opencode-anthropic-fix 0.0.14

package/README.md

@@ -0,0 +1,478 @@
+# opencode-anthropic-fix
+
+Use your Claude Pro or Max subscription with [OpenCode](https://github.com/anomalyco/opencode). Supports multiple accounts with automatic rotation when you hit rate limits.
+
+## Quick Start
+
+**Prerequisites:** [OpenCode](https://github.com/anomalyco/opencode) installed, a Claude Pro or Max subscription, Node.js 18+.
+
+```bash
+# 1. Clone and install
+git clone https://github.com/marco-jardim/opencode-anthropic-fix.git
+cd opencode-anthropic-fix
+npm install
+
+# 2. Install the plugin + CLI
+npm run install:link
+
+# 3. Start OpenCode and connect
+opencode
+# Press Ctrl+K → Connect Provider → Anthropic → "Claude Pro/Max (multi-account)"
+# Follow the OAuth prompts to log in
+```
+
+That's it. OpenCode will now use your Claude subscription directly. All model costs show as $0.00.
+
+## Why This Fork?
+
+The [upstream plugin](https://github.com/anomalyco/opencode-anthropic-auth) ships as a built-in default with OpenCode. This fork adds:
+
+- **Multi-account support** — add up to 10 Claude accounts and rotate between them
+- **Automatic rate limit handling** — when one account hits a limit, the plugin switches to another
+- **Health scoring** — tracks account reliability and prefers healthy accounts
+- **Standalone CLI** — manage accounts without opening OpenCode
+- **Configurable strategies** — sticky, round-robin, or hybrid account selection
+- **Claude Code signature emulation** — optional Claude-style request headers with startup version lookup
+- **Adaptive thinking for Opus 4.6** — automatically uses `adaptive-thinking-2026-01-28` and maps `budgetTokens` to effort levels (`low`/`medium`/`high`/`max`)
+- **1M context limit override** — patches `model.limit.context` so OpenCode compacts at the right threshold while `models.dev` catches up
+
+## Installation
+
+### Development (symlink)
+
+Best for active development. Edits to source files take effect immediately.
+
+```bash
+npm run install:link
+```
+
+This creates:
+
+- **Plugin:** `~/.config/opencode/plugin/opencode-anthropic-auth-plugin.js` → `./index.mjs`
+- **CLI:** `~/.local/bin/opencode-anthropic-auth` → `./cli.mjs`
+
+### Stable (copy)
+
+Bundles the plugin and CLI into self-contained single files (via esbuild) and copies them. No symlinks, no `node_modules` needed at the destination.
+
+```bash
+npm run install:copy
+```
+
+This creates:
+
+- **Plugin:** `~/.config/opencode/plugin/opencode-anthropic-auth-plugin.js` (standalone, ~50KB)
+- **CLI:** `~/.local/bin/opencode-anthropic-auth` (standalone, ~35KB)
+
+### Uninstall
+
+```bash
+npm run uninstall
+```
+
+### PATH Setup
+
+If `~/.local/bin` isn't on your PATH, add it:
+
+```bash
+export PATH="$HOME/.local/bin:$PATH"
+```
+
+## Adding Accounts
+
+### First Account
+
+1. Open OpenCode
+2. Press `Ctrl+K` → **Connect Provider** → **Anthropic**
+3. Select **"Claude Pro/Max (multi-account)"**
+4. Open the URL in your browser, authorize, and paste the code back
+
+You can also add accounts directly from the CLI without opening OpenCode:
+
+```bash
+opencode-anthropic-auth login
+```
+
+### Additional Accounts
+
+Run the auth flow again (via CLI `login` or OpenCode's Connect Provider). The plugin detects existing accounts and shows a menu:
+
+```
+2 account(s) configured:
+  1. alice@example.com (active)
+  2. bob@example.com
+
+(a)dd new, (f)resh start, (m)anage, (c)ancel? [a/f/m/c]:
+```
+
+- **Add** — log in with another Claude account
+- **Fresh start** — clear all accounts and start over
+- **Manage** — enable/disable/remove accounts inline
+- **Cancel** — keep current setup
+
+This fork is OAuth-first. Use `claude.ai` login flows (`login` / `reauth`) for all accounts.
+
+## CLI
+
+The CLI lets you manage accounts outside of OpenCode.
+
+```bash
+opencode-anthropic-auth [command] [args]
+```
+
+| Command                | Description                                                   |
+| ---------------------- | ------------------------------------------------------------- |
+| `login`                | Add a new account via browser OAuth flow                      |
+| `logout <N>`           | Revoke tokens and remove account N                            |
+| `logout --all`         | Revoke all tokens and clear all accounts                      |
+| `reauth <N>`           | Re-authenticate account N with fresh OAuth tokens             |
+| `refresh <N>`          | Attempt token refresh (no browser needed)                     |
+| `list`                 | Show all accounts with status and live usage quotas (default) |
+| `status`               | Compact one-liner for scripts/prompts                         |
+| `switch <N>`           | Set account N as active                                       |
+| `enable <N>`           | Enable a disabled account                                     |
+| `disable <N>`          | Disable an account (skipped in rotation)                      |
+| `remove <N>`           | Remove an account permanently                                 |
+| `reset <N\|all>`       | Clear rate-limit / failure tracking                           |
+| `stats`                | Show per-account token usage statistics                       |
+| `reset-stats [N\|all]` | Reset usage statistics                                        |
+| `strategy [name]`      | Show or change selection strategy                             |
+| `config`               | Show configuration and file paths                             |
+| `manage`               | Interactive account management menu                           |
+| `help`                 | Show help                                                     |
+
+### Examples
+
+```bash
+# Add a new account via browser OAuth
+opencode-anthropic-auth login
+
+# See account status (includes live usage quotas)
+opencode-anthropic-auth list
+
+# Output:
+# Anthropic Multi-Account Status
+#   #    Account               Status        Failures   Rate Limit
+#   ──────────────────────────────────────────────────────────────
+#   1    alice@example.com     ● active      0          —
+#        5h            █████░░░░░ 45%  resets in 2h 30m
+#        7d            █████░░░░░ 45%  resets in 4d 16h
+#        Sonnet 7d     ░░░░░░░░░░  0%
+#
+#   2    bob@example.com       ● ready       0          —
+#        5h            ███░░░░░░░ 31%  resets in 30m
+#        7d            ███████░░░ 70%  resets in 19h 31m
+#        Sonnet 7d     █░░░░░░░░░ 11%  resets in 2d 10h
+#
+# Strategy: sticky | 2 of 2 enabled
+# Storage: ~/.config/opencode/anthropic-accounts.json
+
+# Switch active account
+opencode-anthropic-auth switch 2
+
+# Re-authenticate a broken account (opens browser)
+opencode-anthropic-auth reauth 1
+
+# Quick token refresh without browser
+opencode-anthropic-auth refresh 1
+
+# Revoke tokens and remove an account
+opencode-anthropic-auth logout 2
+
+# Revoke all tokens and clear all accounts
+opencode-anthropic-auth logout --all
+
+# View token usage per account
+opencode-anthropic-auth stats
+
+# Reset all usage counters
+opencode-anthropic-auth reset-stats all
+
+# One-liner for shell prompts
+opencode-anthropic-auth status
+# anthropic: 2 accounts (2 active), strategy: sticky, next: #1
+
+# Interactive management
+opencode-anthropic-auth manage
+```
+
+### Flags
+
+| Flag         | Description                                        |
+| ------------ | -------------------------------------------------- |
+| `--force`    | Skip confirmation prompts (for `remove`, `logout`) |
+| `--all`      | Target all accounts (for `logout`)                 |
+| `--no-color` | Disable colored output                             |
+| `--help`     | Show help message                                  |
+
+Most commands have short aliases: `ln`, `lo`, `ra`, `rf`, `ls`, `st`, `sw`, `en`, `dis`, `rm`, `strat`, `cfg`, `mg`.
+
+## Slash Commands in OpenCode
+
+The plugin also registers a built-in `/anthropic` slash command so you can manage accounts without leaving OpenCode.
+
+### Common examples
+
+```text
+/anthropic                # list (default)
+/anthropic usage          # full account list + quota windows
+/anthropic switch 2
+/anthropic refresh 1
+/anthropic logout 2       # revoke tokens and remove account 2
+/anthropic logout --all   # revoke all tokens and clear all accounts
+/anthropic strategy hybrid
+/anthropic stats
+/anthropic config
+```
+
+### OAuth flows from slash command
+
+Login and reauth are two-step flows in slash mode:
+
+```text
+/anthropic login
+# opens URL instructions in chat
+/anthropic login complete <code#state>
+
+/anthropic reauth 1
+# opens URL instructions in chat
+/anthropic reauth complete <code#state>
+```
+
+Pending slash OAuth flows expire after 10 minutes. If completion fails with an expiration message, run the start command again.
+
+### Notes
+
+- Destructive commands (`remove`, `logout`) run with non-interactive `--force` behavior in slash mode.
+- Interactive `manage` is terminal-only; use granular slash commands instead.
+
+## Account Selection Strategies
+
+Control how the plugin picks which account to use for each request.
+
+| Strategy               | Behavior                                                                                  | Best For                                              |
+| ---------------------- | ----------------------------------------------------------------------------------------- | ----------------------------------------------------- |
+| **`sticky`** (default) | Stay on one account until it fails or is rate-limited                                     | Single account, or when you want predictable behavior |
+| **`round-robin`**      | Rotate through accounts on every request                                                  | Spreading load evenly across accounts                 |
+| **`hybrid`**           | Score-based selection with stickiness bias. Considers health, token budget, and freshness | Multiple accounts with varying rate limits            |
+
+### Change Strategy
+
+```bash
+# Via CLI
+opencode-anthropic-auth strategy round-robin
+
+# Via environment variable (overrides config file)
+export OPENCODE_ANTHROPIC_STRATEGY=hybrid
+
+# Via config file
+# Edit ~/.config/opencode/anthropic-auth.json
+```
+
+## Configuration
+
+Configuration is stored at `~/.config/opencode/anthropic-auth.json`. All settings are optional &mdash; defaults work well for most users.
+
+```jsonc
+{
+  // Account selection strategy: "sticky" | "round-robin" | "hybrid"
+  "account_selection_strategy": "sticky",
+
+  // Seconds before consecutive failure count resets (60-7200)
+  "failure_ttl_seconds": 3600,
+
+  // Enable debug logging
+  "debug": false,
+
+  // Claude Code signature emulation behavior
+  "signature_emulation": {
+    // Enable Claude-style attribution/stainless headers and betas
+    "enabled": true,
+    // Resolve latest @anthropic-ai/claude-code version once on plugin startup
+    "fetch_claude_code_version_on_startup": true,
+    // Compact long injected system instructions to reduce token usage.
+    // In "minimal" mode, repeated/contained blocks are deduplicated and title-generator
+    // requests are replaced with a compact dedicated prompt.
+    // "minimal" | "off"
+    "prompt_compaction": "minimal",
+  },
+
+  // Context limit override for 1M-window models.
+  // Prevents OpenCode from compacting too early when models.dev hasn't been
+  // updated yet (e.g. claude-opus-4-6 and any *-1m model variants).
+  // Only applied for OAuth (Max Plan) sessions — API key users use the
+  // context-1m-2025-08-07 beta header instead.
+  "override_model_limits": {
+    // Enable/disable the override
+    "enabled": true,
+    // Context window to inject (tokens). Default: 1_000_000.
+    "context": 1000000,
+    // Max output tokens to inject. 0 = leave the model's default unchanged.
+    "output": 0,
+  },
+
+  // Health score tuning (0-100 scale)
+  "health_score": {
+    "initial": 70,
+    "success_reward": 1,
+    "rate_limit_penalty": -10,
+    "failure_penalty": -20,
+    "recovery_rate_per_hour": 2,
+    "min_usable": 50,
+    "max_score": 100,
+  },
+
+  // Client-side rate limiting (token bucket)
+  "token_bucket": {
+    "max_tokens": 50,
+    "regeneration_rate_per_minute": 6,
+    "initial_tokens": 50,
+  },
+
+  // Toast notification settings
+  "toasts": {
+    // Suppress non-error toasts (account status, switching)
+    "quiet": false,
+    // Minimum seconds between account-switch toasts (0-300)
+    "debounce_seconds": 30,
+  },
+}
+```
+
+### Environment Variables
+
+| Variable                                           | Description                                                                                                 |
+| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
+| `OPENCODE_ANTHROPIC_STRATEGY`                      | Override the account selection strategy at runtime.                                                         |
+| `OPENCODE_ANTHROPIC_DEBUG`                         | Set to `1` to enable debug logging.                                                                         |
+| `OPENCODE_ANTHROPIC_QUIET`                         | Set to `1` to suppress non-error toasts (account status, switching).                                        |
+| `OPENCODE_ANTHROPIC_EMULATE_CLAUDE_CODE_SIGNATURE` | Set to `0` to disable Claude signature emulation (legacy mode).                                             |
+| `OPENCODE_ANTHROPIC_FETCH_CLAUDE_CODE_VERSION`     | Set to `0` to skip npm version lookup at startup.                                                           |
+| `OPENCODE_ANTHROPIC_PROMPT_COMPACTION`             | Set to `off` to disable default minimal system prompt compaction.                                           |
+| `OPENCODE_ANTHROPIC_DEBUG_SYSTEM_PROMPT`           | Set to `1` to log the final transformed `system` prompt to stderr (title-generator requests are skipped).   |
+| `OPENCODE_ANTHROPIC_OVERRIDE_MODEL_LIMITS`         | Set to `0` to disable context limit overrides for 1M-window models (e.g. when models.dev has been updated). |
+
+### OAuth-only behavior
+
+- The expected auth mode is OAuth (`claude login` / browser flow), not direct `ANTHROPIC_API_KEY` usage.
+- In OAuth mode, the plugin always includes `oauth-2025-04-20` in `anthropic-beta`.
+- This applies to all models, including Haiku.
+
+## How It Works
+
+When you make a request through OpenCode:
+
+1. The plugin selects an account based on your strategy
+2. It refreshes the OAuth token if expired
+3. It transforms the request (adds OAuth headers, `oauth-2025-04-20`, signature headers, beta flags, tool prefixes)
+4. If the response is account-specific (429/401, plus 400/403 billing/quota/permission errors), it marks that account and immediately tries the next account
+5. If the response is service-wide (500/503/529), it returns the error directly (switching accounts would not help)
+6. It tries each available account at most once per request
+7. Successful responses have tool name prefixes stripped from the stream
+
+The plugin also:
+
+- Zeros out model costs (your subscription covers usage)
+- Emulates Claude-style request headers and beta flags by default
+- Sanitizes "OpenCode" references to "Claude Code" in system prompts (required by Anthropic's API)
+- In `prompt_compaction="minimal"`, deduplicates repeated/contained system blocks and uses a compact dedicated prompt for internal title-generation requests
+- Adds `?beta=true` to `/v1/messages` requests
+
+When signature emulation is disabled (`signature_emulation.enabled=false`), the plugin falls back to legacy behavior including the Claude Code system prompt prefix.
+
+## Files
+
+| Path                                                          | Description                            |
+| ------------------------------------------------------------- | -------------------------------------- |
+| `~/.config/opencode/anthropic-auth.json`                      | Plugin configuration                   |
+| `~/.config/opencode/anthropic-accounts.json`                  | Account credentials (0600 permissions) |
+| `~/.config/opencode/plugin/opencode-anthropic-auth-plugin.js` | Installed plugin entry point           |
+| `~/.local/bin/opencode-anthropic-auth`                        | CLI binary                             |
+
+Account credentials are stored with restrictive file permissions (owner read/write only) and are excluded from git via an auto-generated `.gitignore`.
+
+## Troubleshooting
+
+### "Provider not showing up"
+
+Make sure the plugin is installed in `~/.config/opencode/plugin/`. Restart OpenCode after installing.
+
+### "Auth flow completes but requests fail"
+
+Your OAuth token may have expired. Try a quick refresh first, or re-authenticate with fresh browser login:
+
+```bash
+# Quick token refresh (no browser needed)
+opencode-anthropic-auth refresh 1
+
+# Full re-authentication (opens browser)
+opencode-anthropic-auth reauth 1
+```
+
+Or re-run the auth flow from OpenCode: `Ctrl+K` &rarr; Connect Provider &rarr; Anthropic.
+
+### "Need to inspect the final system prompt sent to Anthropic"
+
+Enable system prompt debug logging:
+
+```bash
+export OPENCODE_ANTHROPIC_DEBUG_SYSTEM_PROMPT=1
+opencode
+```
+
+When enabled, the plugin prints the transformed `system` block (after sanitization/compaction) to `stderr` with prefix:
+
+```text
+[opencode-anthropic-auth][system-debug] transformed system:
+```
+
+Note: internal title-generator requests are intentionally skipped by this debug log to avoid noisy high-volume output.
+
+### "Rate limited on all accounts"
+
+When all accounts are exhausted for an account-specific error, the plugin returns immediately instead of sleeping in-process. Try:
+
+```bash
+# Check status
+opencode-anthropic-auth list
+
+# Reset tracking if stuck
+opencode-anthropic-auth reset all
+```
+
+### "Toast notifications when using other models"
+
+You may see `Claude: <email>` toasts even when your selected model is not Anthropic (e.g., OpenAI Codex, Gemini). This is expected behavior — OpenCode uses Claude Haiku as a background "small model" for internal tasks like generating session titles, regardless of which model you selected. These background API calls go through the Anthropic provider, which triggers the plugin's fetch interceptor and its account-usage toast.
+
+To suppress non-error toasts, set `quiet` mode in your config:
+
+```jsonc
+// ~/.config/opencode/anthropic-auth.json
+{
+  "toasts": { "quiet": true },
+}
+```
+
+Or via environment variable:
+
+```bash
+export OPENCODE_ANTHROPIC_QUIET=1
+```
+
+Error toasts (e.g., "Disabled Account 1 (token refresh failed)") are never suppressed.
+
+### "CLI command not found"
+
+Make sure `~/.local/bin` is on your PATH:
+
+```bash
+export PATH="$HOME/.local/bin:$PATH"
+```
+
+## License
+
+Same as upstream. See [anomalyco/opencode-anthropic-auth](https://github.com/anomalyco/opencode-anthropic-auth).
+
+---
+
+_Maintained at [marco-jardim/opencode-anthropic-fix](https://github.com/marco-jardim/opencode-anthropic-fix)._

package/agents.md

@@ -0,0 +1,22 @@
+# agents.md
+
+This repository is OAuth-first and optimized for Claude Code request mimese.
+
+## Operating rules
+
+- Use OAuth login flows (`opencode-anthropic-auth login` / `reauth`) for all accounts.
+- Treat direct API-key auth as out of scope for normal operation.
+- Keep Claude signature emulation enabled by default unless debugging a regression.
+
+## Request-shaping expectations
+
+- Always include OAuth beta behavior: `oauth-2025-04-20` must be present in `anthropic-beta` when authenticated via OAuth.
+- Preserve model/provider-aware beta composition logic in `index.mjs`.
+- Preserve Claude-style system prompt shaping (identity block + billing header block rules).
+- Keep `metadata.user_id` composition stable across account/session context.
+
+## Change policy for contributors and agents
+
+- Prefer minimal diffs that keep existing runtime behavior intact.
+- When updating beta/header logic, update docs in `docs/mimese-http-header-system-prompt.md` and `README.md` together.
+- Add or adjust tests in `index.test.mjs` for any header/system/body mimicry change.

package/bun.lock

@@ -0,0 +1,43 @@
+{
+  "lockfileVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "opencode-anthropic-auth",
+      "dependencies": {
+        "@openauthjs/openauth": "^0.4.3",
+      },
+      "devDependencies": {
+        "@opencode-ai/plugin": "^0.4.45",
+      },
+    },
+  },
+  "packages": {
+    "@openauthjs/openauth": ["@openauthjs/openauth@0.4.3", "", { "dependencies": { "@standard-schema/spec": "1.0.0-beta.3", "aws4fetch": "1.0.20", "jose": "5.9.6" }, "peerDependencies": { "arctic": "^2.2.2", "hono": "^4.0.0" } }, "sha512-RlnjqvHzqcbFVymEwhlUEuac4utA5h4nhSK/i2szZuQmxTIqbGUxZ+nM+avM+VV4Ing+/ZaNLKILoXS3yrkOOw=="],
+
+    "@opencode-ai/plugin": ["@opencode-ai/plugin@0.4.45", "", { "dependencies": { "@opencode-ai/sdk": "0.4.19" } }, "sha512-TuD+FNmA6vN+/B82qayCvOyTXRuAtfvU0U95UKSZoNrYgIBhpD/sW/oS65iUv5QwQqzO8BxI4DYWjmLIqCz8uw=="],
+
+    "@opencode-ai/sdk": ["@opencode-ai/sdk@0.4.19", "", {}, "sha512-7V+wDR1+m+TQZAraAh/bOSObiA/uysG1YIXZVe6gl1sQAXDtkG2FYCzs0gTZ/ORdkUKEnr3vyQIk895Mu0CC/w=="],
+
+    "@oslojs/asn1": ["@oslojs/asn1@1.0.0", "", { "dependencies": { "@oslojs/binary": "1.0.0" } }, "sha512-zw/wn0sj0j0QKbIXfIlnEcTviaCzYOY3V5rAyjR6YtOByFtJiT574+8p9Wlach0lZH9fddD4yb9laEAIl4vXQA=="],
+
+    "@oslojs/binary": ["@oslojs/binary@1.0.0", "", {}, "sha512-9RCU6OwXU6p67H4NODbuxv2S3eenuQ4/WFLrsq+K/k682xrznH5EVWA7N4VFk9VYVcbFtKqur5YQQZc0ySGhsQ=="],
+
+    "@oslojs/crypto": ["@oslojs/crypto@1.0.1", "", { "dependencies": { "@oslojs/asn1": "1.0.0", "@oslojs/binary": "1.0.0" } }, "sha512-7n08G8nWjAr/Yu3vu9zzrd0L9XnrJfpMioQcvCMxBIiF5orECHe5/3J0jmXRVvgfqMm/+4oxlQ+Sq39COYLcNQ=="],
+
+    "@oslojs/encoding": ["@oslojs/encoding@1.1.0", "", {}, "sha512-70wQhgYmndg4GCPxPPxPGevRKqTIJ2Nh4OkiMWmDAVYsTQ+Ta7Sq+rPevXyXGdzr30/qZBnyOalCszoMxlyldQ=="],
+
+    "@oslojs/jwt": ["@oslojs/jwt@0.2.0", "", { "dependencies": { "@oslojs/encoding": "0.4.1" } }, "sha512-bLE7BtHrURedCn4Mco3ma9L4Y1GR2SMBuIvjWr7rmQ4/W/4Jy70TIAgZ+0nIlk0xHz1vNP8x8DCns45Sb2XRbg=="],
+
+    "@standard-schema/spec": ["@standard-schema/spec@1.0.0-beta.3", "", {}, "sha512-0ifF3BjA1E8SY9C+nUew8RefNOIq0cDlYALPty4rhUm8Rrl6tCM8hBT4bhGhx7I7iXD0uAgt50lgo8dD73ACMw=="],
+
+    "arctic": ["arctic@2.3.4", "", { "dependencies": { "@oslojs/crypto": "1.0.1", "@oslojs/encoding": "1.1.0", "@oslojs/jwt": "0.2.0" } }, "sha512-+p30BOWsctZp+CVYCt7oAean/hWGW42sH5LAcRQX56ttEkFJWbzXBhmSpibbzwSJkRrotmsA+oAoJoVsU0f5xA=="],
+
+    "aws4fetch": ["aws4fetch@1.0.20", "", {}, "sha512-/djoAN709iY65ETD6LKCtyyEI04XIBP5xVvfmNxsEP0uJB5tyaGBztSryRr4HqMStr9R06PisQE7m9zDTXKu6g=="],
+
+    "hono": ["hono@4.9.1", "", {}, "sha512-qfvdJ42t6CQE0N/iSCa8KsW8SQqYD67YB+TYbwPHlnALvX+s7ynh8otR1NEk5jXtUg73gpV/B82OSufDmwtX3w=="],
+
+    "jose": ["jose@5.9.6", "", {}, "sha512-AMlnetc9+CV9asI19zHmrgS/WYsWUwCn2R7RzlbJWD7F9eWYUTGyBmU9o6PxngtLGOiDGPRu+Uc4fhKzbpteZQ=="],
+
+    "@oslojs/jwt/@oslojs/encoding": ["@oslojs/encoding@0.4.1", "", {}, "sha512-hkjo6MuIK/kQR5CrGNdAPZhS01ZCXuWDRJ187zh6qqF2+yMHZpD9fAYpX8q2bOO6Ryhl3XpCT6kUX76N8hhm4Q=="],
+  }
+}