feat(tui): stealth oauth login

Author: Kuberwastaken

src-rust/crates/api/src/lib.rs

@@ -468,6 +468,55 @@ pub mod client {
             self.config.api_key.is_empty()
         }
 
+        /// Returns `true` when this client is configured to use a Claude Code
+        /// OAuth Bearer token (Claude.ai Pro/Max). The query path and the
+        /// request builders check this to enable stealth-impersonation.
+        pub fn is_oauth(&self) -> bool {
+            self.config.use_bearer_auth
+        }
+
+        /// Mutate the outgoing request so it looks like Claude Code when the
+        /// client is authenticated with an OAuth Bearer token:
+        ///
+        /// 1. Prepend the required `"You are Claude Code, …"` system block.
+        ///    Existing system content is preserved as a second block so the
+        ///    rest of Claurst's prompt assembly still reaches the model.
+        ///
+        /// No-op when `use_bearer_auth` is false (API-key flow).
+        fn apply_oauth_stealth(&self, request: &mut CreateMessageRequest) {
+            if !self.config.use_bearer_auth {
+                return;
+            }
+
+            let identity_block = SystemBlock {
+                block_type: "text".to_string(),
+                text: claurst_core::oauth_config::CLAUDE_CODE_SYSTEM_PROMPT_PREFIX.to_string(),
+                cache_control: None,
+            };
+
+            request.system = match request.system.take() {
+                None => Some(SystemPrompt::Blocks(vec![identity_block])),
+                Some(SystemPrompt::Text(existing)) => {
+                    let existing_block = SystemBlock {
+                        block_type: "text".to_string(),
+                        text: existing,
+                        cache_control: None,
+                    };
+                    Some(SystemPrompt::Blocks(vec![identity_block, existing_block]))
+                }
+                Some(SystemPrompt::Blocks(mut blocks)) => {
+                    // Avoid duplicating the identity block on retries / re-sends.
+                    let already_first = blocks.first().is_some_and(|b| {
+                        b.text == claurst_core::oauth_config::CLAUDE_CODE_SYSTEM_PROMPT_PREFIX
+                    });
+                    if !already_first {
+                        blocks.insert(0, identity_block);
+                    }
+                    Some(SystemPrompt::Blocks(blocks))
+                }
+            };
+        }
+
         /// Build a new client.  Panics if `config.api_key` is empty.
         pub fn new(config: ClientConfig) -> anyhow::Result<Self> {
             // Allow empty key at construction — validation is deferred to
@@ -556,6 +605,7 @@ pub mod client {
             }
 
             request.stream = false;
+            self.apply_oauth_stealth(&mut request);
             let body = serde_json::to_value(&request).map_err(ClaudeError::Json)?;
 
             let resp = self.send_with_retry(&body).await?;
@@ -661,6 +711,7 @@ pub mod client {
             }
 
             request.stream = true;
+            self.apply_oauth_stealth(&mut request);
             let body = serde_json::to_value(&request).map_err(ClaudeError::Json)?;
 
             let resp = self.send_with_retry(&body).await?;
@@ -704,11 +755,19 @@ pub mod client {
                 .get(&url)
                 .header("anthropic-version", &self.config.api_version)
                 .header("content-type", "application/json");
-            req = if self.config.use_bearer_auth {
-                req.header("Authorization", format!("Bearer {}", &self.config.api_key))
+            if self.config.use_bearer_auth {
+                let ua = format!(
+                    "claude-cli/{}",
+                    claurst_core::oauth_config::CLAUDE_CODE_VERSION_FOR_OAUTH
+                );
+                req = req
+                    .header("anthropic-beta", claurst_core::oauth_config::OAUTH_BETA_FLAGS.join(","))
+                    .header("user-agent", ua)
+                    .header("x-app", "cli")
+                    .header("Authorization", format!("Bearer {}", &self.config.api_key));
             } else {
-                req.header("x-api-key", &self.config.api_key)
-            };
+                req = req.header("x-api-key", &self.config.api_key);
+            }
 
             let resp = req.send().await?;
 
@@ -744,24 +803,57 @@ pub mod client {
             loop {
                 attempts += 1;
 
-                // Compute CCH hash and build billing header
-                let cch_hash = cch::compute_cch(body_bytes);
-                let billing_header = format!("cc_version=0.1; cc_entrypoint=claude_code; {}; cc_workload=claude_code;", cch_hash);
-
                 // Use Bearer auth for Claude.ai OAuth tokens; x-api-key for regular keys.
+                let use_oauth = self.config.use_bearer_auth;
+
+                // On the OAuth path we impersonate Claude Code: prepend the
+                // required beta flags, advertise `claude-cli/<ver>` as the
+                // user-agent, and drop the CCH billing header (the real
+                // Claude Code client sends it but the API does not require
+                // it for OAuth tokens, and emitting it would fingerprint
+                // mismatch against the impersonated UA).
+                let anthropic_beta = if use_oauth {
+                    let mut flags: Vec<&str> =
+                        claurst_core::oauth_config::OAUTH_BETA_FLAGS.to_vec();
+                    if !self.config.beta_features.is_empty() {
+                        flags.push(&self.config.beta_features);
+                    }
+                    flags.join(",")
+                } else {
+                    self.config.beta_features.clone()
+                };
+
                 let mut req = self
                     .http
                     .post(&url)
                     .header("anthropic-version", &self.config.api_version)
-                    .header("anthropic-beta", &self.config.beta_features)
+                    .header("anthropic-beta", &anthropic_beta)
                     .header("content-type", "application/json")
-                    .header("accept", "text/event-stream")
-                    .header("x-anthropic-billing-header", billing_header);
-                req = if self.config.use_bearer_auth {
-                    req.header("Authorization", format!("Bearer {}", &self.config.api_key))
+                    .header("accept", "text/event-stream");
+
+                if use_oauth {
+                    let ua = format!(
+                        "claude-cli/{}",
+                        claurst_core::oauth_config::CLAUDE_CODE_VERSION_FOR_OAUTH
+                    );
+                    req = req
+                        .header("user-agent", ua)
+                        .header("x-app", "cli")
+                        .header("Authorization", format!("Bearer {}", &self.config.api_key));
                 } else {
-                    req.header("x-api-key", &self.config.api_key)
-                };
+                    // Compute CCH billing hash and attach on the API-key path
+                    // only — this is the codepath the official client uses
+                    // for direct API customers.
+                    let cch_hash = cch::compute_cch(body_bytes);
+                    let billing_header = format!(
+                        "cc_version=0.1; cc_entrypoint=claude_code; {}; cc_workload=claude_code;",
+                        cch_hash
+                    );
+                    req = req
+                        .header("x-anthropic-billing-header", billing_header)
+                        .header("x-api-key", &self.config.api_key);
+                }
+
                 let req = req.body(body_str.clone());
 
                 let resp = req.send().await.map_err(ClaudeError::Http)?;

src-rust/crates/cli/src/oauth_flow.rs

@@ -1,9 +1,12 @@
-// WARNING: The OAuth client IDs in this module are registered to Anthropic's Claude Code CLI.
-// They will not work for Claurst. This module is preserved for reference but disabled.
-// Users should authenticate via API key (/connect → Anthropic → paste key).
-//
 // OAuth 2.0 PKCE login flow for the Claurst CLI.
 //
+// Uses the Claude Code client ID and impersonates Claude Code at request time
+// (see `claurst_core::oauth_config` for the impersonation constants and
+// `claurst_api::AnthropicClient::apply_oauth_stealth` for how they're applied).
+// Claude Pro/Max tokens used through Claurst draw from the account's "extra
+// usage" pool, not subscription quota — users should be aware of this before
+// switching from API-key auth.
+//
 // Implements the same flow as the TypeScript OAuthService + authLogin():
 // 1. Generate PKCE code_verifier / code_challenge / state
 // 2. Start a temporary localhost HTTP server on a random port

src-rust/crates/core/src/lib.rs

@@ -3496,9 +3496,10 @@ pub mod oauth {
 
     // ---- Production OAuth endpoints & constants ----
 
-    // NOTE: This client ID is registered to Anthropic's official Claude Code CLI.
-    // It will NOT work for Claurst. Users should use an API key from console.anthropic.com.
-    pub const CLIENT_ID: &str = "9d1c250a-e61b-44d9-88ed-5944d1962f5e"; // Anthropic's — will not work for Claurst
+    // Claude Code client ID, used in stealth-impersonation mode (see
+    // `claurst_core::oauth_config` for the matching request-time headers and
+    // system-prompt prefix wired into `claurst_api::AnthropicClient`).
+    pub const CLIENT_ID: &str = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
     pub const CONSOLE_AUTHORIZE_URL: &str = "https://platform.claude.com/oauth/authorize";
     pub const CLAUDE_AI_AUTHORIZE_URL: &str = "https://claude.com/cai/oauth/authorize";
     pub const TOKEN_URL: &str = "https://platform.claude.com/v1/oauth/token";

src-rust/crates/core/src/oauth_config.rs

@@ -47,6 +47,25 @@ pub const ALL_OAUTH_SCOPES: &[&str] = &[
 /// Minimum scopes required for basic operation.
 pub const MINIMUM_SCOPES: &[&str] = &[CLAUDE_AI_INFERENCE_SCOPE, CLAUDE_AI_PROFILE_SCOPE];
 
+// ---------------------------------------------------------------------------
+// Claude Code stealth-impersonation constants
+// ---------------------------------------------------------------------------
+
+/// User-Agent advertised to Anthropic's API on OAuth-authenticated requests.
+/// Must match a Claude Code version the server still accepts; bump when
+/// Anthropic invalidates the current value.
+pub const CLAUDE_CODE_VERSION_FOR_OAUTH: &str = "2.1.75";
+
+/// `anthropic-beta` flags that must be present on every OAuth-authenticated
+/// request. Without these the API server rejects subscription tokens.
+pub const OAUTH_BETA_FLAGS: &[&str] = &["claude-code-20250219", "oauth-2025-04-20"];
+
+/// System-prompt prefix that must appear as the first system block on every
+/// OAuth-authenticated request. Anthropic's gate refuses requests whose system
+/// prompt does not start with this identity string.
+pub const CLAUDE_CODE_SYSTEM_PROMPT_PREFIX: &str =
+    "You are Claude Code, Anthropic's official CLI for Claude.";
+
 // ---------------------------------------------------------------------------
 // OAuthConfig struct
 // ---------------------------------------------------------------------------
@@ -76,10 +95,17 @@ pub struct OAuthConfig {
 // Production config (mirrors PROD_OAUTH_CONFIG in oauth.ts)
 // ---------------------------------------------------------------------------
 
-// NOTE: These OAuth client IDs are registered to Anthropic's official Claude Code CLI.
-// They will NOT work for Claurst — Anthropic's auth server will reject or misattribute requests.
-// Users should use an API key from console.anthropic.com instead.
-// To use OAuth, Claurst would need its own registered OAuth application with Anthropic.
+// Claude Code OAuth client ID, used in stealth-impersonation mode so that
+// Anthropic's auth server accepts Claude Pro/Max tokens through Claurst.
+// The matching request-time impersonation (user-agent, x-app, anthropic-beta,
+// and the Claude Code system-prompt prefix) is wired up in
+// `claurst_api::client::AnthropicClient` and is required for these tokens to
+// be honoured by the API.
+//
+// Billing note: tokens minted by a Pro/Max subscription draw from the
+// account's "extra usage" pool when used by a third-party client — they do
+// not consume subscription quota. Users should be aware of this before
+// switching from API-key auth.
 pub const PROD_OAUTH: OAuthConfig = OAuthConfig {
     base_api_url: "https://api.anthropic.com",
     // Routes through claude.com/cai/* for attribution, 307s to claude.ai in
@@ -93,7 +119,7 @@ pub const PROD_OAUTH: OAuthConfig = OAuthConfig {
     console_success_url: "https://platform.claude.com/buy_credits?returnUrl=/oauth/code/success%3Fapp%3Dclaude-code",
     claudeai_success_url: "https://platform.claude.com/oauth/code/success?app=claude-code",
     manual_redirect_url: "https://platform.claude.com/oauth/code/callback",
-    client_id: "9d1c250a-e61b-44d9-88ed-5944d1962f5e", // Anthropic's Claude Code — will not work for Claurst
+    client_id: "9d1c250a-e61b-44d9-88ed-5944d1962f5e", // Claude Code client ID (stealth)
     oauth_file_suffix: "",
     mcp_proxy_url: "https://mcp-proxy.anthropic.com",
     mcp_proxy_path: "/v1/mcp/{server_id}",
@@ -114,7 +140,7 @@ pub const STAGING_OAUTH: OAuthConfig = OAuthConfig {
     console_success_url: "https://platform.staging.ant.dev/buy_credits?returnUrl=/oauth/code/success%3Fapp%3Dclaude-code",
     claudeai_success_url: "https://platform.staging.ant.dev/oauth/code/success?app=claude-code",
     manual_redirect_url: "https://platform.staging.ant.dev/oauth/code/callback",
-    client_id: "22422756-60c9-4084-8eb7-27705fd5cf9a", // Anthropic's Claude Code staging — will not work for Claurst
+    client_id: "22422756-60c9-4084-8eb7-27705fd5cf9a", // Claude Code staging client ID (stealth)
     oauth_file_suffix: "-staging-oauth",
     mcp_proxy_url: "https://mcp-proxy-staging.anthropic.com",
     mcp_proxy_path: "/v1/mcp/{server_id}",