opencode-anthropic-fix 0.0.17 → 0.0.18

package/package.json

@@ -1,7 +1,13 @@
 {
   "name": "opencode-anthropic-fix",
-  "version": "0.0.17",
+  "version": "0.0.18",
   "main": "./index.mjs",
+  "files": [
+    "index.mjs",
+    "lib/**/*.mjs",
+    "README.md",
+    "LICENSE"
+  ],
   "scripts": {
     "build": "node scripts/build.mjs",
     "test": "vitest run",

package/.github/workflows/publish.yml

@@ -1,31 +0,0 @@
-name: Publish to npm
-
-on:
-  workflow_dispatch:
-    inputs:
-      bump:
-        description: "Version bump type"
-        required: false
-        default: "patch"
-
-permissions:
-  id-token: write
-  contents: read
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "24"
-          registry-url: "https://registry.npmjs.org"
-
-      - run: npm install
-
-      - run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_CONFIG_PROVENANCE: false

package/.husky/pre-commit

@@ -1,2 +0,0 @@
-npm test
-npx lint-staged

package/.husky/pre-push

@@ -1,3 +0,0 @@
-npm test
-npx prettier --check .
-npx eslint .

package/.planning/CLI-ENHANCEMENTS.md

@@ -1,221 +0,0 @@
-# CLI Enhancements: Full Account Management
-
-**Status:** Complete
-**Created:** 2026-02-09
-**Completed:** 2026-02-09
-
----
-
-## Problem Statement
-
-The plugin CLI (`opencode-anthropic-auth`) can **manage** existing accounts (enable, disable, remove, switch, reset) but cannot **authenticate** new ones or re-authenticate broken ones. The only way to add an account is through `opencode auth login` → selecting "Claude Pro/Max" → browser OAuth flow inside the OpenCode TUI.
-
-This creates friction in several scenarios:
-
-1. **Disabled account recovery** — Account #1 was disabled due to a token refresh failure. To fix it, you'd have to `remove` it via CLI, then re-login via `opencode auth login`, which is the exact workflow we want to avoid.
-2. **No re-authentication** — There's no way to get fresh tokens for an existing broken account without deleting and re-adding it.
-3. **No proper logout** — The `remove` command just deletes local data without revoking tokens server-side.
-4. **Incomplete standalone tool** — The CLI should be a self-contained account management tool that doesn't depend on the OpenCode TUI for any operation.
-
-## Solution Overview
-
-Add four new commands to `cli.mjs` that give full account lifecycle management:
-
-| Command        | Alias | Description                                        |
-| -------------- | ----- | -------------------------------------------------- |
-| `login`        | `ln`  | Add a new account via browser OAuth flow           |
-| `logout <N>`   | `lo`  | Revoke tokens + remove a specific account          |
-| `logout --all` | —     | Revoke all tokens + clear all accounts             |
-| `reauth <N>`   | `ra`  | Re-authenticate an account with fresh OAuth tokens |
-| `refresh <N>`  | `rf`  | Attempt token refresh without browser (quick fix)  |
-
-### Architecture Change
-
-Extract the OAuth `authorize()` and `exchange()` functions from `index.mjs` into a new shared module `lib/oauth.mjs`, plus add a new `revoke()` function. Both `index.mjs` (plugin) and `cli.mjs` (standalone) import from this shared module.
-
-```
-lib/oauth.mjs (NEW)
-  ├── authorize(mode)          — Generate PKCE + build auth URL
-  ├── exchange(code, verifier) — Exchange auth code for tokens
-  └── revoke(refreshToken)     — Revoke a refresh token (best-effort)
-```
-
-## Design Decisions
-
-| Decision              | Choice               | Rationale                                                               |
-| --------------------- | -------------------- | ----------------------------------------------------------------------- |
-| Reauth matching       | Replace at index     | Simpler UX; user explicitly chooses which slot to replace               |
-| Logout behavior       | Revoke + remove      | Clean break; user can re-add via `login`                                |
-| Token refresh command | Yes, add `refresh`   | Quick fix for expired access tokens without browser round-trip          |
-| Browser opening       | Auto-open + show URL | Best UX: tries `open`/`xdg-open`/`start`, always prints URL as fallback |
-
-## Detailed Command Specifications
-
-### `login` (alias: `ln`)
-
-**Flow:**
-
-1. Call `authorize("max")` to get PKCE URL + verifier
-2. Auto-open the URL in the user's default browser
-3. Print the URL to terminal as fallback
-4. Prompt user to paste the authorization code (readline)
-5. Call `exchange(code, verifier)` to get tokens
-6. Deduplicate: check if an account with the same refresh token already exists
-7. Add the account to `anthropic-accounts.json`, save, print confirmation
-
-**Edge cases:**
-
-- If exchange fails, print error and exit with code 1
-- If max accounts (10) reached, print error
-- If duplicate refresh token, update existing account instead of adding
-
-### `logout <N>` (alias: `lo <N>`)
-
-**Flow:**
-
-1. Validate index N exists
-2. Attempt `revoke(account.refreshToken)` — best-effort, won't block on failure
-3. Remove the account from array (splice)
-4. Adjust `activeIndex` if needed (same logic as existing `remove` command)
-5. Save + print confirmation
-
-**Flags:**
-
-- `--force` — Skip confirmation prompt (same as `remove`)
-- `--all` — Logout all accounts
-
-### `logout --all`
-
-**Flow:**
-
-1. Iterate all accounts, attempt `revoke()` for each
-2. Write explicit empty storage `{ version: 1, accounts: [], activeIndex: 0 }`
-3. Print confirmation with count of revoked accounts
-
-**Important behavior:** empty storage is treated as authoritative by `AccountManager.load()`, so plugin instances stay logged out and do not re-bootstrap from fallback auth when the accounts file explicitly contains zero accounts.
-
-### `reauth <N>` (alias: `ra <N>`)
-
-**Flow:**
-
-1. Validate index N exists
-2. Run full OAuth flow (same as `login` steps 1-5)
-3. Replace the account at index N with the new tokens
-4. Preserve: `id`, `addedAt`, `stats`
-5. Reset: `enabled=true`, `consecutiveFailures=0`, `lastFailureTime=null`, `rateLimitResetTimes={}`
-6. Save + print confirmation
-
-**Key detail:** Replaces whatever's at index N with whatever the user logs in with, regardless of email matching.
-
-### `refresh <N>` (alias: `rf <N>`)
-
-**Flow:**
-
-1. Validate index N exists
-2. Call the existing `refreshAccessToken(account)` function
-3. If success: update account, re-enable if disabled, save + print new token expiry
-4. If failure: print error and suggest `reauth <N>` instead
-
-## Files Modified
-
-| File                | Change                                                               | Status |
-| ------------------- | -------------------------------------------------------------------- | ------ |
-| `lib/oauth.mjs`     | **NEW** — Extracted `authorize()`, `exchange()`, plus new `revoke()` | Done   |
-| `index.mjs`         | Replace inline OAuth functions with imports from `lib/oauth.mjs`     | Done   |
-| `cli.mjs`           | Add 5 new commands + browser opener utility                          | Done   |
-| `scripts/build.mjs` | No change needed — esbuild follows imports automatically             | N/A    |
-
-## Task List
-
-- [x] **Task 1:** Create `lib/oauth.mjs` — extract `authorize()` and `exchange()` from `index.mjs`, add `revoke()`
-- [x] **Task 2:** Update `index.mjs` — replace inline functions with imports from `lib/oauth.mjs`
-- [x] **Task 3:** Add `openBrowser()` utility to `cli.mjs`
-- [x] **Task 4:** Implement `cmdLogin` in `cli.mjs`
-- [x] **Task 5:** Implement `cmdLogout` and `cmdLogoutAll` in `cli.mjs`
-- [x] **Task 6:** Implement `cmdReauth` in `cli.mjs`
-- [x] **Task 7:** Implement `cmdRefresh` in `cli.mjs`
-- [x] **Task 8:** Wire new commands into `main()` dispatcher and update `cmdHelp()`
-- [x] **Task 9:** Build — passes (esbuild picks up `lib/oauth.mjs` automatically)
-- [x] **Task 10:** Tests — all 349 tests pass across 7 test files, zero failures
-- [x] **Task 11:** Lint — eslint passes cleanly
-- [x] **Task 12:** Live verification — `refresh 1` correctly fails (broken token), `refresh 2` succeeds (7h 59m expiry)
-- [x] **Task 13:** Update this document with completion status
-
-## Token Revocation Notes
-
-Anthropic's OAuth implementation may or may not support RFC 7009 token revocation at `POST /v1/oauth/revoke`. The `revoke()` function is implemented as best-effort:
-
-- Attempts `POST https://console.anthropic.com/v1/oauth/revoke` with `{ token: refreshToken, token_type_hint: "refresh_token", client_id: CLIENT_ID }`
-- Returns `true` if 2xx response, `false` otherwise
-- `logout` proceeds with local cleanup regardless of revocation result
-- No error is surfaced to the user if revocation fails — only a dim note
-
-## Immediate Use Case
-
-To fix the disabled account #1:
-
-```bash
-# Option A: Try a token refresh first (no browser)
-opencode-anthropic-auth refresh 1
-# Tested: correctly fails with "token refresh failed" and suggests reauth
-
-# Option B: If refresh fails, do a full re-auth
-opencode-anthropic-auth reauth 1
-
-# Option C: Full nuke and re-login
-opencode-anthropic-auth logout 1
-opencode-anthropic-auth login
-```
-
-**Verified:** `refresh 2` (healthy account) succeeds and reports "Token refreshed, expires in 7h 59m".
-
-## Updated Help Text (Preview)
-
-```
-Anthropic Multi-Account Auth CLI
-
-Usage:
-  opencode-anthropic-auth [command] [args]
-
-Commands:
-  list              Show all accounts with status (default)
-  status            Compact one-liner for scripts/prompts
-  login             Add a new account via browser OAuth flow
-  logout <N>        Revoke tokens and remove account N
-  logout --all      Revoke all tokens and clear all accounts
-  reauth <N>        Re-authenticate account N with fresh OAuth tokens
-  refresh <N>       Attempt token refresh (no browser needed)
-  switch <N>        Set account N as active
-  enable <N>        Enable a disabled account
-  disable <N>       Disable an account (skipped in rotation)
-  remove <N>        Remove an account permanently
-  reset <N|all>     Clear rate-limit / failure tracking
-  stats             Show per-account usage statistics
-  reset-stats [N|all] Reset usage statistics
-  strategy [name]   Show or change selection strategy
-  config            Show configuration and file paths
-  manage            Interactive account management menu
-  help              Show this help message
-```
-
-## Post-Review Remediations
-
-Following delegated code review, the following fixes were applied:
-
-1. **Logout-all semantics hardened**
-   - `cmdLogoutAll` now writes explicit empty account storage instead of deleting the accounts file.
-   - `AccountManager.load` now treats existing storage (including empty storage) as authoritative, preventing fallback re-bootstrap when users explicitly logout-all.
-
-2. **Windows browser launch fixed**
-   - `openBrowser` now uses `cmd /c start "" <url>` on Windows for correct URL handling.
-
-3. **Reauth state message bug fixed**
-   - `cmdReauth` now captures prior disabled state (`wasDisabled`) before mutation and correctly prints "re-enabled" message when applicable.
-
-4. **Login dedupe ordering corrected**
-   - `cmdLogin` now performs duplicate-token update path before applying max-account rejection, so existing accounts can still be refreshed when at capacity.
-
-5. **Unit test coverage expanded for new auth commands**
-   - Added direct CLI unit tests for `cmdLogin`, `cmdLogout` (single + `--all`), `cmdReauth`, and `cmdRefresh`.
-   - Added main routing tests for new aliases/paths: `ln`, `lo --all --force`, `ra`, and `rf`.
-   - Added help text assertions for new commands/examples.

package/.planning/codebase/ARCHITECTURE.md

@@ -1,201 +0,0 @@
-# Architecture
-
-**Analysis Date:** 2026-02-07
-
-## Pattern Overview
-
-**Overall:** Plugin + CLI dual-entry-point architecture with shared library layer
-
-**Key Characteristics:**
-
-- OpenCode plugin providing OAuth-based multi-account Anthropic authentication
-- Standalone CLI binary for account management (shares storage layer with plugin)
-- Fetch interceptor pattern: the plugin wraps HTTP requests to Anthropic API, injecting OAuth tokens, transforming request/response bodies, and rotating accounts on failures
-- Stateful account management with disk persistence and in-memory health tracking
-- No framework — pure Node.js ESM modules with zero runtime dependencies beyond `@openauthjs/openauth`
-
-## Layers
-
-**Plugin Entry (`index.mjs`):**
-
-- Purpose: OpenCode plugin that intercepts Anthropic API calls with OAuth multi-account support
-- Location: `index.mjs`
-- Contains: OAuth authorize/exchange helpers, request/response transform functions, `AnthropicAuthPlugin` factory, token refresh logic, CLI-style interactive prompts for auth flow
-- Depends on: `lib/accounts.mjs`, `lib/config.mjs`, `lib/storage.mjs`, `lib/backoff.mjs`, `@openauthjs/openauth`
-- Used by: OpenCode runtime (loaded as plugin)
-
-**CLI Entry (`cli.mjs`):**
-
-- Purpose: Standalone CLI for managing accounts outside of the OpenCode TUI
-- Location: `cli.mjs`
-- Contains: All CLI commands (list, switch, enable, disable, remove, reset, stats, strategy, config, manage), formatting/color helpers, usage quota fetching
-- Depends on: `lib/storage.mjs`, `lib/config.mjs`
-- Used by: End users via `opencode-anthropic-auth` binary
-
-**Account Management (`lib/accounts.mjs`):**
-
-- Purpose: In-memory account pool with health scoring, rotation, and disk sync
-- Location: `lib/accounts.mjs`
-- Contains: `AccountManager` class — the core runtime coordinator for account selection, failure tracking, rate limit handling, and usage statistics
-- Depends on: `lib/storage.mjs`, `lib/rotation.mjs`, `lib/backoff.mjs`
-- Used by: `index.mjs`
-
-**Rotation Logic (`lib/rotation.mjs`):**
-
-- Purpose: Account selection algorithms and health/token tracking
-- Location: `lib/rotation.mjs`
-- Contains: `HealthScoreTracker` class, `TokenBucketTracker` class, `selectAccount()` function implementing sticky/round-robin/hybrid strategies
-- Depends on: `lib/config.mjs` (for defaults only)
-- Used by: `lib/accounts.mjs`
-
-**Backoff Logic (`lib/backoff.mjs`):**
-
-- Purpose: Error classification and retry backoff calculation
-- Location: `lib/backoff.mjs`
-- Contains: `isAccountSpecificError()`, `parseRateLimitReason()`, `calculateBackoffMs()`, `parseRetryAfterHeader()`
-- Depends on: Nothing
-- Used by: `index.mjs`, `lib/accounts.mjs`
-
-**Configuration (`lib/config.mjs`):**
-
-- Purpose: Config file loading, validation, and env var overrides
-- Location: `lib/config.mjs`
-- Contains: `loadConfig()`, `saveConfig()`, `DEFAULT_CONFIG`, `CLIENT_ID`, strategy validation, XDG-compliant path resolution
-- Depends on: Node.js builtins only
-- Used by: `index.mjs`, `cli.mjs`, `lib/accounts.mjs`, `lib/rotation.mjs`
-
-**Storage (`lib/storage.mjs`):**
-
-- Purpose: Atomic JSON file persistence for account data
-- Location: `lib/storage.mjs`
-- Contains: `loadAccounts()`, `saveAccounts()`, `clearAccounts()`, account validation/deduplication, `.gitignore` management
-- Depends on: `lib/config.mjs` (for config dir path)
-- Used by: `index.mjs`, `cli.mjs`, `lib/accounts.mjs`
-
-## Data Flow
-
-**API Request (Plugin fetch interceptor):**
-
-1. OpenCode calls `fetch(input, init)` on the plugin's custom fetch
-2. `transformRequestBody()` sanitizes system prompts and prefixes tool names with `mcp_`
-3. `transformRequestUrl()` adds `?beta=true` to `/v1/messages` endpoint
-4. `AccountManager.getCurrentAccount()` selects best account via strategy (sticky/round-robin/hybrid)
-5. If token expired, `refreshAccountTokenSingleFlight()` refreshes OAuth token (single-flight deduplication)
-6. `buildRequestHeaders()` sets Authorization bearer, anthropic-beta headers, removes x-api-key
-7. Actual `fetch()` to Anthropic API executes
-8. On account-specific error (429, 401, 400/403 with account language): mark account, try next account (up to N accounts)
-9. On service-wide error (529, 503, 500): return immediately (switching won't help)
-10. On success: `transformResponse()` wraps the SSE stream to strip `mcp_` prefix from tool names, extract token usage, and detect mid-stream account errors
-
-**Account Selection (per-request):**
-
-1. `AccountManager.syncActiveIndexFromDisk()` reconciles with CLI changes
-2. Build candidate list: enabled accounts, not in per-request exclusion set
-3. `selectAccount()` applies configured strategy:
-   - **sticky**: Stay on current account unless rate-limited/failed
-   - **round-robin**: Rotate cursor through available accounts
-   - **hybrid**: Score accounts by health (weighted ×2) + token bucket (weighted ×5) + freshness, with stickiness bonus (150 points) and switch threshold (100 points)
-4. Consume a token bucket token for the selected account
-5. Return selected `ManagedAccount`
-
-**OAuth Login Flow:**
-
-1. User triggers `opencode auth login` → plugin's `auth.methods[0].authorize()` runs
-2. If existing accounts: prompt menu (add/fresh/manage/cancel)
-3. Generate PKCE challenge via `@openauthjs/openauth`
-4. Build authorize URL for `claude.ai/oauth/authorize`
-5. User pastes authorization code
-6. `exchange()` POSTs to `console.anthropic.com/v1/oauth/token` for tokens
-7. `AccountManager.addAccount()` stores new credentials (deduplicates by refresh token)
-8. `AccountManager.saveToDisk()` persists to `~/.config/opencode/anthropic-accounts.json`
-
-**State Management:**
-
-- **In-memory (plugin process):** `AccountManager` with `HealthScoreTracker` and `TokenBucketTracker` — these are ephemeral, rebuilt on plugin load
-- **On-disk (shared):** `anthropic-accounts.json` stores account credentials, failure tracking, rate limit reset times, usage stats, and active index
-- **Sync mechanism:** Plugin reads `activeIndex` from disk before each request to pick up CLI changes; debounced writes (1s) persist plugin-side changes back
-- **Stats merge-on-save:** To handle concurrent instances, `saveToDisk()` reads disk values and applies in-memory deltas rather than overwriting
-
-## Key Abstractions
-
-**AccountManager (`lib/accounts.mjs`):**
-
-- Purpose: Central coordinator for multi-account state and request routing
-- Pattern: Singleton per plugin instance with private state (`#accounts`, `#healthTracker`, `#tokenTracker`)
-- Static factory: `AccountManager.load(config, authFallback)` bootstraps from disk + OpenCode auth
-- Key methods: `getCurrentAccount()`, `markRateLimited()`, `markSuccess()`, `markFailure()`, `recordUsage()`, `syncActiveIndexFromDisk()`
-
-**HealthScoreTracker (`lib/rotation.mjs`):**
-
-- Purpose: Track per-account health with passive time-based recovery
-- Pattern: In-memory score map with configurable initial/penalty/recovery values
-- Score range: 0–100, min_usable threshold (default 50) gates account selection
-
-**TokenBucketTracker (`lib/rotation.mjs`):**
-
-- Purpose: Rate-limit requests per account using token bucket algorithm
-- Pattern: Per-account bucket with configurable max tokens, regeneration rate
-- Default: 50 tokens, 6/minute regen
-
-**ManagedAccount (typedef in `lib/accounts.mjs`):**
-
-- Purpose: Runtime representation of an Anthropic OAuth account
-- Contains: id, index, email, refreshToken, access, expires, enabled, rateLimitResetTimes, consecutiveFailures, stats
-- Pattern: Mutable in-memory state with periodic disk sync
-
-## Entry Points
-
-**Plugin (`index.mjs` → `AnthropicAuthPlugin`):**
-
-- Location: `index.mjs`
-- Triggers: Loaded by OpenCode plugin system as ESM module
-- Responsibilities: Exports an async plugin factory function returning hooks for `experimental.chat.system.transform`, `auth.loader`, and `auth.methods`
-- Exported as: `export async function AnthropicAuthPlugin({ client })`
-
-**CLI (`cli.mjs` → `main()`):**
-
-- Location: `cli.mjs`
-- Triggers: Executed as `opencode-anthropic-auth [command]` via `~/.local/bin` symlink/copy
-- Responsibilities: Parse argv, route to command handlers, manage accounts via direct storage manipulation
-- Self-detection: Uses `import.meta.url === pathToFileURL(process.argv[1]).href` with symlink resolution
-
-**Build (`scripts/build.mjs`):**
-
-- Location: `scripts/build.mjs`
-- Triggers: `npm run build`
-- Responsibilities: Bundle `index.mjs` → `dist/opencode-anthropic-auth-plugin.js` and `cli.mjs` → `dist/opencode-anthropic-auth-cli.mjs` using esbuild (ESM, node20 target, all deps bundled except node: builtins)
-
-**Install (`scripts/install.mjs`):**
-
-- Location: `scripts/install.mjs`
-- Triggers: `npm run install:link` (dev) or `npm run install:copy` (production)
-- Responsibilities: Symlink or copy plugin to `~/.config/opencode/plugin/` and CLI to `~/.local/bin/`
-
-## Error Handling
-
-**Strategy:** Account-specific vs. service-wide error classification with automatic account rotation
-
-**Patterns:**
-
-- **Account-specific errors** (429, 401, 400/403 with account error body): Mark account with backoff, rotate to next account. Auth failures (401) invalidate cached token.
-- **Service-wide errors** (529, 503, 500): Return immediately to caller — switching accounts won't help.
-- **Token refresh failures**: Transient errors skip account for current request; terminal errors (400, 401, 403, `invalid_grant`) disable the account permanently.
-- **Mid-stream SSE errors**: Detected in response stream transformer. Account marked for next request (not retried mid-stream).
-- **Single-flight token refresh**: Concurrent requests to the same account share one in-flight refresh promise to prevent race conditions.
-- **Backoff calculation** (`lib/backoff.mjs`): Retry-After header takes precedence. Otherwise, reason-based: AUTH_FAILED=5s, RATE_LIMIT_EXCEEDED=30s, QUOTA_EXHAUSTED=escalating [1m, 5m, 30m, 2h].
-
-## Cross-Cutting Concerns
-
-**Logging:** Debug logging via `console.error("[opencode-anthropic-auth]", ...)` gated by `config.debug` flag (env: `OPENCODE_ANTHROPIC_DEBUG=1`). CLI uses direct `console.log` with ANSI color helpers.
-
-**Validation:** Config values are clamped to valid ranges in `lib/config.mjs` (`clampNumber()`). Account data is validated on load with type checks and fallbacks in `lib/storage.mjs` (`validateAccount()`). Duplicate refresh tokens are deduplicated.
-
-**Persistence:** All disk writes use atomic temp-file-and-rename pattern. Account storage uses `randomBytes(6).hex` temp names; config uses PID-based temp names. Files are written with `mode: 0o600` for security.
-
-**Configuration Precedence:** Config file (`~/.config/opencode/anthropic-auth.json`) → environment variable overrides (`OPENCODE_ANTHROPIC_STRATEGY`, `OPENCODE_ANTHROPIC_DEBUG`, `OPENCODE_ANTHROPIC_QUIET`).
-
-**Toast Notifications:** Plugin sends TUI toasts via `client.tui?.showToast()` for account usage, switching, and errors. Toasts are debounced per category and suppressible via quiet mode.
-
----
-
-_Architecture analysis: 2026-02-07_