Module: PWN::AI::Anthropic

Defined in:
lib/pwn/ai/anthropic.rb

Overview

This plugin interacts with Anthropic's Claude API. It provides methods to list models, generate completions, and chat. API documentation: https://docs.anthropic.com/en/api Obtain an API key from https://console.anthropic.com/

Constant Summary collapse

ANTHROPIC_OAUTH_CLIENT_ID =

Anthropic / Claude OAuth (Claude Pro/Max) -- public-client PKCE.

Same identity path Claude Code / community tools use:

* public client_id 9d1c250a-e61b-44d9-88ed-5944d1962f5e (no secret)
* authorization_code + S256 PKCE against claude.ai
* token endpoint at platform.claude.com
* redirect_uri is the official hosted callback that returns a
pasteable code (code=true) -- SSH / headless friendly, no
localhost listener required.

Access tokens are short-lived; refresh_token is durable. Persist via pwn-vault under ai.anthropic.oauth.refresh_token.

Wire format for OAuth bearers is different from API keys: Authorization: Bearer <access_token> anthropic-beta: (NO x-api-key)

'9d1c250a-e61b-44d9-88ed-5944d1962f5e'
ANTHROPIC_OAUTH_AUTHORIZE_URI = 
'https://claude.ai/oauth/authorize'
ANTHROPIC_OAUTH_TOKEN_URI = 
'https://platform.claude.com/v1/oauth/token'
ANTHROPIC_OAUTH_REDIRECT_URI = 
'https://platform.claude.com/oauth/code/callback'
ANTHROPIC_OAUTH_SCOPE = 
'user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload'
ANTHROPIC_OAUTH_USER_AGENT = 
'claude-cli/2.1.81 (external, cli)'
ANTHROPIC_OAUTH_BETA_FLAGS = 
'claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,prompt-caching-scope-2026-01-05'

Class Method Summary collapse

Class Method Details

.authors ⇒ Object

Author(s)

0day Inc. support@0dayinc.com



945
946
947
948
949
 
# File 'lib/pwn/ai/anthropic.rb', line 945

public_class_method def self.authors
  "AUTHOR(S):
    0day Inc. <support@0dayinc.com>
  "
end

.chat(opts = {}) ⇒ Object

Supported Method Parameters

response = PWN::AI::Anthropic.chat( request: 'required - message to Anthropic', model: 'optional - model to use for text generation (defaults to PWN::Env[:anthropic][:model])', temp: 'optional - creative response float (defaults to PWN::Env[:anthropic][:temp])', system_role_content: 'optional - context to set up the model behavior for conversation (Default: PWN::Env[:anthropic][:system_role_content])', response_history: 'optional - pass response back in to have a conversation', speak_answer: 'optional speak answer using PWN::Plugins::Voice.text_to_speech (Default: nil)', timeout: 'optional timeout in seconds (defaults to 900)', spinner: 'optional - display spinner (defaults to false)' )



838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
 
# File 'lib/pwn/ai/anthropic.rb', line 838

public_class_method def self.chat(opts = {})
  engine = PWN::Env[:ai][:anthropic]
  request = opts[:request]
  max_prompt_length = engine[:max_prompt_length] ||= 200_000
  request_trunc_idx = ((max_prompt_length - 1) / 3.36).floor
  request = request[0..request_trunc_idx]

  model = opts[:model] ||= engine[:model]
  raise 'ERROR: Model is required.  Call #get_models method for details' if model.nil?

  temp = opts[:temp].to_f ||= engine[:temp].to_f
  temp = 1 if temp.zero?

  rest_call = 'messages'

  response_history = opts[:response_history]

  system_role_content = opts[:system_role_content] ||= engine[:system_role_content]

  system_role = {
    role: 'system',
    content: system_role_content
  }

  user_role = {
    role: 'user',
    content: request
  }

  response_history ||= { choices: [system_role] }

  http_body = {
    model: model,
    max_tokens: engine[:max_tokens] || 128_000,
    temperature: temp,
    system: system_role_content,
    messages: []
  }

  if response_history[:choices].length > 1
    response_history[:choices][1..].each do |message|
      next if message[:role] == 'system'

      http_body[:messages].push(role: message[:role].to_s, content: message[:content].to_s)
    end
  end

  http_body[:messages].push(role: 'user', content: request)

  timeout = opts[:timeout]
   = opts[:spinner]

  response = anthropic_rest_call(
    http_method: :post,
    rest_call: rest_call,
    http_body: http_body,
    timeout: timeout,
    spinner: 
  )

  json_resp = JSON.parse(response, symbolize_names: true)
  raise "Anthropic API Error: #{json_resp[:error] || json_resp}" if json_resp[:error] || json_resp[:type] == 'error'

  assistant_content = if json_resp[:content] && json_resp[:content].is_a?(Array) && json_resp[:content].first
                        json_resp[:content].first[:text]
                      else
                        ''
                      end
  assistant_resp = {
    role: 'assistant',
    content: assistant_content
  }

  # Build choices for PWN compatibility: [system, ...history..., user, assistant]
  json_resp[:choices] = [system_role] + http_body[:messages]
  json_resp[:choices].push(assistant_resp)

  # Ensure compatibility fields
  json_resp[:id] ||= "msg_#{SecureRandom.hex(8)}"
  json_resp[:object] ||= 'message'
  json_resp[:model] ||= model

  if json_resp[:usage].is_a?(Hash)
    inp_tokens = json_resp[:usage][:input_tokens] || 0
    out_tokens = json_resp[:usage][:output_tokens] || 0
    json_resp[:usage][:total_tokens] = inp_tokens + out_tokens
  else
    json_resp[:usage] = { input_tokens: 0, output_tokens: 0, total_tokens: 0 }
  end

  speak_answer = true if opts[:speak_answer]

  if speak_answer
    answer = assistant_resp[:content]
    text_path = "/tmp/#{SecureRandom.hex}.pwn_voice"
    File.write(text_path, answer)
    PWN::Plugins::Voice.text_to_speech(text_path: text_path)
    File.unlink(text_path)
  end

  json_resp
rescue StandardError => e
  raise e
end

.chat_with_tools(opts = {}) ⇒ Object

Supported Method Parameters

response = PWN::AI::Anthropic.chat_with_tools( messages: 'required - OpenAI-format messages array (system/user/assistant/tool)', tools: 'optional - OpenAI tools array [function:{...}]', tool_choice: 'optional - "auto" | "none" | "required" | function:{name:..}', model: 'optional - overrides PWN::Env[:anthropic][:model]', temp: 'optional - temperature (defaults to PWN::Env[:anthropic][:temp] || 1)', max_tokens: 'optional - defaults to PWN::Env[:anthropic][:max_tokens] || 128_000', timeout: 'optional - seconds (default 900)', spinner: 'optional - display spinner (default false)' )



641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
 
# File 'lib/pwn/ai/anthropic.rb', line 641

public_class_method def self.chat_with_tools(opts = {})
  engine   = PWN::Env[:ai][:anthropic]
  messages = opts[:messages]
  raise 'ERROR: messages array is required' if messages.nil? || messages.empty?

  model = opts[:model] ||= engine[:model]
  raise 'ERROR: Model is required.  Call #get_models method for details' if model.nil?

  temp = opts[:temp].to_f
  temp = engine[:temp].to_f.nonzero? || 1 if temp.zero?

  system_str, anth_messages = oa_messages_to_anthropic(messages: messages)

  http_body = {
    model: model,
    max_tokens: opts[:max_tokens] || engine[:max_tokens] || 128_000,
    temperature: temp,
    messages: anth_messages
  }
  http_body[:system] = system_str if system_str && !system_str.empty?

  if opts[:tools] && !opts[:tools].empty?
    http_body[:tools] = opts[:tools].map do |t|
      fn = t[:function] || t['function'] || t
      {
        name: fn[:name] || fn['name'],
        description: fn[:description] || fn['description'],
        input_schema: fn[:parameters] || fn['parameters'] || { type: 'object', properties: {} }
      }
    end
    http_body[:tool_choice] = anth_tool_choice(choice: opts[:tool_choice]) if opts[:tool_choice]
  end

  response = anthropic_rest_call(
    http_method: :post,
    rest_call: 'messages',
    http_body: http_body,
    timeout: opts[:timeout],
    spinner: opts[:spinner]
  )
  return nil if response.nil?

  json_resp = JSON.parse(response, symbolize_names: true)
  raise "Anthropic API Error: #{json_resp[:error] || json_resp}" if json_resp[:error] || json_resp[:type] == 'error'

  anthropic_resp_to_oa(response: json_resp)
rescue StandardError => e
  raise e
end

.get_models ⇒ Object

Supported Method Parameters

models = PWN::AI::Anthropic.get_models



489
490
491
492
493
494
495
 
# File 'lib/pwn/ai/anthropic.rb', line 489

public_class_method def self.get_models
  models = anthropic_rest_call(rest_call: 'models')

  JSON.parse(models, symbolize_names: true)[:data]
rescue StandardError => e
  raise e
end

.get_plan_usage(opts = {}) ⇒ Object

Supported Method Parameters

usage = PWN::AI::Anthropic.get_plan_usage( timeout: 'optional - seconds (default 8)' )

Admin Usage API (organizations/usage_report/messages) yields tokens used; organizations/rate_limits yields the configured ceiling so the PS1 can show a percent. Individual accounts without an Admin key return available:false. Never prompts for credentials.



506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
 
# File 'lib/pwn/ai/anthropic.rb', line 506

public_class_method def self.get_plan_usage(opts = {})
  timeout = opts[:timeout] || 8
  return { available: false, engine: :anthropic } unless plan_usage_credentials?

  now = Time.now.utc
  start_of_month = Time.utc(now.year, now.month, 1)
  report = parse_plan_usage_json(
    raw: anthropic_rest_call(
      rest_call: 'organizations/usage_report/messages',
      params: {
        starting_at: start_of_month.strftime('%Y-%m-%dT00:00:00Z'),
        ending_at: now.strftime('%Y-%m-%dT%H:%M:%SZ'),
        bucket_width: '1d'
      },
      timeout: timeout,
      spinner: false,
      non_interactive: true
    )
  )
  used_tokens = sum_usage_tokens(report: report)

  limits = parse_plan_usage_json(
    raw: anthropic_rest_call(
      rest_call: 'organizations/rate_limits',
      timeout: timeout,
      spinner: false,
      non_interactive: true
    )
  )
  limit_tokens = first_rate_limit(limits: limits)

  normalized = PWN::AI.normalize_plan_usage(
    used: used_tokens,
    limit: limit_tokens,
    source: 'organizations/usage_report',
    engine: :anthropic
  )
  return normalized if normalized[:available]

  { available: false, engine: :anthropic }
rescue StandardError
  { available: false, engine: :anthropic }
end

.help ⇒ Object

Display Usage for this Module



953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
 
# File 'lib/pwn/ai/anthropic.rb', line 953

public_class_method def self.help
  puts "USAGE:
    models = #{self}.get_models

    usage = #{self}.get_plan_usage

    # One-time Claude Pro/Max OAuth enrollment (PKCE paste flow):
    bearer = #{self}.obtain_oauth_bearer_token
    # Subsequent runs silently refresh via ai.anthropic.oauth.refresh_token

    response = #{self}.chat(
      request: 'required - message to Anthropic',
      model: 'optional - model to use for text generation (defaults to PWN::Env[:ai][:anthropic][:model])',
      temp: 'optional - creative response float (defaults to PWN::Env[:ai][:anthropic][:temp])',
      system_role_content: 'optional - context to set up the model behavior for conversation (Default: PWN::Env[:ai][:anthropic][:system_role_content])',
      response_history: 'optional - pass response back in to have a conversation',
      speak_answer: 'optional speak answer using PWN::Plugins::Voice.text_to_speech (Default: nil)',
      timeout: 'optional - timeout in seconds (defaults to 900)',
      spinner: 'optional - display spinner (defaults to false)'
    )

    #{self}.authors
  "
end

.obtain_oauth_bearer_token(opts = {}) ⇒ Object

Supported Method Parameters

bearer = PWN::AI::Anthropic.obtain_oauth_bearer_token( client_id: 'optional - Claude Code public client id', scope: 'optional - space-delimited scopes', redirect_uri: 'optional - must match registered callback', authorize_uri:'optional - claude.ai authorize endpoint', token_uri: 'optional - platform.claude.com token endpoint' )

Runs the OAuth 2.0 Authorization Code + PKCE (S256) flow against Anthropic's public Claude Code client. The hosted redirect returns a pasteable code (code=true) so this works over SSH with no localhost listener -- same UX class as the Grok device flow.



238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
 
# File 'lib/pwn/ai/anthropic.rb', line 238

public_class_method def self.obtain_oauth_bearer_token(opts = {})
  client_id     = real_config_value?(value: opts[:client_id])     ? opts[:client_id]     : ANTHROPIC_OAUTH_CLIENT_ID
  scope         = real_config_value?(value: opts[:scope])         ? opts[:scope]         : ANTHROPIC_OAUTH_SCOPE
  redirect_uri  = real_config_value?(value: opts[:redirect_uri])  ? opts[:redirect_uri]  : ANTHROPIC_OAUTH_REDIRECT_URI
  authorize_uri = real_config_value?(value: opts[:authorize_uri]) ? opts[:authorize_uri] : ANTHROPIC_OAUTH_AUTHORIZE_URI
  token_uri     = real_config_value?(value: opts[:token_uri])     ? opts[:token_uri]     : ANTHROPIC_OAUTH_TOKEN_URI

  pkce = pkce_pair
  params = {
    'code' => 'true',
    'response_type' => 'code',
    'client_id' => client_id,
    'redirect_uri' => redirect_uri,
    'scope' => scope,
    'code_challenge' => pkce[:challenge],
    'code_challenge_method' => 'S256',
    'state' => pkce[:verifier]
  }
  auth_url = "#{authorize_uri}?#{URI.encode_www_form(params)}"

  puts "\n[*] Anthropic / Claude OAuth -- Authorization Code + PKCE (S256, public client, no secret)"
  puts '    A Claude Pro / Max subscription on the approving account is required for inference scope.'
  puts ''
  puts '    Step 1: In a browser (any device), open:'
  puts "            #{auth_url}"
  puts '    Step 2: Approve access for Claude Code / CLI.'
  puts '    Step 3: Copy the authorization code shown after redirect and paste it below.'
  puts ''
  print '    Authorization code> '
  raw = $stdin.gets
  raise 'Anthropic OAuth enrollment aborted: no code provided.' if raw.nil?

  # Hosted callback sometimes returns "code#state" — take the code segment only.
  code = raw.to_s.strip.split('#', 2).first
  raise 'Anthropic OAuth enrollment aborted: empty code.' if code.empty?

  resp = RestClient.post(
    token_uri,
    {
      grant_type: 'authorization_code',
      code: code,
      code_verifier: pkce[:verifier],
      client_id: client_id,
      redirect_uri: redirect_uri,
      state: pkce[:verifier]
    },
    content_type: 'application/x-www-form-urlencoded',
    accept: 'application/json',
    user_agent: ANTHROPIC_OAUTH_USER_AGENT
  )
  data = JSON.parse(resp.body)
  raise "Anthropic OAuth token error: #{data['error']} - #{data['error_description'] || data['message']}" if data['error']

  access_token  = data['access_token']
  refresh_token = data['refresh_token']
  raise 'Anthropic OAuth token endpoint returned no access_token.' unless access_token

  opts[:bearer_token]  = access_token
  opts[:refresh_token] = refresh_token if refresh_token
  opts[:expires_at]    = Time.now.to_i + data['expires_in'].to_i if data['expires_in']

  puts "\n[*] SUCCESS: Anthropic OAuth bearer obtained via authorization_code + PKCE."
  puts '    Cached in-memory for this pwn / pwn-ai process.'
  puts ''
  puts '    TO MAKE THIS PERMANENT (recommended -- one-time), store via pwn-vault:'
  puts "      ai.anthropic.oauth.refresh_token = #{refresh_token}" if refresh_token
  puts "      ai.anthropic.oauth.bearer_token  = #{access_token}"
  puts '    On future runs the refresh_token alone is enough -- PWN::AI::Anthropic will'
  puts '    silently exchange it for a fresh access_token (no browser, no prompt).'
  puts ''

  access_token
rescue RestClient::ExceptionWithResponse => e
  raise "Failed to obtain Anthropic OAuth bearer token (HTTP #{e.http_code}): #{e.response&.body}"
rescue StandardError => e
  raise "Failed to obtain Anthropic OAuth bearer token: #{e.message}"
end

.refresh_oauth_bearer_token(opts = {}) ⇒ Object

Supported Method Parameters

access_token = PWN::AI::Anthropic.refresh_oauth_bearer_token( refresh_token: 'required - Anthropic OAuth refresh_token', client_id: 'optional - defaults to Claude Code public client', token_uri: 'optional - defaults to platform.claude.com token endpoint' ) On success, writes :bearer_token (and a rotated :refresh_token if returned) back into the passed opts/oauth Hash so the live PWN::Env stays warm for the rest of the process. Also mirrors those values onto PWN::Env[:anthropic][:oauth] when that Hash is available, then attempts to re-encrypt the updated tokens into ~/.pwn/pwn.yaml when the matching decryptor (key + iv) is present.



103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
 
# File 'lib/pwn/ai/anthropic.rb', line 103

public_class_method def self.refresh_oauth_bearer_token(opts = {})
  refresh_token = opts[:refresh_token]
  raise 'refresh_token is required' unless real_config_value?(value: refresh_token)

  client_id = real_config_value?(value: opts[:client_id]) ? opts[:client_id] : ANTHROPIC_OAUTH_CLIENT_ID
  token_uri = real_config_value?(value: opts[:token_uri]) ? opts[:token_uri] : ANTHROPIC_OAUTH_TOKEN_URI

  resp = RestClient.post(
    token_uri,
    {
      grant_type: 'refresh_token',
      refresh_token: refresh_token,
      client_id: client_id
    },
    content_type: 'application/x-www-form-urlencoded',
    accept: 'application/json',
    user_agent: ANTHROPIC_OAUTH_USER_AGENT
  )
  data = JSON.parse(resp.body)
  raise "Anthropic OAuth refresh error: #{data['error']} - #{data['error_description'] || data['message']}" if data['error']

  opts[:bearer_token]  = data['access_token']
  opts[:refresh_token] = data['refresh_token'] if data['refresh_token']
  opts[:expires_at]    = Time.now.to_i + data['expires_in'].to_i if data['expires_in']

  # Always keep the live session Env warm, even when +opts+ is a copy
  # rather than the object identity of PWN::Env[:ai][:anthropic][:oauth].
  sync_oauth_into_env(oauth: opts)
  persist_oauth_to_vault(oauth: opts)

  data['access_token']
rescue RestClient::ExceptionWithResponse => e
  raise "Anthropic OAuth refresh failed (HTTP #{e.http_code}): #{e.response&.body}"
end