pi-anthropic-oauth 0.2.4 → 0.3.1

package/README.md

@@ -47,9 +47,17 @@ pi update npm:pi-anthropic-oauth
 > [!NOTE]
 > Anthropic auth changes are closely monitored for quick compatibility updates.
 
+## Claude Code version override
+
+Anthropic gates new models on the Claude Code client version (error `claude_code_version_too_old`). The version is sent in both the OAuth user agent and the billing header of the system prompt. Override it without reinstalling:
+
+```bash
+PI_ANTHROPIC_OAUTH_CLAUDE_CODE_VERSION=2.1.280
+```
+
 ## System prompt rewriting
 
-When using Claude Pro/Max OAuth, the extension prepends Claude Code identity text and rewrites standalone `Pi` / `pi` references in Pi's system prompt to `Claude Code`. The rewrite mode defaults to `aggressive`:
+When using Claude Pro/Max OAuth, the extension prepends the Claude Code billing-header and identity system blocks and rewrites standalone `Pi` / `pi` references in Pi's system prompt to `Claude Code`. The rewrite mode defaults to `aggressive`:
 
 ```bash
 PI_ANTHROPIC_OAUTH_REWRITE_MODE=aggressive

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-anthropic-oauth",
-  "version": "0.2.4",
+  "version": "0.3.1",
   "description": "Claude Pro/Max OAuth extension for Pi",
   "type": "module",
   "license": "MIT",
@@ -38,12 +38,12 @@
     "@anthropic-ai/sdk": "^0.52.0"
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": ">=0.80.8",
-    "@earendil-works/pi-coding-agent": ">=0.80.8"
+    "@earendil-works/pi-ai": ">=0.86.0",
+    "@earendil-works/pi-coding-agent": ">=0.86.0"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.80.8",
-    "@earendil-works/pi-coding-agent": "^0.80.8",
+    "@earendil-works/pi-ai": "^0.86.1",
+    "@earendil-works/pi-coding-agent": "^0.86.1",
     "typescript": "^5.9.3"
   }
 }

package/src/auth.ts

@@ -3,6 +3,7 @@ import type {
   OAuthCredentials,
   OAuthLoginCallbacks,
 } from "@earendil-works/pi-ai";
+import { makeClaudeCodeUserAgent } from "./version.js";
 
 const CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
 const AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
@@ -16,16 +17,54 @@ const SCOPES = [
   "user:mcp_servers",
   "user:file_upload",
 ].join(" ");
-const USER_AGENT = "claude-code/2.1.97";
+const USER_AGENT = makeClaudeCodeUserAgent();
 const CALLBACK_PORT = 53692;
 const CALLBACK_HOST = "127.0.0.1";
 const LOCAL_CALLBACK_TIMEOUT = 5 * 60 * 1000;
 const MAX_TOKEN_RETRIES = 2;
 const INITIAL_RETRY_DELAY_MS = 5000;
+const MAX_RETRY_DELAY_MS = 30_000;
+const MANUAL_SETTLE_GRACE_MS = 10_000;
+const LOCAL_REDIRECT_URI = `http://localhost:${CALLBACK_PORT}/callback`;
 
 export { USER_AGENT };
 
-type ParsedAuthInput = { code: string; state: string };
+class TokenHttpError extends Error {
+  constructor(
+    message: string,
+    readonly status: number,
+  ) {
+    super(message);
+    this.name = "TokenHttpError";
+  }
+}
+
+function isTransientTokenError(error: unknown): boolean {
+  if (error instanceof TokenHttpError) {
+    return error.status === 429 ||
+      (error.status >= 500 && error.status < 600);
+  }
+  return error instanceof TypeError;
+}
+
+function parseRetryAfter(value: string | null): number | undefined {
+  if (!value) return undefined;
+
+  const seconds = Number(value);
+  if (Number.isFinite(seconds)) {
+    return Math.min(Math.max(seconds, 0) * 1000, MAX_RETRY_DELAY_MS);
+  }
+
+  const at = Date.parse(value);
+  if (Number.isNaN(at)) return undefined;
+  return Math.min(Math.max(at - Date.now(), 0), MAX_RETRY_DELAY_MS);
+}
+
+type ParsedAuthInput = {
+  code: string;
+  state: string;
+  redirectUri?: string;
+};
 type LocalAuthorization = {
   redirectUri: string;
   waitForCallback: () => Promise<string | null>;
@@ -44,55 +83,68 @@ export async function loginAnthropic(
 
   let authInput: string | null = null;
   let redirectUri = REDIRECT_URI;
+  const initiatedRedirectUris = new Set<string>();
 
+  let localAuthorization: LocalAuthorization | null = null;
   try {
-    const localAuthorization = await createLocalAuthorization(state);
-    redirectUri = localAuthorization.redirectUri;
+    localAuthorization = await createLocalAuthorization(state);
+  } catch {
+    // Failure to bind the callback server falls back to the paste flow.
+  }
 
-    callbacks.onAuth({
-      url: makeAuthorizeUrl(challenge, state, redirectUri),
-      instructions:
-        "Complete login in your browser. If the browser is on another machine, paste the final redirect URL here.",
-    });
+  try {
+    if (localAuthorization) {
+      const local = localAuthorization;
+      redirectUri = local.redirectUri;
+      initiatedRedirectUris.add(redirectUri);
+
+      callbacks.onAuth({
+        url: makeAuthorizeUrl(challenge, state, redirectUri),
+        instructions:
+          "Complete login in your browser. If the browser is on another machine, paste the final redirect URL here.",
+      });
 
-    if (callbacks.onManualCodeInput) {
-      let manualInput: string | undefined;
-      let manualError: Error | undefined;
-      const manualPromise = callbacks
-        .onManualCodeInput()
-        .then((input) => {
-          manualInput = input;
-          localAuthorization.cancel();
-        })
-        .catch((err) => {
-          manualError =
-            err instanceof Error ? err : new Error(String(err));
-          localAuthorization.cancel();
-        });
-
-      const callbackResult = await localAuthorization.waitForCallback();
-
-      if (manualError) throw manualError;
-
-      if (callbackResult) {
-        authInput = callbackResult;
-      } else if (manualInput) {
-        authInput = manualInput;
-      }
+      if (callbacks.onManualCodeInput) {
+        let manualInput: string | undefined;
+        let manualError: Error | undefined;
+        const manualPromise = callbacks
+          .onManualCodeInput()
+          .then((input) => {
+            manualInput = input;
+            local.cancel();
+          })
+          .catch((err) => {
+            manualError =
+              err instanceof Error ? err : new Error(String(err));
+            local.cancel();
+          });
+
+        const callbackResult = await local.waitForCallback();
 
-      if (!authInput) {
-        await manualPromise;
         if (manualError) throw manualError;
-        if (manualInput) authInput = manualInput;
+
+        if (callbackResult) {
+          authInput = callbackResult;
+        } else if (manualInput) {
+          authInput = manualInput;
+        }
+
+        if (!authInput) {
+          await Promise.race([manualPromise, settleGrace()]);
+          if (manualError) throw manualError;
+          if (manualInput) authInput = manualInput;
+        }
+      } else {
+        authInput = await local.waitForCallback();
       }
-    } else {
-      authInput = await localAuthorization.waitForCallback();
     }
-  } catch {
+  } finally {
+    localAuthorization?.cancel();
   }
 
   if (!authInput) {
     redirectUri = REDIRECT_URI;
+    initiatedRedirectUris.add(redirectUri);
     callbacks.onAuth({
       url: makeAuthorizeUrl(challenge, state, redirectUri),
       instructions:
@@ -103,10 +155,12 @@ export async function loginAnthropic(
     });
   }
 
-  const parsed = parseAuthInput(authInput);
+  const parsed = parseAuthInput(authInput, initiatedRedirectUris);
   if (!parsed) throw new Error("Could not parse authorization callback input.");
   if (parsed.state !== state) throw new Error("OAuth state mismatch.");
 
+  const exchangeRedirectUri = parsed.redirectUri ?? redirectUri;
+
   const tokenResponse = await fetchWithRetry(
     TOKEN_URL,
     {
@@ -117,7 +171,7 @@ export async function loginAnthropic(
         client_id: CLIENT_ID,
         code: parsed.code,
         state: parsed.state,
-        redirect_uri: redirectUri,
+        redirect_uri: exchangeRedirectUri,
         code_verifier: verifier,
       }),
       signal: callbacks.signal,
@@ -156,11 +210,12 @@ export async function refreshAnthropicToken(
       },
       "Token refresh",
     );
-  } catch {
-    if (credentials.expires > Date.now()) {
+  } catch (error) {
+    if (isTransientTokenError(error) && credentials.expires > Date.now()) {
       return { ...credentials, expires: Date.now() + 30_000 };
     }
-    throw new Error("Token refresh failed and token has expired.");
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`Token refresh failed: ${detail}`);
   }
 
   const data = (await response.json()) as {
@@ -209,28 +264,29 @@ async function fetchWithRetry(
 
     const bodyText = await response.text();
 
+    const failure = new TokenHttpError(
+      `${label} failed: ${response.status} ${bodyText}`,
+      response.status,
+    );
+
     const shouldRetry = response.headers.get("x-should-retry");
-    if (shouldRetry === "false") {
-      throw new Error(`${label} failed: ${response.status} ${bodyText}`);
-    }
+    if (shouldRetry === "false") throw failure;
 
     if (
       attempt < MAX_TOKEN_RETRIES &&
-      (response.status === 429 || response.status >= 500)
+      (response.status === 429 ||
+        (response.status >= 500 && response.status < 600))
     ) {
-      const retryAfter = response.headers.get("retry-after");
-      const delayMs = retryAfter
-        ? Math.min(Number(retryAfter) * 1000, 30_000)
-        : INITIAL_RETRY_DELAY_MS * 2 ** attempt;
+      const delayMs =
+        parseRetryAfter(response.headers.get("retry-after")) ??
+        INITIAL_RETRY_DELAY_MS * 2 ** attempt;
 
       await new Promise((resolve) => setTimeout(resolve, delayMs));
-      lastError = new Error(
-        `${label} failed: ${response.status} ${bodyText}`,
-      );
+      lastError = failure;
       continue;
     }
 
-    throw new Error(`${label} failed: ${response.status} ${bodyText}`);
+    throw failure;
   }
 
   throw lastError ?? new Error(`${label} failed after retries`);
@@ -249,6 +305,7 @@ async function createLocalAuthorization(
 
   return new Promise((resolve, reject) => {
     let done = false;
+    let settled = false;
     let timer: ReturnType<typeof setTimeout> | undefined;
     let complete!: (value: string | null) => void;
     const wait = new Promise<string | null>((innerResolve) => {
@@ -267,10 +324,7 @@ async function createLocalAuthorization(
     };
 
     server.on("request", (req, res) => {
-      const url = new URL(
-        req.url ?? "/",
-        `http://${req.headers.host ?? "localhost"}`,
-      );
+      const url = new URL(req.url ?? "/", LOCAL_REDIRECT_URI);
 
       if (url.pathname !== "/callback") {
         res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
@@ -289,7 +343,6 @@ async function createLocalAuthorization(
       if (gotState !== state) {
         res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
         res.end("Invalid state");
-        finish(null);
         return;
       }
 
@@ -298,15 +351,25 @@ async function createLocalAuthorization(
         Connection: "close",
       });
       res.end(makeCallbackPage());
-      finish(url.toString());
+      finish(`${LOCAL_REDIRECT_URI}?${url.searchParams.toString()}`);
     });
 
-    server.once("error", reject);
+    server.on("error", (error) => {
+      if (!settled) {
+        settled = true;
+        finish(null);
+        reject(error);
+        return;
+      }
+      finish(null);
+    });
 
     server.listen(CALLBACK_PORT, CALLBACK_HOST, () => {
+      settled = true;
       timer = setTimeout(() => finish(null), LOCAL_CALLBACK_TIMEOUT);
+      timer.unref?.();
       resolve({
-        redirectUri: `http://localhost:${CALLBACK_PORT}/callback`,
+        redirectUri: LOCAL_REDIRECT_URI,
         waitForCallback: () => wait,
         cancel: () => finish(null),
       });
@@ -325,6 +388,10 @@ function makeCallbackPage(): string {
 </html>`;
 }
 
+function settleGrace(): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, MANUAL_SETTLE_GRACE_MS));
+}
+
 async function generatePKCE(): Promise<{
   verifier: string;
   challenge: string;
@@ -350,14 +417,21 @@ function toBase64Url(bytes: Uint8Array): string {
     .replace(/=+$/g, "");
 }
 
-function parseAuthInput(input: string): ParsedAuthInput | null {
+function parseAuthInput(
+  input: string,
+  initiatedRedirectUris: ReadonlySet<string>,
+): ParsedAuthInput | null {
   const text = input.trim();
 
   try {
     const url = new URL(text);
     const code = url.searchParams.get("code");
     const state = url.searchParams.get("state");
-    if (code && state) return { code, state };
+    if (code && state) {
+      const redirectUri = `${url.origin}${url.pathname}`;
+      if (!initiatedRedirectUris.has(redirectUri)) return null;
+      return { code, state, redirectUri };
+    }
   } catch {}
 
   const split = text.split("#");

package/src/convert.ts

@@ -245,10 +245,30 @@ export function convertPiMessagesToAnthropic(
     }
   }
 
+  // The loop flushes pending tool uses before the next message. Flush once more
+  // so a history ending on an unresolved tool call is still valid.
+  flushPendingToolResults();
+
+  // Anthropic prompt caching requires an explicit breakpoint. Plain-text user
+  // turns must be promoted to a block so there is somewhere to attach it.
   const last = params.at(-1);
-  if (last?.role === "user" && Array.isArray(last.content) && last.content.length > 0) {
-    const lastBlock = last.content[last.content.length - 1] as { cache_control?: { type: string } };
-    lastBlock.cache_control = { type: "ephemeral" };
+  if (last?.role === "user") {
+    if (typeof last.content === "string") {
+      if (last.content) {
+        last.content = [
+          {
+            type: "text",
+            text: last.content,
+            cache_control: { type: "ephemeral" },
+          },
+        ];
+      }
+    } else if (last.content.length > 0) {
+      const lastBlock = last.content[last.content.length - 1] as {
+        cache_control?: { type: string };
+      };
+      lastBlock.cache_control = { type: "ephemeral" };
+    }
   }
 
   return params;

package/src/prompt.ts

@@ -1,5 +1,21 @@
+import { randomUUID } from "node:crypto";
+import { getClaudeCodeVersion } from "./version.js";
+
 const CLAUDE_CODE_IDENTITY =
-  "You are Claude Code, Anthropic's official CLI for Claude.";
+  "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
+
+/**
+ * Anthropic's OAuth classifier rejects premium-model requests that do not
+ * open with a Claude Code billing-header system block. The `cch` and
+ * `cc_prompt_id` keys must be present, but their values are not validated,
+ * and the block must not carry `cache_control`.
+ */
+export function buildClaudeCodeBillingBlock(): MessageContentBlock {
+  return {
+    type: "text",
+    text: `x-anthropic-billing-header: cc_version=${getClaudeCodeVersion()}; cc_entrypoint=cli; cch=00000; cc_prompt_id=${randomUUID()}`,
+  };
+}
 const PI_REMOVAL_ANCHORS = [
   "pi-coding-agent",
   "@earendil-works/pi-coding-agent",
@@ -50,14 +66,13 @@ export function buildAnthropicSystemPrompt(
   const blocks: MessageContentBlock[] = [];
 
   if (isOAuth) {
-    blocks.push({
-      type: "text",
-      text: CLAUDE_CODE_IDENTITY,
-      cache_control: { type: "ephemeral" },
-    });
+    blocks.push(buildClaudeCodeBillingBlock());
+    blocks.push({ type: "text", text: CLAUDE_CODE_IDENTITY });
   }
 
-  const sanitized = systemPrompt ? sanitizeSystemText(systemPrompt) : "";
+  const sanitized = systemPrompt
+    ? sanitizeSystemText(sanitizeSurrogates(systemPrompt))
+    : "";
   if (sanitized) {
     blocks.push({
       type: "text",
@@ -80,10 +95,11 @@ export function sanitizeSystemText(
     return !PI_REMOVAL_ANCHORS.some((anchor) => paragraph.includes(anchor));
   });
 
-  return filtered
-    .join("\n\n")
-    .replace(resolvePiRewritePattern(env), "Claude Code")
-    .trim();
+  const filteredText = filtered.join("\n\n");
+  const rewritePattern = resolvePiRewritePattern(env);
+  rejectZeroLengthMatches(rewritePattern, filteredText);
+
+  return filteredText.replace(rewritePattern, "Claude Code").trim();
 }
 
 function resolvePiRewritePattern(env: NodeJS.ProcessEnv): RegExp {
@@ -109,12 +125,30 @@ function compileCustomPiRewritePattern(value: string | undefined): RegExp {
 
   const parsed = parseRegexLiteral(pattern) ?? { source: pattern, flags: "" };
   const flags = parsed.flags.includes("g") ? parsed.flags : `${parsed.flags}g`;
+  let compiled: RegExp;
   try {
-    return new RegExp(parsed.source, flags);
+    compiled = new RegExp(parsed.source, flags);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`Invalid ${PI_REWRITE_PATTERN_ENV}: ${message}`);
   }
+
+  rejectZeroLengthMatches(compiled, "");
+  return compiled;
+}
+
+function rejectZeroLengthMatches(pattern: RegExp, text: string): void {
+  pattern.lastIndex = 0;
+  let match: RegExpExecArray | null;
+  while ((match = pattern.exec(text)) !== null) {
+    if (match[0].length === 0) {
+      pattern.lastIndex = 0;
+      throw new Error(
+        `Invalid ${PI_REWRITE_PATTERN_ENV}: the pattern can match without consuming text. Use (?!) to disable rewriting.`,
+      );
+    }
+  }
+  pattern.lastIndex = 0;
 }
 
 function parseRegexLiteral(value: string): { source: string; flags: string } | undefined {

package/src/stream.ts

@@ -5,11 +5,15 @@ import {
   type AssistantMessage,
   type AssistantMessageEventStream,
   calculateCost,
-  type Context,
+  collapseSystemMessages,
   createAssistantMessageEventStream,
+  getCurrentSystemPrompt,
+  getCurrentTools,
+  type JsonObject,
   type Model,
   type SimpleStreamOptions,
   type StopReason,
+  type TranscriptContext,
 } from "@earendil-works/pi-ai";
 import { isClaudeOAuthAccessToken, USER_AGENT } from "./auth.js";
 import {
@@ -32,6 +36,26 @@ const REQUIRED_BETAS = [
   "interleaved-thinking-2025-05-14",
 ] as const;
 
+const LEGACY_THINKING_MODEL =
+  /^claude-(?:opus|sonnet|haiku)-4-[0-5](?:-|$)|^claude-[0-3][-.]/;
+const MIN_THINKING_BUDGET = 1024;
+const EFFORT_BY_REASONING: Record<string, string> = {
+  minimal: "low",
+  low: "low",
+  medium: "medium",
+  high: "high",
+  xhigh: "xhigh",
+  max: "max",
+};
+
+export function usesAdaptiveThinking(model: Model<Api>): boolean {
+  const forced = (
+    model.compat as { forceAdaptiveThinking?: boolean } | undefined
+  )?.forceAdaptiveThinking;
+  if (typeof forced === "boolean") return forced;
+  return !LEGACY_THINKING_MODEL.test(model.id.toLowerCase().replace(/\./g, "-"));
+}
+
 function mapStopReason(reason: string | null | undefined): StopReason {
   switch (reason) {
     case "end_turn":
@@ -47,6 +71,43 @@ function mapStopReason(reason: string | null | undefined): StopReason {
   }
 }
 
+type MessageDeltaUsage = {
+  input_tokens?: number | null;
+  output_tokens?: number | null;
+  cache_read_input_tokens?: number | null;
+  cache_creation_input_tokens?: number | null;
+  output_tokens_details?: { thinking_tokens?: number | null };
+};
+
+export function applyMessageDelta(
+  output: AssistantMessage,
+  model: Model<Api>,
+  stopReason: string | null | undefined,
+  usage: MessageDeltaUsage | undefined,
+): void {
+  if (stopReason != null) output.stopReason = mapStopReason(stopReason);
+
+  if (usage) {
+    if (usage.input_tokens != null) output.usage.input = usage.input_tokens;
+    if (usage.output_tokens != null) output.usage.output = usage.output_tokens;
+    if (usage.cache_read_input_tokens != null) {
+      output.usage.cacheRead = usage.cache_read_input_tokens;
+    }
+    if (usage.cache_creation_input_tokens != null) {
+      output.usage.cacheWrite = usage.cache_creation_input_tokens;
+    }
+    const thinkingTokens = usage.output_tokens_details?.thinking_tokens;
+    if (thinkingTokens != null) output.usage.reasoning = thinkingTokens;
+  }
+
+  output.usage.totalTokens =
+    output.usage.input +
+    output.usage.output +
+    output.usage.cacheRead +
+    output.usage.cacheWrite;
+  calculateCost(model, output.usage);
+}
+
 function headersToRecord(headers: Headers): Record<string, string> {
   const record: Record<string, string> = {};
   headers.forEach((value, key) => {
@@ -94,11 +155,19 @@ function makeDefaultHeaders(
 
 export function streamAnthropicOAuth(
   model: Model<Api>,
-  context: Context,
+  context: TranscriptContext,
   options?: SimpleStreamOptions,
 ): AssistantMessageEventStream {
   const stream = createAssistantMessageEventStream();
 
+  // Anthropic has no mid-conversation system messages: fold system-message
+  // patches into the leading system message, then read the current prompt and
+  // tool declarations from the transcript (pi >= 0.86 no longer provides
+  // context.systemPrompt / context.tools).
+  const transcript = collapseSystemMessages(context);
+  const tools = getCurrentTools(transcript.messages);
+  const systemPrompt = getCurrentSystemPrompt(transcript.messages);
+
   void (async () => {
     const output: AssistantMessage = {
       role: "assistant",
@@ -144,15 +213,15 @@ export function streamAnthropicOAuth(
 
       const params: MessageCreateParamsStreaming = {
         model: model.id,
-        messages: convertPiMessagesToAnthropic(context.messages, isOAuth, model),
+        messages: convertPiMessagesToAnthropic(transcript.messages, isOAuth, model),
         max_tokens: maxTokens,
         stream: true,
       };
 
-      const system = buildAnthropicSystemPrompt(context.systemPrompt, isOAuth);
+      const system = buildAnthropicSystemPrompt(systemPrompt, isOAuth);
       if (system) params.system = system as never;
-      if (context.tools?.length)
-        params.tools = convertPiToolsToAnthropic(context.tools, isOAuth);
+      if (tools.length)
+        params.tools = convertPiToolsToAnthropic(tools, isOAuth);
 
       if (options?.reasoning && model.reasoning && maxTokens > 1) {
         const defaultBudgets: Record<string, number> = {
@@ -168,11 +237,23 @@ export function streamAnthropicOAuth(
           ];
         const requestedBudget =
           customBudget ?? defaultBudgets[options.reasoning] ?? 10240;
-
-        params.thinking = {
-          type: "enabled",
-          budget_tokens: Math.min(requestedBudget, maxTokens - 1),
-        };
+        if (usesAdaptiveThinking(model)) {
+          const mapped = model.thinkingLevelMap?.[options.reasoning];
+          const effort =
+            typeof mapped === "string"
+              ? mapped
+              : (EFFORT_BY_REASONING[options.reasoning] ?? "high");
+          params.thinking = {
+            type: "adaptive",
+            display: "summarized",
+          } as never;
+          Object.assign(params, { output_config: { effort } });
+        } else {
+          const budget = Math.min(requestedBudget, maxTokens - 1);
+          if (budget >= MIN_THINKING_BUDGET) {
+            params.thinking = { type: "enabled", budget_tokens: budget };
+          }
+        }
       }
 
       // Raw stream instead of the MessageStream helper: MessageStream
@@ -268,7 +349,7 @@ export function streamAnthropicOAuth(
               name: isOAuth
                 ? fromClaudeCodeToolName(
                     event.content_block.name,
-                    context.tools,
+                    tools,
                   )
                 : event.content_block.name,
               arguments: {},
@@ -322,10 +403,7 @@ export function streamAnthropicOAuth(
           ) {
             block.partialJson += event.delta.partial_json;
             try {
-              block.arguments = JSON.parse(block.partialJson) as Record<
-                string,
-                unknown
-              >;
+              block.arguments = JSON.parse(block.partialJson) as JsonObject;
             } catch {}
             stream.push({
               type: "toolcall_delta",
@@ -361,10 +439,7 @@ export function streamAnthropicOAuth(
             });
           } else if (block.type === "toolCall") {
             try {
-              block.arguments = JSON.parse(block.partialJson) as Record<
-                string,
-                unknown
-              >;
+              block.arguments = JSON.parse(block.partialJson) as JsonObject;
             } catch {}
             delete (block as { partialJson?: string }).partialJson;
             stream.push({
@@ -378,42 +453,26 @@ export function streamAnthropicOAuth(
         }
 
         if (event.type === "message_delta") {
-          output.stopReason = mapStopReason(event.delta.stop_reason);
-          output.usage.input =
-            (event.usage as { input_tokens?: number }).input_tokens ||
-            output.usage.input;
-          output.usage.output =
-            (event.usage as { output_tokens?: number }).output_tokens ||
-            output.usage.output;
-          output.usage.cacheRead =
-            (event.usage as { cache_read_input_tokens?: number })
-              .cache_read_input_tokens || 0;
-          output.usage.cacheWrite =
-            (event.usage as { cache_creation_input_tokens?: number })
-              .cache_creation_input_tokens || 0;
-          const thinkingTokens = (
-            event.usage as {
-              output_tokens_details?: { thinking_tokens?: number };
-            }
-          ).output_tokens_details?.thinking_tokens;
-          if (thinkingTokens != null) {
-            output.usage.reasoning = thinkingTokens;
-          }
-          output.usage.totalTokens =
-            output.usage.input +
-            output.usage.output +
-            output.usage.cacheRead +
-            output.usage.cacheWrite;
-          calculateCost(model, output.usage);
+          applyMessageDelta(
+            output,
+            model,
+            event.delta.stop_reason,
+            event.usage as MessageDeltaUsage | undefined,
+          );
         }
       }
 
       if (options?.signal?.aborted) throw new Error("Request aborted");
-      stream.push({
-        type: "done",
-        reason: output.stopReason as "stop" | "length" | "toolUse",
-        message: output,
-      });
+      if (output.stopReason === "error") {
+        output.errorMessage ??= "Unrecognized stop reason from the API.";
+        stream.push({ type: "error", reason: "error", error: output });
+      } else {
+        stream.push({
+          type: "done",
+          reason: output.stopReason as "stop" | "length" | "toolUse",
+          message: output,
+        });
+      }
       stream.end();
     } catch (error) {
       for (const block of output.content as Array<{

package/src/version.ts

@@ -0,0 +1,24 @@
+export const CLAUDE_CODE_VERSION_ENV = "PI_ANTHROPIC_OAUTH_CLAUDE_CODE_VERSION";
+const DEFAULT_CLAUDE_CODE_VERSION = "2.1.280";
+
+/**
+ * Claude Code version advertised to the API (user agent and billing header).
+ *
+ * Anthropic gates new models on the client version; override with
+ * PI_ANTHROPIC_OAUTH_CLAUDE_CODE_VERSION when a newer one is required.
+ */
+export function getClaudeCodeVersion(
+  env: NodeJS.ProcessEnv = process.env,
+): string {
+  return env[CLAUDE_CODE_VERSION_ENV]?.trim() || DEFAULT_CLAUDE_CODE_VERSION;
+}
+
+/**
+ * User agent matching the current Claude Code CLI client. The classifier
+ * rejects the older `claude-code/<ver>` form for premium models.
+ */
+export function makeClaudeCodeUserAgent(
+  env: NodeJS.ProcessEnv = process.env,
+): string {
+  return `claude-cli/${getClaudeCodeVersion(env)} (external, cli)`;
+}