opencode-anthropic-fix 0.0.26 → 0.0.28

package/lib/oauth.test.mjs

@@ -23,7 +23,7 @@ describe("oauth headers", () => {
     await exchange("code#state", "verifier");
 
     const [, init] = mockFetch.mock.calls[0];
-    expect(init.headers["User-Agent"]).toBe("claude-code/2.1.80");
+    expect(init.headers["User-Agent"]).toBe("axios/1.13.6");
   });
 
   it("sends Claude Code user-agent on token refresh", async () => {
@@ -35,7 +35,7 @@ describe("oauth headers", () => {
     await refreshToken("refresh-token");
 
     const [, init] = mockFetch.mock.calls[0];
-    expect(init.headers["User-Agent"]).toBe("claude-code/2.1.80");
+    expect(init.headers["User-Agent"]).toBe("axios/1.13.6");
   });
 
   it("sends Claude Code user-agent on token revoke", async () => {
@@ -44,6 +44,123 @@ describe("oauth headers", () => {
     await revoke("refresh-token");
 
     const [, init] = mockFetch.mock.calls[0];
-    expect(init.headers["User-Agent"]).toBe("claude-code/2.1.80");
+    expect(init.headers["User-Agent"]).toBe("axios/1.13.6");
+  });
+
+  it("parses Anthropic nested error payloads on exchange failure", async () => {
+    mockFetch.mockResolvedValueOnce({
+      ok: false,
+      status: 400,
+      headers: { get: () => null },
+      text: async () => JSON.stringify({ error: { type: "invalid_grant", message: "Bad auth code." } }),
+    });
+
+    const result = await exchange("code#state", "verifier");
+    expect(result.type).toBe("failed");
+    expect(result.status).toBe(400);
+    expect(result.code).toBe("invalid_grant");
+    expect(result.reason).toBe("Bad auth code.");
+  });
+
+  it("retries token exchange on 429 before succeeding", async () => {
+    mockFetch
+      .mockResolvedValueOnce({
+        ok: false,
+        status: 429,
+        headers: { get: (key) => (key === "retry-after-ms" ? "1" : null) },
+        text: async () => JSON.stringify({ error: { type: "rate_limit_error", message: "retry" } }),
+      })
+      .mockResolvedValueOnce({
+        ok: true,
+        json: async () => ({
+          access_token: "access",
+          refresh_token: "refresh",
+          expires_in: 3600,
+          account: { email_address: "retry@example.com" },
+        }),
+      });
+
+    const result = await exchange("code#state", "verifier");
+    expect(result.type).toBe("success");
+    expect(mockFetch).toHaveBeenCalledTimes(2);
+  });
+
+  it("retries token refresh on 429 before succeeding", async () => {
+    mockFetch
+      .mockResolvedValueOnce({
+        ok: false,
+        status: 429,
+        headers: { get: (key) => (key === "retry-after-ms" ? "1" : null) },
+        text: async () => JSON.stringify({ error: { type: "rate_limit_error", message: "retry" } }),
+      })
+      .mockResolvedValueOnce({
+        ok: true,
+        json: async () => ({ access_token: "a", refresh_token: "r", expires_in: 3600 }),
+      });
+
+    const result = await refreshToken("refresh-token");
+    expect(result.access_token).toBe("a");
+    expect(mockFetch).toHaveBeenCalledTimes(2);
+  });
+
+  it("uses nested error type as refresh error code", async () => {
+    mockFetch.mockResolvedValueOnce({
+      ok: false,
+      status: 400,
+      headers: { get: () => null },
+      text: async () => JSON.stringify({ error: { type: "invalid_grant", message: "Bad refresh token." } }),
+    });
+
+    await expect(refreshToken("refresh-token")).rejects.toMatchObject({
+      status: 400,
+      code: "invalid_grant",
+    });
+  });
+
+  it("returns cooldown hint on exchange 429 without Retry-After headers", async () => {
+    vi.useFakeTimers();
+    try {
+      mockFetch.mockResolvedValue({
+        ok: false,
+        status: 429,
+        headers: { get: () => null },
+        text: async () => JSON.stringify({ error: { type: "rate_limit_error", message: "Rate limited" } }),
+      });
+
+      const promise = exchange("code#state", "verifier");
+      await vi.runAllTimersAsync();
+      const result = await promise;
+
+      expect(result).toMatchObject({
+        type: "failed",
+        status: 429,
+        code: "rate_limit_error",
+        retryAfterMs: 30_000,
+      });
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it("throws 30s cooldown hint on refresh 429 without Retry-After headers", async () => {
+    vi.useFakeTimers();
+    try {
+      mockFetch.mockResolvedValue({
+        ok: false,
+        status: 429,
+        headers: { get: () => null },
+        text: async () => JSON.stringify({ error: { type: "rate_limit_error", message: "Rate limited" } }),
+      });
+
+      const assertion = expect(refreshToken("refresh-token")).rejects.toMatchObject({
+        status: 429,
+        code: "rate_limit_error",
+        retryAfterMs: 30_000,
+      });
+      await vi.runAllTimersAsync();
+      await assertion;
+    } finally {
+      vi.useRealTimers();
+    }
   });
 });

package/lib/rotation.mjs

@@ -216,7 +216,8 @@ const SWITCH_THRESHOLD = 100;
 function calculateHybridScore(account, maxTokens) {
   const healthComponent = account.healthScore * 2;
   const tokenComponent = (account.tokens / maxTokens) * 100 * 5;
-  const secondsSinceUsed = (Date.now() - account.lastUsed) / 1000;
+  // QA fix M17: lastUsed=0 means never-used; treat as 0 freshness bonus instead of max
+  const secondsSinceUsed = account.lastUsed > 0 ? (Date.now() - account.lastUsed) / 1000 : 0;
   const freshnessComponent = Math.min(secondsSinceUsed, 3600) * 0.1;
 
   return Math.max(0, healthComponent + tokenComponent + freshnessComponent);

package/lib/rotation.test.mjs

@@ -135,7 +135,7 @@ describe("TokenBucketTracker", () => {
     tracker.consume(0);
     tracker.consume(0);
     tracker.refund(0);
-    expect(tracker.getTokens(0)).toBe(49);
+    expect(tracker.getTokens(0)).toBeCloseTo(49, 0);
   });
 
   it("refund does not exceed max", () => {
@@ -290,9 +290,9 @@ describe("selectAccount", () => {
     it("selects the account with highest composite score", () => {
       const candidates = [
         makeCandidate({ index: 0, lastUsed: Date.now() }),
-        makeCandidate({ index: 1, lastUsed: 0 }), // Older = more fresh
+        makeCandidate({ index: 1, lastUsed: Date.now() - 120_000 }), // 2 min ago = more fresh
       ];
-      // Account 1 should have higher freshness score
+      // Account 1 should have higher freshness score (120s * 0.1 = 12pt bonus)
       const result = selectAccount(candidates, "hybrid", null, healthTracker, tokenTracker, 0);
       // Both have same health and tokens, but account 1 has more freshness
       expect(result?.index).toBe(1);

package/lib/storage.mjs

@@ -1,7 +1,7 @@
 import { promises as fs } from "node:fs";
 import { existsSync, readFileSync, appendFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { randomBytes } from "node:crypto";
+import { randomBytes, createHash } from "node:crypto";
 import { getConfigDir } from "./config.mjs";
 
 /**
@@ -153,7 +153,11 @@ function validateAccount(raw, now) {
 
   const addedAt = typeof acc.addedAt === "number" && Number.isFinite(acc.addedAt) ? acc.addedAt : now;
 
-  const id = typeof acc.id === "string" && acc.id ? acc.id : `${addedAt}:${acc.refreshToken.slice(0, 12)}`;
+  // QA fix M12: hash token fragment instead of leaking raw prefix
+  const id =
+    typeof acc.id === "string" && acc.id
+      ? acc.id
+      : `${addedAt}:${createHash("sha256").update(acc.refreshToken).digest("hex").slice(0, 12)}`;
 
   return {
     id,
@@ -198,8 +202,21 @@ export async function loadAccounts() {
     }
 
     if (data.version !== CURRENT_VERSION) {
-      // Future: handle migrations here
-      return null;
+      // QA fix H12: warn about version mismatch but attempt best-effort load
+      // rather than silently discarding all accounts
+      if (typeof data.version === "number" && data.version > CURRENT_VERSION) {
+        // Forward-compat: newer versions likely only add fields
+
+        console.warn(
+          `[anthropic-auth] accounts file version ${data.version} is newer than expected ${CURRENT_VERSION}; loading with best effort`,
+        );
+      } else {
+        // Unknown/older version — still try to load
+
+        console.warn(
+          `[anthropic-auth] accounts file version mismatch (${data.version} vs ${CURRENT_VERSION}); attempting load`,
+        );
+      }
     }
 
     const now = Date.now();
@@ -225,7 +242,12 @@ export async function loadAccounts() {
   } catch (error) {
     const code = /** @type {NodeJS.ErrnoException} */ (error).code;
     if (code === "ENOENT") return null;
-    return null;
+    // QA fix H11: only swallow ENOENT and JSON parse errors; throw for real I/O failures
+    if (error instanceof SyntaxError) {
+      // Corrupted JSON file — treat as empty
+      return null;
+    }
+    throw error;
   }
 }
 
@@ -244,11 +266,13 @@ export async function saveAccounts(storage) {
   /** @type {AccountStorage} */
   let storageToWrite = storage;
 
+  // QA fix M15: Accept pre-loaded disk data to avoid double-read (TOCTOU mitigation).
+  // Callers can pass diskData from their own loadAccounts() call.
   // Merge auth fields against disk by freshness to avoid stale-process clobber.
   // We do not resurrect removed accounts; only merge for accounts present in
   // the incoming storage payload.
   try {
-    const disk = await loadAccounts();
+    const disk = arguments[1] ?? (await loadAccounts());
     if (disk && storage.accounts.length > 0) {
       const diskById = new Map(disk.accounts.map((a) => [a.id, a]));
       /** @type {Map<number, AccountMetadata[]>} */
@@ -313,6 +337,10 @@ export async function saveAccounts(storage) {
   const content = JSON.stringify(storageToWrite, null, 2);
 
   try {
+    // QA note H9: mode 0o600 (owner-only read/write) is enforced on Linux/macOS.
+    // On Windows, POSIX mode is silently ignored by Node.js — ACLs govern permissions.
+    // Windows file inherits parent directory ACLs, which typically restrict access
+    // to the current user on per-user directories (%APPDATA%).
     await fs.writeFile(tempPath, content, { encoding: "utf-8", mode: 0o600 });
     await fs.rename(tempPath, storagePath);
   } catch (error) {

package/lib/storage.test.mjs

@@ -27,11 +27,15 @@ vi.mock("node:fs", () => ({
   },
 }));
 
-vi.mock("node:crypto", () => ({
-  randomBytes: vi.fn(() => ({
-    toString: () => "abcdef123456",
-  })),
-}));
+vi.mock("node:crypto", async (importOriginal) => {
+  const actual = await importOriginal();
+  return {
+    randomBytes: vi.fn(() => ({
+      toString: () => "abcdef123456",
+    })),
+    createHash: actual.createHash,
+  };
+});
 
 // ---------------------------------------------------------------------------
 // deduplicateByRefreshToken
@@ -206,10 +210,13 @@ describe("loadAccounts", () => {
     expect(result).toBeNull();
   });
 
-  it("returns null for wrong version", async () => {
+  it("returns best-effort data for newer version (forward compat)", async () => {
     fs.readFile.mockResolvedValue(JSON.stringify({ version: 99, accounts: [] }));
     const result = await loadAccounts();
-    expect(result).toBeNull();
+    // H12 fix: no longer returns null; attempts best-effort load with a warning
+    expect(result).not.toBeNull();
+    expect(result.accounts).toEqual([]);
+    expect(result.version).toBe(1); // normalized to current version
   });
 
   it("returns null when accounts is not an array", async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-anthropic-fix",
-  "version": "0.0.26",
+  "version": "0.0.28",
   "license": "GPL-3.0-or-later",
   "main": "./index.mjs",
   "files": [
@@ -33,7 +33,7 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@opencode-ai/plugin": "^0.4.45",
+    "@opencode-ai/plugin": "^1.2.27",
     "esbuild": "^0.27.3",
     "eslint": "^10.0.0",
     "husky": "^9.1.7",