pi-anthropic-oauth 0.3.0 → 0.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-anthropic-oauth",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Claude Pro/Max OAuth extension for Pi",
   "type": "module",
   "license": "MIT",

package/src/auth.ts

@@ -23,10 +23,48 @@ const CALLBACK_HOST = "127.0.0.1";
 const LOCAL_CALLBACK_TIMEOUT = 5 * 60 * 1000;
 const MAX_TOKEN_RETRIES = 2;
 const INITIAL_RETRY_DELAY_MS = 5000;
+const MAX_RETRY_DELAY_MS = 30_000;
+const MANUAL_SETTLE_GRACE_MS = 10_000;
+const LOCAL_REDIRECT_URI = `http://localhost:${CALLBACK_PORT}/callback`;
 
 export { USER_AGENT };
 
-type ParsedAuthInput = { code: string; state: string };
+class TokenHttpError extends Error {
+  constructor(
+    message: string,
+    readonly status: number,
+  ) {
+    super(message);
+    this.name = "TokenHttpError";
+  }
+}
+
+function isTransientTokenError(error: unknown): boolean {
+  if (error instanceof TokenHttpError) {
+    return error.status === 429 ||
+      (error.status >= 500 && error.status < 600);
+  }
+  return error instanceof TypeError;
+}
+
+function parseRetryAfter(value: string | null): number | undefined {
+  if (!value) return undefined;
+
+  const seconds = Number(value);
+  if (Number.isFinite(seconds)) {
+    return Math.min(Math.max(seconds, 0) * 1000, MAX_RETRY_DELAY_MS);
+  }
+
+  const at = Date.parse(value);
+  if (Number.isNaN(at)) return undefined;
+  return Math.min(Math.max(at - Date.now(), 0), MAX_RETRY_DELAY_MS);
+}
+
+type ParsedAuthInput = {
+  code: string;
+  state: string;
+  redirectUri?: string;
+};
 type LocalAuthorization = {
   redirectUri: string;
   waitForCallback: () => Promise<string | null>;
@@ -45,55 +83,68 @@ export async function loginAnthropic(
 
   let authInput: string | null = null;
   let redirectUri = REDIRECT_URI;
+  const initiatedRedirectUris = new Set<string>();
 
+  let localAuthorization: LocalAuthorization | null = null;
   try {
-    const localAuthorization = await createLocalAuthorization(state);
-    redirectUri = localAuthorization.redirectUri;
+    localAuthorization = await createLocalAuthorization(state);
+  } catch {
+    // Failure to bind the callback server falls back to the paste flow.
+  }
 
-    callbacks.onAuth({
-      url: makeAuthorizeUrl(challenge, state, redirectUri),
-      instructions:
-        "Complete login in your browser. If the browser is on another machine, paste the final redirect URL here.",
-    });
+  try {
+    if (localAuthorization) {
+      const local = localAuthorization;
+      redirectUri = local.redirectUri;
+      initiatedRedirectUris.add(redirectUri);
+
+      callbacks.onAuth({
+        url: makeAuthorizeUrl(challenge, state, redirectUri),
+        instructions:
+          "Complete login in your browser. If the browser is on another machine, paste the final redirect URL here.",
+      });
 
-    if (callbacks.onManualCodeInput) {
-      let manualInput: string | undefined;
-      let manualError: Error | undefined;
-      const manualPromise = callbacks
-        .onManualCodeInput()
-        .then((input) => {
-          manualInput = input;
-          localAuthorization.cancel();
-        })
-        .catch((err) => {
-          manualError =
-            err instanceof Error ? err : new Error(String(err));
-          localAuthorization.cancel();
-        });
-
-      const callbackResult = await localAuthorization.waitForCallback();
-
-      if (manualError) throw manualError;
-
-      if (callbackResult) {
-        authInput = callbackResult;
-      } else if (manualInput) {
-        authInput = manualInput;
-      }
+      if (callbacks.onManualCodeInput) {
+        let manualInput: string | undefined;
+        let manualError: Error | undefined;
+        const manualPromise = callbacks
+          .onManualCodeInput()
+          .then((input) => {
+            manualInput = input;
+            local.cancel();
+          })
+          .catch((err) => {
+            manualError =
+              err instanceof Error ? err : new Error(String(err));
+            local.cancel();
+          });
+
+        const callbackResult = await local.waitForCallback();
 
-      if (!authInput) {
-        await manualPromise;
         if (manualError) throw manualError;
-        if (manualInput) authInput = manualInput;
+
+        if (callbackResult) {
+          authInput = callbackResult;
+        } else if (manualInput) {
+          authInput = manualInput;
+        }
+
+        if (!authInput) {
+          await Promise.race([manualPromise, settleGrace()]);
+          if (manualError) throw manualError;
+          if (manualInput) authInput = manualInput;
+        }
+      } else {
+        authInput = await local.waitForCallback();
       }
-    } else {
-      authInput = await localAuthorization.waitForCallback();
     }
-  } catch {
+  } finally {
+    localAuthorization?.cancel();
   }
 
   if (!authInput) {
     redirectUri = REDIRECT_URI;
+    initiatedRedirectUris.add(redirectUri);
     callbacks.onAuth({
       url: makeAuthorizeUrl(challenge, state, redirectUri),
       instructions:
@@ -104,10 +155,12 @@ export async function loginAnthropic(
     });
   }
 
-  const parsed = parseAuthInput(authInput);
+  const parsed = parseAuthInput(authInput, initiatedRedirectUris);
   if (!parsed) throw new Error("Could not parse authorization callback input.");
   if (parsed.state !== state) throw new Error("OAuth state mismatch.");
 
+  const exchangeRedirectUri = parsed.redirectUri ?? redirectUri;
+
   const tokenResponse = await fetchWithRetry(
     TOKEN_URL,
     {
@@ -118,7 +171,7 @@ export async function loginAnthropic(
         client_id: CLIENT_ID,
         code: parsed.code,
         state: parsed.state,
-        redirect_uri: redirectUri,
+        redirect_uri: exchangeRedirectUri,
         code_verifier: verifier,
       }),
       signal: callbacks.signal,
@@ -157,11 +210,12 @@ export async function refreshAnthropicToken(
       },
       "Token refresh",
     );
-  } catch {
-    if (credentials.expires > Date.now()) {
+  } catch (error) {
+    if (isTransientTokenError(error) && credentials.expires > Date.now()) {
       return { ...credentials, expires: Date.now() + 30_000 };
     }
-    throw new Error("Token refresh failed and token has expired.");
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`Token refresh failed: ${detail}`);
   }
 
   const data = (await response.json()) as {
@@ -210,28 +264,29 @@ async function fetchWithRetry(
 
     const bodyText = await response.text();
 
+    const failure = new TokenHttpError(
+      `${label} failed: ${response.status} ${bodyText}`,
+      response.status,
+    );
+
     const shouldRetry = response.headers.get("x-should-retry");
-    if (shouldRetry === "false") {
-      throw new Error(`${label} failed: ${response.status} ${bodyText}`);
-    }
+    if (shouldRetry === "false") throw failure;
 
     if (
       attempt < MAX_TOKEN_RETRIES &&
-      (response.status === 429 || response.status >= 500)
+      (response.status === 429 ||
+        (response.status >= 500 && response.status < 600))
     ) {
-      const retryAfter = response.headers.get("retry-after");
-      const delayMs = retryAfter
-        ? Math.min(Number(retryAfter) * 1000, 30_000)
-        : INITIAL_RETRY_DELAY_MS * 2 ** attempt;
+      const delayMs =
+        parseRetryAfter(response.headers.get("retry-after")) ??
+        INITIAL_RETRY_DELAY_MS * 2 ** attempt;
 
       await new Promise((resolve) => setTimeout(resolve, delayMs));
-      lastError = new Error(
-        `${label} failed: ${response.status} ${bodyText}`,
-      );
+      lastError = failure;
       continue;
     }
 
-    throw new Error(`${label} failed: ${response.status} ${bodyText}`);
+    throw failure;
   }
 
   throw lastError ?? new Error(`${label} failed after retries`);
@@ -250,6 +305,7 @@ async function createLocalAuthorization(
 
   return new Promise((resolve, reject) => {
     let done = false;
+    let settled = false;
     let timer: ReturnType<typeof setTimeout> | undefined;
     let complete!: (value: string | null) => void;
     const wait = new Promise<string | null>((innerResolve) => {
@@ -268,10 +324,7 @@ async function createLocalAuthorization(
     };
 
     server.on("request", (req, res) => {
-      const url = new URL(
-        req.url ?? "/",
-        `http://${req.headers.host ?? "localhost"}`,
-      );
+      const url = new URL(req.url ?? "/", LOCAL_REDIRECT_URI);
 
       if (url.pathname !== "/callback") {
         res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
@@ -290,7 +343,6 @@ async function createLocalAuthorization(
       if (gotState !== state) {
         res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
         res.end("Invalid state");
-        finish(null);
         return;
       }
 
@@ -299,15 +351,25 @@ async function createLocalAuthorization(
         Connection: "close",
       });
       res.end(makeCallbackPage());
-      finish(url.toString());
+      finish(`${LOCAL_REDIRECT_URI}?${url.searchParams.toString()}`);
     });
 
-    server.once("error", reject);
+    server.on("error", (error) => {
+      if (!settled) {
+        settled = true;
+        finish(null);
+        reject(error);
+        return;
+      }
+      finish(null);
+    });
 
     server.listen(CALLBACK_PORT, CALLBACK_HOST, () => {
+      settled = true;
       timer = setTimeout(() => finish(null), LOCAL_CALLBACK_TIMEOUT);
+      timer.unref?.();
       resolve({
-        redirectUri: `http://localhost:${CALLBACK_PORT}/callback`,
+        redirectUri: LOCAL_REDIRECT_URI,
         waitForCallback: () => wait,
         cancel: () => finish(null),
       });
@@ -326,6 +388,10 @@ function makeCallbackPage(): string {
 </html>`;
 }
 
+function settleGrace(): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, MANUAL_SETTLE_GRACE_MS));
+}
+
 async function generatePKCE(): Promise<{
   verifier: string;
   challenge: string;
@@ -351,14 +417,21 @@ function toBase64Url(bytes: Uint8Array): string {
     .replace(/=+$/g, "");
 }
 
-function parseAuthInput(input: string): ParsedAuthInput | null {
+function parseAuthInput(
+  input: string,
+  initiatedRedirectUris: ReadonlySet<string>,
+): ParsedAuthInput | null {
   const text = input.trim();
 
   try {
     const url = new URL(text);
     const code = url.searchParams.get("code");
     const state = url.searchParams.get("state");
-    if (code && state) return { code, state };
+    if (code && state) {
+      const redirectUri = `${url.origin}${url.pathname}`;
+      if (!initiatedRedirectUris.has(redirectUri)) return null;
+      return { code, state, redirectUri };
+    }
   } catch {}
 
   const split = text.split("#");

package/src/convert.ts

@@ -245,10 +245,30 @@ export function convertPiMessagesToAnthropic(
     }
   }
 
+  // The loop flushes pending tool uses before the next message. Flush once more
+  // so a history ending on an unresolved tool call is still valid.
+  flushPendingToolResults();
+
+  // Anthropic prompt caching requires an explicit breakpoint. Plain-text user
+  // turns must be promoted to a block so there is somewhere to attach it.
   const last = params.at(-1);
-  if (last?.role === "user" && Array.isArray(last.content) && last.content.length > 0) {
-    const lastBlock = last.content[last.content.length - 1] as { cache_control?: { type: string } };
-    lastBlock.cache_control = { type: "ephemeral" };
+  if (last?.role === "user") {
+    if (typeof last.content === "string") {
+      if (last.content) {
+        last.content = [
+          {
+            type: "text",
+            text: last.content,
+            cache_control: { type: "ephemeral" },
+          },
+        ];
+      }
+    } else if (last.content.length > 0) {
+      const lastBlock = last.content[last.content.length - 1] as {
+        cache_control?: { type: string };
+      };
+      lastBlock.cache_control = { type: "ephemeral" };
+    }
   }
 
   return params;

package/src/prompt.ts

@@ -70,7 +70,9 @@ export function buildAnthropicSystemPrompt(
     blocks.push({ type: "text", text: CLAUDE_CODE_IDENTITY });
   }
 
-  const sanitized = systemPrompt ? sanitizeSystemText(systemPrompt) : "";
+  const sanitized = systemPrompt
+    ? sanitizeSystemText(sanitizeSurrogates(systemPrompt))
+    : "";
   if (sanitized) {
     blocks.push({
       type: "text",
@@ -93,10 +95,11 @@ export function sanitizeSystemText(
     return !PI_REMOVAL_ANCHORS.some((anchor) => paragraph.includes(anchor));
   });
 
-  return filtered
-    .join("\n\n")
-    .replace(resolvePiRewritePattern(env), "Claude Code")
-    .trim();
+  const filteredText = filtered.join("\n\n");
+  const rewritePattern = resolvePiRewritePattern(env);
+  rejectZeroLengthMatches(rewritePattern, filteredText);
+
+  return filteredText.replace(rewritePattern, "Claude Code").trim();
 }
 
 function resolvePiRewritePattern(env: NodeJS.ProcessEnv): RegExp {
@@ -122,12 +125,30 @@ function compileCustomPiRewritePattern(value: string | undefined): RegExp {
 
   const parsed = parseRegexLiteral(pattern) ?? { source: pattern, flags: "" };
   const flags = parsed.flags.includes("g") ? parsed.flags : `${parsed.flags}g`;
+  let compiled: RegExp;
   try {
-    return new RegExp(parsed.source, flags);
+    compiled = new RegExp(parsed.source, flags);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`Invalid ${PI_REWRITE_PATTERN_ENV}: ${message}`);
   }
+
+  rejectZeroLengthMatches(compiled, "");
+  return compiled;
+}
+
+function rejectZeroLengthMatches(pattern: RegExp, text: string): void {
+  pattern.lastIndex = 0;
+  let match: RegExpExecArray | null;
+  while ((match = pattern.exec(text)) !== null) {
+    if (match[0].length === 0) {
+      pattern.lastIndex = 0;
+      throw new Error(
+        `Invalid ${PI_REWRITE_PATTERN_ENV}: the pattern can match without consuming text. Use (?!) to disable rewriting.`,
+      );
+    }
+  }
+  pattern.lastIndex = 0;
 }
 
 function parseRegexLiteral(value: string): { source: string; flags: string } | undefined {

package/src/stream.ts

@@ -36,6 +36,26 @@ const REQUIRED_BETAS = [
   "interleaved-thinking-2025-05-14",
 ] as const;
 
+const LEGACY_THINKING_MODEL =
+  /^claude-(?:opus|sonnet|haiku)-4-[0-5](?:-|$)|^claude-[0-3][-.]/;
+const MIN_THINKING_BUDGET = 1024;
+const EFFORT_BY_REASONING: Record<string, string> = {
+  minimal: "low",
+  low: "low",
+  medium: "medium",
+  high: "high",
+  xhigh: "xhigh",
+  max: "max",
+};
+
+export function usesAdaptiveThinking(model: Model<Api>): boolean {
+  const forced = (
+    model.compat as { forceAdaptiveThinking?: boolean } | undefined
+  )?.forceAdaptiveThinking;
+  if (typeof forced === "boolean") return forced;
+  return !LEGACY_THINKING_MODEL.test(model.id.toLowerCase().replace(/\./g, "-"));
+}
+
 function mapStopReason(reason: string | null | undefined): StopReason {
   switch (reason) {
     case "end_turn":
@@ -51,6 +71,43 @@ function mapStopReason(reason: string | null | undefined): StopReason {
   }
 }
 
+type MessageDeltaUsage = {
+  input_tokens?: number | null;
+  output_tokens?: number | null;
+  cache_read_input_tokens?: number | null;
+  cache_creation_input_tokens?: number | null;
+  output_tokens_details?: { thinking_tokens?: number | null };
+};
+
+export function applyMessageDelta(
+  output: AssistantMessage,
+  model: Model<Api>,
+  stopReason: string | null | undefined,
+  usage: MessageDeltaUsage | undefined,
+): void {
+  if (stopReason != null) output.stopReason = mapStopReason(stopReason);
+
+  if (usage) {
+    if (usage.input_tokens != null) output.usage.input = usage.input_tokens;
+    if (usage.output_tokens != null) output.usage.output = usage.output_tokens;
+    if (usage.cache_read_input_tokens != null) {
+      output.usage.cacheRead = usage.cache_read_input_tokens;
+    }
+    if (usage.cache_creation_input_tokens != null) {
+      output.usage.cacheWrite = usage.cache_creation_input_tokens;
+    }
+    const thinkingTokens = usage.output_tokens_details?.thinking_tokens;
+    if (thinkingTokens != null) output.usage.reasoning = thinkingTokens;
+  }
+
+  output.usage.totalTokens =
+    output.usage.input +
+    output.usage.output +
+    output.usage.cacheRead +
+    output.usage.cacheWrite;
+  calculateCost(model, output.usage);
+}
+
 function headersToRecord(headers: Headers): Record<string, string> {
   const record: Record<string, string> = {};
   headers.forEach((value, key) => {
@@ -180,39 +237,22 @@ export function streamAnthropicOAuth(
           ];
         const requestedBudget =
           customBudget ?? defaultBudgets[options.reasoning] ?? 10240;
-        const display = "summarized";
-        const forceAdaptive = (
-          model.compat as { forceAdaptiveThinking?: boolean } | undefined
-        )?.forceAdaptiveThinking;
-        const id = model.id.toLowerCase().replace(/\./g, "-");
-        const adaptive =
-          forceAdaptive === true ||
-          (forceAdaptive !== false &&
-            (/claude-(?:opus|sonnet|haiku|fable|mythos)-5(?:-|$)/.test(id) ||
-              /claude-(?:opus|sonnet|haiku|fable|mythos)-4-(?:[6-9]|\d{2,})(?:-|$)/.test(
-                id,
-              )));
-
-        if (adaptive) {
+        if (usesAdaptiveThinking(model)) {
           const mapped = model.thinkingLevelMap?.[options.reasoning];
           const effort =
             typeof mapped === "string"
               ? mapped
-              : options.reasoning === "minimal" || options.reasoning === "low"
-                ? "low"
-                : options.reasoning === "medium"
-                  ? "medium"
-                  : options.reasoning === "high"
-                    ? "high"
-                    : "high";
-          params.thinking = { type: "adaptive", display } as never;
-          Object.assign(params, { output_config: { effort } });
-        } else {
+              : (EFFORT_BY_REASONING[options.reasoning] ?? "high");
           params.thinking = {
-            type: "enabled",
-            budget_tokens: Math.min(requestedBudget, maxTokens - 1),
-            display,
+            type: "adaptive",
+            display: "summarized",
           } as never;
+          Object.assign(params, { output_config: { effort } });
+        } else {
+          const budget = Math.min(requestedBudget, maxTokens - 1);
+          if (budget >= MIN_THINKING_BUDGET) {
+            params.thinking = { type: "enabled", budget_tokens: budget };
+          }
         }
       }
 
@@ -413,42 +453,26 @@ export function streamAnthropicOAuth(
         }
 
         if (event.type === "message_delta") {
-          output.stopReason = mapStopReason(event.delta.stop_reason);
-          output.usage.input =
-            (event.usage as { input_tokens?: number }).input_tokens ||
-            output.usage.input;
-          output.usage.output =
-            (event.usage as { output_tokens?: number }).output_tokens ||
-            output.usage.output;
-          output.usage.cacheRead =
-            (event.usage as { cache_read_input_tokens?: number })
-              .cache_read_input_tokens || 0;
-          output.usage.cacheWrite =
-            (event.usage as { cache_creation_input_tokens?: number })
-              .cache_creation_input_tokens || 0;
-          const thinkingTokens = (
-            event.usage as {
-              output_tokens_details?: { thinking_tokens?: number };
-            }
-          ).output_tokens_details?.thinking_tokens;
-          if (thinkingTokens != null) {
-            output.usage.reasoning = thinkingTokens;
-          }
-          output.usage.totalTokens =
-            output.usage.input +
-            output.usage.output +
-            output.usage.cacheRead +
-            output.usage.cacheWrite;
-          calculateCost(model, output.usage);
+          applyMessageDelta(
+            output,
+            model,
+            event.delta.stop_reason,
+            event.usage as MessageDeltaUsage | undefined,
+          );
         }
       }
 
       if (options?.signal?.aborted) throw new Error("Request aborted");
-      stream.push({
-        type: "done",
-        reason: output.stopReason as "stop" | "length" | "toolUse",
-        message: output,
-      });
+      if (output.stopReason === "error") {
+        output.errorMessage ??= "Unrecognized stop reason from the API.";
+        stream.push({ type: "error", reason: "error", error: output });
+      } else {
+        stream.push({
+          type: "done",
+          reason: output.stopReason as "stop" | "length" | "toolUse",
+          message: output,
+        });
+      }
       stream.end();
     } catch (error) {
       for (const block of output.content as Array<{