opencode-anthropic-fix 1.0.0 → 2.0.0

package/lib/accounts.mjs

@@ -1,8 +1,10 @@
 import { createHash } from "node:crypto";
+import { isTokenUsable } from "./account-state.mjs";
 import { loadAccounts, saveAccounts, createDefaultStats } from "./storage.mjs";
 import { HealthScoreTracker, TokenBucketTracker, selectAccount } from "./rotation.mjs";
 import { calculateBackoffMs } from "./backoff.mjs";
 import { readCCCredentials } from "./cc-credentials.mjs";
+import { HEADLESS_REFRESH_TOKEN_VAR, resolveHeadlessLogin } from "./oauth-env.mjs";
 
 /** QA fix M12: hash token fragment instead of leaking raw prefix */
 function hashTokenFragment(token) {
@@ -22,7 +24,7 @@ function hashTokenFragment(token) {
  */
 
 /**
- * @typedef {'oauth' | 'cc-keychain' | 'cc-file'} AccountSource
+ * @typedef {'oauth' | 'cc-keychain' | 'cc-file' | 'env'} AccountSource
  */
 
 /**
@@ -42,7 +44,9 @@ function hashTokenFragment(token) {
  * @property {number | null} lastFailureTime
  * @property {string} [lastSwitchReason]
  * @property {AccountStats} stats
- * @property {AccountSource} [source] - Origin of the account. CC accounts must not enter OAuth HTTP refresh.
+ * @property {AccountSource} [source] - Origin of the account. CC accounts must not enter OAuth HTTP refresh. env accounts are process-lifetime only and are never persisted.
+ * @property {string} [clientId] - OAuth client id to refresh with. Only set for `env` accounts.
+ * @property {string[]} [scopes] - Scopes the operator declared for an `env` account. In-memory only.
  */
 
 const MAX_ACCOUNTS = 10;
@@ -58,6 +62,38 @@ const RATE_LIMIT_KEY_FAST = "anthropic:fast";
 
 export { RATE_LIMIT_KEY, RATE_LIMIT_KEY_FAST };
 
+/** One-shot latch so a rotating env credential warns once per process, not once per refresh. */
+let ephemeralRotationWarned = false;
+
+/**
+ * Warn when the server rotates the refresh token of an `env`-sourced account.
+ *
+ * An env credential is process-lifetime only by design, so its successor is
+ * written nowhere. Left silent, the next process start would re-seed the
+ * retired token from the environment and fail with no explanation. This is the
+ * one place that can see both the account's origin and the server's response.
+ *
+ * @param {{ source?: AccountSource, refreshToken?: string }} account
+ * @param {string | undefined} rotatedToken - `refresh_token` from the token response
+ * @returns {boolean} whether a warning was emitted
+ * @see docs/oauth-2.1.280-contract.md §5.2
+ */
+export function warnOnEphemeralTokenRotation(account, rotatedToken) {
+  if (account?.source !== "env") return false;
+  if (!rotatedToken || rotatedToken === account.refreshToken) return false;
+  if (ephemeralRotationWarned) return false;
+  ephemeralRotationWarned = true;
+  console.warn(
+    `[anthropic-auth] the server rotated the refresh token for the ${HEADLESS_REFRESH_TOKEN_VAR} account. The new token is held in memory only and will be lost when this process exits; update the environment variable to keep it.`,
+  );
+  return true;
+}
+
+/** Reset the one-shot rotation warning. Exported for tests only. */
+export function resetEphemeralRotationWarning() {
+  ephemeralRotationWarned = false;
+}
+
 /**
  * @typedef {object} StatsDelta
  * @property {number} requests
@@ -103,9 +139,10 @@ export class AccountManager {
    * Load accounts from disk, optionally merging with an OpenCode auth fallback.
    * @param {AnthropicAuthConfig} config
    * @param {{refresh: string, access?: string, expires?: number} | null} [authFallback]
+   * @param {Record<string, string | undefined>} [env]
    * @returns {Promise<AccountManager>}
    */
-  static async load(config, authFallback) {
+  static async load(config, authFallback, env = process.env) {
     const manager = new AccountManager(config);
     const stored = await loadAccounts();
 
@@ -144,7 +181,7 @@ export class AccountManager {
           const fallbackHasAccess = typeof authFallback.access === "string" && authFallback.access.length > 0;
           const fallbackExpires = typeof authFallback.expires === "number" ? authFallback.expires : 0;
           const matchExpires = typeof match.expires === "number" ? match.expires : 0;
-          const fallbackLooksFresh = fallbackHasAccess && fallbackExpires > Date.now();
+          const fallbackLooksFresh = fallbackHasAccess && isTokenUsable(fallbackExpires);
           const shouldAdoptFallback =
             fallbackLooksFresh && (!match.access || !match.expires || fallbackExpires > matchExpires);
           if (shouldAdoptFallback) {
@@ -158,6 +195,7 @@ export class AccountManager {
       // Merge CC credentials if enabled
       manager.#mergeCC(config);
 
+      manager.#seedEnvAccount(env);
       return manager;
     }
 
@@ -190,6 +228,7 @@ export class AccountManager {
     // Merge CC credentials if enabled
     manager.#mergeCC(config);
 
+    manager.#seedEnvAccount(env);
     return manager;
   }
 
@@ -270,6 +309,98 @@ export class AccountManager {
     }
   }
 
+  /**
+   * Seed a process-lifetime account from CLAUDE_CODE_OAUTH_REFRESH_TOKEN.
+   *
+   * The seeded account is marked `source: "env"` and is filtered out of every
+   * write to `anthropic-accounts.json`: persisting a credential the operator
+   * injected transiently would turn an environment variable into a stored
+   * secret the user never asked for.
+   *
+   * It is appended LAST so the positional mapping between `stored.accounts[i]`
+   * and `this.#accounts[i]` that `syncActiveIndexFromDisk` relies on still holds
+   * for every disk-backed account.
+   *
+   * A malformed declaration throws rather than degrading to disk accounts: an
+   * operator who set the variable meant to use it, and silently ignoring it
+   * would run the wrong credential.
+   *
+   * @param {Record<string, string | undefined> | undefined} env
+   */
+  #seedEnvAccount(env) {
+    const headless = resolveHeadlessLogin(env);
+    if (!headless) return;
+
+    // Already managed on disk. Leave the stored account untouched — re-tagging
+    // it `source: "env"` would make the next save silently delete it.
+    if (this.#accounts.some((acc) => acc.refreshToken === headless.refreshToken)) return;
+
+    if (this.#accounts.length >= MAX_ACCOUNTS) {
+      console.warn(
+        `[anthropic-auth] ${HEADLESS_REFRESH_TOKEN_VAR} was ignored: the account pool is already at its maximum of ${MAX_ACCOUNTS}.`,
+      );
+      return;
+    }
+
+    // The id is derived from the token hash alone and is therefore stable across
+    // restarts: a timestamp would add nothing the hash does not and would break
+    // id-keyed correlation between runs.
+    const now = Date.now();
+    this.#accounts.push({
+      id: `env:${hashTokenFragment(headless.refreshToken)}`,
+      index: this.#accounts.length,
+      email: undefined,
+      refreshToken: headless.refreshToken,
+      access: undefined,
+      expires: undefined,
+      tokenUpdatedAt: now,
+      addedAt: now,
+      lastUsed: 0,
+      enabled: true,
+      rateLimitResetTimes: {},
+      consecutiveFailures: 0,
+      lastFailureTime: null,
+      lastSwitchReason: "env",
+      stats: createDefaultStats(now),
+      source: "env",
+      clientId: headless.clientId,
+      scopes: headless.scopes,
+    });
+
+    if (this.#currentIndex < 0) this.#currentIndex = this.#accounts.length - 1;
+  }
+
+  /**
+   * Accounts that may be written to disk. `env` accounts are excluded by design.
+   * @returns {ManagedAccount[]}
+   */
+  #persistableAccounts() {
+    return this.#accounts.filter((acc) => acc.source !== "env");
+  }
+
+  /**
+   * Discard pending stats deltas belonging to `env` accounts.
+   *
+   * A delta is the amount to add to the value ON DISK; `recordUsage` has already
+   * applied the same increment to the in-memory record, which is why the normal
+   * save path rebuilds `mergedStats` from disk plus delta rather than from
+   * `acc.stats`. An env account has no disk row, so its in-memory stats are
+   * already the whole truth and re-applying the delta would double-count.
+   *
+   * The deltas must still be dropped: `saveToDisk` can return before the capture
+   * point, and a key that is never captured is never cleared, so env deltas would
+   * otherwise accumulate for the life of the process.
+   *
+   * @param {Set<string>} [keys] - Restrict to these delta keys; all when omitted.
+   */
+  #drainEnvStatsDeltas(keys) {
+    for (const acc of this.#accounts) {
+      if (acc.source !== "env") continue;
+      if (keys && !keys.has(acc.id)) continue;
+      this.#statsDeltas.delete(acc.id);
+    }
+  }
+
   /**
    * Get the number of enabled accounts.
    * @returns {number}
@@ -717,10 +848,26 @@ export class AccountManager {
       return null;
     };
 
+    // `env` accounts never reach disk. The persisted activeIndex is resolved by
+    // account id rather than by position, so it stays correct no matter where an
+    // env account sits in the in-memory list.
+    const persistable = this.#persistableAccounts();
+    const currentAccount = this.#currentIndex >= 0 ? this.#accounts[this.#currentIndex] : undefined;
+    const persistedActiveIndex = currentAccount ? persistable.findIndex((acc) => acc.id === currentAccount.id) : -1;
+
+    // Nothing to persist and nothing on disk: do not create an empty store.
+    // Writing `accounts: []` here would make the next load take the
+    // "disk is authoritative" branch and permanently refuse to bootstrap from an
+    // auth fallback — a process-lifetime env credential must not have that effect.
+    if (persistable.length === 0 && diskAccountsById === null) {
+      this.#drainEnvStatsDeltas();
+      return;
+    }
+
     /** @type {AccountStorage} */
     const storage = {
       version: 1,
-      accounts: this.#accounts.map((acc) => {
+      accounts: persistable.map((acc) => {
         const delta = this.#statsDeltas.get(acc.id);
         let mergedStats = acc.stats;
         const diskAcc = findDiskAccount(acc);
@@ -794,7 +941,7 @@ export class AccountManager {
           source: acc.source,
         };
       }),
-      activeIndex: Math.max(0, this.#currentIndex),
+      activeIndex: Math.max(0, persistedActiveIndex),
     };
 
     // QA fix H8: snapshot delta keys before the async write to avoid losing
@@ -809,6 +956,11 @@ export class AccountManager {
     const preloadedDiskData = diskAccountsById ? { version: 1, accounts: [...diskAccountsById.values()] } : null;
     await saveAccounts(storage, preloadedDiskData);
 
+    // Env accounts are absent from `storage`, so their deltas were never merged.
+    // Fold them into the in-memory record before the captured keys are dropped,
+    // otherwise every save silently discards an env account's usage.
+    this.#drainEnvStatsDeltas(capturedDeltaKeys);
+
     // Clear only the captured deltas; new ones added during await are preserved
     for (const key of capturedDeltaKeys) {
       this.#statsDeltas.delete(key);
@@ -833,9 +985,18 @@ export class AccountManager {
     const stored = await loadAccounts();
     if (!stored) return;
 
-    // Reconcile account list/enabled states with disk (CLI may add/remove/enable/disable)
-    const existingByTokenForSnapshot = new Map(this.#accounts.map((acc) => [acc.refreshToken, acc]));
-    const memSnapshot = this.#accounts.map((acc) => `${acc.id}:${acc.refreshToken}:${acc.enabled ? 1 : 0}`).join("|");
+    // Reconcile account list/enabled states with disk (CLI may add/remove/enable/disable).
+    // `env` accounts have no disk representation, so they are held aside and
+    // re-appended; comparing them against the disk snapshot would report a
+    // difference on every tick and rebuild the list forever.
+    // Captured before any rebuild: after the list is rebuilt, position is
+    // meaningless and only identity survives.
+    const currentBeforeSync = this.#currentIndex >= 0 ? this.#accounts[this.#currentIndex] : undefined;
+
+    const envAccounts = this.#accounts.filter((acc) => acc.source === "env");
+    const persistedMem = this.#persistableAccounts();
+    const existingByTokenForSnapshot = new Map(persistedMem.map((acc) => [acc.refreshToken, acc]));
+    const memSnapshot = persistedMem.map((acc) => `${acc.id}:${acc.refreshToken}:${acc.enabled ? 1 : 0}`).join("|");
 
     const diskSnapshot = stored.accounts
       .map((acc) => {
@@ -845,10 +1006,10 @@ export class AccountManager {
       .join("|");
 
     if (diskSnapshot !== memSnapshot) {
-      const existingById = new Map(this.#accounts.map((acc) => [acc.id, acc]));
-      const existingByToken = new Map(this.#accounts.map((acc) => [acc.refreshToken, acc]));
+      const existingById = new Map(persistedMem.map((acc) => [acc.id, acc]));
+      const existingByToken = new Map(persistedMem.map((acc) => [acc.refreshToken, acc]));
 
-      this.#accounts = stored.accounts.map((acc, index) => {
+      const rebuilt = stored.accounts.map((acc, index) => {
         const existing =
           (acc.id && existingById.get(acc.id)) || (!acc.id ? existingByToken.get(acc.refreshToken) : null);
         return {
@@ -871,6 +1032,17 @@ export class AccountManager {
         };
       });
 
+      // An env token that has since appeared on disk is no longer ephemeral:
+      // keeping both copies would give one credential two account entries that
+      // invalidate each other on the first refresh.
+      const rebuiltTokens = new Set(rebuilt.map((acc) => acc.refreshToken));
+      const survivingEnvAccounts = envAccounts.filter((acc) => !rebuiltTokens.has(acc.refreshToken));
+
+      this.#accounts = [...rebuilt, ...survivingEnvAccounts];
+      this.#accounts.forEach((acc, i) => {
+        acc.index = i;
+      });
+
       // Trackers are index-based; reset when account set/order changes.
       this.#healthTracker = new HealthScoreTracker(this.#config.health_score);
       this.#tokenTracker = new TokenBucketTracker(this.#config.token_bucket);
@@ -886,8 +1058,35 @@ export class AccountManager {
         this.#cursor = 0;
         return;
       }
+
+      // Re-anchor the selection by identity. Positions shift whenever disk gains
+      // or loses an account, so carrying the old index over silently switches the
+      // caller to a different credential.
+      const reanchored = currentBeforeSync ? this.#accounts.findIndex((acc) => acc.id === currentBeforeSync.id) : -1;
+      if (reanchored >= 0) {
+        this.#currentIndex = reanchored;
+        this.#cursor = reanchored;
+        // This is a BASELINE, not an override. The disk `activeIndex` remains
+        // authoritative for selection — that is the whole point of this method —
+        // so the handshake below still runs. Re-anchoring only decides where we
+        // stand if the handshake declines to move us (its target is disabled or
+        // absent); without it we would be left on whatever account happened to
+        // inherit our old numeric position.
+      } else if (this.#currentIndex >= this.#accounts.length) {
+        // The selected account is gone (a CLI logout-all can empty the disk list
+        // while an env account survives). Land on the last remaining account.
+        this.#currentIndex = this.#accounts.length - 1;
+        this.#cursor = this.#currentIndex;
+      }
     }
 
+    // `activeIndex` addresses the persisted list, which has no slot for an env
+    // account. When an env account is selected, `saveToDisk` necessarily wrote
+    // some other index, so honouring it here would deselect the env credential on
+    // the very next tick after every save.
+    const current = this.#currentIndex >= 0 ? this.#accounts[this.#currentIndex] : undefined;
+    if (current?.source === "env") return;
+
     const diskIndex = Math.min(stored.activeIndex, this.#accounts.length - 1);
     if (diskIndex >= 0 && diskIndex !== this.#currentIndex) {
       const diskAccount = stored.accounts[diskIndex];

package/lib/config.mjs

@@ -2,6 +2,8 @@ import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync } from "
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
 import { randomBytes } from "node:crypto";
+import { OAUTH_CLIENT_ID } from "./oauth-constants.mjs";
+import { PROJECT_SCOPES } from "./oauth-scopes.mjs";
 
 /**
  * @typedef {'sticky' | 'round-robin' | 'hybrid' | 'single'} AccountSelectionStrategy
@@ -104,7 +106,7 @@ import { randomBytes } from "node:crypto";
  * @property {{ enabled: boolean, default_cooldown_ms: number, poll_quota_on_overload: boolean }} overload_recovery
  * @property {{ proactive_disabled: boolean }} account_management
  * @property {{ enabled: boolean }} anti_verbosity
- * @property {{ sdk_token_useragent: boolean }} oauth
+ * @property {{ sdk_token_useragent: boolean, revoke_on_logout: boolean, plugins_scope: boolean, project_scopes: string[] }} oauth
  */
 
 /** @type {AnthropicAuthConfig} */
@@ -438,22 +440,51 @@ export const DEFAULT_CONFIG = {
   },
   /** OAuth token-endpoint request fingerprint. */
   oauth: {
-    /** When true (DEFAULT), the OAuth token EXCHANGE/REFRESH POSTs use Claude
-     *  Code 2.1.195's SDK-native-fetch fingerprint (`User-Agent:
-     *  anthropic-sdk-typescript/0.94.0 userOAuthProvider`, `anthropic-beta:
-     *  oauth-2025-04-20`, no axios `Accept`). When false, the legacy axios
-     *  fingerprint (`User-Agent: axios/1.13.6`, axios `Accept` header) is sent
-     *  byte-for-byte as before.
-     *  Default ON to match upstream CC 2.1.195's userOAuthProvider. Set to
-     *  `false` to revert to the legacy axios/1.13.6 + `Accept` fingerprint. */
+    /** [DEPRECATED — has no effect] Formerly selected between the SDK
+     *  fingerprint and a legacy `axios/1.13.6` one. Claude Code 2.1.280 has no
+     *  axios OAuth path, so setting this to `false` did not make a user more
+     *  anonymous — it made them the only client on the network sending that
+     *  shape. The axios path is removed; every token request now carries
+     *  `anthropic-sdk-typescript/0.112.1 userOAuthProvider`.
+     *  The key stays recognised so existing config files keep loading, and an
+     *  explicit value warns once per process.
+     *  @see docs/oauth-2.1.280-contract.md §7 divergence D2 */
     sdk_token_useragent: true,
+    /** Attempt RFC 7009 server-side revocation on logout. Default OFF.
+     *  `/v1/oauth/revoke` appears nowhere in the Claude Code 2.1.280 bundle, so
+     *  every revocation is a request that identifies this client. It is kept as
+     *  an opt-in rather than deleted, because users who want the affordance
+     *  should be able to choose it knowingly.
+     *  @see docs/oauth-2.1.280-contract.md §7 divergence D1 */
+    revoke_on_logout: false,
+    /** Request the `user:plugins` scope at authorize time. Default OFF.
+     *  §13.8 records that the genuine client appends `user:plugins` when its
+     *  `PLUGINS_SCOPE_REGISTERED` gate is on, but does not record the gate's
+     *  shipped state. Defaulting to off preserves the previously-emitted
+     *  five-scope string byte for byte; it is not a claim that the genuine
+     *  default is off.
+     *  @see docs/oauth-2.1.280-contract.md §4.2, §7 divergence D9 */
+    plugins_scope: false,
+    /** Extra project scopes to request at authorize time. Default none.
+     *  Only `user:projects:read` and `user:projects:write` are recognised;
+     *  anything else is dropped by the scope composer rather than forwarded,
+     *  because an unrecognised scope in the authorize URL is a fingerprint and
+     *  is likely to be rejected by the server. (§13.8 does not record how the
+     *  authorize endpoint treats an unknown scope, so "likely" is the strongest
+     *  claim the evidence supports.) A dropped entry is warned about once at
+     *  config-load time so the user is not left wondering.
+     *  @see docs/oauth-2.1.280-contract.md §4.2, §7 divergence D9 */
+    project_scopes: Object.freeze([]),
   },
 };
 
 export const VALID_STRATEGIES = ["sticky", "round-robin", "hybrid", "single"];
 
-/** OpenCode's OAuth client ID for Anthropic console auth flows. */
-export const CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+/** The OAuth client ID for Anthropic auth flows.
+ *  Re-exported from ./oauth-constants.mjs so there is exactly one literal in
+ *  the repository; this alias exists for the call sites that already import it
+ *  from here. */
+export const CLIENT_ID = OAUTH_CLIENT_ID;
 
 /**
  * Build a deep-cloned config object from defaults.
@@ -487,7 +518,7 @@ function createDefaultConfig() {
     microcompact: { ...DEFAULT_CONFIG.microcompact },
     overload_recovery: { ...DEFAULT_CONFIG.overload_recovery },
     account_management: { ...DEFAULT_CONFIG.account_management },
-    oauth: { ...DEFAULT_CONFIG.oauth },
+    oauth: { ...DEFAULT_CONFIG.oauth, project_scopes: [...DEFAULT_CONFIG.oauth.project_scopes] },
   };
 }
 
@@ -537,6 +568,12 @@ function clampNumber(value, min, max, fallback) {
  */
 let contextHintDeprecationWarned = false;
 
+/** One-time latch for the `oauth.sdk_token_useragent` deprecation warning. */
+let sdkTokenUserAgentDeprecationWarned = false;
+
+/** One-time latch for the `oauth.project_scopes` unrecognised-entry warning. */
+let projectScopesDropWarned = false;
+
 function validateConfig(raw) {
   const config = createDefaultConfig();
 
@@ -1045,9 +1082,50 @@ function validateConfig(raw) {
   // OAuth token-endpoint fingerprint sub-config
   if (raw.oauth && typeof raw.oauth === "object") {
     const o = /** @type {Record<string, unknown>} */ (raw.oauth);
+
+    // Non-silent deprecation. Any explicit value warns, because both values now
+    // produce the same request: a user who set `false` deliberately is relying
+    // on behaviour that no longer exists and deserves to be told, and a user who
+    // set `true` is carrying a setting that no longer means anything.
+    if (typeof o.sdk_token_useragent === "boolean" && !sdkTokenUserAgentDeprecationWarned) {
+      sdkTokenUserAgentDeprecationWarned = true;
+
+      // The message deliberately carries no `2.1.<NN>` literal. A version string
+      // in production source is exactly what the version-literals conformance
+      // guard exists to forbid, and weakening that guard for a log line would
+      // trade a real invariant for a cosmetic one.
+      console.warn(
+        "[anthropic-auth] oauth.sdk_token_useragent is deprecated and has no effect: " +
+          "no axios OAuth path exists in the genuine client, so token requests always send " +
+          "the SDK user-agent. See the OAuth wire contract doc, divergence D2. " +
+          "Remove the setting from your config to silence this warning.",
+      );
+    }
+
+    // Unrecognised project scopes are dropped here AND downstream by the scope
+    // composer. Dropping silently in two places is how a user ends up staring
+    // at a typo that produces no error and no scope, so say it once.
+    let projectScopes = [...DEFAULT_CONFIG.oauth.project_scopes];
+    if (Array.isArray(o.project_scopes)) {
+      const requested = o.project_scopes.filter((s) => typeof s === "string");
+      projectScopes = requested.filter((s) => PROJECT_SCOPES.includes(s));
+      const dropped = requested.filter((s) => !PROJECT_SCOPES.includes(s));
+      if (dropped.length > 0 && !projectScopesDropWarned) {
+        projectScopesDropWarned = true;
+        console.warn(
+          `[anthropic-auth] oauth.project_scopes contains unrecognised entries that were dropped: ` +
+            `${dropped.join(", ")}. Recognised values are: ${PROJECT_SCOPES.join(", ")}.`,
+        );
+      }
+    }
+
     config.oauth = {
       sdk_token_useragent:
         typeof o.sdk_token_useragent === "boolean" ? o.sdk_token_useragent : DEFAULT_CONFIG.oauth.sdk_token_useragent,
+      revoke_on_logout:
+        typeof o.revoke_on_logout === "boolean" ? o.revoke_on_logout : DEFAULT_CONFIG.oauth.revoke_on_logout,
+      plugins_scope: typeof o.plugins_scope === "boolean" ? o.plugins_scope : DEFAULT_CONFIG.oauth.plugins_scope,
+      project_scopes: projectScopes,
     };
   }
 

package/lib/mimicry/adapter-input.mjs

@@ -240,9 +240,11 @@ export const ADAPTER_ENV_KEYS = Object.freeze([
  * PROFILE INHERITANCE POLICY. The adapter never passes an explicit `profile`
  * argument to the package's entry points; omitting it IS the mechanism by which
  * the plugin inherits whatever `DEFAULT_PROFILE` the installed
- * `@tormentalabs/claude-code-wire-compat` declares. The dependency is tracked at
- * the `latest` dist-tag, so each package release can advance the default profile
- * and the plugin follows without a code change to the composition path.
+ * `@tormentalabs/claude-code-wire-compat` declares. Under the `latest` dist-tag
+ * each package release can advance the default profile and the plugin follows
+ * without a code change to the composition path. The dependency is currently
+ * pinned to an exact version instead, holding the default profile back until the
+ * plugin is ported to the next one (docs/shared-package-provenance.md).
  *
  * These two constants are the baseline `resolveProfileOverride` compares
  * against, and they are READ FROM the profile through the seam

package/lib/oauth-constants.mjs

@@ -0,0 +1,109 @@
+/**
+ * Every value here is transcribed from docs/oauth-2.1.280-contract.md, the local
+ * contract for the genuine Claude Code 2.1.280 OAuth surface, recorded from
+ * section 13.8 of the bundle analysis. No value may be guessed or interpolated
+ * from another release.
+ *
+ * Scope: this module holds only the constants this plugin actually emits. The
+ * contract also records the OIDC federation surface (contract §2.4, §3), which
+ * this plugin deliberately does not implement — see divergence D12. Its
+ * constants are intentionally absent here rather than exported unused, so that
+ * every export in this file has a live consumer and a conformance assertion.
+ */
+
+/**
+ * Genuine OAuth client identifier.
+ * @see docs/oauth-2.1.280-contract.md §1.1
+ */
+export const OAUTH_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+
+/**
+ * Console authorization endpoint.
+ * @see docs/oauth-2.1.280-contract.md §1
+ */
+export const OAUTH_CONSOLE_AUTHORIZE_URL = "https://platform.claude.com/oauth/authorize";
+
+/**
+ * Genuine consumer authorize page on claude.com/cai/, not claude.ai.
+ * This URL and OAUTH_CLAUDE_AI_ORIGIN are different and must never be collapsed.
+ * @see docs/oauth-2.1.280-contract.md §1
+ */
+export const OAUTH_CLAUDE_AI_AUTHORIZE_URL = "https://claude.com/cai/oauth/authorize";
+
+/**
+ * Consumer origin, distinct from the consumer authorize page on claude.com/cai/.
+ * This origin and OAUTH_CLAUDE_AI_AUTHORIZE_URL must never be collapsed.
+ * @see docs/oauth-2.1.280-contract.md §1
+ */
+export const OAUTH_CLAUDE_AI_ORIGIN = "https://claude.ai";
+
+/**
+ * Attested absolute token URL. The contract marks the host binding
+ * [unattested-bind]: which request uses this URL is not attested. Do not fix the host.
+ * @see docs/oauth-2.1.280-contract.md §1, §2.6
+ */
+export const OAUTH_TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
+
+/**
+ * OAuth code callback URI.
+ * @see docs/oauth-2.1.280-contract.md §1.1
+ */
+export const OAUTH_REDIRECT_URI = "https://platform.claude.com/oauth/code/callback";
+
+/**
+ * OAuth API key creation endpoint.
+ * @see docs/oauth-2.1.280-contract.md §1
+ */
+export const OAUTH_API_KEY_URL = "https://api.anthropic.com/api/oauth/claude_cli/create_api_key";
+
+/**
+ * SDK version embedded in the genuine release.
+ * @see docs/oauth-2.1.280-contract.md §3
+ */
+export const OAUTH_SDK_VERSION = "0.112.1";
+
+/**
+ * User OAuth provider SDK user agent.
+ * @see docs/oauth-2.1.280-contract.md §3
+ */
+export const OAUTH_SDK_USER_AGENT = `anthropic-sdk-typescript/${OAUTH_SDK_VERSION} userOAuthProvider`;
+
+/**
+ * OAuth beta identifier. Sent on every token request.
+ * @see docs/oauth-2.1.280-contract.md §3
+ */
+export const OAUTH_BETA = "oauth-2025-04-20";
+
+/**
+ * OAuth expiry skew in seconds.
+ * @see docs/oauth-2.1.280-contract.md §3
+ */
+export const OAUTH_EXPIRY_SKEW_SECONDS = 30;
+
+/**
+ * Approved custom OAuth endpoints, frozen to preserve the attested allowlist.
+ * @see docs/oauth-2.1.280-contract.md §5.1
+ */
+export const OAUTH_CUSTOM_URL_ALLOWLIST = Object.freeze([
+  "https://beacon.claude-ai.staging.ant.dev",
+  "https://claude.fedstart.com",
+  "https://claude-staging.fedstart.com",
+]);
+
+/**
+ * Default local apps base URL.
+ * @see docs/oauth-2.1.280-contract.md §5
+ */
+export const OAUTH_LOCAL_APPS_BASE_DEFAULT = "http://localhost:4000";
+
+/**
+ * Default local console base URL.
+ * @see docs/oauth-2.1.280-contract.md §5
+ */
+export const OAUTH_LOCAL_CONSOLE_BASE_DEFAULT = "http://localhost:3000";
+
+/**
+ * Must match the genuine rejection string byte-for-byte, including its trailing full stop.
+ * @see docs/oauth-2.1.280-contract.md §5.1
+ */
+export const OAUTH_CUSTOM_URL_REJECTION_MESSAGE = "CLAUDE_CODE_CUSTOM_OAUTH_URL is not an approved endpoint.";