opencode-anthropic-fix 1.0.0 → 2.1.0

package/cli.mjs

@@ -7,8 +7,8 @@
  *
  * Auth Commands:
  *   login             Add a new account via browser OAuth flow
- *   logout <N>        Revoke tokens and remove account N
- *   logout --all      Revoke all tokens and clear all accounts
+ *   logout <N>        Remove account N (discards its tokens)
+ *   logout --all      Remove all accounts (discards their tokens)
  *   reauth <N>        Re-authenticate account N with fresh OAuth tokens
  *   refresh <N>       Attempt token refresh (no browser needed)
  *
@@ -31,7 +31,8 @@
 import { loadAccounts, saveAccounts, getStoragePath, createDefaultStats } from "./lib/storage.mjs";
 import { loadConfig, saveConfig, getConfigPath, VALID_STRATEGIES } from "./lib/config.mjs";
 import { authorize, exchange, refreshToken, revoke } from "./lib/oauth.mjs";
-import { adjustActiveIndexAfterRemoval } from "./lib/account-state.mjs";
+import { adjustActiveIndexAfterRemoval, isTokenExpired } from "./lib/account-state.mjs";
+import { warnOnEphemeralTokenRotation } from "./lib/accounts.mjs";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { writeFile } from "node:fs/promises";
 import path from "node:path";
@@ -150,9 +151,16 @@ function rpad(str, width) {
  */
 export async function refreshAccessToken(account) {
   try {
-    const json = await refreshToken(account.refreshToken, { signal: AbortSignal.timeout(5000) });
+    // `clientId` is undefined for every normal account, which means "use the
+    // default". Only a CLAUDE_CODE_OAUTH_CLIENT_ID-seeded env account carries one
+    // (contract §5.2, divergence D10).
+    const json = await refreshToken(account.refreshToken, {
+      signal: AbortSignal.timeout(5000),
+      clientId: account.clientId,
+    });
     account.access = json.access_token;
     account.expires = Date.now() + json.expires_in * 1000;
+    warnOnEphemeralTokenRotation(account, json.refresh_token);
     if (json.refresh_token) account.refreshToken = json.refresh_token;
     account.token_updated_at = Date.now();
     return json.access_token;
@@ -194,7 +202,7 @@ export async function ensureTokenAndFetchUsage(account) {
   let token = account.access;
   let tokenRefreshed = false;
 
-  if (!token || !account.expires || account.expires < Date.now()) {
+  if (!token || isTokenExpired(account.expires)) {
     token = await refreshAccessToken(account);
     tokenRefreshed = !!token;
     if (!token) return { usage: null, tokenRefreshed: false };
@@ -301,7 +309,19 @@ function openBrowser(url) {
  * @returns {Promise<{refresh: string, access: string, expires: number, email?: string} | null>}
  */
 async function runOAuthFlow() {
-  const { url, verifier } = await authorize("max");
+  /** @type {{url: string, verifier: string}} */
+  let authorization;
+  try {
+    // `authorize()` rejects on a configuration problem before it does any work —
+    // an unapproved CLAUDE_CODE_CUSTOM_OAUTH_URL, or an approved one this plugin
+    // cannot honour. Those messages are written for the operator, so print them
+    // as an error rather than letting the promise reject into a stack trace.
+    authorization = await authorize("max");
+  } catch (err) {
+    console.error(c.red(`Error: ${err?.message ?? err}`));
+    return null;
+  }
+  const { url, verifier } = authorization;
 
   console.log("");
   console.log(c.bold("Opening browser for Anthropic OAuth login..."));
@@ -412,7 +432,28 @@ export async function cmdLogin() {
 }
 
 /**
- * Logout: revoke tokens and remove an account, or all accounts.
+ * Turn a `revoke()` outcome into a line that says what actually happened.
+ *
+ * Three outcomes, three messages. Collapsing "we did not try" and "we tried and
+ * it failed" into one line tells a user who opted into server-side revocation
+ * that their token was merely discarded locally, when in fact it is still live
+ * on the server. That is the one thing this function exists to prevent.
+ *
+ * @param {{ attempted: boolean, ok: boolean, status?: number, error?: string }} outcome
+ * @returns {string}
+ * @see docs/oauth-2.1.280-contract.md §7 divergence D1
+ */
+export function describeRevokeOutcome(outcome) {
+  if (!outcome?.attempted) {
+    return "Token discarded locally (server-side revocation is off; set oauth.revoke_on_logout to enable).";
+  }
+  if (outcome.ok) return "Token revoked server-side.";
+  const detail = outcome.status ? `HTTP ${outcome.status}` : outcome.error || "unknown error";
+  return `Server-side revocation failed (${detail}). Token removed locally; it may still be valid.`;
+}
+
+/**
+ * Logout: discard tokens and remove an account, or all accounts.
  * @param {string} arg - Account number
  * @param {object} [opts]
  * @param {boolean} [opts.force] Skip confirmation prompt
@@ -453,7 +494,7 @@ export async function cmdLogout(arg, opts = {}) {
     const rl = createInterface({ input: stdin, output: stdout });
     try {
       const answer = await rl.question(
-        `Logout account #${n} (${label})? This will revoke tokens and remove the account. [y/N]: `,
+        `Logout account #${n} (${label})? This will discard its tokens and remove the account. [y/N]: `,
       );
       if (answer.trim().toLowerCase() !== "y") {
         console.log(c.dim("Cancelled."));
@@ -464,13 +505,11 @@ export async function cmdLogout(arg, opts = {}) {
     }
   }
 
-  // Attempt token revocation (best-effort)
-  const revoked = await revoke(stored.accounts[idx].refreshToken);
-  if (revoked) {
-    console.log(c.dim("Token revoked server-side."));
-  } else {
-    console.log(c.dim("Token revocation skipped (server may not support it)."));
-  }
+  // Server-side revocation is opt-in (oauth.revoke_on_logout, default off): the
+  // genuine client has no revoke endpoint. Report what actually happened rather
+  // than implying a network call that was never made.
+  const outcome = await revoke(stored.accounts[idx].refreshToken);
+  console.log(c.dim(describeRevokeOutcome(outcome)));
 
   // Remove the account
   stored.accounts.splice(idx, 1);
@@ -491,7 +530,7 @@ export async function cmdLogout(arg, opts = {}) {
 }
 
 /**
- * Logout all accounts: revoke all tokens and clear storage.
+ * Logout all accounts: discard all tokens and clear storage.
  * @param {object} [opts]
  * @param {boolean} [opts.force] Skip confirmation prompt
  * @returns {Promise<number>} exit code
@@ -514,7 +553,7 @@ async function cmdLogoutAll(opts = {}) {
     const rl = createInterface({ input: stdin, output: stdout });
     try {
       const answer = await rl.question(
-        `Logout all ${count} account(s)? This will revoke tokens and remove all accounts. [y/N]: `,
+        `Logout all ${count} account(s)? This will discard their tokens and remove all accounts. [y/N]: `,
       );
       if (answer.trim().toLowerCase() !== "y") {
         console.log(c.dim("Cancelled."));
@@ -525,12 +564,26 @@ async function cmdLogoutAll(opts = {}) {
     }
   }
 
-  // Attempt token revocation for each account (best-effort, in parallel)
+  // Server-side revocation is opt-in (oauth.revoke_on_logout, default off).
   const results = await Promise.allSettled(stored.accounts.map((acc) => revoke(acc.refreshToken)));
-  const revokedCount = results.filter((r) => r.status === "fulfilled" && r.value === true).length;
-
-  if (revokedCount > 0) {
+  const outcomes = results.map((r) => (r.status === "fulfilled" ? r.value : { attempted: true, ok: false }));
+  const attempted = outcomes.filter((o) => o?.attempted === true).length;
+  const revokedCount = outcomes.filter((o) => o?.ok === true).length;
+
+  if (attempted === 0) {
+    // Nothing was sent. Say so, and say how to change it.
+    console.log(c.dim(`Discarded ${count} token(s) locally (server-side revocation is off).`));
+    console.log(c.dim("Enable it with: oauth.revoke_on_logout = true"));
+  } else if (revokedCount === attempted) {
     console.log(c.dim(`Revoked ${revokedCount} of ${count} token(s) server-side.`));
+  } else {
+    // Partial or total failure must not be reported as a clean local discard.
+    console.log(
+      c.yellow(
+        `Revoked ${revokedCount} of ${attempted} token(s) server-side; ` +
+          `${attempted - revokedCount} revocation(s) failed. Tokens removed locally anyway.`,
+      ),
+    );
   }
 
   // Write explicit empty state so running plugin instances reconcile immediately.
@@ -1574,8 +1627,8 @@ ${c.dim("Usage:")}
 
 ${c.dim("Auth Commands:")}
   ${pad(c.cyan("login"), 22)}Add a new account via browser OAuth flow
-  ${pad(c.cyan("logout") + " <N>", 22)}Revoke tokens and remove account N
-  ${pad(c.cyan("logout") + " --all", 22)}Revoke all tokens and clear all accounts
+  ${pad(c.cyan("logout") + " <N>", 22)}Remove account N (discards its tokens)
+  ${pad(c.cyan("logout") + " --all", 22)}Remove all accounts (discards their tokens)
   ${pad(c.cyan("reauth") + " <N>", 22)}Re-authenticate account N with fresh tokens
   ${pad(c.cyan("refresh") + " <N>", 22)}Attempt token refresh (no browser needed)
 
@@ -1602,7 +1655,7 @@ ${c.dim("Options:")}
 
 ${c.dim("Examples:")}
   ${bin} login             ${c.dim("# Add a new account via browser")}
-  ${bin} logout 2          ${c.dim("# Revoke tokens & remove account 2")}
+  ${bin} logout 2          ${c.dim("# Remove account 2 & discard its tokens")}
   ${bin} logout --all      ${c.dim("# Logout all accounts")}
   ${bin} reauth 1          ${c.dim("# Re-authenticate account 1")}
   ${bin} refresh 1         ${c.dim("# Quick token refresh for account 1")}