opencode-anthropic-fix 0.0.26 → 0.0.27

package/lib/accounts.mjs

@@ -1,7 +1,13 @@
+import { createHash } from "node:crypto";
 import { loadAccounts, saveAccounts, createDefaultStats } from "./storage.mjs";
 import { HealthScoreTracker, TokenBucketTracker, selectAccount } from "./rotation.mjs";
 import { calculateBackoffMs } from "./backoff.mjs";
 
+/** QA fix M12: hash token fragment instead of leaking raw prefix */
+function hashTokenFragment(token) {
+  return createHash("sha256").update(token).digest("hex").slice(0, 12);
+}
+
 /**
  * @typedef {import('./config.mjs').AnthropicAuthConfig} AnthropicAuthConfig
  * @typedef {import('./config.mjs').AccountSelectionStrategy} AccountSelectionStrategy
@@ -92,7 +98,7 @@ export class AccountManager {
     // re-bootstrapping from OpenCode auth fallback credentials.
     if (stored) {
       manager.#accounts = stored.accounts.map((acc, index) => ({
-        id: acc.id || `${acc.addedAt}:${acc.refreshToken.slice(0, 12)}`,
+        id: acc.id || `${acc.addedAt}:${hashTokenFragment(acc.refreshToken)}`,
         index,
         email: acc.email,
         refreshToken: acc.refreshToken,
@@ -193,6 +199,15 @@ export class AccountManager {
     return this.#currentIndex;
   }
 
+  /**
+   * Get the health score for a specific account.
+   * @param {number} accountIndex
+   * @returns {number}
+   */
+  getHealthScore(accountIndex) {
+    return this.#healthTracker.getScore(accountIndex);
+  }
+
   /**
    * Force the active account to a specific index.
    * Used by OPENCODE_ANTHROPIC_INITIAL_ACCOUNT to pin a session to one account.
@@ -389,7 +404,7 @@ export class AccountManager {
     const now = Date.now();
     /** @type {ManagedAccount} */
     const account = {
-      id: `${now}:${refreshToken.slice(0, 12)}`,
+      id: `${now}:${hashTokenFragment(refreshToken)}`,
       index: this.#accounts.length,
       email,
       refreshToken,
@@ -445,11 +460,10 @@ export class AccountManager {
       }
     }
 
-    // Reset health scores for all accounts since indices shifted after splice.
-    // This is simpler and safer than trying to remap individual scores.
-    for (let i = 0; i < this.#accounts.length; i++) {
-      this.#healthTracker.reset(i);
-    }
+    // Reset both health and token trackers since indices shifted after splice (QA fix H10).
+    // Rebuilding is simpler and safer than trying to remap individual entries.
+    this.#healthTracker = new HealthScoreTracker(this.#config.health_score);
+    this.#tokenTracker = new TokenBucketTracker(this.#config.token_bucket);
     this.requestSaveToDisk();
     return true;
   }
@@ -475,6 +489,10 @@ export class AccountManager {
     this.#accounts = [];
     this.#currentIndex = -1;
     this.#cursor = 0;
+    // QA fix: reset trackers to avoid stale state leaking to new accounts
+    this.#healthTracker = new HealthScoreTracker(this.#config.health_score);
+    this.#tokenTracker = new TokenBucketTracker(this.#config.token_bucket);
+    this.#statsDeltas.clear();
   }
 
   /**
@@ -617,10 +635,20 @@ export class AccountManager {
       activeIndex: Math.max(0, this.#currentIndex),
     };
 
-    await saveAccounts(storage);
+    // QA fix H8: snapshot delta keys before the async write to avoid losing
+    // deltas added during the await. Only delete keys we captured, not new ones.
+    const capturedDeltaKeys = new Set(this.#statsDeltas.keys());
 
-    // Clear deltas after successful write
-    this.#statsDeltas.clear();
+    // QA fix M15: pass pre-loaded disk data to saveAccounts to avoid TOCTOU double-read
+    const preloadedDiskData = diskAccountsById
+      ? { version: 1, accounts: [...diskAccountsById.values()], activeIndex: Math.max(0, this.#currentIndex) }
+      : null;
+    await saveAccounts(storage, preloadedDiskData);
+
+    // Clear only the captured deltas; new ones added during await are preserved
+    for (const key of capturedDeltaKeys) {
+      this.#statsDeltas.delete(key);
+    }
 
     // Update in-memory stats to match what we wrote (so subsequent reads
     // reflect the merged values, not stale pre-merge values)
@@ -660,7 +688,7 @@ export class AccountManager {
         const existing =
           (acc.id && existingById.get(acc.id)) || (!acc.id ? existingByToken.get(acc.refreshToken) : null);
         return {
-          id: acc.id || existing?.id || `${acc.addedAt}:${acc.refreshToken.slice(0, 12)}`,
+          id: acc.id || existing?.id || `${acc.addedAt}:${hashTokenFragment(acc.refreshToken)}`,
           index,
           email: acc.email ?? existing?.email,
           refreshToken: acc.refreshToken,

package/lib/accounts.test.mjs

@@ -356,18 +356,18 @@ describe("AccountManager persistence", () => {
 
   it("saveToDisk calls saveAccounts with correct format", async () => {
     await manager.saveToDisk();
-    expect(saveAccounts).toHaveBeenCalledWith(
-      expect.objectContaining({
-        version: 1,
-        accounts: expect.arrayContaining([
-          expect.objectContaining({
-            refreshToken: "token1",
-            enabled: true,
-          }),
-        ]),
-        activeIndex: expect.any(Number),
-      }),
+    // M15: saveToDisk now passes optional 2nd arg (preloaded disk data)
+    const savedArg = saveAccounts.mock.calls[0][0];
+    expect(savedArg.version).toBe(1);
+    expect(savedArg.accounts).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          refreshToken: "token1",
+          enabled: true,
+        }),
+      ]),
     );
+    expect(typeof savedArg.activeIndex).toBe("number");
   });
 
   it("requestSaveToDisk debounces saves", async () => {
@@ -606,18 +606,18 @@ describe("AccountManager usage stats", () => {
 
     await manager.saveToDisk();
 
-    expect(saveAccounts).toHaveBeenCalledWith(
-      expect.objectContaining({
-        accounts: expect.arrayContaining([
-          expect.objectContaining({
-            stats: expect.objectContaining({
-              requests: 1,
-              inputTokens: 100,
-              outputTokens: 50,
-            }),
+    // M15: saveToDisk now passes optional 2nd arg (preloaded disk data)
+    const savedArg = saveAccounts.mock.calls[0][0];
+    expect(savedArg.accounts).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          stats: expect.objectContaining({
+            requests: 1,
+            inputTokens: 100,
+            outputTokens: 50,
           }),
-        ]),
-      }),
+        }),
+      ]),
     );
   });
 });

package/lib/config.mjs

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
+import { randomBytes } from "node:crypto";
 
 /**
  * @typedef {'sticky' | 'round-robin' | 'hybrid'} AccountSelectionStrategy
@@ -68,6 +69,7 @@ import { homedir } from "node:os";
  * @property {CachePolicyConfig} cache_policy
  * @property {boolean} fast_mode
  * @property {{emulate_minimal: boolean}} telemetry
+ * @property {boolean} usage_toast
  */
 
 /** @type {AnthropicAuthConfig} */
@@ -119,6 +121,13 @@ export const DEFAULT_CONFIG = {
   telemetry: {
     emulate_minimal: false,
   },
+  usage_toast: false,
+  headers: {
+    emulation_profile: "",
+    overrides: {},
+    disable: [],
+    billing_header: true,
+  },
 };
 
 export const VALID_STRATEGIES = ["sticky", "round-robin", "hybrid"];
@@ -143,6 +152,7 @@ function createDefaultConfig() {
     cache_policy: { ...DEFAULT_CONFIG.cache_policy },
     fast_mode: DEFAULT_CONFIG.fast_mode,
     telemetry: { ...DEFAULT_CONFIG.telemetry },
+    headers: { ...DEFAULT_CONFIG.headers, overrides: {}, disable: [] },
   };
 }
 
@@ -344,6 +354,9 @@ function validateConfig(raw) {
       ? raw.telemetry.emulate_minimal
       : DEFAULT_CONFIG.telemetry.emulate_minimal;
 
+  // Usage toast
+  config.usage_toast = typeof raw.usage_toast === "boolean" ? raw.usage_toast : DEFAULT_CONFIG.usage_toast;
+
   return config;
 }
 
@@ -507,7 +520,8 @@ export function saveConfig(updates) {
   const merged = deepMergeConfig(existing, updates);
 
   // Atomic write: temp file + rename
-  const tmpPath = configPath + `.tmp.${process.pid}`;
+  // QA fix M16: use random bytes to avoid collision with same-process concurrent calls
+  const tmpPath = configPath + `.tmp.${process.pid}.${randomBytes(4).toString("hex")}`;
   writeFileSync(tmpPath, JSON.stringify(merged, null, 2) + "\n", { encoding: "utf-8", mode: 0o600 });
   renameSync(tmpPath, configPath);
 }

package/lib/oauth.mjs

@@ -1,5 +1,6 @@
 import { createHash, randomBytes } from "node:crypto";
 import { CLIENT_ID } from "./config.mjs";
+import { parseRetryAfterHeader, parseRetryAfterMsHeader } from "./backoff.mjs";
 
 // ---------------------------------------------------------------------------
 // OAuth helpers — shared between plugin (index.mjs) and CLI (cli.mjs)
@@ -10,8 +11,18 @@ const OAUTH_MAX_HOST = "claude.ai";
 const OAUTH_REDIRECT_URI = `https://${OAUTH_CONSOLE_HOST}/oauth/code/callback`;
 const OAUTH_TOKEN_URL = `https://${OAUTH_CONSOLE_HOST}/v1/oauth/token`;
 const OAUTH_REVOKE_URL = `https://${OAUTH_CONSOLE_HOST}/v1/oauth/revoke`;
-const OAUTH_CLI_VERSION_PROFILE = "2.1.80";
-const OAUTH_USER_AGENT = `claude-code/${OAUTH_CLI_VERSION_PROFILE}`;
+// Real Claude Code uses axios 1.13.6 for OAuth calls — axios sets User-Agent
+// automatically and adds Accept header. We must match this fingerprint exactly.
+// CLI version profile: 2.1.81 (for reference; not sent on OAuth calls)
+const OAUTH_AXIOS_VERSION = "1.13.6";
+const OAUTH_USER_AGENT = `axios/${OAUTH_AXIOS_VERSION}`;
+const OAUTH_ACCEPT = "application/json, text/plain, */*";
+const OAUTH_MAX_RETRIES = 2;
+const OAUTH_MAX_RETRY_DELAY_MS = 30_000;
+const OAUTH_RATE_LIMIT_COOLDOWN_MS = 30_000;
+const OAUTH_RETRY_AFTER_SOURCE_HEADER_MS = "retry-after-ms";
+const OAUTH_RETRY_AFTER_SOURCE_HEADER = "retry-after";
+const OAUTH_RETRY_AFTER_SOURCE_FALLBACK_429 = "fallback-429";
 
 export const CLAUDE_AI_SCOPES = [
   "user:profile",
@@ -33,6 +44,116 @@ function generatePKCE() {
   return { verifier, challenge, state };
 }
 
+/**
+ * @param {number} ms
+ * @returns {Promise<void>}
+ */
+function sleep(ms) {
+  if (ms <= 0) return Promise.resolve();
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/**
+ * @param {number} status
+ * @returns {boolean}
+ */
+function isRetryableTokenStatus(status) {
+  return status === 429 || status === 500 || status === 502 || status === 503 || status === 504;
+}
+
+/**
+ * @param {Response} resp
+ * @param {number} attempt
+ * @returns {number}
+ */
+function getRetryDelayMs(resp, attempt) {
+  if (!resp || !resp.headers || typeof resp.headers.get !== "function") {
+    return Math.min(1000 * 2 ** attempt, 8000);
+  }
+  const headerMs = parseRetryAfterMsHeader(resp);
+  const retryAfterMs = parseRetryAfterHeader(resp);
+  const fallback = Math.min(1000 * 2 ** attempt, 8000);
+  const resolved = headerMs ?? retryAfterMs ?? fallback;
+  return Math.max(250, Math.min(resolved, OAUTH_MAX_RETRY_DELAY_MS));
+}
+
+/**
+ * Build a caller-facing cooldown hint from Retry-After headers.
+ * Falls back to a conservative 30s cooldown for 429s.
+ * @param {Response | null | undefined} resp
+ * @param {number | undefined} status
+ * @returns {{ retryAfterMs: number | null, retryAfterSource?: string }}
+ */
+function getCooldownHint(resp, status) {
+  if (resp && resp.headers && typeof resp.headers.get === "function") {
+    const headerMs = parseRetryAfterMsHeader(resp);
+    if (Number.isFinite(headerMs) && headerMs > 0) {
+      return {
+        retryAfterMs: Math.max(250, Math.min(headerMs, OAUTH_MAX_RETRY_DELAY_MS)),
+        retryAfterSource: OAUTH_RETRY_AFTER_SOURCE_HEADER_MS,
+      };
+    }
+
+    const retryAfterMs = parseRetryAfterHeader(resp);
+    if (Number.isFinite(retryAfterMs) && retryAfterMs > 0) {
+      return {
+        retryAfterMs: Math.max(250, Math.min(retryAfterMs, OAUTH_MAX_RETRY_DELAY_MS)),
+        retryAfterSource: OAUTH_RETRY_AFTER_SOURCE_HEADER,
+      };
+    }
+  }
+
+  if (status === 429) {
+    return {
+      retryAfterMs: OAUTH_RATE_LIMIT_COOLDOWN_MS,
+      retryAfterSource: OAUTH_RETRY_AFTER_SOURCE_FALLBACK_429,
+    };
+  }
+
+  return { retryAfterMs: null };
+}
+
+/**
+ * @param {string} rawText
+ * @returns {{ errorCode?: string, reason?: string }}
+ */
+function parseOAuthErrorBody(rawText) {
+  if (!rawText) return {};
+
+  try {
+    const parsed = JSON.parse(rawText);
+    let errorCode;
+    let reason;
+
+    if (typeof parsed.error === "string" && parsed.error) {
+      errorCode = parsed.error;
+    } else if (parsed.error && typeof parsed.error === "object") {
+      if (typeof parsed.error.type === "string" && parsed.error.type) {
+        errorCode = parsed.error.type;
+      }
+      if (typeof parsed.error.message === "string" && parsed.error.message) {
+        reason = parsed.error.message;
+      }
+    }
+
+    if (!reason) {
+      if (typeof parsed.error_description === "string" && parsed.error_description) {
+        reason = parsed.error_description;
+      } else if (typeof parsed.message === "string" && parsed.message) {
+        reason = parsed.message;
+      }
+    }
+
+    return {
+      ...(errorCode ? { errorCode } : {}),
+      ...(reason ? { reason } : {}),
+    };
+  } catch {
+    const trimmed = rawText.trim();
+    return trimmed ? { reason: trimmed } : {};
+  }
+}
+
 /**
  * Build an OAuth authorization URL with PKCE challenge.
  * @param {"max" | "console"} mode
@@ -64,29 +185,24 @@ export async function authorize(mode) {
  * @param {string} verifier
  * @returns {Promise<
  *   | { type: "success", refresh: string, access: string, expires: number, email?: string }
- *   | { type: "failed", status?: number, code?: string, reason?: string, details?: string }
+ *   | {
+ *       type: "failed",
+ *       status?: number,
+ *       code?: string,
+ *       reason?: string,
+ *       details?: string,
+ *       retryAfterMs?: number,
+ *       retryAfterSource?: "retry-after-ms" | "retry-after" | "fallback-429"
+ *     }
  * >}
  */
 export async function exchange(code, verifier) {
-  const fail = (status, rawText = "") => {
-    let errorCode;
-    let reason;
-
-    if (rawText) {
-      try {
-        const parsed = JSON.parse(rawText);
-        if (typeof parsed.error === "string" && parsed.error) {
-          errorCode = parsed.error;
-        }
-        if (typeof parsed.error_description === "string" && parsed.error_description) {
-          reason = parsed.error_description;
-        } else if (typeof parsed.message === "string" && parsed.message) {
-          reason = parsed.message;
-        }
-      } catch {
-        reason = rawText.trim() || undefined;
-      }
-    }
+  const fail = (status, rawText = "", cooldownHint = { retryAfterMs: null }) => {
+    const { errorCode, reason } = parseOAuthErrorBody(rawText);
+    const retryAfterMs =
+      Number.isFinite(cooldownHint?.retryAfterMs) && cooldownHint.retryAfterMs > 0
+        ? Number(cooldownHint.retryAfterMs)
+        : null;
 
     const detailsParts = [];
     if (typeof status === "number") detailsParts.push(`HTTP ${status}`);
@@ -99,43 +215,76 @@ export async function exchange(code, verifier) {
       ...(errorCode ? { code: errorCode } : {}),
       ...(reason ? { reason } : {}),
       ...(detailsParts.length ? { details: detailsParts.join(" · ") } : {}),
+      ...(retryAfterMs ? { retryAfterMs } : {}),
+      ...(cooldownHint?.retryAfterSource ? { retryAfterSource: cooldownHint.retryAfterSource } : {}),
     };
   };
 
   const splits = code.split("#");
   let result;
+  for (let attempt = 0; attempt <= OAUTH_MAX_RETRIES; attempt++) {
+    try {
+      result = await fetch(OAUTH_TOKEN_URL, {
+        method: "POST",
+        headers: {
+          Accept: OAUTH_ACCEPT,
+          "Content-Type": "application/json",
+          "User-Agent": OAUTH_USER_AGENT,
+        },
+        body: JSON.stringify({
+          grant_type: "authorization_code",
+          code: splits[0],
+          redirect_uri: OAUTH_REDIRECT_URI,
+          client_id: CLIENT_ID,
+          code_verifier: verifier,
+          state: splits[1],
+        }),
+        signal: AbortSignal.timeout(15_000),
+      });
+    } catch (err) {
+      if (attempt < OAUTH_MAX_RETRIES) {
+        await sleep(Math.min(500 * 2 ** attempt, 2000));
+        continue;
+      }
+      return fail(undefined, err instanceof Error ? err.message : String(err));
+    }
+
+    if (!result.ok) {
+      const raw =
+        typeof result.text === "function"
+          ? await result
+              .text()
+              .then((value) => (typeof value === "string" ? value : ""))
+              .catch(() => "")
+          : "";
+
+      if (attempt < OAUTH_MAX_RETRIES && isRetryableTokenStatus(result.status)) {
+        await sleep(getRetryDelayMs(result, attempt));
+        continue;
+      }
+
+      return fail(result.status, raw, getCooldownHint(result, result.status));
+    }
+
+    break;
+  }
+
+  if (!result) {
+    return fail(undefined, "Token exchange request did not complete");
+  }
+
+  let json;
   try {
-    result = await fetch(OAUTH_TOKEN_URL, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "User-Agent": OAUTH_USER_AGENT,
-      },
-      body: JSON.stringify({
-        code: splits[0],
-        state: splits[1],
-        grant_type: "authorization_code",
-        client_id: CLIENT_ID,
-        redirect_uri: OAUTH_REDIRECT_URI,
-        code_verifier: verifier,
-      }),
-    });
-  } catch (err) {
-    return fail(undefined, err instanceof Error ? err.message : String(err));
+    json = await result.json();
+  } catch {
+    return fail(result.status, "Invalid JSON in token response");
   }
 
-  if (!result.ok) {
-    const raw =
-      typeof result.text === "function"
-        ? await result
-            .text()
-            .then((value) => (typeof value === "string" ? value : ""))
-            .catch(() => "")
-        : "";
-    return fail(result.status, raw);
+  // Validate required fields before returning success (QA fix C4)
+  if (!json.access_token || !json.refresh_token || typeof json.expires_in !== "number") {
+    return fail(result.status, "Missing required fields in token response");
   }
 
-  const json = await result.json();
   return {
     type: "success",
     refresh: json.refresh_token,
@@ -160,6 +309,7 @@ export async function revoke(refreshToken) {
     const resp = await fetch(OAUTH_REVOKE_URL, {
       method: "POST",
       headers: {
+        Accept: OAUTH_ACCEPT,
         "Content-Type": "application/json",
         "User-Agent": OAUTH_USER_AGENT,
       },
@@ -184,35 +334,67 @@ export async function revoke(refreshToken) {
  * @throws {Error} On HTTP errors or network failures
  */
 export async function refreshToken(refreshTokenValue, options = {}) {
-  const resp = await fetch(OAUTH_TOKEN_URL, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      "User-Agent": OAUTH_USER_AGENT,
-    },
-    body: JSON.stringify({
-      grant_type: "refresh_token",
-      client_id: CLIENT_ID,
-      refresh_token: refreshTokenValue,
-      scope: CLAUDE_AI_SCOPES.join(" "),
-    }),
-    ...(options.signal ? { signal: options.signal } : {}),
-  });
-
-  if (!resp.ok) {
-    const text = await resp.text().catch(() => "");
-    const error = new Error(`Token refresh failed (HTTP ${resp.status}): ${text}`);
-    error.status = resp.status;
+  // QA fix M13: default 30s timeout to prevent hanging on unresponsive server
+  const signal = options.signal ?? AbortSignal.timeout(30_000);
+  let lastError = null;
+
+  for (let attempt = 0; attempt <= OAUTH_MAX_RETRIES; attempt++) {
+    let resp;
     try {
-      const parsed = JSON.parse(text);
-      if (parsed.error) error.code = parsed.error;
-    } catch {
-      // Body may not be valid JSON
+      resp = await fetch(OAUTH_TOKEN_URL, {
+        method: "POST",
+        headers: {
+          Accept: OAUTH_ACCEPT,
+          "Content-Type": "application/json",
+          "User-Agent": OAUTH_USER_AGENT,
+        },
+        body: JSON.stringify({
+          grant_type: "refresh_token",
+          refresh_token: refreshTokenValue,
+          client_id: CLIENT_ID,
+          scope: options.scopes ? options.scopes.join(" ") : CLAUDE_AI_SCOPES.join(" "),
+        }),
+        signal,
+      });
+    } catch (err) {
+      lastError = err;
+      if (attempt < OAUTH_MAX_RETRIES) {
+        await sleep(Math.min(500 * 2 ** attempt, 2000));
+        continue;
+      }
+      throw err;
+    }
+
+    if (!resp.ok) {
+      const text = await resp.text().catch(() => "");
+      const retryAfterMs = getRetryDelayMs(resp, attempt);
+
+      if (attempt < OAUTH_MAX_RETRIES && isRetryableTokenStatus(resp.status)) {
+        await sleep(retryAfterMs);
+        continue;
+      }
+
+      const error = new Error(`Token refresh failed (HTTP ${resp.status}): ${text}`);
+      error.status = resp.status;
+      const cooldownHint = getCooldownHint(resp, resp.status);
+      error.retryAfterMs =
+        Number.isFinite(cooldownHint.retryAfterMs) && cooldownHint.retryAfterMs > 0
+          ? cooldownHint.retryAfterMs
+          : retryAfterMs;
+      if (cooldownHint.retryAfterSource) {
+        error.retryAfterSource = cooldownHint.retryAfterSource;
+      }
+
+      const parsed = parseOAuthErrorBody(text);
+      if (parsed.errorCode) error.code = parsed.errorCode;
+
+      throw error;
     }
-    throw error;
+
+    return resp.json();
   }
 
-  return resp.json();
+  throw lastError instanceof Error ? lastError : new Error("Token refresh failed after retries");
 }
 
 /**