@zgltyq/pi-provider-claude 1.2.0 → 1.3.1

package/README.md

@@ -91,6 +91,23 @@ the assistant message (`stopReason: "error"`) via `message_end`, including Claud
 is hit, the turn errors once, the pool flips (with a UI notification), and you just
 resend your message to continue on the other account.
 
+**OAuth compatibility and background token refresh (v1.3.1):** The pool now
+uses its own Anthropic OAuth login/refresh adapter, keeping it compatible with
+pi 0.81.x where the old runtime OAuth export is no longer available. OAuth access
+tokens are short-lived. An account that sat idle (e.g. your fallback) would have
+a dead access token by the time failover switched to it — producing a `401
+authentication_error`. v1.3.1 retains the v1.3.0 keep-warm behavior:
+
+- A `setInterval` keep-warm loop that refreshes **every** pooled account before it
+  expires, even when idle and not the active account (the timer is `unref()`'d so
+  it never blocks CLI commands like `pi update` from exiting).
+- A wider 5-minute pre-expiry refresh buffer, and a full-pool refresh on
+  `session_start` / `before_agent_start` (not just the active account).
+- Reactive 401 handling: if the server rejects the active token anyway, it is
+  force-refreshed in place (no account switch) so the resend succeeds. If the
+  refresh token itself was revoked, you're told to re-run `/login` +
+  `/claude-pool-add <label>`.
+
 It is **inert** unless `<agentDir>/claude-pool.json` exists with ≥2 accounts and
 `"enabled" !== false`.
 

package/index.ts

@@ -45,6 +45,10 @@ import {
 import { homedir } from "node:os";
 import { join } from "node:path";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import {
+	loginAnthropicOAuth,
+	refreshAnthropicOAuth,
+} from "./oauth.ts";
 
 // Prefix used to disguise flat tools as MCP tools. Kept short so
 // `mcp__pi__<name>` stays well under Anthropic's 64-char tool-name limit.
@@ -291,12 +295,20 @@ const POOL_PATH = join(
 	process.env.PI_CODING_AGENT_DIR || join(homedir(), ".pi", "agent"),
 	"claude-pool.json",
 );
-const POOL_REFRESH_BUFFER_MS = 60_000;
+// Refresh an access token this long BEFORE it actually expires, so we never
+// hand a request a token that's about to die. Generous because OAuth access
+// tokens are short-lived and the failover target may have sat idle for days.
+const POOL_REFRESH_BUFFER_MS = 5 * 60_000;
 const POOL_DEFAULT_COOLDOWN_MS = 5 * 60_000;
+// Background keep-warm cadence: re-check every account on this interval even
+// when idle / not the active one, so an account is never stale when we switch.
+const POOL_BG_REFRESH_INTERVAL_MS = 4 * 60_000;
 
 let poolAccounts: PoolAccount[] = [];
 let poolActive = 0;
 let poolCooldownUntil: number[] = [];
+let poolBgTimer: ReturnType<typeof setInterval> | undefined;
+let poolRefreshInFlight = false;
 
 function poolLog(msg: string): void {
 	writeDebugLog({ stage: "pool", time: new Date().toISOString(), msg });
@@ -363,25 +375,51 @@ function poolSelectActive(): void {
 	}
 }
 
-async function poolEnsureFresh(i: number): Promise<void> {
+// Low-level refresh of account `i`. Returns true on success. When `force` is
+// false it skips accounts whose token is still comfortably valid.
+async function poolRefreshAccount(i: number, force: boolean): Promise<boolean> {
 	const acct = poolAccounts[i];
-	if (!acct || acct.expires > Date.now() + POOL_REFRESH_BUFFER_MS) return;
+	if (!acct) return false;
+	if (!force && acct.expires > Date.now() + POOL_REFRESH_BUFFER_MS) return true;
 	try {
-		const oauth = (await import("@earendil-works/pi-ai/oauth")) as {
-			refreshAnthropicToken: (
-				r: string,
-			) => Promise<{ refresh?: string; access: string; expires: number }>;
-		};
-		const next = await oauth.refreshAnthropicToken(acct.refresh);
+		const next = await refreshAnthropicOAuth({ refresh: acct.refresh });
 		acct.access = next.access;
 		acct.expires = next.expires;
 		if (next.refresh) acct.refresh = next.refresh;
 		persistPool();
-		poolLog(`refreshed ${acct.label}`);
+		poolLog(`refreshed ${acct.label} (exp ${new Date(acct.expires).toISOString()})`);
+		return true;
 	} catch (e) {
 		poolLog(
 			`refresh FAILED ${acct.label}: ${(e as Error)?.message ?? String(e)}`,
 		);
+		return false;
+	}
+}
+
+// Refresh account `i` only if it is near (or past) expiry.
+async function poolEnsureFresh(i: number): Promise<void> {
+	await poolRefreshAccount(i, false);
+}
+
+// Force a refresh of account `i` regardless of expiry (used on a 401, when the
+// server rejected the token even though we thought it was still valid).
+async function poolForceRefresh(i: number): Promise<boolean> {
+	return poolRefreshAccount(i, true);
+}
+
+// Background keep-warm: refresh EVERY pooled account whose token is near expiry,
+// not just the active one. This is what guarantees the failover target is never
+// stale when we switch to it after it sat unused for a long time.
+async function poolRefreshAll(): Promise<void> {
+	if (poolRefreshInFlight) return; // never overlap refresh sweeps
+	poolRefreshInFlight = true;
+	try {
+		for (let i = 0; i < poolAccounts.length; i++) {
+			await poolEnsureFresh(i);
+		}
+	} finally {
+		poolRefreshInFlight = false;
 	}
 }
 
@@ -415,6 +453,13 @@ function poolMarkRateLimitedUntil(until: number): void {
 const POOL_LIMIT_RE =
 	/\b429\b|\b529\b|rate[ _-]?limit|usage[ _-]?limit|overloaded_error|quota/i;
 
+// Expired / rejected credential detection (401). When the active account's
+// token is rejected we force-refresh it in place so the resend succeeds — this
+// is the symptom of switching to an account that sat idle until its access
+// token died. Anchored to avoid colliding with the 429 message.
+const POOL_AUTH_RE =
+	/authentication_error|invalid authentication credentials|\b401\b/i;
+
 // Claude subscription cap messages often carry a reset epoch after a pipe,
 // e.g. "Claude AI usage limit reached|1750000000".
 function poolParseResetEpoch(message: string): number | undefined {
@@ -544,7 +589,9 @@ function setupPool(pi: ExtensionAPI): void {
 
 	const prep = async () => {
 		poolSelectActive();
-		await poolEnsureFresh(poolActive);
+		// Keep ALL accounts warm, not just the active one, so the failover target
+		// is ready the instant we switch to it.
+		await poolRefreshAll();
 	};
 	pi.on("session_start", async () => {
 		await prep();
@@ -553,6 +600,20 @@ function setupPool(pi: ExtensionAPI): void {
 		await prep();
 	});
 
+	// Background keep-warm loop: refresh every account before it expires even
+	// while idle / not active. This is the core fix — the failover target is kept
+	// fresh continuously so it's never expired when we switch to it.
+	//
+	// unref() is CRITICAL: an active timer handle keeps the Node event loop alive
+	// and would prevent short-lived CLI commands (e.g. `pi update`) from exiting.
+	// We also do NOT fire an immediate refresh here — interactive sessions warm
+	// via session_start; firing at module load would add network I/O to the CLI
+	// path. The first tick lands one interval later, only in long-lived sessions.
+	poolBgTimer = setInterval(() => {
+		void poolRefreshAll();
+	}, POOL_BG_REFRESH_INTERVAL_MS);
+	if (typeof poolBgTimer.unref === "function") poolBgTimer.unref();
+
 	// PRIMARY rate/usage-cap detector: provider errors surface on the assistant
 	// message (stopReason "error"), not via after_provider_response (the SDK
 	// throws on 429/529 before pi-ai's onResponse callback runs).
@@ -577,6 +638,23 @@ function setupPool(pi: ExtensionAPI): void {
 			)
 				return undefined;
 			const prev = poolAccounts[poolActive]?.label;
+
+			// 401 / expired-credential path: the server rejected the ACTIVE token.
+			// Force-refresh it in place (don't switch accounts) so the resend works.
+			if (
+				POOL_AUTH_RE.test(msg.errorMessage) &&
+				!POOL_LIMIT_RE.test(msg.errorMessage)
+			) {
+				const ok = await poolForceRefresh(poolActive);
+				ctx.ui.notify(
+					ok
+						? `Claude account "${prev}" had an expired token — refreshed it. Resend your message to continue.`
+						: `Claude account "${prev}" token is invalid and refresh FAILED — its refresh token was likely revoked. Run /login anthropic then /claude-pool-add ${prev}.`,
+					ok ? "info" : "warning",
+				);
+				return undefined;
+			}
+
 			if (!poolHandleErrorMessage(msg.errorMessage)) return undefined;
 			const next = poolAccounts[poolActive]?.label;
 			if (next !== prev) {
@@ -621,12 +699,7 @@ function setupPool(pi: ExtensionAPI): void {
 	register("anthropic", {
 		oauth: {
 			name: `Claude (pooled: ${poolAccounts.map((a) => a.label).join("+")})`,
-			async login(callbacks: unknown) {
-				const m = (await import("@earendil-works/pi-ai/oauth")) as {
-					anthropicOAuthProvider: { login: (c: unknown) => Promise<unknown> };
-				};
-				return m.anthropicOAuthProvider.login(callbacks);
-			},
+			login: loginAnthropicOAuth,
 			async refreshToken(_creds: unknown) {
 				await poolEnsureFresh(poolActive);
 				const a = poolAccounts[poolActive];

package/oauth.ts

@@ -0,0 +1,254 @@
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+
+export interface AnthropicOAuthCredential {
+	type: "oauth";
+	refresh: string;
+	access: string;
+	expires: number;
+}
+
+export interface AnthropicOAuthCallbacks {
+	notify: (event: Record<string, unknown>) => void;
+	prompt: (prompt: Record<string, unknown>) => Promise<string>;
+}
+
+const CLIENT_ID = Buffer.from("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl", "base64").toString("utf8");
+const AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+const TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
+const CALLBACK_HOST = process.env.PI_OAUTH_CALLBACK_HOST || "127.0.0.1";
+const CALLBACK_PORT = 53692;
+const CALLBACK_PATH = "/callback";
+const REDIRECT_URI = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
+const SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
+
+type AuthorizationResult = { code: string; state: string };
+
+function parseAuthorizationInput(input: string): { code?: string; state?: string } {
+	const value = input.trim();
+	if (!value) return {};
+	try {
+		const url = new URL(value);
+		return {
+			code: url.searchParams.get("code") ?? undefined,
+			state: url.searchParams.get("state") ?? undefined,
+		};
+	} catch {
+		// Not a URL; continue with the other supported formats.
+	}
+	if (value.includes("#")) {
+		const [code, state] = value.split("#", 2);
+		return { code, state };
+	}
+	if (value.includes("code=")) {
+		const params = new URLSearchParams(value);
+		return {
+			code: params.get("code") ?? undefined,
+			state: params.get("state") ?? undefined,
+		};
+	}
+	return { code: value };
+}
+
+function formatErrorDetails(error: unknown): string {
+	if (!(error instanceof Error)) return String(error);
+	return `${error.name}: ${error.message}${error.stack ? `; stack=${error.stack}` : ""}`;
+}
+
+async function startCallbackServer(expectedState: string): Promise<{
+	server: ReturnType<typeof createServer>;
+	cancelWait: () => void;
+	waitForCode: () => Promise<AuthorizationResult | null>;
+}> {
+	return new Promise((resolve, reject) => {
+		let settleWait: (value: AuthorizationResult | null) => void = () => undefined;
+		const waitForCode = new Promise<AuthorizationResult | null>((resolveWait) => {
+			let settled = false;
+			settleWait = (value) => {
+				if (settled) return;
+				settled = true;
+				resolveWait(value);
+			};
+		});
+		const server = createServer((req, res) => {
+			try {
+				const url = new URL(req.url || "", "http://localhost");
+				if (url.pathname !== CALLBACK_PATH) {
+					res.writeHead(404);
+					res.end("Callback route not found.");
+					return;
+				}
+				const code = url.searchParams.get("code");
+				const state = url.searchParams.get("state");
+				const error = url.searchParams.get("error");
+				if (error) {
+					res.writeHead(400);
+					res.end(`Anthropic authentication did not complete: ${error}`);
+					return;
+				}
+				if (!code || !state) {
+					res.writeHead(400);
+					res.end("Missing code or state parameter.");
+					return;
+				}
+				if (state !== expectedState) {
+					res.writeHead(400);
+					res.end("State mismatch.");
+					return;
+				}
+				res.writeHead(200);
+				res.end("Anthropic authentication completed. You can close this window.");
+				settleWait({ code, state });
+			} catch {
+				res.writeHead(500);
+				res.end("Internal error");
+			}
+		});
+		server.once("error", reject);
+		server.listen(CALLBACK_PORT, CALLBACK_HOST, () =>
+			resolve({
+				server,
+				cancelWait: () => settleWait(null),
+				waitForCode: () => waitForCode,
+			}),
+		);
+	});
+}
+
+async function postJson(url: string, body: Record<string, unknown>): Promise<string> {
+	const response = await fetch(url, {
+		method: "POST",
+		headers: { "Content-Type": "application/json", Accept: "application/json" },
+		body: JSON.stringify(body),
+		signal: AbortSignal.timeout(30_000),
+	});
+	const responseBody = await response.text();
+	if (!response.ok) {
+		throw new Error(`HTTP request failed. status=${response.status}; url=${url}; body=${responseBody}`);
+	}
+	return responseBody;
+}
+
+async function exchangeAuthorizationCode(
+	code: string,
+	state: string,
+	verifier: string,
+): Promise<AnthropicOAuthCredential> {
+	let responseBody: string;
+	try {
+		responseBody = await postJson(TOKEN_URL, {
+			grant_type: "authorization_code",
+			client_id: CLIENT_ID,
+			code,
+			state,
+			redirect_uri: REDIRECT_URI,
+			code_verifier: verifier,
+		});
+	} catch (error) {
+		throw new Error(`Token exchange request failed. details=${formatErrorDetails(error)}`);
+	}
+	let tokenData: { refresh_token?: string; access_token?: string; expires_in?: number };
+	try {
+		tokenData = JSON.parse(responseBody) as typeof tokenData;
+	} catch (error) {
+		throw new Error(`Token exchange returned invalid JSON. body=${responseBody}; details=${formatErrorDetails(error)}`);
+	}
+	if (!tokenData.refresh_token || !tokenData.access_token || !tokenData.expires_in) {
+		throw new Error("Token exchange response did not contain complete OAuth credentials.");
+	}
+	return {
+		type: "oauth",
+		refresh: tokenData.refresh_token,
+		access: tokenData.access_token,
+		expires: Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000,
+	};
+}
+
+export async function loginAnthropicOAuth(
+	interaction: AnthropicOAuthCallbacks,
+): Promise<AnthropicOAuthCredential> {
+	const verifier = randomBytes(32).toString("base64url");
+	const challenge = createHash("sha256").update(verifier).digest("base64url");
+	const server = await startCallbackServer(verifier);
+	const manualAbort = new AbortController();
+	let manualInput: string | undefined;
+	let manualError: Error | undefined;
+	try {
+		const authParams = new URLSearchParams({
+			code: "true",
+			client_id: CLIENT_ID,
+			response_type: "code",
+			redirect_uri: REDIRECT_URI,
+			scope: SCOPES,
+			code_challenge: challenge,
+			code_challenge_method: "S256",
+			state: verifier,
+		});
+		interaction.notify({
+			type: "auth_url",
+			url: `${AUTHORIZE_URL}?${authParams.toString()}`,
+			instructions: "Complete login in your browser. If the browser is on another machine, paste the final redirect URL here.",
+		});
+		const manualPromise = interaction
+			.prompt({
+				type: "manual_code",
+				message: "Complete login in your browser, or paste the authorization code / redirect URL here:",
+				placeholder: REDIRECT_URI,
+				signal: manualAbort.signal,
+			})
+			.then((input) => {
+				manualInput = input;
+				server.cancelWait();
+			})
+			.catch((error: unknown) => {
+				manualError = error instanceof Error ? error : new Error(String(error));
+				server.cancelWait();
+			});
+		const result = await server.waitForCode();
+		if (manualError) throw manualError;
+		const parsed = result ?? (manualInput ? parseAuthorizationInput(manualInput) : {});
+		if (parsed.state && parsed.state !== verifier) throw new Error("OAuth state mismatch");
+		if (!parsed.code) {
+			await manualPromise;
+			if (manualError) throw manualError;
+			const fallback = parseAuthorizationInput(manualInput ?? "");
+			if (fallback.state && fallback.state !== verifier) throw new Error("OAuth state mismatch");
+			parsed.code = fallback.code;
+		}
+		if (!parsed.code) throw new Error("Missing authorization code");
+		interaction.notify({ type: "progress", message: "Exchanging authorization code for tokens..." });
+		return exchangeAuthorizationCode(parsed.code, parsed.state ?? verifier, verifier);
+	} finally {
+		manualAbort.abort();
+		server.server.close();
+	}
+}
+
+export async function refreshAnthropicOAuth(
+	credential: Pick<AnthropicOAuthCredential, "refresh">,
+): Promise<AnthropicOAuthCredential> {
+	let responseBody: string;
+	try {
+		responseBody = await postJson(TOKEN_URL, {
+			grant_type: "refresh_token",
+			client_id: CLIENT_ID,
+			refresh_token: credential.refresh,
+		});
+	} catch (error) {
+		throw new Error(`Anthropic token refresh request failed. details=${formatErrorDetails(error)}`);
+	}
+	const data = JSON.parse(responseBody) as {
+		refresh_token?: string;
+		access_token?: string;
+		expires_in?: number;
+	};
+	if (!data.access_token || !data.expires_in) {
+		throw new Error("Anthropic token refresh response did not contain complete OAuth credentials.");
+	}
+	return {
+		type: "oauth",
+		refresh: data.refresh_token ?? credential.refresh,
+		access: data.access_token,
+		expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,
+	};
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zgltyq/pi-provider-claude",
-  "version": "1.2.0",
+  "version": "1.3.1",
   "description": "Claude (Anthropic OAuth/subscription) compatibility layer for pi-coding-agent — keeps ALL extension tools usable under the Claude subscription by mapping unknown flat tool names to mcp__pi__<name> on the wire instead of dropping them, plus optional multi-account failover. Self-contained fork of the tool half of @benvargas/pi-claude-code-use.",
   "author": "Leechael",
   "license": "MIT",
@@ -31,6 +31,7 @@
   "type": "module",
   "files": [
     "index.ts",
+    "oauth.ts",
     "package.json",
     "README.md",
     "LICENSE",