", "/s", "/c", [resolvedBinaryPath, ...args].map(quoteWindowsCmdArg).join(" ")],
             display,
         };
     }
-    return {
-        file: resolvedBinaryPath,
-        args: [...args],
-        display,
-    };
-}
-function asRecord(value) {
-    return value && typeof value === "object" && !Array.isArray(value)
-        ? value
-        : null;
+    return { file: resolvedBinaryPath, args: [...args], display };
 }
 function normalizeResetTimeIso(value) {
-    if (typeof value !== "string") {
-        return undefined;
-    }
-    const trimmed = value.trim();
-    if (!trimmed) {
-        return undefined;
-    }
-    const parsed = Date.parse(trimmed);
-    if (!Number.isFinite(parsed)) {
+    const text = nonEmptyString(value);
+    if (!text)
         return undefined;
-    }
-    return new Date(parsed).toISOString();
+    const parsed = Date.parse(text);
+    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : undefined;
 }
+/** A finite number, or a numeric string such as "35". */
 function normalizeUsagePercent(value) {
-    if (typeof value === "number" && Number.isFinite(value)) {
-        return value;
-    }
-    if (typeof value === "string") {
-        const trimmed = value.trim();
-        if (!trimmed) {
-            return undefined;
-        }
-        const parsed = Number(trimmed);
-        return Number.isFinite(parsed) ? parsed : undefined;
-    }
-    return undefined;
-}
-function getWindowUsedPercent(window) {
-    const candidates = [
-        window["utilization"],
-        window["used_percentage"],
-        window["usedPercentage"],
-        window["used_percent"],
-        window["usedPercent"],
-        window["percent_used"],
-        window["percentUsed"],
-    ];
-    for (const candidate of candidates) {
-        const normalized = normalizeUsagePercent(candidate);
-        if (normalized !== undefined) {
-            return normalized;
-        }
-    }
-    return undefined;
-}
-function getWindowResetTimeIso(window) {
-    return normalizeResetTimeIso(window["resets_at"] ?? window["resetsAt"] ?? window["reset_at"] ?? window["resetAt"]);
+    if (typeof value !== "string")
+        return finiteNumber(value);
+    const text = nonEmptyString(value);
+    return text === undefined ? undefined : finiteNumber(Number(text));
 }
 function parseQuotaWindow(window) {
     const record = asRecord(window);
-    if (!record) {
+    if (!record)
         return null;
-    }
-    const used = getWindowUsedPercent(record);
-    if (used === undefined) {
+    const used = USED_PERCENT_KEYS.map((key) => normalizeUsagePercent(record[key])).find((percent) => percent !== undefined);
+    if (used === undefined)
         return null;
-    }
     return {
         percentRemaining: Math.min(100, Math.round(100 - used)),
-        resetTimeIso: getWindowResetTimeIso(record),
+        resetTimeIso: normalizeResetTimeIso(record["resets_at"] ?? record["resetsAt"] ?? record["reset_at"] ?? record["resetAt"]),
     };
 }
 function parseExtraUsageQuota(extraUsage) {
     const record = asRecord(extraUsage);
-    if (!record || record["is_enabled"] !== true) {
-        return undefined;
-    }
-    const used = record["utilization"];
-    if (typeof used !== "number" || !Number.isFinite(used) || used < 0 || used > 100) {
+    const used = finiteNumber(record?.["utilization"]);
+    if (record?.["is_enabled"] !== true || used === undefined || used < 0 || used > 100) {
         return undefined;
     }
     return { percentRemaining: Math.round(100 - used) };
 }
-function getUsageRoots(data) {
-    const root = asRecord(data);
-    if (!root) {
-        return [];
-    }
-    const candidates = [
-        root,
-        asRecord(root["quota"]),
-        asRecord(root["usage"]),
-        asRecord(root["rate_limits"]),
-        asRecord(root["rateLimits"]),
-        asRecord(root["oauth_usage"]),
-        asRecord(root["oauthUsage"]),
-    ];
-    const seen = new Set();
-    const roots = [];
-    for (const candidate of candidates) {
-        if (!candidate || seen.has(candidate)) {
-            continue;
-        }
-        seen.add(candidate);
-        roots.push(candidate);
-    }
-    return roots;
-}
+/** The `weekly_scoped` limit for the Fable model in the OAuth usage `limits` list. */
 function parseFableWeeklyWindow(limits) {
-    if (!Array.isArray(limits)) {
+    if (!Array.isArray(limits))
         return undefined;
-    }
     for (const value of limits) {
         const limit = asRecord(value);
-        if (!limit || limit["kind"] !== "weekly_scoped") {
-            continue;
-        }
-        const scope = asRecord(limit["scope"]);
-        const model = asRecord(scope?.["model"]);
-        const displayName = model?.["display_name"];
-        if (displayName !== "Fable") {
+        const model = asRecord(asRecord(limit?.["scope"])?.["model"]);
+        if (!limit || limit["kind"] !== "weekly_scoped" || model?.["display_name"] !== "Fable") {
             continue;
         }
         const window = parseQuotaWindow({
             utilization: limit["percent"],
             resets_at: limit["resets_at"],
         });
-        if (window) {
+        if (window)
             return window;
-        }
     }
     return undefined;
 }
-function parseUsageResponse(data, options = {}) {
-    for (const root of getUsageRoots(data)) {
-        const fiveHour = parseQuotaWindow(root["five_hour"] ?? root["fiveHour"]);
-        const sevenDay = parseQuotaWindow(root["seven_day"] ?? root["sevenDay"]);
-        if (!fiveHour || !sevenDay) {
-            continue;
-        }
-        const extraUsage = options.includeExtraUsage
-            ? parseExtraUsageQuota(root["extra_usage"])
-            : undefined;
-        return {
-            success: true,
-            five_hour: fiveHour,
-            seven_day: sevenDay,
-            ...(extraUsage ? { extra_usage: extraUsage } : {}),
-        };
-    }
-    return null;
-}
-function parseOAuthUsageResponse(data) {
-    for (const root of getUsageRoots(data)) {
-        const fiveHour = parseQuotaWindow(root["five_hour"] ?? root["fiveHour"]);
-        const sevenDay = parseQuotaWindow(root["seven_day"] ?? root["sevenDay"]);
-        if (!fiveHour || !sevenDay) {
+/** The first of the response root and its nested usage objects that has both the 5h and 7d windows. */
+function findUsageWindows(data) {
+    const root = asRecord(data);
+    if (!root)
+        return null;
+    const candidates = [root, ...NESTED_USAGE_KEYS.map((key) => asRecord(root[key]))];
+    for (const candidate of candidates) {
+        if (!candidate)
             continue;
-        }
-        const extraUsage = parseExtraUsageQuota(root["extra_usage"]);
-        const fableWeekly = parseFableWeeklyWindow(root["limits"]);
-        return {
-            success: true,
-            five_hour: fiveHour,
-            seven_day: sevenDay,
-            ...(extraUsage ? { extra_usage: extraUsage } : {}),
-            ...(fableWeekly ? { fable_weekly: fableWeekly } : {}),
-        };
+        const fiveHour = parseQuotaWindow(candidate["five_hour"] ?? candidate["fiveHour"]);
+        const sevenDay = parseQuotaWindow(candidate["seven_day"] ?? candidate["sevenDay"]);
+        if (fiveHour && sevenDay)
+            return { root: candidate, fiveHour, sevenDay };
     }
     return null;
 }
-function getClaudeCredentialsPath() {
-    return join(homedir(), ".claude", ".credentials.json");
-}
-function getClaudeKeychainLocation() {
-    return `macOS Keychain service ${sanitizeDisplayText(CLAUDE_CODE_CREDENTIALS_SERVICE)}`;
+/** Quota from Claude CLI `auth status --json`: only the 5h and 7d windows. */
+function parseUsageResponse(data) {
+    const windows = findUsageWindows(data);
+    return windows
+        ? { success: true, five_hour: windows.fiveHour, seven_day: windows.sevenDay }
+        : null;
 }
-function getClaudeCredentialsNotFoundDetail(locations) {
-    if (locations.length === 0) {
-        return "Claude OAuth credentials were not found.";
-    }
-    if (locations.length === 1) {
-        return `Claude OAuth credentials not found in ${locations[0]}.`;
-    }
-    const [head, ...tail] = locations;
-    return `Claude OAuth credentials not found in ${head} or ${tail.join(" or ")}.`;
+/** Quota from the OAuth usage endpoint: the 5h and 7d windows, Usage Credits and Fable weekly. */
+function parseOAuthUsageResponse(data) {
+    const windows = findUsageWindows(data);
+    if (!windows)
+        return null;
+    const extraUsage = parseExtraUsageQuota(windows.root["extra_usage"]);
+    const fableWeekly = parseFableWeeklyWindow(windows.root["limits"]);
+    return {
+        success: true,
+        five_hour: windows.fiveHour,
+        seven_day: windows.sevenDay,
+        ...(extraUsage ? { extra_usage: extraUsage } : {}),
+        ...(fableWeekly ? { fable_weekly: fableWeekly } : {}),
+    };
 }
 function buildAnthropicNoQuotaDiagnosticsMessage(detail) {
     const normalizedDetail = detail?.trim();
@@ -279,168 +211,118 @@ function buildAnthropicNoQuotaDiagnosticsMessage(detail) {
 }
 function extractClaudeCredentialsAccessToken(data) {
     const root = asRecord(data);
-    if (!root) {
-        return "";
-    }
-    for (const candidate of [asRecord(root["claudeAiOauth"]), asRecord(root["oauth"]), root]) {
-        if (!candidate) {
-            continue;
-        }
+    for (const candidate of [asRecord(root?.["claudeAiOauth"]), asRecord(root?.["oauth"]), root]) {
         for (const key of ["accessToken", "access_token", "token"]) {
-            const token = candidate[key];
-            if (typeof token === "string" && token.trim()) {
-                return token.trim();
-            }
+            const token = nonEmptyString(candidate?.[key]);
+            if (token)
+                return token;
         }
     }
-    return "";
+    return undefined;
 }
-function parseClaudeCredentialsAccessToken(content, options) {
+/** Reads the access token from stored Claude credentials; the Keychain may hold the bare token. */
+function parseClaudeCredentials(content, source) {
+    const missing = {
+        state: "unavailable",
+        detail: `Claude OAuth access token missing in ${source.location}.`,
+    };
     const trimmed = content.trim();
-    if (!trimmed) {
-        return { error: "missing" };
-    }
     if (!trimmed.startsWith("{") && !trimmed.startsWith("[")) {
-        return options.allowPlainText ? { accessToken: trimmed } : { error: "missing" };
+        return source.allowPlainText && trimmed
+            ? { state: "configured", accessToken: trimmed }
+            : missing;
     }
     try {
-        const parsed = JSON.parse(trimmed);
-        const accessToken = extractClaudeCredentialsAccessToken(parsed);
-        return accessToken ? { accessToken } : { error: "missing" };
+        const accessToken = extractClaudeCredentialsAccessToken(JSON.parse(trimmed));
+        return accessToken ? { state: "configured", accessToken } : missing;
     }
     catch (error) {
         return {
-            error: sanitizeDisplayText(error instanceof Error ? error.message : String(error)),
+            state: "unavailable",
+            detail: `Could not parse ${source.parseFailureLabel}: ${sanitizeDisplayText(errorText(error))}.`,
         };
     }
 }
-async function runCredentialCommand(file, args) {
-    return await new Promise((resolve, reject) => {
-        try {
-            execFile(file, args, {
-                encoding: "utf8",
-                timeout: CLAUDE_COMMAND_TIMEOUT_MS,
-                maxBuffer: 1024 * 1024,
-            }, (error, stdout, stderr) => {
-                const stdoutText = typeof stdout === "string" ? stdout : stdout.toString("utf8");
-                const stderrText = typeof stderr === "string" ? stderr : stderr.toString("utf8");
-                if (!error) {
-                    resolve({
-                        code: 0,
-                        stdout: stdoutText,
-                        stderr: stderrText,
-                        timedOut: false,
-                    });
-                    return;
-                }
-                const execError = error;
-                resolve({
-                    code: typeof execError.code === "number" ? execError.code : null,
-                    stdout: stdoutText,
-                    stderr: stderrText,
-                    timedOut: isTimedOutError(execError),
-                    spawnErrorCode: execError.code,
-                    errorMessage: execError.message,
-                });
+async function runCommand(file, args) {
+    return await new Promise((resolve) => {
+        execFile(file, args, { encoding: "utf8", timeout: CLAUDE_COMMAND_TIMEOUT_MS, maxBuffer: 1024 * 1024 }, (error, stdout, stderr) => {
+            if (!error) {
+                resolve({ code: 0, stdout, stderr, timedOut: false });
+                return;
+            }
+            const execError = error;
+            resolve({
+                code: typeof execError.code === "number" ? execError.code : null,
+                stdout,
+                stderr,
+                timedOut: execError.code === "ETIMEDOUT" ||
+                    execError.killed === true ||
+                    execError.message.toLowerCase().includes("timed out"),
+                spawnErrorCode: execError.code,
+                errorMessage: execError.message,
             });
-        }
-        catch (error) {
-            reject(error);
-        }
+        });
     });
 }
-async function readClaudeCredentialsAccessTokenFromMacOSKeychain() {
-    if (process.platform !== "darwin") {
+async function readClaudeCredentialsFromMacOSKeychain() {
+    if (process.platform !== "darwin")
         return null;
-    }
-    const location = getClaudeKeychainLocation();
-    const result = await runCredentialCommand("security", [
+    const result = await runCommand("security", [
         "find-generic-password",
         "-s",
         CLAUDE_CODE_CREDENTIALS_SERVICE,
         "-w",
     ]);
-    if (result.code !== 0) {
-        return {
-            state: "not-found",
-            location,
-        };
-    }
-    const parsed = parseClaudeCredentialsAccessToken(result.stdout, { allowPlainText: true });
-    if (parsed.accessToken) {
-        return {
-            state: "configured",
-            accessToken: parsed.accessToken,
-        };
-    }
-    return {
-        state: "unavailable",
-        detail: parsed.error && parsed.error !== "missing"
-            ? `Could not parse Claude OAuth credentials from ${location}: ${parsed.error}.`
-            : `Claude OAuth access token missing in ${location}.`,
-    };
+    if (result.code !== 0)
+        return { state: "not-found", location: CLAUDE_KEYCHAIN_LOCATION };
+    return parseClaudeCredentials(result.stdout, {
+        location: CLAUDE_KEYCHAIN_LOCATION,
+        parseFailureLabel: `Claude OAuth credentials from ${CLAUDE_KEYCHAIN_LOCATION}`,
+        allowPlainText: true,
+    });
 }
-async function readClaudeCredentialsAccessTokenFromFile() {
-    const credentialsPath = getClaudeCredentialsPath();
+async function readClaudeCredentialsFromFile() {
+    const credentialsPath = join(homedir(), ".claude", ".credentials.json");
+    const location = sanitizeDisplayText(credentialsPath);
+    let content;
     try {
-        const content = await readFile(credentialsPath, "utf8");
-        const parsed = parseClaudeCredentialsAccessToken(content, { allowPlainText: false });
-        const accessToken = parsed.accessToken?.trim() ?? "";
-        if (!accessToken) {
-            return {
-                state: "unavailable",
-                detail: parsed.error && parsed.error !== "missing"
-                    ? `Could not parse Claude credentials file ${sanitizeDisplayText(credentialsPath)}: ${parsed.error}.`
-                    : `Claude OAuth access token missing in ${sanitizeDisplayText(credentialsPath)}.`,
-            };
-        }
-        return {
-            state: "configured",
-            accessToken,
-        };
+        content = await readFile(credentialsPath, "utf8");
     }
     catch (error) {
-        const code = error && typeof error === "object" && "code" in error
-            ? error.code
-            : undefined;
-        if (code === "ENOENT") {
-            return {
-                state: "not-found",
-                location: sanitizeDisplayText(credentialsPath),
-            };
+        if (error?.code === "ENOENT") {
+            return { state: "not-found", location };
         }
         return {
             state: "unavailable",
-            detail: `Could not read Claude credentials file: ${sanitizeDisplayText(error instanceof Error ? error.message : String(error))}`,
+            detail: `Could not read Claude credentials file: ${sanitizeDisplayText(errorText(error))}`,
         };
     }
+    return parseClaudeCredentials(content, {
+        location,
+        parseFailureLabel: `Claude credentials file ${location}`,
+        allowPlainText: false,
+    });
 }
 async function readClaudeOAuthAccessToken() {
-    const locationsChecked = [];
+    const notFoundLocations = [];
     const unavailableDetails = [];
-    const keychainCredentials = await readClaudeCredentialsAccessTokenFromMacOSKeychain();
-    if (keychainCredentials?.state === "configured") {
-        return { ...keychainCredentials, source: "claude-credentials" };
-    }
-    if (keychainCredentials?.state === "unavailable") {
-        unavailableDetails.push(keychainCredentials.detail);
-    }
-    if (keychainCredentials?.state === "not-found") {
-        locationsChecked.push(keychainCredentials.location);
-    }
-    const fileCredentials = await readClaudeCredentialsAccessTokenFromFile();
-    if (fileCredentials.state === "configured") {
-        return { ...fileCredentials, source: "claude-credentials" };
-    }
-    if (fileCredentials.state === "unavailable") {
-        unavailableDetails.push(fileCredentials.detail);
-    }
-    if (fileCredentials.state === "not-found") {
-        locationsChecked.push(fileCredentials.location);
+    for (const readSource of [
+        readClaudeCredentialsFromMacOSKeychain,
+        readClaudeCredentialsFromFile,
+    ]) {
+        const result = await readSource();
+        if (result?.state === "configured") {
+            return { state: "configured", accessToken: result.accessToken, source: "claude-credentials" };
+        }
+        if (result?.state === "unavailable")
+            unavailableDetails.push(result.detail);
+        if (result?.state === "not-found")
+            notFoundLocations.push(result.location);
     }
     return {
         state: "unavailable",
-        detail: unavailableDetails[0] ?? getClaudeCredentialsNotFoundDetail(locationsChecked),
+        detail: unavailableDetails[0] ??
+            `Claude OAuth credentials not found in ${notFoundLocations.join(" or ")}.`,
     };
 }
 async function readAnthropicOAuthAccessToken(options) {
@@ -456,31 +338,34 @@ async function readAnthropicOAuthAccessToken(options) {
         ? await readClaudeOAuthAccessToken()
         : { state: "unavailable" };
 }
-function fingerprintAccessToken(accessToken) {
-    return createHash("sha256").update(accessToken).digest("hex");
-}
 function parseRetryAfterMs(value, nowMs) {
     const trimmed = value?.trim();
-    if (!trimmed) {
+    if (!trimmed)
         return undefined;
-    }
     if (/^[+-]?(?:\d+(?:\.\d+)?|\.\d+)$/u.test(trimmed)) {
         const seconds = Number(trimmed);
         return Number.isFinite(seconds) && seconds > 0 ? seconds * 1_000 : undefined;
     }
-    const retryAtMs = Date.parse(trimmed);
-    const durationMs = retryAtMs - nowMs;
+    const durationMs = Date.parse(trimmed) - nowMs;
     return Number.isFinite(durationMs) && durationMs > 0 ? durationMs : undefined;
 }
-function getAnthropicOAuthCooldownDurationMs(failureCount, retryAfter, nowMs) {
-    const exponentialMs = Math.min(ANTHROPIC_OAUTH_COOLDOWN_MAX_MS, ANTHROPIC_OAUTH_BACKOFF_BASE_MS * 2 ** Math.min(failureCount, 30));
-    const retryAfterMs = Math.min(ANTHROPIC_OAUTH_COOLDOWN_MAX_MS, parseRetryAfterMs(retryAfter, nowMs) ?? 0);
-    return Math.max(exponentialMs, retryAfterMs);
+/** Records a 429 for this token and returns how long the usage probe stays paused. */
+function startAnthropicOAuthCooldown(tokenFingerprint, retryAfter) {
+    const nowMs = Date.now();
+    const failureCount = anthropicOAuthCooldowns.get(tokenFingerprint)?.failureCount ?? 0;
+    // Exponential backoff from 30s, raised to Retry-After, capped at 15 minutes.
+    const durationMs = Math.min(ANTHROPIC_OAUTH_COOLDOWN_MAX_MS, Math.max(ANTHROPIC_OAUTH_BACKOFF_BASE_MS * 2 ** failureCount, parseRetryAfterMs(retryAfter, nowMs) ?? 0));
+    anthropicOAuthCooldowns.set(tokenFingerprint, {
+        failureCount: failureCount + 1,
+        blockedUntilMs: nowMs + durationMs,
+    });
+    return durationMs;
 }
 function getAnthropicOAuthCooldownMessage(remainingMs) {
-    const boundedRemainingMs = Math.min(ANTHROPIC_OAUTH_COOLDOWN_MAX_MS, Math.max(0, remainingMs));
-    return `Anthropic OAuth usage probe paused after HTTP 429; retry in ${Math.ceil(boundedRemainingMs / 1_000)}s.`;
+    const seconds = Math.ceil(Math.min(ANTHROPIC_OAUTH_COOLDOWN_MAX_MS, remainingMs) / 1_000);
+    return `Anthropic OAuth usage probe paused after HTTP 429; retry in ${seconds}s.`;
 }
+/** Bounds the cooldown map, evicting the soonest-expiring entries other than this token. */
 function retainAnthropicOAuthCooldownForToken(tokenFingerprint) {
     const targetSize = anthropicOAuthCooldowns.has(tokenFingerprint)
         ? ANTHROPIC_OAUTH_COOLDOWN_MAX_ENTRIES
@@ -493,20 +378,14 @@ function retainAnthropicOAuthCooldownForToken(tokenFingerprint) {
             anthropicOAuthCooldowns.delete(fingerprint);
     }
 }
-function redactAccessTokenFromSanitizedDetail(detail, accessToken) {
-    const sanitizedDetail = sanitizeDisplayText(detail);
+/** Sanitizes a detail and removes the token, also in the form sanitizing may reassemble. */
+function redactAccessToken(detail, accessToken) {
     const sanitizedAccessToken = sanitizeDisplayText(accessToken);
-    const redactedDetail = sanitizedDetail.split(accessToken).join("[redacted]");
+    const redactedDetail = sanitizeDisplayText(detail).split(accessToken).join("[redacted]");
     return sanitizedAccessToken
         ? redactedDetail.split(sanitizedAccessToken).join("[redacted]")
         : redactedDetail;
 }
-function sanitizeAnthropicApiDetail(detail, accessToken) {
-    return redactAccessTokenFromSanitizedDetail(detail, accessToken).slice(0, 120);
-}
-function sanitizeAnthropicRequestError(detail, accessToken) {
-    return redactAccessTokenFromSanitizedDetail(detail, accessToken);
-}
 async function performAnthropicOAuthUsageRequest(accessToken, tokenFingerprint, requestTimeoutMs) {
     try {
         return await fetchWithTimeout(ANTHROPIC_USAGE_URL, {
@@ -518,48 +397,32 @@ async function performAnthropicOAuthUsageRequest(accessToken, tokenFingerprint,
             },
             timeoutMs: requestTimeoutMs,
             consume: async (response, timeoutSignal) => {
-                if (response.status === 429) {
-                    const nowMs = Date.now();
-                    const previousFailureCount = anthropicOAuthCooldowns.get(tokenFingerprint)?.failureCount ?? 0;
-                    const durationMs = getAnthropicOAuthCooldownDurationMs(previousFailureCount, response.headers?.get?.("Retry-After") ?? null, nowMs);
-                    anthropicOAuthCooldowns.set(tokenFingerprint, {
-                        failureCount: previousFailureCount + 1,
-                        blockedUntilMs: nowMs + durationMs,
-                    });
-                    let detail = "";
-                    try {
-                        detail = sanitizeAnthropicApiDetail(await response.text(), accessToken);
-                    }
-                    catch (error) {
-                        if (timeoutSignal.aborted)
-                            throw error;
-                        detail = "";
-                    }
-                    const errorDetail = detail
-                        ? `Anthropic API error ${response.status}: ${detail}`
-                        : `Anthropic API returned ${response.status}`;
-                    return {
-                        state: "unavailable",
-                        detail: `${errorDetail} ${getAnthropicOAuthCooldownMessage(durationMs)}`,
-                    };
-                }
-                anthropicOAuthCooldowns.delete(tokenFingerprint);
+                // The cooldown starts before the body is read, so a stalled 429 body still pauses retries.
+                const cooldownMs = response.status === 429
+                    ? startAnthropicOAuthCooldown(tokenFingerprint, response.headers.get("Retry-After"))
+                    : undefined;
+                if (cooldownMs === undefined)
+                    anthropicOAuthCooldowns.delete(tokenFingerprint);
                 if (!response.ok) {
                     const authenticationFailure = response.status === 401 || response.status === 403;
                     let detail = "";
                     try {
-                        detail = sanitizeAnthropicApiDetail(await response.text(), accessToken);
+                        detail = redactAccessToken(await response.text(), accessToken).slice(0, 120);
                     }
                     catch (error) {
+                        // A rejected token needs no body (it triggers the credential fallback);
+                        // any other timed-out body read fails the whole request.
                         if (timeoutSignal.aborted && !authenticationFailure)
                             throw error;
-                        detail = "";
                     }
+                    const errorDetail = detail
+                        ? `Anthropic API error ${response.status}: ${detail}`
+                        : `Anthropic API returned ${response.status}`;
                     return {
                         state: "unavailable",
-                        detail: detail
-                            ? `Anthropic API error ${response.status}: ${detail}`
-                            : `Anthropic API returned ${response.status}`,
+                        detail: cooldownMs === undefined
+                            ? errorDetail
+                            : `${errorDetail} ${getAnthropicOAuthCooldownMessage(cooldownMs)}`,
                         ...(authenticationFailure ? { failureKind: "authentication" } : {}),
                     };
                 }
@@ -570,34 +433,21 @@ async function performAnthropicOAuthUsageRequest(accessToken, tokenFingerprint,
                 catch (error) {
                     if (timeoutSignal.aborted)
                         throw error;
-                    return {
-                        state: "unavailable",
-                        detail: "Failed to parse Anthropic quota response",
-                    };
+                    return { state: "unavailable", detail: "Failed to parse Anthropic quota response" };
                 }
                 const quota = parseOAuthUsageResponse(data);
-                if (!quota) {
-                    return {
-                        state: "unavailable",
-                        detail: "Unexpected Anthropic quota response shape",
-                    };
-                }
-                return {
-                    state: "success",
-                    quota,
-                };
+                return quota
+                    ? { state: "success", quota }
+                    : { state: "unavailable", detail: "Unexpected Anthropic quota response shape" };
             },
         });
     }
     catch (error) {
-        return {
-            state: "unavailable",
-            detail: sanitizeAnthropicRequestError(error instanceof Error ? error.message : String(error), accessToken),
-        };
+        return { state: "unavailable", detail: redactAccessToken(errorText(error), accessToken) };
     }
 }
 async function queryAnthropicQuotaFromOAuthAccessToken(accessToken, requestTimeoutMs) {
-    const tokenFingerprint = fingerprintAccessToken(accessToken);
+    const tokenFingerprint = createHash("sha256").update(accessToken).digest("hex");
     retainAnthropicOAuthCooldownForToken(tokenFingerprint);
     const nowMs = Date.now();
     const cooldown = anthropicOAuthCooldowns.get(tokenFingerprint);
@@ -607,10 +457,10 @@ async function queryAnthropicQuotaFromOAuthAccessToken(accessToken, requestTimeo
             detail: getAnthropicOAuthCooldownMessage(cooldown.blockedUntilMs - nowMs),
         };
     }
+    // Concurrent probes with the same token share one request.
     const existingInFlight = anthropicOAuthInFlight.get(tokenFingerprint);
-    if (existingInFlight) {
+    if (existingInFlight)
         return await existingInFlight;
-    }
     const inFlight = performAnthropicOAuthUsageRequest(accessToken, tokenFingerprint, requestTimeoutMs);
     anthropicOAuthInFlight.set(tokenFingerprint, inFlight);
     try {
@@ -624,170 +474,79 @@ async function queryAnthropicQuotaFromOAuthAccessToken(accessToken, requestTimeo
 }
 export async function queryAnthropicQuotaWithOAuth(accessToken, requestTimeoutMs) {
     const result = await queryAnthropicQuotaFromOAuthAccessToken(accessToken, requestTimeoutMs);
-    return result.state === "success"
-        ? result.quota
-        : { success: false, error: result.detail ?? "Anthropic OAuth quota unavailable" };
+    return result.state === "success" ? result.quota : { success: false, error: result.detail };
 }
 function extractAuthBoolean(data) {
     const record = asRecord(data);
-    if (!record) {
+    if (!record)
         return undefined;
-    }
+    const auth = asRecord(record["auth"]);
     for (const candidate of [
         record["authenticated"],
         record["isAuthenticated"],
         record["loggedIn"],
+        auth?.["authenticated"],
+        auth?.["loggedIn"],
     ]) {
-        if (typeof candidate === "boolean") {
+        if (typeof candidate === "boolean")
             return candidate;
-        }
-    }
-    const authRecord = asRecord(record["auth"]);
-    if (authRecord) {
-        for (const candidate of [authRecord["authenticated"], authRecord["loggedIn"]]) {
-            if (typeof candidate === "boolean") {
-                return candidate;
-            }
-        }
-    }
-    const status = record["status"];
-    if (typeof status === "string") {
-        const normalized = status.trim().toLowerCase();
-        if (normalized === "authenticated") {
-            return true;
-        }
-        if (normalized === "unauthenticated") {
-            return false;
-        }
     }
+    const status = nonEmptyString(record["status"])?.toLowerCase();
+    if (status === "authenticated")
+        return true;
+    if (status === "unauthenticated")
+        return false;
     return undefined;
 }
-function hasUnsupportedCommandText(output) {
-    const normalized = output.toLowerCase();
-    return (normalized.includes("unknown command") ||
-        normalized.includes("unrecognized command") ||
-        normalized.includes("unexpected argument"));
-}
-function hasUnauthenticatedText(output) {
+function includesAnyPhrase(output, phrases) {
     const normalized = output.toLowerCase();
-    return (normalized.includes("not logged in") ||
-        normalized.includes("login required") ||
-        normalized.includes("authentication required") ||
-        normalized.includes("run `claude login`") ||
-        normalized.includes("run `claude auth login`") ||
-        normalized.includes("run claude login") ||
-        normalized.includes("run claude auth login"));
-}
-function detailFromCommandResult(result) {
-    const detail = `${result.stderr}\n${result.stdout}\n${result.errorMessage ?? ""}`.trim();
-    return detail ? sanitizeDisplaySnippet(detail, 160) : undefined;
+    return phrases.some((phrase) => normalized.includes(phrase));
 }
 function parseVersion(output) {
     const match = output.match(/\b\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?\b/);
     return match ? match[0] : null;
 }
 function isCommandMissing(result) {
-    if (result.spawnErrorCode === "ENOENT") {
-        return true;
-    }
-    const output = `${result.stderr}\n${result.stdout}\n${result.errorMessage ?? ""}`.toLowerCase();
-    return (output.includes("command not found") ||
-        output.includes("not recognized as an internal or external command") ||
-        output.includes("no such file or directory"));
-}
-function isTimedOutError(error) {
-    return (error.code === "ETIMEDOUT" ||
-        error.killed === true ||
-        error.message.toLowerCase().includes("timed out"));
-}
-async function runClaudeCommand(invocation) {
-    return await new Promise((resolve, reject) => {
-        try {
-            execFile(invocation.file, invocation.args, {
-                encoding: "utf8",
-                timeout: CLAUDE_COMMAND_TIMEOUT_MS,
-                maxBuffer: 1024 * 1024,
-            }, (error, stdout, stderr) => {
-                const stdoutText = typeof stdout === "string" ? stdout : stdout.toString("utf8");
-                const stderrText = typeof stderr === "string" ? stderr : stderr.toString("utf8");
-                if (!error) {
-                    resolve({
-                        code: 0,
-                        stdout: stdoutText,
-                        stderr: stderrText,
-                        timedOut: false,
-                    });
-                    return;
-                }
-                const execError = error;
-                resolve({
-                    code: typeof execError.code === "number" ? execError.code : null,
-                    stdout: stdoutText,
-                    stderr: stderrText,
-                    timedOut: isTimedOutError(execError),
-                    spawnErrorCode: execError.code,
-                    errorMessage: execError.message,
-                });
-            });
-        }
-        catch (error) {
-            reject(error);
-        }
-    });
+    return (result.spawnErrorCode === "ENOENT" ||
+        includesAnyPhrase(`${result.stderr}\n${result.stdout}\n${result.errorMessage ?? ""}`, COMMAND_MISSING_TEXT));
 }
 function parseClaudeAuthStatusResult(result) {
     const combinedOutput = `${result.stdout}\n${result.stderr}`;
-    if (hasUnsupportedCommandText(combinedOutput)) {
+    if (includesAnyPhrase(combinedOutput, UNSUPPORTED_COMMAND_TEXT)) {
         return {
             authStatus: "unknown",
             unsupportedCommand: true,
             message: "Claude CLI authentication status JSON is unavailable in this version of Claude.",
         };
     }
-    if (hasUnauthenticatedText(combinedOutput)) {
-        return {
-            authStatus: "unauthenticated",
-            message: "Claude is not authenticated. Run `claude auth login` and try again.",
-        };
+    if (includesAnyPhrase(combinedOutput, UNAUTHENTICATED_TEXT)) {
+        return { authStatus: "unauthenticated", message: CLAUDE_NOT_AUTHENTICATED_MESSAGE };
     }
     const trimmed = result.stdout.trim();
     if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
         try {
             const payload = JSON.parse(trimmed);
             const auth = extractAuthBoolean(payload);
-            if (auth === true) {
-                return {
-                    authStatus: "authenticated",
-                    jsonPayload: payload,
-                };
-            }
+            if (auth === true)
+                return { authStatus: "authenticated", jsonPayload: payload };
             if (auth === false) {
-                return {
-                    authStatus: "unauthenticated",
-                    message: "Claude is not authenticated. Run `claude auth login` and try again.",
-                    jsonPayload: payload,
-                };
+                return { authStatus: "unauthenticated", message: CLAUDE_NOT_AUTHENTICATED_MESSAGE };
             }
             return {
                 authStatus: "unknown",
                 message: "Could not verify Claude authentication status from JSON output.",
-                jsonPayload: payload,
             };
         }
         catch {
-            // Fall through to exit-code-based handling.
+            // Not JSON after all: fall through to exit-code-based handling.
         }
     }
-    if (result.code === 0) {
+    if (result.code === 0)
         return { authStatus: "authenticated" };
-    }
     if (result.timedOut) {
-        return {
-            authStatus: "unknown",
-            message: "Timed out while running Claude CLI auth status.",
-        };
+        return { authStatus: "unknown", message: "Timed out while running Claude CLI auth status." };
     }
-    const detail = detailFromCommandResult(result);
+    const detail = sanitizeDisplaySnippet(`${result.stderr}\n${result.stdout}\n${result.errorMessage ?? ""}`.trim(), 160);
     return {
         authStatus: "unknown",
         message: detail
@@ -795,43 +554,15 @@ function parseClaudeAuthStatusResult(result) {
             : "Could not verify Claude authentication status.",
     };
 }
-function mapLocalDiagnosticsToAnthropicDiagnostics(localDiagnostics) {
-    if (localDiagnostics.localQuota) {
-        return {
-            installed: localDiagnostics.installed,
-            version: localDiagnostics.version,
-            authStatus: localDiagnostics.authStatus,
-            quotaSupported: true,
-            quotaSource: "claude-auth-status-json",
-            binaryPath: localDiagnostics.binaryPath,
-            checkedCommands: localDiagnostics.checkedCommands,
-            quota: localDiagnostics.localQuota,
-        };
-    }
-    const diagnostics = {
-        installed: localDiagnostics.installed,
-        version: localDiagnostics.version,
-        authStatus: localDiagnostics.authStatus,
-        quotaSupported: false,
-        quotaSource: "none",
-        binaryPath: localDiagnostics.binaryPath,
-        checkedCommands: localDiagnostics.checkedCommands,
-    };
-    if (localDiagnostics.message) {
-        diagnostics.message = localDiagnostics.message;
-    }
-    return diagnostics;
-}
-async function runClaudeVersionCommand(binaryPath, checkedCommands) {
-    const versionCommand = buildClaudeCommandInvocation(binaryPath, ["--version"]);
-    checkedCommands.push(versionCommand.display);
-    return await runClaudeCommand(versionCommand);
-}
-async function probeAnthropicLocalDiagnostics(options = {}) {
-    const configuredBinaryPath = resolveAnthropicBinaryPath(options.binaryPath);
+async function probeAnthropicLocalDiagnostics(configuredBinaryPath) {
     const checkedCommands = [];
+    const runClaude = async (binaryPath, args) => {
+        const invocation = buildClaudeCommandInvocation(binaryPath, args);
+        checkedCommands.push(invocation.display);
+        return await runCommand(invocation.file, invocation.args);
+    };
     let binaryPath = configuredBinaryPath;
-    let versionResult = await runClaudeVersionCommand(binaryPath, checkedCommands);
+    let versionResult = await runClaude(binaryPath, ["--version"]);
     // No configured path and no `claude` on PATH: the first install folder whose CLI runs wins.
     const installFolderCandidates = configuredBinaryPath === DEFAULT_CLAUDE_BINARY ? claudeInstallFolderCandidates() : [];
     if (isCommandMissing(versionResult)) {
@@ -839,14 +570,14 @@ async function probeAnthropicLocalDiagnostics(options = {}) {
             if (!existsSync(candidate))
                 continue;
             binaryPath = candidate;
-            versionResult = await runClaudeVersionCommand(candidate, checkedCommands);
+            versionResult = await runClaude(candidate, ["--version"]);
             if (!isCommandMissing(versionResult))
                 break;
         }
     }
     if (isCommandMissing(versionResult)) {
         const alsoChecked = installFolderCandidates.length > 0
-            ? ` Also checked: ${installFolderCandidates.map((candidate) => sanitizeDisplayText(candidate)).join(", ")}.`
+            ? ` Also checked: ${installFolderCandidates.map(sanitizeDisplayText).join(", ")}.`
             : "";
         return {
             installed: false,
@@ -857,50 +588,23 @@ async function probeAnthropicLocalDiagnostics(options = {}) {
             message: `Claude CLI (\`${sanitizeDisplayText(configuredBinaryPath)}\`) is not installed or not on PATH.${alsoChecked}`,
         };
     }
-    const binaryPathDisplay = binaryPath === DEFAULT_CLAUDE_BINARY ? CLAUDE_ON_PATH_DISPLAY : binaryPath;
-    const version = parseVersion(`${versionResult.stdout}\n${versionResult.stderr}`);
-    const authStatusJsonCommand = buildClaudeCommandInvocation(binaryPath, [
-        "auth",
-        "status",
-        "--json",
-    ]);
-    checkedCommands.push(authStatusJsonCommand.display);
-    const authJsonResult = await runClaudeCommand(authStatusJsonCommand);
-    let parsedAuth = parseClaudeAuthStatusResult(authJsonResult);
+    const installed = {
+        installed: true,
+        version: parseVersion(`${versionResult.stdout}\n${versionResult.stderr}`),
+        binaryPath: binaryPath === DEFAULT_CLAUDE_BINARY ? CLAUDE_ON_PATH_DISPLAY : binaryPath,
+        checkedCommands,
+    };
+    let parsedAuth = parseClaudeAuthStatusResult(await runClaude(binaryPath, ["auth", "status", "--json"]));
     if (parsedAuth.unsupportedCommand) {
-        const authStatusCommand = buildClaudeCommandInvocation(binaryPath, ["auth", "status"]);
-        checkedCommands.push(authStatusCommand.display);
-        parsedAuth = parseClaudeAuthStatusResult(await runClaudeCommand(authStatusCommand));
+        parsedAuth = parseClaudeAuthStatusResult(await runClaude(binaryPath, ["auth", "status"]));
     }
     if (parsedAuth.authStatus !== "authenticated") {
-        return {
-            installed: true,
-            version,
-            authStatus: parsedAuth.authStatus,
-            binaryPath: binaryPathDisplay,
-            checkedCommands,
-            message: parsedAuth.message,
-        };
+        return { ...installed, authStatus: parsedAuth.authStatus, message: parsedAuth.message };
     }
-    const quota = parsedAuth.jsonPayload ? parseUsageResponse(parsedAuth.jsonPayload) : null;
-    if (quota) {
-        return {
-            installed: true,
-            version,
-            authStatus: "authenticated",
-            binaryPath: binaryPathDisplay,
-            checkedCommands,
-            localQuota: quota,
-        };
-    }
-    return {
-        installed: true,
-        version,
-        authStatus: "authenticated",
-        binaryPath: binaryPathDisplay,
-        checkedCommands,
-        message: CLAUDE_NO_LOCAL_QUOTA_MESSAGE,
-    };
+    const localQuota = parseUsageResponse(parsedAuth.jsonPayload);
+    return localQuota
+        ? { ...installed, authStatus: "authenticated", localQuota }
+        : { ...installed, authStatus: "authenticated", message: CLAUDE_NO_LOCAL_QUOTA_MESSAGE };
 }
 export function clearAnthropicDiagnosticsCacheForTests() {
     diagnosticsCache.clear();
@@ -908,148 +612,99 @@ export function clearAnthropicDiagnosticsCacheForTests() {
     anthropicOAuthCooldowns.clear();
     anthropicOAuthInFlight.clear();
 }
-async function getCachedAnthropicLocalDiagnostics(options = {}) {
-    const binaryPath = resolveAnthropicBinaryPath(options.binaryPath);
-    const now = Date.now();
-    const cached = localDiagnosticsCache.get(binaryPath) ?? {
-        timestamp: 0,
-        value: null,
-    };
-    if (cached.value &&
-        cached.timestamp > 0 &&
-        now - cached.timestamp < ANTHROPIC_DIAGNOSTICS_TTL_MS) {
+/**
+ * Reuses a probe result for a few seconds and shares one in-flight probe
+ * between concurrent callers. A failed probe is dropped so the next call retries.
+ */
+async function getCachedProbe(cache, key, probe) {
+    const cached = cache.get(key);
+    if (cached && "inFlight" in cached)
+        return await cached.inFlight;
+    if (cached && Date.now() - cached.timestamp < ANTHROPIC_DIAGNOSTICS_TTL_MS)
         return cached.value;
-    }
-    if (cached.inFlight) {
-        return cached.inFlight;
-    }
-    const inFlight = probeAnthropicLocalDiagnostics({ binaryPath }).then((value) => {
-        localDiagnosticsCache.set(binaryPath, {
-            timestamp: Date.now(),
-            value,
-        });
-        return value;
-    });
-    localDiagnosticsCache.set(binaryPath, {
-        timestamp: cached.timestamp,
-        value: cached.value,
-        inFlight,
-    });
+    const pending = { inFlight: probe() };
+    cache.set(key, pending);
     try {
-        return await inFlight;
+        const value = await pending.inFlight;
+        cache.set(key, { value, timestamp: Date.now() });
+        return value;
     }
-    finally {
-        const latest = localDiagnosticsCache.get(binaryPath);
-        if (latest?.inFlight === inFlight) {
-            localDiagnosticsCache.set(binaryPath, {
-                timestamp: latest.timestamp,
-                value: latest.value,
-            });
-        }
+    catch (error) {
+        if (cache.get(key) === pending)
+            cache.delete(key);
+        throw error;
     }
 }
-export async function getAnthropicDiagnostics(options = {}) {
-    const binaryPath = resolveAnthropicBinaryPath(options.binaryPath);
-    const now = Date.now();
-    const cached = diagnosticsCache.get(binaryPath) ?? {
-        timestamp: 0,
-        value: null,
+async function getCachedAnthropicLocalDiagnostics(binaryPath) {
+    const resolvedBinaryPath = resolveAnthropicBinaryPath(binaryPath);
+    return await getCachedProbe(localDiagnosticsCache, resolvedBinaryPath, () => probeAnthropicLocalDiagnostics(resolvedBinaryPath));
+}
+function buildDiagnostics(local, outcome) {
+    return {
+        installed: local.installed,
+        version: local.version,
+        authStatus: local.authStatus,
+        quotaSupported: outcome.quota !== undefined,
+        quotaSource: outcome.quotaSource,
+        ...(outcome.oauthCredentialSource
+            ? { oauthCredentialSource: outcome.oauthCredentialSource }
+            : {}),
+        binaryPath: local.binaryPath,
+        checkedCommands: local.checkedCommands,
+        ...(outcome.message ? { message: outcome.message } : {}),
+        ...(outcome.quota ? { quota: outcome.quota } : {}),
     };
-    if (cached.value &&
-        cached.timestamp > 0 &&
-        now - cached.timestamp < ANTHROPIC_DIAGNOSTICS_TTL_MS) {
-        return cached.value;
-    }
-    if (cached.inFlight) {
-        return cached.inFlight;
+}
+async function probeAnthropicDiagnostics(binaryPath, requestTimeoutMs) {
+    const local = await getCachedAnthropicLocalDiagnostics(binaryPath);
+    if (local.localQuota) {
+        return buildDiagnostics(local, {
+            quotaSource: "claude-auth-status-json",
+            quota: local.localQuota,
+        });
     }
-    const inFlight = (async () => {
-        const localDiagnostics = await getCachedAnthropicLocalDiagnostics({ binaryPath });
-        if (localDiagnostics.localQuota) {
-            return mapLocalDiagnosticsToAnthropicDiagnostics(localDiagnostics);
-        }
-        let credentials = await readAnthropicOAuthAccessToken({
-            includeClaudeCredentials: localDiagnostics.authStatus === "authenticated",
+    const claudeAuthenticated = local.authStatus === "authenticated";
+    let credentials = await readAnthropicOAuthAccessToken({
+        includeClaudeCredentials: claudeAuthenticated,
+    });
+    if (credentials.state !== "configured") {
+        return buildDiagnostics(local, {
+            quotaSource: "none",
+            message: claudeAuthenticated
+                ? buildAnthropicNoQuotaDiagnosticsMessage(credentials.detail)
+                : local.message,
         });
-        if (credentials.state !== "configured") {
-            if (localDiagnostics.authStatus !== "authenticated") {
-                return mapLocalDiagnosticsToAnthropicDiagnostics(localDiagnostics);
-            }
-            const diagnostics = {
-                installed: localDiagnostics.installed,
-                version: localDiagnostics.version,
-                authStatus: localDiagnostics.authStatus,
-                quotaSupported: false,
-                quotaSource: "none",
-                binaryPath: localDiagnostics.binaryPath,
-                checkedCommands: localDiagnostics.checkedCommands,
-                message: buildAnthropicNoQuotaDiagnosticsMessage(credentials.detail),
-            };
-            return diagnostics;
-        }
-        let fallbackQuota = await queryAnthropicQuotaFromOAuthAccessToken(credentials.accessToken, options.requestTimeoutMs);
-        if (fallbackQuota.state === "unavailable" &&
-            fallbackQuota.failureKind === "authentication" &&
-            credentials.source === "opencode-auth" &&
-            localDiagnostics.authStatus === "authenticated") {
-            const claudeCredentials = await readClaudeOAuthAccessToken();
-            if (claudeCredentials.state === "configured") {
-                credentials = claudeCredentials;
-                fallbackQuota = await queryAnthropicQuotaFromOAuthAccessToken(claudeCredentials.accessToken, options.requestTimeoutMs);
-            }
-        }
-        if (fallbackQuota.state !== "success") {
-            const diagnostics = {
-                installed: localDiagnostics.installed,
-                version: localDiagnostics.version,
-                authStatus: localDiagnostics.authStatus,
-                quotaSupported: false,
-                quotaSource: "none",
-                oauthCredentialSource: credentials.source,
-                binaryPath: localDiagnostics.binaryPath,
-                checkedCommands: localDiagnostics.checkedCommands,
-                message: buildAnthropicNoQuotaDiagnosticsMessage(fallbackQuota.detail),
-            };
-            return diagnostics;
-        }
-        const diagnostics = {
-            installed: localDiagnostics.installed,
-            version: localDiagnostics.version,
-            authStatus: localDiagnostics.authStatus,
-            quotaSupported: true,
-            quotaSource: credentials.source === "opencode-auth"
-                ? "opencode-auth-oauth-api"
-                : "claude-credentials-oauth-api",
+    }
+    let fallbackQuota = await queryAnthropicQuotaFromOAuthAccessToken(credentials.accessToken, requestTimeoutMs);
+    // A rejected OpenCode login falls back to Claude's own credentials when the Claude CLI is signed in.
+    if (fallbackQuota.state === "unavailable" &&
+        fallbackQuota.failureKind === "authentication" &&
+        credentials.source === "opencode-auth" &&
+        claudeAuthenticated) {
+        const claudeCredentials = await readClaudeOAuthAccessToken();
+        if (claudeCredentials.state === "configured") {
+            credentials = claudeCredentials;
+            fallbackQuota = await queryAnthropicQuotaFromOAuthAccessToken(claudeCredentials.accessToken, requestTimeoutMs);
+        }
+    }
+    if (fallbackQuota.state !== "success") {
+        return buildDiagnostics(local, {
+            quotaSource: "none",
             oauthCredentialSource: credentials.source,
-            binaryPath: localDiagnostics.binaryPath,
-            checkedCommands: localDiagnostics.checkedCommands,
-            quota: fallbackQuota.quota,
-        };
-        return diagnostics;
-    })().then((value) => {
-        diagnosticsCache.set(binaryPath, {
-            timestamp: Date.now(),
-            value,
+            message: buildAnthropicNoQuotaDiagnosticsMessage(fallbackQuota.detail),
         });
-        return value;
-    });
-    diagnosticsCache.set(binaryPath, {
-        timestamp: cached.timestamp,
-        value: cached.value,
-        inFlight,
-    });
-    try {
-        return await inFlight;
-    }
-    finally {
-        const latest = diagnosticsCache.get(binaryPath);
-        if (latest?.inFlight === inFlight) {
-            diagnosticsCache.set(binaryPath, {
-                timestamp: latest.timestamp,
-                value: latest.value,
-            });
-        }
     }
+    return buildDiagnostics(local, {
+        quotaSource: credentials.source === "opencode-auth"
+            ? "opencode-auth-oauth-api"
+            : "claude-credentials-oauth-api",
+        oauthCredentialSource: credentials.source,
+        quota: fallbackQuota.quota,
+    });
+}
+export async function getAnthropicDiagnostics(options = {}) {
+    const binaryPath = resolveAnthropicBinaryPath(options.binaryPath);
+    return await getCachedProbe(diagnosticsCache, binaryPath, () => probeAnthropicDiagnostics(binaryPath, options.requestTimeoutMs));
 }
 export async function hasAnthropicCredentialsConfigured(options = {}) {
     try {
@@ -1063,7 +718,7 @@ export async function hasAnthropicCredentialsConfigured(options = {}) {
         // Fall back to the existing local Claude CLI probe.
     }
     try {
-        const diagnostics = await getCachedAnthropicLocalDiagnostics(options);
+        const diagnostics = await getCachedAnthropicLocalDiagnostics(options.binaryPath);
         return diagnostics.installed && diagnostics.authStatus === "authenticated";
     }
     catch {
@@ -1073,7 +728,7 @@ export async function hasAnthropicCredentialsConfigured(options = {}) {
 export async function resolveAnthropicAuthIdentity(options = {}) {
     let localDiagnostics;
     try {
-        localDiagnostics = await getCachedAnthropicLocalDiagnostics(options);
+        localDiagnostics = await getCachedAnthropicLocalDiagnostics(options.binaryPath);
     }
     catch {
         return null;
@@ -1089,9 +744,8 @@ export async function resolveAnthropicAuthIdentity(options = {}) {
             principal: { kind: "credential", value: opencodeCredentials.accessToken },
         })
         : null;
-    if (localDiagnostics.authStatus !== "authenticated") {
+    if (localDiagnostics.authStatus !== "authenticated")
         return opencodeIdentity;
-    }
     const claudeCredentials = await readClaudeOAuthAccessToken();
     const claudeIdentity = claudeCredentials.state === "configured"
         ? await deriveResolvedAuthIdentity({
@@ -1110,23 +764,19 @@ export async function resolveAnthropicAuthIdentity(options = {}) {
 export async function queryAnthropicQuota(options = {}) {
     try {
         const diagnostics = await getAnthropicDiagnostics(options);
-        if (diagnostics.quotaSupported) {
+        if (diagnostics.quotaSupported)
             return diagnostics.quota ?? null;
-        }
         if ((diagnostics.authStatus === "authenticated" ||
             diagnostics.oauthCredentialSource !== undefined) &&
             diagnostics.message) {
-            return {
-                success: false,
-                error: diagnostics.message,
-            };
+            return { success: false, error: diagnostics.message };
         }
         return null;
     }
     catch (err) {
         return {
             success: false,
-            error: `Claude CLI probe failed: ${sanitizeDisplayText(err instanceof Error ? err.message : String(err))}`,
+            error: `Claude CLI probe failed: ${sanitizeDisplayText(errorText(err))}`,
         };
     }
 }