opencode-anthropic-fix 0.6.0 → 1.0.0

package/lib/mimicry/wire-compat.mjs

@@ -4,9 +4,124 @@
  * NOT promised because the returned HeaderPair array is converted to Headers.
  */
 
-import { buildClaudeCodeRequest, buildClaudeCodeCountTokensRequest } from "@tormentalabs/claude-code-wire-compat";
+import {
+  BETA_REGISTRY_2_1_233,
+  buildClaudeCodeRequest,
+  buildClaudeCodeCountTokensRequest,
+  CLAUDE_CODE_2_1_233_PROFILE,
+  hasOneMillionContext,
+  isAdaptiveThinkingModel,
+  isClaude3Model,
+  isEligibleFor1MContext,
+  isFable5Model,
+  isHaikuModel,
+  isMythos5Model,
+  isOpus46Model,
+  isOpus47Model,
+  isOpus48Model,
+  supportsStructuredOutputs,
+  supportsWebSearch,
+} from "@tormentalabs/claude-code-wire-compat";
 import { stripStainlessHelperMarkers } from "./headers.mjs";
 
+/**
+ * Model-family predicates, re-exported so the rest of the tree classifies models
+ * through the SAME catalogue the request builder classifies them with.
+ *
+ * These used to be hand-written regexes in `lib/mimicry/models.mjs`, maintained
+ * in parallel with the package's model catalogue and therefore free to drift
+ * from it: a request could be composed as an adaptive-thinking model by the
+ * package while the plugin's own gating said otherwise. Sourcing both sides from
+ * one place removes that whole class of divergence. The behavioural differences
+ * this migration introduces are pinned, row by row, in
+ * `test/conformance/model-predicates-parity.test.mjs`.
+ *
+ * `isEligibleFor1MContext` is deliberately NOT re-exported raw — see
+ * `isEligibleFor1MContextWire` below.
+ *
+ * The CAPABILITY predicates (`isHaikuModel`, `supportsStructuredOutputs`,
+ * `supportsWebSearch`) join them for the same reason. `lib/mimicry/headers.mjs`
+ * still declares its own local copies, but those now feed ONLY the frozen legacy
+ * header forge; every adapter-path decision reads the package's, which are
+ * ported from the genuine client's own capability table rather than guessed from
+ * a regex. The one measured behavioural difference —
+ * `supportsStructuredOutputs("claude-haiku-4-5")` is `true` upstream and was
+ * `false` under the plugin's "haiku never supports it" heuristic — is a mimicry
+ * fidelity FIX, and is pinned by the migration harness baseline.
+ */
+export {
+  hasOneMillionContext,
+  isAdaptiveThinkingModel,
+  isClaude3Model,
+  isFable5Model,
+  isHaikuModel,
+  isMythos5Model,
+  isOpus46Model,
+  isOpus47Model,
+  isOpus48Model,
+  supportsStructuredOutputs,
+  supportsWebSearch,
+};
+
+/**
+ * The genuine client's beta registry for the profile the plugin emulates,
+ * re-exported so the host's own beta tables can be RECONCILED against it
+ * without a second import point.
+ *
+ * `lib/betas.mjs` is host policy — what the plugin adds or suppresses on top of
+ * what the package composes — and it names beta headers as literal strings. A
+ * literal is exactly the thing that rots when upstream bumps a beta's date, and
+ * nothing used to notice. `lib/betas.test.mjs` now walks this registry and fails
+ * on a header that has drifted from it, so the rot is caught at test time rather
+ * than on the wire.
+ *
+ * Shape: `{ KEY: { featureKey, header } }`, deep-frozen by the package. It is
+ * pinned to 2.1.233 rather than derived from `WIRE_PROFILE` because the package
+ * exports no profile->registry accessor; if the emulated baseline moves, this
+ * binding and `WIRE_PROFILE` move together.
+ */
+export { BETA_REGISTRY_2_1_233 };
+
+/**
+ * 1M-context eligibility under the profile the plugin actually emulates.
+ *
+ * Unlike its siblings, the package's `isEligibleFor1MContext` is
+ * PROFILE-DEPENDENT: its second parameter selects the model catalogue, and it
+ * defaults to the package's own baseline (2.1.195), not to ours. The two
+ * disagree in practice — `claude-mythos-5` is ineligible under 2.1.195 and
+ * eligible under 2.1.233 — so calling it bare would gate the plugin's context
+ * decisions on a profile the plugin does not emulate anywhere else.
+ *
+ * This wrapper binds `WIRE_PROFILE`, so eligibility follows the emulated
+ * profile automatically if that baseline is ever bumped.
+ *
+ * @param {string | undefined} model
+ * @returns {boolean}
+ */
+export function isEligibleFor1MContextWire(model) {
+  return isEligibleFor1MContext(model, WIRE_PROFILE);
+}
+
+/**
+ * The protocol profile the plugin composes against, re-exported so the rest of
+ * the tree can read the baseline CLI version WITHOUT importing the package.
+ *
+ * This module is the single seam through which
+ * `@tormentalabs/claude-code-wire-compat` enters the plugin (pinned by
+ * `test/conformance/package-dependency-policy.test.mjs`), so a consumer that
+ * needs `cliVersion` — the startup value of `claudeCliVersion` in index.mjs, the
+ * `mimicryBaseline` reported by `lib/diagnose.mjs` — reads it from here instead
+ * of re-declaring a hand-maintained copy.
+ *
+ * NOTE: this is a BASELINE, not the profile the request path uses. The
+ * composition path deliberately passes no explicit `profile` so it inherits the
+ * package's `DEFAULT_PROFILE` (see `lib/mimicry/adapter-input.mjs`); naming a
+ * profile here only pins what the plugin reports about itself.
+ *
+ * @type {import('@tormentalabs/claude-code-wire-compat').ClaudeCodeProtocolProfile}
+ */
+export const WIRE_PROFILE = CLAUDE_CODE_2_1_233_PROFILE;
+
 const PROFILE_OVERRIDE_ENV = "OPENCODE_ANTHROPIC_PROFILE_OVERRIDE";
 
 const BODY_FIELD_NAMES = new Set([
@@ -63,18 +178,25 @@ function normalizeSystem(system) {
  * `normalizeModelId` (dist/model-identity.js) tests `includes("claude-opus-4-7")`
  * and never the dotted spelling, because the genuine Claude Code client emits
  * dashed ids. The plugin, by contrast, deliberately TOLERATES dotted ids
- * throughout — `lib/mimicry/models.mjs` matches with the `[._-]` character class
- * — so a host can legitimately hand us `claude-opus-4.7`.
+ * throughout — the package's own family predicates re-exported above accept
+ * `claude-opus-4.7` — so a host can legitimately hand us that spelling.
+ *
+ * WHY IT SURVIVED THE PACKAGE MIGRATION. The consolidation plan predicted this
+ * rewrite could be deleted once the family predicates came from the package,
+ * on the premise that the package normalizes the id for us. Measured against
+ * the installed package, that premise is WRONG, and the distinction is:
  *
- * Passing a dotted id straight through MISCLASSIFIES it. For
- * `claude-opus-4.7` no `includes` branch matches, so the fallback
- * `/claude-opus-4(?!-\d(?!\d))/` matches (the character after `claude-opus-4`
- * is `.`, not `-`) and the model resolves to `claude-opus-4-0`. That silently
- * drops `adaptiveThinking`, `supportsEffort`, `supportsMaxEffort` and
- * `supportsXhighEffort`, and wrongly turns `supportsTemperature` ON.
+ *   - DECISIONS are dotted-tolerant. The package's own predicates classify
+ *     `claude-opus-4.7` correctly (pinned as data in
+ *     `test/conformance/model-predicates-parity.test.mjs`).
+ *   - The BODY is not normalized. The package copies the caller's model
+ *     through VERBATIM apart from stripping `[1m]`-style markers, so feeding
+ *     it `claude-opus-4.7` bare yields `body.model === "claude-opus-4.7"`.
  *
- * The tolerance belongs to the plugin, so it is spent here and the package
- * receives the dashed id it is built for. The rewrite is deliberately narrow:
+ * The real API only accepts the dashed spelling, so dropping this rewrite
+ * would put an id on the wire that Anthropic rejects. The tolerance therefore
+ * belongs to the plugin, is spent here, and the package receives the dashed id
+ * it is built for. The rewrite is deliberately narrow:
  * a dot is only replaced when it FOLLOWS a letter or digit and PRECEDES a
  * digit, i.e. when it is a version separator (`claude-opus-4.7`,
  * `claude-3.5-sonnet`). A dot before a letter is left alone, so vendor

package/lib/oauth.mjs

@@ -23,8 +23,9 @@ const OAUTH_ACCEPT = "application/json, text/plain, */*";
 // this fingerprint: `User-Agent: anthropic-sdk-typescript/0.94.0
 // userOAuthProvider`, `anthropic-beta: oauth-2025-04-20`, JSON body, and NO
 // axios `Accept` header (native fetch sends no default Accept). The SDK version
-// mirrors request-headers.mjs `ANTHROPIC_SDK_VERSION` ("0.94.0"); hardcoded here
-// to avoid coupling the OAuth path to the messages-header module.
+// is the one real Claude Code 2.1.195 shipped ("0.94.0"); it is hardcoded here
+// so the OAuth token path stays decoupled from the wire seam
+// (lib/mimicry/wire-compat.mjs), which only describes /v1/messages traffic.
 const OAUTH_SDK_VERSION = "0.94.0";
 const OAUTH_SDK_USER_AGENT = `anthropic-sdk-typescript/${OAUTH_SDK_VERSION} userOAuthProvider`;
 const OAUTH_SDK_BETA = "oauth-2025-04-20";

package/lib/passthrough-headers.mjs

@@ -0,0 +1,152 @@
+/**
+ * The emulation-OFF request envelope.
+ *
+ * WHY THIS MODULE IS NOT UNDER lib/mimicry/. That is the point of it. With
+ * `signature_emulation.enabled === false` the plugin makes NO attempt to look
+ * like Claude Code, so no mimicry function may compose the outgoing headers —
+ * if one did, "off" would keep meaning "less mimicry" instead of "none", which
+ * is exactly the half-state Phase 2.2 removed.
+ *
+ * WHAT SURVIVES, AND WHY IT IS NOT MIMICRY. The plugin is an OAuth transport:
+ * it owns the AUTH ENVELOPE and nothing else.
+ *
+ *  - `authorization` — the selected account's bearer. Without it there is no
+ *    request; account rotation is the plugin's entire reason to exist.
+ *  - `anthropic-beta` — ADDITIVE, never substitutive. The host's value is
+ *    preserved verbatim and `oauth-2025-04-20` is appended when missing. That
+ *    beta is a CONTRACT of the OAuth token, not a fingerprint: the API rejects
+ *    an OAuth bearer without it (docs/claude-code-reverse-engineering.md §14.2
+ *    item 3 and §14.3, both listing it as MUST for OAuth). Forging the rest of
+ *    the beta list, or replacing the host's, would be mimicry — and is gone.
+ *  - `x-api-key`, `x-session-affinity` — REMOVED. The first is a competing
+ *    credential that would travel next to our bearer; the second is an opencode
+ *    SDK routing hint that leaks session identity upstream. Both are envelope
+ *    hygiene, not disguise.
+ *
+ * Everything else the host sent — `user-agent` above all — goes out untouched.
+ */
+
+import { stripStainlessHelperMarkers } from "./mimicry/headers.mjs";
+
+/** The beta the Anthropic API requires alongside an OAuth bearer. */
+export const OAUTH_BETA_FLAG = "oauth-2025-04-20";
+
+/**
+ * Credentials and routing hints that must not travel with our bearer.
+ * @see the module comment
+ */
+const STRIPPED_HOST_HEADERS = ["x-api-key", "x-session-affinity"];
+
+/**
+ * Copy the host's headers, from either carrier, into one mutable set.
+ *
+ * @param {Request | URL | string | undefined} input
+ * @param {RequestInit} requestInit
+ * @returns {Headers}
+ */
+function collectHostHeaders(input, requestInit) {
+  const headers = new Headers();
+
+  if (input instanceof Request) {
+    input.headers.forEach((value, name) => headers.set(name, value));
+  }
+
+  const initHeaders = requestInit?.headers;
+  if (initHeaders instanceof Headers) {
+    initHeaders.forEach((value, name) => headers.set(name, value));
+  } else if (Array.isArray(initHeaders)) {
+    for (const [name, value] of initHeaders) {
+      if (typeof value !== "undefined") headers.set(name, String(value));
+    }
+  } else if (initHeaders && typeof initHeaders === "object") {
+    for (const [name, value] of Object.entries(initHeaders)) {
+      if (typeof value !== "undefined") headers.set(name, String(value));
+    }
+  }
+
+  return headers;
+}
+
+/**
+ * Build the outgoing headers for a request that carries NO Claude Code
+ * emulation: the host's own headers plus the auth envelope.
+ *
+ * @param {Request | URL | string | undefined} input The host's fetch input.
+ * @param {RequestInit} requestInit The host's fetch init.
+ * @param {string} accessToken The selected account's access token.
+ * @returns {Headers}
+ */
+export function buildPassthroughHeaders(input, requestInit, accessToken) {
+  const headers = collectHostHeaders(input, requestInit);
+
+  for (const name of STRIPPED_HOST_HEADERS) headers.delete(name);
+
+  // ANTHROPIC_AUTH_TOKEN is the documented manual-bearer escape hatch and
+  // belongs to the same envelope: it selects WHICH token authenticates, not how
+  // the request looks.
+  const authTokenOverride = process.env.ANTHROPIC_AUTH_TOKEN?.trim();
+  headers.set("authorization", `Bearer ${authTokenOverride || accessToken}`);
+
+  const hostBetas = (headers.get("anthropic-beta") || "")
+    .split(",")
+    .map((beta) => beta.trim())
+    .filter(Boolean);
+  if (!hostBetas.includes(OAUTH_BETA_FLAG)) hostBetas.push(OAUTH_BETA_FLAG);
+  headers.set("anthropic-beta", hostBetas.join(","));
+
+  return headers;
+}
+
+/**
+ * Remove the body fields the Anthropic API does not accept, and nothing else.
+ *
+ * THE ONLY BODY EDITS LEFT WITH EMULATION OFF. Every structural normalization
+ * `transformRequestBody` performs (output cap, thinking, effort ->
+ * output_config, system sanitize/compact, metadata, cache breakpoints) is
+ * skipped on this path — the host's body goes out as the host wrote it. These
+ * two strips are the exception, on the same grounds as the auth envelope: they
+ * are what keeps the request VALID, not what makes it look like Claude Code.
+ * Both were already applied unconditionally with emulation off, so keeping them
+ * preserves a working request rather than adding policy.
+ *
+ *  - `betas` — never a first-party field. It existed for Bedrock, which cannot
+ *    forward custom HTTP headers; the first-party API answers "Extra inputs are
+ *    not permitted".
+ *  - the stainless-helper markers — a HOST-side signal (opencode tags a tool or
+ *    message so the plugin can derive `x-stainless-helper`). The plugin never
+ *    injects them and, with emulation off, never derives the header either; the
+ *    API has never known the keys and rejects them inside a tool definition.
+ *    The marker list lives in lib/mimicry/headers.mjs and is imported rather
+ *    than copied: the boundary rule this module enforces is that no mimicry
+ *    function COMPOSES a fingerprint here, and removing a field the API rejects
+ *    is the exact inverse of that.
+ *
+ * When neither is present the ORIGINAL string is returned, byte for byte: a
+ * re-serialization would reorder nothing today but would make the passthrough
+ * claim untrue tomorrow.
+ *
+ * @param {unknown} body
+ * @returns {unknown} The body, with the non-API fields removed if present.
+ */
+export function stripNonApiBodyFields(body) {
+  if (typeof body !== "string" || body.length === 0) return body;
+
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    // Not JSON — there is no field to strip, and rewriting is not our business.
+    return body;
+  }
+
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return body;
+
+  let changed = false;
+  if (Object.hasOwn(parsed, "betas")) {
+    delete parsed.betas;
+    changed = true;
+  }
+  if (stripStainlessHelperMarkers(parsed.tools, parsed.messages) > 0) changed = true;
+
+  return changed ? JSON.stringify(parsed) : body;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-anthropic-fix",
-  "version": "0.6.0",
+  "version": "1.0.0",
   "license": "GPL-3.0-or-later",
   "repository": {
     "type": "git",

package/lib/mimicry/models.mjs

@@ -1,146 +0,0 @@
-import { isTruthyEnv } from "../env.mjs";
-
-// Perf: module-scope regex reused across per-request hot paths. It does not use
-// the `/g` flag and is consumed via `.test()`, so the shared instance is
-// stateless and safe (no `lastIndex` to reset between calls).
-export const CLAUDE_3_MODEL_RE = /claude-3-/i;
-
-/**
- * Detects claude-opus-4.6 / claude-opus-4-6 model IDs.
- * These models use adaptive thinking (effort parameter) instead of
- * manual budgetTokens.
- * @param {string | undefined} model
- * @returns {boolean}
- */
-export function isOpus46Model(model) {
-  if (!model) return false;
-  // Match standard IDs (claude-opus-4-6, claude-opus-4.6) and Bedrock ARNs
-  // (arn:aws:bedrock:...anthropic.claude-opus-4-6-...).
-  // Also match bare "opus-4-6" / "opus-4.6" fragments for non-standard strings.
-  return /claude-opus-4[._-]6|opus[._-]4[._-]6/i.test(model);
-}
-
-/**
- * Detects claude-opus-4.7 / claude-opus-4-7 model IDs.
- * @param {string | undefined} model
- * @returns {boolean}
- */
-export function isOpus47Model(model) {
-  if (!model) return false;
-  return /claude-opus-4[._-]7|opus[._-]4[._-]7/i.test(model);
-}
-
-/**
- * Detects claude-opus-4.8 / claude-opus-4-8 model IDs.
- * Opus 4.8 (launched 2026-05-28) is an adaptive-thinking model: manual
- * `thinking: {type: "enabled", budget_tokens}` returns a 400 — it MUST use
- * `thinking: {type: "adaptive"}` + the effort parameter. It also supports
- * `speed: "fast"` (fast-mode research preview) and 1M context by default.
- * @param {string | undefined} model
- * @returns {boolean}
- */
-export function isOpus48Model(model) {
-  if (!model) return false;
-  return /claude-opus-4[._-]8|opus[._-]4[._-]8/i.test(model);
-}
-
-/**
- * Check if a model is eligible for 1M context (can receive context-1m beta).
- * Real CC v2.1.97 U01(): claude-sonnet-4* || opus-4-6 are eligible.
- * Also matches explicit "1m" in the name (e.g. "claude-opus-4-6[1m]").
- * @param {string} model
- * @returns {boolean}
- */
-export function isEligibleFor1MContext(model) {
-  if (!model) return false;
-  if (/(^|[-_ ])1m($|[-_ ])|context[-_]?1m|\[1m\]/i.test(model)) return true;
-  return (
-    /claude-sonnet-4|sonnet[._-]4/i.test(model) || isOpus46Model(model) || isOpus47Model(model) || isOpus48Model(model)
-  );
-}
-
-/**
- * Check if a model should ALWAYS use 1M context (static mode, no adaptive gating).
- * Only models with explicit "1m" in the name — NOT bare Opus 4.6.
- * When adaptive_context is enabled, Opus 4.6 uses the adaptive decision instead.
- * @param {string} model
- * @returns {boolean}
- */
-export function hasOneMillionContext(model) {
-  return /(^|[-_ ])1m($|[-_ ])|context[-_]?1m/i.test(model);
-}
-
-/**
- * Detects claude-sonnet-4.6 / claude-sonnet-4-6 model IDs.
- * @param {string | undefined} model
- * @returns {boolean}
- */
-export function isSonnet46Model(model) {
-  if (!model) return false;
-  return /claude-sonnet-4[._-]6|sonnet[._-]4[._-]6/i.test(model);
-}
-
-/**
- * @param {string | undefined} model
- * @returns {boolean}
- */
-export function isFable5Model(model) {
-  if (!model) return false;
-  return /claude-fable-5|fable[._-]5/i.test(model);
-}
-
-/**
- * @param {string | undefined} model
- * @returns {boolean}
- */
-export function isMythos5Model(model) {
-  if (!model) return false;
-  return /claude-mythos-5|mythos[._-]5/i.test(model);
-}
-
-/**
- * Detects models that support adaptive thinking ({type: "adaptive"}).
- * Currently: Opus 4.6, Opus 4.7, Opus 4.8, Sonnet 4.6, Fable 5, and Mythos 5.
- * @param {string | undefined} model
- * @returns {boolean}
- */
-export function isAdaptiveThinkingModel(model) {
-  return (
-    isOpus46Model(model) ||
-    isOpus47Model(model) ||
-    isOpus48Model(model) ||
-    isSonnet46Model(model) ||
-    isFable5Model(model) ||
-    isMythos5Model(model)
-  );
-}
-
-/**
- * @param {any} thinking
- * @param {string} model
- * @returns {any}
- */
-export function normalizeThinkingBlock(thinking, model) {
-  // If thinking is absent or not an object, pass through
-  if (!thinking || typeof thinking !== "object") {
-    return thinking;
-  }
-
-  // Adaptive thinking models always get { type: "adaptive" }
-  // regardless of what format the incoming thinking block has
-  if (isAdaptiveThinkingModel(model)) {
-    // Check for env-var override to force budget_tokens fallback
-    if (isTruthyEnv(process.env.OPENCODE_ANTHROPIC_DISABLE_ADAPTIVE_THINKING)) {
-      // Fallback: return as-is if already budget_tokens shape, otherwise default
-      if (thinking.type === "enabled" && typeof thinking.budget_tokens === "number") {
-        return thinking;
-      }
-      const parsedBudget = parseInt(process.env.MAX_THINKING_TOKENS, 10);
-      return { type: "enabled", budget_tokens: Number.isNaN(parsedBudget) ? 16000 : parsedBudget };
-    }
-    return { type: "adaptive" };
-  }
-
-  // Non-adaptive models: pass through unchanged
-  return thinking;
-}