opencode-anthropic-fix 0.0.46 → 0.0.48

package/README.md

@@ -44,7 +44,7 @@ The [original plugin](https://github.com/anomalyco/opencode-anthropic-auth) prov
 - **Configurable strategies** — sticky, round-robin, or hybrid account selection
 - **Claude Code signature emulation** — full HTTP header, system prompt, beta flag, and metadata mimicry derived from Claude Code's open source code
 - **OAuth endpoint fingerprint parity** — matches the real CLI's bundled axios 1.13.6 HTTP client signature (`Accept`, `User-Agent`, `Content-Type`) on all OAuth token endpoint calls, required since 2026-03-21 server-side enforcement
-- **Dynamic billing cache hash** — computes the `cch` field in the billing header using the real CLI's `NP1()` algorithm (SHA-256 of salt + first user message chars + version), replacing the static `00000` placeholder
+- **Billing header fingerprint parity** — `cc_version` suffix uses the real CLI's 3-char fingerprint hash (SHA-256 of salt + first user message chars + version), `cch` matches the Bun native client attestation placeholder, and `X-Claude-Code-Session-Id` header is sent on all requests
 - **Adaptive thinking for Opus/Sonnet 4.6** — automatically normalizes thinking to `{type: "adaptive"}` for supported models, with `effort-2025-11-24` beta
 - **Upstream-aligned auto betas** — 13+ always-on betas matching Claude Code 2.1.92 (`redact-thinking-2026-02-12` available as opt-in to preserve thinking block visibility)
 - **1M context limit override** — patches `model.limit.context` so OpenCode compacts at the right threshold while `models.dev` catches up

package/index.mjs

@@ -2780,6 +2780,7 @@ export async function AnthropicAuthPlugin({ client, project, directory, worktree
                     claudeCliVersion,
                     customBetas: config.custom_betas,
                     strategy: getEffectiveStrategy(),
+                    sessionId: signatureSessionId,
                   },
                   _adaptiveOverride,
                   _tokenEconomy,
@@ -5553,19 +5554,34 @@ function buildRequestMetadata(input) {
 
 /**
  * Build the billing header block for Claude Code system prompt injection.
- * Claude Code v2.1.84: cch computed via NP1() from first user message, cc_version includes model ID.
+ * Claude Code v2.1.92: cc_version includes 3-char fingerprint hash (not model ID).
+ * cch is a static "00000" placeholder for Bun native client attestation.
+ *
+ * Real CC (system.ts:78): version = `${MACRO.VERSION}.${fingerprint}`
+ * Real CC (system.ts:82): cch = feature('NATIVE_CLIENT_ATTESTATION') ? ' cch=00000;' : ''
  *
- * @param {string} version - CLI version (e.g., "2.1.84")
- * @param {string} [modelId] - Model ID to append (e.g., "claude-opus-4-6")
- * @param {string} [firstUserMessage] - First user message text for cch hash computation
+ * @param {string} version - CLI version (e.g., "2.1.92")
+ * @param {string} [firstUserMessage] - First user message text for fingerprint computation
+ * @param {string} [provider] - API provider ("anthropic" | "bedrock" | "vertex" | "foundry")
  * @returns {string}
  */
-function buildAnthropicBillingHeader(version, modelId, firstUserMessage) {
+function buildAnthropicBillingHeader(version, firstUserMessage, provider) {
   if (isFalsyEnv(process.env.CLAUDE_CODE_ATTRIBUTION_HEADER)) return "";
   const entrypoint = process.env.CLAUDE_CODE_ENTRYPOINT || "unknown";
-  const ccVersion = modelId ? `${version}.${modelId}` : version;
-  const cch = firstUserMessage ? computeBillingCacheHash(firstUserMessage, version) : "00000";
-  let header = `x-anthropic-billing-header: cc_version=${ccVersion}; cc_entrypoint=${entrypoint}; cch=${cch};`;
+  // Fix #1: cc_version suffix is the 3-char fingerprint hash, NOT the model ID.
+  // computeBillingCacheHash() computes SHA256(salt + msg[4]+msg[7]+msg[20] + version)[:3]
+  // which matches computeFingerprint() in the real CC source (utils/fingerprint.ts).
+  // Always call the hash function — even for empty messages the real CC computes
+  // the hash from "000" chars (indices 4,7,20 all missing → fallback "0").
+  const fingerprint = computeBillingCacheHash(firstUserMessage || "", version);
+  const ccVersion = `${version}.${fingerprint}`;
+  // Fix #4: cch is a static "00000" placeholder for Bun's native client attestation.
+  // Real CC v92: cch is included for all providers EXCEPT bedrock/anthropicAws.
+  // The real Bun binary overwrites these zeros in the serialized body bytes.
+  // For non-Bun runtimes, the server sees "00000" and skips attestation verification.
+  const isBedrock = provider === "bedrock" || provider === "anthropicAws";
+  const cchPart = isBedrock ? "" : " cch=00000;";
+  let header = `x-anthropic-billing-header: cc_version=${ccVersion}; cc_entrypoint=${entrypoint};${cchPart}`;
   const workload = process.env.CLAUDE_CODE_WORKLOAD;
   if (workload) {
     // QA fix M5: sanitize workload value to prevent header injection
@@ -5757,8 +5773,8 @@ function buildSystemPromptBlocks(system, signature) {
   const blocks = [];
   const billingHeader = buildAnthropicBillingHeader(
     signature.claudeCliVersion,
-    signature.modelId,
     signature.firstUserMessage,
+    signature.provider,
   );
   if (billingHeader) {
     // Billing header: no cache_control (null scope — never cached)
@@ -5785,16 +5801,20 @@ function buildSystemPromptBlocks(system, signature) {
   // we always include it for better cache hit rates on the proxy side.
   blocks.push({ type: "text", text: CLAUDE_CODE_IDENTITY_STRING, cache_control: baseCacheControl });
 
-  // Filtered blocks: keep as-is, with optional static/dynamic boundary marker
+  // Real CC (utils/api.ts splitSysPromptPrefix): ALL user system blocks are joined
+  // with '\n\n' into a SINGLE text block. This is true in ALL modes (default, MCP, boundary).
+  // Wire format: [billing (no cache), identity (ephemeral), ONE_JOINED_BLOCK (ephemeral)]
+  // Sending separate blocks is a detectable fingerprinting signal.
   if (filtered.length > 0) {
     const useBoundary =
       signature.cachePolicy?.boundary_marker || isTruthyEnv(process.env.CLAUDE_CODE_FORCE_GLOBAL_CACHE);
 
     if (useBoundary) {
-      // Heuristic: treat first half as "static" (tool defs, instructions)
-      // and second half as "dynamic" (env info, memory, etc.)
-      // Find a split point: look for blocks containing environment/date/CWD info
-      // as the boundary between static and dynamic.
+      // Global cache mode: split blocks into static (pre-boundary) and dynamic (post-boundary).
+      // Real CC (splitSysPromptPrefix boundary path):
+      //   static blocks → joined + cacheScope:'global' → cache_control:{type:'ephemeral',scope:'global',ttl:'1h'}
+      //   dynamic blocks → joined + cacheScope:null → NO cache_control
+      // We use a heuristic to find the split point (environment/date/CWD info = dynamic).
       const splitIndex = filtered.findIndex((block) => {
         const text = block.text.toLowerCase();
         return (
@@ -5808,29 +5828,29 @@ function buildSystemPromptBlocks(system, signature) {
 
       const effectiveSplit = splitIndex > 0 ? splitIndex : Math.ceil(filtered.length / 2);
 
-      // Static blocks (before boundary) get global-scope cache_control
-      for (let i = 0; i < effectiveSplit; i++) {
-        blocks.push({ ...filtered[i], cache_control: globalCacheControl });
+      // Static blocks (before boundary): joined into ONE block with global cache
+      const staticText = filtered
+        .slice(0, effectiveSplit)
+        .map((b) => b.text)
+        .join("\n\n");
+      if (staticText) {
+        blocks.push({ type: "text", text: staticText, cache_control: globalCacheControl });
       }
 
-      // Boundary marker
-      blocks.push({ type: "text", text: SYSTEM_PROMPT_DYNAMIC_BOUNDARY });
-
-      // Dynamic blocks (after boundary) get NO cache_control
-      for (let i = effectiveSplit; i < filtered.length; i++) {
-        const { cache_control: _cc, ...rest } = filtered[i];
-        blocks.push(rest);
+      // Dynamic blocks (after boundary): joined into ONE block with NO cache
+      const dynamicText = filtered
+        .slice(effectiveSplit)
+        .map((b) => b.text)
+        .join("\n\n");
+      if (dynamicText) {
+        blocks.push({ type: "text", text: dynamicText });
       }
     } else {
-      // Original behavior: only last block gets cache_control.
-      // Strip any upstream cache_control from intermediate blocks to prevent
-      // TTL ordering violations (e.g., upstream 5m followed by our 1h).
-      for (let i = 0; i < filtered.length - 1; i++) {
-        const { cache_control: _cc, ...rest } = filtered[i];
-        blocks.push(rest);
-      }
-      const lastFiltered = filtered[filtered.length - 1];
-      blocks.push({ ...lastFiltered, cache_control: baseCacheControl });
+      // Default mode (and MCP tools mode): ALL filtered blocks joined into ONE block.
+      // Real CC (splitSysPromptPrefix default/MCP path):
+      //   rest.join('\n\n') → cacheScope:'org' → cache_control:{type:'ephemeral',ttl:'1h'}
+      const joinedText = filtered.map((b) => b.text).join("\n\n");
+      blocks.push({ type: "text", text: joinedText, cache_control: baseCacheControl });
     }
   }
 
@@ -6118,7 +6138,7 @@ async function fetchLatestClaudeCodeVersion(timeoutMs = 1200) {
  * @param {string} accessToken
  * @param {string | undefined} requestBody
  * @param {URL | null} requestUrl
- * @param {{enabled: boolean, claudeCliVersion: string, strategy?: import('./lib/config.mjs').AccountSelectionStrategy, customBetas?: string[]}} signature
+ * @param {{enabled: boolean, claudeCliVersion: string, strategy?: import('./lib/config.mjs').AccountSelectionStrategy, customBetas?: string[], sessionId?: string}} signature
  * @returns {Headers}
  */
 function buildRequestHeaders(
@@ -6182,7 +6202,14 @@ function buildRequestHeaders(
   requestHeaders.set("user-agent", buildExtendedUserAgent(signature.claudeCliVersion));
   if (signature.enabled) {
     requestHeaders.set("anthropic-version", "2023-06-01");
-    requestHeaders.set("x-app", "cli");
+    // Fix #6: x-app is "cli" for interactive mode, "cli-bg" for background tasks.
+    // Real CC (client.ts:106): 'x-app': 'cli' (foreground) or 'cli-bg' (background agent).
+    requestHeaders.set("x-app", isTruthyEnv(process.env.CLAUDE_CODE_BACKGROUND) ? "cli-bg" : "cli");
+    // Fix #3: X-Claude-Code-Session-Id — sent in ALL requests by real CC (client.ts:108).
+    // Value matches metadata.user_id.session_id for server-side correlation.
+    if (signature.sessionId) {
+      requestHeaders.set("X-Claude-Code-Session-Id", signature.sessionId);
+    }
     requestHeaders.set("x-stainless-arch", getStainlessArch(process.arch));
     requestHeaders.set("x-stainless-lang", "js");
     requestHeaders.set("x-stainless-os", getStainlessOs(process.platform));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-anthropic-fix",
-  "version": "0.0.46",
+  "version": "0.0.48",
   "license": "GPL-3.0-or-later",
   "main": "./index.mjs",
   "files": [