opencode-anthropic-fix 0.1.29 → 0.1.31

package/index.mjs

@@ -30,6 +30,7 @@ import {
   parseRateLimitReason,
   parseRetryAfterHeader,
   parseRetryAfterMsHeader,
+  parseUnifiedResetMsHeader,
   parseShouldRetryHeader,
   TRANSIENT_RETRY_THRESHOLD_MS,
 } from "./lib/backoff.mjs";
@@ -3745,7 +3746,10 @@ export async function AnthropicAuthPlugin({ client, project, directory, worktree
                   // Account-specific errors (429/401/billing/permission)
                   if (accountSpecific) {
                     const reason = parseRateLimitReason(response.status, errorBody);
-                    const retryAfterMs = parseRetryAfterMsHeader(response) ?? parseRetryAfterHeader(response);
+                    const retryAfterMs =
+                      parseRetryAfterMsHeader(response) ??
+                      parseRetryAfterHeader(response) ??
+                      parseUnifiedResetMsHeader(response);
 
                     // Transient 429: short retry-after (<=10s) is a burst throttle.
                     // Retry on the SAME account instead of rotating — avoids wasting
@@ -6661,7 +6665,7 @@ function getClaudeEntrypoint() {
 }
 
 /**
- * @param {string | undefined} body
+ * @param {string | undefined} model
  * @returns {string | undefined}
  */
 function logTransformedSystemPrompt(body) {
@@ -6773,8 +6777,33 @@ function isSonnet46Model(model) {
  * @param {string | undefined} body
  * @returns {boolean}
  */
-function isAdaptiveThinkingModel(model) {
-  return isOpus46Model(model) || isOpus47Model(model) || isOpus48Model(model) || isSonnet46Model(model);
+export function isFable5Model(model) {
+  if (!model) return false;
+  return /claude-fable-5|fable[._-]5/i.test(model);
+}
+
+/**
+ * @param {string | undefined} model
+ * @returns {boolean}
+ */
+export function isMythos5Model(model) {
+  if (!model) return false;
+  return /claude-mythos-5|mythos[._-]5/i.test(model);
+}
+
+/**
+ * @param {string | undefined} model
+ * @returns {boolean}
+ */
+export function isAdaptiveThinkingModel(model) {
+  return (
+    isOpus46Model(model) ||
+    isOpus47Model(model) ||
+    isOpus48Model(model) ||
+    isSonnet46Model(model) ||
+    isFable5Model(model) ||
+    isMythos5Model(model)
+  );
 }
 
 /**
@@ -7062,6 +7091,14 @@ const MAX_SUBAGENT_CC_PREFIX = MAX_SAFE_SYSTEM_TEXT_LENGTH;
 const SUBAGENT_CC_ANCHOR = "You are an interactive";
 let cachedCCPrompt = null;
 
+// Perf: module-scope regexes reused across per-request hot paths. None use the
+// `/g` flag and all are consumed via `.test()`, so a single shared instance is
+// stateless and safe (no `lastIndex` to reset between calls).
+const CLAUDE_3_MODEL_RE = /claude-3-/i;
+const TAIL_IMPORTANT_RE = /\b(MUST|NEVER|CRITICAL|IMPORTANT|REQUIRED|DO NOT|ALWAYS|FORBIDDEN)\b/i;
+const TAIL_HEADER_RE = /^#{1,4}\s/;
+const TAIL_LIST_ITEM_RE = /^\s*[-*]\s/;
+
 function sanitizeSystemText(text) {
   // QA fix M4: use word boundaries to avoid mangling URLs and code identifiers
   let sanitized = text.replace(/\bOpenCode\b/g, "Claude Code").replace(/\bopencode\b/gi, "Claude");
@@ -7084,9 +7121,9 @@ function tailSystemBlock(text, maxChars, turnThreshold) {
   const lines = text.split("\n");
   const kept = [];
   let charCount = 0;
-  const importantRe = /\b(MUST|NEVER|CRITICAL|IMPORTANT|REQUIRED|DO NOT|ALWAYS|FORBIDDEN)\b/i;
-  const headerRe = /^#{1,4}\s/;
-  const listItemRe = /^\s*[-*]\s/;
+  const importantRe = TAIL_IMPORTANT_RE;
+  const headerRe = TAIL_HEADER_RE;
+  const listItemRe = TAIL_LIST_ITEM_RE;
   // Always keep the first paragraph (identity/role definition)
   let firstParaEnd = 0;
   for (let j = 0; j < lines.length; j++) {
@@ -7575,6 +7612,22 @@ function buildSystemPromptBlocks(system, signature) {
  *   accumulates fast-mode independently of actual body content.
  * @returns {string}
  */
+// Mirrors CC's Kw(model) effort eligibility: returns false for claude-3-* and the
+// explicit older 4.x exclusion set (opus-4-0/4-1, sonnet-4-0/4-5, haiku-4-5), true
+// for every other model (effort-capable: Opus 4.5/4.6/4.7/4.8, Sonnet 4.6, etc.).
+const _EFFORT_EXCLUDED_MODELS = [
+  /claude-opus-4-0/i,
+  /claude-opus-4-1/i,
+  /claude-sonnet-4-0/i,
+  /claude-sonnet-4-5/i,
+  /claude-haiku-4-5/i,
+];
+function isEffortCapableModel(model) {
+  if (!model) return false;
+  if (CLAUDE_3_MODEL_RE.test(model)) return false;
+  return !_EFFORT_EXCLUDED_MODELS.some((re) => re.test(model));
+}
+
 function buildAnthropicBetaHeader(
   incomingBeta,
   signatureEnabled,
@@ -7628,13 +7681,15 @@ function buildAnthropicBetaHeader(
 
   // v2.1.150: fast-mode-2026-02-01 removed from always-on (CC sends only when speed feature active).
 
-  // v2.1.150: effort-2025-11-24 removed from always-on (CC sends only when effort is explicitly requested).
+  // v2.1.195: effort-2025-11-24 is no longer always-on; it is now a model-gated
+  // default emitted in the conditional section below for effort-capable models
+  // (mirrors CC's Kw(model)).
 
   // Interleaved thinking — real CC's i01 pushes via hv4(model), which is
   // (firstParty && non-Claude-3). Claude 3.x models don't support interleaved
   // thinking and real CC never sends this flag for them, so emitting it
   // diverges the fingerprint for legacy Haiku/Sonnet 3.x requests.
-  if (!isTruthyEnv(process.env.DISABLE_INTERLEAVED_THINKING) && !/claude-3-/i.test(model)) {
+  if (!isTruthyEnv(process.env.DISABLE_INTERLEAVED_THINKING) && !CLAUDE_3_MODEL_RE.test(model)) {
     betas.push("interleaved-thinking-2025-05-14");
   }
 
@@ -7660,11 +7715,28 @@ function buildAnthropicBetaHeader(
 
   // === CONDITIONAL BETAS (model/context-dependent) ===
 
-  // v2.1.150: context-management gated behind opt-in (CC has hardcoded && false).
-  if (te.context_management && !/claude-3-/i.test(model)) {
+  // First-party provider predicate (OAuth path). Mirrors CC's ZO(provider) which
+  // excludes bedrock/vertex/mantle. context-management and effort are first-party
+  // only here, so they must never be pushed on bedrock/vertex.
+  const isFirstPartyProvider = provider !== "vertex" && provider !== "bedrock" && provider !== "mantle";
+
+  // v2.1.195: context-management-2025-06-27 is default-ON for first-party non-claude-3
+  // models (incl. Haiku 4.5), mirroring CC's n0d(model) eligibility path. Earlier
+  // analyses read only the separate USE_API_CONTEXT_MANAGEMENT env term (hardcoded
+  // && false) and recorded it as off; 2.1.195 confirms it ships by default for modern
+  // first-party models. Opt out via token_economy.context_management = false.
+  if (te.context_management !== false && isFirstPartyProvider && !CLAUDE_3_MODEL_RE.test(model)) {
     betas.push("context-management-2025-06-27");
   }
 
+  // v2.1.195: effort-2025-11-24 is a model-gated default for effort-capable models
+  // (Opus 4.5/4.6/4.7/4.8, Sonnet 4.6), mirroring CC's Kw(model). Excluded for
+  // claude-3-*, opus-4-0, opus-4-1, sonnet-4-0, sonnet-4-5, haiku-4-5. First-party
+  // only; opt out via token_economy.effort = false.
+  if (te.effort !== false && isFirstPartyProvider && isEffortCapableModel(model)) {
+    betas.push(_EFFORT_BETA_FLAG);
+  }
+
   // v2.1.150: structured-outputs gated behind opt-in (CC has behind tengu_tool_pear flag).
   if (te.structured_outputs && supportsStructuredOutputs(model)) {
     betas.push("structured-outputs-2025-12-15");
@@ -7679,7 +7751,7 @@ function buildAnthropicBetaHeader(
   // (tengu_sage_compass2) and firstParty+isLoggedIn. Since we can't check
   // CC's feature flags, include it unconditionally for Claude 4+ models.
   // CC v108 sends it in MITM captures for Max/Pro users.
-  if (!/claude-3-/i.test(model)) {
+  if (!CLAUDE_3_MODEL_RE.test(model)) {
     betas.push("advisor-tool-2026-03-01");
   }
 
@@ -7691,12 +7763,11 @@ function buildAnthropicBetaHeader(
   // token-efficient context compaction. Sticky: disabled permanently on
   // 400/409/529 errors referencing the hint. Users can opt out via
   // token_economy.context_hint = false.
-  const isFirstPartyProvider = provider !== "vertex" && provider !== "bedrock" && provider !== "mantle";
   // Mimicry note: real CC gates context-hint on querySource.startsWith("repl_main_thread").
   // We infer main-thread from body shape via classifyRequestRole and pass it via
   // tokenEconomy.__requestRole. Treat absent marker as "main" for backward compat.
   const _isMainThread = te.__requestRole == null || te.__requestRole === "main";
-  if (isFirstPartyProvider && !/claude-3-/i.test(model) && te.context_hint !== false && _isMainThread) {
+  if (isFirstPartyProvider && !CLAUDE_3_MODEL_RE.test(model) && te.context_hint !== false && _isMainThread) {
     betas.push("context-hint-2026-04-09");
   }
 
@@ -7714,13 +7785,13 @@ function buildAnthropicBetaHeader(
 
   // v2.1.150: redact-thinking is default-ON in CC (first-party, non-SDK, thinking models).
   // Opt out via `/anthropic set redact-thinking off` to see thinking content.
-  if (te.redact_thinking !== false && !disableExperimentalBetas && !/claude-3-/i.test(model)) {
+  if (te.redact_thinking !== false && !disableExperimentalBetas && !CLAUDE_3_MODEL_RE.test(model)) {
     betas.push("redact-thinking-2026-02-12");
   }
 
   // v2.1.150: thinking-token-count for token budget tracking (behind tengu_chert_bezel in CC).
   // Default ON for token economy visibility. Opt out via token_economy.thinking_token_count = false.
-  if (te.thinking_token_count !== false && !disableExperimentalBetas && !/claude-3-/i.test(model)) {
+  if (te.thinking_token_count !== false && !disableExperimentalBetas && !CLAUDE_3_MODEL_RE.test(model)) {
     betas.push("thinking-token-count-2026-05-13");
   }
 
@@ -8014,7 +8085,9 @@ function buildRequestHeaders(
       requestHeaders.set("x-anthropic-additional-protection", "true");
     }
 
-    // x-client-request-id: NOT sent by real CC (confirmed via proxy capture). Removed.
+    // x-client-request-id: real CC 2.1.195's first-party fetch middleware (Ukd) sets
+    // this to crypto.randomUUID() on every first-party request. Re-emit a random uuid.
+    requestHeaders.set("x-client-request-id", randomUUID());
   }
   requestHeaders.delete("x-api-key");
   // x-session-affinity: set by opencode SDK but NOT in real CC. Strip it.
@@ -8155,16 +8228,16 @@ function transformRequestBody(body, signature, runtime, betaHeader, config) {
       delete parsed.temperature;
 
       // Claude Code v2.1.84: inject the context_management body field ONLY when the
-      // context-management beta is actually enabled (token_economy.context_management,
-      // the SAME flag that gates the beta in buildAnthropicBetaHeader). A top-level
-      // context_management field WITHOUT the beta is rejected by the API with
-      // "context_management: Extra inputs are not permitted". Keeping the field and
-      // the anthropic-beta header in lockstep prevents that 400 — previously the
-      // field was injected on every thinking turn regardless of the beta, which only
-      // worked if the beta happened to be forced on via custom_betas/ANTHROPIC_BETAS.
+      // user has explicitly opted in via token_economy.context_management. Note: as of
+      // v2.1.195 the context-management *beta header* is default-ON for first-party
+      // non-claude-3 models (see buildAnthropicBetaHeader), but the body field stays
+      // opt-in. A top-level context_management field WITHOUT the beta is rejected with
+      // "context_management: Extra inputs are not permitted"; the beta being present
+      // without the field is fine. Gating the field on explicit opt-in keeps the field
+      // ⊆ beta invariant, so the 400 never fires.
       if (
         config?.token_economy?.context_management &&
-        !/claude-3-/i.test(parsed.model || "") &&
+        !CLAUDE_3_MODEL_RE.test(parsed.model || "") &&
         !parsed.context_management
       ) {
         parsed.context_management = {
@@ -8293,9 +8366,34 @@ function transformRequestBody(body, signature, runtime, betaHeader, config) {
     const modelId = parsed.model || "";
     // Extract first user message text for billing hash computation (cch)
     const firstUserMessage = extractFirstUserMessageText(parsed.messages);
+    // Resolve the prompt-cache TTL ONCE so system blocks, tools, and messages
+    // all share the SAME ttl. Anthropic processes cache_control blocks in the
+    // order tools → system → messages and rejects any ttl='1h' block that comes
+    // AFTER a ttl='5m' block. Before this fix the role-scoped 5m downgrade was
+    // applied only to tools/messages (resolveCacheTtl in the breakpoint loop)
+    // while the system blocks kept the configured 1h — so subagent requests
+    // (5m tools, then 1h system) tripped:
+    //   "system.1.cache_control.ttl: a ttl='1h' cache_control block must not
+    //    come after a ttl='5m' cache_control block".
+    // Threading it through buildSystemPromptBlocks keeps every cache_control ttl
+    // consistent (real CC derives the ttl uniformly from querySource).
+    const baseCachePolicy = signature.cachePolicy || { ttl: "1h", ttl_supported: true };
+    const cachingEnabledForTtl = baseCachePolicy.ttl !== "off" && baseCachePolicy.ttl_supported !== false;
+    const resolvedCacheTtl = cachingEnabledForTtl
+      ? resolveCacheTtl({
+          configuredTtl: baseCachePolicy.ttl || "1h",
+          roleScopedTtl: config?.token_economy?.role_scoped_cache_ttl !== false,
+          isMainForCache: runtime?.requestRole === "main" || runtime?.requestRole == null,
+          isSubagent: runtime?.isSubagent === true,
+          env: process.env,
+        })
+      : baseCachePolicy.ttl;
     const signatureWithModel = {
       ...signature,
       modelId,
+      // Override cachePolicy.ttl with the role/subagent-resolved ttl so the
+      // system blocks match the tool/message breakpoint ttl (see comment above).
+      cachePolicy: { ...baseCachePolicy, ttl: resolvedCacheTtl },
       firstUserMessage,
       antiVerbosity: config?.anti_verbosity,
       // Role-aware system-prompt leaning: for non-main-thread requests (title,
@@ -8393,17 +8491,10 @@ function transformRequestBody(body, signature, runtime, betaHeader, config) {
       // We map step 4 via classifyRequestRole: main (interactive/auto_mode thread)
       // → 1h; side-queries (title-gen, etc.) → 5m. The env vars are honored
       // exactly as CC does, giving the user a manual override + mimicry fidelity.
-      const configuredTtl = signature.cachePolicy?.ttl || "1h";
-      const roleScopedTtl = config?.token_economy?.role_scoped_cache_ttl !== false;
-      const isMainForCache = runtime?.requestRole === "main" || runtime?.requestRole == null;
-      const isSubagentForCache = runtime?.isSubagent === true;
-      const ccTtl = resolveCacheTtl({
-        configuredTtl,
-        roleScopedTtl,
-        isMainForCache,
-        isSubagent: isSubagentForCache,
-        env: process.env,
-      });
+      // Reuse the request-wide resolved ttl (computed above where
+      // signatureWithModel is built) so tools/messages match the system blocks
+      // and never trip the 1h-after-5m ordering rule on subagent requests.
+      const ccTtl = resolvedCacheTtl;
       if (Array.isArray(parsed.tools) && parsed.tools.length > 0) {
         for (const tool of parsed.tools) {
           if (tool.cache_control) delete tool.cache_control;

package/lib/adaptive-thinking-models.test.mjs

@@ -0,0 +1,30 @@
+import { describe, expect, test } from "vitest";
+
+import { isAdaptiveThinkingModel, isFable5Model, isMythos5Model } from "../index.mjs";
+
+describe("Claude 5 adaptive thinking model predicates", () => {
+  test("isFable5Model matches version-anchored fable 5 model names", () => {
+    expect(isFable5Model("claude-fable-5")).toBe(true);
+    expect(isFable5Model("anthropic/claude-fable-5")).toBe(true);
+  });
+
+  test("isFable5Model rejects non-fable-5 model names", () => {
+    expect(isFable5Model("claude-opus-4-8")).toBe(false);
+    expect(isFable5Model("claude-haiku-4-5")).toBe(false);
+    expect(isFable5Model("")).toBe(false);
+  });
+
+  test("isMythos5Model matches version-anchored mythos 5 model names", () => {
+    expect(isMythos5Model("claude-mythos-5")).toBe(true);
+  });
+
+  test("isMythos5Model rejects non-mythos-5 model names", () => {
+    expect(isMythos5Model("claude-opus-4-8")).toBe(false);
+    expect(isMythos5Model("claude-haiku-4-5")).toBe(false);
+    expect(isMythos5Model("")).toBe(false);
+  });
+
+  test("isAdaptiveThinkingModel includes fable 5 models", () => {
+    expect(isAdaptiveThinkingModel("claude-fable-5")).toBe(true);
+  });
+});

package/lib/backoff.mjs

@@ -64,6 +64,29 @@ export function parseRetryAfterHeader(response) {
   return null;
 }
 
+/**
+ * Parse the unified rate-limit reset header from a response (Claude Code 2.1.195+).
+ * Reads `anthropic-ratelimit-unified-reset`, falling back to
+ * `anthropic-ratelimit-unified-overage-reset` when the primary header is absent.
+ * Both are UNIX epochs in SECONDS (parsed via `Number()`, mirroring upstream).
+ * Returns milliseconds-until-reset, or null when the header is missing, not a
+ * number, or already in the past.
+ * @param {Response} response
+ * @returns {number | null} Milliseconds until reset, or null
+ */
+export function parseUnifiedResetMsHeader(response) {
+  const header =
+    response.headers.get("anthropic-ratelimit-unified-reset") ??
+    response.headers.get("anthropic-ratelimit-unified-overage-reset");
+  if (!header) return null;
+
+  const epochSeconds = Number(header);
+  if (isNaN(epochSeconds)) return null;
+
+  const ms = epochSeconds * 1000 - Date.now();
+  return ms > 0 ? ms : null;
+}
+
 /**
  * Parse normalized error signals from a response body.
  * Accepts raw strings, parsed objects, or null.

package/lib/backoff.test.mjs

@@ -1,5 +1,11 @@
 import { describe, it, expect } from "vitest";
-import { parseRateLimitReason, calculateBackoffMs, parseRetryAfterHeader, isAccountSpecificError } from "./backoff.mjs";
+import {
+  parseRateLimitReason,
+  calculateBackoffMs,
+  parseRetryAfterHeader,
+  parseUnifiedResetMsHeader,
+  isAccountSpecificError,
+} from "./backoff.mjs";
 
 // ---------------------------------------------------------------------------
 // isAccountSpecificError
@@ -343,3 +349,63 @@ describe("parseRetryAfterHeader", () => {
     expect(parseRetryAfterHeader(response)).toBeNull();
   });
 });
+
+// ---------------------------------------------------------------------------
+// parseUnifiedResetMsHeader
+// ---------------------------------------------------------------------------
+
+describe("parseUnifiedResetMsHeader", () => {
+  it("returns null when no unified-reset header present", () => {
+    const response = new Response(null, { headers: {} });
+    expect(parseUnifiedResetMsHeader(response)).toBeNull();
+  });
+
+  it("returns ~ms-until-reset for a future epoch (seconds)", () => {
+    const futureEpochSeconds = Math.floor(Date.now() / 1000) + 120;
+    const response = new Response(null, {
+      headers: { "anthropic-ratelimit-unified-reset": String(futureEpochSeconds) },
+    });
+    const result = parseUnifiedResetMsHeader(response);
+    expect(result).toBeGreaterThan(110_000);
+    expect(result).toBeLessThanOrEqual(120_000);
+  });
+
+  it("returns null for a non-numeric value (NaN)", () => {
+    const response = new Response(null, {
+      headers: { "anthropic-ratelimit-unified-reset": "not-a-number" },
+    });
+    expect(parseUnifiedResetMsHeader(response)).toBeNull();
+  });
+
+  it("returns null for a past epoch (<= now)", () => {
+    const pastEpochSeconds = Math.floor(Date.now() / 1000) - 60;
+    const response = new Response(null, {
+      headers: { "anthropic-ratelimit-unified-reset": String(pastEpochSeconds) },
+    });
+    expect(parseUnifiedResetMsHeader(response)).toBeNull();
+  });
+
+  it("falls back to overage-reset when unified-reset is absent", () => {
+    const futureEpochSeconds = Math.floor(Date.now() / 1000) + 90;
+    const response = new Response(null, {
+      headers: { "anthropic-ratelimit-unified-overage-reset": String(futureEpochSeconds) },
+    });
+    const result = parseUnifiedResetMsHeader(response);
+    expect(result).toBeGreaterThan(80_000);
+    expect(result).toBeLessThanOrEqual(90_000);
+  });
+
+  it("prefers unified-reset over overage-reset when both present", () => {
+    const resetEpoch = Math.floor(Date.now() / 1000) + 120;
+    const overageEpoch = Math.floor(Date.now() / 1000) + 300;
+    const response = new Response(null, {
+      headers: {
+        "anthropic-ratelimit-unified-reset": String(resetEpoch),
+        "anthropic-ratelimit-unified-overage-reset": String(overageEpoch),
+      },
+    });
+    const result = parseUnifiedResetMsHeader(response);
+    expect(result).toBeGreaterThan(110_000);
+    expect(result).toBeLessThanOrEqual(120_000);
+  });
+});

package/lib/config.mjs

@@ -104,6 +104,7 @@ import { randomBytes } from "node:crypto";
  * @property {{ enabled: boolean, default_cooldown_ms: number, poll_quota_on_overload: boolean }} overload_recovery
  * @property {{ proactive_disabled: boolean }} account_management
  * @property {{ enabled: boolean, length_anchors: boolean }} anti_verbosity
+ * @property {{ sdk_token_useragent: boolean }} oauth
  */
 
 /** @type {AnthropicAuthConfig} */
@@ -434,6 +435,19 @@ export const DEFAULT_CONFIG = {
     /** Also inject numeric length anchors (≤25 words between tool calls, ≤100 words final). */
     length_anchors: true,
   },
+  /** OAuth token-endpoint request fingerprint. HIGH-RISK knob — leave OFF unless
+   *  validated against a live refresh. */
+  oauth: {
+    /** When true, the OAuth token EXCHANGE/REFRESH POSTs use Claude Code
+     *  2.1.195's SDK-native-fetch fingerprint (`User-Agent:
+     *  anthropic-sdk-typescript/0.94.0 userOAuthProvider`, `anthropic-beta:
+     *  oauth-2025-04-20`, no axios `Accept`). When false (DEFAULT), the legacy
+     *  axios fingerprint (`User-Agent: axios/1.13.6`, axios `Accept` header) is
+     *  sent byte-for-byte as before.
+     *  Default OFF: the token endpoint historically 429'd requests lacking the
+     *  axios UA, so this stays opt-in until proven against live refresh. */
+    sdk_token_useragent: false,
+  },
 };
 
 export const VALID_STRATEGIES = ["sticky", "round-robin", "hybrid"];
@@ -473,6 +487,7 @@ function createDefaultConfig() {
     microcompact: { ...DEFAULT_CONFIG.microcompact },
     overload_recovery: { ...DEFAULT_CONFIG.overload_recovery },
     account_management: { ...DEFAULT_CONFIG.account_management },
+    oauth: { ...DEFAULT_CONFIG.oauth },
   };
 }
 
@@ -1002,6 +1017,15 @@ function validateConfig(raw) {
     };
   }
 
+  // OAuth token-endpoint fingerprint sub-config
+  if (raw.oauth && typeof raw.oauth === "object") {
+    const o = /** @type {Record<string, unknown>} */ (raw.oauth);
+    config.oauth = {
+      sdk_token_useragent:
+        typeof o.sdk_token_useragent === "boolean" ? o.sdk_token_useragent : DEFAULT_CONFIG.oauth.sdk_token_useragent,
+    };
+  }
+
   return config;
 }
 

package/lib/oauth.mjs

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from "node:crypto";
-import { CLIENT_ID } from "./config.mjs";
+import { CLIENT_ID, loadConfig } from "./config.mjs";
 import { parseRetryAfterHeader, parseRetryAfterMsHeader } from "./backoff.mjs";
 
 // ---------------------------------------------------------------------------
@@ -17,6 +17,17 @@ const OAUTH_REVOKE_URL = `https://${OAUTH_CONSOLE_HOST}/v1/oauth/revoke`;
 const OAUTH_AXIOS_VERSION = "1.13.6";
 const OAUTH_USER_AGENT = `axios/${OAUTH_AXIOS_VERSION}`;
 const OAUTH_ACCEPT = "application/json, text/plain, */*";
+// Claude Code 2.1.195 migrated the OAuth token client from axios to the
+// Anthropic TS SDK's native-fetch `userOAuthProvider`. When the
+// `oauth.sdk_token_useragent` config flag is ON, the token POST switches to
+// this fingerprint: `User-Agent: anthropic-sdk-typescript/0.94.0
+// userOAuthProvider`, `anthropic-beta: oauth-2025-04-20`, JSON body, and NO
+// axios `Accept` header (native fetch sends no default Accept). The SDK version
+// mirrors request-headers.mjs `ANTHROPIC_SDK_VERSION` ("0.94.0"); hardcoded here
+// to avoid coupling the OAuth path to the messages-header module.
+const OAUTH_SDK_VERSION = "0.94.0";
+const OAUTH_SDK_USER_AGENT = `anthropic-sdk-typescript/${OAUTH_SDK_VERSION} userOAuthProvider`;
+const OAUTH_SDK_BETA = "oauth-2025-04-20";
 const OAUTH_MAX_RETRIES = 2;
 const OAUTH_MAX_RETRY_DELAY_MS = 30_000;
 const OAUTH_RATE_LIMIT_COOLDOWN_MS = 30_000;
@@ -44,6 +55,44 @@ function generatePKCE() {
   return { verifier, challenge, state };
 }
 
+/**
+ * Resolve whether the SDK-native-fetch token fingerprint should be used.
+ * An explicit boolean override (used by callers/tests) wins; otherwise the
+ * live `oauth.sdk_token_useragent` config flag is read (default false).
+ * @param {boolean | undefined} override
+ * @returns {boolean}
+ */
+function useSdkTokenFingerprint(override) {
+  if (typeof override === "boolean") return override;
+  try {
+    return loadConfig()?.oauth?.sdk_token_useragent === true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Build the headers for an OAuth token POST (exchange/refresh).
+ * @param {boolean} useSdk - When true, emit the CC 2.1.195 SDK-native-fetch
+ *   fingerprint; when false, emit the legacy axios fingerprint (default).
+ * @returns {Record<string, string>}
+ */
+function buildTokenHeaders(useSdk) {
+  if (useSdk) {
+    // Native fetch sends no default Accept header — omit it deliberately.
+    return {
+      "Content-Type": "application/json",
+      "anthropic-beta": OAUTH_SDK_BETA,
+      "User-Agent": OAUTH_SDK_USER_AGENT,
+    };
+  }
+  return {
+    Accept: OAUTH_ACCEPT,
+    "Content-Type": "application/json",
+    "User-Agent": OAUTH_USER_AGENT,
+  };
+}
+
 /**
  * @param {number} ms
  * @returns {Promise<void>}
@@ -261,6 +310,8 @@ export function parseOAuthCallback(input) {
  * Exchange an authorization code for tokens.
  * @param {string} code
  * @param {string} verifier
+ * @param {{ sdkTokenUserAgent?: boolean }} [options] - `sdkTokenUserAgent`
+ *   overrides the `oauth.sdk_token_useragent` config flag (mainly for tests).
  * @returns {Promise<
  *   | { type: "success", refresh: string, access: string, expires: number, email?: string }
  *   | {
@@ -274,7 +325,8 @@ export function parseOAuthCallback(input) {
  *     }
  * >}
  */
-export async function exchange(code, verifier) {
+export async function exchange(code, verifier, options = {}) {
+  const tokenHeaders = buildTokenHeaders(useSdkTokenFingerprint(options.sdkTokenUserAgent));
   const fail = (status, rawText = "", cooldownHint = { retryAfterMs: null }) => {
     const { errorCode, reason } = parseOAuthErrorBody(rawText);
     const retryAfterMs =
@@ -312,11 +364,7 @@ export async function exchange(code, verifier) {
       };
       result = await fetch(OAUTH_TOKEN_URL, {
         method: "POST",
-        headers: {
-          Accept: OAUTH_ACCEPT,
-          "Content-Type": "application/json",
-          "User-Agent": OAUTH_USER_AGENT,
-        },
+        headers: tokenHeaders,
         body: JSON.stringify(_exchangeBody),
         signal: AbortSignal.timeout(15_000),
       });
@@ -413,24 +461,23 @@ export async function revoke(refreshToken) {
 /**
  * Refresh an OAuth access token.
  * @param {string} refreshTokenValue - The refresh token to use
- * @param {{ signal?: AbortSignal }} [options]
+ * @param {{ signal?: AbortSignal, scopes?: string[], sdkTokenUserAgent?: boolean }} [options]
+ *   `sdkTokenUserAgent` overrides the `oauth.sdk_token_useragent` config flag
+ *   (mainly for tests).
  * @returns {Promise<{access_token: string, refresh_token: string, expires_in: number}>}
  * @throws {Error} On HTTP errors or network failures
  */
 export async function refreshToken(refreshTokenValue, options = {}) {
   // QA fix M13: default 30s timeout to prevent hanging on unresponsive server
   const signal = options.signal ?? AbortSignal.timeout(30_000);
+  const tokenHeaders = buildTokenHeaders(useSdkTokenFingerprint(options.sdkTokenUserAgent));
 
   for (let attempt = 0; attempt <= OAUTH_MAX_RETRIES; attempt++) {
     let resp;
     try {
       resp = await fetch(OAUTH_TOKEN_URL, {
         method: "POST",
-        headers: {
-          Accept: OAUTH_ACCEPT,
-          "Content-Type": "application/json",
-          "User-Agent": OAUTH_USER_AGENT,
-        },
+        headers: tokenHeaders,
         body: JSON.stringify({
           grant_type: "refresh_token",
           refresh_token: refreshTokenValue,

package/lib/oauth.test.mjs

@@ -47,6 +47,60 @@ describe("oauth headers", () => {
     expect(init.headers["User-Agent"]).toBe("axios/1.13.6");
   });
 
+  it("flag OFF (default) keeps axios fingerprint on exchange", async () => {
+    mockFetch.mockResolvedValueOnce({ ok: false, status: 400, text: async () => "" });
+
+    await exchange("code#state", "verifier", { sdkTokenUserAgent: false });
+
+    const [, init] = mockFetch.mock.calls[0];
+    expect(init.headers["User-Agent"]).toBe("axios/1.13.6");
+    expect(init.headers["Accept"]).toBe("application/json, text/plain, */*");
+    expect(init.headers["Content-Type"]).toBe("application/json");
+    expect(init.headers["anthropic-beta"]).toBeUndefined();
+  });
+
+  it("flag ON sends SDK native-fetch fingerprint on exchange", async () => {
+    mockFetch.mockResolvedValueOnce({ ok: false, status: 400, text: async () => "" });
+
+    await exchange("code#state", "verifier", { sdkTokenUserAgent: true });
+
+    const [, init] = mockFetch.mock.calls[0];
+    expect(init.headers["User-Agent"]).toBe("anthropic-sdk-typescript/0.94.0 userOAuthProvider");
+    expect(init.headers["anthropic-beta"]).toBe("oauth-2025-04-20");
+    expect(init.headers["Content-Type"]).toBe("application/json");
+    expect("Accept" in init.headers).toBe(false);
+  });
+
+  it("flag OFF (default) keeps axios fingerprint on refresh", async () => {
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: async () => ({ access_token: "a", refresh_token: "r", expires_in: 3600 }),
+    });
+
+    await refreshToken("refresh-token", { sdkTokenUserAgent: false });
+
+    const [, init] = mockFetch.mock.calls[0];
+    expect(init.headers["User-Agent"]).toBe("axios/1.13.6");
+    expect(init.headers["Accept"]).toBe("application/json, text/plain, */*");
+    expect(init.headers["Content-Type"]).toBe("application/json");
+    expect(init.headers["anthropic-beta"]).toBeUndefined();
+  });
+
+  it("flag ON sends SDK native-fetch fingerprint on refresh", async () => {
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: async () => ({ access_token: "a", refresh_token: "r", expires_in: 3600 }),
+    });
+
+    await refreshToken("refresh-token", { sdkTokenUserAgent: true });
+
+    const [, init] = mockFetch.mock.calls[0];
+    expect(init.headers["User-Agent"]).toBe("anthropic-sdk-typescript/0.94.0 userOAuthProvider");
+    expect(init.headers["anthropic-beta"]).toBe("oauth-2025-04-20");
+    expect(init.headers["Content-Type"]).toBe("application/json");
+    expect("Accept" in init.headers).toBe(false);
+  });
+
   it("parses Anthropic nested error payloads on exchange failure", async () => {
     mockFetch.mockResolvedValueOnce({
       ok: false,

package/lib/request-headers.mjs

@@ -16,15 +16,15 @@
 // Version / build / SDK constants
 // ---------------------------------------------------------------------------
 
-export const FALLBACK_CLAUDE_CLI_VERSION = "2.1.159";
+export const FALLBACK_CLAUDE_CLI_VERSION = "2.1.195";
 export const CLAUDE_CODE_NPM_LATEST_URL = "https://registry.npmjs.org/@anthropic-ai/claude-code/latest";
-// Real build markers extracted from the 2.1.159 linux-x64 native binary
-// (Bun-embedded JS): `BUILD_TIME:"2026-05-31T16:22:50Z"`,
-// `GIT_SHA:"dd8c11fc8d05cea0b2b9fc8f5a99a5c5c5dffc9b"`.
-// (Prior 2.1.154 win32-x64: BUILD_TIME 2026-05-28T12:27:24Z,
-//  GIT_SHA b84d2da9ada13121515426fc644786a303e9ac53.)
-export const CLAUDE_CODE_BUILD_TIME = "2026-05-31T16:22:50Z";
-export const CLAUDE_CODE_GIT_SHA = "dd8c11fc8d05cea0b2b9fc8f5a99a5c5c5dffc9b";
+// Real build markers extracted from the 2.1.195 native binary
+// (Bun-embedded JS): `BUILD_TIME:"2026-06-26T01:00:56Z"`,
+// `GIT_SHA:"4603aa3f2ea164bd0974f82eb413ae7acc99a7ee"`.
+// (Prior 2.1.159 linux-x64: BUILD_TIME 2026-05-31T16:22:50Z,
+//  GIT_SHA dd8c11fc8d05cea0b2b9fc8f5a99a5c5c5dffc9b.)
+export const CLAUDE_CODE_BUILD_TIME = "2026-06-26T01:00:56Z";
+export const CLAUDE_CODE_GIT_SHA = "4603aa3f2ea164bd0974f82eb413ae7acc99a7ee";
 
 // The @anthropic-ai/sdk version bundled with Claude Code.
 // This is distinct from the CLI version and goes in X-Stainless-Package-Version.
@@ -38,6 +38,46 @@ export const ANTHROPIC_SDK_VERSION = "0.94.0";
 
 // Map of CLI version to bundled SDK version (update when CLI version changes)
 export const CLI_TO_SDK_VERSION = new Map([
+  // 2.1.160-2.1.195: refusal-fallback feature (server-side-fallback /
+  // fallback-credit betas) is opt-in/GrowthBook-gated and never emitted on a
+  // default /v1/messages turn; no wire SDK bump (binary-verified:
+  // x-stainless-package-version still "0.94.0" in 2.1.195).
+  ["2.1.195", "0.94.0"],
+  ["2.1.194", "0.94.0"],
+  ["2.1.193", "0.94.0"],
+  ["2.1.192", "0.94.0"],
+  ["2.1.191", "0.94.0"],
+  ["2.1.190", "0.94.0"],
+  ["2.1.189", "0.94.0"],
+  ["2.1.188", "0.94.0"],
+  ["2.1.187", "0.94.0"],
+  ["2.1.186", "0.94.0"],
+  ["2.1.185", "0.94.0"],
+  ["2.1.184", "0.94.0"],
+  ["2.1.183", "0.94.0"],
+  ["2.1.182", "0.94.0"],
+  ["2.1.181", "0.94.0"],
+  ["2.1.180", "0.94.0"],
+  ["2.1.179", "0.94.0"],
+  ["2.1.178", "0.94.0"],
+  ["2.1.177", "0.94.0"],
+  ["2.1.176", "0.94.0"],
+  ["2.1.175", "0.94.0"],
+  ["2.1.174", "0.94.0"],
+  ["2.1.173", "0.94.0"],
+  ["2.1.172", "0.94.0"],
+  ["2.1.171", "0.94.0"],
+  ["2.1.170", "0.94.0"],
+  ["2.1.169", "0.94.0"],
+  ["2.1.168", "0.94.0"],
+  ["2.1.167", "0.94.0"],
+  ["2.1.166", "0.94.0"],
+  ["2.1.165", "0.94.0"],
+  ["2.1.164", "0.94.0"],
+  ["2.1.163", "0.94.0"],
+  ["2.1.162", "0.94.0"],
+  ["2.1.161", "0.94.0"],
+  ["2.1.160", "0.94.0"],
   // 2.1.155-2.1.159: only wire change is the revival of
   // summarize-connector-text-2026-03-13 (label narration_summaries), gated by
   // GrowthBook pewter_owl_header (default-off) — not always-on. SDK still 0.94.0
@@ -146,6 +186,10 @@ export const EXPERIMENTAL_BETA_FLAGS = new Set([
   "context-management-2025-06-27",
   "environments-2025-11-01",
   "extended-cache-ttl-2025-04-11",
+  // Refusal-fallback credit beta from the upstream Udd registry (CC 2.1.195).
+  // Opt-in/GrowthBook-gated; never auto-emitted on a default /v1/messages turn.
+  // Listed here for the disable-experimental guard + manual opt-in ONLY.
+  "fallback-credit-2026-06-01",
   "fast-mode-2026-02-01",
   "files-api-2025-04-14",
   "interleaved-thinking-2025-05-14",
@@ -158,6 +202,10 @@ export const EXPERIMENTAL_BETA_FLAGS = new Set([
   "mid-conversation-system-2026-04-07",
   "prompt-caching-scope-2026-01-05",
   "redact-thinking-2026-02-12",
+  // Server-side refusal-fallback beta from the upstream Udd registry (CC 2.1.195).
+  // Opt-in/GrowthBook-gated; never auto-emitted on a default /v1/messages turn.
+  // Listed here for the disable-experimental guard + manual opt-in ONLY.
+  "server-side-fallback-2026-06-01",
   "structured-outputs-2025-12-15",
   // Revived in CC 2.1.159 as registry label `narration_summaries` (it was a dead
   // slot from v2.1.90-2.1.154). Real CC emits it only when GrowthBook flag
@@ -208,6 +256,9 @@ export const BETA_SHORTCUTS = new Map([
   ["connector-text", "summarize-connector-text-2026-03-13"],
   ["narration-summaries", "summarize-connector-text-2026-03-13"],
   ["summarize-connector-text", "summarize-connector-text-2026-03-13"],
+  ["server-side-fallback", "server-side-fallback-2026-06-01"],
+  ["fallback", "server-side-fallback-2026-06-01"],
+  ["fallback-credit", "fallback-credit-2026-06-01"],
 ]);
 
 // ---------------------------------------------------------------------------

package/lib/request-headers.test.mjs

@@ -8,18 +8,21 @@ import {
   ANTHROPIC_SDK_VERSION,
   getSdkVersion,
   BETA_SHORTCUTS,
+  EXPERIMENTAL_BETA_FLAGS,
   resolveBetaShortcut,
   buildExtendedUserAgent,
 } from "./request-headers.mjs";
 
 describe("request-headers constants", () => {
-  it("FALLBACK_CLAUDE_CLI_VERSION is 2.1.159", () => {
-    expect(FALLBACK_CLAUDE_CLI_VERSION).toBe("2.1.159");
+  it("FALLBACK_CLAUDE_CLI_VERSION is 2.1.195", () => {
+    expect(FALLBACK_CLAUDE_CLI_VERSION).toBe("2.1.195");
   });
 
   it("ANTHROPIC_SDK_VERSION matches expected value", () => {
     expect(typeof ANTHROPIC_SDK_VERSION).toBe("string");
     expect(ANTHROPIC_SDK_VERSION).toMatch(/^\d+\.\d+\.\d+$/);
+    // The wire SDK version did NOT bump for 2.1.195.
+    expect(ANTHROPIC_SDK_VERSION).toBe("0.94.0");
   });
 });
 
@@ -31,6 +34,12 @@ describe("getSdkVersion", () => {
     expect(v).toMatch(/^\d+\.\d+\.\d+$/);
   });
 
+  it("resolves 2.1.195 (and the 2.1.160-2.1.194 range) to 0.94.0", () => {
+    expect(getSdkVersion("2.1.195")).toBe("0.94.0");
+    expect(getSdkVersion("2.1.160")).toBe("0.94.0");
+    expect(getSdkVersion("2.1.180")).toBe("0.94.0");
+  });
+
   it("falls back to ANTHROPIC_SDK_VERSION for an unknown CLI version", () => {
     expect(getSdkVersion("9.99.999")).toBe(ANTHROPIC_SDK_VERSION);
   });
@@ -53,6 +62,26 @@ describe("BETA_SHORTCUTS", () => {
   it("has a cache-diag alias for cache-diagnosis-2026-04-07", () => {
     expect(BETA_SHORTCUTS.get("cache-diag")).toBe("cache-diagnosis-2026-04-07");
   });
+
+  it("has server-side-fallback / fallback aliases for server-side-fallback-2026-06-01", () => {
+    expect(BETA_SHORTCUTS.get("server-side-fallback")).toBe("server-side-fallback-2026-06-01");
+    expect(BETA_SHORTCUTS.get("fallback")).toBe("server-side-fallback-2026-06-01");
+  });
+
+  it("has a fallback-credit alias for fallback-credit-2026-06-01", () => {
+    expect(BETA_SHORTCUTS.get("fallback-credit")).toBe("fallback-credit-2026-06-01");
+  });
+});
+
+describe("EXPERIMENTAL_BETA_FLAGS", () => {
+  it("is a Set", () => {
+    expect(EXPERIMENTAL_BETA_FLAGS).toBeInstanceOf(Set);
+  });
+
+  it("includes the 2.1.195 refusal-fallback registry betas", () => {
+    expect(EXPERIMENTAL_BETA_FLAGS.has("server-side-fallback-2026-06-01")).toBe(true);
+    expect(EXPERIMENTAL_BETA_FLAGS.has("fallback-credit-2026-06-01")).toBe(true);
+  });
 });
 
 describe("resolveBetaShortcut", () => {
@@ -72,6 +101,15 @@ describe("resolveBetaShortcut", () => {
     expect(resolveBetaShortcut("fast")).toBe("fast-mode-2026-02-01");
   });
 
+  it("expands server-side-fallback / fallback shortcuts", () => {
+    expect(resolveBetaShortcut("server-side-fallback")).toBe("server-side-fallback-2026-06-01");
+    expect(resolveBetaShortcut("fallback")).toBe("server-side-fallback-2026-06-01");
+  });
+
+  it("expands fallback-credit shortcut", () => {
+    expect(resolveBetaShortcut("fallback-credit")).toBe("fallback-credit-2026-06-01");
+  });
+
   it("returns the input unchanged when no alias matches", () => {
     expect(resolveBetaShortcut("context-hint-2026-04-09")).toBe("context-hint-2026-04-09");
     expect(resolveBetaShortcut("no-such-beta")).toBe("no-such-beta");
@@ -121,5 +159,6 @@ describe("buildExtendedUserAgent", () => {
   it("uses FALLBACK_CLAUDE_CLI_VERSION when explicitly passed as the version", () => {
     const ua = buildExtendedUserAgent(FALLBACK_CLAUDE_CLI_VERSION);
     expect(ua).toContain(FALLBACK_CLAUDE_CLI_VERSION);
+    expect(ua).toBe("claude-cli/2.1.195 (external, cli)");
   });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-anthropic-fix",
-  "version": "0.1.29",
+  "version": "0.1.31",
   "license": "GPL-3.0-or-later",
   "repository": {
     "type": "git",