opencode-anthropic 0.0.0-stage → 0.1.2

package/login.mjs

@@ -0,0 +1,158 @@
+#!/usr/bin/env node
+// Interactive login for Claude Pro/Max OAuth.
+//
+// Usage:
+//   opencode-anthropic login                  (installed package)
+//   node /path/to/login.mjs                   (source checkout)
+//   node /path/to/login.mjs --no-browser      (print the URL only)
+//
+// The script opens the browser flow, exchanges the pasted code for tokens,
+// registers an Anthropic OAuth credential in the running OpenCode server, and
+// saves a local token cache bound to that credential. Token values never
+// travel through process arguments: the server is reached directly over its
+// local HTTP API.
+import { spawn, spawnSync } from "node:child_process";
+import { chmodSync, mkdirSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { createInterface as createPrompt } from "node:readline/promises";
+import { stdin, stdout } from "node:process";
+import { TOKENS_FILE, createAuthorizationRequest, exchangeCodeForTokens } from "./oauth.mjs";
+
+const METHOD_ID = "claude-pro-max";
+const LABEL = "Claude Pro/Max";
+const noBrowser = process.argv.slice(2).includes("--no-browser");
+
+function openBrowser(url) {
+  const [command, args] =
+    process.platform === "darwin"
+      ? ["open", [url]]
+      : process.platform === "win32"
+        ? ["cmd", ["/c", "start", "", url]]
+        : ["xdg-open", [url]];
+  try {
+    const child = spawn(command, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {});
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function discoverServer() {
+  const override = process.env.OPENCODE_SERVER_URL;
+  if (override) return override.replace(/\/+$/, "");
+  const result = spawnSync("opencode", ["service", "status"], { encoding: "utf8" });
+  const match = /(https?:\/\/[^\s]+)/.exec(`${result.stdout ?? ""}${result.stderr ?? ""}`);
+  return match ? match[1].replace(/\/+$/, "") : null;
+}
+
+async function api(base, method, path, body) {
+  const response = await fetch(`${base}${path}`, {
+    method,
+    headers: body === undefined ? undefined : { "content-type": "application/json" },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+  const text = await response.text();
+  let data = null;
+  try {
+    data = text ? JSON.parse(text) : null;
+  } catch {}
+  return { ok: response.ok, status: response.status, data };
+}
+
+function printRegistrationFailure(reason) {
+  console.log("");
+  console.log(`! Could not register the credential in OpenCode: ${reason}.`);
+  console.log("  Make sure OpenCode is running and the `opencode` CLI is on your PATH,");
+  console.log("  then run the login again. Without the credential the plugin stays inactive.");
+}
+
+async function registerCredential(tokens) {
+  const base = discoverServer();
+  if (!base) {
+    printRegistrationFailure("could not find the OpenCode server (is the `opencode` CLI on your PATH?)");
+    return null;
+  }
+  const list = await api(base, "GET", "/api/credential");
+  if (!list.ok || !Array.isArray(list.data?.data)) {
+    printRegistrationFailure(`the server answered HTTP ${list.status} while listing credentials`);
+    return null;
+  }
+  for (const entry of list.data.data) {
+    if (entry.integrationID === "anthropic" && entry.value?.type === "oauth" && entry.value?.methodID === METHOD_ID) {
+      await api(base, "DELETE", `/api/credential/${entry.id}`);
+    }
+  }
+  const created = await api(base, "POST", "/api/credential", {
+    integrationID: "anthropic",
+    label: LABEL,
+    value: {
+      type: "oauth",
+      methodID: METHOD_ID,
+      access: tokens.access,
+      refresh: tokens.refresh,
+      expires: tokens.expires,
+    },
+    activate: true,
+  });
+  if (!created.ok) {
+    printRegistrationFailure(`the server answered HTTP ${created.status} while creating the credential`);
+    return null;
+  }
+  return created.data?.data?.id ?? null;
+}
+
+function saveTokens(tokens) {
+  mkdirSync(dirname(TOKENS_FILE), { recursive: true });
+  const temp = `${TOKENS_FILE}.tmp`;
+  writeFileSync(temp, JSON.stringify(tokens, null, 2), { mode: 0o600 });
+  renameSync(temp, TOKENS_FILE);
+  chmodSync(TOKENS_FILE, 0o600);
+}
+
+const { url, verifier } = createAuthorizationRequest();
+console.log("");
+console.log("Open the URL below in your browser and authorize with your Claude Pro/Max account:");
+console.log("");
+console.log(`  ${url}`);
+console.log("");
+if (!noBrowser && openBrowser(url)) {
+  console.log("(tried to open your browser — use the URL above if it did not)");
+  console.log("");
+}
+const prompt = createPrompt({ input: stdin, output: stdout });
+const code = (await prompt.question("Paste the code shown by Anthropic here: ")).trim();
+prompt.close();
+if (!code) {
+  console.error("\nNo code provided. Nothing was saved.");
+  process.exit(1);
+}
+
+console.log("\nExchanging the code for tokens...");
+let tokens;
+try {
+  tokens = await exchangeCodeForTokens(code, verifier);
+} catch (error) {
+  const detail = String(error?.message ?? error);
+  if (/fetch failed|ENOTFOUND|ECONNREFUSED|EAI_AGAIN|network/i.test(detail)) {
+    console.error("\nNetwork failure while talking to Anthropic. Check your connection and try again.");
+  } else if (/Token exchange failed: 4\d\d/.test(detail)) {
+    console.error("\nAnthropic rejected the code (invalid or expired). Run the login again and paste a fresh code.");
+  } else {
+    console.error(`\nLogin failed: ${detail}`);
+  }
+  process.exit(1);
+}
+
+const connectionID = await registerCredential(tokens);
+saveTokens({ ...tokens, ...(connectionID ? { connectionID } : {}) });
+if (!connectionID) process.exit(1);
+
+console.log("");
+console.log("Login complete. Tokens saved to:");
+console.log(`  ${TOKENS_FILE}`);
+console.log(`Access token expires at ${new Date(tokens.expires).toLocaleString()} (refreshed automatically).`);
+console.log("");
+console.log("Open a new OpenCode session and select an anthropic/claude-* model.");
+console.log("Tip: if you just updated the plugin, restart the service first: opencode service restart");

package/oauth.mjs

@@ -0,0 +1,136 @@
+// OAuth PKCE helpers for the Anthropic Claude Pro/Max flow.
+// Ported from opencode-anthropic-oauth (MIT) so the params stay identical.
+import { createHash, randomBytes } from "node:crypto";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export const CLIENT_ID = process.env.ANTHROPIC_CLIENT_ID || "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+export const AUTHORIZE_URL = process.env.ANTHROPIC_AUTHORIZE_URL || "https://claude.ai/oauth/authorize";
+export const TOKEN_URL = process.env.ANTHROPIC_TOKEN_URL || "https://platform.claude.com/v1/oauth/token";
+export const REDIRECT_URI = process.env.ANTHROPIC_REDIRECT_URI || "https://platform.claude.com/oauth/code/callback";
+const SCOPES =
+  process.env.ANTHROPIC_SCOPES ||
+  "user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
+// The Claude Code profile this plugin targets. Override with
+// ANTHROPIC_CLI_VERSION when a newer release needs different headers.
+const CLI_VERSION = process.env.ANTHROPIC_CLI_VERSION || "2.1.289";
+const CLI_BUILD = process.env.ANTHROPIC_CLI_BUILD || "45c";
+export const CLI_ENTRYPOINT = process.env.ANTHROPIC_CLI_ENTRYPOINT || "cli";
+export const USER_AGENT = process.env.ANTHROPIC_USER_AGENT || `claude-cli/${CLI_VERSION} (external, ${CLI_ENTRYPOINT})`;
+// First system block of a Claude Code request, as captured from 2.1.289.
+export const BILLING_HEADER =
+  process.env.ANTHROPIC_BILLING_HEADER ||
+  `x-anthropic-billing-header: cc_version=${CLI_VERSION}.${CLI_BUILD}; cc_entrypoint=${CLI_ENTRYPOINT};`;
+// Anthropic SDK telemetry headers, as captured from Claude Code 2.1.289.
+export const SDK_HEADERS = {
+  "x-stainless-arch": process.arch === "x64" ? "x64" : process.arch,
+  "x-stainless-lang": "js",
+  "x-stainless-os":
+    process.platform === "linux"
+      ? "Linux"
+      : process.platform === "darwin"
+        ? "MacOS"
+        : process.platform === "win32"
+          ? "Windows"
+          : process.platform,
+  "x-stainless-package-version": process.env.ANTHROPIC_SDK_VERSION || "0.128.0",
+  "x-stainless-retry-count": "0",
+  "x-stainless-runtime": "node",
+  "x-stainless-runtime-version": process.env.ANTHROPIC_NODE_VERSION || "v26.3.0",
+  "x-stainless-timeout": "600",
+};
+export const BETA_FLAGS =
+  process.env.ANTHROPIC_BETA_FLAGS ||
+  "claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,thinking-token-count-2026-05-13,context-management-2025-06-27,prompt-caching-scope-2026-01-05";
+
+const DATA_DIR = process.env.XDG_DATA_HOME ? join(process.env.XDG_DATA_HOME, "opencode") : join(homedir(), ".local", "share", "opencode");
+export const TOKENS_FILE = join(DATA_DIR, "opencode-anthropic.json");
+export const DEVICE_FILE = join(DATA_DIR, "opencode-anthropic-device.json");
+
+function base64url(buffer) {
+  return buffer.toString("base64url").replace(/=+$/, "");
+}
+
+async function fetchWithRetry(url, init, retries = 3) {
+  for (let attempt = 0; attempt < retries; attempt++) {
+    const response = await fetch(url, init);
+    if (response.status === 429 && attempt < retries - 1) {
+      await new Promise((resolve) => setTimeout(resolve, (attempt + 1) * 2000));
+      continue;
+    }
+    return response;
+  }
+  return fetch(url, init);
+}
+
+export function createAuthorizationRequest() {
+  const verifier = base64url(randomBytes(32));
+  const challenge = base64url(createHash("sha256").update(verifier).digest());
+  const params = new URLSearchParams({
+    code: "true",
+    response_type: "code",
+    client_id: CLIENT_ID,
+    redirect_uri: REDIRECT_URI,
+    scope: SCOPES,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    state: verifier,
+  });
+  return { url: `${AUTHORIZE_URL}?${params}`, verifier };
+}
+
+export function parseAuthCode(raw) {
+  const hashIndex = raw.indexOf("#");
+  return hashIndex >= 0 ? raw.slice(0, hashIndex) : raw;
+}
+
+export async function exchangeCodeForTokens(rawCode, verifier) {
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code: parseAuthCode(rawCode.trim()),
+    code_verifier: verifier,
+    client_id: CLIENT_ID,
+    redirect_uri: REDIRECT_URI,
+    state: verifier,
+  });
+  const response = await fetchWithRetry(TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": USER_AGENT },
+    body: body.toString(),
+  });
+  if (!response.ok) {
+    const detail = await response.text().catch(() => "");
+    throw new Error(`Token exchange failed: ${response.status} ${response.statusText}${detail ? ` — ${detail}` : ""}`);
+  }
+  const data = await response.json();
+  if (!data.access_token || !data.refresh_token) throw new Error("Token exchange returned no tokens");
+  return {
+    access: data.access_token,
+    refresh: data.refresh_token,
+    expires: Date.now() + (data.expires_in ?? 36000) * 1000,
+  };
+}
+
+export async function refreshTokens(refreshToken) {
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+    client_id: CLIENT_ID,
+  });
+  const response = await fetchWithRetry(TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": USER_AGENT },
+    body: body.toString(),
+  });
+  if (!response.ok) {
+    const detail = await response.text().catch(() => "");
+    throw new Error(`Token refresh failed: ${response.status} ${response.statusText}${detail ? ` — ${detail}` : ""}`);
+  }
+  const data = await response.json();
+  if (!data.access_token) throw new Error("Token refresh returned no access token");
+  return {
+    access: data.access_token,
+    refresh: data.refresh_token || refreshToken,
+    expires: Date.now() + (data.expires_in ?? 36000) * 1000,
+  };
+}

package/package.json

@@ -1,6 +1,48 @@
 {
   "name": "opencode-anthropic",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.2",
+  "description": "OpenCode V2 plugin that restores Claude Pro/Max OAuth for the Anthropic provider",
+  "type": "module",
+  "keywords": [
+    "opencode",
+    "opencode-plugin",
+    "anthropic",
+    "claude",
+    "oauth"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/aiev/opencode-anthropic.git"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "import": "./index.js"
+    }
+  },
+  "bin": {
+    "opencode-anthropic": "login.mjs"
+  },
+  "files": [
+    "index.js",
+    "oauth.mjs",
+    "transform.mjs",
+    "tools.mjs",
+    "retry.mjs",
+    "login.mjs",
+    "tests",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "test": "node --test",
+    "capture": "node scripts/claude-capture.mjs",
+    "prepublishOnly": "node --test"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

package/retry.mjs

@@ -0,0 +1,46 @@
+// Rate-limit handling.
+//
+// Anthropic reports a `retry-after` header on 429 (and sometimes 503/529)
+// responses. OpenCode's retry hook can veto or reshape a retry decision, so
+// the http.response hook records the last hint here and the retry hook hands
+// it back as the delay instead of letting the client hammer the endpoint.
+const RETRY_STATUSES = new Set([429, 503, 529]);
+const DEFAULT_TTL_MS = 5 * 60 * 1000;
+const DEFAULT_CAP_MS = 15 * 60 * 1000;
+const DEFAULT_FLOOR_MS = 1000;
+
+// `retry-after` is either a number of seconds or an HTTP date.
+export function parseRetryAfter(value, now = Date.now()) {
+  if (value === null || value === undefined || value === "") return null;
+  const seconds = Number(value);
+  if (Number.isFinite(seconds) && seconds >= 0) return Math.round(seconds * 1000);
+  const date = Date.parse(value);
+  if (!Number.isNaN(date)) return Math.max(0, date - now);
+  return null;
+}
+
+export function createRateLimitState({ ttlMs = DEFAULT_TTL_MS, capMs = DEFAULT_CAP_MS, floorMs = DEFAULT_FLOOR_MS } = {}) {
+  let last = null;
+  return {
+    // Record the hint for a retryable failure; any other status clears it.
+    note(response, now = Date.now()) {
+      if (!RETRY_STATUSES.has(response?.status)) {
+        last = null;
+        return last;
+      }
+      const hint = parseRetryAfter(response.headers?.get?.("retry-after"), now);
+      last = { at: now, delayMs: hint };
+      return last;
+    },
+    clear() {
+      last = null;
+    },
+    // Null when there is no fresh, usable hint: the caller should leave the
+    // retry decision alone.
+    delayMsFor(status, now = Date.now()) {
+      if (!RETRY_STATUSES.has(status)) return null;
+      if (!last || now - last.at > ttlMs || last.delayMs === null) return null;
+      return Math.min(Math.max(last.delayMs, floorMs), capMs);
+    },
+  };
+}