feat(oauth): add runtime auto-refresh token bridge

[Steffen025]

Summary

• Tokens expire every ~8-12h for all users — manual refresh was the only option after PR feat(installer): add anthropic-max preset for Max/Pro OAuth subscription #84
• Adds a runtime plugin that checks the token every 5 messages and auto-refreshes from macOS Keychain
• All users need this (Claude Code CLI is a prerequisite, so everyone has the Keychain credentials)

Changes

New files

• .opencode/plugins/anthropic-token-bridge.js — compiled plugin, runs in OpenCode
• .opencode/plugins/anthropic-token-bridge.ts — source TypeScript
• .opencode/plugins/lib/token-utils.ts — reads/writes auth.json, checks expiry
• .opencode/plugins/lib/refresh-manager.ts — 3-strategy refresh (Keychain → claude setup-token → exchange API)
• contrib/anthropic-max-bridge/plugins/anthropic-token-bridge.js — included in standalone contrib package

Modified files

• .opencode/plugins/lib/file-logger.ts — add info() / warn() / error() wrappers (needed by token bridge)
• contrib/anthropic-max-bridge/install.sh — copies both plugins, updates token refresh note

How it works

Every 5 user messages the plugin checks auth.json. If the token expires in <2h it triggers an async refresh:

1. Strategy 1 — Extract fresh token from macOS Keychain (security find-generic-password)
2. Strategy 2 — Generate setup token via claude setup-token CLI
3. Strategy 3 — Exchange setup token via api.anthropic.com/v1/oauth/setup_token/exchange

Refresh has a 5-minute cooldown to prevent hammering. All logging goes to /tmp/pai-opencode-debug.log (TUI-safe, ADR-004).

Summary by CodeRabbit

• New Features

  • Automatic Anthropic OAuth refresh: checks every 5 user messages and at session start; triggers background refresh when tokens are missing or near expiry.
  • Refresh safeguards: prevents concurrent refreshes and enforces a cooldown between attempts.

• Documentation

  • Installer and README updated to install both plugins and explain auto-refresh plus a manual fallback.

• Other

  • Added local debug logging for refresh activity and outcomes.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds an Anthropic OAuth token auto-refresh plugin and supporting utilities that read/write session auth at ~/.local/share/opencode/auth.json, check token expiry, attempt refresh (Keychain → Claude CLI → Anthropic exchange), persist new tokens, and register handlers to trigger checks during chat sessions.

Changes

Cohort / File(s)	Summary
Core Token Bridge Plugin ./.opencode/plugins/anthropic-token-bridge.ts, ./.opencode/plugins/anthropic-token-bridge.js, contrib/anthropic-max-bridge/plugins/anthropic-token-bridge.js	New plugin registering chat.message (every 5 user messages) and experimental.chat.system.transform handlers; checks Anthropic token status and asynchronously triggers guarded refresh when missing, expired, or expiring soon; logs outcomes to file.
Token Management ./.opencode/plugins/lib/token-utils.ts, ./.opencode/plugins/lib/refresh-manager.ts	Implements token status inspection, masking, auth.json read/write, and a multi-strategy refresh manager with single-flight, 5‑minute cooldown, Keychain extraction, Claude CLI fallback, OAuth setup-token exchange, and persistence via updateAnthropicTokens.
Logging Helpers ./.opencode/plugins/lib/file-logger.ts	Adds info, warn, and error wrappers that serialize optional metadata and forward messages to the existing file logger.
Contrib Installer & Docs contrib/anthropic-max-bridge/install.sh, contrib/anthropic-max-bridge/README.md, contrib/anthropic-max-bridge/TECHNICAL.md	Installer now installs the token-bridge plugin and documentation updated to describe automatic 5-message refresh checks, Keychain/Claude refresh paths, cooldown behavior, and manual refresh-token.sh fallback.

Sequence Diagram(s)

sequenceDiagram
    participant Handler as Chat Handler
    participant Plugin as Token Bridge Plugin
    participant TokenUtils as Token Utils
    participant AuthFile as Auth File\n(~/.local/share/opencode/auth.json)
    participant Keychain as macOS Keychain
    participant Claude as Claude CLI
    participant AnthropicAPI as Anthropic OAuth API

    Handler->>Plugin: Trigger check (every 5th user message or session start)
    Plugin->>TokenUtils: checkAnthropicToken()
    TokenUtils->>AuthFile: Read auth.json
    AuthFile-->>TokenUtils: Token data / expiresAt

    alt Missing/expired/expiring soon
        TokenUtils-->>Plugin: status (requires refresh)
        Plugin->>Plugin: isRefreshInProgress? / cooldown
        alt Not refreshing
            Plugin->>Keychain: Run `security find-generic-password`
            alt Keychain returns tokens
                Keychain-->>Plugin: access_token, refresh_token
            else Keychain failed
                Plugin->>Claude: Run `claude setup-token`
                Claude-->>Plugin: setup_token (sk-ant-...)
                Plugin->>AnthropicAPI: POST /v1/oauth/setup_token/exchange
                AnthropicAPI-->>Plugin: access_token, refresh_token, expires_in
            end
            Plugin->>TokenUtils: updateAnthropicTokens(access, refresh, expires_in)
            TokenUtils->>AuthFile: Write updated auth.json
            AuthFile-->>TokenUtils: Write success
            TokenUtils-->>Plugin: success
        else Refresh in progress or cooldown
            Plugin-->>Handler: Skip refresh (in-progress/cooldown)
        end
    else Valid
        TokenUtils-->>Plugin: no action required
    end

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• feat(installer): add anthropic-max preset for Max/Pro OAuth subscription #84: Adds a closely related Anthropic OAuth token-refresh flow (auth.json reads/writes, Keychain + Claude CLI refresh, plugin handlers) with overlapping logic and file targets.

Poem

🐰 I hop through logs at midnight’s gate,
Five tiny hops to check the state,
Keychain hums, Claude whispers a key,
I stitch new tokens, set sessions free,
Hopping happy — auth refreshed with glee ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat(oauth): add runtime auto-refresh token bridge' accurately summarizes the main change: introducing a new runtime plugin that automatically refreshes Anthropic OAuth tokens.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/oauth-auto-refresh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 5

🧹 Nitpick comments (3)

.opencode/plugins/lib/refresh-manager.ts (1)

21-40: Consider adding a timeout to prevent indefinite hangs.

The execCommand function has no timeout, so if security or claude commands hang (e.g., waiting for user input, Keychain prompt stuck), the refresh process will hang indefinitely.

⏱️ Proposed fix to add timeout

-function execCommand(command: string, args: string[]): Promise<ExecResult> {
-	return new Promise((resolve) => {
+const EXEC_TIMEOUT_MS = 30_000; // 30 seconds
+
+function execCommand(command: string, args: string[]): Promise<ExecResult> {
+	return new Promise((resolve) => {
 		const child = spawn(command, args);
 		let stdout = "";
 		let stderr = "";
+		const timeout = setTimeout(() => {
+			child.kill();
+			resolve({ stdout, stderr: "Command timed out", exitCode: 124 });
+		}, EXEC_TIMEOUT_MS);

 		child.stdout?.on("data", (data: Buffer) => {
 			stdout += data.toString();
 		});
 		child.stderr?.on("data", (data: Buffer) => {
 			stderr += data.toString();
 		});
 		child.on("close", (exitCode: number | null) => {
+			clearTimeout(timeout);
 			resolve({ stdout, stderr, exitCode: exitCode ?? 0 });
 		});
 		child.on("error", (err: Error) => {
+			clearTimeout(timeout);
 			resolve({ stdout, stderr: String(err), exitCode: 1 });
 		});
 	});
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.opencode/plugins/lib/refresh-manager.ts around lines 21 - 40, The
execCommand function can hang indefinitely; update execCommand to accept an
optional timeout parameter (or use a default timeout) and enforce it by starting
a timer when spawn(command, args) is called, and on timeout kill the child
process (child.kill()) and resolve with stderr indicating a timeout and a
non-zero exitCode; ensure you clear the timer on normal close or error and
remove/avoid double-resolving the promise by wiring the timer, 'close', and
'error' handlers to a single resolve path. Reference symbols: function
execCommand, local child variable (spawn), child.on('close'), child.on('error').

.opencode/plugins/anthropic-token-bridge.js (1)

41-59: Async/sync inconsistency: functions marked async but use synchronous operations.

readAuthFile and writeAuthFile are marked async and await on the error() calls, but error() is synchronous (returns void). The TypeScript source uses synchronous functions. This won't break at runtime, but indicates the bundle may be out of sync with the source.

Consider regenerating this bundle from the TypeScript source to ensure consistency.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.opencode/plugins/anthropic-token-bridge.js around lines 41 - 59, The bundle
incorrectly marks readAuthFile and writeAuthFile as async and awaits error(),
while they use synchronous fs APIs; change these to synchronous functions to
match the TS source by removing the async keyword and any await before error(),
keeping fs.readFileSync and fs.writeFileSync and returning values directly (use
error(...) instead of await error(...)) so readAuthFile, writeAuthFile,
AUTH_FILE and error() usage are consistent; alternatively regenerate the bundle
from the TypeScript source if that was the intended fix.

contrib/anthropic-max-bridge/plugins/anthropic-token-bridge.js (1)

1-405: This file is a duplicate of .opencode/plugins/anthropic-token-bridge.js.

The same issues noted in the other review apply here:

• Line 164: Dead code (promisify(spawn))
• Lines 41-59: Async/sync inconsistency
• Lines 206-207: Pipeline false positive for secret detection

Consider generating both files from a single source to avoid maintenance burden and drift between copies.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@contrib/anthropic-max-bridge/plugins/anthropic-token-bridge.js` around lines
1 - 405, This file duplicates .opencode/plugins/anthropic-token-bridge.js and
has three actionable issues: remove the dead promisify(spawn) usage (the exec
variable should call your execCommand wrapper, remove "var exec =
promisify(spawn)" and any use that relies on it), fix async/sync mismatch in
readAuthFile and writeAuthFile (these functions are declared async but use
synchronous fs methods and call await error/logger which are synchronous —
either make the logger functions return Promises or remove the unnecessary
async/await and return values synchronously; update readAuthFile/writeAuthFile
to consistently use either fs.promises or to be non-async), and stop leaking
potential setup tokens in logs by not matching or logging raw tokens in
generateSetupToken (replace the raw regex tokenMatch usage by safely validating
presence without storing or logging the full token, and ensure any logs
redact/mask matches). Also consolidate this file with the existing one to avoid
duplication and drift (generate both outputs from a single source or remove the
duplicate).

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.opencode/plugins/anthropic-token-bridge.js:
- Around line 206-207: The pipeline flagged runtime extractions of secrets for
accessToken and refreshToken as hardcoded — update the lines that define const
accessToken = credentials.accessToken || credentials.access_token; and const
refreshToken = credentials.refreshToken || credentials.refresh_token; to include
the same suppression comment used in the TypeScript source (e.g., an appropriate
Snyk/semgrep/secret-scan suppression annotation) indicating these are runtime
Keychain extractions, so the scanner treats them as false positives; place the
suppression comment immediately above or on the same line as those const
declarations and ensure it references the scanner rule ID used in the project.
- Around line 163-164: Remove the dead promisify usage: the line creating exec
via promisify(spawn) is invalid because spawn returns a ChildProcess, and exec
is unused; delete the import of promisify and the var exec = promisify(spawn)
statement so the module only uses spawn directly (see symbols promisify, spawn,
and exec in this file) and ensure no remaining references to exec remain.

In @.opencode/plugins/anthropic-token-bridge.ts:
- Around line 13-14: The chat.message handler incorrectly reads role from input;
change it to read the message from output by extracting const msg = (output as
any).message and then guard with if (!msg?.role || msg.role !== "user") return;
— update the async "chat.message"(...) handler to use msg/role from
output.message instead of input.role so only user messages pass.

In @.opencode/plugins/lib/refresh-manager.ts:
- Around line 70-71: This is a false positive from the secret scanner on runtime
token extractions: update the token-extraction site (where you set accessToken =
credentials.accessToken ?? credentials.access_token and refreshToken =
credentials.refreshToken ?? credentials.refresh_token) to include a suppression
comment recognized by our secret-scanner immediately above those lines (or the
surrounding function) so the scanner knows these are runtime values from
Keychain, not hardcoded secrets; reference the variables accessToken,
refreshToken and the credentials object when adding the suppression and ensure
the comment follows the scanner's expected syntax/pattern for ignored findings.

In @.opencode/plugins/lib/token-utils.ts:
- Line 5: AUTH_FILE currently uses process.env.HOME with a literal "~" fallback
which won't expand; update token-utils.ts to import node:os and use os.homedir()
when building AUTH_FILE (replace the AUTH_FILE definition that references
process.env.HOME or "~" with a path.join(os.homedir(), ".local", "share",
"opencode", "auth.json")) and ensure the os import is added at the top of the
file.

---

Nitpick comments:
In @.opencode/plugins/anthropic-token-bridge.js:
- Around line 41-59: The bundle incorrectly marks readAuthFile and writeAuthFile
as async and awaits error(), while they use synchronous fs APIs; change these to
synchronous functions to match the TS source by removing the async keyword and
any await before error(), keeping fs.readFileSync and fs.writeFileSync and
returning values directly (use error(...) instead of await error(...)) so
readAuthFile, writeAuthFile, AUTH_FILE and error() usage are consistent;
alternatively regenerate the bundle from the TypeScript source if that was the
intended fix.

In @.opencode/plugins/lib/refresh-manager.ts:
- Around line 21-40: The execCommand function can hang indefinitely; update
execCommand to accept an optional timeout parameter (or use a default timeout)
and enforce it by starting a timer when spawn(command, args) is called, and on
timeout kill the child process (child.kill()) and resolve with stderr indicating
a timeout and a non-zero exitCode; ensure you clear the timer on normal close or
error and remove/avoid double-resolving the promise by wiring the timer,
'close', and 'error' handlers to a single resolve path. Reference symbols:
function execCommand, local child variable (spawn), child.on('close'),
child.on('error').

In `@contrib/anthropic-max-bridge/plugins/anthropic-token-bridge.js`:
- Around line 1-405: This file duplicates
.opencode/plugins/anthropic-token-bridge.js and has three actionable issues:
remove the dead promisify(spawn) usage (the exec variable should call your
execCommand wrapper, remove "var exec = promisify(spawn)" and any use that
relies on it), fix async/sync mismatch in readAuthFile and writeAuthFile (these
functions are declared async but use synchronous fs methods and call await
error/logger which are synchronous — either make the logger functions return
Promises or remove the unnecessary async/await and return values synchronously;
update readAuthFile/writeAuthFile to consistently use either fs.promises or to
be non-async), and stop leaking potential setup tokens in logs by not matching
or logging raw tokens in generateSetupToken (replace the raw regex tokenMatch
usage by safely validating presence without storing or logging the full token,
and ensure any logs redact/mask matches). Also consolidate this file with the
existing one to avoid duplication and drift (generate both outputs from a single
source or remove the duplicate).

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 9ee43b80-3f36-4f66-acf3-2ac8928f2e25

📥 Commits

Reviewing files that changed from the base of the PR and between b1b1f0c and 11e5e88.

📒 Files selected for processing (7)

• .opencode/plugins/anthropic-token-bridge.js
• .opencode/plugins/anthropic-token-bridge.ts
• .opencode/plugins/lib/file-logger.ts
• .opencode/plugins/lib/refresh-manager.ts
• .opencode/plugins/lib/token-utils.ts
• contrib/anthropic-max-bridge/install.sh
• contrib/anthropic-max-bridge/plugins/anthropic-token-bridge.js

[coderabbitai]

🧹 Nitpick comments (1)

contrib/anthropic-max-bridge/README.md (1)

88-90: Broaden auto-refresh wording to match actual fallback behavior.

Current text implies Keychain is the only refresh source, but runtime logic also falls back to claude setup-token and setup-token exchange. Please align this section with the 3-strategy flow to avoid support confusion.

Suggested doc tweak

-**Auto-refresh (default):** The `anthropic-token-bridge` plugin checks your token every 5 messages and refreshes it automatically from the macOS Keychain — no action needed.
+**Auto-refresh (default):** The `anthropic-token-bridge` plugin checks your token every 5 messages and refreshes it automatically (Keychain first, then CLI/setup-token fallback paths) — no action needed.
...
-> So the Keychain always has a fresh token after any `claude` use — which is what the auto-refresh plugin pulls from.
+> So the Keychain is usually fresh after any `claude` use, and the plugin uses it first before fallback refresh paths.

Also applies to: 99-99

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@contrib/anthropic-max-bridge/README.md` around lines 88 - 90, Update the
"Auto-refresh (default)" / "Manual refresh (fallback)" wording to reflect the
three-step refresh flow used by the anthroptic-token-bridge: state that the
plugin attempts automatic refresh from the macOS Keychain every 5 messages, then
falls back to invoking the local `claude setup-token` flow, and finally to the
interactive `setup-token` exchange if the previous methods fail; mention all
three strategies and that no user action is needed unless all fallbacks fail,
and reference the `anthropic-token-bridge`, `claude setup-token`, and
`setup-token` terms so readers can find the commands.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@contrib/anthropic-max-bridge/README.md`:
- Around line 88-90: Update the "Auto-refresh (default)" / "Manual refresh
(fallback)" wording to reflect the three-step refresh flow used by the
anthroptic-token-bridge: state that the plugin attempts automatic refresh from
the macOS Keychain every 5 messages, then falls back to invoking the local
`claude setup-token` flow, and finally to the interactive `setup-token` exchange
if the previous methods fail; mention all three strategies and that no user
action is needed unless all fallbacks fail, and reference the
`anthropic-token-bridge`, `claude setup-token`, and `setup-token` terms so
readers can find the commands.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: d5173885-03f4-4b39-890b-25077b5b8fb9

📥 Commits

Reviewing files that changed from the base of the PR and between 11e5e88 and 050eed7.

📒 Files selected for processing (2)

• contrib/anthropic-max-bridge/README.md
• contrib/anthropic-max-bridge/TECHNICAL.md

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (2)

.opencode/plugins/lib/token-utils.ts (1)

29-47: Synchronous I/O is acceptable here, but note the lack of file locking.

The readFileSync/writeFileSync calls are fine for small JSON files. However, as noted in refresh-manager.ts, there's no inter-process locking. If multiple processes (e.g., concurrent OpenCode instances) attempt to refresh tokens simultaneously, auth.json could be corrupted or updates could be lost.

For a plugin of this scope, this is an acceptable trade-off given the 5-minute cooldown between refresh attempts, but worth documenting.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.opencode/plugins/lib/token-utils.ts around lines 29 - 47, Document that
readAuthFile and writeAuthFile use synchronous I/O without file locking and can
suffer inter-process races: add a clear comment (or a short JSDoc) above the
functions readAuthFile and writeAuthFile explaining that
readFileSync/writeFileSync are chosen intentionally, that concurrent processes
can corrupt auth.json or lose updates, and reference the 5-minute refresh
cooldown as the rationale and trade-off; optionally include a TODO suggesting
future use of advisory locks or an atomic write strategy if stronger guarantees
are required.

contrib/anthropic-max-bridge/plugins/anthropic-token-bridge.js (1)

1-33: Bundled JS file risks becoming stale.

This file inlines all modules (file-logger, token-utils, refresh-manager) into a single distributable JS file. Per install.sh (lines 132-137), it's installed via cp rather than symlink.

If the source TypeScript files are updated, this bundled JS will not automatically reflect those changes. Consider:

1. Adding a build step to regenerate this file from TS sources
2. Documenting the regeneration process
3. Adding a version/hash comment to detect drift

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@contrib/anthropic-max-bridge/plugins/anthropic-token-bridge.js` around lines
1 - 33, The bundled JS (which defines LOG_PATH, fileLog, fileLogError, info,
warn, error) can drift from the TypeScript sources because it's copied in
install.sh; update the repo to ensure the bundle regenerates automatically and
is detectable: add a build step that compiles the TypeScript sources
(token-utils, refresh-manager, file-logger) into this JS during CI and/or npm
build, add a documented regeneration command in CONTRIBUTING or INSTALL
(referencing the bundling step that produces the file containing
fileLog/fileLogError), and insert a version/hash comment header into the
generated file so mismatches between source and bundle are easy to detect.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.opencode/plugins/lib/refresh-manager.ts:
- Around line 76-87: The code parses claudeAiOauth.expiresAt but then ignores it
and always passes a hardcoded 28800s to updateAnthropicTokens; update
refreshAnthropicToken to compute the real TTL from claudeAiOauth.expiresAt
(convert to seconds relative to now), clamp to a sensible minimum (e.g., 0) and
use that value when calling updateAnthropicTokens (fall back to 28800 only if
expiresAt is missing or invalid) so you don't store an incorrect expiry;
reference claudeAiOauth.expiresAt, refreshAnthropicToken, and
updateAnthropicTokens when making the change.

---

Nitpick comments:
In @.opencode/plugins/lib/token-utils.ts:
- Around line 29-47: Document that readAuthFile and writeAuthFile use
synchronous I/O without file locking and can suffer inter-process races: add a
clear comment (or a short JSDoc) above the functions readAuthFile and
writeAuthFile explaining that readFileSync/writeFileSync are chosen
intentionally, that concurrent processes can corrupt auth.json or lose updates,
and reference the 5-minute refresh cooldown as the rationale and trade-off;
optionally include a TODO suggesting future use of advisory locks or an atomic
write strategy if stronger guarantees are required.

In `@contrib/anthropic-max-bridge/plugins/anthropic-token-bridge.js`:
- Around line 1-33: The bundled JS (which defines LOG_PATH, fileLog,
fileLogError, info, warn, error) can drift from the TypeScript sources because
it's copied in install.sh; update the repo to ensure the bundle regenerates
automatically and is detectable: add a build step that compiles the TypeScript
sources (token-utils, refresh-manager, file-logger) into this JS during CI
and/or npm build, add a documented regeneration command in CONTRIBUTING or
INSTALL (referencing the bundling step that produces the file containing
fileLog/fileLogError), and insert a version/hash comment header into the
generated file so mismatches between source and bundle are easy to detect.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7802f728-80d8-4d9d-a670-b3b12819aebd

📥 Commits

Reviewing files that changed from the base of the PR and between 050eed7 and 5b4e1ce.

📒 Files selected for processing (5)

• .opencode/plugins/anthropic-token-bridge.js
• .opencode/plugins/anthropic-token-bridge.ts
• .opencode/plugins/lib/refresh-manager.ts
• .opencode/plugins/lib/token-utils.ts
• contrib/anthropic-max-bridge/plugins/anthropic-token-bridge.js

✅ Files skipped from review due to trivial changes (1)

• .opencode/plugins/anthropic-token-bridge.js

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Consider using the Keychain token's actual expiration.

The claudeAiOauth structure includes an expiresAt field (line 80), but it's not used. Instead, a hardcoded 8-hour expiry (28800 seconds) is passed to updateAnthropicTokens at line 211.

If the Keychain token has a different remaining lifetime, this could cause premature "expires soon" warnings or, worse, storing an already-expired token as if it were valid for 8 hours.

🔧 Suggested improvement

 		// Extract from nested claudeAiOauth structure (standard Claude Code format)
 		const oauth = credentials.claudeAiOauth;
+		const expiresAt = oauth?.expiresAt;
 		// pragma: allowlist secret — runtime extraction from macOS Keychain
 		const accessToken = oauth?.accessToken ?? credentials.accessToken ?? credentials.access_token;
 		const refreshToken = oauth?.refreshToken ?? credentials.refreshToken ?? credentials.refresh_token;
 
 		if (!accessToken || !refreshToken) {
 			// ...
 		}
 
-		return { accessToken, refreshToken };
+		return { accessToken, refreshToken, expiresAt };

Then in refreshAnthropicToken:

 		if (keychainTokens) {
 			info("Found tokens in Keychain, updating auth.json");
+			// Calculate remaining seconds, default to 8 hours if no expiry
+			const expiresInSeconds = keychainTokens.expiresAt
+				? Math.max(0, Math.floor((keychainTokens.expiresAt - Date.now()) / 1000))
+				: 28800;
 			const success = updateAnthropicTokens(
 				keychainTokens.accessToken,
 				keychainTokens.refreshToken,
-				28800,
+				expiresInSeconds,
 			);

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.opencode/plugins/lib/refresh-manager.ts around lines 76 - 87, The code
parses claudeAiOauth.expiresAt but then ignores it and always passes a hardcoded
28800s to updateAnthropicTokens; update refreshAnthropicToken to compute the
real TTL from claudeAiOauth.expiresAt (convert to seconds relative to now),
clamp to a sensible minimum (e.g., 0) and use that value when calling
updateAnthropicTokens (fall back to 28800 only if expiresAt is missing or
invalid) so you don't store an incorrect expiry; reference
claudeAiOauth.expiresAt, refreshAnthropicToken, and updateAnthropicTokens when
making the change.