fix(ai): inject Claude Code identity for Anthropic OAuth model access

apps/desktop/src/main/ai/providers/factory.ts

@@ -38,6 +38,59 @@ function isOAuthToken(token: string | undefined): boolean {
   return token.startsWith('sk-ant-oa') || token.startsWith('sk-ant-ort');
 }
 
+// =============================================================================
+// Anthropic OAuth System Prompt Injection
+// =============================================================================
+
+/**
+ * The Claude Code identity string that Anthropic's API requires as the first
+ * system block for OAuth tokens to access Opus/Sonnet models.
+ * Must be a SEPARATE system block (not combined with other text).
+ */
+const CLAUDE_CODE_IDENTITY = "You are Claude Code, Anthropic's official CLI for Claude.";
+
+/**
+ * Creates a fetch interceptor that injects the Claude Code identity as a
+ * separate first system block in Anthropic API requests.
+ *
+ * Anthropic's API validates that OAuth tokens include this identity as an
+ * exact-match first system block to access Opus/Sonnet models.
+ * The identity must be a separate `{type: "text", text: "..."}` entry —
+ * combining it with other text in a single block is rejected.
+ */
+function createOAuthSystemPromptFetch(): typeof globalThis.fetch {
+  return async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+    if (init?.method?.toUpperCase() === 'POST' && init.body) {
+      try {
+        const body = JSON.parse(typeof init.body === 'string' ? init.body : new TextDecoder().decode(init.body as ArrayBuffer));
+
+        if (body.system && Array.isArray(body.system)) {
+          // Check if identity block already present
+          const hasIdentity = body.system.length > 0
+            && body.system[0]?.type === 'text'
+            && body.system[0]?.text === CLAUDE_CODE_IDENTITY;
+
+          if (!hasIdentity) {
+            body.system = [
+              { type: 'text', text: CLAUDE_CODE_IDENTITY },
+              ...body.system,
+            ];
+            init = { ...init, body: JSON.stringify(body) };
+          }
+        } else if (body.system === undefined && body.messages) {
+          // No system prompt at all — add identity block
+          body.system = [{ type: 'text', text: CLAUDE_CODE_IDENTITY }];
+          init = { ...init, body: JSON.stringify(body) };
+        }
+      } catch {
+        // JSON parse failed — pass through unchanged
+      }
+    }
+
+    return globalThis.fetch(input, init);
+  };
+}
+
 // =============================================================================
 // Provider Instance Creators
 // =============================================================================
@@ -53,6 +106,7 @@ function createProviderInstance(config: ProviderConfig) {
     case SupportedProvider.Anthropic: {
       // OAuth tokens use authToken (Authorization: Bearer) + required beta header
       // API keys use apiKey (x-api-key header)
+      // Custom fetch injects Claude Code identity system block for model access
       if (isOAuthToken(apiKey)) {
         return createAnthropic({
           authToken: apiKey,
@@ -61,6 +115,7 @@ function createProviderInstance(config: ProviderConfig) {
             ...headers,
             'anthropic-beta': 'claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14',
           },
+          fetch: createOAuthSystemPromptFetch(),
         });
       }
       return createAnthropic({

apps/desktop/src/main/claude-profile-manager.ts

@@ -105,6 +105,10 @@ export class ClaudeProfileManager {
     // This repairs emails that were truncated due to ANSI escape codes in terminal output
     this.migrateCorruptedEmails();
 
+    // Remove duplicate profiles sharing the same configDir
+    // Keeps the first (oldest/default) entry per configDir
+    this.deduplicateProfiles();
+
     // Populate missing subscription metadata for existing profiles
     // This reads subscriptionType and rateLimitTier from Keychain credentials
     this.populateSubscriptionMetadata();
@@ -147,6 +151,47 @@ export class ClaudeProfileManager {
     }
   }
 
+  /**
+   * Remove duplicate profiles that share the same configDir.
+   * Keeps the first entry per configDir (which is typically the oldest or the default).
+   * Remaps activeProfileId if the active profile was a duplicate that got removed.
+   */
+  private deduplicateProfiles(): void {
+    const seen = new Map<string, number>(); // configDir -> index of first occurrence
+    const duplicateIndices: number[] = [];
+    const removedIds: string[] = [];
+
+    for (let i = 0; i < this.data.profiles.length; i++) {
+      const configDir = this.data.profiles[i].configDir;
+      if (!configDir) continue;
+
+      if (seen.has(configDir)) {
+        duplicateIndices.push(i);
+        removedIds.push(this.data.profiles[i].id);
+      } else {
+        seen.set(configDir, i);
+      }
+    }
+
+    if (duplicateIndices.length === 0) return;
+
+    // Remap activeProfileId if it points to a duplicate being removed
+    if (this.data.activeProfileId && removedIds.includes(this.data.activeProfileId)) {
+      const activeConfigDir = this.data.profiles.find(p => p.id === this.data.activeProfileId)?.configDir;
+      if (activeConfigDir && seen.has(activeConfigDir)) {
+        this.data.activeProfileId = this.data.profiles[seen.get(activeConfigDir)!].id;
+      }
+    }
+
+    // Remove duplicates (iterate in reverse to preserve indices)
+    for (let i = duplicateIndices.length - 1; i >= 0; i--) {
+      this.data.profiles.splice(duplicateIndices[i], 1);
+    }
+
+    console.warn(`[ClaudeProfileManager] Deduplicated profiles: removed ${duplicateIndices.length} duplicates, ${this.data.profiles.length} remaining`);
+    this.save();
+  }
+
   /**
    * Populate missing subscription metadata (subscriptionType, rateLimitTier) for existing profiles.
    *
@@ -354,24 +399,55 @@ export class ClaudeProfileManager {
   }
 
   /**
-   * Save or update a profile
+   * Save or update a profile.
+   *
+   * Deduplication: If a profile with the same configDir already exists (but
+   * a different ID), we update the existing entry instead of creating a
+   * duplicate. This prevents the profile store from growing unboundedly
+   * when the UI generates new IDs for the same underlying account.
    */
   saveProfile(profile: ClaudeProfile): ClaudeProfile {
     // Expand ~ in configDir path
     if (profile.configDir) {
       profile.configDir = expandHomePath(profile.configDir);
     }
 
-    const index = this.data.profiles.findIndex(p => p.id === profile.id);
+    // First, try exact ID match (normal update path)
+    const indexById = this.data.profiles.findIndex(p => p.id === profile.id);
 
-    if (index >= 0) {
-      // Update existing
-      this.data.profiles[index] = profile;
-    } else {
-      // Add new
-      this.data.profiles.push(profile);
+    if (indexById >= 0) {
+      // Update existing profile by ID
+      this.data.profiles[indexById] = profile;
+      this.save();
+      return profile;
+    }
+
+    // No ID match — check for configDir duplicate before adding
+    if (profile.configDir) {
+      const indexByConfigDir = this.data.profiles.findIndex(
+        p => p.configDir === profile.configDir
+      );
+
+      if (indexByConfigDir >= 0) {
+        // Same configDir exists with a different ID — update the existing entry
+        // instead of creating a duplicate. Preserve the existing ID.
+        const existingId = this.data.profiles[indexByConfigDir].id;
+        const existingIsDefault = this.data.profiles[indexByConfigDir].isDefault;
+        debugLog('[ClaudeProfileManager] Dedup: profile with configDir already exists, updating instead of adding', {
+          existingId,
+          incomingId: profile.id,
+          configDir: profile.configDir,
+        });
+        profile.id = existingId;
+        profile.isDefault = existingIsDefault || profile.isDefault;
+        this.data.profiles[indexByConfigDir] = profile;
+        this.save();
+        return profile;
+      }
     }
 
+    // Genuinely new profile — add it
+    this.data.profiles.push(profile);
     this.save();
     return profile;
   }