pi-multi-account 1.1.0 → 1.2.0

package/CHANGELOG.md

@@ -5,6 +5,27 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.2.0] - 2026-06-10
+
+### Added
+
+- **Anthropic (Claude Pro/Max) OAuth now works out of the box.** OAuth login is
+  enabled on the base `anthropic` provider and on every `anthropic-account-*`
+  alias, and outgoing Anthropic OAuth requests are shaped (billing header +
+  system-prompt normalization) directly by this package. A separate
+  `pi-anthropic-auth` install is no longer required.
+
+### Changed
+
+- Request shaping is idempotent and only touches OAuth-marked Anthropic requests,
+  so it coexists safely with `pi-anthropic-auth` if both are installed, and leaves
+  API-key Anthropic and OpenAI Codex / Qwen requests untouched.
+
+### Credits
+
+- Anthropic OAuth request-shaping logic vendored from
+  [`gotgenes/pi-anthropic-auth`](https://github.com/gotgenes/pi-anthropic-auth) (MIT).
+
 ## [1.1.0] - 2026-06-10
 
 ### Fixed
@@ -55,5 +76,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Plaintext-free credential handling (SHA-256 fingerprints only); `0600`
   config/state files.
 
+[1.2.0]: https://github.com/Sarrius/pi-multi-account/releases/tag/v1.2.0
 [1.1.0]: https://github.com/Sarrius/pi-multi-account/releases/tag/v1.1.0
 [1.0.0]: https://github.com/Sarrius/pi-multi-account/releases/tag/v1.0.0

package/README.md

@@ -21,7 +21,11 @@ pi install npm:pi-multi-account
 
 Restart Pi or run `/reload` after installation.
 
-> **Anthropic OAuth aliases** (`anthropic-account-2`, …) require [`@gotgenes/pi-anthropic-auth`](https://www.npmjs.com/package/@gotgenes/pi-anthropic-auth) for request shaping. The base `anthropic` provider and all OpenAI Codex / Qwen accounts work without it.
+> **Anthropic (Claude Pro/Max) works out of the box.** OAuth login and request
+> shaping for the base `anthropic` provider and every `anthropic-account-*` alias
+> are built in — no separate `pi-anthropic-auth` install is required. If you
+> already have `pi-anthropic-auth`, the two coexist safely (the shaping is
+> idempotent). OpenAI Codex / ChatGPT and Qwen accounts work as well.
 
 ### Recommended setting
 

package/index.ts

@@ -15,9 +15,11 @@
  *   transparently switches to the next available account/model, optionally
  *   queuing a safe continuation prompt.
  *
- * Anthropic OAuth aliases require `@gotgenes/pi-anthropic-auth` for request
- * shaping (its before_provider_request hook is provider-agnostic and covers
- * every Anthropic OAuth alias this package registers).
+ * Anthropic OAuth (Claude Pro/Max) works out of the box: this package enables
+ * OAuth login on the base `anthropic` provider and on every `anthropic-account-*`
+ * alias, and shapes the outgoing requests itself (billing header + system-prompt
+ * normalization, vendored from gotgenes/pi-anthropic-auth, MIT). No separate
+ * pi-anthropic-auth install is needed; if you have one, both coexist (idempotent).
  *
  * Config:  ~/.pi/agent/provider-failover.json
  * State:   ~/.pi/agent/provider-failover-state.json
@@ -455,7 +457,7 @@ function codexModelDef(id: string) {
 }
 
 function registerAnthropicSlot(pi: ExtensionAPI, id: string) {
-	if (id === ANTHROPIC_BASE) return; // base provider is native / shaped by pi-anthropic-auth
+	if (id === ANTHROPIC_BASE) return; // base provider: oauth + shaping registered in piMultiAccount()
 	const models = DEFAULT_ANTHROPIC_MODELS.map((m) => anthropicModelDef(m, id));
 	pi.registerProvider(id, {
 		name: `Claude Pro/Max (${id})`,
@@ -601,6 +603,193 @@ function getAssistantErrorText(messages: any[]) {
 	return "";
 }
 
+// ===========================================================================
+// Anthropic OAuth request shaping (vendored)
+//
+// Makes Claude Pro/Max (OAuth) accounts work out of the box — no separate
+// pi-anthropic-auth install required. Ported from gotgenes/pi-anthropic-auth
+// (MIT). The logic is idempotent: if pi-anthropic-auth is ALSO installed, both
+// before_provider_request hooks run, but the second sees the request already
+// shaped (billing header present, Pi preamble already replaced) and no-ops.
+//
+// CLAUDE_CODE_VERSION must track the current Claude Code release; if it drifts
+// too far Anthropic may reject or miscount OAuth requests. Check `claude
+// --version` or https://github.com/anthropics/claude-code.
+// ===========================================================================
+
+const PI_DEFAULT_PROMPT_PREFIX = "You are an expert coding assistant operating inside pi, a coding agent harness.";
+const PI_DEFAULT_PROMPT_TERMINATOR =
+	"- Always read pi .md files completely and follow links to related docs (e.g., tui.md for TUI API details)";
+const MINIMAL_ANTHROPIC_OAUTH_PROMPT_PREFIX = "You are an expert coding assistant.";
+const MINIMAL_ANTHROPIC_OAUTH_PROMPT = [
+	MINIMAL_ANTHROPIC_OAUTH_PROMPT_PREFIX,
+	"Be concise and helpful.",
+	"Use the available tools to answer the user's request.",
+	"Show file paths clearly when working with files.",
+].join("\n");
+const CLAUDE_CODE_IDENTITY_PREFIX = "You are Claude Code, Anthropic's official CLI";
+const CLAUDE_CODE_VERSION = "2.1.150";
+const BILLING_HEADER_SALT = "59cf53e54c78";
+const BILLING_HEADER_POSITIONS = [4, 7, 20] as const;
+const CLAUDE_CODE_ENTRYPOINT = "sdk-cli";
+const PARAGRAPH_REMOVAL_ANCHORS: readonly string[] = [
+	"operating inside pi, a coding agent harness",
+	"In addition to the tools above",
+	"Pi documentation (read only when the user asks about pi itself",
+];
+const TEXT_REPLACEMENTS: readonly { match: string; replacement: string }[] = [
+	{
+		match: "Here is some useful information about the environment you are running in:",
+		replacement: "Environment context you are running in:",
+	},
+];
+
+type ShapeTextBlock = { type: "text"; text: string; [key: string]: unknown };
+type ShapeMessageBlock = { type?: string; text?: string; [key: string]: unknown };
+type ShapeMessageParam = { role?: string; content?: string | ShapeMessageBlock[]; [key: string]: unknown };
+type ShapeAnthropicPayload = { model?: unknown; messages?: unknown; system?: unknown; stream?: unknown; [key: string]: unknown };
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function isAnthropicMessagesPayload(payload: unknown): payload is ShapeAnthropicPayload {
+	return isRecord(payload) && typeof payload.model === "string" && Array.isArray(payload.messages) && typeof payload.stream === "boolean";
+}
+
+function hasOAuthAnthropicSystemMarker(block: unknown): boolean {
+	if (!isRecord(block) || block.type !== "text" || typeof block.text !== "string") return false;
+	return (
+		block.text.includes(CLAUDE_CODE_IDENTITY_PREFIX) ||
+		block.text.includes("x-anthropic-billing-header:") ||
+		block.text.startsWith(MINIMAL_ANTHROPIC_OAUTH_PROMPT_PREFIX)
+	);
+}
+
+// Only requests that Pi already marked as OAuth (Claude Code identity block, or
+// already-shaped) are touched — API-key Anthropic requests pass through untouched.
+function isOAuthAnthropicPayload(payload: ShapeAnthropicPayload): boolean {
+	if (!Array.isArray(payload.system)) return false;
+	return payload.system.some(hasOAuthAnthropicSystemMarker);
+}
+
+function getFirstUserText(messages: ShapeMessageParam[]): string {
+	const firstUserMessage = messages.find((message) => message.role === "user");
+	if (!firstUserMessage) return "";
+	if (typeof firstUserMessage.content === "string") return firstUserMessage.content;
+	if (!Array.isArray(firstUserMessage.content)) return "";
+	const firstTextBlock = firstUserMessage.content.find((block) => block.type === "text" && typeof block.text === "string");
+	return typeof firstTextBlock?.text === "string" ? firstTextBlock.text : "";
+}
+
+function buildBillingHeaderValue(messages: ShapeMessageParam[]): string | undefined {
+	const messageText = getFirstUserText(messages);
+	if (!messageText) return undefined;
+	const cch = createHash("sha256").update(messageText).digest("hex").slice(0, 5);
+	const sampledCharacters = BILLING_HEADER_POSITIONS.map((index) => messageText[index] || "0").join("");
+	const suffix = createHash("sha256")
+		.update(`${BILLING_HEADER_SALT}${sampledCharacters}${CLAUDE_CODE_VERSION}`)
+		.digest("hex")
+		.slice(0, 3);
+	return ["x-anthropic-billing-header:", `cc_version=${CLAUDE_CODE_VERSION}.${suffix};`, `cc_entrypoint=${CLAUDE_CODE_ENTRYPOINT};`, `cch=${cch};`].join(" ");
+}
+
+function normalizeSystemBlock(block: unknown): ShapeTextBlock {
+	if (typeof block === "string") return { type: "text", text: block };
+	if (isRecord(block) && typeof block.text === "string") return { ...block, type: "text", text: block.text };
+	return { type: "text", text: "" };
+}
+
+function prependBillingHeader(system: unknown, messages: ShapeMessageParam[]): unknown {
+	const billingHeader = buildBillingHeaderValue(messages);
+	if (!billingHeader) return system;
+	const systemBlocks = Array.isArray(system) ? system.map(normalizeSystemBlock) : system == null ? [] : [normalizeSystemBlock(system)];
+	// Idempotent: don't add a second billing header (e.g. pi-anthropic-auth also ran).
+	if (systemBlocks.some((block) => block.text.includes("x-anthropic-billing-header:"))) return systemBlocks;
+	const billingBlock: ShapeTextBlock = { type: "text", text: billingHeader };
+	return [billingBlock, ...systemBlocks];
+}
+
+// The Anthropic API rejects assistant turns where non-tool_use blocks follow a
+// tool_use block; Pi's serializer can produce that, so split into two turns.
+function splitAssistantToolUseTrailingContent(messages: ShapeMessageParam[]): ShapeMessageParam[] {
+	return messages.flatMap((message) => {
+		if (message.role !== "assistant" || !Array.isArray(message.content)) return [message];
+		const firstToolUseIndex = message.content.findIndex((block) => block.type === "tool_use");
+		if (firstToolUseIndex === -1) return [message];
+		const trailingBlocks = message.content.slice(firstToolUseIndex);
+		if (!trailingBlocks.some((block) => block.type !== "tool_use")) return [message];
+		const nonToolUseBlocks = message.content.filter((block) => block.type !== "tool_use");
+		const toolUseBlocks = message.content.filter((block) => block.type === "tool_use");
+		return [
+			{ ...message, content: nonToolUseBlocks },
+			{ ...message, content: toolUseBlocks },
+		];
+	});
+}
+
+function sanitizeSystemText(text: string): string {
+	const paragraphs = text.split(/\n\n+/);
+	const filtered = paragraphs.filter((paragraph) => !PARAGRAPH_REMOVAL_ANCHORS.some((anchor) => paragraph.includes(anchor)));
+	let result = filtered.join("\n\n");
+	for (const rule of TEXT_REPLACEMENTS) result = result.replaceAll(rule.match, rule.replacement);
+	return result.trim();
+}
+
+function findProjectContextStart(systemPrompt: string): number {
+	return systemPrompt.indexOf("\n\n# Project Context\n\n");
+}
+
+function shapeAnthropicOAuthSystemPrompt(systemPrompt: string): string {
+	const prefixIdx = systemPrompt.indexOf(PI_DEFAULT_PROMPT_PREFIX);
+	if (prefixIdx === -1) return systemPrompt;
+	const terminatorIdx = systemPrompt.indexOf(PI_DEFAULT_PROMPT_TERMINATOR, prefixIdx);
+	if (terminatorIdx !== -1) {
+		const terminatorEnd = terminatorIdx + PI_DEFAULT_PROMPT_TERMINATOR.length;
+		const preamble = systemPrompt.slice(prefixIdx, terminatorEnd);
+		const sanitized = sanitizeSystemText(preamble);
+		const shapedPreamble = sanitized ? `${MINIMAL_ANTHROPIC_OAUTH_PROMPT}\n\n${sanitized}` : MINIMAL_ANTHROPIC_OAUTH_PROMPT;
+		return systemPrompt.slice(0, prefixIdx) + shapedPreamble + systemPrompt.slice(terminatorEnd);
+	}
+	// Pi reworded its preamble terminator → fall back to slicing from project context.
+	const projectContextStart = findProjectContextStart(systemPrompt);
+	if (projectContextStart === -1) return MINIMAL_ANTHROPIC_OAUTH_PROMPT;
+	return `${MINIMAL_ANTHROPIC_OAUTH_PROMPT}${systemPrompt.slice(projectContextStart)}`;
+}
+
+function shapeSystemBlocks(blocks: ShapeTextBlock[]): ShapeTextBlock[] {
+	return blocks.map((block) => {
+		if (block.type !== "text" || !block.text.includes(PI_DEFAULT_PROMPT_PREFIX)) return block;
+		return { ...block, text: shapeAnthropicOAuthSystemPrompt(block.text) };
+	});
+}
+
+/** before_provider_request shaper: makes Claude Pro/Max OAuth requests acceptable. */
+function shapeAnthropicOAuthPayload(payload: unknown): unknown {
+	if (!isAnthropicMessagesPayload(payload)) return payload;
+	const messages = payload.messages as ShapeMessageParam[];
+	if (!isOAuthAnthropicPayload(payload)) return payload; // API-key / non-OAuth → untouched
+	const normalizedMessages = splitAssistantToolUseTrailingContent(messages);
+	const shapedSystem = Array.isArray(payload.system) ? shapeSystemBlocks(payload.system as ShapeTextBlock[]) : payload.system;
+	const finalSystem = prependBillingHeader(shapedSystem, normalizedMessages);
+	return { ...payload, messages: normalizedMessages, system: finalSystem };
+}
+
+/** OAuth override enabling Claude Pro/Max login on a provider (base or alias). */
+const anthropicOAuthOverride = {
+	name: "Anthropic (Claude Pro/Max)",
+	login: (callbacks: any) => loginAnthropic(callbacks),
+	async refreshToken(credentials: any) {
+		const refreshed = await refreshAnthropicToken(credentials.refresh);
+		return {
+			...credentials,
+			...refreshed,
+			refresh: typeof refreshed.refresh === "string" && refreshed.refresh.trim().length > 0 ? refreshed.refresh : credentials.refresh,
+		};
+	},
+	getApiKey: (credentials: any) => credentials.access,
+};
+
 // ===========================================================================
 // Extension entry point
 // ===========================================================================
@@ -1186,6 +1375,14 @@ export default function piMultiAccount(pi: ExtensionAPI) {
 		pi.registerCommand(name, { description: "Manage automatic multi-account failover & rotation", handler: handleCommand });
 	}
 
+	// ----- Anthropic OAuth out of the box -----------------------------------
+	// Enable Claude Pro/Max OAuth login on the base `anthropic` provider and shape
+	// every Anthropic OAuth request so subscription tokens are accepted — without
+	// requiring a separate pi-anthropic-auth install. Idempotent, so it coexists
+	// safely if pi-anthropic-auth is also present.
+	pi.registerProvider("anthropic", { oauth: anthropicOAuthOverride } as any);
+	pi.on("before_provider_request", (event: any) => shapeAnthropicOAuthPayload(event.payload));
+
 	// ----- lifecycle hooks --------------------------------------------------
 
 	refreshDiscovery(true);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-multi-account",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Automatic multi-account failover & rotation for Pi Agent across Anthropic (Claude), OpenAI/ChatGPT Codex, and Qwen/Alibaba. Auto-discovers authenticated accounts, grows the rotation on login, and drops accounts on logout, expiry, or quota/rate-limit errors.",
   "type": "module",
   "license": "MIT",