opencode-anthropic-fix 0.1.31 → 0.2.0

package/lib/config.mjs

@@ -435,18 +435,17 @@ export const DEFAULT_CONFIG = {
     /** Also inject numeric length anchors (≤25 words between tool calls, ≤100 words final). */
     length_anchors: true,
   },
-  /** OAuth token-endpoint request fingerprint. HIGH-RISK knob — leave OFF unless
-   *  validated against a live refresh. */
+  /** OAuth token-endpoint request fingerprint. */
   oauth: {
-    /** When true, the OAuth token EXCHANGE/REFRESH POSTs use Claude Code
-     *  2.1.195's SDK-native-fetch fingerprint (`User-Agent:
+    /** When true (DEFAULT), the OAuth token EXCHANGE/REFRESH POSTs use Claude
+     *  Code 2.1.195's SDK-native-fetch fingerprint (`User-Agent:
      *  anthropic-sdk-typescript/0.94.0 userOAuthProvider`, `anthropic-beta:
-     *  oauth-2025-04-20`, no axios `Accept`). When false (DEFAULT), the legacy
-     *  axios fingerprint (`User-Agent: axios/1.13.6`, axios `Accept` header) is
-     *  sent byte-for-byte as before.
-     *  Default OFF: the token endpoint historically 429'd requests lacking the
-     *  axios UA, so this stays opt-in until proven against live refresh. */
-    sdk_token_useragent: false,
+     *  oauth-2025-04-20`, no axios `Accept`). When false, the legacy axios
+     *  fingerprint (`User-Agent: axios/1.13.6`, axios `Accept` header) is sent
+     *  byte-for-byte as before.
+     *  Default ON to match upstream CC 2.1.195's userOAuthProvider. Set to
+     *  `false` to revert to the legacy axios/1.13.6 + `Accept` fingerprint. */
+    sdk_token_useragent: true,
   },
 };
 

package/lib/config.test.mjs

@@ -1,5 +1,5 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { loadConfig, DEFAULT_CONFIG, getConfigDir, getConfigPath } from "./config.mjs";
+import { loadConfig, loadRawConfig, DEFAULT_CONFIG, getConfigDir, getConfigPath } from "./config.mjs";
 import { existsSync, readFileSync } from "node:fs";
 
 // Mock fs module
@@ -49,6 +49,28 @@ describe("getConfigDir", () => {
     const dir = getConfigDir();
     expect(dir.endsWith("opencode")).toBe(true);
   });
+
+  it("uses APPDATA on Windows", () => {
+    const originalAppData = process.env.APPDATA;
+    process.env.APPDATA = "C:\\Users\\test\\AppData\\Roaming";
+
+    expect(getConfigDir()).toBe("C:\\Users\\test\\AppData\\Roaming\\opencode");
+
+    if (originalAppData === undefined) delete process.env.APPDATA;
+    else process.env.APPDATA = originalAppData;
+  });
+
+  it("uses XDG_CONFIG_HOME on non-Windows platforms", () => {
+    const platform = vi.spyOn(process, "platform", "get").mockReturnValue("linux");
+    const originalXdgConfigHome = process.env.XDG_CONFIG_HOME;
+    process.env.XDG_CONFIG_HOME = "/tmp/custom-config";
+
+    expect(getConfigDir()).toBe("\\tmp\\custom-config\\opencode");
+
+    platform.mockRestore();
+    if (originalXdgConfigHome === undefined) delete process.env.XDG_CONFIG_HOME;
+    else process.env.XDG_CONFIG_HOME = originalXdgConfigHome;
+  });
 });
 
 describe("getConfigPath", () => {
@@ -70,7 +92,12 @@ describe("loadConfig", () => {
     delete process.env.OPENCODE_ANTHROPIC_EMULATE_CLAUDE_CODE_SIGNATURE;
     delete process.env.OPENCODE_ANTHROPIC_FETCH_CLAUDE_CODE_VERSION;
     delete process.env.OPENCODE_ANTHROPIC_PROMPT_COMPACTION;
+    delete process.env.OPENCODE_ANTHROPIC_OVERRIDE_MODEL_LIMITS;
+    delete process.env.OPENCODE_ANTHROPIC_CC_CREDENTIALS;
     delete process.env.OPENCODE_ANTHROPIC_ADAPTIVE_CONTEXT;
+    delete process.env.OPENCODE_ANTHROPIC_PROACTIVE_DISABLED;
+    delete process.env.OPENCODE_ANTHROPIC_ANTI_VERBOSITY;
+    delete process.env.OPENCODE_ANTHROPIC_LENGTH_ANCHORS;
   });
 
   afterEach(() => {
@@ -188,6 +215,206 @@ describe("loadConfig", () => {
     expect(config.token_bucket.regeneration_rate_per_minute).toBe(6);
   });
 
+  it("validates and merges every supported nested config section", () => {
+    existsSync.mockReturnValue(true);
+    readFileSync.mockReturnValue(
+      JSON.stringify({
+        failure_ttl_seconds: 9_000,
+        signature_emulation: {
+          enabled: false,
+          fetch_claude_code_version_on_startup: false,
+          prompt_compaction: "off",
+          workload: "  nightly-agent  ",
+        },
+        override_model_limits: { enabled: true, context: 3_000_000, output: -1 },
+        custom_betas: [" beta-one ", "", 42, "beta-two"],
+        health_score: {
+          initial: 80,
+          success_reward: 5,
+          rate_limit_penalty: -15,
+          failure_penalty: -30,
+          recovery_rate_per_hour: 4,
+          min_usable: 60,
+          max_score: 90,
+        },
+        token_bucket: { max_tokens: 75, regeneration_rate_per_minute: 8, initial_tokens: 70 },
+        toasts: { quiet: true, debounce_seconds: 12 },
+        headers: {
+          emulation_profile: "  2.1.0  ",
+          overrides: { "x-test": "value", ignored: 7, "": "empty-key" },
+          disable: [" X-REMOVE ", 10, "", "X-OTHER"],
+          billing_header: false,
+        },
+        idle_refresh: { enabled: false, window_minutes: 90, min_interval_minutes: 45 },
+        cache_policy: {
+          ttl: "5m",
+          ttl_supported: false,
+          boundary_marker: true,
+          hit_rate_warning_threshold: 2,
+        },
+        fast_mode: true,
+        telemetry: { emulate_minimal: true },
+        usage_toast: true,
+        cc_credential_reuse: { enabled: true, auto_detect: false, prefer_over_oauth: true },
+        adaptive_context: { enabled: false, escalation_threshold: 200_000, deescalation_threshold: 220_000 },
+        willow_mode: { enabled: false, idle_threshold_minutes: 45, cooldown_minutes: 90, min_turns_before_suggest: 5 },
+        token_economy: {
+          token_efficient_tools: true,
+          redact_thinking: false,
+          context_hint: false,
+          conservative: false,
+          debug_dump_bodies: true,
+          ttl_thinking_strip: false,
+          proactive_microcompact: false,
+          microcompact_percent: 20,
+          microcompact_keep_recent: 100,
+          stable_tool_ordering: false,
+          deferred_tool_names: ["read", 12, "grep"],
+          adaptive_thinking_zero_simple: false,
+          tool_result_dedupe: true,
+          fast_mode_auto: true,
+          trailing_summary_trim: true,
+          role_scoped_cache_ttl: false,
+          lean_system_non_main: false,
+          simple_system_prompt: false,
+        },
+        token_economy_strategies: {
+          system_prompt_tailing: true,
+          system_prompt_tail_turns: 0,
+          system_prompt_tail_max_chars: 100_000,
+          tool_deferral: true,
+          tool_description_compaction: true,
+          adaptive_tool_set: true,
+          tool_result_dedupe_session_wide: true,
+          haiku_rolling_summary: true,
+          stale_read_eviction: true,
+          per_tool_class_prune: true,
+        },
+        output_cap: { enabled: false, default_max_tokens: 100, escalated_max_tokens: 300_000 },
+        preconnect: { enabled: false, timeout_ms: 50 },
+        overflow_recovery: { enabled: false, safety_margin: 20_000 },
+        cache_break_detection: { enabled: false, alert_threshold: 1_500, adaptive_breakpoint: false },
+        request_classification: {
+          enabled: false,
+          background_max_service_retries: 3,
+          background_max_should_retries: 4,
+        },
+        token_budget: { enabled: true, default: 25_000, completion_threshold: 2 },
+        microcompact: { enabled: false, threshold_percent: 120 },
+        overload_recovery: { enabled: false, default_cooldown_ms: 500, poll_quota_on_overload: false },
+        account_management: { proactive_disabled: false },
+        anti_verbosity: { enabled: false, length_anchors: false },
+        oauth: { sdk_token_useragent: false },
+      }),
+    );
+
+    const config = loadConfig();
+
+    expect(config.failure_ttl_seconds).toBe(7_200);
+    expect(config.signature_emulation).toEqual({
+      enabled: false,
+      fetch_claude_code_version_on_startup: false,
+      prompt_compaction: "off",
+      workload: "nightly-agent",
+    });
+    expect(config.override_model_limits).toEqual({ enabled: true, context: 2_000_000, output: 0 });
+    expect(config.custom_betas).toEqual(["beta-one", "beta-two"]);
+    expect(config.health_score).toEqual({
+      initial: 80,
+      success_reward: 5,
+      rate_limit_penalty: -15,
+      failure_penalty: -30,
+      recovery_rate_per_hour: 4,
+      min_usable: 60,
+      max_score: 90,
+    });
+    expect(config.token_bucket).toEqual({ max_tokens: 75, regeneration_rate_per_minute: 8, initial_tokens: 70 });
+    expect(config.toasts).toEqual({ quiet: true, debounce_seconds: 12 });
+    expect(config.headers).toEqual({
+      emulation_profile: "2.1.0",
+      overrides: { "x-test": "value" },
+      disable: ["x-remove", "x-other"],
+      billing_header: false,
+    });
+    expect(config.idle_refresh).toEqual({ enabled: false, window_minutes: 90, min_interval_minutes: 45 });
+    expect(config.cache_policy).toEqual({
+      ttl: "5m",
+      ttl_supported: false,
+      boundary_marker: true,
+      hit_rate_warning_threshold: 1,
+    });
+    expect(config.fast_mode).toBe(true);
+    expect(config.telemetry.emulate_minimal).toBe(true);
+    expect(config.usage_toast).toBe(true);
+    expect(config.cc_credential_reuse).toEqual({ enabled: true, auto_detect: false, prefer_over_oauth: true });
+    expect(config.adaptive_context).toEqual({
+      enabled: false,
+      escalation_threshold: 200_000,
+      deescalation_threshold: 150_000,
+    });
+    expect(config.willow_mode).toEqual({
+      enabled: false,
+      idle_threshold_minutes: 45,
+      cooldown_minutes: 90,
+      min_turns_before_suggest: 5,
+    });
+    expect(config.token_economy).toEqual({
+      token_efficient_tools: true,
+      redact_thinking: false,
+      context_hint: false,
+      conservative: false,
+      debug_dump_bodies: true,
+      ttl_thinking_strip: false,
+      proactive_microcompact: false,
+      microcompact_percent: 30,
+      microcompact_keep_recent: 64,
+      stable_tool_ordering: false,
+      deferred_tool_names: ["read", "grep"],
+      adaptive_thinking_zero_simple: false,
+      tool_result_dedupe: true,
+      fast_mode_auto: true,
+      trailing_summary_trim: true,
+      role_scoped_cache_ttl: false,
+      lean_system_non_main: false,
+      simple_system_prompt: false,
+    });
+    expect(config.token_economy_strategies).toEqual({
+      system_prompt_tailing: true,
+      system_prompt_tail_turns: 1,
+      system_prompt_tail_max_chars: 50_000,
+      tool_deferral: true,
+      tool_description_compaction: true,
+      adaptive_tool_set: true,
+      tool_result_dedupe_session_wide: true,
+      haiku_rolling_summary: true,
+      stale_read_eviction: true,
+      per_tool_class_prune: true,
+    });
+    expect(config.output_cap).toEqual({ enabled: false, default_max_tokens: 256, escalated_max_tokens: 200_000 });
+    expect(config.preconnect).toEqual({ enabled: false, timeout_ms: 100 });
+    expect(config.overflow_recovery).toEqual({ enabled: false, safety_margin: 10_000 });
+    expect(config.cache_break_detection).toEqual({
+      enabled: false,
+      alert_threshold: 1_500,
+      adaptive_breakpoint: false,
+    });
+    expect(config.request_classification).toEqual({
+      enabled: false,
+      background_max_service_retries: 3,
+      background_max_should_retries: 4,
+    });
+    expect(config.token_budget).toEqual({ enabled: true, default: 25_000, completion_threshold: 1 });
+    expect(config.microcompact).toEqual({ enabled: false, threshold_percent: 100 });
+    expect(config.overload_recovery).toEqual({
+      enabled: false,
+      default_cooldown_ms: 1_000,
+      poll_quota_on_overload: false,
+    });
+    expect(config.account_management.proactive_disabled).toBe(false);
+    expect(config.anti_verbosity).toEqual({ enabled: false, length_anchors: false });
+    expect(config.oauth.sdk_token_useragent).toBe(false);
+  });
+
   // Environment variable overrides
   it("overrides strategy from OPENCODE_ANTHROPIC_STRATEGY", () => {
     existsSync.mockReturnValue(false);
@@ -378,6 +605,76 @@ describe("loadConfig", () => {
     const config = loadConfig();
     expect(config.adaptive_context.enabled).toBe(false);
   });
+
+  it("applies true-form environment overrides for feature switches", () => {
+    existsSync.mockReturnValue(true);
+    readFileSync.mockReturnValue(
+      JSON.stringify({
+        signature_emulation: { enabled: false, fetch_claude_code_version_on_startup: false, prompt_compaction: "off" },
+        override_model_limits: { enabled: false },
+        cc_credential_reuse: { enabled: false },
+        account_management: { proactive_disabled: false },
+        anti_verbosity: { enabled: false },
+      }),
+    );
+    process.env.OPENCODE_ANTHROPIC_EMULATE_CLAUDE_CODE_SIGNATURE = "true";
+    process.env.OPENCODE_ANTHROPIC_FETCH_CLAUDE_CODE_VERSION = "true";
+    process.env.OPENCODE_ANTHROPIC_PROMPT_COMPACTION = "minimal";
+    process.env.OPENCODE_ANTHROPIC_OVERRIDE_MODEL_LIMITS = "true";
+    process.env.OPENCODE_ANTHROPIC_CC_CREDENTIALS = "true";
+    process.env.OPENCODE_ANTHROPIC_PROACTIVE_DISABLED = "true";
+    process.env.OPENCODE_ANTHROPIC_ANTI_VERBOSITY = "true";
+
+    const config = loadConfig();
+
+    expect(config.signature_emulation).toMatchObject({
+      enabled: true,
+      fetch_claude_code_version_on_startup: true,
+      prompt_compaction: "minimal",
+    });
+    expect(config.override_model_limits.enabled).toBe(true);
+    expect(config.cc_credential_reuse.enabled).toBe(true);
+    expect(config.account_management.proactive_disabled).toBe(true);
+    expect(config.anti_verbosity.enabled).toBe(true);
+  });
+
+  it("applies false-form environment overrides for feature switches", () => {
+    existsSync.mockReturnValue(false);
+    process.env.OPENCODE_ANTHROPIC_OVERRIDE_MODEL_LIMITS = "false";
+    process.env.OPENCODE_ANTHROPIC_CC_CREDENTIALS = "false";
+    process.env.OPENCODE_ANTHROPIC_PROACTIVE_DISABLED = "false";
+    process.env.OPENCODE_ANTHROPIC_ANTI_VERBOSITY = "false";
+    process.env.OPENCODE_ANTHROPIC_LENGTH_ANCHORS = "false";
+
+    const config = loadConfig();
+
+    expect(config.override_model_limits.enabled).toBe(false);
+    expect(config.cc_credential_reuse.enabled).toBe(false);
+    expect(config.account_management.proactive_disabled).toBe(false);
+    expect(config.anti_verbosity).toEqual({ enabled: false, length_anchors: false });
+  });
+});
+
+describe("loadRawConfig", () => {
+  beforeEach(() => {
+    vi.resetAllMocks();
+  });
+
+  it("returns parsed values without applying validation", () => {
+    existsSync.mockReturnValue(true);
+    readFileSync.mockReturnValue(JSON.stringify({ failure_ttl_seconds: -10, custom_key: "preserved" }));
+
+    expect(loadRawConfig()).toEqual({ failure_ttl_seconds: -10, custom_key: "preserved" });
+  });
+
+  it("returns an empty object for missing, malformed, or non-object config", () => {
+    existsSync.mockReturnValueOnce(false).mockReturnValue(true);
+    readFileSync.mockReturnValueOnce("invalid json").mockReturnValueOnce("[]");
+
+    expect(loadRawConfig()).toEqual({});
+    expect(loadRawConfig()).toEqual({});
+    expect(loadRawConfig()).toEqual({});
+  });
 });
 
 describe("token_economy_strategies.haiku_rolling_summary", () => {

package/lib/diagnose.mjs

@@ -0,0 +1,184 @@
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { getConfigDir, loadConfig } from "./config.mjs";
+import { redactSecrets } from "./redact.mjs";
+import { FALLBACK_CLAUDE_CLI_VERSION } from "./request-headers.mjs";
+import { loadAccounts } from "./storage.mjs";
+
+const ENV_KEYS = [
+  "OPENCODE_ANTHROPIC_STRATEGY",
+  "OPENCODE_ANTHROPIC_DEBUG",
+  "OPENCODE_ANTHROPIC_MAX_BUDGET_USD",
+  "INITIAL_ACCOUNT",
+  "TELEMETRY_EMULATE",
+  "IGNORE_BUDGET",
+  "SIGNATURE_USER_ID",
+  "DISABLE_ADAPTIVE_THINKING",
+  "DISABLE_FAST_MODE",
+  "STREAM_IDLE_TIMEOUT_MS",
+  "CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS",
+  "DISABLE_1M_CONTEXT",
+  "ORGANIZATION_UUID",
+  "ENTRYPOINT",
+  "USE_BEDROCK",
+  "USE_FOUNDRY",
+  "USE_ANTHROPIC_AWS",
+  "USE_MANTLE",
+  "USE_VERTEX",
+  "ACCOUNT_UUID",
+  "EXTRA_METADATA",
+  "ATTRIBUTION_HEADER",
+  "WORKLOAD",
+  "FORCE_GLOBAL_CACHE",
+  "BACKGROUND",
+  "CONTAINER_ID",
+  "REMOTE_SESSION_ID",
+  "ADDITIONAL_PROTECTION",
+];
+
+function getPluginVersion() {
+  try {
+    const packagePath = fileURLToPath(new URL("../package.json", import.meta.url));
+    const packageJson = JSON.parse(readFileSync(packagePath, "utf8"));
+    return typeof packageJson.version === "string" ? packageJson.version : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+function getRuntimeEnv() {
+  const env = {};
+  for (const key of ENV_KEYS) {
+    if (process.env[key] !== undefined) env[key] = process.env[key];
+  }
+  return redactSecrets(env);
+}
+
+async function getAccountSummary() {
+  try {
+    const stored = await loadAccounts();
+    if (!stored || !Array.isArray(stored.accounts)) return { count: 0, items: [] };
+
+    const items = stored.accounts.map((account, index) => {
+      const item = { index };
+      for (const key of ["email", "disabled", "enabled", "consecutiveFailures", "rateLimitResetTimes"]) {
+        if (Object.hasOwn(account, key)) item[key] = account[key];
+      }
+      return item;
+    });
+
+    return redactSecrets({ count: items.length, items });
+  } catch {
+    return { count: 0, items: [] };
+  }
+}
+
+function sortedArtifactFiles(directory, prefix, extension) {
+  try {
+    if (!existsSync(directory)) return [];
+    return readdirSync(directory)
+      .filter((file) => file.startsWith(prefix) && file.endsWith(extension))
+      .sort()
+      .slice(-10);
+  } catch {
+    return [];
+  }
+}
+
+function requestDumpMetadata(directory) {
+  return sortedArtifactFiles(directory, "req-", ".json").map((file) => {
+    try {
+      const filePath = path.join(directory, file);
+      const envelope = JSON.parse(readFileSync(filePath, "utf8"));
+      return {
+        file,
+        correlationId: envelope.correlationId,
+        timestamp: envelope.timestamp,
+        bytes: statSync(filePath).size,
+      };
+    } catch {
+      return { file, error: "unparseable" };
+    }
+  });
+}
+
+function correlationIdFromResponseFile(file) {
+  const stem = file.slice("res-".length, -".sse".length);
+  const isoTimestamp = /^\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z-(.+)$/i.exec(stem);
+  if (isoTimestamp) return isoTimestamp[1];
+
+  const numericTimestamp = /^\d{10,}-(.+)$/.exec(stem);
+  if (numericTimestamp) return numericTimestamp[1];
+
+  const uuid = /([0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12})$/i.exec(stem);
+  return uuid?.[1] ?? stem;
+}
+
+function responseDumpMetadata(directory) {
+  const items = [];
+  for (const file of sortedArtifactFiles(directory, "res-", ".sse")) {
+    try {
+      items.push({
+        file,
+        correlationId: correlationIdFromResponseFile(file),
+        bytes: statSync(path.join(directory, file)).size,
+      });
+    } catch {
+      // A file can disappear between directory enumeration and stat; omit it rather than abort diagnostics.
+    }
+  }
+  return items;
+}
+
+function debugHeadersMetadata() {
+  try {
+    const filePath = path.join(getConfigDir(), "debug-headers.log");
+    if (!existsSync(filePath)) return { exists: false, sizeBytes: 0 };
+    return { exists: true, sizeBytes: statSync(filePath).size };
+  } catch {
+    return { exists: false, sizeBytes: 0 };
+  }
+}
+
+function getArtifactSummary() {
+  try {
+    const dumpsDirectory = path.join(os.homedir(), ".opencode", "opencode-anthropic-fix", "request-dumps");
+    return {
+      requestDumps: requestDumpMetadata(dumpsDirectory),
+      responseDumps: responseDumpMetadata(dumpsDirectory),
+      debugHeadersLog: debugHeadersMetadata(),
+    };
+  } catch {
+    return {
+      requestDumps: [],
+      responseDumps: [],
+      debugHeadersLog: { exists: false, sizeBytes: 0 },
+    };
+  }
+}
+
+/**
+ * Build a shareable diagnostic snapshot without exposing credentials.
+ *
+ * @returns {Promise<object>}
+ */
+export async function buildDiagnosticBundle() {
+  const bundle = {
+    meta: {
+      generatedAt: new Date().toISOString(),
+      pluginVersion: getPluginVersion(),
+      nodeVersion: process.version,
+      platform: process.platform,
+      mimicryBaseline: FALLBACK_CLAUDE_CLI_VERSION,
+    },
+    config: redactSecrets(loadConfig()),
+    env: getRuntimeEnv(),
+    accounts: await getAccountSummary(),
+    artifacts: getArtifactSummary(),
+  };
+
+  return redactSecrets(bundle);
+}

package/lib/diagnose.test.mjs

@@ -0,0 +1,122 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const state = vi.hoisted(() => ({
+  accounts: null,
+  config: {},
+  configDir: "/diagnose/config",
+  debugHeadersExists: false,
+  directoryExists: false,
+  entries: [],
+  fileContents: new Map(),
+  home: "/diagnose/home",
+}));
+
+vi.mock("node:fs", () => ({
+  existsSync: vi.fn((filePath) => {
+    const value = String(filePath);
+    if (value.endsWith("debug-headers.log")) return state.debugHeadersExists;
+    if (value.endsWith("request-dumps")) return state.directoryExists;
+    return false;
+  }),
+  readFileSync: vi.fn((filePath) => {
+    const value = String(filePath);
+    if (value.endsWith("package.json")) return JSON.stringify({ version: "1.2.3-test" });
+    const file = value.split(/[\\/]/).at(-1);
+    if (!state.fileContents.has(file)) throw new Error(`Missing fixture: ${file}`);
+    return state.fileContents.get(file);
+  }),
+  readdirSync: vi.fn(() => [...state.entries]),
+  statSync: vi.fn((filePath) => {
+    const file = String(filePath).split(/[\\/]/).at(-1);
+    const contents = state.fileContents.get(file) ?? "";
+    return { size: Buffer.byteLength(contents) };
+  }),
+}));
+
+vi.mock("node:os", () => ({
+  default: { homedir: vi.fn(() => state.home) },
+}));
+
+vi.mock("./config.mjs", () => ({
+  getConfigDir: vi.fn(() => state.configDir),
+  loadConfig: vi.fn(() => state.config),
+}));
+
+vi.mock("./storage.mjs", () => ({
+  loadAccounts: vi.fn(async () => state.accounts),
+}));
+
+import { buildDiagnosticBundle } from "./diagnose.mjs";
+
+describe("buildDiagnosticBundle", () => {
+  beforeEach(() => {
+    state.accounts = null;
+    state.config = {};
+    state.debugHeadersExists = false;
+    state.directoryExists = false;
+    state.entries = [];
+    state.fileContents.clear();
+  });
+
+  it("returns all sections without leaking seeded secrets", async () => {
+    const bearer = "Bearer diagnoseBearerToken123";
+    const apiKey = "sk-ant-diagnoseSecret123";
+    const oauthToken = "oat01DiagnoseSecret123";
+    const refreshToken = "literal-refresh-secret";
+    const access = "literal-access-secret";
+
+    state.config = {
+      authorization: bearer,
+      apiKey,
+      metadata: oauthToken,
+      refreshToken,
+    };
+    state.accounts = {
+      accounts: [
+        {
+          email: "alice@example.com",
+          enabled: true,
+          consecutiveFailures: 2,
+          rateLimitResetTimes: { primary: 1234 },
+          access,
+          refreshToken,
+        },
+      ],
+    };
+
+    const bundle = await buildDiagnosticBundle();
+    const serialized = JSON.stringify(bundle);
+
+    expect(Object.keys(bundle)).toEqual(["meta", "config", "env", "accounts", "artifacts"]);
+    expect(serialized).not.toMatch(/Bearer\s+[A-Za-z0-9]/);
+    expect(serialized).not.toMatch(/sk-ant-[A-Za-z0-9]{4,}/);
+    expect(serialized).not.toMatch(/\boat01[A-Za-z0-9]{8,}/);
+    for (const secret of [bearer, apiKey, oauthToken, refreshToken, access]) {
+      expect(serialized).not.toContain(secret);
+    }
+    expect(bundle.accounts.items[0].email).toBe("a***@example.com");
+    expect(bundle.accounts.items[0]).not.toHaveProperty("access");
+    expect(bundle.accounts.items[0]).not.toHaveProperty("refreshToken");
+  });
+
+  it("degrades gracefully when accounts and artifact directories are absent", async () => {
+    const bundle = await buildDiagnosticBundle();
+
+    expect(bundle.accounts).toEqual({ count: 0, items: [] });
+    expect(bundle.artifacts.requestDumps).toEqual([]);
+    expect(bundle.artifacts.responseDumps).toEqual([]);
+    expect(bundle.artifacts.debugHeadersLog).toEqual({ exists: false, sizeBytes: 0 });
+  });
+
+  it("records a corrupted request dump and continues", async () => {
+    const corruptFile = "req-2026-04-10T12-00-00-000Z-correlation.json";
+    state.directoryExists = true;
+    state.entries = [corruptFile];
+    state.fileContents.set(corruptFile, "{not-json");
+
+    const bundle = await buildDiagnosticBundle();
+
+    expect(bundle.artifacts.requestDumps).toEqual([{ file: corruptFile, error: "unparseable" }]);
+    expect(bundle.artifacts.responseDumps).toEqual([]);
+  });
+});

package/lib/env.mjs

@@ -0,0 +1,19 @@
+/**
+ * @param {string | undefined} value
+ * @returns {boolean}
+ */
+export function isTruthyEnv(value) {
+  if (!value) return false;
+  const normalized = value.trim().toLowerCase();
+  return normalized === "1" || normalized === "true" || normalized === "yes";
+}
+
+/**
+ * @param {string | undefined} value
+ * @returns {boolean}
+ */
+export function isFalsyEnv(value) {
+  if (!value) return false;
+  const normalized = value.trim().toLowerCase();
+  return normalized === "0" || normalized === "false" || normalized === "no";
+}