opencode-anthropic-fix 1.0.0 → 2.0.0

package/cli.mjs

@@ -7,8 +7,8 @@
  *
  * Auth Commands:
  *   login             Add a new account via browser OAuth flow
- *   logout <N>        Revoke tokens and remove account N
- *   logout --all      Revoke all tokens and clear all accounts
+ *   logout <N>        Remove account N (discards its tokens)
+ *   logout --all      Remove all accounts (discards their tokens)
  *   reauth <N>        Re-authenticate account N with fresh OAuth tokens
  *   refresh <N>       Attempt token refresh (no browser needed)
  *
@@ -31,7 +31,8 @@
 import { loadAccounts, saveAccounts, getStoragePath, createDefaultStats } from "./lib/storage.mjs";
 import { loadConfig, saveConfig, getConfigPath, VALID_STRATEGIES } from "./lib/config.mjs";
 import { authorize, exchange, refreshToken, revoke } from "./lib/oauth.mjs";
-import { adjustActiveIndexAfterRemoval } from "./lib/account-state.mjs";
+import { adjustActiveIndexAfterRemoval, isTokenExpired } from "./lib/account-state.mjs";
+import { warnOnEphemeralTokenRotation } from "./lib/accounts.mjs";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { writeFile } from "node:fs/promises";
 import path from "node:path";
@@ -150,9 +151,16 @@ function rpad(str, width) {
  */
 export async function refreshAccessToken(account) {
   try {
-    const json = await refreshToken(account.refreshToken, { signal: AbortSignal.timeout(5000) });
+    // `clientId` is undefined for every normal account, which means "use the
+    // default". Only a CLAUDE_CODE_OAUTH_CLIENT_ID-seeded env account carries one
+    // (contract §5.2, divergence D10).
+    const json = await refreshToken(account.refreshToken, {
+      signal: AbortSignal.timeout(5000),
+      clientId: account.clientId,
+    });
     account.access = json.access_token;
     account.expires = Date.now() + json.expires_in * 1000;
+    warnOnEphemeralTokenRotation(account, json.refresh_token);
     if (json.refresh_token) account.refreshToken = json.refresh_token;
     account.token_updated_at = Date.now();
     return json.access_token;
@@ -194,7 +202,7 @@ export async function ensureTokenAndFetchUsage(account) {
   let token = account.access;
   let tokenRefreshed = false;
 
-  if (!token || !account.expires || account.expires < Date.now()) {
+  if (!token || isTokenExpired(account.expires)) {
     token = await refreshAccessToken(account);
     tokenRefreshed = !!token;
     if (!token) return { usage: null, tokenRefreshed: false };
@@ -301,7 +309,19 @@ function openBrowser(url) {
  * @returns {Promise<{refresh: string, access: string, expires: number, email?: string} | null>}
  */
 async function runOAuthFlow() {
-  const { url, verifier } = await authorize("max");
+  /** @type {{url: string, verifier: string}} */
+  let authorization;
+  try {
+    // `authorize()` rejects on a configuration problem before it does any work —
+    // an unapproved CLAUDE_CODE_CUSTOM_OAUTH_URL, or an approved one this plugin
+    // cannot honour. Those messages are written for the operator, so print them
+    // as an error rather than letting the promise reject into a stack trace.
+    authorization = await authorize("max");
+  } catch (err) {
+    console.error(c.red(`Error: ${err?.message ?? err}`));
+    return null;
+  }
+  const { url, verifier } = authorization;
 
   console.log("");
   console.log(c.bold("Opening browser for Anthropic OAuth login..."));
@@ -412,7 +432,28 @@ export async function cmdLogin() {
 }
 
 /**
- * Logout: revoke tokens and remove an account, or all accounts.
+ * Turn a `revoke()` outcome into a line that says what actually happened.
+ *
+ * Three outcomes, three messages. Collapsing "we did not try" and "we tried and
+ * it failed" into one line tells a user who opted into server-side revocation
+ * that their token was merely discarded locally, when in fact it is still live
+ * on the server. That is the one thing this function exists to prevent.
+ *
+ * @param {{ attempted: boolean, ok: boolean, status?: number, error?: string }} outcome
+ * @returns {string}
+ * @see docs/oauth-2.1.280-contract.md §7 divergence D1
+ */
+export function describeRevokeOutcome(outcome) {
+  if (!outcome?.attempted) {
+    return "Token discarded locally (server-side revocation is off; set oauth.revoke_on_logout to enable).";
+  }
+  if (outcome.ok) return "Token revoked server-side.";
+  const detail = outcome.status ? `HTTP ${outcome.status}` : outcome.error || "unknown error";
+  return `Server-side revocation failed (${detail}). Token removed locally; it may still be valid.`;
+}
+
+/**
+ * Logout: discard tokens and remove an account, or all accounts.
  * @param {string} arg - Account number
  * @param {object} [opts]
  * @param {boolean} [opts.force] Skip confirmation prompt
@@ -453,7 +494,7 @@ export async function cmdLogout(arg, opts = {}) {
     const rl = createInterface({ input: stdin, output: stdout });
     try {
       const answer = await rl.question(
-        `Logout account #${n} (${label})? This will revoke tokens and remove the account. [y/N]: `,
+        `Logout account #${n} (${label})? This will discard its tokens and remove the account. [y/N]: `,
       );
       if (answer.trim().toLowerCase() !== "y") {
         console.log(c.dim("Cancelled."));
@@ -464,13 +505,11 @@ export async function cmdLogout(arg, opts = {}) {
     }
   }
 
-  // Attempt token revocation (best-effort)
-  const revoked = await revoke(stored.accounts[idx].refreshToken);
-  if (revoked) {
-    console.log(c.dim("Token revoked server-side."));
-  } else {
-    console.log(c.dim("Token revocation skipped (server may not support it)."));
-  }
+  // Server-side revocation is opt-in (oauth.revoke_on_logout, default off): the
+  // genuine client has no revoke endpoint. Report what actually happened rather
+  // than implying a network call that was never made.
+  const outcome = await revoke(stored.accounts[idx].refreshToken);
+  console.log(c.dim(describeRevokeOutcome(outcome)));
 
   // Remove the account
   stored.accounts.splice(idx, 1);
@@ -491,7 +530,7 @@ export async function cmdLogout(arg, opts = {}) {
 }
 
 /**
- * Logout all accounts: revoke all tokens and clear storage.
+ * Logout all accounts: discard all tokens and clear storage.
  * @param {object} [opts]
  * @param {boolean} [opts.force] Skip confirmation prompt
  * @returns {Promise<number>} exit code
@@ -514,7 +553,7 @@ async function cmdLogoutAll(opts = {}) {
     const rl = createInterface({ input: stdin, output: stdout });
     try {
       const answer = await rl.question(
-        `Logout all ${count} account(s)? This will revoke tokens and remove all accounts. [y/N]: `,
+        `Logout all ${count} account(s)? This will discard their tokens and remove all accounts. [y/N]: `,
       );
       if (answer.trim().toLowerCase() !== "y") {
         console.log(c.dim("Cancelled."));
@@ -525,12 +564,26 @@ async function cmdLogoutAll(opts = {}) {
     }
   }
 
-  // Attempt token revocation for each account (best-effort, in parallel)
+  // Server-side revocation is opt-in (oauth.revoke_on_logout, default off).
   const results = await Promise.allSettled(stored.accounts.map((acc) => revoke(acc.refreshToken)));
-  const revokedCount = results.filter((r) => r.status === "fulfilled" && r.value === true).length;
-
-  if (revokedCount > 0) {
+  const outcomes = results.map((r) => (r.status === "fulfilled" ? r.value : { attempted: true, ok: false }));
+  const attempted = outcomes.filter((o) => o?.attempted === true).length;
+  const revokedCount = outcomes.filter((o) => o?.ok === true).length;
+
+  if (attempted === 0) {
+    // Nothing was sent. Say so, and say how to change it.
+    console.log(c.dim(`Discarded ${count} token(s) locally (server-side revocation is off).`));
+    console.log(c.dim("Enable it with: oauth.revoke_on_logout = true"));
+  } else if (revokedCount === attempted) {
     console.log(c.dim(`Revoked ${revokedCount} of ${count} token(s) server-side.`));
+  } else {
+    // Partial or total failure must not be reported as a clean local discard.
+    console.log(
+      c.yellow(
+        `Revoked ${revokedCount} of ${attempted} token(s) server-side; ` +
+          `${attempted - revokedCount} revocation(s) failed. Tokens removed locally anyway.`,
+      ),
+    );
   }
 
   // Write explicit empty state so running plugin instances reconcile immediately.
@@ -1574,8 +1627,8 @@ ${c.dim("Usage:")}
 
 ${c.dim("Auth Commands:")}
   ${pad(c.cyan("login"), 22)}Add a new account via browser OAuth flow
-  ${pad(c.cyan("logout") + " <N>", 22)}Revoke tokens and remove account N
-  ${pad(c.cyan("logout") + " --all", 22)}Revoke all tokens and clear all accounts
+  ${pad(c.cyan("logout") + " <N>", 22)}Remove account N (discards its tokens)
+  ${pad(c.cyan("logout") + " --all", 22)}Remove all accounts (discards their tokens)
   ${pad(c.cyan("reauth") + " <N>", 22)}Re-authenticate account N with fresh tokens
   ${pad(c.cyan("refresh") + " <N>", 22)}Attempt token refresh (no browser needed)
 
@@ -1602,7 +1655,7 @@ ${c.dim("Options:")}
 
 ${c.dim("Examples:")}
   ${bin} login             ${c.dim("# Add a new account via browser")}
-  ${bin} logout 2          ${c.dim("# Revoke tokens & remove account 2")}
+  ${bin} logout 2          ${c.dim("# Remove account 2 & discard its tokens")}
   ${bin} logout --all      ${c.dim("# Logout all accounts")}
   ${bin} reauth 1          ${c.dim("# Re-authenticate account 1")}
   ${bin} refresh 1         ${c.dim("# Quick token refresh for account 1")}

package/index.mjs

@@ -3,7 +3,7 @@ import { stdin, stdout } from "node:process";
 import { randomBytes, randomUUID, createHash as createHashCrypto } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join, resolve, basename } from "node:path";
-import { AccountManager, RATE_LIMIT_KEY_FAST } from "./lib/accounts.mjs";
+import { AccountManager, RATE_LIMIT_KEY_FAST, warnOnEphemeralTokenRotation } from "./lib/accounts.mjs";
 import {
   authorize as oauthAuthorize,
   exchange as oauthExchange,
@@ -32,7 +32,7 @@ import {
   maybeApplySessionToolResultDedupe,
   applyContextHintCompaction,
 } from "./lib/token-economy/transforms.mjs";
-import { shouldMicrocompact, buildMicrocompactBetas } from "./lib/token-economy/microcompact.mjs";
+import { shouldMicrocompact } from "./lib/token-economy/microcompact.mjs";
 import { redactSecrets, redactString } from "./lib/redact.mjs";
 import {
   createTransformedSSEStream,
@@ -44,7 +44,12 @@ import { isTruthyEnv } from "./lib/env.mjs";
 import { sessionMetrics, createInitialSessionMetrics, getAverageCacheHitRate } from "./lib/session-metrics.mjs";
 import { repairOrphanedToolUseBlocks } from "./lib/mimicry/request-helpers.mjs";
 import { resolveCacheTtl, shouldPlaceToolBreakpoint, updateBoundaryStability } from "./lib/mimicry/cache.mjs";
-import { SERVICE_WIDE_MAX_RETRIES, CONSECUTIVE_529_FALLBACK_THRESHOLD } from "./lib/tuning.mjs";
+import {
+  SERVICE_WIDE_MAX_RETRIES,
+  CONSECUTIVE_529_FALLBACK_THRESHOLD,
+  FOREGROUND_REFRESH_EXPIRY_BUFFER_MS,
+} from "./lib/tuning.mjs";
+import { isTokenExpired, isTokenUsable } from "./lib/account-state.mjs";
 import {
   computeServiceRetrySleepMs,
   selectFallbackModel,
@@ -1424,7 +1429,7 @@ export async function AnthropicAuthPlugin({ client }) {
        */
       async function getFilesAuth(acct) {
         let tok = acct.access;
-        if (!tok || !acct.expires || acct.expires < Date.now()) {
+        if (!tok || isTokenExpired(acct.expires)) {
           tok = await refreshAccountTokenSingleFlight(acct);
         }
         return {
@@ -2284,7 +2289,7 @@ export async function AnthropicAuthPlugin({ client }) {
           // Ignore idle failure here; foreground path handles refresh decisions.
         }
 
-        if (account.access && account.expires && account.expires > Date.now()) {
+        if (account.access && isTokenUsable(account.expires)) {
           return account.access;
         }
       } else {
@@ -2397,7 +2402,7 @@ export async function AnthropicAuthPlugin({ client }) {
     const excluded = new Set([activeAccount.index]);
     const candidates = accountManager
       .getEnabledAccounts(excluded)
-      .filter((acc) => !acc.expires || acc.expires <= now + getIdleRefreshWindowMs())
+      .filter((acc) => isTokenExpired(acc.expires, getIdleRefreshWindowMs(), now))
       .filter((acc) => {
         const last = idleRefreshLastAttempt.get(acc.id) ?? 0;
         return now - last >= getIdleRefreshMinIntervalMs();
@@ -2738,7 +2743,7 @@ export async function AnthropicAuthPlugin({ client }) {
                 let accessToken;
                 // Per-account token refresh
                 // Refresh 5 minutes before expiry to avoid mid-request token expiration (RE doc §1.10)
-                if (!account.access || !account.expires || account.expires < Date.now() + 300_000) {
+                if (!account.access || isTokenExpired(account.expires, FOREGROUND_REFRESH_EXPIRY_BUFFER_MS)) {
                   const attemptedRefreshToken = account.refreshToken;
                   try {
                     accessToken = await refreshAccountTokenSingleFlight(account);
@@ -2898,14 +2903,12 @@ export async function AnthropicAuthPlugin({ client }) {
                 const _baseTE = config.token_economy || {};
                 const _tokenEconomy = { ..._baseTE, __requestRole: _requestRole };
 
-                // Microcompact: inject clear betas at high context utilization
-                let _microcompactBetas = null;
+                // Microcompact: track high context utilization (state + toast only)
                 if (requestInit.body) {
                   const estimatedTokens = _parsedBodyOnce
                     ? estimatePromptTokensFromParsed(_parsedBodyOnce)
                     : estimatePromptTokens(requestInit.body);
                   if (shouldMicrocompact(estimatedTokens, config)) {
-                    _microcompactBetas = buildMicrocompactBetas();
                     if (!microcompactState.active) {
                       microcompactState.active = true;
                       microcompactState.lastActivatedTurn = sessionMetrics.turns;
@@ -4527,7 +4530,7 @@ export async function AnthropicAuthPlugin({ client }) {
 
       const getAccessToken = async () => {
         let tok = account.access;
-        if (!tok || !account.expires || account.expires < Date.now()) {
+        if (!tok || isTokenExpired(account.expires)) {
           tok = await refreshAccountTokenSingleFlight(account);
         }
         if (!tok) throw new Error("no access token available for Haiku call");
@@ -6170,7 +6173,7 @@ function applyDiskAuthIfFresher(account, diskAuth, options = {}) {
   const diskTokenUpdatedAt = diskAuth.tokenUpdatedAt || 0;
   const memTokenUpdatedAt = account.tokenUpdatedAt || 0;
   const diskHasDifferentAuth = diskAuth.refreshToken !== account.refreshToken || diskAuth.access !== account.access;
-  const memAuthExpired = !account.expires || account.expires <= Date.now();
+  const memAuthExpired = isTokenExpired(account.expires);
   const allowExpiredFallback = options.allowExpiredFallback === true;
   if (diskTokenUpdatedAt <= memTokenUpdatedAt && !(allowExpiredFallback && diskHasDifferentAuth && memAuthExpired)) {
     return false;
@@ -6206,7 +6209,7 @@ async function refreshAccountToken(account, client, _source = "foreground", { on
     // Accept CC credential if:
     //   - expiresAt is in the future (normal case), OR
     //   - expiresAt is 0/missing (CC didn't provide expiry — trust the token, let API 401 if stale)
-    if (match && (match.expiresAt === 0 || match.expiresAt > Date.now())) {
+    if (match && (match.expiresAt === 0 || isTokenUsable(match.expiresAt))) {
       account.access = match.accessToken;
       account.expires = match.expiresAt || Date.now() + 3600_000; // default 1h if unknown
       markTokenStateUpdated(account);
@@ -6242,7 +6245,7 @@ async function refreshAccountToken(account, client, _source = "foreground", { on
   if (!lock.acquired) {
     const diskAuth = await readDiskAccountAuth(account.id);
     const adopted = applyDiskAuthIfFresher(account, diskAuth, { allowExpiredFallback: true });
-    if (adopted && account.access && account.expires && account.expires > Date.now()) {
+    if (adopted && account.access && isTokenUsable(account.expires)) {
       return account.access;
     }
     throw new Error("Refresh lock busy");
@@ -6253,14 +6256,21 @@ async function refreshAccountToken(account, client, _source = "foreground", { on
     const adopted = applyDiskAuthIfFresher(account, diskAuthBeforeRefresh);
     // Apply fresher disk tokens for both foreground and idle paths — prevents an
     // unnecessary HTTP refresh when another process already rotated the token.
-    if (adopted && account.access && account.expires && account.expires > Date.now()) {
+    if (adopted && account.access && isTokenUsable(account.expires)) {
       return account.access;
     }
 
-    const json = await refreshToken(account.refreshToken, { signal: AbortSignal.timeout(15_000) });
+    // `clientId` is undefined for every normal account, which means "use the
+    // default". Only a CLAUDE_CODE_OAUTH_CLIENT_ID-seeded env account carries one
+    // (contract §5.2, divergence D10).
+    const json = await refreshToken(account.refreshToken, {
+      signal: AbortSignal.timeout(15_000),
+      clientId: account.clientId,
+    });
 
     account.access = json.access_token;
     account.expires = Date.now() + json.expires_in * 1000;
+    warnOnEphemeralTokenRotation(account, json.refresh_token);
     if (json.refresh_token) {
       account.refreshToken = json.refresh_token;
     }

package/lib/account-state.mjs

@@ -1,3 +1,51 @@
+import { OAUTH_EXPIRY_SKEW_SECONDS } from "./oauth-constants.mjs";
+
+/** The attested 30-second expiry skew, in milliseconds. @see docs/oauth-2.1.280-contract.md §3 */
+export const TOKEN_EXPIRY_SKEW_MS = OAUTH_EXPIRY_SKEW_SECONDS * 1000;
+
+/**
+ * The single expiry predicate. Every "is this access token still usable?"
+ * question in this repository routes through here.
+ *
+ * ATTESTED: §13.8 (byte 4418342) records `expiry skew (seconds): 30`. A token is
+ * therefore treated as expired 30 s before its nominal expiry, so a request is
+ * never sent with a credential that dies in flight.
+ *
+ * WHY leadMs IS A FLOOR AND NOT AN ADDEND. Some callers deliberately refresh far
+ * ahead of expiry — a foreground buffer, an idle-refresh window. Adding the skew
+ * to those would silently retune them; dropping the skew for them would leave a
+ * site that can still call a token valid seconds before it dies. Taking the
+ * larger of the two keeps every tuned lead time exactly as it was while
+ * guaranteeing the 30 s floor everywhere.
+ *
+ * A missing or non-numeric `expires` is EXPIRED, not valid: an unknown expiry is
+ * not evidence of freshness, and the alternative is sending a dead token.
+ *
+ * @param {number | null | undefined} expires - Absolute expiry, ms since epoch
+ * @param {number} [leadMs=0] - Extra lead time this caller wants
+ * @param {number} [now=Date.now()] - Injectable clock for tests
+ * @returns {boolean}
+ * @see docs/oauth-2.1.280-contract.md §3
+ */
+export function isTokenExpired(expires, leadMs = 0, now = Date.now()) {
+  if (typeof expires !== "number" || !Number.isFinite(expires)) return true;
+  const lead = Math.max(Number.isFinite(leadMs) ? leadMs : 0, TOKEN_EXPIRY_SKEW_MS);
+  return now >= expires - lead;
+}
+
+/**
+ * Convenience inverse of {@link isTokenExpired}. Exists so call sites read as
+ * the question they are asking instead of as a negation.
+ *
+ * @param {number | null | undefined} expires
+ * @param {number} [leadMs=0]
+ * @param {number} [now=Date.now()]
+ * @returns {boolean}
+ */
+export function isTokenUsable(expires, leadMs = 0, now = Date.now()) {
+  return !isTokenExpired(expires, leadMs, now);
+}
+
 /**
  * @typedef {import('./storage.mjs').AccountMetadata} AccountMetadata
  * @typedef {import('./storage.mjs').AccountStorage} AccountStorage