pi-claude-agent-sdk 0.9.0 → 0.9.2

package/README.md

@@ -29,7 +29,7 @@ Fable 5.1 needs Claude Code **2.1.251 or newer**. If an explicitly configured CL
 
 Behind the scenes, pi's tools are bridged to Claude Code but everything works like normal in pi. Bash commands get Claude Code's 120-second default timeout since pi's bash has none. Skills are forwarded to Claude Code's system prompt, and steering mid-turn reaches Claude at the next tool boundary.
 
-**Authentication:** the bridge requires an Anthropic OAuth credential (or API key) configured in Pi and uses Pi's normal token refresh. Claude Code login and inherited Claude/Anthropic authentication settings are deliberately ignored, so configure Anthropic authentication in Pi before using the provider.
+**Authentication:** the bridge requires an Anthropic OAuth credential (or API key) configured in Pi and uses Pi's token refresh, renewing an OAuth token with less than two hours left before it starts a Claude Code turn (a turn keeps the token it started with). Claude Code login and inherited Claude/Anthropic authentication settings are deliberately ignored, so configure Anthropic authentication in Pi before using the provider.
 
 The model list comes from pi-ai's Anthropic catalog automatically — when pi-ai adds a new Claude model, it appears in `/model` after updating the package, no bridge update needed. Dated snapshot ids (e.g. `claude-opus-4-5-20251101`) are not shown.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-claude-agent-sdk",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "private": false,
   "description": "Pi extension that uses Claude Code (via Agent SDK) as a model provider.",
   "keywords": [

package/src/child-env.ts

@@ -65,10 +65,49 @@ export function buildClaudeChildEnv(
 	return env;
 }
 
+/** Remaining validity an OAuth token must have before it is handed to a child.
+ *
+ * A child keeps the token it was spawned with for its whole turn and cannot
+ * refresh it (it never sees the refresh token), so a turn that outlives the
+ * token fails with "401 OAuth access token has expired". Pi's default refresh
+ * window is five minutes; asking for more refreshes early instead. Anthropic
+ * access tokens last about eight hours, so this costs one extra refresh per
+ * cycle and leaves only turns longer than this exposed.
+ */
+export const CHILD_OAUTH_MIN_VALIDITY_MS = 2 * 60 * 60 * 1000;
+
+interface AnthropicAuthRuntime {
+	getAuth(provider: string, overrides?: { minOAuthValidityMs?: number }): Promise<AuthResult | undefined>;
+}
+
+// Latched when the provider issues tokens shorter than the minimum: pi refreshes
+// and then rejects the result, so retrying would refresh on every child spawn.
+let minValidityUnsatisfiable = false;
+
+/** Pi's public getProviderAuth() takes no overrides, but is a pass-through to
+ * ModelRuntime.getAuth(), which accepts minOAuthValidityMs. Reach the runtime
+ * when it is there and fall back to the public call otherwise. */
+async function resolveAnthropicAuth(registry: AnthropicAuthRegistry): Promise<AuthResult | undefined> {
+	const runtime = (registry as { runtime?: Partial<AnthropicAuthRuntime> }).runtime;
+	if (!minValidityUnsatisfiable && typeof runtime?.getAuth === "function") {
+		try {
+			return await runtime.getAuth("anthropic", { minOAuthValidityMs: CHILD_OAUTH_MIN_VALIDITY_MS });
+		} catch (err) {
+			if (/expires too soon/i.test(err instanceof Error ? err.message : String(err))) minValidityUnsatisfiable = true;
+		}
+	}
+	return registry.getProviderAuth("anthropic");
+}
+
 export async function resolveClaudeChildEnv(
 	registry: AnthropicAuthRegistry | null | undefined,
 	base: NodeJS.ProcessEnv = process.env,
 ): Promise<NodeJS.ProcessEnv> {
-	const resolved = registry ? await registry.getProviderAuth("anthropic") : undefined;
+	const resolved = registry ? await resolveAnthropicAuth(registry) : undefined;
 	return buildClaudeChildEnv(base, resolved);
 }
+
+/** Test hook: clear the unsatisfiable-minimum latch. */
+export function resetChildAuthState(): void {
+	minValidityUnsatisfiable = false;
+}