opencode-anthropic-fix 0.0.16 → 0.0.18

package/lib/refresh-lock.mjs

@@ -0,0 +1,123 @@
+import { promises as fs } from "node:fs";
+import { createHash, randomBytes } from "node:crypto";
+import { dirname, join } from "node:path";
+import { getStoragePath } from "./storage.mjs";
+
+const DEFAULT_LOCK_TIMEOUT_MS = 2_000;
+const DEFAULT_LOCK_BACKOFF_MS = 50;
+const DEFAULT_STALE_LOCK_MS = 20_000;
+
+/**
+ * @param {number} ms
+ * @returns {Promise<void>}
+ */
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/**
+ * @param {string} accountId
+ * @returns {string}
+ */
+function getLockPath(accountId) {
+  const hash = createHash("sha1").update(accountId).digest("hex").slice(0, 24);
+  return join(dirname(getStoragePath()), "locks", `refresh-${hash}.lock`);
+}
+
+/**
+ * Try to acquire a per-account cross-process lock.
+ * @param {string} accountId
+ * @param {{ timeoutMs?: number, backoffMs?: number, staleMs?: number }} [options]
+ * @returns {Promise<{ acquired: boolean, lockPath: string | null, owner: string | null, lockInode: number | null }>}
+ */
+export async function acquireRefreshLock(accountId, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS;
+  const backoffMs = options.backoffMs ?? DEFAULT_LOCK_BACKOFF_MS;
+  const staleMs = options.staleMs ?? DEFAULT_STALE_LOCK_MS;
+  const lockPath = getLockPath(accountId);
+  const lockDir = dirname(lockPath);
+  const deadline = Date.now() + Math.max(0, timeoutMs);
+  const owner = randomBytes(12).toString("hex");
+
+  await fs.mkdir(lockDir, { recursive: true });
+
+  while (Date.now() <= deadline) {
+    try {
+      const handle = await fs.open(lockPath, "wx", 0o600);
+      try {
+        await handle.writeFile(JSON.stringify({ pid: process.pid, createdAt: Date.now(), owner }), "utf-8");
+        const stat = await handle.stat();
+        return { acquired: true, lockPath, owner, lockInode: stat.ino };
+      } finally {
+        await handle.close();
+      }
+    } catch (error) {
+      const code = /** @type {NodeJS.ErrnoException} */ (error).code;
+      if (code !== "EEXIST") {
+        throw error;
+      }
+
+      try {
+        const stat = await fs.stat(lockPath);
+        if (Date.now() - stat.mtimeMs > staleMs) {
+          await fs.unlink(lockPath);
+          continue;
+        }
+      } catch {
+        // Lock may have been released concurrently; retry.
+      }
+
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) break;
+      const jitter = Math.floor(Math.random() * 25);
+      await delay(Math.min(remaining, backoffMs + jitter));
+    }
+  }
+
+  return { acquired: false, lockPath: null, owner: null, lockInode: null };
+}
+
+/**
+ * Release a lock acquired by acquireRefreshLock.
+ * @param {{ lockPath: string | null, owner?: string | null, lockInode?: number | null } | string | null} lock
+ * @returns {Promise<void>}
+ */
+export async function releaseRefreshLock(lock) {
+  const lockPath = typeof lock === "string" || lock === null ? lock : lock.lockPath;
+  const owner = typeof lock === "object" && lock ? lock.owner || null : null;
+  const lockInode = typeof lock === "object" && lock ? lock.lockInode || null : null;
+
+  if (!lockPath) return;
+
+  // Ownership-safe release: avoid deleting a lock that another process
+  // acquired after ours became stale.
+  if (owner) {
+    try {
+      const content = await fs.readFile(lockPath, "utf-8");
+      const parsed = JSON.parse(content);
+      if (!parsed || typeof parsed !== "object" || parsed.owner !== owner) {
+        return;
+      }
+
+      if (lockInode) {
+        const stat = await fs.stat(lockPath);
+        if (stat.ino !== lockInode) {
+          return;
+        }
+      }
+    } catch (error) {
+      const code = /** @type {NodeJS.ErrnoException} */ (error).code;
+      if (code === "ENOENT") return;
+      // If unreadable/corrupt, fail closed to avoid deleting another
+      // process's lock when ownership cannot be verified.
+      return;
+    }
+  }
+
+  try {
+    await fs.unlink(lockPath);
+  } catch (error) {
+    const code = /** @type {NodeJS.ErrnoException} */ (error).code;
+    if (code !== "ENOENT") throw error;
+  }
+}

package/lib/refresh-lock.test.mjs

@@ -0,0 +1,79 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import { promises as fs } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+const baseDir = join(tmpdir(), `opencode-refresh-lock-test-${process.pid}`);
+const storagePath = join(baseDir, "anthropic-accounts.json");
+
+vi.mock("./storage.mjs", () => ({
+  getStoragePath: () => storagePath,
+}));
+
+import { acquireRefreshLock, releaseRefreshLock } from "./refresh-lock.mjs";
+
+describe("refresh-lock", () => {
+  beforeEach(async () => {
+    await fs.rm(baseDir, { recursive: true, force: true });
+    await fs.mkdir(baseDir, { recursive: true });
+  });
+
+  afterEach(async () => {
+    await fs.rm(baseDir, { recursive: true, force: true });
+  });
+
+  it("does not release lock with mismatched owner", async () => {
+    const lock = await acquireRefreshLock("acc-1");
+    expect(lock.acquired).toBe(true);
+    expect(lock.lockPath).toBeTruthy();
+
+    await releaseRefreshLock({ lockPath: lock.lockPath, owner: "wrong-owner" });
+
+    await expect(fs.stat(lock.lockPath)).resolves.toBeTruthy();
+
+    await releaseRefreshLock(lock);
+    await expect(fs.stat(lock.lockPath)).rejects.toMatchObject({ code: "ENOENT" });
+  });
+
+  it("acquires a new lock after stale lock timeout", async () => {
+    const first = await acquireRefreshLock("acc-2", { timeoutMs: 50, staleMs: 10_000 });
+    expect(first.acquired).toBe(true);
+
+    const old = Date.now() / 1000 - 120;
+    await fs.utimes(first.lockPath, old, old);
+
+    const second = await acquireRefreshLock("acc-2", { timeoutMs: 200, backoffMs: 5, staleMs: 20 });
+    expect(second.acquired).toBe(true);
+    expect(second.owner).not.toBe(first.owner);
+
+    await releaseRefreshLock(second);
+  });
+
+  it("returns not acquired when lock remains busy", async () => {
+    const first = await acquireRefreshLock("acc-3", { timeoutMs: 50 });
+    expect(first.acquired).toBe(true);
+
+    const second = await acquireRefreshLock("acc-3", { timeoutMs: 30, backoffMs: 5, staleMs: 60_000 });
+    expect(second.acquired).toBe(false);
+
+    await releaseRefreshLock(first);
+  });
+
+  it("does not release when inode changed even if owner matches", async () => {
+    const first = await acquireRefreshLock("acc-4");
+    expect(first.acquired).toBe(true);
+
+    // Replace lock file with a new inode that reuses owner text.
+    await fs.unlink(first.lockPath);
+    await fs.writeFile(first.lockPath, JSON.stringify({ owner: first.owner, createdAt: Date.now() }), {
+      encoding: "utf-8",
+      mode: 0o600,
+    });
+
+    await releaseRefreshLock(first);
+
+    await expect(fs.stat(first.lockPath)).resolves.toBeTruthy();
+
+    await fs.unlink(first.lockPath);
+  });
+});

package/lib/storage.mjs

@@ -21,6 +21,7 @@ import { getConfigDir } from "./config.mjs";
  * @property {string} refreshToken
  * @property {string} [access]
  * @property {number} [expires]
+ * @property {number} token_updated_at
  * @property {number} addedAt
  * @property {number} lastUsed
  * @property {boolean} enabled
@@ -160,6 +161,12 @@ function validateAccount(raw, now) {
     refreshToken: acc.refreshToken,
     access: typeof acc.access === "string" ? acc.access : undefined,
     expires: typeof acc.expires === "number" && Number.isFinite(acc.expires) ? acc.expires : undefined,
+    token_updated_at:
+      typeof acc.token_updated_at === "number" && Number.isFinite(acc.token_updated_at)
+        ? acc.token_updated_at
+        : typeof acc.tokenUpdatedAt === "number" && Number.isFinite(acc.tokenUpdatedAt)
+          ? acc.tokenUpdatedAt
+          : addedAt,
     addedAt,
     lastUsed: typeof acc.lastUsed === "number" && Number.isFinite(acc.lastUsed) ? acc.lastUsed : 0,
     enabled: acc.enabled !== false,
@@ -234,8 +241,76 @@ export async function saveAccounts(storage) {
   await fs.mkdir(configDir, { recursive: true });
   ensureGitignore(configDir);
 
+  /** @type {AccountStorage} */
+  let storageToWrite = storage;
+
+  // Merge auth fields against disk by freshness to avoid stale-process clobber.
+  // We do not resurrect removed accounts; only merge for accounts present in
+  // the incoming storage payload.
+  try {
+    const disk = await loadAccounts();
+    if (disk && storage.accounts.length > 0) {
+      const diskById = new Map(disk.accounts.map((a) => [a.id, a]));
+      /** @type {Map<number, AccountMetadata[]>} */
+      const diskByAddedAt = new Map();
+      const diskByToken = new Map(disk.accounts.map((a) => [a.refreshToken, a]));
+      for (const d of disk.accounts) {
+        const bucket = diskByAddedAt.get(d.addedAt) || [];
+        bucket.push(d);
+        diskByAddedAt.set(d.addedAt, bucket);
+      }
+
+      const findDiskMatch = (/** @type {AccountMetadata} */ acc) => {
+        const byId = diskById.get(acc.id);
+        if (byId) return byId;
+
+        const byAddedAt = diskByAddedAt.get(acc.addedAt);
+        if (byAddedAt?.length === 1) return byAddedAt[0];
+
+        const byToken = diskByToken.get(acc.refreshToken);
+        if (byToken) return byToken;
+
+        if (byAddedAt && byAddedAt.length > 0) return byAddedAt[0];
+        return null;
+      };
+
+      const mergedAccounts = storage.accounts.map((acc) => {
+        const diskAcc = findDiskMatch(acc);
+        const memTs =
+          typeof acc.token_updated_at === "number" && Number.isFinite(acc.token_updated_at)
+            ? acc.token_updated_at
+            : acc.addedAt;
+        const diskTs = diskAcc?.token_updated_at || 0;
+        const useDiskAuth = !!diskAcc && diskTs > memTs;
+
+        return {
+          ...acc,
+          refreshToken: useDiskAuth ? diskAcc.refreshToken : acc.refreshToken,
+          access: useDiskAuth ? diskAcc.access : acc.access,
+          expires: useDiskAuth ? diskAcc.expires : acc.expires,
+          token_updated_at: useDiskAuth ? diskTs : memTs,
+        };
+      });
+
+      let activeIndex = storage.activeIndex;
+      if (mergedAccounts.length > 0) {
+        activeIndex = Math.max(0, Math.min(activeIndex, mergedAccounts.length - 1));
+      } else {
+        activeIndex = 0;
+      }
+
+      storageToWrite = {
+        ...storage,
+        accounts: mergedAccounts,
+        activeIndex,
+      };
+    }
+  } catch {
+    // If merge read fails, continue with caller-provided storage payload.
+  }
+
   const tempPath = `${storagePath}.${randomBytes(6).toString("hex")}.tmp`;
-  const content = JSON.stringify(storage, null, 2);
+  const content = JSON.stringify(storageToWrite, null, 2);
 
   try {
     await fs.writeFile(tempPath, content, { encoding: "utf-8", mode: 0o600 });

package/lib/storage.test.mjs

@@ -352,6 +352,139 @@ describe("saveAccounts", () => {
     await expect(saveAccounts(storage)).rejects.toThrow("disk full");
     expect(fs.unlink).toHaveBeenCalledWith(expect.stringContaining(".tmp"));
   });
+
+  it("merges auth fields from fresher disk state", async () => {
+    fs.readFile.mockResolvedValue(
+      JSON.stringify({
+        version: 1,
+        accounts: [
+          {
+            id: "a1",
+            refreshToken: "disk-refresh",
+            access: "disk-access",
+            expires: 999999,
+            token_updated_at: 2000,
+            addedAt: 1000,
+            lastUsed: 0,
+            enabled: true,
+            rateLimitResetTimes: {},
+            consecutiveFailures: 0,
+            lastFailureTime: null,
+            stats: createDefaultStats(1000),
+          },
+        ],
+        activeIndex: 0,
+      }),
+    );
+
+    const storage = {
+      version: 1,
+      accounts: [
+        {
+          id: "a1",
+          refreshToken: "mem-refresh",
+          access: "mem-access",
+          expires: 123,
+          token_updated_at: 1000,
+          addedAt: 1000,
+          lastUsed: 0,
+          enabled: true,
+          rateLimitResetTimes: {},
+          consecutiveFailures: 0,
+          lastFailureTime: null,
+          stats: createDefaultStats(1000),
+        },
+      ],
+      activeIndex: 0,
+    };
+
+    await saveAccounts(storage);
+
+    const written = JSON.parse(fs.writeFile.mock.calls[0][1]);
+    expect(written.accounts[0].refreshToken).toBe("disk-refresh");
+    expect(written.accounts[0].access).toBe("disk-access");
+    expect(written.accounts[0].expires).toBe(999999);
+    expect(written.accounts[0].token_updated_at).toBe(2000);
+  });
+
+  it("matches id-less disk accounts by addedAt during freshness merge", async () => {
+    fs.readFile.mockResolvedValue(
+      JSON.stringify({
+        version: 1,
+        accounts: [
+          {
+            refreshToken: "disk-refresh-rotated",
+            access: "disk-access",
+            expires: 888888,
+            token_updated_at: 3000,
+            addedAt: 1111,
+            lastUsed: 0,
+            enabled: true,
+            rateLimitResetTimes: {},
+            consecutiveFailures: 0,
+            lastFailureTime: null,
+            stats: createDefaultStats(1111),
+          },
+        ],
+        activeIndex: 0,
+      }),
+    );
+
+    const storage = {
+      version: 1,
+      accounts: [
+        {
+          id: "legacy-a1",
+          refreshToken: "old-refresh",
+          access: "old-access",
+          expires: 111,
+          token_updated_at: 1000,
+          addedAt: 1111,
+          lastUsed: 0,
+          enabled: true,
+          rateLimitResetTimes: {},
+          consecutiveFailures: 0,
+          lastFailureTime: null,
+          stats: createDefaultStats(1111),
+        },
+      ],
+      activeIndex: 0,
+    };
+
+    await saveAccounts(storage);
+
+    const written = JSON.parse(fs.writeFile.mock.calls[0][1]);
+    expect(written.accounts[0].refreshToken).toBe("disk-refresh-rotated");
+    expect(written.accounts[0].token_updated_at).toBe(3000);
+  });
+
+  it("does not resurrect accounts removed by caller", async () => {
+    fs.readFile.mockResolvedValue(
+      JSON.stringify({
+        version: 1,
+        accounts: [
+          {
+            id: "a1",
+            refreshToken: "disk-refresh",
+            token_updated_at: 2000,
+            addedAt: 1000,
+            lastUsed: 0,
+            enabled: true,
+            rateLimitResetTimes: {},
+            consecutiveFailures: 0,
+            lastFailureTime: null,
+            stats: createDefaultStats(1000),
+          },
+        ],
+        activeIndex: 0,
+      }),
+    );
+
+    await saveAccounts({ version: 1, accounts: [], activeIndex: 0 });
+
+    const written = JSON.parse(fs.writeFile.mock.calls[0][1]);
+    expect(written.accounts).toEqual([]);
+  });
 });
 
 // ---------------------------------------------------------------------------

package/package.json

@@ -1,7 +1,13 @@
 {
   "name": "opencode-anthropic-fix",
-  "version": "0.0.16",
+  "version": "0.0.18",
   "main": "./index.mjs",
+  "files": [
+    "index.mjs",
+    "lib/**/*.mjs",
+    "README.md",
+    "LICENSE"
+  ],
   "scripts": {
     "build": "node scripts/build.mjs",
     "test": "vitest run",

package/.github/workflows/publish.yml

@@ -1,31 +0,0 @@
-name: Publish to npm
-
-on:
-  workflow_dispatch:
-    inputs:
-      bump:
-        description: "Version bump type"
-        required: false
-        default: "patch"
-
-permissions:
-  id-token: write
-  contents: read
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "24"
-          registry-url: "https://registry.npmjs.org"
-
-      - run: npm install
-
-      - run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_CONFIG_PROVENANCE: false

package/.husky/pre-commit

@@ -1,2 +0,0 @@
-npm test
-npx lint-staged

package/.husky/pre-push

@@ -1,3 +0,0 @@
-npm test
-npx prettier --check .
-npx eslint .