opencode-anthropic-fix 0.0.32 → 0.0.33

package/index.mjs

@@ -821,7 +821,7 @@ export async function AnthropicAuthPlugin({ client, project, directory, worktree
         },
         "adaptive-context": () => {
           const enabled = value === "on" || value === "true" || value === "1";
-          saveConfig({ adaptive_context: { enabled } });
+          saveConfig({ adaptive_context: { ...config.adaptive_context, enabled } });
           if (!config.adaptive_context)
             config.adaptive_context = {
               enabled: false,
@@ -833,6 +833,7 @@ export async function AnthropicAuthPlugin({ client, project, directory, worktree
           if (!enabled) {
             adaptiveContextState.active = false;
             adaptiveContextState.escalatedByError = false;
+            adaptiveContextState.lastTransitionTurn = sessionMetrics.turns;
           }
         },
       };
@@ -1825,6 +1826,8 @@ export async function AnthropicAuthPlugin({ client, project, directory, worktree
               let serviceWideRetryCount = 0; // Track 529/503 retries (max 2 per RE doc §5.5)
               let shouldRetryCount = 0; // Track x-should-retry forced retries (cap at 3)
               let consecutive529Count = 0;
+              let _adaptiveDecisionMade = false; // Ensure adaptive context decision is made only once per logical request
+              let _adaptiveOverrideForRequest; // Cached adaptive override for all retry attempts
               for (let attempt = 0; attempt < maxAttempts; attempt++) {
                 // Select account — use pinned account on first attempt if available
                 const account =
@@ -1974,30 +1977,34 @@ export async function AnthropicAuthPlugin({ client, project, directory, worktree
                 );
                 const _reqProvider = detectProvider(requestUrl);
 
-                // --- Adaptive 1M context decision ---
-                const _prevAdaptiveState = adaptiveContextState.active;
-                const _use1MContext = resolveAdaptiveContext(
-                  requestInit.body,
-                  _reqModel,
-                  config.adaptive_context || {
-                    enabled: false,
-                    escalation_threshold: 150_000,
-                    deescalation_threshold: 100_000,
-                  },
-                );
-                // Emit visual cue on state transitions (only when adaptive mode is on)
-                if (config.adaptive_context?.enabled && _prevAdaptiveState !== adaptiveContextState.active) {
-                  const label = adaptiveContextState.active ? "1M context ON" : "1M context OFF";
-                  const variant = adaptiveContextState.active ? "info" : "success";
-                  const est = estimatePromptTokens(requestInit.body);
-                  toast(`⬡ ${label} (est. ${Math.round(est / 1000)}K tokens)`, variant, {
-                    debounceKey: "adaptive-ctx",
-                  }).catch(() => {});
+                // --- Adaptive 1M context decision (once per logical request, not per retry) ---
+                if (!_adaptiveDecisionMade) {
+                  _adaptiveDecisionMade = true;
+                  const _prevAdaptiveState = adaptiveContextState.active;
+                  const _use1MContext = resolveAdaptiveContext(
+                    requestInit.body,
+                    _reqModel,
+                    config.adaptive_context || {
+                      enabled: true,
+                      escalation_threshold: 150_000,
+                      deescalation_threshold: 100_000,
+                    },
+                  );
+                  // Emit visual cue on state transitions (only when adaptive mode is on)
+                  if (config.adaptive_context?.enabled && _prevAdaptiveState !== adaptiveContextState.active) {
+                    const label = adaptiveContextState.active ? "1M context ON" : "1M context OFF";
+                    const variant = adaptiveContextState.active ? "info" : "success";
+                    const est = estimatePromptTokens(requestInit.body);
+                    toast(`⬡ ${label} (est. ${Math.round(est / 1000)}K tokens)`, variant, {
+                      debounceKey: "adaptive-ctx",
+                    }).catch(() => {});
+                  }
+                  _adaptiveOverrideForRequest = config.adaptive_context?.enabled
+                    ? { use1MContext: _use1MContext }
+                    : undefined;
                 }
 
-                const _adaptiveOverride = config.adaptive_context?.enabled
-                  ? { use1MContext: _use1MContext }
-                  : undefined;
+                const _adaptiveOverride = _adaptiveOverrideForRequest;
 
                 const computedBetaHeader = buildAnthropicBetaHeader(
                   "",
@@ -2207,26 +2214,34 @@ export async function AnthropicAuthPlugin({ client, project, directory, worktree
                     try {
                       const parsedBody = JSON.parse(body);
                       if (Array.isArray(parsedBody.messages) && parsedBody.messages.length > 4) {
-                        // Keep first 2 messages (initial context) and last N messages (recent work).
+                        // Keep first 2 messages (initial context) and last 2 messages (recent work).
                         // Ensure the trimmed array never ends with an assistant message (prefill),
                         // which would cause "does not support assistant message prefill" errors.
-                        let tailCount = 2;
                         const msgs = parsedBody.messages;
-                        // Expand tail if it would end with an assistant message
-                        while (
-                          tailCount < msgs.length - 2 &&
-                          msgs[msgs.length - tailCount]?.role !== "user" &&
-                          msgs.length - tailCount > 0
-                        ) {
-                          tailCount++;
-                        }
-                        const tail = msgs.slice(-tailCount);
-                        // If tail still starts/ends badly, force a user wrapper
+                        const tail = msgs.slice(-2);
+                        // If tail ends with assistant, append a user message to fix the prefill issue.
+                        // Check if the assistant's last content block is tool_use — if so, synthesize
+                        // a tool_result instead of bare "Continue." to respect the tool protocol.
                         if (tail.length > 0 && tail[tail.length - 1]?.role === "assistant") {
-                          tail.push({
-                            role: "user",
-                            content: [{ type: "text", text: "Continue." }],
-                          });
+                          const lastAssistant = tail[tail.length - 1];
+                          const lastContent = Array.isArray(lastAssistant.content) ? lastAssistant.content : [];
+                          const toolUseBlocks = lastContent.filter((b) => b.type === "tool_use");
+                          if (toolUseBlocks.length > 0) {
+                            // Synthesize tool_result for each pending tool_use
+                            tail.push({
+                              role: "user",
+                              content: toolUseBlocks.map((tu) => ({
+                                type: "tool_result",
+                                tool_use_id: tu.id,
+                                content: "[Context trimmed — previous result unavailable]",
+                              })),
+                            });
+                          } else {
+                            tail.push({
+                              role: "user",
+                              content: [{ type: "text", text: "Continue." }],
+                            });
+                          }
                         }
                         const trimmed = [
                           ...msgs.slice(0, 2),
@@ -2635,6 +2650,12 @@ export async function AnthropicAuthPlugin({ client, project, directory, worktree
       ],
     },
     "experimental.session.compacting": async (input, output) => {
+      // Reset adaptive context state on session compaction (new conversation boundary).
+      // This prevents sticky escalation from leaking across conversations.
+      adaptiveContextState.active = false;
+      adaptiveContextState.lastTransitionTurn = sessionMetrics.turns;
+      adaptiveContextState.escalatedByError = false;
+
       // Inject Anthropic-specific context into compaction
       if (!accountManager) return;
       const account = accountManager.getCurrentAccount();
@@ -2706,9 +2727,50 @@ const adaptiveContextState = {
  */
 function estimatePromptTokens(bodyString) {
   if (!bodyString || typeof bodyString !== "string") return 0;
-  // The body includes tools, system prompt, and messages.
-  // 4 chars/token is a reasonable heuristic for JSON-encoded conversation.
-  return Math.ceil(bodyString.length / 4);
+  try {
+    const parsed = JSON.parse(bodyString);
+    let charCount = 0;
+
+    // Count system prompt text
+    if (Array.isArray(parsed.system)) {
+      for (const block of parsed.system) {
+        if (block.type === "text" && typeof block.text === "string") {
+          charCount += block.text.length;
+        }
+      }
+    } else if (typeof parsed.system === "string") {
+      charCount += parsed.system.length;
+    }
+
+    // Count messages content (text blocks, tool results) — skip tool definitions
+    if (Array.isArray(parsed.messages)) {
+      for (const msg of parsed.messages) {
+        if (typeof msg.content === "string") {
+          charCount += msg.content.length;
+        } else if (Array.isArray(msg.content)) {
+          for (const block of msg.content) {
+            if (block.type === "text" && typeof block.text === "string") {
+              charCount += block.text.length;
+            } else if (block.type === "tool_result" && typeof block.content === "string") {
+              charCount += block.content.length;
+            } else if (block.type === "tool_use") {
+              // Count serialized input as tokens
+              charCount += JSON.stringify(block.input || {}).length;
+            } else if (block.type === "image" || block.type === "image_url") {
+              // Images: ~2000 tokens per image (Anthropic tile-based counting)
+              charCount += 8000; // 2000 tokens * 4 chars/token
+            }
+          }
+        }
+      }
+    }
+
+    // 4 chars/token heuristic for text content (reasonable for English + code + JSON)
+    return Math.ceil(charCount / 4);
+  } catch {
+    // Fallback: raw body length / 4 if JSON parsing fails
+    return Math.ceil(bodyString.length / 4);
+  }
 }
 
 /**
@@ -2735,6 +2797,11 @@ function resolveAdaptiveContext(bodyString, model, adaptiveConfig) {
     return hasOneMillionContext(model);
   }
 
+  // If experimental betas are disabled, context-1m will be stripped anyway — skip adaptive logic
+  if (isTruthyEnv(process.env.CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS)) {
+    return false;
+  }
+
   // Model must be eligible for 1M context at all
   if (!hasOneMillionContext(model)) {
     return false;
@@ -2762,6 +2829,10 @@ function resolveAdaptiveContext(bodyString, model, adaptiveConfig) {
     return true;
   } else {
     // Currently inactive — consider escalation
+    // Symmetric hysteresis: require at least 2 turns before re-escalation too
+    if (turnsSinceTransition < 2 && adaptiveContextState.lastTransitionTurn > 0) {
+      return false;
+    }
     if (estimatedTokens > adaptiveConfig.escalation_threshold) {
       // Escalate
       adaptiveContextState.active = true;
@@ -4293,10 +4364,26 @@ function transformRequestBody(body, signature, runtime, betaHeader) {
     if (Array.isArray(parsed.messages) && parsed.messages.length > 0) {
       const lastMsg = parsed.messages[parsed.messages.length - 1];
       if (lastMsg && lastMsg.role === "assistant") {
-        parsed.messages.push({
-          role: "user",
-          content: [{ type: "text", text: "Continue." }],
-        });
+        // Check if the assistant message contains tool_use blocks — if so,
+        // synthesize tool_result responses instead of bare "Continue." to
+        // respect the Anthropic tool protocol.
+        const lastContent = Array.isArray(lastMsg.content) ? lastMsg.content : [];
+        const toolUseBlocks = lastContent.filter((b) => b.type === "tool_use");
+        if (toolUseBlocks.length > 0) {
+          parsed.messages.push({
+            role: "user",
+            content: toolUseBlocks.map((tu) => ({
+              type: "tool_result",
+              tool_use_id: tu.id,
+              content: "[Result unavailable — conversation was restructured]",
+            })),
+          });
+        } else {
+          parsed.messages.push({
+            role: "user",
+            content: [{ type: "text", text: "Continue." }],
+          });
+        }
       }
     }
 
@@ -4751,9 +4838,12 @@ async function refreshAccountToken(account, client, source = "foreground", { onT
     const { readCCCredentials } = await import("./lib/cc-credentials.mjs");
     const ccCreds = readCCCredentials();
     const match = ccCreds.find((c) => c.refreshToken === account.refreshToken);
-    if (match && match.expiresAt > Date.now()) {
+    // Accept CC credential if:
+    //   - expiresAt is in the future (normal case), OR
+    //   - expiresAt is 0/missing (CC didn't provide expiry — trust the token, let API 401 if stale)
+    if (match && (match.expiresAt === 0 || match.expiresAt > Date.now())) {
       account.access = match.accessToken;
-      account.expires = match.expiresAt;
+      account.expires = match.expiresAt || Date.now() + 3600_000; // default 1h if unknown
       markTokenStateUpdated(account);
       if (onTokensUpdated) {
         try {

package/lib/accounts.mjs

@@ -807,6 +807,7 @@ export class AccountManager {
           lastFailureTime: acc.lastFailureTime,
           lastSwitchReason: acc.lastSwitchReason || existing?.lastSwitchReason || "initial",
           stats: acc.stats ?? existing?.stats ?? createDefaultStats(),
+          source: acc.source || existing?.source || "oauth",
         };
       });
 

package/lib/cc-credentials.mjs

@@ -16,7 +16,7 @@
  * @module cc-credentials
  */
 
-import { execSync } from "node:child_process";
+import { execSync, execFileSync } from "node:child_process";
 import { readFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
@@ -77,7 +77,7 @@ function listKeychainServices() {
  */
 function readKeychainService(service) {
   try {
-    const raw = execSync(`security find-generic-password -s "${service}" -w`, {
+    const raw = execFileSync("security", ["find-generic-password", "-s", service, "-w"], {
       timeout: 5_000,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"],

package/lib/cc-credentials.test.mjs

@@ -12,6 +12,7 @@ import {
 
 vi.mock("node:child_process", () => ({
   execSync: vi.fn(),
+  execFileSync: vi.fn(),
 }));
 
 vi.mock("node:fs", () => ({
@@ -23,7 +24,7 @@ vi.mock("node:os", () => ({
   homedir: vi.fn(() => "/home/testuser"),
 }));
 
-import { execSync } from "node:child_process";
+import { execSync, execFileSync } from "node:child_process";
 import { readFileSync, existsSync } from "node:fs";
 import { homedir } from "node:os";
 
@@ -149,10 +150,14 @@ describe("readCCCredentialsFromKeychain", () => {
   it("reads single keychain service on macOS", () => {
     Object.defineProperty(process, "platform", { value: "darwin" });
 
+    // dump-keychain uses execSync, find-generic-password uses execFileSync
     execSync.mockImplementation((cmd) => {
       if (cmd === "security dump-keychain") return KEYCHAIN_DUMP_SINGLE;
-      if (cmd.includes("find-generic-password")) return JSON.stringify(VALID_CRED);
-      throw new Error("unexpected cmd");
+      throw new Error("unexpected execSync cmd");
+    });
+    execFileSync.mockImplementation((_bin, args) => {
+      if (args && args.includes("find-generic-password")) return JSON.stringify(VALID_CRED);
+      throw new Error("unexpected execFileSync cmd");
     });
 
     const result = readCCCredentialsFromKeychain();
@@ -168,12 +173,15 @@ describe("readCCCredentialsFromKeychain", () => {
     let callIdx = 0;
     execSync.mockImplementation((cmd) => {
       if (cmd === "security dump-keychain") return KEYCHAIN_DUMP_MULTI;
-      if (cmd.includes("find-generic-password")) {
+      throw new Error("unexpected execSync cmd");
+    });
+    execFileSync.mockImplementation((_bin, args) => {
+      if (args && args.includes("find-generic-password")) {
         callIdx++;
         const cred = callIdx === 1 ? VALID_CRED : VALID_CRED_2;
         return JSON.stringify(cred);
       }
-      throw new Error("unexpected cmd");
+      throw new Error("unexpected execFileSync cmd");
     });
 
     const result = readCCCredentialsFromKeychain();
@@ -197,13 +205,13 @@ describe("readCCCredentialsFromKeychain", () => {
 
     execSync.mockImplementation((cmd) => {
       if (cmd === "security dump-keychain") return KEYCHAIN_DUMP_SINGLE;
-      if (cmd.includes("find-generic-password")) {
-        const err = new Error("not found");
-        err.status = 44;
-        throw err;
-      }
       throw new Error("unexpected");
     });
+    execFileSync.mockImplementation(() => {
+      const err = new Error("not found");
+      err.status = 44;
+      throw err;
+    });
 
     expect(readCCCredentialsFromKeychain()).toEqual([]);
   });
@@ -317,11 +325,14 @@ describe("readCCCredentials", () => {
   it("combines keychain and file sources on macOS", () => {
     Object.defineProperty(process, "platform", { value: "darwin" });
 
-    // Keychain returns one credential
+    // Keychain: dump-keychain via execSync, find-generic-password via execFileSync
     execSync.mockImplementation((cmd) => {
       if (cmd === "security dump-keychain") return KEYCHAIN_DUMP_SINGLE;
-      if (cmd.includes("find-generic-password")) return JSON.stringify(VALID_CRED);
-      throw new Error("unexpected");
+      throw new Error("unexpected execSync cmd");
+    });
+    execFileSync.mockImplementation((_bin, args) => {
+      if (args && args.includes("find-generic-password")) return JSON.stringify(VALID_CRED);
+      throw new Error("unexpected execFileSync cmd");
     });
 
     // File returns a different credential
@@ -343,8 +354,11 @@ describe("readCCCredentials", () => {
 
     execSync.mockImplementation((cmd) => {
       if (cmd === "security dump-keychain") return KEYCHAIN_DUMP_SINGLE;
-      if (cmd.includes("find-generic-password")) return JSON.stringify(keychainCred);
-      throw new Error("unexpected");
+      throw new Error("unexpected execSync cmd");
+    });
+    execFileSync.mockImplementation((_bin, args) => {
+      if (args && args.includes("find-generic-password")) return JSON.stringify(keychainCred);
+      throw new Error("unexpected execFileSync cmd");
     });
 
     existsSync.mockReturnValue(true);

package/lib/config.mjs

@@ -150,7 +150,7 @@ export const DEFAULT_CONFIG = {
     prefer_over_oauth: false,
   },
   adaptive_context: {
-    enabled: false,
+    enabled: true,
     escalation_threshold: 150_000,
     deescalation_threshold: 100_000,
   },
@@ -417,6 +417,13 @@ function validateConfig(raw) {
         DEFAULT_CONFIG.adaptive_context.deescalation_threshold,
       ),
     };
+    // Cross-validate: deescalation must be strictly less than escalation to maintain hysteresis gap
+    if (config.adaptive_context.deescalation_threshold >= config.adaptive_context.escalation_threshold) {
+      config.adaptive_context.deescalation_threshold = Math.max(
+        20_000,
+        config.adaptive_context.escalation_threshold - 50_000,
+      );
+    }
   }
 
   return config;

package/lib/config.test.mjs

@@ -308,11 +308,11 @@ describe("loadConfig", () => {
 
   // --- adaptive_context config tests ---
 
-  it("has adaptive_context defaults (disabled)", () => {
+  it("has adaptive_context defaults (enabled)", () => {
     existsSync.mockReturnValue(false);
     const config = loadConfig();
     expect(config.adaptive_context).toEqual({
-      enabled: false,
+      enabled: true,
       escalation_threshold: 150_000,
       deescalation_threshold: 100_000,
     });
@@ -349,7 +349,7 @@ describe("loadConfig", () => {
     existsSync.mockReturnValue(true);
     readFileSync.mockReturnValue(JSON.stringify({ adaptive_context: { enabled: "yes" } }));
     const config = loadConfig();
-    expect(config.adaptive_context.enabled).toBe(false);
+    expect(config.adaptive_context.enabled).toBe(true);
   });
 
   it("ignores non-number adaptive_context thresholds", () => {

package/lib/storage.mjs

@@ -183,6 +183,10 @@ function validateAccount(raw, now) {
       typeof acc.consecutiveFailures === "number" ? Math.max(0, Math.floor(acc.consecutiveFailures)) : 0,
     lastFailureTime: typeof acc.lastFailureTime === "number" ? acc.lastFailureTime : null,
     lastSwitchReason: typeof acc.lastSwitchReason === "string" ? acc.lastSwitchReason : undefined,
+    source:
+      typeof acc.source === "string" && ["oauth", "cc-keychain", "cc-file"].includes(acc.source)
+        ? acc.source
+        : undefined,
     stats: validateStats(acc.stats, now),
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-anthropic-fix",
-  "version": "0.0.32",
+  "version": "0.0.33",
   "license": "GPL-3.0-or-later",
   "main": "./index.mjs",
   "files": [