opencode-anthropic-fix 0.0.42 → 0.0.44

package/lib/account-state.mjs

@@ -15,6 +15,9 @@ export function resetAccountTracking(account) {
 
 /**
  * Normalize active index after removing one account.
+ * NOTE: This operates on the disk-level AccountStorage shape (activeIndex >= 0).
+ * AccountManager.removeAccount has its own inline variant using #currentIndex = -1
+ * for empty accounts (runtime sentinel). The two are intentionally different.
  * @param {AccountStorage} storage
  * @param {number} removedIndex
  */

package/lib/accounts.mjs

@@ -154,7 +154,7 @@ export class AccountManager {
       const now = Date.now();
       manager.#accounts = [
         {
-          id: `${now}:${authFallback.refresh.slice(0, 12)}`,
+          id: `${now}:${hashTokenFragment(authFallback.refresh)}`,
           index: 0,
           email: undefined,
           refreshToken: authFallback.refresh,
@@ -433,6 +433,20 @@ export class AccountManager {
     return backoffMs;
   }
 
+  /**
+   * Mark an account for preemptive switching (quota burn rate high, but request succeeded).
+   * Unlike markRateLimited, this does NOT increment consecutiveFailures or record a health penalty.
+   * It only applies a short cooldown to encourage the rotation strategy to pick a different account.
+   * @param {ManagedAccount} account
+   * @param {number|null} [cooldownMs] - Optional cooldown in ms; defaults to 60s
+   */
+  markPreemptiveSwitch(account, cooldownMs = 60_000) {
+    const now = Date.now();
+    account.rateLimitResetTimes[RATE_LIMIT_KEY] = now + (cooldownMs ?? 60_000);
+    // Do NOT increment consecutiveFailures or record health penalty — the request succeeded.
+    this.requestSaveToDisk();
+  }
+
   /**
    * Mark a successful request for an account.
    * @param {ManagedAccount} account
@@ -559,7 +573,8 @@ export class AccountManager {
         this.#currentIndex = this.#accounts.length - 1;
       }
       if (this.#cursor > 0) {
-        this.#cursor = Math.min(this.#cursor, this.#accounts.length);
+        // QA fix L-cursor: clamp to valid range instead of allowing cursor === length
+        this.#cursor = this.#accounts.length > 0 ? this.#cursor % this.#accounts.length : 0;
       }
     }
 
@@ -744,9 +759,11 @@ export class AccountManager {
     const capturedDeltaKeys = new Set(this.#statsDeltas.keys());
 
     // QA fix M15: pass pre-loaded disk data to saveAccounts to avoid TOCTOU double-read
-    const preloadedDiskData = diskAccountsById
-      ? { version: 1, accounts: [...diskAccountsById.values()], activeIndex: Math.max(0, this.#currentIndex) }
-      : null;
+    // QA fix L-preload: omit activeIndex from preloaded disk data since saveAccounts
+    // only uses disk.accounts for auth freshness merge (not disk.activeIndex).
+    // The in-memory currentIndex was misleading here — the real disk activeIndex is
+    // carried by the first arg (storage.activeIndex).
+    const preloadedDiskData = diskAccountsById ? { version: 1, accounts: [...diskAccountsById.values()] } : null;
     await saveAccounts(storage, preloadedDiskData);
 
     // Clear only the captured deltas; new ones added during await are preserved

package/lib/backoff.mjs

@@ -138,10 +138,13 @@ function bodyHasAccountError(body) {
     "not authorized",
   ];
 
+  // QA fix: only match signals against error type and parsed message fields,
+  // not the full JSON body text — common words like "billing", "permission" in
+  // unrelated JSON fields (e.g. resource URLs) cause false account-specific
+  // classification, triggering unnecessary account rotation.
   return (
     typeSignals.some((signal) => errorType.includes(signal)) ||
-    messageSignals.some((signal) => message.includes(signal)) ||
-    messageSignals.some((signal) => text.includes(signal))
+    messageSignals.some((signal) => message.includes(signal))
   );
 }
 

package/lib/backoff.test.mjs

@@ -18,24 +18,63 @@ describe("isAccountSpecificError", () => {
     expect(isAccountSpecificError(401, null)).toBe(true);
   });
 
-  it("returns true for 400 with rate limit language in body", () => {
-    expect(isAccountSpecificError(400, "This request would exceed your account's rate limit")).toBe(true);
+  it("returns true for 400 with rate limit language in JSON error message", () => {
+    expect(
+      isAccountSpecificError(
+        400,
+        JSON.stringify({
+          error: { type: "invalid_request_error", message: "This request would exceed your account's rate limit" },
+        }),
+      ),
+    ).toBe(true);
+  });
+
+  it("returns true for 400 with quota language in JSON error message", () => {
+    expect(
+      isAccountSpecificError(
+        400,
+        JSON.stringify({ error: { type: "invalid_request_error", message: "Your quota has been exhausted" } }),
+      ),
+    ).toBe(true);
   });
 
-  it("returns true for 400 with quota language in body", () => {
-    expect(isAccountSpecificError(400, "Your quota has been exhausted")).toBe(true);
+  it("returns true for 400 with credit balance language in JSON error message", () => {
+    expect(
+      isAccountSpecificError(
+        400,
+        JSON.stringify({
+          error: { type: "invalid_request_error", message: "Your credit balance is too low to complete this request" },
+        }),
+      ),
+    ).toBe(true);
   });
 
-  it("returns true for 400 with credit balance language in body", () => {
-    expect(isAccountSpecificError(400, "Your credit balance is too low to complete this request")).toBe(true);
+  it("returns true for 400 with billing language in JSON error message", () => {
+    expect(
+      isAccountSpecificError(
+        400,
+        JSON.stringify({ error: { type: "billing_error", message: "Billing issue on your account" } }),
+      ),
+    ).toBe(true);
   });
 
-  it("returns true for 400 with billing language in body", () => {
-    expect(isAccountSpecificError(400, "Billing issue on your account")).toBe(true);
+  it("returns true for 403 with permission language in JSON error message", () => {
+    expect(
+      isAccountSpecificError(
+        403,
+        JSON.stringify({
+          error: { type: "permission_error", message: "You do not have permission to access this model" },
+        }),
+      ),
+    ).toBe(true);
   });
 
-  it("returns true for 403 with permission language in body", () => {
-    expect(isAccountSpecificError(403, "You do not have permission to access this model")).toBe(true);
+  it("returns false for plain text body without JSON structure (no false positives)", () => {
+    // Plain text bodies that happen to contain keywords should NOT match
+    // — only structured error.type and error.message fields are checked
+    expect(isAccountSpecificError(400, "This request would exceed your account's rate limit")).toBe(false);
+    expect(isAccountSpecificError(400, "Billing issue on your account")).toBe(false);
+    expect(isAccountSpecificError(403, "You do not have permission to access this model")).toBe(false);
   });
 
   it("returns true for 403 permission_error type in JSON body", () => {
@@ -86,9 +125,19 @@ describe("isAccountSpecificError", () => {
     expect(isAccountSpecificError(200, null)).toBe(false);
   });
 
-  it("is case-insensitive for body matching", () => {
-    expect(isAccountSpecificError(400, "RATE LIMIT exceeded")).toBe(true);
-    expect(isAccountSpecificError(400, "QUOTA Exhausted")).toBe(true);
+  it("is case-insensitive for JSON error message matching", () => {
+    expect(
+      isAccountSpecificError(
+        400,
+        JSON.stringify({ error: { type: "invalid_request_error", message: "RATE LIMIT exceeded" } }),
+      ),
+    ).toBe(true);
+    expect(
+      isAccountSpecificError(
+        400,
+        JSON.stringify({ error: { type: "invalid_request_error", message: "QUOTA Exhausted" } }),
+      ),
+    ).toBe(true);
   });
 });
 

package/lib/cc-credentials.mjs

@@ -226,6 +226,10 @@ export function parseCCCredentialData(jsonStr, source, label) {
  * @returns {CCCredential | null}
  */
 function shapeToCCCredential(data, source, label) {
+  // QA fix: filter MCP-scoped credentials — they're not valid for API requests.
+  // The file reader already checks this, but keychain entries bypass that check.
+  if (data.scope === "mcp") return null;
+
   const accessToken = typeof data.accessToken === "string" ? data.accessToken : null;
   const refreshToken = typeof data.refreshToken === "string" ? data.refreshToken : null;
 

package/lib/config.mjs

@@ -67,6 +67,14 @@ import { randomBytes } from "node:crypto";
  * @property {boolean} prefer_over_oauth - When true, CC credentials are tried before plugin-managed OAuth accounts. Default: false.
  */
 
+/**
+ * @typedef {object} HeaderConfig
+ * @property {string} emulation_profile - Claude Code version to emulate in headers
+ * @property {Record<string, string>} overrides - Custom header overrides
+ * @property {string[]} disable - Headers to disable/remove
+ * @property {boolean} billing_header - Whether to include billing header in system prompt
+ */
+
 /**
  * @typedef {object} AnthropicAuthConfig
  * @property {AccountSelectionStrategy} account_selection_strategy
@@ -515,6 +523,158 @@ function validateConfig(raw) {
     }
   }
 
+  // Willow mode sub-config
+  if (raw.willow_mode && typeof raw.willow_mode === "object") {
+    const wm = /** @type {Record<string, unknown>} */ (raw.willow_mode);
+    config.willow_mode = {
+      enabled: typeof wm.enabled === "boolean" ? wm.enabled : DEFAULT_CONFIG.willow_mode.enabled,
+      idle_threshold_minutes: clampNumber(
+        wm.idle_threshold_minutes,
+        1,
+        24 * 60,
+        DEFAULT_CONFIG.willow_mode.idle_threshold_minutes,
+      ),
+      cooldown_minutes: clampNumber(wm.cooldown_minutes, 1, 24 * 60, DEFAULT_CONFIG.willow_mode.cooldown_minutes),
+      min_turns_before_suggest: clampNumber(
+        wm.min_turns_before_suggest,
+        0,
+        50,
+        DEFAULT_CONFIG.willow_mode.min_turns_before_suggest,
+      ),
+    };
+  }
+
+  // Token economy sub-config
+  if (raw.token_economy && typeof raw.token_economy === "object") {
+    const te = /** @type {Record<string, unknown>} */ (raw.token_economy);
+    config.token_economy = {
+      token_efficient_tools:
+        typeof te.token_efficient_tools === "boolean"
+          ? te.token_efficient_tools
+          : DEFAULT_CONFIG.token_economy.token_efficient_tools,
+      redact_thinking:
+        typeof te.redact_thinking === "boolean" ? te.redact_thinking : DEFAULT_CONFIG.token_economy.redact_thinking,
+      connector_text_summarization:
+        typeof te.connector_text_summarization === "boolean"
+          ? te.connector_text_summarization
+          : DEFAULT_CONFIG.token_economy.connector_text_summarization,
+    };
+  }
+
+  // Output cap sub-config
+  if (raw.output_cap && typeof raw.output_cap === "object") {
+    const oc = /** @type {Record<string, unknown>} */ (raw.output_cap);
+    config.output_cap = {
+      enabled: typeof oc.enabled === "boolean" ? oc.enabled : DEFAULT_CONFIG.output_cap.enabled,
+      default_max_tokens: clampNumber(
+        oc.default_max_tokens,
+        256,
+        200_000,
+        DEFAULT_CONFIG.output_cap.default_max_tokens,
+      ),
+      escalated_max_tokens: clampNumber(
+        oc.escalated_max_tokens,
+        1_000,
+        200_000,
+        DEFAULT_CONFIG.output_cap.escalated_max_tokens,
+      ),
+    };
+  }
+
+  // Preconnect sub-config
+  if (raw.preconnect && typeof raw.preconnect === "object") {
+    const pc = /** @type {Record<string, unknown>} */ (raw.preconnect);
+    config.preconnect = {
+      enabled: typeof pc.enabled === "boolean" ? pc.enabled : DEFAULT_CONFIG.preconnect.enabled,
+      timeout_ms: clampNumber(pc.timeout_ms, 100, 60_000, DEFAULT_CONFIG.preconnect.timeout_ms),
+    };
+  }
+
+  // Overflow recovery sub-config
+  if (raw.overflow_recovery && typeof raw.overflow_recovery === "object") {
+    const ovf = /** @type {Record<string, unknown>} */ (raw.overflow_recovery);
+    config.overflow_recovery = {
+      enabled: typeof ovf.enabled === "boolean" ? ovf.enabled : DEFAULT_CONFIG.overflow_recovery.enabled,
+      safety_margin: clampNumber(ovf.safety_margin, 0, 10_000, DEFAULT_CONFIG.overflow_recovery.safety_margin),
+    };
+  }
+
+  // Cache break detection sub-config
+  if (raw.cache_break_detection && typeof raw.cache_break_detection === "object") {
+    const cbd = /** @type {Record<string, unknown>} */ (raw.cache_break_detection);
+    config.cache_break_detection = {
+      enabled: typeof cbd.enabled === "boolean" ? cbd.enabled : DEFAULT_CONFIG.cache_break_detection.enabled,
+      alert_threshold: clampNumber(
+        cbd.alert_threshold,
+        0,
+        1_000_000,
+        DEFAULT_CONFIG.cache_break_detection.alert_threshold,
+      ),
+    };
+  }
+
+  // Request classification sub-config
+  if (raw.request_classification && typeof raw.request_classification === "object") {
+    const rc = /** @type {Record<string, unknown>} */ (raw.request_classification);
+    config.request_classification = {
+      enabled: typeof rc.enabled === "boolean" ? rc.enabled : DEFAULT_CONFIG.request_classification.enabled,
+      background_max_service_retries: clampNumber(
+        rc.background_max_service_retries,
+        0,
+        10,
+        DEFAULT_CONFIG.request_classification.background_max_service_retries,
+      ),
+      background_max_should_retries: clampNumber(
+        rc.background_max_should_retries,
+        0,
+        10,
+        DEFAULT_CONFIG.request_classification.background_max_should_retries,
+      ),
+    };
+  }
+
+  // Token budget sub-config
+  if (raw.token_budget && typeof raw.token_budget === "object") {
+    const tbg = /** @type {Record<string, unknown>} */ (raw.token_budget);
+    config.token_budget = {
+      enabled: typeof tbg.enabled === "boolean" ? tbg.enabled : DEFAULT_CONFIG.token_budget.enabled,
+      default: clampNumber(tbg.default, 0, 1_000_000, DEFAULT_CONFIG.token_budget.default),
+      completion_threshold: clampNumber(
+        tbg.completion_threshold,
+        0,
+        1,
+        DEFAULT_CONFIG.token_budget.completion_threshold,
+      ),
+    };
+  }
+
+  // Microcompact sub-config
+  if (raw.microcompact && typeof raw.microcompact === "object") {
+    const mc = /** @type {Record<string, unknown>} */ (raw.microcompact);
+    config.microcompact = {
+      enabled: typeof mc.enabled === "boolean" ? mc.enabled : DEFAULT_CONFIG.microcompact.enabled,
+      threshold_percent: clampNumber(mc.threshold_percent, 0, 100, DEFAULT_CONFIG.microcompact.threshold_percent),
+    };
+  }
+
+  // Overload recovery sub-config
+  if (raw.overload_recovery && typeof raw.overload_recovery === "object") {
+    const ovl = /** @type {Record<string, unknown>} */ (raw.overload_recovery);
+    config.overload_recovery = {
+      enabled: typeof ovl.enabled === "boolean" ? ovl.enabled : DEFAULT_CONFIG.overload_recovery.enabled,
+      default_cooldown_ms: clampNumber(
+        ovl.default_cooldown_ms,
+        1_000,
+        3_600_000,
+        DEFAULT_CONFIG.overload_recovery.default_cooldown_ms,
+      ),
+      poll_quota_on_overload:
+        typeof ovl.poll_quota_on_overload === "boolean"
+          ? ovl.poll_quota_on_overload
+          : DEFAULT_CONFIG.overload_recovery.poll_quota_on_overload,
+    };
+  }
+
   return config;
 }
 

package/lib/oauth.mjs

@@ -269,6 +269,7 @@ export async function exchange(code, verifier) {
     break;
   }
 
+  // Defensive guard — control flow guarantees result is always set, but kept for safety
   if (!result) {
     return fail(undefined, "Token exchange request did not complete");
   }
@@ -336,7 +337,6 @@ export async function revoke(refreshToken) {
 export async function refreshToken(refreshTokenValue, options = {}) {
   // QA fix M13: default 30s timeout to prevent hanging on unresponsive server
   const signal = options.signal ?? AbortSignal.timeout(30_000);
-  let lastError = null;
 
   for (let attempt = 0; attempt <= OAUTH_MAX_RETRIES; attempt++) {
     let resp;
@@ -357,7 +357,6 @@ export async function refreshToken(refreshTokenValue, options = {}) {
         signal,
       });
     } catch (err) {
-      lastError = err;
       if (attempt < OAUTH_MAX_RETRIES) {
         await sleep(Math.min(500 * 2 ** attempt, 2000));
         continue;
@@ -393,8 +392,6 @@ export async function refreshToken(refreshTokenValue, options = {}) {
 
     return resp.json();
   }
-
-  throw lastError instanceof Error ? lastError : new Error("Token refresh failed after retries");
 }
 
 /**

package/lib/refresh-lock.mjs

@@ -60,7 +60,16 @@ export async function acquireRefreshLock(accountId, options = {}) {
       try {
         const stat = await fs.stat(lockPath);
         if (Date.now() - stat.mtimeMs > staleMs) {
-          await fs.unlink(lockPath);
+          // QA fix L-toctou: re-stat after potential concurrent lock renewal
+          // to reduce the TOCTOU window. If mtime changed, skip the unlink.
+          try {
+            const reStat = await fs.stat(lockPath);
+            if (Date.now() - reStat.mtimeMs > staleMs) {
+              await fs.unlink(lockPath);
+            }
+          } catch {
+            // File vanished between stat calls — another process released it
+          }
           continue;
         }
       } catch {

package/lib/rotation.mjs

@@ -216,8 +216,9 @@ const SWITCH_THRESHOLD = 100;
 function calculateHybridScore(account, maxTokens) {
   const healthComponent = account.healthScore * 2;
   const tokenComponent = (account.tokens / maxTokens) * 100 * 5;
-  // QA fix M17: lastUsed=0 means never-used; treat as 0 freshness bonus instead of max
-  const secondsSinceUsed = account.lastUsed > 0 ? (Date.now() - account.lastUsed) / 1000 : 0;
+  // QA fix M17+: lastUsed=0 means never-used; treat as max freshness (3600s cap)
+  // so new accounts aren't perpetually ranked below recently-active ones.
+  const secondsSinceUsed = account.lastUsed > 0 ? (Date.now() - account.lastUsed) / 1000 : 3600;
   const freshnessComponent = Math.min(secondsSinceUsed, 3600) * 0.1;
 
   return Math.max(0, healthComponent + tokenComponent + freshnessComponent);

package/lib/storage.mjs

@@ -261,7 +261,7 @@ export async function loadAccounts() {
  * @param {AccountStorage} storage
  * @returns {Promise<void>}
  */
-export async function saveAccounts(storage) {
+export async function saveAccounts(storage, storageOrDiskData = undefined) {
   const storagePath = getStoragePath();
   const configDir = dirname(storagePath);
 
@@ -276,8 +276,9 @@ export async function saveAccounts(storage) {
   // Merge auth fields against disk by freshness to avoid stale-process clobber.
   // We do not resurrect removed accounts; only merge for accounts present in
   // the incoming storage payload.
+  // QA fix: declare diskData param explicitly instead of hidden arguments[1].
   try {
-    const disk = arguments[1] ?? (await loadAccounts());
+    const disk = storageOrDiskData ?? (await loadAccounts());
     if (disk && storage.accounts.length > 0) {
       const diskById = new Map(disk.accounts.map((a) => [a.id, a]));
       /** @type {Map<number, AccountMetadata[]>} */

package/lib/storage.test.mjs

@@ -211,12 +211,16 @@ describe("loadAccounts", () => {
   });
 
   it("returns best-effort data for newer version (forward compat)", async () => {
+    // QA fix L-warnSpy: mock console.warn to prevent test output contamination
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
     fs.readFile.mockResolvedValue(JSON.stringify({ version: 99, accounts: [] }));
     const result = await loadAccounts();
     // H12 fix: no longer returns null; attempts best-effort load with a warning
     expect(result).not.toBeNull();
     expect(result.accounts).toEqual([]);
     expect(result.version).toBe(1); // normalized to current version
+    expect(warnSpy).toHaveBeenCalledOnce();
+    warnSpy.mockRestore();
   });
 
   it("returns null when accounts is not an array", async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-anthropic-fix",
-  "version": "0.0.42",
+  "version": "0.0.44",
   "license": "GPL-3.0-or-later",
   "main": "./index.mjs",
   "files": [