opencode-anthropic-fix 0.0.16 → 0.0.17

package/index.test.mjs

@@ -32,6 +32,11 @@ vi.mock("./lib/storage.mjs", async (importOriginal) => {
   };
 });
 
+vi.mock("./lib/refresh-lock.mjs", () => ({
+  acquireRefreshLock: vi.fn().mockResolvedValue({ acquired: true, lockPath: "/tmp/opencode-test.lock" }),
+  releaseRefreshLock: vi.fn().mockResolvedValue(undefined),
+}));
+
 // Mock config — always return defaults
 vi.mock("./lib/config.mjs", async (importOriginal) => {
   const original = await importOriginal();
@@ -46,6 +51,7 @@ vi.mock("./lib/config.mjs", async (importOriginal) => {
       override_model_limits: {
         ...original.DEFAULT_CONFIG.override_model_limits,
       },
+      idle_refresh: { ...original.DEFAULT_CONFIG.idle_refresh, enabled: false },
     })),
   };
 });
@@ -56,6 +62,8 @@ vi.stubGlobal("fetch", mockFetch);
 
 import { AnthropicAuthPlugin } from "./index.mjs";
 import { saveAccounts, loadAccounts, clearAccounts } from "./lib/storage.mjs";
+import { acquireRefreshLock } from "./lib/refresh-lock.mjs";
+import { loadConfig, DEFAULT_CONFIG } from "./lib/config.mjs";
 
 beforeEach(() => {
   delete process.env.DISABLE_INTERLEAVED_THINKING;
@@ -74,6 +82,10 @@ beforeEach(() => {
   delete process.env.CLAUDE_CODE_REMOTE_SESSION_ID;
   delete process.env.CLAUDE_CODE_ADDITIONAL_PROTECTION;
   delete process.env.OPENCODE_ANTHROPIC_DEBUG_SYSTEM_PROMPT;
+  delete process.env.CLAUDE_CODE_ACCOUNT_UUID;
+  delete process.env.CLAUDE_CODE_USER_EMAIL;
+  delete process.env.CLAUDE_CODE_ORGANIZATION_UUID;
+  delete process.env.CLAUDE_CODE_DISABLE_1M_CONTEXT;
   process.env.OPENCODE_ANTHROPIC_SIGNATURE_USER_ID = "test-signature-user";
 });
 
@@ -117,6 +129,24 @@ function makeProvider() {
   };
 }
 
+/**
+ * Poll until condition passes or timeout.
+ * @param {() => void} assertion
+ * @param {number} [timeoutMs]
+ */
+async function waitForAssertion(assertion, timeoutMs = 500) {
+  const started = Date.now();
+  while (true) {
+    try {
+      assertion();
+      return;
+    } catch (err) {
+      if (Date.now() - started >= timeoutMs) throw err;
+      await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+  }
+}
+
 /**
  * Build a stored account object with sensible defaults.
  * Override any field by passing partial overrides.
@@ -550,6 +580,10 @@ describe("fetch interceptor", () => {
     delete process.env.CLAUDE_CODE_REMOTE_SESSION_ID;
     delete process.env.CLAUDE_CODE_ADDITIONAL_PROTECTION;
     delete process.env.OPENCODE_ANTHROPIC_PROMPT_COMPACTION;
+    delete process.env.CLAUDE_CODE_ACCOUNT_UUID;
+    delete process.env.CLAUDE_CODE_USER_EMAIL;
+    delete process.env.CLAUDE_CODE_ORGANIZATION_UUID;
+    delete process.env.CLAUDE_CODE_DISABLE_1M_CONTEXT;
     process.env.OPENCODE_ANTHROPIC_SIGNATURE_USER_ID = "test-signature-user";
     delete process.env.CLAUDE_CODE_ATTRIBUTION_HEADER;
     delete process.env.CLAUDE_CODE_ENTRYPOINT;
@@ -589,7 +623,7 @@ describe("fetch interceptor", () => {
     expect(headers.get("authorization")).toBe("Bearer test-access");
     expect(headers.get("anthropic-beta")).toContain("oauth-2025-04-20");
     expect(headers.get("anthropic-beta")).toContain("claude-code-20250219");
-    expect(headers.get("user-agent")).toContain("claude-cli");
+    expect(headers.get("user-agent")).toContain("claude-cli/2.1.68");
     expect(headers.get("x-app")).toBe("cli");
     expect(headers.get("x-stainless-lang")).toBe("js");
     expect(headers.has("x-api-key")).toBe(false);
@@ -727,10 +761,10 @@ describe("fetch interceptor", () => {
 
   it("preserves verbose system instructions when prompt compaction is off", async () => {
     const configModule = await import("./lib/config.mjs");
-    configModule.loadConfig.mockReturnValueOnce({
-      ...configModule.loadConfig(),
+    loadConfig.mockReturnValueOnce({
+      ...loadConfig(),
       signature_emulation: {
-        ...configModule.loadConfig().signature_emulation,
+        ...loadConfig().signature_emulation,
         prompt_compaction: "off",
       },
     });
@@ -798,10 +832,137 @@ describe("fetch interceptor", () => {
     });
 
     const text = await response.text();
-    expect(text).toContain('"name": "read_file"');
+    expect(text).toContain('"name":"read_file"');
     expect(text).not.toContain("mcp_read_file");
   });
 
+  it("strips mcp_ prefix when a tool_use SSE data line is split across chunks", async () => {
+    const encoder = new TextEncoder();
+    const splitStream = new ReadableStream({
+      start(controller) {
+        controller.enqueue(
+          encoder.encode('data:{"type":"content_block_start","content_block":{"type":"tool_use","name":"mcp_'),
+        );
+        controller.enqueue(encoder.encode('read_file","id":"t1"}}\n'));
+        controller.enqueue(encoder.encode("\n"));
+        controller.close();
+      },
+    });
+
+    mockFetch.mockResolvedValueOnce(
+      new Response(splitStream, {
+        status: 200,
+        headers: { "content-type": "text/event-stream" },
+      }),
+    );
+
+    const response = await fetchFn("https://api.anthropic.com/v1/messages", {
+      method: "POST",
+      body: JSON.stringify({ messages: [] }),
+    });
+
+    const text = await response.text();
+    expect(text).toContain('"name":"read_file"');
+    expect(text).not.toContain("mcp_read_file");
+  });
+
+  it("double-prefixes tools already named mcp_* in request body", async () => {
+    mockFetch.mockResolvedValueOnce(new Response("", { status: 200 }));
+
+    await fetchFn("https://api.anthropic.com/v1/messages", {
+      method: "POST",
+      body: JSON.stringify({
+        tools: [{ name: "mcp_server", description: "An MCP server tool" }],
+        messages: [
+          {
+            role: "assistant",
+            content: [{ type: "tool_use", name: "mcp_server", id: "t1", input: {} }],
+          },
+        ],
+      }),
+    });
+
+    const [, init] = mockFetch.mock.calls[0];
+    const body = JSON.parse(init.body);
+    // Must become mcp_mcp_server so that response stripping restores the original name
+    expect(body.tools[0].name).toBe("mcp_mcp_server");
+    expect(body.messages[0].content[0].name).toBe("mcp_mcp_server");
+  });
+
+  it("round-trips mcp_-prefixed tool names correctly", async () => {
+    // Tool already named mcp_server → sent as mcp_mcp_server → response strips back to mcp_server
+    const responseBody =
+      'data: {"type":"content_block_start","content_block":{"type":"tool_use","name":"mcp_mcp_server","id":"t1"}}\n\n';
+    mockFetch.mockResolvedValueOnce(
+      new Response(responseBody, {
+        status: 200,
+        headers: { "content-type": "text/event-stream" },
+      }),
+    );
+
+    const response = await fetchFn("https://api.anthropic.com/v1/messages", {
+      method: "POST",
+      body: JSON.stringify({
+        tools: [{ name: "mcp_server", description: "An MCP server tool" }],
+        messages: [],
+      }),
+    });
+
+    const text = await response.text();
+    // Should strip one mcp_ prefix, restoring original name
+    expect(text).toContain('"name":"mcp_server"');
+    expect(text).not.toContain("mcp_mcp_server");
+  });
+
+  it("does not strip mcp_ from text content in response stream", async () => {
+    // A text content block that happens to contain "name": "mcp_foo" — should NOT be modified
+    const responseBody =
+      'data: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"The tool \\"name\\": \\"mcp_foo\\" was called."}}\n\n';
+    mockFetch.mockResolvedValueOnce(
+      new Response(responseBody, {
+        status: 200,
+        headers: { "content-type": "text/event-stream" },
+      }),
+    );
+
+    const response = await fetchFn("https://api.anthropic.com/v1/messages", {
+      method: "POST",
+      body: JSON.stringify({ messages: [] }),
+    });
+
+    const text = await response.text();
+    // The mcp_foo in text content should be preserved
+    expect(text).toContain("mcp_foo");
+  });
+
+  it("strips mcp_ from tool_use blocks but not text blocks in response stream", async () => {
+    // Two SSE events: one tool_use (should strip), one text (should preserve)
+    const sseBody = [
+      'data: {"type":"content_block_start","content_block":{"type":"tool_use","name":"mcp_write_file","id":"t1"}}',
+      "",
+      'data: {"type":"content_block_start","content_block":{"type":"text","text":"Using tool \\"name\\": \\"mcp_write_file\\""}}',
+      "",
+    ].join("\n");
+
+    mockFetch.mockResolvedValueOnce(
+      new Response(sseBody, {
+        status: 200,
+        headers: { "content-type": "text/event-stream" },
+      }),
+    );
+
+    const response = await fetchFn("https://api.anthropic.com/v1/messages", {
+      method: "POST",
+      body: JSON.stringify({ messages: [] }),
+    });
+
+    const text = await response.text();
+    // tool_use name should have mcp_ stripped
+    expect(text).toContain('"name":"write_file"');
+    // text content should still have mcp_write_file
+    expect(text).toContain("mcp_write_file");
+  });
+
   it("does not show account usage toast for non-message endpoints", async () => {
     mockFetch.mockResolvedValueOnce(new Response("{}", { status: 200 }));
 
@@ -901,8 +1062,8 @@ describe("system prompt transform", () => {
 
   it("keeps legacy prefix behavior when emulation is disabled", async () => {
     const configModule = await import("./lib/config.mjs");
-    configModule.loadConfig.mockReturnValueOnce({
-      ...configModule.loadConfig(),
+    loadConfig.mockReturnValueOnce({
+      ...loadConfig(),
       signature_emulation: {
         enabled: false,
         fetch_claude_code_version_on_startup: false,
@@ -982,6 +1143,34 @@ describe("fetch interceptor — token refresh", () => {
     );
   });
 
+  it("continues request flow when auth.json persistence fails after successful refresh", async () => {
+    loadAccounts.mockResolvedValue(makeAccountsData());
+    saveAccounts.mockResolvedValue(undefined);
+    client.auth.set.mockRejectedValueOnce(new Error("disk temporarily unavailable"));
+
+    const plugin = await AnthropicAuthPlugin({ client });
+    const getAuth = vi.fn().mockResolvedValue({
+      type: "oauth",
+      refresh: "refresh-1",
+      access: "expired-access",
+      expires: Date.now() - 1000,
+    });
+    const result = await plugin.auth.loader(getAuth, makeProvider());
+
+    mockFetch.mockResolvedValueOnce(mockTokenRefresh("fresh-access", "refresh-1-rotated"));
+    mockFetch.mockResolvedValueOnce(new Response('{"content":[]}', { status: 200 }));
+
+    const response = await result.fetch("https://api.anthropic.com/v1/messages", {
+      method: "POST",
+      body: JSON.stringify({ messages: [] }),
+    });
+
+    expect(response.status).toBe(200);
+    expect(mockFetch).toHaveBeenCalledTimes(2);
+    const [, apiInit] = mockFetch.mock.calls[1];
+    expect(apiInit.headers.get("authorization")).toBe("Bearer fresh-access");
+  });
+
   it("coalesces concurrent refreshes for the same account", async () => {
     loadAccounts.mockResolvedValue(makeAccountsData());
     saveAccounts.mockResolvedValue(undefined);
@@ -1000,11 +1189,26 @@ describe("fetch interceptor — token refresh", () => {
       resolveRefresh = resolve;
     });
 
-    mockFetch.mockImplementation((url) => {
+    let refreshCallCount = 0;
+    /** @type {() => void} */
+    let markRefreshInFlight;
+    const refreshInFlight = new Promise((resolve) => {
+      markRefreshInFlight = resolve;
+    });
+
+    /** @type {string[]} */
+    const apiAuthHeaders = [];
+
+    mockFetch.mockImplementation((url, init) => {
       const s = String(url);
       if (s.includes("/v1/oauth/token")) {
+        refreshCallCount += 1;
+        if (refreshCallCount === 1) markRefreshInFlight();
         return refreshPromise;
       }
+
+      const headers = new Headers(init?.headers ?? undefined);
+      apiAuthHeaders.push(headers.get("authorization") || "");
       return Promise.resolve(new Response('{"content":[]}', { status: 200 }));
     });
 
@@ -1017,8 +1221,8 @@ describe("fetch interceptor — token refresh", () => {
       body: JSON.stringify({ messages: [] }),
     });
 
-    // Let both requests reach refresh path
-    await Promise.resolve();
+    // Wait until refresh is definitely in-flight, then resolve it.
+    await refreshInFlight;
 
     resolveRefresh(mockTokenRefresh("fresh-access", "refresh-1-rotated"));
 
@@ -1028,6 +1232,257 @@ describe("fetch interceptor — token refresh", () => {
 
     const refreshCalls = mockFetch.mock.calls.filter(([u]) => String(u).includes("/v1/oauth/token"));
     expect(refreshCalls).toHaveLength(1);
+    expect(apiAuthHeaders).toEqual(["Bearer fresh-access", "Bearer fresh-access"]);
+  });
+
+  it("uses disk-updated token state when refresh lock is held by another process", async () => {
+    const staleToken = "refresh-1-stale";
+    const rotatedToken = "refresh-1-rotated";
+    const rotatedAccess = "access-from-other-process";
+    const accountId = "stable-id-1";
+
+    loadAccounts.mockResolvedValue(
+      makeAccountsData([
+        {
+          id: accountId,
+          refreshToken: staleToken,
+          access: "expired-access",
+          expires: Date.now() - 1_000,
+          token_updated_at: 10,
+        },
+      ]),
+    );
+    saveAccounts.mockResolvedValue(undefined);
+
+    acquireRefreshLock.mockResolvedValue({ acquired: false, lockPath: null });
+
+    const plugin = await AnthropicAuthPlugin({ client });
+    const getAuth = vi.fn().mockResolvedValue({
+      type: "oauth",
+      refresh: staleToken,
+      access: "expired-access",
+      expires: Date.now() - 1_000,
+    });
+    const result = await plugin.auth.loader(getAuth, makeProvider());
+
+    // Request-time reads: sync + lock-held disk reread.
+    const requestDiskReads = [
+      makeAccountsData([
+        {
+          id: accountId,
+          refreshToken: staleToken,
+          access: "expired-access",
+          expires: Date.now() - 1_000,
+          token_updated_at: 10,
+        },
+      ]),
+      makeAccountsData([
+        {
+          id: accountId,
+          refreshToken: rotatedToken,
+          access: rotatedAccess,
+          expires: Date.now() + 3_600_000,
+          token_updated_at: 999,
+        },
+      ]),
+    ];
+    loadAccounts.mockImplementation(async () => requestDiskReads.shift() ?? requestDiskReads.at(-1));
+
+    // No oauth refresh should be issued; only API call should happen.
+    mockFetch.mockResolvedValueOnce(new Response('{"content":[]}', { status: 200 }));
+
+    const response = await result.fetch("https://api.anthropic.com/v1/messages", {
+      method: "POST",
+      body: JSON.stringify({ messages: [] }),
+    });
+
+    expect(response.status).toBe(200);
+    const oauthCalls = mockFetch.mock.calls.filter(([u]) => String(u).includes("/v1/oauth/token"));
+    expect(oauthCalls).toHaveLength(0);
+
+    const [, apiInit] = mockFetch.mock.calls[0];
+    expect(apiInit.headers.get("authorization")).toBe(`Bearer ${rotatedAccess}`);
+  });
+
+  it("refreshes near-expiry idle account in background while serving active account", async () => {
+    loadConfig.mockReturnValue({
+      ...DEFAULT_CONFIG,
+      signature_emulation: { ...DEFAULT_CONFIG.signature_emulation, fetch_claude_code_version_on_startup: false },
+      override_model_limits: { ...DEFAULT_CONFIG.override_model_limits },
+      idle_refresh: { ...DEFAULT_CONFIG.idle_refresh, enabled: true },
+    });
+
+    loadAccounts.mockResolvedValue(
+      makeAccountsData([
+        { access: "access-1", expires: Date.now() + 2 * 3600_000 },
+        { refreshToken: "refresh-2", access: "access-2", expires: Date.now() + 10 * 60_000 },
+      ]),
+    );
+    saveAccounts.mockResolvedValue(undefined);
+
+    const plugin = await AnthropicAuthPlugin({ client });
+    const getAuth = vi.fn().mockResolvedValue({
+      type: "oauth",
+      refresh: "refresh-1",
+      access: "access-1",
+      expires: Date.now() + 2 * 3600_000,
+    });
+    const result = await plugin.auth.loader(getAuth, makeProvider());
+
+    mockFetch.mockImplementation((url) => {
+      const s = String(url);
+      if (s.includes("/v1/oauth/token")) {
+        return Promise.resolve(mockTokenRefresh("idle-fresh-access", "refresh-2-rotated"));
+      }
+      return Promise.resolve(new Response('{"content":[]}', { status: 200 }));
+    });
+
+    const response = await result.fetch("https://api.anthropic.com/v1/messages", {
+      method: "POST",
+      body: JSON.stringify({ messages: [] }),
+    });
+    expect(response.status).toBe(200);
+
+    await waitForAssertion(() => {
+      const refreshCalls = mockFetch.mock.calls.filter(([u]) => String(u).includes("/v1/oauth/token"));
+      expect(refreshCalls.length).toBe(1);
+    });
+
+    const refreshCalls = mockFetch.mock.calls.filter(([u]) => String(u).includes("/v1/oauth/token"));
+    const refreshBody = JSON.parse(refreshCalls[0][1].body);
+    expect(refreshBody.refresh_token).toBe("refresh-2");
+  });
+
+  it("does not disable idle account on background refresh failure", async () => {
+    loadConfig.mockReturnValue({
+      ...DEFAULT_CONFIG,
+      signature_emulation: { ...DEFAULT_CONFIG.signature_emulation, fetch_claude_code_version_on_startup: false },
+      override_model_limits: { ...DEFAULT_CONFIG.override_model_limits },
+      idle_refresh: { ...DEFAULT_CONFIG.idle_refresh, enabled: true },
+    });
+
+    loadAccounts.mockResolvedValue(
+      makeAccountsData([
+        { access: "access-1", expires: Date.now() + 2 * 3600_000 },
+        { refreshToken: "refresh-2", access: "access-2", expires: Date.now() + 10 * 60_000 },
+      ]),
+    );
+    saveAccounts.mockResolvedValue(undefined);
+
+    const plugin = await AnthropicAuthPlugin({ client });
+    const getAuth = vi.fn().mockResolvedValue({
+      type: "oauth",
+      refresh: "refresh-1",
+      access: "access-1",
+      expires: Date.now() + 2 * 3600_000,
+    });
+    const result = await plugin.auth.loader(getAuth, makeProvider());
+
+    // Background idle refresh fails terminally and retry fails too.
+    mockFetch.mockImplementation((url) => {
+      const s = String(url);
+      if (s.includes("/v1/oauth/token")) {
+        return Promise.resolve({
+          ok: false,
+          status: 400,
+          text: async () => JSON.stringify({ error: "invalid_grant" }),
+        });
+      }
+      return Promise.resolve(new Response('{"content":[]}', { status: 200 }));
+    });
+
+    const response = await result.fetch("https://api.anthropic.com/v1/messages", {
+      method: "POST",
+      body: JSON.stringify({ messages: [] }),
+    });
+    expect(response.status).toBe(200);
+
+    await waitForAssertion(() => {
+      const refreshCalls = mockFetch.mock.calls.filter(([u]) => String(u).includes("/v1/oauth/token"));
+      expect(refreshCalls.length).toBeGreaterThanOrEqual(2);
+    });
+
+    // Background maintenance should not auto-disable accounts.
+    const disabledToasts = client.tui.showToast.mock.calls.filter(([arg]) =>
+      String(arg?.body?.message || "").includes("Disabled"),
+    );
+    expect(disabledToasts).toHaveLength(0);
+
+    for (const [storage] of saveAccounts.mock.calls) {
+      expect(storage.accounts[1]?.enabled).not.toBe(false);
+    }
+  });
+
+  it("foreground refresh does not inherit an in-flight idle refresh failure", async () => {
+    loadConfig.mockReturnValue({
+      ...DEFAULT_CONFIG,
+      signature_emulation: { ...DEFAULT_CONFIG.signature_emulation, fetch_claude_code_version_on_startup: false },
+      override_model_limits: { ...DEFAULT_CONFIG.override_model_limits },
+      idle_refresh: { ...DEFAULT_CONFIG.idle_refresh, enabled: true },
+    });
+
+    loadAccounts.mockResolvedValue(
+      makeAccountsData([
+        { access: "access-1", expires: Date.now() + 2 * 3600_000 },
+        { refreshToken: "refresh-2", access: "stale-access-2", expires: Date.now() - 1000 },
+      ]),
+    );
+    saveAccounts.mockResolvedValue(undefined);
+
+    const plugin = await AnthropicAuthPlugin({ client });
+    const getAuth = vi.fn().mockResolvedValue({
+      type: "oauth",
+      refresh: "refresh-1",
+      access: "access-1",
+      expires: Date.now() + 2 * 3600_000,
+    });
+    const result = await plugin.auth.loader(getAuth, makeProvider());
+
+    /** @type {(error: Error) => void} */
+    let rejectIdleRefresh;
+    const idleRefreshPromise = new Promise((_, reject) => {
+      rejectIdleRefresh = reject;
+    });
+
+    let oauthCount = 0;
+    mockFetch.mockImplementation((url, init) => {
+      const s = String(url);
+      const headers = new Headers(init?.headers ?? undefined);
+
+      if (s.includes("/v1/oauth/token")) {
+        oauthCount += 1;
+        if (oauthCount === 1) return idleRefreshPromise;
+        return Promise.resolve(mockTokenRefresh("fresh-access-2", "refresh-2-rotated"));
+      }
+
+      // First request on account 1 fails account-specific so flow switches to account 2.
+      if (headers.get("authorization") === "Bearer access-1") {
+        // Let idle refresh fail while foreground is preparing to use account 2.
+        rejectIdleRefresh(new Error("idle refresh failed"));
+        return Promise.resolve(
+          new Response('{"error":{"type":"rate_limit_error","message":"Rate limit"}}', { status: 429 }),
+        );
+      }
+
+      return Promise.resolve(new Response('{"content":[]}', { status: 200 }));
+    });
+
+    const response = await result.fetch("https://api.anthropic.com/v1/messages", {
+      method: "POST",
+      body: JSON.stringify({ messages: [] }),
+    });
+
+    expect(response.status).toBe(200);
+
+    const oauthCalls = mockFetch.mock.calls.filter(([u]) => String(u).includes("/v1/oauth/token"));
+    expect(oauthCalls).toHaveLength(2);
+    const secondBody = JSON.parse(oauthCalls[1][1].body);
+    expect(secondBody.refresh_token).toBe("refresh-2");
+
+    const disabledToasts = client.tui.showToast.mock.calls.filter(([arg]) =>
+      String(arg?.body?.message || "").includes("Disabled"),
+    );
+    expect(disabledToasts).toHaveLength(0);
   });
 
   it("disables account on 401 token refresh failure and retries with next account", async () => {
@@ -1136,6 +1591,164 @@ describe("fetch interceptor — token refresh", () => {
     expect(response.status).toBe(200);
     expect(mockFetch).toHaveBeenCalledTimes(3);
   });
+
+  it("recovers when another instance rotated the refresh token (disk read before refresh)", async () => {
+    // Simulate: in-memory has stale token, disk has the rotated token from another instance.
+    // Plugin loads with the stale token, but readDiskRefreshToken finds the new one.
+    const staleToken = "stale-refresh";
+    const rotatedToken = "rotated-by-other-instance";
+    const accountId = "stable-id-1";
+
+    // First loadAccounts call (plugin init) — stale token
+    loadAccounts.mockResolvedValue(makeAccountsData([{ id: accountId, refreshToken: staleToken }]));
+    saveAccounts.mockResolvedValue(undefined);
+
+    const plugin = await AnthropicAuthPlugin({ client });
+    const getAuth = vi.fn().mockResolvedValue({
+      type: "oauth",
+      refresh: staleToken,
+      access: "expired-access",
+      expires: Date.now() - 1000, // expired — forces refresh
+    });
+    const result = await plugin.auth.loader(getAuth, makeProvider());
+
+    // Subsequent loadAccounts calls (readDiskRefreshToken) — return the rotated token
+    loadAccounts.mockResolvedValue(makeAccountsData([{ id: accountId, refreshToken: rotatedToken }]));
+
+    // Refresh with rotated token succeeds
+    mockFetch.mockResolvedValueOnce(mockTokenRefresh("new-access", "new-refresh"));
+    // API call succeeds
+    mockFetch.mockResolvedValueOnce(new Response('{"content":[]}', { status: 200 }));
+
+    const response = await result.fetch("https://api.anthropic.com/v1/messages", {
+      method: "POST",
+      body: JSON.stringify({ messages: [] }),
+    });
+
+    expect(response.status).toBe(200);
+    // Only 2 fetch calls: successful refresh (with rotated token) + API call
+    expect(mockFetch).toHaveBeenCalledTimes(2);
+    // Verify the refresh used the rotated token, not the stale one
+    const refreshCall = mockFetch.mock.calls[0];
+    const refreshBody = JSON.parse(refreshCall[1].body);
+    expect(refreshBody.refresh_token).toBe(rotatedToken);
+  });
+
+  it("retries with disk token when initial refresh fails with invalid_grant", async () => {
+    // Simulate: two instances loaded the same token. Instance A rotated it.
+    // Instance B's memory still has the old token. refreshAccountToken reads disk
+    // (gets old token, same as memory), refresh fails. Retry reads disk again,
+    // this time instance A's save has landed, finds the rotated token.
+    const oldToken = "old-refresh";
+    const rotatedToken = "rotated-refresh";
+    const accountId = "stable-id-1";
+
+    // Default: return old token for all loadAccounts calls (init, saveToDisk merge, Option A)
+    loadAccounts.mockResolvedValue(makeAccountsData([{ id: accountId, refreshToken: oldToken }]));
+    saveAccounts.mockResolvedValue(undefined);
+
+    const plugin = await AnthropicAuthPlugin({ client });
+    const getAuth = vi.fn().mockResolvedValue({
+      type: "oauth",
+      refresh: oldToken,
+      access: "expired-access",
+      expires: Date.now() - 1000,
+    });
+    const result = await plugin.auth.loader(getAuth, makeProvider());
+
+    // Request-time disk reads happen in this order:
+    // 1) syncActiveIndexFromDisk, 2) pre-refresh disk read, 3) retry disk read after invalid_grant.
+    const requestDiskReads = [
+      makeAccountsData([{ id: accountId, refreshToken: oldToken }]),
+      makeAccountsData([{ id: accountId, refreshToken: oldToken }]),
+      makeAccountsData([{ id: accountId, refreshToken: rotatedToken }]),
+    ];
+    loadAccounts.mockImplementation(async () => {
+      return requestDiskReads.shift() ?? makeAccountsData([{ id: accountId, refreshToken: rotatedToken }]);
+    });
+
+    // First refresh fails with invalid_grant (old token was rotated by other instance)
+    mockFetch.mockResolvedValueOnce({
+      ok: false,
+      status: 400,
+      text: async () => JSON.stringify({ error: "invalid_grant" }),
+    });
+    // Retry refresh with rotated token succeeds
+    mockFetch.mockResolvedValueOnce(mockTokenRefresh("recovered-access", "recovered-refresh"));
+    // API call succeeds
+    mockFetch.mockResolvedValueOnce(new Response('{"content":[]}', { status: 200 }));
+
+    const response = await result.fetch("https://api.anthropic.com/v1/messages", {
+      method: "POST",
+      body: JSON.stringify({ messages: [] }),
+    });
+
+    expect(response.status).toBe(200);
+    // 3 fetch calls: failed refresh + successful retry refresh + API call
+    expect(mockFetch).toHaveBeenCalledTimes(3);
+
+    const refreshCalls = mockFetch.mock.calls.filter(([url]) => String(url).includes("/v1/oauth/token"));
+    expect(refreshCalls).toHaveLength(2);
+    const firstRefreshBody = JSON.parse(refreshCalls[0][1].body);
+    const secondRefreshBody = JSON.parse(refreshCalls[1][1].body);
+    expect(firstRefreshBody.refresh_token).toBe(oldToken);
+    expect(secondRefreshBody.refresh_token).toBe(rotatedToken);
+  });
+
+  it("still disables account when retry also fails", async () => {
+    const oldToken = "doomed-refresh";
+    const accountId = "stable-id-1";
+
+    loadAccounts.mockResolvedValue(makeAccountsData([{ id: accountId, refreshToken: oldToken }]));
+    saveAccounts.mockResolvedValue(undefined);
+
+    const plugin = await AnthropicAuthPlugin({ client });
+    const getAuth = vi.fn().mockResolvedValue({
+      type: "oauth",
+      refresh: oldToken,
+      access: "expired-access",
+      expires: Date.now() - 1000,
+    });
+    const result = await plugin.auth.loader(getAuth, makeProvider());
+
+    // Request-time reads: sync, pre-refresh disk read, retry-read.
+    const requestDiskReads = [
+      makeAccountsData([{ id: accountId, refreshToken: oldToken }]),
+      makeAccountsData([{ id: accountId, refreshToken: oldToken }]),
+      makeAccountsData([{ id: accountId, refreshToken: "also-bad-token" }]),
+    ];
+    loadAccounts.mockImplementation(async () => {
+      return requestDiskReads.shift() ?? makeAccountsData([{ id: accountId, refreshToken: "also-bad-token" }]);
+    });
+
+    // First refresh fails
+    mockFetch.mockResolvedValueOnce({
+      ok: false,
+      status: 400,
+      text: async () => JSON.stringify({ error: "invalid_grant" }),
+    });
+    // Retry refresh also fails
+    mockFetch.mockResolvedValueOnce({
+      ok: false,
+      status: 400,
+      text: async () => JSON.stringify({ error: "invalid_grant" }),
+    });
+
+    // No more accounts — should throw
+    await expect(
+      result.fetch("https://api.anthropic.com/v1/messages", {
+        method: "POST",
+        body: JSON.stringify({ messages: [] }),
+      }),
+    ).rejects.toThrow();
+
+    const refreshCalls = mockFetch.mock.calls.filter(([url]) => String(url).includes("/v1/oauth/token"));
+    expect(refreshCalls).toHaveLength(2);
+    const firstRefreshBody = JSON.parse(refreshCalls[0][1].body);
+    const secondRefreshBody = JSON.parse(refreshCalls[1][1].body);
+    expect(firstRefreshBody.refresh_token).toBe(oldToken);
+    expect(secondRefreshBody.refresh_token).toBe("also-bad-token");
+  });
 });
 
 // ---------------------------------------------------------------------------
@@ -1843,6 +2456,24 @@ describe("header handling", () => {
     }
   });
 
+  it("defaults to medium effort for Opus 4.6 when thinking has no budget_tokens", async () => {
+    mockFetch.mockResolvedValueOnce(new Response("", { status: 200 }));
+
+    await fetchFn("https://api.anthropic.com/v1/messages", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        model: "claude-opus-4-6",
+        messages: [],
+        thinking: { type: "enabled" },
+      }),
+    });
+
+    const [, init] = mockFetch.mock.calls[0];
+    const parsed = JSON.parse(init.body);
+    expect(parsed.thinking).toEqual({ type: "enabled", effort: "medium" });
+  });
+
   it("keeps effort if already provided for Opus 4.6", async () => {
     mockFetch.mockResolvedValueOnce(new Response("", { status: 200 }));
 
@@ -2015,6 +2646,25 @@ describe("header handling", () => {
     expect(parsed.betas).toBeUndefined();
   });
 
+  it("adds metadata fields from CLAUDE_CODE_* env vars", async () => {
+    process.env.CLAUDE_CODE_ACCOUNT_UUID = "acct-uuid-123";
+    process.env.CLAUDE_CODE_ORGANIZATION_UUID = "org-uuid-456";
+    process.env.CLAUDE_CODE_USER_EMAIL = "dev@example.com";
+    mockFetch.mockResolvedValueOnce(new Response("", { status: 200 }));
+
+    await fetchFn("https://api.anthropic.com/v1/messages", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ messages: [{ role: "user", content: "hello" }], system: [] }),
+    });
+
+    const [, init] = mockFetch.mock.calls[0];
+    const parsed = JSON.parse(init.body);
+    expect(parsed.metadata.user_id).toContain("_account_acct-uuid-123_");
+    expect(parsed.metadata.organization_uuid).toBe("org-uuid-456");
+    expect(parsed.metadata.user_email).toBe("dev@example.com");
+  });
+
   it("removes unsupported top-level betas field from request body", async () => {
     mockFetch.mockResolvedValueOnce(new Response("", { status: 200 }));
 
@@ -2228,55 +2878,57 @@ describe("markSuccess wiring", () => {
     vi.resetAllMocks();
     const client = makeClient();
     const fetchFn = await setupFetchFn(client);
+    vi.useFakeTimers();
 
-    // Build an SSE stream with message_start and message_delta usage events
-    const sseBody = [
-      "event: message_start",
-      'data: {"type":"message_start","message":{"usage":{"input_tokens":25,"output_tokens":1,"cache_read_input_tokens":10,"cache_creation_input_tokens":5}}}',
-      "",
-      "event: content_block_delta",
-      'data: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"Hello"}}',
-      "",
-      "event: message_delta",
-      'data: {"type":"message_delta","delta":{"stop_reason":"end_turn"},"usage":{"input_tokens":25,"output_tokens":42,"cache_read_input_tokens":10,"cache_creation_input_tokens":5}}',
-      "",
-      "event: message_stop",
-      'data: {"type":"message_stop"}',
-      "",
-    ].join("\n");
-
-    mockFetch.mockResolvedValueOnce(
-      new Response(sseBody, {
-        status: 200,
-        headers: { "content-type": "text/event-stream" },
-      }),
-    );
-
-    const response = await fetchFn("https://api.anthropic.com/v1/messages", {
-      method: "POST",
-      body: JSON.stringify({ messages: [{ role: "user", content: "Hi" }] }),
-    });
+    try {
+      // Build an SSE stream with message_start and message_delta usage events
+      const sseBody = [
+        "event: message_start",
+        'data: {"type":"message_start","message":{"usage":{"input_tokens":25,"output_tokens":1,"cache_read_input_tokens":10,"cache_creation_input_tokens":5}}}',
+        "",
+        "event: content_block_delta",
+        'data: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"Hello"}}',
+        "",
+        "event: message_delta",
+        'data: {"type":"message_delta","delta":{"stop_reason":"end_turn"},"usage":{"input_tokens":25,"output_tokens":42,"cache_read_input_tokens":10,"cache_creation_input_tokens":5}}',
+        "",
+        "event: message_stop",
+        'data: {"type":"message_stop"}',
+        "",
+      ].join("\n");
 
-    expect(response.status).toBe(200);
+      mockFetch.mockResolvedValueOnce(
+        new Response(sseBody, {
+          status: 200,
+          headers: { "content-type": "text/event-stream" },
+        }),
+      );
 
-    // Consume the stream so the onUsage callback fires
-    const text = await response.text();
-    expect(text).toContain("Hello");
+      const response = await fetchFn("https://api.anthropic.com/v1/messages", {
+        method: "POST",
+        body: JSON.stringify({ messages: [{ role: "user", content: "Hi" }] }),
+      });
 
-    // The recordUsage triggers a debounced save; flush it
-    vi.useFakeTimers();
-    vi.advanceTimersByTime(1500);
-    vi.useRealTimers();
-    await new Promise((r) => setTimeout(r, 10));
+      expect(response.status).toBe(200);
 
-    // Verify usage was recorded: the stats should reflect the message_delta usage
-    const saveCalls = saveAccounts.mock.calls;
-    expect(saveCalls.length).toBeGreaterThan(0);
-    const lastSave = saveCalls[saveCalls.length - 1][0];
-    const acc = lastSave.accounts[0];
-    expect(acc.stats.requests).toBeGreaterThan(0);
-    expect(acc.stats.outputTokens).toBe(42);
-    expect(acc.stats.inputTokens).toBe(25);
+      // Consume the stream so the onUsage callback fires
+      const text = await response.text();
+      expect(text).toContain("Hello");
+
+      // recordUsage triggers a debounced save (1s); flush deterministically.
+      await vi.advanceTimersByTimeAsync(1500);
+
+      // Verify usage was recorded: the stats should reflect the message_delta usage
+      const saveCalls = saveAccounts.mock.calls;
+      expect(saveCalls.length).toBeGreaterThan(0);
+      const lastSave = saveCalls[saveCalls.length - 1][0];
+      const acc = lastSave.accounts[0];
+      expect(acc.stats.requests).toBeGreaterThan(0);
+      expect(acc.stats.outputTokens).toBe(42);
+      expect(acc.stats.inputTokens).toBe(25);
+    } finally {
+      vi.useRealTimers();
+    }
   });
 
   it("detects whitespace-formatted mid-stream error events and switches account on next request", async () => {
@@ -2643,6 +3295,23 @@ describe("override_model_limits", () => {
     expect(provider.models["claude-sonnet"].limit.context).toBe(200_000);
   });
 
+  it("does not override 1M context when CLAUDE_CODE_DISABLE_1M_CONTEXT is set", async () => {
+    process.env.CLAUDE_CODE_DISABLE_1M_CONTEXT = "1";
+    const provider = makeProvider();
+    const plugin = await AnthropicAuthPlugin({ client });
+    const getAuth = vi.fn().mockResolvedValue({
+      type: "oauth",
+      refresh: "refresh-1",
+      access: "access-1",
+      expires: Date.now() + 3_600_000,
+    });
+
+    await plugin.auth.loader(getAuth, provider);
+
+    expect(provider.models["claude-opus-4-6"].limit.context).toBe(200_000);
+    expect(provider.models["claude-sonnet-4-1m"].limit.context).toBe(200_000);
+  });
+
   it("preserves original output limit when override_model_limits.output is 0 (default)", async () => {
     const provider = makeProvider();
     const plugin = await AnthropicAuthPlugin({ client });
@@ -2670,8 +3339,8 @@ describe("override_model_limits", () => {
 
   it("does not override limits when override_model_limits.enabled is false in config", async () => {
     const configModule = await import("./lib/config.mjs");
-    configModule.loadConfig.mockReturnValueOnce({
-      ...configModule.loadConfig(),
+    loadConfig.mockReturnValueOnce({
+      ...loadConfig(),
       override_model_limits: { enabled: false, context: 1_000_000, output: 0 },
     });
     const provider = makeProvider();