opencode-anthropic-fix 0.0.25 → 0.0.27

package/lib/oauth.mjs

@@ -1,5 +1,6 @@
 import { createHash, randomBytes } from "node:crypto";
 import { CLIENT_ID } from "./config.mjs";
+import { parseRetryAfterHeader, parseRetryAfterMsHeader } from "./backoff.mjs";
 
 // ---------------------------------------------------------------------------
 // OAuth helpers — shared between plugin (index.mjs) and CLI (cli.mjs)
@@ -10,8 +11,27 @@ const OAUTH_MAX_HOST = "claude.ai";
 const OAUTH_REDIRECT_URI = `https://${OAUTH_CONSOLE_HOST}/oauth/code/callback`;
 const OAUTH_TOKEN_URL = `https://${OAUTH_CONSOLE_HOST}/v1/oauth/token`;
 const OAUTH_REVOKE_URL = `https://${OAUTH_CONSOLE_HOST}/v1/oauth/revoke`;
-const OAUTH_CLI_VERSION_PROFILE = "2.1.79";
-const OAUTH_USER_AGENT = `claude-cli/${OAUTH_CLI_VERSION_PROFILE} (external, cli)`;
+// Real Claude Code uses axios 1.13.6 for OAuth calls — axios sets User-Agent
+// automatically and adds Accept header. We must match this fingerprint exactly.
+// CLI version profile: 2.1.81 (for reference; not sent on OAuth calls)
+const OAUTH_AXIOS_VERSION = "1.13.6";
+const OAUTH_USER_AGENT = `axios/${OAUTH_AXIOS_VERSION}`;
+const OAUTH_ACCEPT = "application/json, text/plain, */*";
+const OAUTH_MAX_RETRIES = 2;
+const OAUTH_MAX_RETRY_DELAY_MS = 30_000;
+const OAUTH_RATE_LIMIT_COOLDOWN_MS = 30_000;
+const OAUTH_RETRY_AFTER_SOURCE_HEADER_MS = "retry-after-ms";
+const OAUTH_RETRY_AFTER_SOURCE_HEADER = "retry-after";
+const OAUTH_RETRY_AFTER_SOURCE_FALLBACK_429 = "fallback-429";
+
+export const CLAUDE_AI_SCOPES = [
+  "user:profile",
+  "user:inference",
+  "user:sessions:claude_code",
+  "user:mcp_servers",
+  "user:file_upload",
+];
+const CONSOLE_SCOPES = ["org:create_api_key", "user:profile"];
 
 function base64url(input) {
   return Buffer.from(input).toString("base64url");
@@ -20,13 +40,124 @@ function base64url(input) {
 function generatePKCE() {
   const verifier = base64url(randomBytes(32));
   const challenge = base64url(createHash("sha256").update(verifier).digest());
-  return { verifier, challenge };
+  const state = base64url(randomBytes(32));
+  return { verifier, challenge, state };
+}
+
+/**
+ * @param {number} ms
+ * @returns {Promise<void>}
+ */
+function sleep(ms) {
+  if (ms <= 0) return Promise.resolve();
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/**
+ * @param {number} status
+ * @returns {boolean}
+ */
+function isRetryableTokenStatus(status) {
+  return status === 429 || status === 500 || status === 502 || status === 503 || status === 504;
+}
+
+/**
+ * @param {Response} resp
+ * @param {number} attempt
+ * @returns {number}
+ */
+function getRetryDelayMs(resp, attempt) {
+  if (!resp || !resp.headers || typeof resp.headers.get !== "function") {
+    return Math.min(1000 * 2 ** attempt, 8000);
+  }
+  const headerMs = parseRetryAfterMsHeader(resp);
+  const retryAfterMs = parseRetryAfterHeader(resp);
+  const fallback = Math.min(1000 * 2 ** attempt, 8000);
+  const resolved = headerMs ?? retryAfterMs ?? fallback;
+  return Math.max(250, Math.min(resolved, OAUTH_MAX_RETRY_DELAY_MS));
+}
+
+/**
+ * Build a caller-facing cooldown hint from Retry-After headers.
+ * Falls back to a conservative 30s cooldown for 429s.
+ * @param {Response | null | undefined} resp
+ * @param {number | undefined} status
+ * @returns {{ retryAfterMs: number | null, retryAfterSource?: string }}
+ */
+function getCooldownHint(resp, status) {
+  if (resp && resp.headers && typeof resp.headers.get === "function") {
+    const headerMs = parseRetryAfterMsHeader(resp);
+    if (Number.isFinite(headerMs) && headerMs > 0) {
+      return {
+        retryAfterMs: Math.max(250, Math.min(headerMs, OAUTH_MAX_RETRY_DELAY_MS)),
+        retryAfterSource: OAUTH_RETRY_AFTER_SOURCE_HEADER_MS,
+      };
+    }
+
+    const retryAfterMs = parseRetryAfterHeader(resp);
+    if (Number.isFinite(retryAfterMs) && retryAfterMs > 0) {
+      return {
+        retryAfterMs: Math.max(250, Math.min(retryAfterMs, OAUTH_MAX_RETRY_DELAY_MS)),
+        retryAfterSource: OAUTH_RETRY_AFTER_SOURCE_HEADER,
+      };
+    }
+  }
+
+  if (status === 429) {
+    return {
+      retryAfterMs: OAUTH_RATE_LIMIT_COOLDOWN_MS,
+      retryAfterSource: OAUTH_RETRY_AFTER_SOURCE_FALLBACK_429,
+    };
+  }
+
+  return { retryAfterMs: null };
+}
+
+/**
+ * @param {string} rawText
+ * @returns {{ errorCode?: string, reason?: string }}
+ */
+function parseOAuthErrorBody(rawText) {
+  if (!rawText) return {};
+
+  try {
+    const parsed = JSON.parse(rawText);
+    let errorCode;
+    let reason;
+
+    if (typeof parsed.error === "string" && parsed.error) {
+      errorCode = parsed.error;
+    } else if (parsed.error && typeof parsed.error === "object") {
+      if (typeof parsed.error.type === "string" && parsed.error.type) {
+        errorCode = parsed.error.type;
+      }
+      if (typeof parsed.error.message === "string" && parsed.error.message) {
+        reason = parsed.error.message;
+      }
+    }
+
+    if (!reason) {
+      if (typeof parsed.error_description === "string" && parsed.error_description) {
+        reason = parsed.error_description;
+      } else if (typeof parsed.message === "string" && parsed.message) {
+        reason = parsed.message;
+      }
+    }
+
+    return {
+      ...(errorCode ? { errorCode } : {}),
+      ...(reason ? { reason } : {}),
+    };
+  } catch {
+    const trimmed = rawText.trim();
+    return trimmed ? { reason: trimmed } : {};
+  }
 }
 
 /**
  * Build an OAuth authorization URL with PKCE challenge.
  * @param {"max" | "console"} mode
- * @returns {Promise<{url: string, verifier: string}>}
+ * @returns {Promise<{url: string, verifier: string, state: string}>}
  */
 export async function authorize(mode) {
   const pkce = generatePKCE();
@@ -36,13 +167,15 @@ export async function authorize(mode) {
   url.searchParams.set("client_id", CLIENT_ID);
   url.searchParams.set("response_type", "code");
   url.searchParams.set("redirect_uri", OAUTH_REDIRECT_URI);
-  url.searchParams.set("scope", "org:create_api_key user:profile user:inference");
+  const scopes = mode === "console" ? CONSOLE_SCOPES : CLAUDE_AI_SCOPES;
+  url.searchParams.set("scope", scopes.join(" "));
   url.searchParams.set("code_challenge", pkce.challenge);
   url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("state", pkce.verifier);
+  url.searchParams.set("state", pkce.state);
   return {
     url: url.toString(),
     verifier: pkce.verifier,
+    state: pkce.state,
   };
 }
 
@@ -52,29 +185,24 @@ export async function authorize(mode) {
  * @param {string} verifier
  * @returns {Promise<
  *   | { type: "success", refresh: string, access: string, expires: number, email?: string }
- *   | { type: "failed", status?: number, code?: string, reason?: string, details?: string }
+ *   | {
+ *       type: "failed",
+ *       status?: number,
+ *       code?: string,
+ *       reason?: string,
+ *       details?: string,
+ *       retryAfterMs?: number,
+ *       retryAfterSource?: "retry-after-ms" | "retry-after" | "fallback-429"
+ *     }
  * >}
  */
 export async function exchange(code, verifier) {
-  const fail = (status, rawText = "") => {
-    let errorCode;
-    let reason;
-
-    if (rawText) {
-      try {
-        const parsed = JSON.parse(rawText);
-        if (typeof parsed.error === "string" && parsed.error) {
-          errorCode = parsed.error;
-        }
-        if (typeof parsed.error_description === "string" && parsed.error_description) {
-          reason = parsed.error_description;
-        } else if (typeof parsed.message === "string" && parsed.message) {
-          reason = parsed.message;
-        }
-      } catch {
-        reason = rawText.trim() || undefined;
-      }
-    }
+  const fail = (status, rawText = "", cooldownHint = { retryAfterMs: null }) => {
+    const { errorCode, reason } = parseOAuthErrorBody(rawText);
+    const retryAfterMs =
+      Number.isFinite(cooldownHint?.retryAfterMs) && cooldownHint.retryAfterMs > 0
+        ? Number(cooldownHint.retryAfterMs)
+        : null;
 
     const detailsParts = [];
     if (typeof status === "number") detailsParts.push(`HTTP ${status}`);
@@ -87,43 +215,76 @@ export async function exchange(code, verifier) {
       ...(errorCode ? { code: errorCode } : {}),
       ...(reason ? { reason } : {}),
       ...(detailsParts.length ? { details: detailsParts.join(" · ") } : {}),
+      ...(retryAfterMs ? { retryAfterMs } : {}),
+      ...(cooldownHint?.retryAfterSource ? { retryAfterSource: cooldownHint.retryAfterSource } : {}),
     };
   };
 
   const splits = code.split("#");
   let result;
+  for (let attempt = 0; attempt <= OAUTH_MAX_RETRIES; attempt++) {
+    try {
+      result = await fetch(OAUTH_TOKEN_URL, {
+        method: "POST",
+        headers: {
+          Accept: OAUTH_ACCEPT,
+          "Content-Type": "application/json",
+          "User-Agent": OAUTH_USER_AGENT,
+        },
+        body: JSON.stringify({
+          grant_type: "authorization_code",
+          code: splits[0],
+          redirect_uri: OAUTH_REDIRECT_URI,
+          client_id: CLIENT_ID,
+          code_verifier: verifier,
+          state: splits[1],
+        }),
+        signal: AbortSignal.timeout(15_000),
+      });
+    } catch (err) {
+      if (attempt < OAUTH_MAX_RETRIES) {
+        await sleep(Math.min(500 * 2 ** attempt, 2000));
+        continue;
+      }
+      return fail(undefined, err instanceof Error ? err.message : String(err));
+    }
+
+    if (!result.ok) {
+      const raw =
+        typeof result.text === "function"
+          ? await result
+              .text()
+              .then((value) => (typeof value === "string" ? value : ""))
+              .catch(() => "")
+          : "";
+
+      if (attempt < OAUTH_MAX_RETRIES && isRetryableTokenStatus(result.status)) {
+        await sleep(getRetryDelayMs(result, attempt));
+        continue;
+      }
+
+      return fail(result.status, raw, getCooldownHint(result, result.status));
+    }
+
+    break;
+  }
+
+  if (!result) {
+    return fail(undefined, "Token exchange request did not complete");
+  }
+
+  let json;
   try {
-    result = await fetch(OAUTH_TOKEN_URL, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "User-Agent": OAUTH_USER_AGENT,
-      },
-      body: JSON.stringify({
-        code: splits[0],
-        state: splits[1],
-        grant_type: "authorization_code",
-        client_id: CLIENT_ID,
-        redirect_uri: OAUTH_REDIRECT_URI,
-        code_verifier: verifier,
-      }),
-    });
-  } catch (err) {
-    return fail(undefined, err instanceof Error ? err.message : String(err));
+    json = await result.json();
+  } catch {
+    return fail(result.status, "Invalid JSON in token response");
   }
 
-  if (!result.ok) {
-    const raw =
-      typeof result.text === "function"
-        ? await result
-            .text()
-            .then((value) => (typeof value === "string" ? value : ""))
-            .catch(() => "")
-        : "";
-    return fail(result.status, raw);
+  // Validate required fields before returning success (QA fix C4)
+  if (!json.access_token || !json.refresh_token || typeof json.expires_in !== "number") {
+    return fail(result.status, "Missing required fields in token response");
   }
 
-  const json = await result.json();
   return {
     type: "success",
     refresh: json.refresh_token,
@@ -148,6 +309,7 @@ export async function revoke(refreshToken) {
     const resp = await fetch(OAUTH_REVOKE_URL, {
       method: "POST",
       headers: {
+        Accept: OAUTH_ACCEPT,
         "Content-Type": "application/json",
         "User-Agent": OAUTH_USER_AGENT,
       },
@@ -172,32 +334,76 @@ export async function revoke(refreshToken) {
  * @throws {Error} On HTTP errors or network failures
  */
 export async function refreshToken(refreshTokenValue, options = {}) {
-  const resp = await fetch(OAUTH_TOKEN_URL, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      "User-Agent": OAUTH_USER_AGENT,
-    },
-    body: JSON.stringify({
-      grant_type: "refresh_token",
-      client_id: CLIENT_ID,
-      refresh_token: refreshTokenValue,
-    }),
-    ...(options.signal ? { signal: options.signal } : {}),
-  });
-
-  if (!resp.ok) {
-    const text = await resp.text().catch(() => "");
-    const error = new Error(`Token refresh failed (HTTP ${resp.status}): ${text}`);
-    error.status = resp.status;
+  // QA fix M13: default 30s timeout to prevent hanging on unresponsive server
+  const signal = options.signal ?? AbortSignal.timeout(30_000);
+  let lastError = null;
+
+  for (let attempt = 0; attempt <= OAUTH_MAX_RETRIES; attempt++) {
+    let resp;
     try {
-      const parsed = JSON.parse(text);
-      if (parsed.error) error.code = parsed.error;
-    } catch {
-      // Body may not be valid JSON
+      resp = await fetch(OAUTH_TOKEN_URL, {
+        method: "POST",
+        headers: {
+          Accept: OAUTH_ACCEPT,
+          "Content-Type": "application/json",
+          "User-Agent": OAUTH_USER_AGENT,
+        },
+        body: JSON.stringify({
+          grant_type: "refresh_token",
+          refresh_token: refreshTokenValue,
+          client_id: CLIENT_ID,
+          scope: options.scopes ? options.scopes.join(" ") : CLAUDE_AI_SCOPES.join(" "),
+        }),
+        signal,
+      });
+    } catch (err) {
+      lastError = err;
+      if (attempt < OAUTH_MAX_RETRIES) {
+        await sleep(Math.min(500 * 2 ** attempt, 2000));
+        continue;
+      }
+      throw err;
+    }
+
+    if (!resp.ok) {
+      const text = await resp.text().catch(() => "");
+      const retryAfterMs = getRetryDelayMs(resp, attempt);
+
+      if (attempt < OAUTH_MAX_RETRIES && isRetryableTokenStatus(resp.status)) {
+        await sleep(retryAfterMs);
+        continue;
+      }
+
+      const error = new Error(`Token refresh failed (HTTP ${resp.status}): ${text}`);
+      error.status = resp.status;
+      const cooldownHint = getCooldownHint(resp, resp.status);
+      error.retryAfterMs =
+        Number.isFinite(cooldownHint.retryAfterMs) && cooldownHint.retryAfterMs > 0
+          ? cooldownHint.retryAfterMs
+          : retryAfterMs;
+      if (cooldownHint.retryAfterSource) {
+        error.retryAfterSource = cooldownHint.retryAfterSource;
+      }
+
+      const parsed = parseOAuthErrorBody(text);
+      if (parsed.errorCode) error.code = parsed.errorCode;
+
+      throw error;
     }
-    throw error;
+
+    return resp.json();
   }
 
-  return resp.json();
+  throw lastError instanceof Error ? lastError : new Error("Token refresh failed after retries");
+}
+
+/**
+ * Check if an account has all required Claude.ai scopes.
+ * @param {string[] | undefined} scopes
+ * @returns {boolean}
+ */
+export function hasRequiredScopes(scopes) {
+  if (!Array.isArray(scopes) || scopes.length === 0) return false;
+  const stored = new Set(scopes);
+  return CLAUDE_AI_SCOPES.every((s) => stored.has(s));
 }

package/lib/oauth.test.mjs

@@ -23,7 +23,7 @@ describe("oauth headers", () => {
     await exchange("code#state", "verifier");
 
     const [, init] = mockFetch.mock.calls[0];
-    expect(init.headers["User-Agent"]).toBe("claude-cli/2.1.79 (external, cli)");
+    expect(init.headers["User-Agent"]).toBe("axios/1.13.6");
   });
 
   it("sends Claude Code user-agent on token refresh", async () => {
@@ -35,7 +35,7 @@ describe("oauth headers", () => {
     await refreshToken("refresh-token");
 
     const [, init] = mockFetch.mock.calls[0];
-    expect(init.headers["User-Agent"]).toBe("claude-cli/2.1.79 (external, cli)");
+    expect(init.headers["User-Agent"]).toBe("axios/1.13.6");
   });
 
   it("sends Claude Code user-agent on token revoke", async () => {
@@ -44,6 +44,123 @@ describe("oauth headers", () => {
     await revoke("refresh-token");
 
     const [, init] = mockFetch.mock.calls[0];
-    expect(init.headers["User-Agent"]).toBe("claude-cli/2.1.79 (external, cli)");
+    expect(init.headers["User-Agent"]).toBe("axios/1.13.6");
+  });
+
+  it("parses Anthropic nested error payloads on exchange failure", async () => {
+    mockFetch.mockResolvedValueOnce({
+      ok: false,
+      status: 400,
+      headers: { get: () => null },
+      text: async () => JSON.stringify({ error: { type: "invalid_grant", message: "Bad auth code." } }),
+    });
+
+    const result = await exchange("code#state", "verifier");
+    expect(result.type).toBe("failed");
+    expect(result.status).toBe(400);
+    expect(result.code).toBe("invalid_grant");
+    expect(result.reason).toBe("Bad auth code.");
+  });
+
+  it("retries token exchange on 429 before succeeding", async () => {
+    mockFetch
+      .mockResolvedValueOnce({
+        ok: false,
+        status: 429,
+        headers: { get: (key) => (key === "retry-after-ms" ? "1" : null) },
+        text: async () => JSON.stringify({ error: { type: "rate_limit_error", message: "retry" } }),
+      })
+      .mockResolvedValueOnce({
+        ok: true,
+        json: async () => ({
+          access_token: "access",
+          refresh_token: "refresh",
+          expires_in: 3600,
+          account: { email_address: "retry@example.com" },
+        }),
+      });
+
+    const result = await exchange("code#state", "verifier");
+    expect(result.type).toBe("success");
+    expect(mockFetch).toHaveBeenCalledTimes(2);
+  });
+
+  it("retries token refresh on 429 before succeeding", async () => {
+    mockFetch
+      .mockResolvedValueOnce({
+        ok: false,
+        status: 429,
+        headers: { get: (key) => (key === "retry-after-ms" ? "1" : null) },
+        text: async () => JSON.stringify({ error: { type: "rate_limit_error", message: "retry" } }),
+      })
+      .mockResolvedValueOnce({
+        ok: true,
+        json: async () => ({ access_token: "a", refresh_token: "r", expires_in: 3600 }),
+      });
+
+    const result = await refreshToken("refresh-token");
+    expect(result.access_token).toBe("a");
+    expect(mockFetch).toHaveBeenCalledTimes(2);
+  });
+
+  it("uses nested error type as refresh error code", async () => {
+    mockFetch.mockResolvedValueOnce({
+      ok: false,
+      status: 400,
+      headers: { get: () => null },
+      text: async () => JSON.stringify({ error: { type: "invalid_grant", message: "Bad refresh token." } }),
+    });
+
+    await expect(refreshToken("refresh-token")).rejects.toMatchObject({
+      status: 400,
+      code: "invalid_grant",
+    });
+  });
+
+  it("returns cooldown hint on exchange 429 without Retry-After headers", async () => {
+    vi.useFakeTimers();
+    try {
+      mockFetch.mockResolvedValue({
+        ok: false,
+        status: 429,
+        headers: { get: () => null },
+        text: async () => JSON.stringify({ error: { type: "rate_limit_error", message: "Rate limited" } }),
+      });
+
+      const promise = exchange("code#state", "verifier");
+      await vi.runAllTimersAsync();
+      const result = await promise;
+
+      expect(result).toMatchObject({
+        type: "failed",
+        status: 429,
+        code: "rate_limit_error",
+        retryAfterMs: 30_000,
+      });
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it("throws 30s cooldown hint on refresh 429 without Retry-After headers", async () => {
+    vi.useFakeTimers();
+    try {
+      mockFetch.mockResolvedValue({
+        ok: false,
+        status: 429,
+        headers: { get: () => null },
+        text: async () => JSON.stringify({ error: { type: "rate_limit_error", message: "Rate limited" } }),
+      });
+
+      const assertion = expect(refreshToken("refresh-token")).rejects.toMatchObject({
+        status: 429,
+        code: "rate_limit_error",
+        retryAfterMs: 30_000,
+      });
+      await vi.runAllTimersAsync();
+      await assertion;
+    } finally {
+      vi.useRealTimers();
+    }
   });
 });

package/lib/rotation.mjs

@@ -72,6 +72,25 @@ export class HealthScoreTracker {
     });
   }
 
+  /**
+   * Apply a direct penalty to an account's health score.
+   * @param {number} accountIndex
+   * @param {number} penalty - Points to deduct
+   */
+  applyPenalty(accountIndex, penalty) {
+    const state = this.#scores.get(accountIndex);
+    if (!state) {
+      this.#scores.set(accountIndex, {
+        score: Math.max(0, this.#config.initial - penalty),
+        lastUpdated: Date.now(),
+        consecutiveFailures: 0,
+      });
+    } else {
+      state.score = Math.max(0, this.getScore(accountIndex) - penalty);
+      state.lastUpdated = Date.now();
+    }
+  }
+
   /**
    * Record a general failure.
    * @param {number} accountIndex
@@ -197,7 +216,8 @@ const SWITCH_THRESHOLD = 100;
 function calculateHybridScore(account, maxTokens) {
   const healthComponent = account.healthScore * 2;
   const tokenComponent = (account.tokens / maxTokens) * 100 * 5;
-  const secondsSinceUsed = (Date.now() - account.lastUsed) / 1000;
+  // QA fix M17: lastUsed=0 means never-used; treat as 0 freshness bonus instead of max
+  const secondsSinceUsed = account.lastUsed > 0 ? (Date.now() - account.lastUsed) / 1000 : 0;
   const freshnessComponent = Math.min(secondsSinceUsed, 3600) * 0.1;
 
   return Math.max(0, healthComponent + tokenComponent + freshnessComponent);

package/lib/rotation.test.mjs

@@ -135,7 +135,7 @@ describe("TokenBucketTracker", () => {
     tracker.consume(0);
     tracker.consume(0);
     tracker.refund(0);
-    expect(tracker.getTokens(0)).toBe(49);
+    expect(tracker.getTokens(0)).toBeCloseTo(49, 0);
   });
 
   it("refund does not exceed max", () => {
@@ -290,9 +290,9 @@ describe("selectAccount", () => {
     it("selects the account with highest composite score", () => {
       const candidates = [
         makeCandidate({ index: 0, lastUsed: Date.now() }),
-        makeCandidate({ index: 1, lastUsed: 0 }), // Older = more fresh
+        makeCandidate({ index: 1, lastUsed: Date.now() - 120_000 }), // 2 min ago = more fresh
       ];
-      // Account 1 should have higher freshness score
+      // Account 1 should have higher freshness score (120s * 0.1 = 12pt bonus)
       const result = selectAccount(candidates, "hybrid", null, healthTracker, tokenTracker, 0);
       // Both have same health and tokens, but account 1 has more freshness
       expect(result?.index).toBe(1);