opencode-anthropic-fix 0.0.16 → 0.0.17

package/lib/account-state.mjs

@@ -0,0 +1,50 @@
+/**
+ * @typedef {import('./storage.mjs').AccountMetadata} AccountMetadata
+ * @typedef {import('./storage.mjs').AccountStorage} AccountStorage
+ */
+
+/**
+ * Reset transient account tracking fields.
+ * @param {AccountMetadata} account
+ */
+export function resetAccountTracking(account) {
+  account.rateLimitResetTimes = {};
+  account.consecutiveFailures = 0;
+  account.lastFailureTime = null;
+}
+
+/**
+ * Normalize active index after removing one account.
+ * @param {AccountStorage} storage
+ * @param {number} removedIndex
+ */
+export function adjustActiveIndexAfterRemoval(storage, removedIndex) {
+  if (storage.accounts.length === 0) {
+    storage.activeIndex = 0;
+    return;
+  }
+
+  if (storage.activeIndex >= storage.accounts.length) {
+    storage.activeIndex = storage.accounts.length - 1;
+    return;
+  }
+
+  if (storage.activeIndex > removedIndex) {
+    storage.activeIndex -= 1;
+  }
+}
+
+/**
+ * Apply OAuth credentials to an existing account record.
+ * @param {AccountMetadata} account
+ * @param {{refresh: string, access: string, expires: number, email?: string}} credentials
+ */
+export function applyOAuthCredentials(account, credentials) {
+  account.refreshToken = credentials.refresh;
+  account.access = credentials.access;
+  account.expires = credentials.expires;
+  account.token_updated_at = Date.now();
+  if (credentials.email) {
+    account.email = credentials.email;
+  }
+}

package/lib/account-state.test.mjs

@@ -0,0 +1,109 @@
+import { describe, it, expect } from "vitest";
+import { applyOAuthCredentials, resetAccountTracking, adjustActiveIndexAfterRemoval } from "./account-state.mjs";
+
+describe("resetAccountTracking", () => {
+  it("resets rate-limit and failure fields", () => {
+    const account = {
+      rateLimitResetTimes: { anthropic: Date.now() + 60_000 },
+      consecutiveFailures: 7,
+      lastFailureTime: Date.now(),
+    };
+
+    resetAccountTracking(account);
+
+    expect(account.rateLimitResetTimes).toEqual({});
+    expect(account.consecutiveFailures).toBe(0);
+    expect(account.lastFailureTime).toBeNull();
+  });
+});
+
+describe("applyOAuthCredentials", () => {
+  it("applies refresh/access/expiry and optional email", () => {
+    const account = {
+      refreshToken: "old-refresh",
+      access: "old-access",
+      expires: 1,
+      email: "old@example.com",
+    };
+
+    applyOAuthCredentials(account, {
+      refresh: "new-refresh",
+      access: "new-access",
+      expires: 123,
+      email: "new@example.com",
+    });
+
+    expect(account).toEqual({
+      refreshToken: "new-refresh",
+      access: "new-access",
+      expires: 123,
+      token_updated_at: expect.any(Number),
+      email: "new@example.com",
+    });
+  });
+
+  it("preserves existing email when credentials omit email", () => {
+    const account = {
+      refreshToken: "old-refresh",
+      access: "old-access",
+      expires: 1,
+      email: "old@example.com",
+    };
+
+    applyOAuthCredentials(account, {
+      refresh: "new-refresh",
+      access: "new-access",
+      expires: 456,
+    });
+
+    expect(account.email).toBe("old@example.com");
+    expect(account.refreshToken).toBe("new-refresh");
+    expect(account.access).toBe("new-access");
+    expect(account.expires).toBe(456);
+    expect(account.token_updated_at).toEqual(expect.any(Number));
+  });
+});
+
+describe("adjustActiveIndexAfterRemoval", () => {
+  it("resets activeIndex to 0 when no accounts remain", () => {
+    const storage = { accounts: [], activeIndex: 3 };
+    adjustActiveIndexAfterRemoval(storage, 0);
+    expect(storage.activeIndex).toBe(0);
+  });
+
+  it("clamps activeIndex when it falls out of range", () => {
+    const storage = {
+      accounts: [{ id: "a" }, { id: "b" }],
+      activeIndex: 2,
+    };
+    adjustActiveIndexAfterRemoval(storage, 0);
+    expect(storage.activeIndex).toBe(1);
+  });
+
+  it("decrements activeIndex when removed index is before active", () => {
+    const storage = {
+      accounts: [{ id: "a" }, { id: "b" }, { id: "c" }],
+      activeIndex: 2,
+    };
+    adjustActiveIndexAfterRemoval(storage, 0);
+    expect(storage.activeIndex).toBe(1);
+  });
+
+  it("keeps activeIndex when removed index is after active", () => {
+    const storage = {
+      accounts: [{ id: "a" }, { id: "b" }, { id: "c" }],
+      activeIndex: 0,
+    };
+    adjustActiveIndexAfterRemoval(storage, 2);
+    expect(storage.activeIndex).toBe(0);
+  });
+
+  it("keeps activeIndex when removed index was the active slot", () => {
+    const storage = {
+      accounts: [{ id: "a" }, { id: "b" }, { id: "c" }],
+      activeIndex: 1,
+    };
+    adjustActiveIndexAfterRemoval(storage, 1);
+    expect(storage.activeIndex).toBe(1);
+  });
+});

package/lib/accounts.mjs

@@ -22,6 +22,7 @@ import { calculateBackoffMs } from "./backoff.mjs";
  * @property {string} refreshToken
  * @property {string} [access]
  * @property {number} [expires]
+ * @property {number} tokenUpdatedAt
  * @property {number} addedAt
  * @property {number} lastUsed
  * @property {boolean} enabled
@@ -97,6 +98,7 @@ export class AccountManager {
         refreshToken: acc.refreshToken,
         access: acc.access,
         expires: acc.expires,
+        tokenUpdatedAt: acc.token_updated_at,
         addedAt: acc.addedAt,
         lastUsed: acc.lastUsed,
         enabled: acc.enabled,
@@ -114,8 +116,17 @@ export class AccountManager {
       if (authFallback && manager.#accounts.length > 0) {
         const match = manager.#accounts.find((acc) => acc.refreshToken === authFallback.refresh);
         if (match) {
-          match.access = authFallback.access;
-          match.expires = authFallback.expires;
+          const fallbackHasAccess = typeof authFallback.access === "string" && authFallback.access.length > 0;
+          const fallbackExpires = typeof authFallback.expires === "number" ? authFallback.expires : 0;
+          const matchExpires = typeof match.expires === "number" ? match.expires : 0;
+          const fallbackLooksFresh = fallbackHasAccess && fallbackExpires > Date.now();
+          const shouldAdoptFallback =
+            fallbackLooksFresh && (!match.access || !match.expires || fallbackExpires > matchExpires);
+          if (shouldAdoptFallback) {
+            match.access = authFallback.access;
+            match.expires = authFallback.expires;
+            match.tokenUpdatedAt = Math.max(match.tokenUpdatedAt || 0, fallbackExpires);
+          }
         }
       }
 
@@ -133,6 +144,7 @@ export class AccountManager {
           refreshToken: authFallback.refresh,
           access: authFallback.access,
           expires: authFallback.expires,
+          tokenUpdatedAt: now,
           addedAt: now,
           lastUsed: 0,
           enabled: true,
@@ -181,6 +193,16 @@ export class AccountManager {
     return this.#currentIndex;
   }
 
+  /**
+   * Get enabled account references for internal plugin operations.
+   * Returned objects are mutable managed accounts.
+   * @param {Set<number>} [excludedIndices]
+   * @returns {ManagedAccount[]}
+   */
+  getEnabledAccounts(excludedIndices) {
+    return this.#accounts.filter((acc) => acc.enabled && !excludedIndices?.has(acc.index));
+  }
+
   /**
    * Clear expired rate limits for an account.
    * @param {ManagedAccount} account
@@ -314,6 +336,7 @@ export class AccountManager {
     if (existing) {
       existing.access = accessToken;
       existing.expires = expires;
+      existing.tokenUpdatedAt = Date.now();
       if (email) existing.email = email;
       existing.enabled = true;
       return existing;
@@ -328,6 +351,7 @@ export class AccountManager {
       refreshToken,
       access: accessToken,
       expires,
+      tokenUpdatedAt: now,
       addedAt: now,
       lastUsed: 0,
       enabled: true,
@@ -430,25 +454,57 @@ export class AccountManager {
    */
   async saveToDisk() {
     // Read current disk state to merge stats
-    let diskAccounts = null;
+    /** @type {Map<string, import('./storage.mjs').AccountMetadata> | null} */
+    let diskAccountsById = null;
+    /** @type {Map<number, import('./storage.mjs').AccountMetadata[]> | null} */
+    let diskAccountsByAddedAt = null;
+    /** @type {Map<string, import('./storage.mjs').AccountMetadata> | null} */
+    let diskAccountsByRefreshToken = null;
     try {
       const diskData = await loadAccounts();
       if (diskData) {
-        diskAccounts = new Map(diskData.accounts.map((a) => [a.id, a]));
+        diskAccountsById = new Map(diskData.accounts.map((a) => [a.id, a]));
+        diskAccountsByAddedAt = new Map();
+        diskAccountsByRefreshToken = new Map();
+        for (const diskAcc of diskData.accounts) {
+          const bucket = diskAccountsByAddedAt.get(diskAcc.addedAt) || [];
+          bucket.push(diskAcc);
+          diskAccountsByAddedAt.set(diskAcc.addedAt, bucket);
+          diskAccountsByRefreshToken.set(diskAcc.refreshToken, diskAcc);
+        }
       }
     } catch {
       // If we can't read, fall through to writing absolute values
     }
 
+    /**
+     * Resolve a corresponding disk account for auth merge.
+     * Prefer stable id, then unique addedAt, then refresh token.
+     * @param {ManagedAccount} account
+     */
+    const findDiskAccount = (account) => {
+      const byId = diskAccountsById?.get(account.id);
+      if (byId) return byId;
+
+      const byAddedAt = diskAccountsByAddedAt?.get(account.addedAt);
+      if (byAddedAt?.length === 1) return byAddedAt[0];
+
+      const byToken = diskAccountsByRefreshToken?.get(account.refreshToken);
+      if (byToken) return byToken;
+
+      if (byAddedAt && byAddedAt.length > 0) return byAddedAt[0];
+      return null;
+    };
+
     /** @type {AccountStorage} */
     const storage = {
       version: 1,
       accounts: this.#accounts.map((acc) => {
         const delta = this.#statsDeltas.get(acc.id);
         let mergedStats = acc.stats;
+        const diskAcc = findDiskAccount(acc);
 
         if (delta) {
-          const diskAcc = diskAccounts?.get(acc.id);
           const diskStats = diskAcc?.stats;
 
           if (delta.isReset) {
@@ -475,12 +531,35 @@ export class AccountManager {
           // If no diskStats and no reset, we write acc.stats as-is (first save)
         }
 
+        const memTokenUpdatedAt = acc.tokenUpdatedAt || 0;
+        const diskTokenUpdatedAt = diskAcc?.token_updated_at || 0;
+        const freshestAuth =
+          diskAcc && diskTokenUpdatedAt > memTokenUpdatedAt
+            ? {
+                refreshToken: diskAcc.refreshToken,
+                access: diskAcc.access,
+                expires: diskAcc.expires,
+                tokenUpdatedAt: diskTokenUpdatedAt,
+              }
+            : {
+                refreshToken: acc.refreshToken,
+                access: acc.access,
+                expires: acc.expires,
+                tokenUpdatedAt: memTokenUpdatedAt,
+              };
+
+        acc.refreshToken = freshestAuth.refreshToken;
+        acc.access = freshestAuth.access;
+        acc.expires = freshestAuth.expires;
+        acc.tokenUpdatedAt = freshestAuth.tokenUpdatedAt;
+
         return {
           id: acc.id,
           email: acc.email,
-          refreshToken: acc.refreshToken,
-          access: acc.access,
-          expires: acc.expires,
+          refreshToken: freshestAuth.refreshToken,
+          access: freshestAuth.access,
+          expires: freshestAuth.expires,
+          token_updated_at: freshestAuth.tokenUpdatedAt,
           addedAt: acc.addedAt,
           lastUsed: acc.lastUsed,
           enabled: acc.enabled,
@@ -519,14 +598,23 @@ export class AccountManager {
     if (!stored) return;
 
     // Reconcile account list/enabled states with disk (CLI may add/remove/enable/disable)
-    const diskSnapshot = stored.accounts.map((acc) => `${acc.refreshToken}:${acc.enabled ? 1 : 0}`).join("|");
-    const memSnapshot = this.#accounts.map((acc) => `${acc.refreshToken}:${acc.enabled ? 1 : 0}`).join("|");
+    const existingByTokenForSnapshot = new Map(this.#accounts.map((acc) => [acc.refreshToken, acc]));
+    const memSnapshot = this.#accounts.map((acc) => `${acc.id}:${acc.refreshToken}:${acc.enabled ? 1 : 0}`).join("|");
+
+    const diskSnapshot = stored.accounts
+      .map((acc) => {
+        const resolvedId = acc.id || existingByTokenForSnapshot.get(acc.refreshToken)?.id || acc.refreshToken;
+        return `${resolvedId}:${acc.refreshToken}:${acc.enabled ? 1 : 0}`;
+      })
+      .join("|");
 
     if (diskSnapshot !== memSnapshot) {
+      const existingById = new Map(this.#accounts.map((acc) => [acc.id, acc]));
       const existingByToken = new Map(this.#accounts.map((acc) => [acc.refreshToken, acc]));
 
       this.#accounts = stored.accounts.map((acc, index) => {
-        const existing = existingByToken.get(acc.refreshToken);
+        const existing =
+          (acc.id && existingById.get(acc.id)) || (!acc.id ? existingByToken.get(acc.refreshToken) : null);
         return {
           id: acc.id || existing?.id || `${acc.addedAt}:${acc.refreshToken.slice(0, 12)}`,
           index,
@@ -534,6 +622,7 @@ export class AccountManager {
           refreshToken: acc.refreshToken,
           access: acc.access ?? existing?.access,
           expires: acc.expires ?? existing?.expires,
+          tokenUpdatedAt: acc.token_updated_at ?? existing?.tokenUpdatedAt ?? acc.addedAt,
           addedAt: acc.addedAt,
           lastUsed: acc.lastUsed,
           enabled: acc.enabled,

package/lib/accounts.test.mjs

@@ -100,6 +100,29 @@ describe("AccountManager.load", () => {
     expect(snapshot[0].access).toBe("fresh-access");
   });
 
+  it("does not let stale/partial fallback override fresher stored auth", async () => {
+    loadAccounts.mockResolvedValue(
+      makeAccountsData([
+        {
+          lastUsed: 2000,
+          access: "disk-access",
+          expires: Date.now() + 6 * 3600_000,
+          token_updated_at: Date.now() + 6 * 3600_000,
+        },
+      ]),
+    );
+
+    const manager = await AccountManager.load(DEFAULT_CONFIG, {
+      refresh: "token1",
+      access: "stale-fallback-access",
+      expires: Date.now() - 60_000,
+    });
+
+    const snapshot = manager.getAccountsSnapshot();
+    expect(snapshot[0].access).toBe("disk-access");
+    expect(snapshot[0].expires).toBeGreaterThan(Date.now());
+  });
+
   it("clamps activeIndex to valid range", async () => {
     loadAccounts.mockResolvedValue(makeAccountsData([{ lastUsed: 2000 }], { activeIndex: 99 }));
     const manager = await AccountManager.load(DEFAULT_CONFIG, null);
@@ -449,6 +472,29 @@ describe("AccountManager persistence", () => {
     await manager.syncActiveIndexFromDisk();
     expect(manager.getCurrentIndex()).toBe(1);
   });
+
+  it("syncActiveIndexFromDisk reconciles by stable id when refresh token rotates", async () => {
+    const current = manager.getAccountsSnapshot()[0];
+
+    loadAccounts.mockResolvedValue(
+      makeAccountsData([
+        {
+          id: current.id,
+          refreshToken: "token1-rotated",
+          access: "rotated-access",
+          expires: Date.now() + 7200_000,
+          token_updated_at: Date.now() + 5_000,
+        },
+      ]),
+    );
+
+    await manager.syncActiveIndexFromDisk();
+    const snapshot = manager.getAccountsSnapshot();
+
+    expect(snapshot[0].id).toBe(current.id);
+    expect(snapshot[0].refreshToken).toBe("token1-rotated");
+    expect(snapshot[0].access).toBe("rotated-access");
+  });
 });
 
 // ---------------------------------------------------------------------------
@@ -779,4 +825,53 @@ describe("AccountManager merge-on-save", () => {
     expect(stats.requests).toBe(1);
     expect(stats.inputTokens).toBe(100);
   });
+
+  it("does not let stale in-memory auth overwrite fresher disk auth", async () => {
+    const manager = await createManagerWithAccounts(1);
+    const account = manager.getAccountsSnapshot()[0];
+
+    loadAccounts.mockResolvedValue(
+      makeAccountsData([
+        {
+          id: account.id,
+          refreshToken: "disk-rotated-refresh",
+          access: "disk-fresh-access",
+          expires: Date.now() + 9_000_000,
+          token_updated_at: Date.now() + 10_000,
+        },
+      ]),
+    );
+
+    await manager.saveToDisk();
+
+    const saved = saveAccounts.mock.calls[0][0];
+    expect(saved.accounts[0].refreshToken).toBe("disk-rotated-refresh");
+    expect(saved.accounts[0].access).toBe("disk-fresh-access");
+    expect(saved.accounts[0].token_updated_at).toBeGreaterThan(account.tokenUpdatedAt);
+  });
+
+  it("matches id-less disk records by addedAt when merging auth freshness", async () => {
+    const manager = await createManagerWithAccounts(1);
+    const account = manager.getAccountsSnapshot()[0];
+
+    // Simulate legacy/id-less disk record after token rotation.
+    loadAccounts.mockResolvedValue(
+      makeAccountsData([
+        {
+          id: undefined,
+          addedAt: account.addedAt,
+          refreshToken: "disk-rotated-no-id",
+          access: "disk-fresh-no-id",
+          expires: Date.now() + 9_000_000,
+          token_updated_at: Date.now() + 10_000,
+        },
+      ]),
+    );
+
+    await manager.saveToDisk();
+
+    const saved = saveAccounts.mock.calls[0][0];
+    expect(saved.accounts[0].refreshToken).toBe("disk-rotated-no-id");
+    expect(saved.accounts[0].access).toBe("disk-fresh-no-id");
+  });
 });

package/lib/config.mjs

@@ -37,6 +37,13 @@ import { homedir } from "node:os";
  * @property {number} output - Max output tokens to inject. 0 = leave model default unchanged.
  */
 
+/**
+ * @typedef {object} IdleRefreshConfig
+ * @property {boolean} enabled - Opportunistically refresh near-expiry idle accounts
+ * @property {number} window_minutes - Refresh idle accounts within this many minutes of expiry
+ * @property {number} min_interval_minutes - Minimum minutes between idle refresh attempts per account
+ */
+
 /**
  * @typedef {object} AnthropicAuthConfig
  * @property {AccountSelectionStrategy} account_selection_strategy
@@ -47,6 +54,8 @@ import { homedir } from "node:os";
  * @property {HealthScoreConfig} health_score
  * @property {TokenBucketConfig} token_bucket
  * @property {ToastConfig} toasts
+ * @property {HeaderConfig} headers
+ * @property {IdleRefreshConfig} idle_refresh
  */
 
 /** @type {AnthropicAuthConfig} */
@@ -82,6 +91,11 @@ export const DEFAULT_CONFIG = {
     quiet: false,
     debounce_seconds: 30,
   },
+  idle_refresh: {
+    enabled: true,
+    window_minutes: 60,
+    min_interval_minutes: 30,
+  },
 };
 
 export const VALID_STRATEGIES = ["sticky", "round-robin", "hybrid"];
@@ -101,6 +115,7 @@ function createDefaultConfig() {
     health_score: { ...DEFAULT_CONFIG.health_score },
     token_bucket: { ...DEFAULT_CONFIG.token_bucket },
     toasts: { ...DEFAULT_CONFIG.toasts },
+    idle_refresh: { ...DEFAULT_CONFIG.idle_refresh },
   };
 }
 
@@ -225,6 +240,51 @@ function validateConfig(raw) {
     };
   }
 
+  if (raw.headers && typeof raw.headers === "object") {
+    const h = /** @type {Record<string, unknown>} */ (raw.headers);
+
+    if (typeof h.emulation_profile === "string" && h.emulation_profile.trim()) {
+      config.headers.emulation_profile = h.emulation_profile.trim();
+    }
+
+    if (h.overrides && typeof h.overrides === "object" && !Array.isArray(h.overrides)) {
+      /** @type {Record<string, string>} */
+      const overrides = {};
+      for (const [key, value] of Object.entries(/** @type {Record<string, unknown>} */ (h.overrides))) {
+        if (!key) continue;
+        if (typeof value === "string") {
+          overrides[key] = value;
+        }
+      }
+      config.headers.overrides = overrides;
+    }
+
+    if (Array.isArray(h.disable)) {
+      config.headers.disable = h.disable
+        .filter((v) => typeof v === "string")
+        .map((v) => v.trim().toLowerCase())
+        .filter(Boolean);
+    }
+
+    if (typeof h.billing_header === "boolean") {
+      config.headers.billing_header = h.billing_header;
+    }
+  }
+
+  if (raw.idle_refresh && typeof raw.idle_refresh === "object") {
+    const ir = /** @type {Record<string, unknown>} */ (raw.idle_refresh);
+    config.idle_refresh = {
+      enabled: typeof ir.enabled === "boolean" ? ir.enabled : DEFAULT_CONFIG.idle_refresh.enabled,
+      window_minutes: clampNumber(ir.window_minutes, 1, 24 * 60, DEFAULT_CONFIG.idle_refresh.window_minutes),
+      min_interval_minutes: clampNumber(
+        ir.min_interval_minutes,
+        1,
+        24 * 60,
+        DEFAULT_CONFIG.idle_refresh.min_interval_minutes,
+      ),
+    };
+  }
+
   return config;
 }
 

package/lib/oauth.mjs

@@ -101,3 +101,38 @@ export async function revoke(refreshToken) {
     return false;
   }
 }
+
+/**
+ * Refresh an OAuth access token.
+ * @param {string} refreshTokenValue - The refresh token to use
+ * @param {{ signal?: AbortSignal }} [options]
+ * @returns {Promise<{access_token: string, refresh_token: string, expires_in: number}>}
+ * @throws {Error} On HTTP errors or network failures
+ */
+export async function refreshToken(refreshTokenValue, options = {}) {
+  const resp = await fetch("https://console.anthropic.com/v1/oauth/token", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      grant_type: "refresh_token",
+      client_id: CLIENT_ID,
+      refresh_token: refreshTokenValue,
+    }),
+    ...(options.signal ? { signal: options.signal } : {}),
+  });
+
+  if (!resp.ok) {
+    const text = await resp.text().catch(() => "");
+    const error = new Error(`Token refresh failed (HTTP ${resp.status}): ${text}`);
+    error.status = resp.status;
+    try {
+      const parsed = JSON.parse(text);
+      if (parsed.error) error.code = parsed.error;
+    } catch {
+      // Body may not be valid JSON
+    }
+    throw error;
+  }
+
+  return resp.json();
+}