Merge pull request #8 from New1Direction/feat/claude-api-key-only

feat: Claude is API-key only; remove subscription OAuth; docs explainer (v1.6.0)

Author: New1Direction

CHANGELOG.md

@@ -4,9 +4,39 @@ Every release of RepoLens, newest first. Want the friendly highlights instead of
 the full detail? See **[What's new](README.md)** in the README.
 
 This project follows [Semantic Versioning](https://semver.org/) and groups changes
-by theme. Dates are when the release landed on `main` — 1.1.0 through 1.5.0 shipped
+by theme. Dates are when the release landed on `main` — 1.1.0 through 1.6.0 shipped
 the same day, as a rapid burst of improvements, so they share a date.
 
+## [1.6.0] — 2026-06-13 · _Claude is API-key only_
+
+### Removed
+
+- **The Claude *subscription* sign-in ("Sign in with Claude").** It never reliably
+  worked, and it can't: Anthropic binds Claude Pro/Max OAuth tokens to their own
+  **Claude Code** client (validated server-side via an identity system prompt + beta
+  flags) and, as of 2026, its terms **prohibit using subscription authentication in
+  third-party products**. The only way to make it "work" is to impersonate Claude
+  Code — which is a terms violation that risks getting **the user's own Anthropic
+  account banned** and breaks whenever Anthropic rotates a flag. So we took it out
+  rather than ship spoofing.
+
+### Changed
+
+- **Claude now connects with a Console API key only** (`sk-ant-api…` from
+  console.anthropic.com). The Anthropic card's *Connect* opens the key field directly;
+  `callAnthropic` is a clean `x-api-key` request with no OAuth/exchange branches.
+- Dropped the now-unused `claude.ai`, `platform.claude.com`, and
+  `console.anthropic.com` host permissions (kept `api.anthropic.com` for inference).
+- Deleted the dead `oauth-anthropic.js` module and its callback interception.
+
+### Notes
+
+- **This does not affect the working sign-ins.** **Grok** (Grok CLI device flow),
+  **OpenRouter**, and **OpenAI** (Sign in with ChatGPT, added in 1.5.0) still use
+  one-click OAuth — those vendors *support* third-party OAuth. Anthropic is the one
+  that doesn't.
+- **Free is still easy:** local **Ollama** (no key) or **Gemini's** free tier.
+
 ## [1.5.0] — 2026-06-13 · _Sign in with ChatGPT_
 
 ### Added

README.md

@@ -10,7 +10,7 @@
 ![Zero build](https://img.shields.io/badge/build-none-0e1722)
 ![Vanilla ES modules](https://img.shields.io/badge/vanilla-ES_modules-f7df1e?logo=javascript&logoColor=black)
 ![Tests](https://img.shields.io/badge/tests-420%2B_passing-4ade80)
-![Version](https://img.shields.io/badge/version-1.5.0-7c5cff)
+![Version](https://img.shields.io/badge/version-1.6.0-7c5cff)
 ![Storage](https://img.shields.io/badge/storage-in--browser_IndexedDB-38bdf8)
 
 </div>
@@ -43,6 +43,11 @@ Plus **SKTPG** (a one-tap State / Known-pitfalls / Trajectory / Proof / Growth r
 
 Newest first — the highlights. Full, detailed notes live in the **[changelog](CHANGELOG.md)**.
 
+### v1.6.0 — Claude is API-key only
+
+- 🔑 **Removed the Claude *subscription* sign-in.** Anthropic locks Claude Pro/Max tokens to their own Claude Code app and, as of 2026, prohibits subscription sign-in in third-party tools — so that login could never work here without impersonating Claude Code (which risks getting **your** account banned). Connect Claude with a **Console API key** instead.
+- 🆓 **Want $0?** Use **local Ollama** (no key) or **Gemini's free tier** — both already supported. See the [How models & sign-in work](website/content/docs/how-it-works.mdx) guide.
+
 ### v1.5.0 — Sign in with ChatGPT
 
 - 🔓 **Connect OpenAI without a key** — *Sign in with ChatGPT* uses the **same login the Codex CLI does**: approve it on OpenAI's page and RepoLens handles the rest. Joins Claude (Claude Code login) and Grok (Grok CLI login) — the three big CLI sign-ins are now all here.
@@ -92,7 +97,7 @@ No accounts. No backend. Your keys, your machine.
 
 ## Models — your keys, your call
 
-Bring your own provider. Five are **first-class** (OAuth where available — Anthropic, Grok, OpenRouter — otherwise an API key) and fan out across a **smart fallback chain**: RepoLens tries them in order and drops to the next if one errors, so a single key is enough to start.
+Bring your own provider. Five are **first-class** (one-click sign-in where the vendor allows it — **Grok**, **OpenRouter**, and **OpenAI/ChatGPT** — otherwise an API key; **Claude** is API-key only) and fan out across a **smart fallback chain**: RepoLens tries them in order and drops to the next if one errors, so a single key is enough to start.
 
 **Nous** (Nous Research) **→ Gemini → OpenRouter → Grok → Anthropic**
 

background.js

@@ -26,16 +26,6 @@ import { nodeIdFor, edgeIdFor, ideaIdFor } from './graph.js';
 import { deriveCapabilities } from './taxonomy.js';
 import { combineCandidates } from './combinator.js';
 import { buildCombinatorPrompt, parseCombinator } from './combinator-prompt.js';
-import {
-  ANTHROPIC_OAUTH_ERROR_KEY,
-  ANTHROPIC_OAUTH_STATE_KEY,
-  ANTHROPIC_OAUTH_VERIFIER_KEY,
-  clearAnthropicCredentials,
-  exchangeAnthropicCode,
-  getAnthropicCredentials,
-  isAnthropicOAuthCallbackUrl,
-  refreshAnthropicToken,
-} from './oauth-anthropic.js';
 import { refreshXaiToken, XAI_CHAT_PROXY } from './oauth-xai.js';
 import {
   OPENAI_OAUTH_ERROR_KEY,
@@ -218,80 +208,10 @@ function resolveCompetitor(input) {
   return { platform: 'github', repoId };
 }
 
-// ─── Anthropic OAuth callback handling (robust intercept for claude.ai → console.anthropic.com) ───
-
-// One redirect can fire BOTH webNavigation.onCompleted and tabs.onUpdated, and the
-// auth code is single-use — only the first handler may run the exchange.
+// One redirect can fire BOTH a navigation event and tabs.onUpdated, and the auth
+// code is single-use — this de-dups so only the first handler runs the exchange.
 const _handledOAuthCodes = new Set();
 
-async function handleAnthropicOAuthCallback(rawUrl, tabId) {
-  if (!rawUrl || !isAnthropicOAuthCallbackUrl(rawUrl)) return;
-
-  console.log('[RepoLens OAuth] Callback detected:', rawUrl.split('?')[0]); // strip the single-use ?code=…
-
-  let url;
-  try {
-    url = new URL(rawUrl);
-  } catch {
-    return;
-  }
-
-  const code = url.searchParams.get('code');
-  const state = url.searchParams.get('state');
-  const error = url.searchParams.get('error');
-  const errorDesc = url.searchParams.get('error_description');
-
-  // Clean verifier/state (the "pending flow" markers). Leave ERROR_KEY for the waiting UI to consume.
-  const cleanupFlowMarkers = async () => {
-    await chrome.storage.local.remove([
-      ANTHROPIC_OAUTH_VERIFIER_KEY,
-      ANTHROPIC_OAUTH_STATE_KEY,
-    ]).catch(() => {});
-  };
-
-  if (error) {
-    const msg = errorDesc || error;
-    console.warn('[RepoLens OAuth] Provider returned error:', msg);
-    await chrome.storage.local.set({ [ANTHROPIC_OAUTH_ERROR_KEY]: `Claude OAuth error: ${msg}` });
-    await cleanupFlowMarkers();
-    if (tabId) chrome.tabs.remove(tabId).catch(() => {});
-    return;
-  }
-
-  if (!code) {
-    console.warn('[RepoLens OAuth] No code in callback URL');
-    await cleanupFlowMarkers();
-    if (tabId) chrome.tabs.remove(tabId).catch(() => {});
-    return;
-  }
-
-  if (_handledOAuthCodes.has(code)) return; // the other listener got here first
-  _handledOAuthCodes.add(code);
-
-  const stored = await chrome.storage.local.get([ANTHROPIC_OAUTH_VERIFIER_KEY, ANTHROPIC_OAUTH_STATE_KEY]);
-  const verifier = stored[ANTHROPIC_OAUTH_VERIFIER_KEY];
-  const storedState = stored[ANTHROPIC_OAUTH_STATE_KEY];
-
-  if (!verifier) {
-    console.warn('[RepoLens OAuth] No stored verifier — flow may have been interrupted or was for another extension');
-    await cleanupFlowMarkers();
-    if (tabId) chrome.tabs.remove(tabId).catch(() => {});
-    return;
-  }
-
-  try {
-    await exchangeAnthropicCode({ code, state, verifier, storedState });
-    console.log('[RepoLens OAuth] Success — tokens stored');
-    await cleanupFlowMarkers();
-    if (tabId) chrome.tabs.remove(tabId).catch(() => {});
-  } catch (err) {
-    console.error('[RepoLens OAuth] Exchange error:', err.message);
-    await chrome.storage.local.set({ [ANTHROPIC_OAUTH_ERROR_KEY]: err.message });
-    await cleanupFlowMarkers();
-    if (tabId) chrome.tabs.remove(tabId).catch(() => {});
-  }
-}
-
 // ─── OpenAI OAuth callback handling ("Sign in with ChatGPT", Codex CLI flow) ───
 //
 // The redirect lands on http://localhost:1455/auth/callback — the loopback server
@@ -366,11 +286,6 @@ async function handleOpenAIOAuthCallback(rawUrl, tabId) {
   }
 }
 
-chrome.webNavigation.onCompleted.addListener((details) => {
-  if (details.frameId !== 0) return;
-  handleAnthropicOAuthCallback(details.url, details.tabId);
-});
-
 // The OpenAI loopback redirect can't load (no local server), so onCompleted never
 // fires for it — onBeforeNavigate runs first and still carries the ?code=.
 chrome.webNavigation.onBeforeNavigate.addListener((details) => {
@@ -380,7 +295,6 @@ chrome.webNavigation.onBeforeNavigate.addListener((details) => {
 
 chrome.tabs.onUpdated.addListener((tabId, changeInfo) => {
   if (changeInfo.url) {
-    handleAnthropicOAuthCallback(changeInfo.url, tabId);
     handleOpenAIOAuthCallback(changeInfo.url, tabId);
   }
 });
@@ -978,44 +892,22 @@ async function callAIInner(keys, prompt, part) {
   throw new Error(rankErrors(failures).userMessage);
 }
 
+// Anthropic Messages API with a standard Console API key (sk-ant-api…) via x-api-key.
+// Subscription/OAuth sign-in was removed: Anthropic binds Claude-subscription tokens to
+// the Claude Code client (server-side identity checks) and, as of 2026, prohibits using
+// subscription auth in third-party apps — so the only supported path is a Console key.
 async function callAnthropic(model = 'claude-sonnet-4-6', prompt) {
-  // Two credential styles share the `anthropicKey` slot:
-  //   • a standard API key (sk-ant-api…) → sent via x-api-key  ← supported, reliable
-  //   • an OAuth access token (has a refresh token) → exchanged for an API key, or
-  //     sent raw with the OAuth beta flags as a fallback
-  //
-  // Uses Hermes-hardened getAnthropicCredentials + refreshAnthropicToken (60s skew + inflight dedup)
-  const { anthropicKey, anthropicRefresh } = await chrome.storage.local.get(['anthropicKey', 'anthropicRefresh']);
-  const creds = await getAnthropicCredentials().catch(() => null);
-
-  const isOAuth = !!(anthropicRefresh || creds?.refresh_token);
-  let token = isOAuth ? await refreshAnthropicToken() : anthropicKey;
-  if (!token) throw new Error('No Anthropic credential — add a key in Settings');
-
-  // OAuth tokens need exchange via create_api_key to get a usable API key.
-  // Direct x-api-key with OAuth tokens may fail (401 "invalid x-api-key").
-  // The Claude Code SDK does this exchange internally.
-  let usingRawOAuthToken = false;
-  if (isOAuth) {
-    const exchanged = await exchangeAnthropicOAuthForApiKey(token);
-    usingRawOAuthToken = exchanged === token;
-    token = exchanged;
-  }
-
-  const headers = {
-    'anthropic-version': '2023-06-01',
-    'anthropic-dangerous-direct-browser-access': 'true',
-    'Content-Type': 'application/json',
-    'x-api-key': token,
-  };
-  // A raw OAuth access token (exchange unavailable) only works with the beta flags.
-  if (usingRawOAuthToken) {
-    headers['anthropic-beta'] = 'oauth-2025-04-20,claude-code-20250219';
-  }
+  const { anthropicKey } = await chrome.storage.local.get('anthropicKey');
+  if (!anthropicKey) throw new Error('No Anthropic API key — add one in Settings');
 
   const res = await fetch('https://api.anthropic.com/v1/messages', {
     method: 'POST',
-    headers,
+    headers: {
+      'anthropic-version': '2023-06-01',
+      'anthropic-dangerous-direct-browser-access': 'true',
+      'Content-Type': 'application/json',
+      'x-api-key': anthropicKey,
+    },
     body: JSON.stringify({
       model,
       max_tokens: 4096,
@@ -1024,20 +916,6 @@ async function callAnthropic(model = 'claude-sonnet-4-6', prompt) {
   });
   if (!res.ok) {
     const err = await res.json().catch(() => ({}));
-    // Only clear stored OAuth tokens on a real auth failure — never on transient errors.
-    if (res.status === 401 && isOAuth) {
-      // The cached exchanged key may be the stale credential being rejected — drop it
-      // so a reconnect takes effect immediately instead of after the SW restarts.
-      _anthropicExchangedKey = null;
-      _anthropicExchangedKeyExpiry = 0;
-      // Hermes-hardened clear (structured + legacy flat keys)
-      if (typeof clearAnthropicCredentials === 'function') {
-        await clearAnthropicCredentials();
-      } else {
-        await chrome.storage.local.remove(['anthropicKey', 'anthropicRefresh', 'anthropicExpiry', 'anthropicCredentials']);
-      }
-      throw new Error('Anthropic session expired — please reconnect in Settings');
-    }
     throw new Error(err.error?.message ?? `Anthropic API error ${res.status}`);
   }
   const data = await res.json();
@@ -1046,44 +924,6 @@ async function callAnthropic(model = 'claude-sonnet-4-6', prompt) {
   return text;
 }
 
-// Cache the exchanged API key (short-lived, ~8h) to avoid hammering the endpoint.
-let _anthropicExchangedKey = null;
-let _anthropicExchangedKeyExpiry = 0;
-
-async function exchangeAnthropicOAuthForApiKey(oauthToken) {
-  // Return cached key if still valid (with 5min skew)
-  if (_anthropicExchangedKey && Date.now() < _anthropicExchangedKeyExpiry - 300_000) {
-    return _anthropicExchangedKey;
-  }
-
-  try {
-    const res = await fetch('https://api.anthropic.com/api/oauth/claude_cli/create_api_key', {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'Authorization': `Bearer ${oauthToken}`,
-      },
-      body: JSON.stringify({}),
-    });
-
-    if (res.ok) {
-      const data = await res.json();
-      if (data.api_key) {
-        _anthropicExchangedKey = data.api_key;
-        _anthropicExchangedKeyExpiry = Date.now() + (data.expires_in || 28800) * 1000;
-        return data.api_key;
-      }
-    }
-    // If exchange fails (endpoint might not exist or token type not supported),
-    // fall back to using the raw OAuth token (callAnthropic adds the beta flags).
-    console.warn('[RepoLens] create_api_key exchange failed, falling back to raw OAuth token');
-  } catch (err) {
-    console.warn('[RepoLens] create_api_key exchange error:', err.message);
-  }
-
-  return oauthToken;
-}
-
 async function callGemini(key, model = 'gemini-2.5-flash', prompt) {
   const url = 'https://generativelanguage.googleapis.com/v1beta/models/' + encodeURIComponent(model) + ':generateContent?key=' + encodeURIComponent(key);
   const res = await fetch(url, {

manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "RepoLens",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "One-click repo explainer. Powered by Claude.",
   "permissions": ["storage", "activeTab", "tabs", "identity", "webNavigation"],
   "host_permissions": [
@@ -13,9 +13,6 @@
     "https://registry.npmjs.org/*",
     "https://pypi.org/pypi/*",
     "https://api.anthropic.com/*",
-    "https://console.anthropic.com/*",
-    "https://claude.ai/*",
-    "https://platform.claude.com/*",
     "https://generativelanguage.googleapis.com/*",
     "https://openrouter.ai/*",
     "https://api.x.ai/*",