opencode-anthropic-fix 0.0.29 → 0.0.31

package/index.mjs

@@ -1527,6 +1527,8 @@ export async function AnthropicAuthPlugin({ client, project, directory, worktree
   async function refreshIdleAccount(account) {
     if (!accountManager) return;
     if (idleRefreshInFlight.has(account.id)) return;
+    // CC-sourced accounts don't use OAuth idle refresh
+    if (account.source === "cc-keychain" || account.source === "cc-file") return;
 
     idleRefreshInFlight.add(account.id);
     const attemptedRefreshToken = account.refreshToken;
@@ -2145,9 +2147,29 @@ export async function AnthropicAuthPlugin({ client, project, directory, worktree
                     try {
                       const parsedBody = JSON.parse(body);
                       if (Array.isArray(parsedBody.messages) && parsedBody.messages.length > 4) {
-                        // Keep first 2 messages (initial context) and last 2 messages (recent work)
+                        // Keep first 2 messages (initial context) and last N messages (recent work).
+                        // Ensure the trimmed array never ends with an assistant message (prefill),
+                        // which would cause "does not support assistant message prefill" errors.
+                        let tailCount = 2;
+                        const msgs = parsedBody.messages;
+                        // Expand tail if it would end with an assistant message
+                        while (
+                          tailCount < msgs.length - 2 &&
+                          msgs[msgs.length - tailCount]?.role !== "user" &&
+                          msgs.length - tailCount > 0
+                        ) {
+                          tailCount++;
+                        }
+                        const tail = msgs.slice(-tailCount);
+                        // If tail still starts/ends badly, force a user wrapper
+                        if (tail.length > 0 && tail[tail.length - 1]?.role === "assistant") {
+                          tail.push({
+                            role: "user",
+                            content: [{ type: "text", text: "Continue." }],
+                          });
+                        }
                         const trimmed = [
-                          ...parsedBody.messages.slice(0, 2),
+                          ...msgs.slice(0, 2),
                           {
                             role: "user",
                             content: [
@@ -2157,7 +2179,7 @@ export async function AnthropicAuthPlugin({ client, project, directory, worktree
                               },
                             ],
                           },
-                          ...parsedBody.messages.slice(-2),
+                          ...tail,
                         ];
                         parsedBody.messages = trimmed;
                         requestInit.body = JSON.stringify(parsedBody);
@@ -4091,6 +4113,19 @@ function transformRequestBody(body, signature, runtime, betaHeader) {
     if (fastModeEnabled && parsed.model && (isOpus46Model(parsed.model) || isSonnet46Model(parsed.model))) {
       parsed.speed = "fast";
     }
+
+    // Guard: ensure messages array never ends with an assistant message.
+    // The API rejects this as "assistant message prefill" when extended thinking is active.
+    if (Array.isArray(parsed.messages) && parsed.messages.length > 0) {
+      const lastMsg = parsed.messages[parsed.messages.length - 1];
+      if (lastMsg && lastMsg.role === "assistant") {
+        parsed.messages.push({
+          role: "user",
+          content: [{ type: "text", text: "Continue." }],
+        });
+      }
+    }
+
     return JSON.stringify(parsed);
   } catch {
     // ignore parse errors
@@ -4535,6 +4570,31 @@ function applyDiskAuthIfFresher(account, diskAuth, options = {}) {
  * @throws {Error} If refresh fails
  */
 async function refreshAccountToken(account, client, source = "foreground", { onTokensUpdated } = {}) {
+  // CC-sourced accounts must NEVER enter the OAuth HTTP refresh flow.
+  // Instead, re-read credentials from the CC source.  If they're still
+  // expired, let the caller handle it (the account will be skipped).
+  if (account.source === "cc-keychain" || account.source === "cc-file") {
+    const { readCCCredentials } = await import("./lib/cc-credentials.mjs");
+    const ccCreds = readCCCredentials();
+    const match = ccCreds.find((c) => c.refreshToken === account.refreshToken);
+    if (match && match.expiresAt > Date.now()) {
+      account.access = match.accessToken;
+      account.expires = match.expiresAt;
+      markTokenStateUpdated(account);
+      if (onTokensUpdated) {
+        try {
+          await onTokensUpdated();
+        } catch {
+          // best-effort
+        }
+      }
+      return account.access;
+    }
+    // Could not refresh from CC source – token may be stale.
+    // Throw so the caller falls through to the next account.
+    throw new Error(`CC credential expired (source: ${account.source})`);
+  }
+
   const lockResult = await acquireRefreshLock(account.id, {
     timeoutMs: 2_000,
     backoffMs: 60,

package/lib/accounts.mjs

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { loadAccounts, saveAccounts, createDefaultStats } from "./storage.mjs";
 import { HealthScoreTracker, TokenBucketTracker, selectAccount } from "./rotation.mjs";
 import { calculateBackoffMs } from "./backoff.mjs";
+import { readCCCredentials } from "./cc-credentials.mjs";
 
 /** QA fix M12: hash token fragment instead of leaking raw prefix */
 function hashTokenFragment(token) {
@@ -20,6 +21,10 @@ function hashTokenFragment(token) {
  * @typedef {import('./storage.mjs').AccountStats} AccountStats
  */
 
+/**
+ * @typedef {'oauth' | 'cc-keychain' | 'cc-file'} AccountSource
+ */
+
 /**
  * @typedef {object} ManagedAccount
  * @property {string} id
@@ -37,6 +42,7 @@ function hashTokenFragment(token) {
  * @property {number | null} lastFailureTime
  * @property {string} [lastSwitchReason]
  * @property {AccountStats} stats
+ * @property {AccountSource} [source] - Origin of the account. CC accounts must not enter OAuth HTTP refresh.
  */
 
 const MAX_ACCOUNTS = 10;
@@ -113,6 +119,7 @@ export class AccountManager {
         lastFailureTime: acc.lastFailureTime,
         lastSwitchReason: acc.lastSwitchReason,
         stats: acc.stats ?? createDefaultStats(acc.addedAt),
+        source: acc.source || "oauth",
       }));
 
       manager.#currentIndex =
@@ -136,6 +143,9 @@ export class AccountManager {
         }
       }
 
+      // Merge CC credentials if enabled
+      manager.#mergeCC(config);
+
       return manager;
     }
 
@@ -159,14 +169,95 @@ export class AccountManager {
           lastFailureTime: null,
           lastSwitchReason: "initial",
           stats: createDefaultStats(now),
+          source: "oauth",
         },
       ];
       manager.#currentIndex = 0;
     }
 
+    // Merge CC credentials if enabled
+    manager.#mergeCC(config);
+
     return manager;
   }
 
+  /**
+   * Merge Claude Code credentials into the account pool.
+   * CC accounts are matched by refreshToken to avoid duplicates.
+   *
+   * @param {AnthropicAuthConfig} config
+   */
+  #mergeCC(config) {
+    if (!config.cc_credential_reuse?.enabled || !config.cc_credential_reuse?.auto_detect) return;
+
+    /** @type {import('./cc-credentials.mjs').CCCredential[]} */
+    let ccCreds;
+    try {
+      ccCreds = readCCCredentials();
+    } catch {
+      return; // best-effort
+    }
+
+    if (!ccCreds.length) return;
+
+    for (const cc of ccCreds) {
+      // Skip if refresh token already known
+      const existing = this.#accounts.find((a) => a.refreshToken === cc.refreshToken);
+      if (existing) {
+        // Update access token if CC's is fresher
+        if (cc.expiresAt > (existing.expires || 0)) {
+          existing.access = cc.accessToken;
+          existing.expires = cc.expiresAt;
+          existing.tokenUpdatedAt = Date.now();
+        }
+        // Ensure source is marked
+        if (!existing.source || existing.source === "oauth") {
+          existing.source = cc.source;
+        }
+        continue;
+      }
+
+      if (this.#accounts.length >= MAX_ACCOUNTS) break;
+
+      const now = Date.now();
+      /** @type {ManagedAccount} */
+      const account = {
+        id: `cc:${now}:${hashTokenFragment(cc.refreshToken)}`,
+        index: this.#accounts.length,
+        email: undefined,
+        refreshToken: cc.refreshToken,
+        access: cc.accessToken,
+        expires: cc.expiresAt,
+        tokenUpdatedAt: now,
+        addedAt: now,
+        lastUsed: 0,
+        enabled: true,
+        rateLimitResetTimes: {},
+        consecutiveFailures: 0,
+        lastFailureTime: null,
+        lastSwitchReason: "cc-auto-detect",
+        stats: createDefaultStats(now),
+        source: cc.source,
+      };
+
+      if (config.cc_credential_reuse.prefer_over_oauth) {
+        this.#accounts.unshift(account);
+        // Re-index after unshift
+        this.#accounts.forEach((a, i) => {
+          a.index = i;
+        });
+        if (this.#currentIndex >= 0) this.#currentIndex++;
+      } else {
+        this.#accounts.push(account);
+      }
+
+      // If this is the first account, make it active
+      if (this.#accounts.length === 1) {
+        this.#currentIndex = 0;
+      }
+    }
+  }
+
   /**
    * Get the number of enabled accounts.
    * @returns {number}
@@ -642,6 +733,7 @@ export class AccountManager {
           lastFailureTime: acc.lastFailureTime,
           lastSwitchReason: acc.lastSwitchReason,
           stats: mergedStats,
+          source: acc.source,
         };
       }),
       activeIndex: Math.max(0, this.#currentIndex),

package/lib/cc-credentials.mjs

@@ -0,0 +1,253 @@
+/**
+ * CC (Claude Code) credential reader.
+ *
+ * Reads OAuth tokens that Claude Code has already obtained and stored,
+ * allowing opencode-anthropic-fix to piggy-back on those tokens instead
+ * of maintaining its own OAuth flow.
+ *
+ * Two sources are supported:
+ *   1. macOS Keychain – `security find-generic-password` for services
+ *      matching "Claude Code-credentials*"
+ *   2. File-based – `~/.claude/.credentials.json`
+ *
+ * CC accounts MUST NEVER enter the normal OAuth HTTP token-refresh path
+ * because the client_id would mismatch and corrupt CC's stored tokens.
+ *
+ * @module cc-credentials
+ */
+
+import { execSync } from "node:child_process";
+import { readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+
+/**
+ * @typedef {'cc-keychain' | 'cc-file'} CCCredentialSource
+ */
+
+/**
+ * @typedef {object} CCCredential
+ * @property {string} accessToken
+ * @property {string} refreshToken
+ * @property {number} expiresAt - ms-epoch
+ * @property {string} [subscriptionType] - e.g. "claude_pro"
+ * @property {CCCredentialSource} source
+ * @property {string} label - human-readable label for logging/toasts
+ */
+
+// ---------------------------------------------------------------------------
+// Keychain reader (macOS only)
+// ---------------------------------------------------------------------------
+
+/**
+ * List all keychain services matching the CC credential pattern.
+ * Returns an array of service names (e.g. "Claude Code-credentials-0").
+ *
+ * @returns {string[]}
+ */
+function listKeychainServices() {
+  if (process.platform !== "darwin") return [];
+
+  try {
+    const dump = execSync("security dump-keychain", {
+      timeout: 5_000,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+
+    /** @type {string[]} */
+    const services = [];
+    const regex = /"svce"<blob>="(Claude Code-credentials[^"]*)"/g;
+    let match;
+    while ((match = regex.exec(dump)) !== null) {
+      const svc = match[1];
+      if (!services.includes(svc)) services.push(svc);
+    }
+    return services;
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Read a single CC credential from macOS Keychain by service name.
+ *
+ * @param {string} service
+ * @returns {CCCredential | null}
+ */
+function readKeychainService(service) {
+  try {
+    const raw = execSync(`security find-generic-password -s "${service}" -w`, {
+      timeout: 5_000,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+
+    return parseCCCredentialData(raw, "cc-keychain", `keychain:${service}`);
+  } catch (err) {
+    // Exit code 36 = user denied, 44 = not found, 128 = killed
+    return null;
+  }
+}
+
+/**
+ * Read all CC credentials stored in the macOS Keychain.
+ *
+ * @returns {CCCredential[]}
+ */
+export function readCCCredentialsFromKeychain() {
+  const services = listKeychainServices();
+  /** @type {CCCredential[]} */
+  const credentials = [];
+
+  for (const svc of services) {
+    const cred = readKeychainService(svc);
+    if (cred) credentials.push(cred);
+  }
+
+  return credentials;
+}
+
+// ---------------------------------------------------------------------------
+// File reader (~/.claude/.credentials.json)
+// ---------------------------------------------------------------------------
+
+/**
+ * Read CC credentials from the file-based store.
+ *
+ * The file can have two shapes:
+ *   - Wrapped: `{ claudeAiOauth: { accessToken, refreshToken, expiresAt, ... } }`
+ *   - Flat:    `{ accessToken, refreshToken, expiresAt, ... }`
+ *
+ * Additionally it may be an array of such objects.
+ *
+ * Entries with `scope: "mcp"` or missing accessToken/refreshToken are filtered.
+ *
+ * @returns {CCCredential[]}
+ */
+export function readCCCredentialsFromFile() {
+  const credPath = join(homedir(), ".claude", ".credentials.json");
+
+  if (!existsSync(credPath)) return [];
+
+  try {
+    const raw = readFileSync(credPath, "utf-8");
+    const parsed = JSON.parse(raw);
+
+    /** @type {CCCredential[]} */
+    const results = [];
+
+    const entries = Array.isArray(parsed) ? parsed : [parsed];
+
+    for (let i = 0; i < entries.length; i++) {
+      const entry = entries[i];
+      if (!entry || typeof entry !== "object") continue;
+
+      // Unwrap "claudeAiOauth" wrapper if present
+      const data = entry.claudeAiOauth && typeof entry.claudeAiOauth === "object" ? entry.claudeAiOauth : entry;
+
+      // Skip MCP-only entries
+      if (data.scope === "mcp") continue;
+
+      const cred = shapeToCCCredential(data, "cc-file", `file:entry-${i}`);
+      if (cred) results.push(cred);
+    }
+
+    return results;
+  } catch {
+    return [];
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Unified reader
+// ---------------------------------------------------------------------------
+
+/**
+ * Read all discoverable CC credentials from all sources.
+ *
+ * @returns {CCCredential[]}
+ */
+export function readCCCredentials() {
+  /** @type {CCCredential[]} */
+  const all = [];
+
+  // Keychain (macOS only)
+  all.push(...readCCCredentialsFromKeychain());
+
+  // File-based (cross-platform)
+  all.push(...readCCCredentialsFromFile());
+
+  // De-duplicate by refreshToken (prefer keychain over file)
+  /** @type {Map<string, CCCredential>} */
+  const seen = new Map();
+  for (const cred of all) {
+    const existing = seen.get(cred.refreshToken);
+    if (!existing || (cred.source === "cc-keychain" && existing.source === "cc-file")) {
+      seen.set(cred.refreshToken, cred);
+    }
+  }
+
+  return [...seen.values()];
+}
+
+// ---------------------------------------------------------------------------
+// Parsing helpers
+// ---------------------------------------------------------------------------
+
+/**
+ * Parse a raw JSON string into a CCCredential.
+ *
+ * @param {string} jsonStr
+ * @param {CCCredentialSource} source
+ * @param {string} label
+ * @returns {CCCredential | null}
+ */
+export function parseCCCredentialData(jsonStr, source, label) {
+  try {
+    const data = JSON.parse(jsonStr);
+    if (!data || typeof data !== "object") return null;
+
+    // Handle wrapped format
+    const inner = data.claudeAiOauth && typeof data.claudeAiOauth === "object" ? data.claudeAiOauth : data;
+
+    return shapeToCCCredential(inner, source, label);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Validate and shape an object into a CCCredential.
+ *
+ * @param {Record<string, unknown>} data
+ * @param {CCCredentialSource} source
+ * @param {string} label
+ * @returns {CCCredential | null}
+ */
+function shapeToCCCredential(data, source, label) {
+  const accessToken = typeof data.accessToken === "string" ? data.accessToken : null;
+  const refreshToken = typeof data.refreshToken === "string" ? data.refreshToken : null;
+
+  if (!accessToken || !refreshToken) return null;
+
+  // expiresAt can be number (ms-epoch) or ISO string
+  let expiresAt = 0;
+  if (typeof data.expiresAt === "number") {
+    expiresAt = data.expiresAt;
+  } else if (typeof data.expiresAt === "string") {
+    const parsed = Date.parse(data.expiresAt);
+    if (!Number.isNaN(parsed)) expiresAt = parsed;
+  } else if (typeof data.expires_at === "number") {
+    expiresAt = data.expires_at;
+  }
+
+  return {
+    accessToken,
+    refreshToken,
+    expiresAt,
+    subscriptionType: typeof data.subscriptionType === "string" ? data.subscriptionType : undefined,
+    source,
+    label,
+  };
+}

package/lib/cc-credentials.test.mjs

@@ -0,0 +1,377 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import {
+  readCCCredentialsFromKeychain,
+  readCCCredentialsFromFile,
+  readCCCredentials,
+  parseCCCredentialData,
+} from "./cc-credentials.mjs";
+
+// ---------------------------------------------------------------------------
+// Mocks
+// ---------------------------------------------------------------------------
+
+vi.mock("node:child_process", () => ({
+  execSync: vi.fn(),
+}));
+
+vi.mock("node:fs", () => ({
+  readFileSync: vi.fn(),
+  existsSync: vi.fn(),
+}));
+
+vi.mock("node:os", () => ({
+  homedir: vi.fn(() => "/home/testuser"),
+}));
+
+import { execSync } from "node:child_process";
+import { readFileSync, existsSync } from "node:fs";
+import { homedir } from "node:os";
+
+// ---------------------------------------------------------------------------
+// Fixtures
+// ---------------------------------------------------------------------------
+
+const VALID_CRED = {
+  accessToken: "acc-123",
+  refreshToken: "ref-456",
+  expiresAt: Date.now() + 3_600_000,
+  subscriptionType: "claude_pro",
+};
+
+const VALID_CRED_2 = {
+  accessToken: "acc-789",
+  refreshToken: "ref-012",
+  expiresAt: Date.now() + 7_200_000,
+};
+
+const MCP_ONLY_CRED = {
+  accessToken: "mcp-acc",
+  refreshToken: "mcp-ref",
+  expiresAt: Date.now() + 3_600_000,
+  scope: "mcp",
+};
+
+const KEYCHAIN_DUMP_SINGLE = `
+keychain: "/Users/test/Library/Keychains/login.keychain-db"
+    0x00000007 <blob>="Claude Code-credentials"
+    "svce"<blob>="Claude Code-credentials"
+`;
+
+const KEYCHAIN_DUMP_MULTI = `
+keychain: "/Users/test/Library/Keychains/login.keychain-db"
+    "svce"<blob>="Claude Code-credentials-0"
+    "svce"<blob>="Claude Code-credentials-1"
+    "svce"<blob>="Claude Code-credentials-0"
+`;
+
+// ---------------------------------------------------------------------------
+// parseCCCredentialData
+// ---------------------------------------------------------------------------
+
+describe("parseCCCredentialData", () => {
+  it("parses valid flat JSON", () => {
+    const result = parseCCCredentialData(JSON.stringify(VALID_CRED), "cc-file", "test");
+    expect(result).not.toBeNull();
+    expect(result.accessToken).toBe("acc-123");
+    expect(result.refreshToken).toBe("ref-456");
+    expect(result.subscriptionType).toBe("claude_pro");
+    expect(result.source).toBe("cc-file");
+    expect(result.label).toBe("test");
+  });
+
+  it("parses wrapped claudeAiOauth format", () => {
+    const wrapped = { claudeAiOauth: VALID_CRED };
+    const result = parseCCCredentialData(JSON.stringify(wrapped), "cc-keychain", "kc");
+    expect(result).not.toBeNull();
+    expect(result.accessToken).toBe("acc-123");
+    expect(result.source).toBe("cc-keychain");
+  });
+
+  it("returns null for invalid JSON", () => {
+    expect(parseCCCredentialData("not json", "cc-file", "x")).toBeNull();
+  });
+
+  it("returns null for missing accessToken", () => {
+    const data = { refreshToken: "ref" };
+    expect(parseCCCredentialData(JSON.stringify(data), "cc-file", "x")).toBeNull();
+  });
+
+  it("returns null for missing refreshToken", () => {
+    const data = { accessToken: "acc" };
+    expect(parseCCCredentialData(JSON.stringify(data), "cc-file", "x")).toBeNull();
+  });
+
+  it("returns null for non-object JSON", () => {
+    expect(parseCCCredentialData('"hello"', "cc-file", "x")).toBeNull();
+    expect(parseCCCredentialData("42", "cc-file", "x")).toBeNull();
+    expect(parseCCCredentialData("null", "cc-file", "x")).toBeNull();
+  });
+
+  it("handles expiresAt as ISO string", () => {
+    const data = { ...VALID_CRED, expiresAt: "2026-06-15T12:00:00Z" };
+    const result = parseCCCredentialData(JSON.stringify(data), "cc-file", "x");
+    expect(result).not.toBeNull();
+    expect(result.expiresAt).toBe(Date.parse("2026-06-15T12:00:00Z"));
+  });
+
+  it("handles expires_at fallback field", () => {
+    const data = { accessToken: "a", refreshToken: "r", expires_at: 999999 };
+    const result = parseCCCredentialData(JSON.stringify(data), "cc-file", "x");
+    expect(result).not.toBeNull();
+    expect(result.expiresAt).toBe(999999);
+  });
+
+  it("defaults expiresAt to 0 when missing", () => {
+    const data = { accessToken: "a", refreshToken: "r" };
+    const result = parseCCCredentialData(JSON.stringify(data), "cc-file", "x");
+    expect(result.expiresAt).toBe(0);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// readCCCredentialsFromKeychain
+// ---------------------------------------------------------------------------
+
+describe("readCCCredentialsFromKeychain", () => {
+  const origPlatform = process.platform;
+
+  afterEach(() => {
+    Object.defineProperty(process, "platform", { value: origPlatform });
+    vi.resetAllMocks();
+  });
+
+  it("returns empty on non-darwin platforms", () => {
+    Object.defineProperty(process, "platform", { value: "linux" });
+    expect(readCCCredentialsFromKeychain()).toEqual([]);
+    expect(execSync).not.toHaveBeenCalled();
+  });
+
+  it("reads single keychain service on macOS", () => {
+    Object.defineProperty(process, "platform", { value: "darwin" });
+
+    execSync.mockImplementation((cmd) => {
+      if (cmd === "security dump-keychain") return KEYCHAIN_DUMP_SINGLE;
+      if (cmd.includes("find-generic-password")) return JSON.stringify(VALID_CRED);
+      throw new Error("unexpected cmd");
+    });
+
+    const result = readCCCredentialsFromKeychain();
+    expect(result).toHaveLength(1);
+    expect(result[0].accessToken).toBe("acc-123");
+    expect(result[0].source).toBe("cc-keychain");
+    expect(result[0].label).toContain("keychain:");
+  });
+
+  it("reads multiple keychain services and deduplicates service names", () => {
+    Object.defineProperty(process, "platform", { value: "darwin" });
+
+    let callIdx = 0;
+    execSync.mockImplementation((cmd) => {
+      if (cmd === "security dump-keychain") return KEYCHAIN_DUMP_MULTI;
+      if (cmd.includes("find-generic-password")) {
+        callIdx++;
+        const cred = callIdx === 1 ? VALID_CRED : VALID_CRED_2;
+        return JSON.stringify(cred);
+      }
+      throw new Error("unexpected cmd");
+    });
+
+    const result = readCCCredentialsFromKeychain();
+    // KEYCHAIN_DUMP_MULTI has credentials-0 twice, but should be deduped to 2 services
+    expect(result).toHaveLength(2);
+    expect(result[0].accessToken).toBe("acc-123");
+    expect(result[1].accessToken).toBe("acc-789");
+  });
+
+  it("returns empty when dump-keychain throws", () => {
+    Object.defineProperty(process, "platform", { value: "darwin" });
+    execSync.mockImplementation(() => {
+      throw new Error("no keychain");
+    });
+
+    expect(readCCCredentialsFromKeychain()).toEqual([]);
+  });
+
+  it("skips services where find-generic-password fails (exit 44)", () => {
+    Object.defineProperty(process, "platform", { value: "darwin" });
+
+    execSync.mockImplementation((cmd) => {
+      if (cmd === "security dump-keychain") return KEYCHAIN_DUMP_SINGLE;
+      if (cmd.includes("find-generic-password")) {
+        const err = new Error("not found");
+        err.status = 44;
+        throw err;
+      }
+      throw new Error("unexpected");
+    });
+
+    expect(readCCCredentialsFromKeychain()).toEqual([]);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// readCCCredentialsFromFile
+// ---------------------------------------------------------------------------
+
+describe("readCCCredentialsFromFile", () => {
+  beforeEach(() => {
+    vi.resetAllMocks();
+    homedir.mockReturnValue("/home/testuser");
+  });
+
+  it("returns empty when credentials file does not exist", () => {
+    existsSync.mockReturnValue(false);
+    expect(readCCCredentialsFromFile()).toEqual([]);
+  });
+
+  it("reads flat credential object", () => {
+    existsSync.mockReturnValue(true);
+    readFileSync.mockReturnValue(JSON.stringify(VALID_CRED));
+
+    const result = readCCCredentialsFromFile();
+    expect(result).toHaveLength(1);
+    expect(result[0].accessToken).toBe("acc-123");
+    expect(result[0].source).toBe("cc-file");
+    expect(result[0].label).toBe("file:entry-0");
+  });
+
+  it("reads wrapped claudeAiOauth format", () => {
+    existsSync.mockReturnValue(true);
+    readFileSync.mockReturnValue(JSON.stringify({ claudeAiOauth: VALID_CRED }));
+
+    const result = readCCCredentialsFromFile();
+    expect(result).toHaveLength(1);
+    expect(result[0].accessToken).toBe("acc-123");
+  });
+
+  it("reads array of credentials", () => {
+    existsSync.mockReturnValue(true);
+    readFileSync.mockReturnValue(JSON.stringify([VALID_CRED, VALID_CRED_2]));
+
+    const result = readCCCredentialsFromFile();
+    expect(result).toHaveLength(2);
+    expect(result[0].accessToken).toBe("acc-123");
+    expect(result[1].accessToken).toBe("acc-789");
+  });
+
+  it("filters MCP-only entries", () => {
+    existsSync.mockReturnValue(true);
+    readFileSync.mockReturnValue(JSON.stringify([VALID_CRED, MCP_ONLY_CRED]));
+
+    const result = readCCCredentialsFromFile();
+    expect(result).toHaveLength(1);
+    expect(result[0].accessToken).toBe("acc-123");
+  });
+
+  it("skips non-object entries in array", () => {
+    existsSync.mockReturnValue(true);
+    readFileSync.mockReturnValue(JSON.stringify([null, 42, "hello", VALID_CRED]));
+
+    const result = readCCCredentialsFromFile();
+    expect(result).toHaveLength(1);
+    expect(result[0].accessToken).toBe("acc-123");
+  });
+
+  it("returns empty on invalid JSON", () => {
+    existsSync.mockReturnValue(true);
+    readFileSync.mockReturnValue("not json at all");
+
+    expect(readCCCredentialsFromFile()).toEqual([]);
+  });
+
+  it("returns empty on read error", () => {
+    existsSync.mockReturnValue(true);
+    readFileSync.mockImplementation(() => {
+      throw new Error("EACCES");
+    });
+
+    expect(readCCCredentialsFromFile()).toEqual([]);
+  });
+
+  it("handles entries missing required fields gracefully", () => {
+    existsSync.mockReturnValue(true);
+    readFileSync.mockReturnValue(JSON.stringify([{ accessToken: "only-access" }, VALID_CRED]));
+
+    const result = readCCCredentialsFromFile();
+    expect(result).toHaveLength(1);
+    expect(result[0].accessToken).toBe("acc-123");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// readCCCredentials (unified)
+// ---------------------------------------------------------------------------
+
+describe("readCCCredentials", () => {
+  const origPlatform = process.platform;
+
+  beforeEach(() => {
+    vi.resetAllMocks();
+    homedir.mockReturnValue("/home/testuser");
+  });
+
+  afterEach(() => {
+    Object.defineProperty(process, "platform", { value: origPlatform });
+  });
+
+  it("combines keychain and file sources on macOS", () => {
+    Object.defineProperty(process, "platform", { value: "darwin" });
+
+    // Keychain returns one credential
+    execSync.mockImplementation((cmd) => {
+      if (cmd === "security dump-keychain") return KEYCHAIN_DUMP_SINGLE;
+      if (cmd.includes("find-generic-password")) return JSON.stringify(VALID_CRED);
+      throw new Error("unexpected");
+    });
+
+    // File returns a different credential
+    existsSync.mockReturnValue(true);
+    readFileSync.mockReturnValue(JSON.stringify(VALID_CRED_2));
+
+    const result = readCCCredentials();
+    expect(result).toHaveLength(2);
+    expect(result.some((c) => c.source === "cc-keychain")).toBe(true);
+    expect(result.some((c) => c.source === "cc-file")).toBe(true);
+  });
+
+  it("deduplicates by refreshToken, preferring keychain", () => {
+    Object.defineProperty(process, "platform", { value: "darwin" });
+
+    // Both sources return same refreshToken
+    const keychainCred = { ...VALID_CRED, accessToken: "keychain-token" };
+    const fileCred = { ...VALID_CRED, accessToken: "file-token" };
+
+    execSync.mockImplementation((cmd) => {
+      if (cmd === "security dump-keychain") return KEYCHAIN_DUMP_SINGLE;
+      if (cmd.includes("find-generic-password")) return JSON.stringify(keychainCred);
+      throw new Error("unexpected");
+    });
+
+    existsSync.mockReturnValue(true);
+    readFileSync.mockReturnValue(JSON.stringify(fileCred));
+
+    const result = readCCCredentials();
+    expect(result).toHaveLength(1);
+    expect(result[0].source).toBe("cc-keychain");
+    expect(result[0].accessToken).toBe("keychain-token");
+  });
+
+  it("returns only file credentials on Linux", () => {
+    Object.defineProperty(process, "platform", { value: "linux" });
+
+    existsSync.mockReturnValue(true);
+    readFileSync.mockReturnValue(JSON.stringify(VALID_CRED));
+
+    const result = readCCCredentials();
+    expect(result).toHaveLength(1);
+    expect(result[0].source).toBe("cc-file");
+    expect(execSync).not.toHaveBeenCalled();
+  });
+
+  it("returns empty when no sources available", () => {
+    Object.defineProperty(process, "platform", { value: "linux" });
+    existsSync.mockReturnValue(false);
+
+    expect(readCCCredentials()).toEqual([]);
+  });
+});

package/lib/config.mjs

@@ -53,6 +53,13 @@ import { randomBytes } from "node:crypto";
  * @property {number} hit_rate_warning_threshold - Warn when avg cache hit rate falls below this (0-1). Default: 0.3
  */
 
+/**
+ * @typedef {object} CCCredentialReuseConfig
+ * @property {boolean} enabled - Master switch for CC credential reuse.  Default: false.
+ * @property {boolean} auto_detect - Auto-discover CC credentials on startup. Default: true.
+ * @property {boolean} prefer_over_oauth - When true, CC credentials are tried before plugin-managed OAuth accounts. Default: false.
+ */
+
 /**
  * @typedef {object} AnthropicAuthConfig
  * @property {AccountSelectionStrategy} account_selection_strategy
@@ -70,6 +77,7 @@ import { randomBytes } from "node:crypto";
  * @property {boolean} fast_mode
  * @property {{emulate_minimal: boolean}} telemetry
  * @property {boolean} usage_toast
+ * @property {CCCredentialReuseConfig} cc_credential_reuse
  */
 
 /** @type {AnthropicAuthConfig} */
@@ -128,6 +136,11 @@ export const DEFAULT_CONFIG = {
     disable: [],
     billing_header: true,
   },
+  cc_credential_reuse: {
+    enabled: false,
+    auto_detect: true,
+    prefer_over_oauth: false,
+  },
 };
 
 export const VALID_STRATEGIES = ["sticky", "round-robin", "hybrid"];
@@ -153,6 +166,7 @@ function createDefaultConfig() {
     fast_mode: DEFAULT_CONFIG.fast_mode,
     telemetry: { ...DEFAULT_CONFIG.telemetry },
     headers: { ...DEFAULT_CONFIG.headers, overrides: {}, disable: [] },
+    cc_credential_reuse: { ...DEFAULT_CONFIG.cc_credential_reuse },
   };
 }
 
@@ -357,6 +371,20 @@ function validateConfig(raw) {
   // Usage toast
   config.usage_toast = typeof raw.usage_toast === "boolean" ? raw.usage_toast : DEFAULT_CONFIG.usage_toast;
 
+  // CC credential reuse sub-config
+  if (raw.cc_credential_reuse && typeof raw.cc_credential_reuse === "object") {
+    const cc = /** @type {Record<string, unknown>} */ (raw.cc_credential_reuse);
+    config.cc_credential_reuse = {
+      enabled: typeof cc.enabled === "boolean" ? cc.enabled : DEFAULT_CONFIG.cc_credential_reuse.enabled,
+      auto_detect:
+        typeof cc.auto_detect === "boolean" ? cc.auto_detect : DEFAULT_CONFIG.cc_credential_reuse.auto_detect,
+      prefer_over_oauth:
+        typeof cc.prefer_over_oauth === "boolean"
+          ? cc.prefer_over_oauth
+          : DEFAULT_CONFIG.cc_credential_reuse.prefer_over_oauth,
+    };
+  }
+
   return config;
 }
 
@@ -429,6 +457,13 @@ function applyEnvOverrides(config) {
     config.override_model_limits.enabled = false;
   }
 
+  if (env.OPENCODE_ANTHROPIC_CC_CREDENTIALS === "1" || env.OPENCODE_ANTHROPIC_CC_CREDENTIALS === "true") {
+    config.cc_credential_reuse.enabled = true;
+  }
+  if (env.OPENCODE_ANTHROPIC_CC_CREDENTIALS === "0" || env.OPENCODE_ANTHROPIC_CC_CREDENTIALS === "false") {
+    config.cc_credential_reuse.enabled = false;
+  }
+
   return config;
 }
 

package/lib/storage.mjs

@@ -30,6 +30,7 @@ import { getConfigDir } from "./config.mjs";
  * @property {number | null} lastFailureTime
  * @property {string} [lastSwitchReason]
  * @property {AccountStats} stats
+ * @property {import('./accounts.mjs').AccountSource} [source] - Origin of the account ('oauth' | 'cc-keychain' | 'cc-file').
  */
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-anthropic-fix",
-  "version": "0.0.29",
+  "version": "0.0.31",
   "license": "GPL-3.0-or-later",
   "main": "./index.mjs",
   "files": [