opencode-anthropic-fix 0.0.17 → 0.0.19

package/index.mjs

@@ -103,7 +103,7 @@ async function promptManageAccounts(accountManager) {
 // Request building helpers (extracted from original fetch interceptor)
 // ---------------------------------------------------------------------------
 
-const FALLBACK_CLAUDE_CLI_VERSION = "2.1.68";
+const FALLBACK_CLAUDE_CLI_VERSION = "2.1.76";
 const CLAUDE_CODE_NPM_LATEST_URL = "https://registry.npmjs.org/@anthropic-ai/claude-code/latest";
 const CLAUDE_CODE_BETA_FLAG = "claude-code-20250219";
 const BILLING_HASH_SALT = "59cf53e54c78";
@@ -292,7 +292,10 @@ function supportsThinking(model) {
  */
 function isOpus46Model(model) {
   if (!model) return false;
-  return /claude-opus-4[._-]6/i.test(model);
+  // Match standard IDs (claude-opus-4-6, claude-opus-4.6) and Bedrock ARNs
+  // (arn:aws:bedrock:...anthropic.claude-opus-4-6-...).
+  // Also match bare "opus-4-6" / "opus-4.6" fragments for non-standard strings.
+  return /claude-opus-4[._-]6|opus[._-]4[._-]6/i.test(model);
 }
 
 /**
@@ -300,7 +303,8 @@ function isOpus46Model(model) {
  * @returns {boolean}
  */
 function hasOneMillionContext(model) {
-  return /(^|[-_ ])1m($|[-_ ])|context[-_]?1m/i.test(model);
+  // Models with explicit 1m suffix, or Opus 4.6 (1M by default since v2.1.75).
+  return /(^|[-_ ])1m($|[-_ ])|context[-_]?1m/i.test(model) || isOpus46Model(model);
 }
 
 /**
@@ -732,7 +736,7 @@ function buildAnthropicBetaHeader(incomingBeta, signatureEnabled, model, provide
   return mergedBetas.join(",");
 }
 
-/** @typedef {'low' | 'medium' | 'high' | 'max'} ThinkingEffort */
+/** @typedef {'low' | 'medium' | 'high'} ThinkingEffort */
 
 /**
  * Map budgetTokens to an adaptive thinking effort level.
@@ -743,8 +747,7 @@ function buildAnthropicBetaHeader(incomingBeta, signatureEnabled, model, provide
 function budgetTokensToEffort(budgetTokens) {
   if (budgetTokens <= 1024) return "low";
   if (budgetTokens <= 8000) return "medium";
-  if (budgetTokens <= 16000) return "high";
-  return "max";
+  return "high";
 }
 
 /**
@@ -753,7 +756,7 @@ function budgetTokensToEffort(budgetTokens) {
  * @returns {value is ThinkingEffort}
  */
 function isValidEffort(value) {
-  return value === "low" || value === "medium" || value === "high" || value === "max";
+  return value === "low" || value === "medium" || value === "high";
 }
 
 /**
@@ -1427,10 +1430,14 @@ function applyDiskAuthIfFresher(account, diskAuth, options = {}) {
  * @param {import('./lib/accounts.mjs').ManagedAccount} account
  * @param {ReturnType<typeof import('@opencode-ai/sdk').createOpencodeClient>} client
  * @param {"foreground" | "idle"} [source]
+ * @param {{ onTokensUpdated?: () => Promise<void> }} [options] - If provided,
+ *   called under the cross-process lock after token update to persist rotated
+ *   tokens before the lock is released.  Omitting means tokens won't be saved
+ *   to disk until the caller arranges it (risking the rotation race).
  * @returns {Promise<string>} The new access token
  * @throws {Error} If refresh fails
  */
-async function refreshAccountToken(account, client, source = "foreground") {
+async function refreshAccountToken(account, client, source = "foreground", { onTokensUpdated } = {}) {
   const lockResult = await acquireRefreshLock(account.id, {
     timeoutMs: 2_000,
     backoffMs: 60,
@@ -1471,6 +1478,22 @@ async function refreshAccountToken(account, client, source = "foreground") {
     }
     markTokenStateUpdated(account);
 
+    // Persist new tokens to disk BEFORE releasing the cross-process lock.
+    // This is critical: if we release the lock first, another process can
+    // acquire it and read the old (now-rotated) refresh token from disk,
+    // leading to an invalid_grant failure.  The debounced requestSaveToDisk()
+    // that callers used previously left a ~1 s window where this race could
+    // (and did) happen.
+    if (onTokensUpdated) {
+      try {
+        await onTokensUpdated();
+      } catch {
+        // Best-effort: in-memory tokens remain valid for this process.
+        // The callback is responsible for scheduling its own fallback
+        // (e.g. a debounced retry) if the synchronous save fails.
+      }
+    }
+
     // Also persist to OpenCode's auth.json for compatibility.
     // This should be best-effort: a persistence hiccup should not invalidate an
     // otherwise successful refresh token exchange.
@@ -2011,7 +2034,21 @@ export async function AnthropicAuthPlugin({ client }) {
     const entry = { source, promise: Promise.resolve("") };
     const p = (async () => {
       try {
-        return await refreshAccountToken(account, client, source);
+        return await refreshAccountToken(account, client, source, {
+          onTokensUpdated: async () => {
+            try {
+              await accountManager.saveToDisk();
+            } catch {
+              // Synchronous save failed (disk full, permissions, etc.).
+              // Schedule a debounced retry so the rotated token eventually
+              // reaches disk.  Another process may hit invalid_grant in the
+              // interim, but its retry-from-disk logic can recover once this
+              // save lands.
+              accountManager.requestSaveToDisk();
+              throw new Error("save failed, debounced retry scheduled");
+            }
+          },
+        });
       } finally {
         if (refreshInFlight.get(key) === entry) {
           refreshInFlight.delete(key);
@@ -2040,7 +2077,6 @@ export async function AnthropicAuthPlugin({ client }) {
     try {
       try {
         await refreshAccountTokenSingleFlight(account, "idle");
-        accountManager.requestSaveToDisk();
         return;
       } catch (err) {
         let details = parseRefreshFailure(err);
@@ -2068,7 +2104,6 @@ export async function AnthropicAuthPlugin({ client }) {
 
         try {
           await refreshAccountTokenSingleFlight(account, "idle");
-          accountManager.requestSaveToDisk();
           return;
         } catch (retryErr) {
           details = parseRefreshFailure(retryErr);
@@ -2252,8 +2287,8 @@ export async function AnthropicAuthPlugin({ client }) {
                   const attemptedRefreshToken = account.refreshToken;
                   try {
                     accessToken = await refreshAccountTokenSingleFlight(account);
-                    // Persist updated tokens (especially if refresh token rotated)
-                    accountManager.requestSaveToDisk();
+                    // Tokens are now saved under the refresh lock (inside
+                    // refreshAccountToken) so no debounced save needed here.
                   } catch (err) {
                     // Token refresh failed — check if another instance rotated the
                     // refresh token and persisted it between attempts.
@@ -2287,7 +2322,6 @@ export async function AnthropicAuthPlugin({ client }) {
 
                       try {
                         accessToken = await refreshAccountTokenSingleFlight(account);
-                        accountManager.requestSaveToDisk();
                       } catch (retryErr) {
                         finalError = retryErr;
                         details = parseRefreshFailure(retryErr);

package/package.json

@@ -1,7 +1,13 @@
 {
   "name": "opencode-anthropic-fix",
-  "version": "0.0.17",
+  "version": "0.0.19",
   "main": "./index.mjs",
+  "files": [
+    "index.mjs",
+    "lib/**/*.mjs",
+    "README.md",
+    "LICENSE"
+  ],
   "scripts": {
     "build": "node scripts/build.mjs",
     "test": "vitest run",

package/.github/workflows/publish.yml

@@ -1,31 +0,0 @@
-name: Publish to npm
-
-on:
-  workflow_dispatch:
-    inputs:
-      bump:
-        description: "Version bump type"
-        required: false
-        default: "patch"
-
-permissions:
-  id-token: write
-  contents: read
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "24"
-          registry-url: "https://registry.npmjs.org"
-
-      - run: npm install
-
-      - run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_CONFIG_PROVENANCE: false

package/.husky/pre-commit

@@ -1,2 +0,0 @@
-npm test
-npx lint-staged

package/.husky/pre-push

@@ -1,3 +0,0 @@
-npm test
-npx prettier --check .
-npx eslint .

package/.planning/CLI-ENHANCEMENTS.md

@@ -1,221 +0,0 @@
-# CLI Enhancements: Full Account Management
-
-**Status:** Complete
-**Created:** 2026-02-09
-**Completed:** 2026-02-09
-
----
-
-## Problem Statement
-
-The plugin CLI (`opencode-anthropic-auth`) can **manage** existing accounts (enable, disable, remove, switch, reset) but cannot **authenticate** new ones or re-authenticate broken ones. The only way to add an account is through `opencode auth login` → selecting "Claude Pro/Max" → browser OAuth flow inside the OpenCode TUI.
-
-This creates friction in several scenarios:
-
-1. **Disabled account recovery** — Account #1 was disabled due to a token refresh failure. To fix it, you'd have to `remove` it via CLI, then re-login via `opencode auth login`, which is the exact workflow we want to avoid.
-2. **No re-authentication** — There's no way to get fresh tokens for an existing broken account without deleting and re-adding it.
-3. **No proper logout** — The `remove` command just deletes local data without revoking tokens server-side.
-4. **Incomplete standalone tool** — The CLI should be a self-contained account management tool that doesn't depend on the OpenCode TUI for any operation.
-
-## Solution Overview
-
-Add four new commands to `cli.mjs` that give full account lifecycle management:
-
-| Command        | Alias | Description                                        |
-| -------------- | ----- | -------------------------------------------------- |
-| `login`        | `ln`  | Add a new account via browser OAuth flow           |
-| `logout <N>`   | `lo`  | Revoke tokens + remove a specific account          |
-| `logout --all` | —     | Revoke all tokens + clear all accounts             |
-| `reauth <N>`   | `ra`  | Re-authenticate an account with fresh OAuth tokens |
-| `refresh <N>`  | `rf`  | Attempt token refresh without browser (quick fix)  |
-
-### Architecture Change
-
-Extract the OAuth `authorize()` and `exchange()` functions from `index.mjs` into a new shared module `lib/oauth.mjs`, plus add a new `revoke()` function. Both `index.mjs` (plugin) and `cli.mjs` (standalone) import from this shared module.
-
-```
-lib/oauth.mjs (NEW)
-  ├── authorize(mode)          — Generate PKCE + build auth URL
-  ├── exchange(code, verifier) — Exchange auth code for tokens
-  └── revoke(refreshToken)     — Revoke a refresh token (best-effort)
-```
-
-## Design Decisions
-
-| Decision              | Choice               | Rationale                                                               |
-| --------------------- | -------------------- | ----------------------------------------------------------------------- |
-| Reauth matching       | Replace at index     | Simpler UX; user explicitly chooses which slot to replace               |
-| Logout behavior       | Revoke + remove      | Clean break; user can re-add via `login`                                |
-| Token refresh command | Yes, add `refresh`   | Quick fix for expired access tokens without browser round-trip          |
-| Browser opening       | Auto-open + show URL | Best UX: tries `open`/`xdg-open`/`start`, always prints URL as fallback |
-
-## Detailed Command Specifications
-
-### `login` (alias: `ln`)
-
-**Flow:**
-
-1. Call `authorize("max")` to get PKCE URL + verifier
-2. Auto-open the URL in the user's default browser
-3. Print the URL to terminal as fallback
-4. Prompt user to paste the authorization code (readline)
-5. Call `exchange(code, verifier)` to get tokens
-6. Deduplicate: check if an account with the same refresh token already exists
-7. Add the account to `anthropic-accounts.json`, save, print confirmation
-
-**Edge cases:**
-
-- If exchange fails, print error and exit with code 1
-- If max accounts (10) reached, print error
-- If duplicate refresh token, update existing account instead of adding
-
-### `logout <N>` (alias: `lo <N>`)
-
-**Flow:**
-
-1. Validate index N exists
-2. Attempt `revoke(account.refreshToken)` — best-effort, won't block on failure
-3. Remove the account from array (splice)
-4. Adjust `activeIndex` if needed (same logic as existing `remove` command)
-5. Save + print confirmation
-
-**Flags:**
-
-- `--force` — Skip confirmation prompt (same as `remove`)
-- `--all` — Logout all accounts
-
-### `logout --all`
-
-**Flow:**
-
-1. Iterate all accounts, attempt `revoke()` for each
-2. Write explicit empty storage `{ version: 1, accounts: [], activeIndex: 0 }`
-3. Print confirmation with count of revoked accounts
-
-**Important behavior:** empty storage is treated as authoritative by `AccountManager.load()`, so plugin instances stay logged out and do not re-bootstrap from fallback auth when the accounts file explicitly contains zero accounts.
-
-### `reauth <N>` (alias: `ra <N>`)
-
-**Flow:**
-
-1. Validate index N exists
-2. Run full OAuth flow (same as `login` steps 1-5)
-3. Replace the account at index N with the new tokens
-4. Preserve: `id`, `addedAt`, `stats`
-5. Reset: `enabled=true`, `consecutiveFailures=0`, `lastFailureTime=null`, `rateLimitResetTimes={}`
-6. Save + print confirmation
-
-**Key detail:** Replaces whatever's at index N with whatever the user logs in with, regardless of email matching.
-
-### `refresh <N>` (alias: `rf <N>`)
-
-**Flow:**
-
-1. Validate index N exists
-2. Call the existing `refreshAccessToken(account)` function
-3. If success: update account, re-enable if disabled, save + print new token expiry
-4. If failure: print error and suggest `reauth <N>` instead
-
-## Files Modified
-
-| File                | Change                                                               | Status |
-| ------------------- | -------------------------------------------------------------------- | ------ |
-| `lib/oauth.mjs`     | **NEW** — Extracted `authorize()`, `exchange()`, plus new `revoke()` | Done   |
-| `index.mjs`         | Replace inline OAuth functions with imports from `lib/oauth.mjs`     | Done   |
-| `cli.mjs`           | Add 5 new commands + browser opener utility                          | Done   |
-| `scripts/build.mjs` | No change needed — esbuild follows imports automatically             | N/A    |
-
-## Task List
-
-- [x] **Task 1:** Create `lib/oauth.mjs` — extract `authorize()` and `exchange()` from `index.mjs`, add `revoke()`
-- [x] **Task 2:** Update `index.mjs` — replace inline functions with imports from `lib/oauth.mjs`
-- [x] **Task 3:** Add `openBrowser()` utility to `cli.mjs`
-- [x] **Task 4:** Implement `cmdLogin` in `cli.mjs`
-- [x] **Task 5:** Implement `cmdLogout` and `cmdLogoutAll` in `cli.mjs`
-- [x] **Task 6:** Implement `cmdReauth` in `cli.mjs`
-- [x] **Task 7:** Implement `cmdRefresh` in `cli.mjs`
-- [x] **Task 8:** Wire new commands into `main()` dispatcher and update `cmdHelp()`
-- [x] **Task 9:** Build — passes (esbuild picks up `lib/oauth.mjs` automatically)
-- [x] **Task 10:** Tests — all 349 tests pass across 7 test files, zero failures
-- [x] **Task 11:** Lint — eslint passes cleanly
-- [x] **Task 12:** Live verification — `refresh 1` correctly fails (broken token), `refresh 2` succeeds (7h 59m expiry)
-- [x] **Task 13:** Update this document with completion status
-
-## Token Revocation Notes
-
-Anthropic's OAuth implementation may or may not support RFC 7009 token revocation at `POST /v1/oauth/revoke`. The `revoke()` function is implemented as best-effort:
-
-- Attempts `POST https://console.anthropic.com/v1/oauth/revoke` with `{ token: refreshToken, token_type_hint: "refresh_token", client_id: CLIENT_ID }`
-- Returns `true` if 2xx response, `false` otherwise
-- `logout` proceeds with local cleanup regardless of revocation result
-- No error is surfaced to the user if revocation fails — only a dim note
-
-## Immediate Use Case
-
-To fix the disabled account #1:
-
-```bash
-# Option A: Try a token refresh first (no browser)
-opencode-anthropic-auth refresh 1
-# Tested: correctly fails with "token refresh failed" and suggests reauth
-
-# Option B: If refresh fails, do a full re-auth
-opencode-anthropic-auth reauth 1
-
-# Option C: Full nuke and re-login
-opencode-anthropic-auth logout 1
-opencode-anthropic-auth login
-```
-
-**Verified:** `refresh 2` (healthy account) succeeds and reports "Token refreshed, expires in 7h 59m".
-
-## Updated Help Text (Preview)
-
-```
-Anthropic Multi-Account Auth CLI
-
-Usage:
-  opencode-anthropic-auth [command] [args]
-
-Commands:
-  list              Show all accounts with status (default)
-  status            Compact one-liner for scripts/prompts
-  login             Add a new account via browser OAuth flow
-  logout <N>        Revoke tokens and remove account N
-  logout --all      Revoke all tokens and clear all accounts
-  reauth <N>        Re-authenticate account N with fresh OAuth tokens
-  refresh <N>       Attempt token refresh (no browser needed)
-  switch <N>        Set account N as active
-  enable <N>        Enable a disabled account
-  disable <N>       Disable an account (skipped in rotation)
-  remove <N>        Remove an account permanently
-  reset <N|all>     Clear rate-limit / failure tracking
-  stats             Show per-account usage statistics
-  reset-stats [N|all] Reset usage statistics
-  strategy [name]   Show or change selection strategy
-  config            Show configuration and file paths
-  manage            Interactive account management menu
-  help              Show this help message
-```
-
-## Post-Review Remediations
-
-Following delegated code review, the following fixes were applied:
-
-1. **Logout-all semantics hardened**
-   - `cmdLogoutAll` now writes explicit empty account storage instead of deleting the accounts file.
-   - `AccountManager.load` now treats existing storage (including empty storage) as authoritative, preventing fallback re-bootstrap when users explicitly logout-all.
-
-2. **Windows browser launch fixed**
-   - `openBrowser` now uses `cmd /c start "" <url>` on Windows for correct URL handling.
-
-3. **Reauth state message bug fixed**
-   - `cmdReauth` now captures prior disabled state (`wasDisabled`) before mutation and correctly prints "re-enabled" message when applicable.
-
-4. **Login dedupe ordering corrected**
-   - `cmdLogin` now performs duplicate-token update path before applying max-account rejection, so existing accounts can still be refreshed when at capacity.
-
-5. **Unit test coverage expanded for new auth commands**
-   - Added direct CLI unit tests for `cmdLogin`, `cmdLogout` (single + `--all`), `cmdReauth`, and `cmdRefresh`.
-   - Added main routing tests for new aliases/paths: `ln`, `lo --all --force`, `ra`, and `rf`.
-   - Added help text assertions for new commands/examples.

package/.planning/codebase/ARCHITECTURE.md

@@ -1,201 +0,0 @@
-# Architecture
-
-**Analysis Date:** 2026-02-07
-
-## Pattern Overview
-
-**Overall:** Plugin + CLI dual-entry-point architecture with shared library layer
-
-**Key Characteristics:**
-
-- OpenCode plugin providing OAuth-based multi-account Anthropic authentication
-- Standalone CLI binary for account management (shares storage layer with plugin)
-- Fetch interceptor pattern: the plugin wraps HTTP requests to Anthropic API, injecting OAuth tokens, transforming request/response bodies, and rotating accounts on failures
-- Stateful account management with disk persistence and in-memory health tracking
-- No framework — pure Node.js ESM modules with zero runtime dependencies beyond `@openauthjs/openauth`
-
-## Layers
-
-**Plugin Entry (`index.mjs`):**
-
-- Purpose: OpenCode plugin that intercepts Anthropic API calls with OAuth multi-account support
-- Location: `index.mjs`
-- Contains: OAuth authorize/exchange helpers, request/response transform functions, `AnthropicAuthPlugin` factory, token refresh logic, CLI-style interactive prompts for auth flow
-- Depends on: `lib/accounts.mjs`, `lib/config.mjs`, `lib/storage.mjs`, `lib/backoff.mjs`, `@openauthjs/openauth`
-- Used by: OpenCode runtime (loaded as plugin)
-
-**CLI Entry (`cli.mjs`):**
-
-- Purpose: Standalone CLI for managing accounts outside of the OpenCode TUI
-- Location: `cli.mjs`
-- Contains: All CLI commands (list, switch, enable, disable, remove, reset, stats, strategy, config, manage), formatting/color helpers, usage quota fetching
-- Depends on: `lib/storage.mjs`, `lib/config.mjs`
-- Used by: End users via `opencode-anthropic-auth` binary
-
-**Account Management (`lib/accounts.mjs`):**
-
-- Purpose: In-memory account pool with health scoring, rotation, and disk sync
-- Location: `lib/accounts.mjs`
-- Contains: `AccountManager` class — the core runtime coordinator for account selection, failure tracking, rate limit handling, and usage statistics
-- Depends on: `lib/storage.mjs`, `lib/rotation.mjs`, `lib/backoff.mjs`
-- Used by: `index.mjs`
-
-**Rotation Logic (`lib/rotation.mjs`):**
-
-- Purpose: Account selection algorithms and health/token tracking
-- Location: `lib/rotation.mjs`
-- Contains: `HealthScoreTracker` class, `TokenBucketTracker` class, `selectAccount()` function implementing sticky/round-robin/hybrid strategies
-- Depends on: `lib/config.mjs` (for defaults only)
-- Used by: `lib/accounts.mjs`
-
-**Backoff Logic (`lib/backoff.mjs`):**
-
-- Purpose: Error classification and retry backoff calculation
-- Location: `lib/backoff.mjs`
-- Contains: `isAccountSpecificError()`, `parseRateLimitReason()`, `calculateBackoffMs()`, `parseRetryAfterHeader()`
-- Depends on: Nothing
-- Used by: `index.mjs`, `lib/accounts.mjs`
-
-**Configuration (`lib/config.mjs`):**
-
-- Purpose: Config file loading, validation, and env var overrides
-- Location: `lib/config.mjs`
-- Contains: `loadConfig()`, `saveConfig()`, `DEFAULT_CONFIG`, `CLIENT_ID`, strategy validation, XDG-compliant path resolution
-- Depends on: Node.js builtins only
-- Used by: `index.mjs`, `cli.mjs`, `lib/accounts.mjs`, `lib/rotation.mjs`
-
-**Storage (`lib/storage.mjs`):**
-
-- Purpose: Atomic JSON file persistence for account data
-- Location: `lib/storage.mjs`
-- Contains: `loadAccounts()`, `saveAccounts()`, `clearAccounts()`, account validation/deduplication, `.gitignore` management
-- Depends on: `lib/config.mjs` (for config dir path)
-- Used by: `index.mjs`, `cli.mjs`, `lib/accounts.mjs`
-
-## Data Flow
-
-**API Request (Plugin fetch interceptor):**
-
-1. OpenCode calls `fetch(input, init)` on the plugin's custom fetch
-2. `transformRequestBody()` sanitizes system prompts and prefixes tool names with `mcp_`
-3. `transformRequestUrl()` adds `?beta=true` to `/v1/messages` endpoint
-4. `AccountManager.getCurrentAccount()` selects best account via strategy (sticky/round-robin/hybrid)
-5. If token expired, `refreshAccountTokenSingleFlight()` refreshes OAuth token (single-flight deduplication)
-6. `buildRequestHeaders()` sets Authorization bearer, anthropic-beta headers, removes x-api-key
-7. Actual `fetch()` to Anthropic API executes
-8. On account-specific error (429, 401, 400/403 with account language): mark account, try next account (up to N accounts)
-9. On service-wide error (529, 503, 500): return immediately (switching won't help)
-10. On success: `transformResponse()` wraps the SSE stream to strip `mcp_` prefix from tool names, extract token usage, and detect mid-stream account errors
-
-**Account Selection (per-request):**
-
-1. `AccountManager.syncActiveIndexFromDisk()` reconciles with CLI changes
-2. Build candidate list: enabled accounts, not in per-request exclusion set
-3. `selectAccount()` applies configured strategy:
-   - **sticky**: Stay on current account unless rate-limited/failed
-   - **round-robin**: Rotate cursor through available accounts
-   - **hybrid**: Score accounts by health (weighted ×2) + token bucket (weighted ×5) + freshness, with stickiness bonus (150 points) and switch threshold (100 points)
-4. Consume a token bucket token for the selected account
-5. Return selected `ManagedAccount`
-
-**OAuth Login Flow:**
-
-1. User triggers `opencode auth login` → plugin's `auth.methods[0].authorize()` runs
-2. If existing accounts: prompt menu (add/fresh/manage/cancel)
-3. Generate PKCE challenge via `@openauthjs/openauth`
-4. Build authorize URL for `claude.ai/oauth/authorize`
-5. User pastes authorization code
-6. `exchange()` POSTs to `console.anthropic.com/v1/oauth/token` for tokens
-7. `AccountManager.addAccount()` stores new credentials (deduplicates by refresh token)
-8. `AccountManager.saveToDisk()` persists to `~/.config/opencode/anthropic-accounts.json`
-
-**State Management:**
-
-- **In-memory (plugin process):** `AccountManager` with `HealthScoreTracker` and `TokenBucketTracker` — these are ephemeral, rebuilt on plugin load
-- **On-disk (shared):** `anthropic-accounts.json` stores account credentials, failure tracking, rate limit reset times, usage stats, and active index
-- **Sync mechanism:** Plugin reads `activeIndex` from disk before each request to pick up CLI changes; debounced writes (1s) persist plugin-side changes back
-- **Stats merge-on-save:** To handle concurrent instances, `saveToDisk()` reads disk values and applies in-memory deltas rather than overwriting
-
-## Key Abstractions
-
-**AccountManager (`lib/accounts.mjs`):**
-
-- Purpose: Central coordinator for multi-account state and request routing
-- Pattern: Singleton per plugin instance with private state (`#accounts`, `#healthTracker`, `#tokenTracker`)
-- Static factory: `AccountManager.load(config, authFallback)` bootstraps from disk + OpenCode auth
-- Key methods: `getCurrentAccount()`, `markRateLimited()`, `markSuccess()`, `markFailure()`, `recordUsage()`, `syncActiveIndexFromDisk()`
-
-**HealthScoreTracker (`lib/rotation.mjs`):**
-
-- Purpose: Track per-account health with passive time-based recovery
-- Pattern: In-memory score map with configurable initial/penalty/recovery values
-- Score range: 0–100, min_usable threshold (default 50) gates account selection
-
-**TokenBucketTracker (`lib/rotation.mjs`):**
-
-- Purpose: Rate-limit requests per account using token bucket algorithm
-- Pattern: Per-account bucket with configurable max tokens, regeneration rate
-- Default: 50 tokens, 6/minute regen
-
-**ManagedAccount (typedef in `lib/accounts.mjs`):**
-
-- Purpose: Runtime representation of an Anthropic OAuth account
-- Contains: id, index, email, refreshToken, access, expires, enabled, rateLimitResetTimes, consecutiveFailures, stats
-- Pattern: Mutable in-memory state with periodic disk sync
-
-## Entry Points
-
-**Plugin (`index.mjs` → `AnthropicAuthPlugin`):**
-
-- Location: `index.mjs`
-- Triggers: Loaded by OpenCode plugin system as ESM module
-- Responsibilities: Exports an async plugin factory function returning hooks for `experimental.chat.system.transform`, `auth.loader`, and `auth.methods`
-- Exported as: `export async function AnthropicAuthPlugin({ client })`
-
-**CLI (`cli.mjs` → `main()`):**
-
-- Location: `cli.mjs`
-- Triggers: Executed as `opencode-anthropic-auth [command]` via `~/.local/bin` symlink/copy
-- Responsibilities: Parse argv, route to command handlers, manage accounts via direct storage manipulation
-- Self-detection: Uses `import.meta.url === pathToFileURL(process.argv[1]).href` with symlink resolution
-
-**Build (`scripts/build.mjs`):**
-
-- Location: `scripts/build.mjs`
-- Triggers: `npm run build`
-- Responsibilities: Bundle `index.mjs` → `dist/opencode-anthropic-auth-plugin.js` and `cli.mjs` → `dist/opencode-anthropic-auth-cli.mjs` using esbuild (ESM, node20 target, all deps bundled except node: builtins)
-
-**Install (`scripts/install.mjs`):**
-
-- Location: `scripts/install.mjs`
-- Triggers: `npm run install:link` (dev) or `npm run install:copy` (production)
-- Responsibilities: Symlink or copy plugin to `~/.config/opencode/plugin/` and CLI to `~/.local/bin/`
-
-## Error Handling
-
-**Strategy:** Account-specific vs. service-wide error classification with automatic account rotation
-
-**Patterns:**
-
-- **Account-specific errors** (429, 401, 400/403 with account error body): Mark account with backoff, rotate to next account. Auth failures (401) invalidate cached token.
-- **Service-wide errors** (529, 503, 500): Return immediately to caller — switching accounts won't help.
-- **Token refresh failures**: Transient errors skip account for current request; terminal errors (400, 401, 403, `invalid_grant`) disable the account permanently.
-- **Mid-stream SSE errors**: Detected in response stream transformer. Account marked for next request (not retried mid-stream).
-- **Single-flight token refresh**: Concurrent requests to the same account share one in-flight refresh promise to prevent race conditions.
-- **Backoff calculation** (`lib/backoff.mjs`): Retry-After header takes precedence. Otherwise, reason-based: AUTH_FAILED=5s, RATE_LIMIT_EXCEEDED=30s, QUOTA_EXHAUSTED=escalating [1m, 5m, 30m, 2h].
-
-## Cross-Cutting Concerns
-
-**Logging:** Debug logging via `console.error("[opencode-anthropic-auth]", ...)` gated by `config.debug` flag (env: `OPENCODE_ANTHROPIC_DEBUG=1`). CLI uses direct `console.log` with ANSI color helpers.
-
-**Validation:** Config values are clamped to valid ranges in `lib/config.mjs` (`clampNumber()`). Account data is validated on load with type checks and fallbacks in `lib/storage.mjs` (`validateAccount()`). Duplicate refresh tokens are deduplicated.
-
-**Persistence:** All disk writes use atomic temp-file-and-rename pattern. Account storage uses `randomBytes(6).hex` temp names; config uses PID-based temp names. Files are written with `mode: 0o600` for security.
-
-**Configuration Precedence:** Config file (`~/.config/opencode/anthropic-auth.json`) → environment variable overrides (`OPENCODE_ANTHROPIC_STRATEGY`, `OPENCODE_ANTHROPIC_DEBUG`, `OPENCODE_ANTHROPIC_QUIET`).
-
-**Toast Notifications:** Plugin sends TUI toasts via `client.tui?.showToast()` for account usage, switching, and errors. Toasts are debounced per category and suppressible via quiet mode.
-
----
-
-_Architecture analysis: 2026-02-07_