opencode-anthropic-fix 0.1.24 → 0.1.26

package/cli.mjs

@@ -1,3 +1,4 @@
+#!/usr/bin/env node
 /**
  * CLI for managing Anthropic multi-account OAuth configuration.
  *

package/index.mjs

@@ -5,7 +5,21 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join, resolve, basename } from "node:path";
 import xxhashInit from "xxhash-wasm";
 import { AccountManager } from "./lib/accounts.mjs";
-import { authorize as oauthAuthorize, exchange as oauthExchange, refreshToken } from "./lib/oauth.mjs";
+import {
+  authorize as oauthAuthorize,
+  exchange as oauthExchange,
+  parseOAuthCallback,
+  refreshToken,
+} from "./lib/oauth.mjs";
+import {
+  FALLBACK_CLAUDE_CLI_VERSION,
+  CLAUDE_CODE_NPM_LATEST_URL,
+  CLAUDE_CODE_BUILD_TIME,
+  EXPERIMENTAL_BETA_FLAGS,
+  BETA_SHORTCUTS,
+  resolveBetaShortcut,
+  buildExtendedUserAgent,
+} from "./lib/request-headers.mjs";
 import { loadConfig, loadConfigFresh, saveConfig, CLIENT_ID, getConfigDir } from "./lib/config.mjs";
 import { loadContextHintDisabledFlag, saveContextHintDisabledFlag } from "./lib/context-hint-persist.mjs";
 import { loadAccounts, saveAccounts, clearAccounts, createDefaultStats } from "./lib/storage.mjs";
@@ -240,6 +254,15 @@ export async function AnthropicAuthPlugin({ client, project, directory, worktree
     lastHeader: null,
   };
 
+  // F4: Session-level latch for rejected custom betas.
+  // When a custom beta triggers a 400/anthropic-beta or 413-with-signal rejection,
+  // its canonical name is stored here so subsequent requests within
+  // SESSION_REJECTED_BETA_TTL_MS skip that beta without paying a first-fail each time.
+  // Memory only - not persisted to disk.
+  const SESSION_REJECTED_BETA_TTL_MS = 5 * 60 * 1000; // 5 minutes
+  /** @type {Map<string, number>} canonical-beta to rejected-at epoch ms */
+  const sessionRejectedBetas = new Map();
+
   // Context-hint controller (CC v2.1.110+). Mirrors real CC's `createContextHintController`:
   // sticky on across requests until the server responds with a specific error family.
   //   - 422/424 → apply hint compaction (clear thinking + microcompact) and retry
@@ -491,8 +514,13 @@ export async function AnthropicAuthPlugin({ client, project, directory, worktree
 
     // Validate CSRF state parameter (RFC 6749 §10.12)
     // If we stored a state, the returned code MUST include a matching state (QA fix C2)
-    const codeParts = code.split("#");
-    const returnedState = codeParts[1];
+    // parseOAuthCallback splits "code#state" or a full callback URL into parts.
+    // _parsedCode is unused after F3 fix (exchange() re-parses internally); kept
+    // only to extract returnedState for the CSRF check below.
+    const { code: _parsedCode, state: returnedState } = parseOAuthCallback(code);
+    // F3: `exchange()` calls parseOAuthCallback() internally; pass the original
+    // user input so it can forward `state` to the token endpoint.
+    // CSRF validation already done above via returnedState === pending.state.
     if (pending.state) {
       if (!returnedState || returnedState !== pending.state) {
         pendingSlashOAuth.delete(sessionID);
@@ -2627,6 +2655,7 @@ export async function AnthropicAuthPlugin({ client, project, directory, worktree
               let _adaptiveOverrideForRequest; // Cached adaptive override for all retry attempts
               let _overloadRecoveryAttempted = false; // Guard: only one quota-aware switch per request
               let _connectionResetRetries = 0; // Cap ECONNRESET/EPIPE retries to prevent infinite loop
+              let customBetasStripped = false; // One-shot latch: strip config.custom_betas once per logical request
               for (let attempt = 0; attempt < maxAttempts; attempt++) {
                 // Select account — use pinned account on first attempt if available
                 const account =
@@ -2845,12 +2874,27 @@ export async function AnthropicAuthPlugin({ client, project, directory, worktree
                   }
                 }
 
+                // F4: filter out session-rejected custom betas before building the header.
+                // This means the second+ request in the same plugin instance already omits
+                // a rejected beta without needing to pay a first-fail again.
+                const _sessionFilteredCustomBetas = customBetasStripped
+                  ? []
+                  : (config.custom_betas ?? []).filter((b) => {
+                      const canonical = resolveBetaShortcut(b);
+                      const rejectedAt = sessionRejectedBetas.get(canonical);
+                      if (rejectedAt == null) return true;
+                      if (Date.now() - rejectedAt > SESSION_REJECTED_BETA_TTL_MS) {
+                        sessionRejectedBetas.delete(canonical);
+                        return true;
+                      }
+                      return false;
+                    });
                 let computedBetaHeader = buildAnthropicBetaHeader(
                   "",
                   getSignatureEmulationEnabled(),
                   _reqModel,
                   _reqProvider,
-                  config.custom_betas,
+                  _sessionFilteredCustomBetas,
                   getEffectiveStrategy(),
                   requestUrl?.pathname,
                   _reqHasFileRefs,
@@ -2884,6 +2928,33 @@ export async function AnthropicAuthPlugin({ client, project, directory, worktree
                     merged.delete("context-hint-2026-04-09");
                     betaLatchState.sent.delete("context-hint-2026-04-09");
                   }
+                  // Custom-beta strip kill switch: when the server rejected our custom
+                  // betas (customBetasStripped latch fired), evict them from the latch so
+                  // they do not re-appear on the retry attempt.
+                  // F1: delete both the raw alias AND the canonical form so that aliases
+                  // like "cache-diag" (cache-diagnosis-2026-04-07) are fully evicted.
+                  if (customBetasStripped && config.custom_betas?.length) {
+                    for (const b of config.custom_betas) {
+                      const canonical = resolveBetaShortcut(b);
+                      merged.delete(b);
+                      merged.delete(canonical);
+                      betaLatchState.sent.delete(b);
+                      betaLatchState.sent.delete(canonical);
+                    }
+                  }
+                  // F4: Evict session-rejected betas from the latch on every request so
+                  // they cannot re-enter the sent set from a prior latched header.
+                  if (sessionRejectedBetas.size > 0) {
+                    const _now = Date.now();
+                    for (const [_canonical, _rejectedAt] of sessionRejectedBetas) {
+                      if (_now - _rejectedAt <= SESSION_REJECTED_BETA_TTL_MS) {
+                        merged.delete(_canonical);
+                        betaLatchState.sent.delete(_canonical);
+                      } else {
+                        sessionRejectedBetas.delete(_canonical);
+                      }
+                    }
+                  }
                   computedBetaHeader = [...merged].join(",");
                   betaLatchState.lastHeader = computedBetaHeader;
                 }
@@ -2961,7 +3032,7 @@ export async function AnthropicAuthPlugin({ client, project, directory, worktree
                   {
                     enabled: getSignatureEmulationEnabled(),
                     claudeCliVersion,
-                    customBetas: config.custom_betas,
+                    customBetas: _sessionFilteredCustomBetas,
                     strategy: getEffectiveStrategy(),
                     sessionId: signatureSessionId,
                   },
@@ -3390,6 +3461,51 @@ export async function AnthropicAuthPlugin({ client, project, directory, worktree
                     }
                   }
 
+                  // Selective custom-beta retry: if the server rejects the request citing an
+                  // anthropic-beta issue not caught by the context-hint handler above, strip
+                  // config.custom_betas once and retry.
+                  // F2: 413 only triggers this path when the body contains an explicit signal
+                  // keyword (anthropic-beta, beta header, unsupported/unknown/invalid beta,
+                  // context_window, long context, 1m/million context) to avoid false positives
+                  // on generic 413s (e.g. plain upload-size limits with an empty body).
+                  // One retry per logical request (latch prevents loop).
+                  if (
+                    !customBetasStripped &&
+                    (config.custom_betas?.length ?? 0) > 0 &&
+                    ((response.status === 400 &&
+                      errorBody &&
+                      errorBody.includes("anthropic-beta") &&
+                      !errorBody.includes("context-hint")) ||
+                      (response.status === 413 &&
+                        errorBody &&
+                        /anthropic-beta|beta header|unsupported beta|unknown beta|invalid beta|context_window|long context|1m context|million context/i.test(
+                          errorBody,
+                        )))
+                  ) {
+                    customBetasStripped = true;
+                    // F4: record rejection in session latch so next logical request already
+                    // omits the rejected beta without needing a first-fail.
+                    // Only record betas explicitly mentioned in the error body (raw or canonical);
+                    // fall back to recording all custom betas if the body names none specifically.
+                    {
+                      const _allCustom = config.custom_betas ?? [];
+                      const _mentioned = _allCustom.filter((_sb) => {
+                        const _rawLc = _sb.toLowerCase();
+                        const _canLc = resolveBetaShortcut(_sb).toLowerCase();
+                        const _bodyLc = (errorBody || "").toLowerCase();
+                        return _bodyLc.includes(_rawLc) || _bodyLc.includes(_canLc);
+                      });
+                      const _toRecord = _mentioned.length > 0 ? _mentioned : _allCustom;
+                      const _recordedAt = Date.now();
+                      for (const _sb of _toRecord) {
+                        sessionRejectedBetas.set(resolveBetaShortcut(_sb), _recordedAt);
+                      }
+                    }
+                    attempt--;
+                    debugLog("custom beta/context rejection - retrying without custom betas");
+                    continue;
+                  }
+
                   // Reactive compaction: on "prompt too long" error, trim oldest messages and retry once
                   if (
                     response.status === 400 &&
@@ -5390,61 +5506,6 @@ process.once("beforeExit", _beforeExitHandler);
 // Request building helpers (extracted from original fetch interceptor)
 // ---------------------------------------------------------------------------
 
-const FALLBACK_CLAUDE_CLI_VERSION = "2.1.119";
-const CLAUDE_CODE_NPM_LATEST_URL = "https://registry.npmjs.org/@anthropic-ai/claude-code/latest";
-const CLAUDE_CODE_BUILD_TIME = "2026-04-23T19:08:52Z";
-
-// The @anthropic-ai/sdk version bundled with Claude Code.
-// This is distinct from the CLI version and goes in X-Stainless-Package-Version.
-// v2.1.107 switched from @anthropic-ai/sdk v0.208.0 to v0.81.0 (confirmed via bundle var x$H="0.81.0").
-// Still 0.81.0 in v2.1.119 (verified via strings extraction from native Bun binary;
-// adds cache-diagnosis-2026-04-07 beta gated by GrowthBook tengu_prompt_cache_diagnostics;
-// no other beta additions/removals vs 2.1.117; OAuth flow unchanged).
-const ANTHROPIC_SDK_VERSION = "0.81.0";
-
-// Map of CLI version → bundled SDK version (update when CLI version changes)
-const CLI_TO_SDK_VERSION = new Map([
-  ["2.1.119", "0.81.0"],
-  ["2.1.117", "0.81.0"],
-  ["2.1.116", "0.81.0"],
-  ["2.1.115", "0.81.0"],
-  ["2.1.114", "0.81.0"],
-  ["2.1.113", "0.81.0"],
-  ["2.1.112", "0.81.0"],
-  ["2.1.111", "0.81.0"],
-  ["2.1.110", "0.81.0"],
-  ["2.1.109", "0.81.0"],
-  ["2.1.108", "0.81.0"],
-  ["2.1.107", "0.81.0"],
-  ["2.1.105", "0.81.0"],
-  ["2.1.97", "0.208.0"],
-  ["2.1.96", "0.208.0"],
-  ["2.1.95", "0.208.0"],
-  ["2.1.94", "0.208.0"],
-  ["2.1.93", "0.208.0"],
-  ["2.1.92", "0.208.0"],
-  ["2.1.91", "0.208.0"],
-  ["2.1.90", "0.208.0"],
-  ["2.1.89", "0.208.0"],
-  ["2.1.88", "0.208.0"],
-  ["2.1.87", "0.208.0"],
-  ["2.1.86", "0.208.0"],
-  ["2.1.85", "0.208.0"],
-  ["2.1.84", "0.208.0"],
-  ["2.1.83", "0.208.0"],
-  ["2.1.81", "0.208.0"],
-  ["2.1.80", "0.208.0"],
-]);
-
-/**
- * Get the SDK version corresponding to a CLI version.
- * Falls back to ANTHROPIC_SDK_VERSION constant.
- * @param {string} cliVersion
- * @returns {string}
- */
-function getSdkVersion(cliVersion) {
-  return CLI_TO_SDK_VERSION.get(cliVersion) ?? ANTHROPIC_SDK_VERSION;
-}
 const BILLING_HASH_SALT = "59cf53e54c78";
 const BILLING_HASH_INDICES = [4, 7, 20];
 
@@ -6216,42 +6277,6 @@ const CORE_TOOL_NAMES = new Set([
   "Compress",
 ]);
 const HOST_SDK_BETAS_BLOCKLIST = new Set(["fine-grained-tool-streaming-2025-05-14", "structured-outputs-2025-11-13"]);
-const EXPERIMENTAL_BETA_FLAGS = new Set([
-  "adaptive-thinking-2026-01-28",
-  "advanced-tool-use-2025-11-20",
-  "advisor-tool-2026-03-01",
-  "afk-mode-2026-01-31",
-  "cache-diagnosis-2026-04-07",
-  "code-execution-2025-08-25",
-  "compact-2026-01-12",
-  "context-1m-2025-08-07",
-  "context-hint-2026-04-09",
-  "context-management-2025-06-27",
-  "fast-mode-2026-02-01",
-  "files-api-2025-04-14",
-  "interleaved-thinking-2025-05-14",
-  "prompt-caching-scope-2026-01-05",
-  "redact-thinking-2026-02-12",
-  "structured-outputs-2025-12-15",
-  "task-budgets-2026-03-13",
-  "tool-search-tool-2025-10-19",
-  "web-search-2025-03-05",
-]);
-const BETA_SHORTCUTS = new Map([
-  ["1m", "context-1m-2025-08-07"],
-  ["1m-context", "context-1m-2025-08-07"],
-  ["context-1m", "context-1m-2025-08-07"],
-  ["cache-diagnosis", "cache-diagnosis-2026-04-07"],
-  ["cache-diag", "cache-diagnosis-2026-04-07"],
-  ["context-hint", "context-hint-2026-04-09"],
-  ["hint", "context-hint-2026-04-09"],
-  ["fast", "fast-mode-2026-02-01"],
-  ["fast-mode", "fast-mode-2026-02-01"],
-  ["opus-fast", "fast-mode-2026-02-01"],
-  ["task-budgets", "task-budgets-2026-03-13"],
-  ["budgets", "task-budgets-2026-03-13"],
-  ["redact-thinking", "redact-thinking-2026-02-12"],
-]);
 const STAINLESS_HELPER_KEYS = [
   "x_stainless_helper",
   "x-stainless-helper",
@@ -6355,17 +6380,6 @@ function isFalsyEnv(value) {
   return normalized === "0" || normalized === "false" || normalized === "no";
 }
 
-/**
- * @param {string | undefined} value
- * @returns {string}
- */
-function resolveBetaShortcut(value) {
-  if (!value) return "";
-  const trimmed = value.trim();
-  const mapped = BETA_SHORTCUTS.get(trimmed.toLowerCase());
-  return mapped || trimmed;
-}
-
 /**
  * @returns {boolean}
  */
@@ -6374,22 +6388,6 @@ function isNonInteractiveMode() {
   return !process.stdout.isTTY;
 }
 
-/**
- * Build the extended User-Agent for API calls.
- * Real CC v96 sends "claude-cli/{version} (external, {entrypoint})" — confirmed via
- * proxy capture of real CC on Windows/Node.js.
- * @param {string} version
- * @returns {string}
- */
-function buildExtendedUserAgent(version) {
-  const entrypoint = process.env.CLAUDE_CODE_ENTRYPOINT ?? "cli";
-  const sdkVersion = process.env.CLAUDE_AGENT_SDK_VERSION ? `, agent-sdk/${process.env.CLAUDE_AGENT_SDK_VERSION}` : "";
-  const clientApp = process.env.CLAUDE_AGENT_SDK_CLIENT_APP
-    ? `, client-app/${process.env.CLAUDE_AGENT_SDK_CLIENT_APP}`
-    : "";
-  return `claude-cli/${version} (external, ${entrypoint}${sdkVersion}${clientApp})`;
-}
-
 /**
  * @returns {Record<string, string>}
  */
@@ -7410,6 +7408,12 @@ function buildAnthropicBetaHeader(
     betas.push("context-hint-2026-04-09");
   }
 
+  // extended-cache-ttl-2025-04-11 — found in CC v2.1.133. Extends server-side
+  // prompt cache TTL. Auto-on for 1P + Claude 4+ to improve cache hit rates.
+  if (isFirstPartyProvider && !/claude-3-/i.test(model)) {
+    betas.push("extended-cache-ttl-2025-04-11");
+  }
+
   // Files API — scoped to file endpoints/references
   if (isFilesEndpoint || hasFileReferences) {
     betas.push("files-api-2025-04-14");
@@ -7800,6 +7804,18 @@ function transformRequestBody(body, signature, runtime, betaHeader, config) {
       delete parsed.effort;
     }
 
+    // Claude Code v2.1.117+: default effort for Pro/Max on adaptive models is
+    // "high" (was "medium"). If the host omits effort entirely, inject the
+    // default so the wire shape matches real CC.
+    if (parsed.model && isAdaptiveThinkingModel(parsed.model)) {
+      if (!parsed.output_config || typeof parsed.output_config !== "object") {
+        parsed.output_config = {};
+      }
+      if (!("effort" in parsed.output_config)) {
+        parsed.output_config.effort = "high";
+      }
+    }
+
     // Claude Code temperature rule: when extended thinking is active (any type),
     // temperature must be omitted (undefined). Otherwise default to 1.
     const thinkingActive =
@@ -8824,7 +8840,9 @@ async function refreshAccountToken(account, client, source = "foreground", { onT
   try {
     const diskAuthBeforeRefresh = await readDiskAccountAuth(account.id);
     const adopted = applyDiskAuthIfFresher(account, diskAuthBeforeRefresh);
-    if (source === "foreground" && adopted && account.access && account.expires && account.expires > Date.now()) {
+    // Apply fresher disk tokens for both foreground and idle paths — prevents an
+    // unnecessary HTTP refresh when another process already rotated the token.
+    if (adopted && account.access && account.expires && account.expires > Date.now()) {
       return account.access;
     }
 

package/lib/oauth.mjs

@@ -179,6 +179,84 @@ export async function authorize(mode) {
   };
 }
 
+/**
+ * Parse an OAuth callback input into { code, state }.
+ *
+ * Tolerates all these input shapes:
+ *  - Full redirect URL:   "https://host/path?code=X&state=Y"
+ *  - Query string:        "?code=X&state=Y" or "code=X&state=Y"
+ *  - Hash fragment URL:   "https://host/path#code=X&state=Y"
+ *  - Hash fragment bare:  "#code=X&state=Y"
+ *  - Legacy code#state:   "abc123#statevalue"
+ *  - Plain code:          "abc123"
+ *
+ * Inputs are trimmed. URLSearchParams decoding is applied where applicable.
+ * @param {string | null | undefined} input
+ * @returns {{ code: string, state: string | null }}
+ */
+export function parseOAuthCallback(input) {
+  if (!input || typeof input !== "string") return { code: "", state: null };
+  const trimmed = input.trim();
+  if (!trimmed) return { code: "", state: null };
+
+  // --- Attempt 1: full URL (https://... or http://...) ---
+  if (trimmed.includes("://")) {
+    try {
+      const url = new URL(trimmed);
+      // Prefer hash params if they carry a "code" key (some OAuth flows use fragment)
+      const hashStr = url.hash.slice(1);
+      if (hashStr && hashStr.includes("=")) {
+        const hashParams = new URLSearchParams(hashStr);
+        const hCode = hashParams.get("code");
+        if (hCode) return { code: hCode, state: hashParams.get("state") };
+      }
+      const qCode = url.searchParams.get("code");
+      if (qCode) return { code: qCode, state: url.searchParams.get("state") };
+    } catch {
+      // fall through
+    }
+  }
+
+  // --- Attempt 2: query string ("?code=X&state=Y" or "code=X&state=Y") ---
+  {
+    const qs = trimmed.startsWith("?") ? trimmed.slice(1) : trimmed;
+    if (qs.includes("=") && (qs.startsWith("code") || qs.includes("&code"))) {
+      try {
+        const params = new URLSearchParams(qs);
+        const qCode = params.get("code");
+        if (qCode) return { code: qCode, state: params.get("state") };
+      } catch {
+        // fall through
+      }
+    }
+  }
+
+  // --- Attempt 3: hash fragment bare ("#code=X&state=Y") ---
+  if (trimmed.startsWith("#")) {
+    const hashStr = trimmed.slice(1);
+    if (hashStr.includes("=")) {
+      try {
+        const params = new URLSearchParams(hashStr);
+        const hCode = params.get("code");
+        if (hCode) return { code: hCode, state: params.get("state") };
+      } catch {
+        // fall through
+      }
+    }
+  }
+
+  // --- Attempt 4: "code#state" bare format ---
+  const hashIdx = trimmed.indexOf("#");
+  if (hashIdx > 0) {
+    const codePart = trimmed.slice(0, hashIdx);
+    const statePart = trimmed.slice(hashIdx + 1);
+    return { code: codePart, state: statePart || null };
+  }
+
+  // --- Attempt 5: plain code ---
+  return { code: trimmed, state: null };
+}
+
 /**
  * Exchange an authorization code for tokens.
  * @param {string} code
@@ -220,10 +298,18 @@ export async function exchange(code, verifier) {
     };
   };
 
-  const splits = code.split("#");
+  const { code: _authCode, state: _authState } = parseOAuthCallback(code);
   let result;
   for (let attempt = 0; attempt <= OAUTH_MAX_RETRIES; attempt++) {
     try {
+      const _exchangeBody = {
+        grant_type: "authorization_code",
+        code: _authCode,
+        redirect_uri: OAUTH_REDIRECT_URI,
+        client_id: CLIENT_ID,
+        code_verifier: verifier,
+        ...(_authState != null ? { state: _authState } : {}),
+      };
       result = await fetch(OAUTH_TOKEN_URL, {
         method: "POST",
         headers: {
@@ -231,14 +317,7 @@ export async function exchange(code, verifier) {
           "Content-Type": "application/json",
           "User-Agent": OAUTH_USER_AGENT,
         },
-        body: JSON.stringify({
-          grant_type: "authorization_code",
-          code: splits[0],
-          redirect_uri: OAUTH_REDIRECT_URI,
-          client_id: CLIENT_ID,
-          code_verifier: verifier,
-          state: splits[1],
-        }),
+        body: JSON.stringify(_exchangeBody),
         signal: AbortSignal.timeout(15_000),
       });
     } catch (err) {

package/lib/oauth.test.mjs

@@ -1,5 +1,5 @@
 import { beforeEach, afterEach, describe, expect, it, vi } from "vitest";
-import { exchange, refreshToken, revoke } from "./oauth.mjs";
+import { exchange, parseOAuthCallback, refreshToken, revoke } from "./oauth.mjs";
 
 const mockFetch = vi.fn();
 
@@ -164,3 +164,122 @@ describe("oauth headers", () => {
     }
   });
 });
+
+describe("parseOAuthCallback", () => {
+  it("returns empty code and null state for empty/falsy input", () => {
+    expect(parseOAuthCallback("")).toEqual({ code: "", state: null });
+    expect(parseOAuthCallback("   ")).toEqual({ code: "", state: null });
+    expect(parseOAuthCallback(null)).toEqual({ code: "", state: null });
+  });
+
+  it("handles plain authorization code (no state)", () => {
+    expect(parseOAuthCallback("myplaincode123")).toEqual({ code: "myplaincode123", state: null });
+  });
+
+  it("trims surrounding whitespace from plain code", () => {
+    expect(parseOAuthCallback("  abc123  ")).toEqual({ code: "abc123", state: null });
+  });
+
+  it("parses legacy code#state bare format", () => {
+    expect(parseOAuthCallback("authcode#statetoken")).toEqual({ code: "authcode", state: "statetoken" });
+  });
+
+  it("returns null state when # present but empty state segment", () => {
+    expect(parseOAuthCallback("authcode#")).toEqual({ code: "authcode", state: null });
+  });
+
+  it("parses full redirect URL with query params", () => {
+    expect(parseOAuthCallback("https://example.com/callback?code=MYCODE&state=MYSTATE")).toEqual({
+      code: "MYCODE",
+      state: "MYSTATE",
+    });
+  });
+
+  it("parses full redirect URL with only code param", () => {
+    expect(parseOAuthCallback("https://example.com/callback?code=ONLYCODE")).toEqual({
+      code: "ONLYCODE",
+      state: null,
+    });
+  });
+
+  it("parses query string with leading ?", () => {
+    expect(parseOAuthCallback("?code=QS_CODE&state=QS_STATE")).toEqual({
+      code: "QS_CODE",
+      state: "QS_STATE",
+    });
+  });
+
+  it("parses bare query string without leading ?", () => {
+    expect(parseOAuthCallback("code=BARE_CODE&state=BARE_STATE")).toEqual({
+      code: "BARE_CODE",
+      state: "BARE_STATE",
+    });
+  });
+
+  it("parses hash fragment URL (OAuth implicit / SPA flows)", () => {
+    expect(parseOAuthCallback("https://example.com/callback#code=HASH_CODE&state=HASH_STATE")).toEqual({
+      code: "HASH_CODE",
+      state: "HASH_STATE",
+    });
+  });
+
+  it("parses bare hash fragment string", () => {
+    expect(parseOAuthCallback("#code=HFRAG_CODE&state=HFRAG_STATE")).toEqual({
+      code: "HFRAG_CODE",
+      state: "HFRAG_STATE",
+    });
+  });
+
+  it("URL-decodes percent-encoded code and state values", () => {
+    expect(parseOAuthCallback("?code=hello%20world&state=foo%2Bbar")).toEqual({
+      code: "hello world",
+      state: "foo+bar",
+    });
+  });
+
+  it("returns empty string (not null) when state query param is present but empty", () => {
+    // state= is explicitly present with an empty value; URLSearchParams.get() returns ""
+    // for keys that exist with no value, so state is "" not null.
+    expect(parseOAuthCallback("?code=CODE&state=")).toEqual({ code: "CODE", state: "" });
+  });
+
+  it("exchange function uses parseOAuthCallback internally (code#state still works)", async () => {
+    const mockFetch = vi.fn().mockResolvedValueOnce({
+      ok: true,
+      status: 200,
+      headers: { get: () => null },
+      json: async () => ({ access_token: "test_token", token_type: "bearer" }),
+      text: async () => '{"access_token":"test_token","token_type":"bearer"}',
+    });
+    vi.stubGlobal("fetch", mockFetch);
+    try {
+      await exchange("CODE_VALUE#STATE_VALUE", "verifier123");
+      expect(mockFetch).toHaveBeenCalledTimes(1);
+      const bodyStr = mockFetch.mock.calls[0][1].body;
+      const body = JSON.parse(bodyStr);
+      expect(body.code).toBe("CODE_VALUE");
+      expect(body.state).toBe("STATE_VALUE");
+    } finally {
+      vi.unstubAllGlobals();
+    }
+  });
+
+  it("exchange omits state field in body when input is a plain code", async () => {
+    const mockFetch = vi.fn().mockResolvedValueOnce({
+      ok: false,
+      status: 400,
+      headers: { get: () => null },
+      text: async () => "",
+    });
+    vi.stubGlobal("fetch", mockFetch);
+    try {
+      await exchange("PLAINCODE", "verifier456");
+      const bodyStr = mockFetch.mock.calls[0][1].body;
+      const body = JSON.parse(bodyStr);
+      expect(body.code).toBe("PLAINCODE");
+      expect(Object.prototype.hasOwnProperty.call(body, "state")).toBe(false);
+    } finally {
+      vi.unstubAllGlobals();
+    }
+  });
+});

package/lib/request-headers.mjs

@@ -0,0 +1,174 @@
+/**
+ * Pure header/mimicry helpers extracted from index.mjs.
+ * No runtime state, no imports needed - all values are self-contained constants
+ * or derive from process.env at call time.
+ *
+ * Exported:
+ *  - Version/build/SDK constants and CLI_TO_SDK_VERSION map
+ *  - getSdkVersion(cliVersion)
+ *  - EXPERIMENTAL_BETA_FLAGS  (Set<string>)
+ *  - BETA_SHORTCUTS            (Map<string, string>)
+ *  - resolveBetaShortcut(value)
+ *  - buildExtendedUserAgent(version)
+ */
+
+// ---------------------------------------------------------------------------
+// Version / build / SDK constants
+// ---------------------------------------------------------------------------
+
+export const FALLBACK_CLAUDE_CLI_VERSION = "2.1.133";
+export const CLAUDE_CODE_NPM_LATEST_URL = "https://registry.npmjs.org/@anthropic-ai/claude-code/latest";
+export const CLAUDE_CODE_BUILD_TIME = "2026-05-07T18:26:46Z";
+
+// The @anthropic-ai/sdk version bundled with Claude Code.
+// This is distinct from the CLI version and goes in X-Stainless-Package-Version.
+// v2.1.107 switched from @anthropic-ai/sdk v0.208.0 to v0.81.0 (confirmed via bundle var x$H="0.81.0").
+// Still 0.81.0 in v2.1.133 (verified via changelog; 2.1.120-2.1.133 are OAuth/MCP/Bedrock
+// fixes with no SDK version bump; cache-diagnosis-2026-04-07 added in 2.1.119 behind
+// GrowthBook tengu_prompt_cache_diagnostics; default effort changed to "high" in 2.1.117).
+export const ANTHROPIC_SDK_VERSION = "0.81.0";
+
+// Map of CLI version to bundled SDK version (update when CLI version changes)
+export const CLI_TO_SDK_VERSION = new Map([
+  ["2.1.133", "0.81.0"],
+  ["2.1.132", "0.81.0"],
+  ["2.1.131", "0.81.0"],
+  ["2.1.130", "0.81.0"],
+  ["2.1.129", "0.81.0"],
+  ["2.1.128", "0.81.0"],
+  ["2.1.127", "0.81.0"],
+  ["2.1.126", "0.81.0"],
+  ["2.1.125", "0.81.0"],
+  ["2.1.124", "0.81.0"],
+  ["2.1.123", "0.81.0"],
+  ["2.1.122", "0.81.0"],
+  ["2.1.121", "0.81.0"],
+  ["2.1.120", "0.81.0"],
+  ["2.1.119", "0.81.0"],
+  ["2.1.117", "0.81.0"],
+  ["2.1.116", "0.81.0"],
+  ["2.1.115", "0.81.0"],
+  ["2.1.114", "0.81.0"],
+  ["2.1.113", "0.81.0"],
+  ["2.1.112", "0.81.0"],
+  ["2.1.111", "0.81.0"],
+  ["2.1.110", "0.81.0"],
+  ["2.1.109", "0.81.0"],
+  ["2.1.108", "0.81.0"],
+  ["2.1.107", "0.81.0"],
+  ["2.1.105", "0.81.0"],
+  ["2.1.97", "0.208.0"],
+  ["2.1.96", "0.208.0"],
+  ["2.1.95", "0.208.0"],
+  ["2.1.94", "0.208.0"],
+  ["2.1.93", "0.208.0"],
+  ["2.1.92", "0.208.0"],
+  ["2.1.91", "0.208.0"],
+  ["2.1.90", "0.208.0"],
+  ["2.1.89", "0.208.0"],
+  ["2.1.88", "0.208.0"],
+  ["2.1.87", "0.208.0"],
+  ["2.1.86", "0.208.0"],
+  ["2.1.85", "0.208.0"],
+  ["2.1.84", "0.208.0"],
+  ["2.1.83", "0.208.0"],
+  ["2.1.81", "0.208.0"],
+  ["2.1.80", "0.208.0"],
+]);
+
+/**
+ * Get the SDK version corresponding to a CLI version.
+ * Falls back to ANTHROPIC_SDK_VERSION constant.
+ * @param {string | null | undefined} cliVersion
+ * @returns {string}
+ */
+export function getSdkVersion(cliVersion) {
+  return CLI_TO_SDK_VERSION.get(cliVersion) ?? ANTHROPIC_SDK_VERSION;
+}
+
+// ---------------------------------------------------------------------------
+// Beta flag registries
+// ---------------------------------------------------------------------------
+
+/**
+ * Set of all known experimental/optional beta flags.
+ * Used to filter betas when CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1.
+ * WARNING: this set intentionally overlaps with always-on betas - only use
+ * it with the disable-experimental guard, never unconditionally.
+ */
+export const EXPERIMENTAL_BETA_FLAGS = new Set([
+  "adaptive-thinking-2026-01-28",
+  "advanced-tool-use-2025-11-20",
+  "advisor-tool-2026-03-01",
+  "afk-mode-2026-01-31",
+  "cache-diagnosis-2026-04-07",
+  "code-execution-2025-08-25",
+  "compact-2026-01-12",
+  "context-1m-2025-08-07",
+  "context-hint-2026-04-09",
+  "context-management-2025-06-27",
+  "environments-2025-11-01",
+  "extended-cache-ttl-2025-04-11",
+  "fast-mode-2026-02-01",
+  "files-api-2025-04-14",
+  "interleaved-thinking-2025-05-14",
+  "prompt-caching-scope-2026-01-05",
+  "redact-thinking-2026-02-12",
+  "structured-outputs-2025-12-15",
+  "task-budgets-2026-03-13",
+  "tool-search-tool-2025-10-19",
+  "web-search-2025-03-05",
+]);
+
+/** Friendly shortcut aliases for config.custom_betas values. */
+export const BETA_SHORTCUTS = new Map([
+  ["1m", "context-1m-2025-08-07"],
+  ["1m-context", "context-1m-2025-08-07"],
+  ["context-1m", "context-1m-2025-08-07"],
+  ["cache-diagnosis", "cache-diagnosis-2026-04-07"],
+  ["cache-diag", "cache-diagnosis-2026-04-07"],
+  ["cache-ttl", "extended-cache-ttl-2025-04-11"],
+  ["context-hint", "context-hint-2026-04-09"],
+  ["environments", "environments-2025-11-01"],
+  ["extended-cache-ttl", "extended-cache-ttl-2025-04-11"],
+  ["hint", "context-hint-2026-04-09"],
+  ["fast", "fast-mode-2026-02-01"],
+  ["fast-mode", "fast-mode-2026-02-01"],
+  ["opus-fast", "fast-mode-2026-02-01"],
+  ["task-budgets", "task-budgets-2026-03-13"],
+  ["budgets", "task-budgets-2026-03-13"],
+  ["redact-thinking", "redact-thinking-2026-02-12"],
+]);
+
+// ---------------------------------------------------------------------------
+// Helper functions
+// ---------------------------------------------------------------------------
+
+/**
+ * Resolve a beta shortcut alias to its canonical flag name.
+ * Returns the value unchanged if no alias matches.
+ * @param {string | null | undefined} value
+ * @returns {string}
+ */
+export function resolveBetaShortcut(value) {
+  if (!value) return "";
+  const trimmed = value.trim();
+  const mapped = BETA_SHORTCUTS.get(trimmed.toLowerCase());
+  return mapped || trimmed;
+}
+
+/**
+ * Build the extended User-Agent for API calls.
+ * Real CC v96 sends "claude-cli/{version} (external, {entrypoint})" - confirmed via
+ * proxy capture of real CC on Windows/Node.js.
+ * @param {string} version
+ * @returns {string}
+ */
+export function buildExtendedUserAgent(version) {
+  const entrypoint = process.env.CLAUDE_CODE_ENTRYPOINT ?? "cli";
+  const sdkVersion = process.env.CLAUDE_AGENT_SDK_VERSION ? `, agent-sdk/${process.env.CLAUDE_AGENT_SDK_VERSION}` : "";
+  const clientApp = process.env.CLAUDE_AGENT_SDK_CLIENT_APP
+    ? `, client-app/${process.env.CLAUDE_AGENT_SDK_CLIENT_APP}`
+    : "";
+  return `claude-cli/${version} (external, ${entrypoint}${sdkVersion}${clientApp})`;
+}

package/lib/request-headers.test.mjs

@@ -0,0 +1,125 @@
+/**
+ * Smoke tests for lib/request-headers.mjs exports.
+ * Verifies version constants, beta shortcuts, and user-agent builder.
+ */
+import { describe, it, expect, afterEach } from "vitest";
+import {
+  FALLBACK_CLAUDE_CLI_VERSION,
+  ANTHROPIC_SDK_VERSION,
+  getSdkVersion,
+  BETA_SHORTCUTS,
+  resolveBetaShortcut,
+  buildExtendedUserAgent,
+} from "./request-headers.mjs";
+
+describe("request-headers constants", () => {
+  it("FALLBACK_CLAUDE_CLI_VERSION is 2.1.133", () => {
+    expect(FALLBACK_CLAUDE_CLI_VERSION).toBe("2.1.133");
+  });
+
+  it("ANTHROPIC_SDK_VERSION matches expected value", () => {
+    expect(typeof ANTHROPIC_SDK_VERSION).toBe("string");
+    expect(ANTHROPIC_SDK_VERSION).toMatch(/^\d+\.\d+\.\d+$/);
+  });
+});
+
+describe("getSdkVersion", () => {
+  it("returns known SDK version for CLI version 2.1.133", () => {
+    // 2.1.133 is in the VERSION_TO_SDK_MAP
+    const v = getSdkVersion("2.1.133");
+    expect(typeof v).toBe("string");
+    expect(v).toMatch(/^\d+\.\d+\.\d+$/);
+  });
+
+  it("falls back to ANTHROPIC_SDK_VERSION for an unknown CLI version", () => {
+    expect(getSdkVersion("9.99.999")).toBe(ANTHROPIC_SDK_VERSION);
+  });
+
+  it("falls back for undefined/null input", () => {
+    expect(getSdkVersion(undefined)).toBe(ANTHROPIC_SDK_VERSION);
+    expect(getSdkVersion(null)).toBe(ANTHROPIC_SDK_VERSION);
+  });
+});
+
+describe("BETA_SHORTCUTS", () => {
+  it("is a Map", () => {
+    expect(BETA_SHORTCUTS).toBeInstanceOf(Map);
+  });
+
+  it("has cache-diagnosis shortcut resolving to cache-diagnosis-2026-04-07", () => {
+    expect(BETA_SHORTCUTS.get("cache-diagnosis")).toBe("cache-diagnosis-2026-04-07");
+  });
+
+  it("has a cache-diag alias for cache-diagnosis-2026-04-07", () => {
+    expect(BETA_SHORTCUTS.get("cache-diag")).toBe("cache-diagnosis-2026-04-07");
+  });
+});
+
+describe("resolveBetaShortcut", () => {
+  it("expands cache-diagnosis shortcut", () => {
+    expect(resolveBetaShortcut("cache-diagnosis")).toBe("cache-diagnosis-2026-04-07");
+  });
+
+  it("expands cache-diag alias", () => {
+    expect(resolveBetaShortcut("cache-diag")).toBe("cache-diagnosis-2026-04-07");
+  });
+
+  it("expands 1m shortcut", () => {
+    expect(resolveBetaShortcut("1m")).toBe("context-1m-2025-08-07");
+  });
+
+  it("expands fast shortcut", () => {
+    expect(resolveBetaShortcut("fast")).toBe("fast-mode-2026-02-01");
+  });
+
+  it("returns the input unchanged when no alias matches", () => {
+    expect(resolveBetaShortcut("context-hint-2026-04-09")).toBe("context-hint-2026-04-09");
+    expect(resolveBetaShortcut("no-such-beta")).toBe("no-such-beta");
+  });
+
+  it("returns empty string for falsy/empty input", () => {
+    expect(resolveBetaShortcut(undefined)).toBe("");
+    expect(resolveBetaShortcut("")).toBe("");
+    expect(resolveBetaShortcut(null)).toBe("");
+  });
+});
+
+describe("buildExtendedUserAgent", () => {
+  afterEach(() => {
+    delete process.env.CLAUDE_CODE_ENTRYPOINT;
+    delete process.env.CLAUDE_AGENT_SDK_VERSION;
+    delete process.env.CLAUDE_AGENT_SDK_CLIENT_APP;
+  });
+
+  it("returns default cli format without env vars", () => {
+    delete process.env.CLAUDE_CODE_ENTRYPOINT;
+    delete process.env.CLAUDE_AGENT_SDK_VERSION;
+    delete process.env.CLAUDE_AGENT_SDK_CLIENT_APP;
+    const ua = buildExtendedUserAgent("2.1.133");
+    expect(ua).toBe("claude-cli/2.1.133 (external, cli)");
+  });
+
+  it("uses CLAUDE_CODE_ENTRYPOINT when set", () => {
+    process.env.CLAUDE_CODE_ENTRYPOINT = "vscode";
+    const ua = buildExtendedUserAgent("2.1.133");
+    expect(ua).toBe("claude-cli/2.1.133 (external, vscode)");
+  });
+
+  it("appends agent-sdk suffix when CLAUDE_AGENT_SDK_VERSION is set", () => {
+    process.env.CLAUDE_AGENT_SDK_VERSION = "1.2.3";
+    const ua = buildExtendedUserAgent("2.1.133");
+    expect(ua).toContain("agent-sdk/1.2.3");
+    expect(ua).toMatch(/^claude-cli\/2\.1\.133/);
+  });
+
+  it("appends client-app suffix when CLAUDE_AGENT_SDK_CLIENT_APP is set", () => {
+    process.env.CLAUDE_AGENT_SDK_CLIENT_APP = "myapp";
+    const ua = buildExtendedUserAgent("2.1.133");
+    expect(ua).toContain("client-app/myapp");
+  });
+
+  it("uses FALLBACK_CLAUDE_CLI_VERSION when explicitly passed as the version", () => {
+    const ua = buildExtendedUserAgent(FALLBACK_CLAUDE_CLI_VERSION);
+    expect(ua).toContain(FALLBACK_CLAUDE_CLI_VERSION);
+  });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-anthropic-fix",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "license": "GPL-3.0-or-later",
   "repository": {
     "type": "git",