opencode-anthropic-fix 0.6.0 → 1.0.0

package/README.md

@@ -58,7 +58,7 @@ The [original plugin](https://github.com/anomalyco/opencode-anthropic-auth) prov
 - **Health scoring** — tracks account reliability and prefers healthy accounts
 - **Standalone CLI** — manage accounts without opening OpenCode
 - **Configurable strategies** — sticky, round-robin, or hybrid account selection
-- **Claude Code signature emulation** — full HTTP header, system prompt, beta flag, and metadata mimicry derived from Claude Code's open source code. System prompt cache scoping follows the real CC's three-path `splitSysPromptPrefix()` architecture (boundary/global/org) with exact marker detection and scope-aware `cache_control` generation
+- **Claude Code signature emulation** — full HTTP header, system prompt, beta flag, and metadata mimicry derived from Claude Code's open source code. Canonical Claude Code protocol composition (headers, body, system prefix, betas, URL) is sourced from [`@tormentalabs/claude-code-wire-compat`](https://www.npmjs.com/package/@tormentalabs/claude-code-wire-compat); system prompt cache scoping stays host policy (`splitSystemCacheScopes`, boundary/global/org) with exact marker detection and scope-aware `cache_control` generation
 - **OAuth endpoint fingerprint parity** — matches the real CLI's bundled axios 1.13.6 HTTP client signature (`Accept`, `User-Agent`, `Content-Type`) on all OAuth token endpoint calls, required since 2026-03-21 server-side enforcement
 - **Billing header fingerprint parity** — `cc_version` suffix uses the real CLI's 3-char fingerprint hash (SHA-256 of salt + first user message chars + version), `cch=00000` is a static placeholder (xxHash64 attestation was removed in Claude Code v2.1.97), system prompt is sanitized to match Claude Code's pattern validation, and `X-Claude-Code-Session-Id` header is sent on all requests
 - **Adaptive thinking for Opus/Sonnet 4.6** — automatically normalizes thinking to `{type: "adaptive"}` for supported models, with `effort-2025-11-24` beta
@@ -597,9 +597,36 @@ The plugin also:
 - Emulates Claude-style request headers and beta flags by default
 - Sanitizes "OpenCode" references to "Claude Code" in system prompts (required by Anthropic's API)
 - In `prompt_compaction="minimal"`, deduplicates repeated/contained system blocks and uses a compact dedicated prompt for internal title-generation requests
-- Adds `?beta=true` to `/v1/messages` and `/v1/messages/count_tokens` requests
+- With signature emulation on, adds `?beta=true` to `/v1/messages` and `/v1/messages/count_tokens` requests (and
+  normalizes a `/messages` path to `/v1/messages`). With it off, the host's URL is sent untouched.
 
-When signature emulation is disabled (`signature_emulation.enabled=false`), the plugin falls back to legacy behavior including the Claude Code system prompt prefix.
+### Signature emulation
+
+`signature_emulation.enabled` is a strictly binary switch — there is no half-way mode.
+
+**On (default):** every `/v1/messages` and `/v1/messages/count_tokens` turn is built by the shared
+`@tormentalabs/claude-code-wire-compat` package: full Claude Code header set, beta list, identity/billing system
+blocks and `metadata.user_id`.
+
+**Off: pure passthrough plus the auth envelope.** The plugin forges nothing. Your request goes out as your client wrote
+it — same `user-agent`, same headers, same body bytes — with only three changes, all of which belong to the OAuth
+transport rather than to the disguise:
+
+- `authorization: Bearer <account token>` — without it there is no request and no account rotation;
+- `anthropic-beta` — **additive**: your value is preserved verbatim and `oauth-2025-04-20` is appended only when
+  missing, because the API rejects an OAuth bearer that does not carry it;
+- `x-api-key` and `x-session-affinity` are removed — a second credential must not travel next to your bearer, and the
+  affinity hint leaks session identity upstream.
+
+The body is not transformed either. Two fields are stripped because the API rejects them outright: the body-level
+`betas` field and any stainless-helper markers your client attached.
+
+> **Changed in the unreleased version.** Emulation-off used to still forge a `claude-cli` user-agent and REPLACE your
+> `anthropic-beta` with a minimal list, and it ran structural body normalizations (which also emptied your `system`
+> prompt and injected a `temperature` you never sent). All of that is gone. See the CHANGELOG.
+
+The system-prompt side is unchanged: with emulation off the plugin uses the legacy system transform path, including
+the Claude Code system prompt prefix.
 
 ## Files