@cortexkit/anthropic-auth-core 1.7.0 → 1.8.0

package/dist/accounts.d.ts

@@ -1,22 +1,35 @@
 import { type Cache1hMode } from './constants.ts';
 export declare const ACCOUNT_FILE_NAME = "anthropic-auth.json";
+export declare const ACCOUNT_STATE_FILE_NAME = "anthropic-auth-state.json";
 export declare const QUOTA_URL = "https://api.anthropic.com/api/oauth/usage";
 export type QuotaWindowName = 'five_hour' | 'seven_day';
-export type OAuthAccount = {
+export type AccountBase = {
     id: string;
     label?: string;
+    enabled?: boolean;
+    addedAt?: number;
+    lastUsed?: number;
+};
+export type OAuthAccount = AccountBase & {
     type: 'oauth';
     access?: string;
     refresh: string;
     expires?: number;
-    enabled?: boolean;
-    addedAt?: number;
-    lastUsed?: number;
     lastRefreshedAt?: number;
     lastRefreshError?: AccountOperationError;
     lastQuotaRefreshError?: AccountOperationError;
     quota?: Partial<Record<QuotaWindowName, AccountQuotaWindow>>;
 };
+export type ApiKeyAccount = AccountBase & {
+    type: 'api';
+    apiKey?: string;
+    baseURL: string;
+    authHeader?: 'authorization-bearer' | 'x-api-key';
+};
+export type FallbackAccount = OAuthAccount | ApiKeyAccount;
+export declare function isOAuthAccount(account: FallbackAccount): account is OAuthAccount;
+export declare function isApiKeyAccount(account: FallbackAccount): account is ApiKeyAccount;
+export declare function isValidApiBaseURL(value: string | undefined): boolean;
 export type AccountOperationError = {
     message: string;
     checkedAt: number;
@@ -94,7 +107,27 @@ export type AccountStorage = {
         transport?: 'http' | 'websocket';
     };
     killswitch?: KillswitchConfig;
-    accounts: OAuthAccount[];
+    accounts: FallbackAccount[];
+};
+export type AccountRuntimeEntry = Partial<Pick<OAuthAccount, 'access' | 'refresh' | 'expires' | 'lastUsed' | 'lastRefreshedAt' | 'lastRefreshError' | 'lastQuotaRefreshError' | 'quota'> & Pick<ApiKeyAccount, 'apiKey' | 'lastUsed'>>;
+export type AccountRuntimeState = {
+    version: 1;
+    main?: {
+        quota?: OAuthQuotaSnapshot;
+        quotaCheckedAt?: number;
+        quotaToken?: string;
+        lastQuotaApiError?: AccountOperationError;
+        lastRefreshError?: AccountOperationError;
+        refreshLeaseId?: string;
+        refreshLeaseUntil?: number;
+        refreshLeaseTokenHash?: string;
+    };
+    accounts?: Record<string, AccountRuntimeEntry>;
+};
+export type AccountStateSaveScope = {
+    mainQuota?: boolean;
+    mainRefresh?: boolean;
+    accounts?: true | string[];
 };
 export type OAuthQuotaSnapshot = Partial<Record<QuotaWindowName, AccountQuotaWindow>>;
 export type AccountManagerOptions = {
@@ -109,8 +142,10 @@ export type AccountRefreshError = {
     message: string;
 };
 export declare function getAccountStoragePath(): string;
+export declare function getAccountStatePath(configPath?: string): string;
 export declare function loadAccounts(path?: string): Promise<AccountStorage | null>;
 export declare function saveAccounts(storage: AccountStorage, path?: string): Promise<void>;
+export declare function saveAccountState(storage: AccountStorage, path?: string, scope?: AccountStateSaveScope): Promise<void>;
 export declare function acquireRefreshFileLock(options: {
     name: string;
     ttlMs: number;
@@ -202,11 +237,11 @@ export declare class FallbackAccountManager {
      */
     private seedFallbackQuota;
     load(): Promise<AccountStorage | null>;
-    save(storage: AccountStorage): Promise<void>;
+    save(storage: AccountStorage, accountIds?: string[]): Promise<void>;
     startBackgroundRefresh(): void;
     stopBackgroundRefresh(): void;
     getUsableFallbackAccounts(existingStorage?: AccountStorage | null): Promise<OAuthAccount[]>;
-    markUsed(account: OAuthAccount): Promise<void>;
+    markUsed(account: FallbackAccount): Promise<void>;
     accountPassesQuotaPolicy(account: OAuthAccount, storage: AccountStorage | null): boolean;
     /**
      * Return the account with its quota overlaid from the unified QuotaManager

package/dist/accounts.js

@@ -8,7 +8,28 @@ import { log } from "./logger.js";
 const setRefreshLockRenewalTimeout = globalThis.setTimeout.bind(globalThis);
 const clearRefreshLockRenewalTimeout = globalThis.clearTimeout.bind(globalThis);
 export const ACCOUNT_FILE_NAME = 'anthropic-auth.json';
+export const ACCOUNT_STATE_FILE_NAME = 'anthropic-auth-state.json';
 export const QUOTA_URL = 'https://api.anthropic.com/api/oauth/usage';
+export function isOAuthAccount(account) {
+    return account.type === 'oauth';
+}
+export function isApiKeyAccount(account) {
+    return account.type === 'api';
+}
+export function isValidApiBaseURL(value) {
+    const raw = value?.trim();
+    if (!raw)
+        return false;
+    try {
+        const url = new URL(raw);
+        return ((url.protocol === 'http:' || url.protocol === 'https:') &&
+            !url.username &&
+            !url.password);
+    }
+    catch {
+        return false;
+    }
+}
 const DEFAULT_FALLBACK_ON = [401, 403, 429];
 const MIN_REFRESH_BEFORE_EXPIRY_MINUTES = 240;
 const DEFAULT_REFRESH_BEFORE_EXPIRY_MINUTES = MIN_REFRESH_BEFORE_EXPIRY_MINUTES;
@@ -40,28 +61,55 @@ export function getAccountStoragePath() {
     return (process.env.OPENCODE_ANTHROPIC_AUTH_FILE?.trim() ||
         join(getConfigDir(), ACCOUNT_FILE_NAME));
 }
+export function getAccountStatePath(configPath = getAccountStoragePath()) {
+    const explicit = process.env.OPENCODE_ANTHROPIC_AUTH_STATE_FILE?.trim();
+    if (explicit)
+        return explicit;
+    return configPath.endsWith(ACCOUNT_FILE_NAME)
+        ? join(dirname(configPath), ACCOUNT_STATE_FILE_NAME)
+        : `${configPath}.state.json`;
+}
 function isRecord(value) {
     return value != null && typeof value === 'object' && !Array.isArray(value);
 }
+function normalizeAccountBase(value) {
+    return {
+        id: typeof value.id === 'string' && value.id.trim()
+            ? value.id.trim()
+            : randomUUID(),
+        label: typeof value.label === 'string' ? value.label : undefined,
+        enabled: typeof value.enabled === 'boolean' ? value.enabled : undefined,
+        addedAt: typeof value.addedAt === 'number' ? value.addedAt : undefined,
+        lastUsed: typeof value.lastUsed === 'number' ? value.lastUsed : undefined,
+    };
+}
 function normalizeAccount(value) {
     if (!isRecord(value))
         return null;
+    if (value.type === 'api') {
+        const baseURL = typeof value.baseURL === 'string' ? value.baseURL.trim() : '';
+        const apiKey = typeof value.apiKey === 'string' ? value.apiKey.trim() : '';
+        if (!isValidApiBaseURL(baseURL))
+            return null;
+        const authHeader = value.authHeader === 'x-api-key' ? 'x-api-key' : 'authorization-bearer';
+        return {
+            ...normalizeAccountBase(value),
+            type: 'api',
+            apiKey: apiKey || undefined,
+            baseURL,
+            authHeader,
+        };
+    }
     if (value.type !== 'oauth')
         return null;
     if (typeof value.refresh !== 'string' || !value.refresh.trim())
         return null;
     return {
-        id: typeof value.id === 'string' && value.id.trim()
-            ? value.id.trim()
-            : randomUUID(),
-        label: typeof value.label === 'string' ? value.label : undefined,
+        ...normalizeAccountBase(value),
         type: 'oauth',
         access: typeof value.access === 'string' ? value.access : undefined,
         refresh: value.refresh,
         expires: typeof value.expires === 'number' ? value.expires : undefined,
-        enabled: typeof value.enabled === 'boolean' ? value.enabled : undefined,
-        addedAt: typeof value.addedAt === 'number' ? value.addedAt : undefined,
-        lastUsed: typeof value.lastUsed === 'number' ? value.lastUsed : undefined,
         lastRefreshedAt: typeof value.lastRefreshedAt === 'number'
             ? value.lastRefreshedAt
             : undefined,
@@ -136,41 +184,226 @@ function normalizeStorage(value) {
             .filter((account) => account != null),
     };
 }
-export async function loadAccounts(path = getAccountStoragePath()) {
+async function readJsonIfPresent(path) {
     try {
-        const raw = await readFile(path, 'utf8');
-        return normalizeStorage(JSON.parse(raw));
+        return { exists: true, value: JSON.parse(await readFile(path, 'utf8')) };
     }
     catch (error) {
-        if (error.code === 'ENOENT')
-            return null;
-        return null;
+        if (error.code === 'ENOENT') {
+            return { exists: false, value: null };
+        }
+        return { exists: false, value: null };
     }
 }
+function objectWithDefinedEntries(value) {
+    return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined));
+}
+function mergeConfigAndState(configValue, stateValue) {
+    if (!isRecord(configValue))
+        return configValue;
+    const state = isRecord(stateValue) ? stateValue : {};
+    const mainState = isRecord(state.main) ? state.main : undefined;
+    const stateAccounts = isRecord(state.accounts) ? state.accounts : {};
+    const quotaConfig = isRecord(configValue.quota) ? configValue.quota : {};
+    const refreshConfig = isRecord(configValue.refresh) ? configValue.refresh : {};
+    const mainQuotaSource = mainState ?? quotaConfig;
+    const mainRefreshSource = mainState ?? refreshConfig;
+    const accounts = Array.isArray(configValue.accounts)
+        ? configValue.accounts.map((account) => {
+            if (!isRecord(account))
+                return account;
+            const stateAccount = typeof account.id === 'string' && isRecord(stateAccounts[account.id])
+                ? stateAccounts[account.id]
+                : {};
+            return { ...account, ...stateAccount };
+        })
+        : [];
+    return {
+        ...configValue,
+        refresh: objectWithDefinedEntries({
+            ...refreshConfig,
+            mainLastRefreshError: mainRefreshSource.lastRefreshError,
+            mainRefreshLeaseId: mainRefreshSource.refreshLeaseId,
+            mainRefreshLeaseUntil: mainRefreshSource.refreshLeaseUntil,
+            mainRefreshLeaseTokenHash: mainRefreshSource.refreshLeaseTokenHash,
+        }),
+        quota: objectWithDefinedEntries({
+            ...quotaConfig,
+            mainQuota: mainQuotaSource.quota,
+            mainQuotaCheckedAt: mainQuotaSource.quotaCheckedAt,
+            mainQuotaToken: mainQuotaSource.quotaToken,
+            mainLastQuotaApiError: mainQuotaSource.lastQuotaApiError,
+        }),
+        accounts,
+    };
+}
+export async function loadAccounts(path = getAccountStoragePath()) {
+    const config = await readJsonIfPresent(path);
+    if (!config.exists)
+        return null;
+    const state = await readJsonIfPresent(getAccountStatePath(path));
+    return normalizeStorage(mergeConfigAndState(config.value, state.value));
+}
 async function loadExistingTopLevelFields(path) {
-    try {
-        const raw = await readFile(path, 'utf8');
-        const parsed = JSON.parse(raw);
-        return isRecord(parsed) ? parsed : {};
-    }
-    catch {
-        return {};
-    }
+    const existing = await readJsonIfPresent(path);
+    return isRecord(existing.value) ? existing.value : {};
 }
 function omitUndefinedTopLevel(value) {
     return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined));
 }
-export async function saveAccounts(storage, path = getAccountStoragePath()) {
+function accountConfig(account) {
+    return objectWithDefinedEntries({
+        id: account.id,
+        label: account.label,
+        type: account.type,
+        enabled: account.enabled,
+        addedAt: account.addedAt,
+        baseURL: account.type === 'api' ? account.baseURL : undefined,
+        authHeader: account.type === 'api' ? account.authHeader : undefined,
+    });
+}
+function accountRuntimeState(account) {
+    if (account.type === 'api') {
+        return objectWithDefinedEntries({
+            apiKey: account.apiKey,
+            lastUsed: account.lastUsed,
+        });
+    }
+    return objectWithDefinedEntries({
+        access: account.access,
+        refresh: account.refresh,
+        expires: account.expires,
+        lastUsed: account.lastUsed,
+        lastRefreshedAt: account.lastRefreshedAt,
+        lastRefreshError: account.lastRefreshError,
+        lastQuotaRefreshError: account.lastQuotaRefreshError,
+        quota: account.quota,
+    });
+}
+function configFromStorage(storage) {
+    const refresh = storage.refresh
+        ? objectWithDefinedEntries({
+            enabled: storage.refresh.enabled,
+            intervalMinutes: storage.refresh.intervalMinutes,
+            refreshBeforeExpiryMinutes: storage.refresh.refreshBeforeExpiryMinutes,
+        })
+        : undefined;
+    const quota = storage.quota
+        ? objectWithDefinedEntries({
+            enabled: storage.quota.enabled,
+            checkIntervalMinutes: storage.quota.checkIntervalMinutes,
+            refreshEveryNRequests: storage.quota.refreshEveryNRequests,
+            minimumRemaining: storage.quota.minimumRemaining,
+            failClosedOnUnknownQuota: storage.quota.failClosedOnUnknownQuota,
+            showToasts: storage.quota.showToasts,
+        })
+        : undefined;
+    return omitUndefinedTopLevel({
+        version: 1,
+        main: storage.main,
+        routing: storage.routing,
+        fallbackOn: storage.fallbackOn,
+        refresh,
+        quota,
+        claudeCache: storage.claudeCache,
+        dump: storage.dump,
+        claudeFast: storage.claudeFast,
+        cacheKeep: storage.cacheKeep,
+        relay: storage.relay,
+        killswitch: storage.killswitch,
+        accounts: storage.accounts.map(accountConfig),
+    });
+}
+function stateFromStorage(storage) {
+    const accounts = Object.fromEntries(storage.accounts.map((account) => [
+        account.id,
+        accountRuntimeState(account),
+    ]));
+    return {
+        version: 1,
+        main: objectWithDefinedEntries({
+            quota: storage.quota?.mainQuota,
+            quotaCheckedAt: storage.quota?.mainQuotaCheckedAt,
+            quotaToken: storage.quota?.mainQuotaToken,
+            lastQuotaApiError: storage.quota?.mainLastQuotaApiError,
+            lastRefreshError: storage.refresh?.mainLastRefreshError,
+            refreshLeaseId: storage.refresh?.mainRefreshLeaseId,
+            refreshLeaseUntil: storage.refresh?.mainRefreshLeaseUntil,
+            refreshLeaseTokenHash: storage.refresh?.mainRefreshLeaseTokenHash,
+        }),
+        accounts,
+    };
+}
+async function writeJsonAtomic(path, value) {
     await mkdir(dirname(path), { recursive: true });
-    const existing = await loadExistingTopLevelFields(path);
-    const next = { ...existing, ...omitUndefinedTopLevel(storage) };
     const tempPath = `${path}.${randomUUID()}.tmp`;
-    await writeFile(tempPath, `${JSON.stringify(next, null, 2)}\n`, {
+    await writeFile(tempPath, `${JSON.stringify(value, null, 2)}\n`, {
         encoding: 'utf8',
         mode: 0o600,
     });
     await rename(tempPath, path);
 }
+export async function saveAccounts(storage, path = getAccountStoragePath()) {
+    const existing = await loadExistingTopLevelFields(path);
+    const nextConfig = { ...existing, ...configFromStorage(storage) };
+    await writeJsonAtomic(path, nextConfig);
+    await writeJsonAtomic(getAccountStatePath(path), stateFromStorage(storage));
+}
+function applyMainQuotaStatePatch(state, storage) {
+    state.main = state.main ?? {};
+    state.main.quota = storage.quota?.mainQuota;
+    state.main.quotaCheckedAt = storage.quota?.mainQuotaCheckedAt;
+    state.main.quotaToken = storage.quota?.mainQuotaToken;
+    state.main.lastQuotaApiError = storage.quota?.mainLastQuotaApiError;
+}
+function applyMainRefreshStatePatch(state, storage) {
+    state.main = state.main ?? {};
+    state.main.lastRefreshError = storage.refresh?.mainLastRefreshError;
+    state.main.refreshLeaseId = storage.refresh?.mainRefreshLeaseId;
+    state.main.refreshLeaseUntil = storage.refresh?.mainRefreshLeaseUntil;
+    state.main.refreshLeaseTokenHash = storage.refresh?.mainRefreshLeaseTokenHash;
+}
+function pruneUndefined(value) {
+    if (Array.isArray(value))
+        return value.map(pruneUndefined);
+    if (!isRecord(value))
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .filter(([, entry]) => entry !== undefined)
+        .map(([key, entry]) => [key, pruneUndefined(entry)]));
+}
+export async function saveAccountState(storage, path = getAccountStoragePath(), scope = {
+    mainQuota: true,
+    mainRefresh: true,
+    accounts: true,
+}) {
+    const statePath = getAccountStatePath(path);
+    const existing = (await readJsonIfPresent(statePath)).value;
+    const next = isRecord(existing)
+        ? { ...existing, version: 1 }
+        : { version: 1 };
+    if (scope.mainQuota)
+        applyMainQuotaStatePatch(next, storage);
+    if (scope.mainRefresh)
+        applyMainRefreshStatePatch(next, storage);
+    if (scope.accounts) {
+        const ids = scope.accounts === true ? null : new Set(scope.accounts);
+        next.accounts = { ...(isRecord(next.accounts) ? next.accounts : {}) };
+        for (const account of storage.accounts) {
+            if (ids && !ids.has(account.id))
+                continue;
+            next.accounts[account.id] = accountRuntimeState(account);
+        }
+        if (ids) {
+            for (const id of ids) {
+                if (!storage.accounts.some((account) => account.id === id)) {
+                    delete next.accounts[id];
+                }
+            }
+        }
+    }
+    await writeJsonAtomic(statePath, pruneUndefined(next));
+}
 export async function acquireRefreshFileLock(options) {
     const accountPath = options.path ?? getAccountStoragePath();
     const lockPath = `${accountPath}.${options.name}.lock`;
@@ -786,8 +1019,10 @@ export class FallbackAccountManager {
     async load() {
         return loadAccounts(this.configPath);
     }
-    async save(storage) {
-        await saveAccounts(storage, this.configPath);
+    async save(storage, accountIds) {
+        await saveAccountState(storage, this.configPath, {
+            accounts: accountIds ?? true,
+        });
     }
     startBackgroundRefresh() {
         const run = async () => {
@@ -818,7 +1053,7 @@ export class FallbackAccountManager {
         const usable = [];
         let changed = false;
         for (const account of storage.accounts) {
-            if (account.enabled === false)
+            if (account.enabled === false || !isOAuthAccount(account))
                 continue;
             try {
                 let next = account;
@@ -898,7 +1133,7 @@ export class FallbackAccountManager {
             return;
         let changed = false;
         for (const account of storage.accounts) {
-            if (account.enabled === false)
+            if (account.enabled === false || !isOAuthAccount(account))
                 continue;
             if (!tokenNeedsRefresh(account, storage, this.now()))
                 continue;
@@ -940,7 +1175,7 @@ export class FallbackAccountManager {
             return;
         let changed = false;
         for (const account of storage.accounts) {
-            if (account.enabled === false)
+            if (account.enabled === false || !isOAuthAccount(account))
                 continue;
             let next = account;
             try {
@@ -985,7 +1220,7 @@ export class FallbackAccountManager {
         const force = options.force ?? false;
         let changed = false;
         for (const account of storage.accounts) {
-            if (account.enabled === false)
+            if (account.enabled === false || !isOAuthAccount(account))
                 continue;
             let next = account;
             try {
@@ -1046,7 +1281,7 @@ export class FallbackAccountManager {
         while (Date.now() < deadline) {
             await new Promise((resolve) => setTimeout(resolve, FALLBACK_REFRESH_JOIN_POLL_MS));
             const latestStorage = await this.load();
-            const latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id);
+            const latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id && isOAuthAccount(candidate));
             if (!latestAccount)
                 continue;
             const changed = latestAccount.access !== previous.access ||
@@ -1075,7 +1310,7 @@ export class FallbackAccountManager {
     }
     async refreshAccountNow(account, storage, options) {
         let latestStorage = await this.load();
-        let latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id);
+        let latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id && isOAuthAccount(candidate));
         if (latestAccount &&
             !options.force &&
             !tokenNeedsRefresh(latestAccount, latestStorage, this.now())) {
@@ -1101,7 +1336,7 @@ export class FallbackAccountManager {
         }
         try {
             latestStorage = await this.load();
-            latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id);
+            latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id && isOAuthAccount(candidate));
             if (latestAccount &&
                 !options.force &&
                 !tokenNeedsRefresh(latestAccount, latestStorage, this.now())) {

package/dist/cachekeep.d.ts

@@ -4,6 +4,9 @@ export declare const CACHE_KEEP_TTL_MS: number;
 export declare const CACHE_KEEP_PREWARM_LEAD_MS: number;
 export declare const CACHE_KEEP_TICK_MS = 60000;
 export declare const CACHE_KEEP_EXTENDED_TTL_BETA = "extended-cache-ttl-2025-04-11";
+export declare const CACHE_KEEP_MAX_TARGETS = 32;
+export declare const CACHE_KEEP_MAX_BODY_BYTES: number;
+export declare const CACHE_KEEP_STALE_TARGET_MS: number;
 export type CacheKeepWindow = {
     startHour: number;
     endHour: number;
@@ -74,6 +77,9 @@ export declare class CacheKeepManager {
         nextPrewarmAt: number | undefined;
     };
     trackedCount(): number;
+    private totalBodyBytes;
+    private evictOldestTarget;
+    private pruneTargets;
     track(input: {
         sessionId?: string | null;
         url: string;

package/dist/cachekeep.js

@@ -5,6 +5,9 @@ export const CACHE_KEEP_TTL_MS = 60 * 60_000;
 export const CACHE_KEEP_PREWARM_LEAD_MS = 5 * 60_000;
 export const CACHE_KEEP_TICK_MS = 60_000;
 export const CACHE_KEEP_EXTENDED_TTL_BETA = 'extended-cache-ttl-2025-04-11';
+export const CACHE_KEEP_MAX_TARGETS = 32;
+export const CACHE_KEEP_MAX_BODY_BYTES = 16 * 1024 * 1024;
+export const CACHE_KEEP_STALE_TARGET_MS = 2 * CACHE_KEEP_TTL_MS;
 const STATUS_TITLE = '## Claude Cache Keep Status';
 const ENABLED_TITLE = '## Claude Cache Keep Enabled';
 const DISABLED_TITLE = '## Claude Cache Keep Disabled';
@@ -208,6 +211,33 @@ export class CacheKeepManager {
     trackedCount() {
         return this.targets.size;
     }
+    totalBodyBytes() {
+        return [...this.targets.values()].reduce((sum, target) => sum + target.bodyText.length, 0);
+    }
+    evictOldestTarget() {
+        const oldest = this.targets.keys().next().value;
+        if (oldest !== undefined)
+            this.targets.delete(oldest);
+    }
+    pruneTargets(now, today) {
+        for (const [id, target] of this.targets) {
+            if (today && target.dayKey !== today) {
+                this.targets.delete(id);
+                continue;
+            }
+            if (now - target.cacheExpiresAt > CACHE_KEEP_STALE_TARGET_MS) {
+                this.targets.delete(id);
+            }
+        }
+        while (this.targets.size > CACHE_KEEP_MAX_TARGETS)
+            this.evictOldestTarget();
+        while (this.totalBodyBytes() > CACHE_KEEP_MAX_BODY_BYTES) {
+            const before = this.targets.size;
+            this.evictOldestTarget();
+            if (this.targets.size === before)
+                break;
+        }
+    }
     track(input) {
         if (!input.sessionId)
             return { tracked: false, reason: 'missing session id' };
@@ -217,11 +247,18 @@ export class CacheKeepManager {
         if (input.cacheMode !== 'hybrid') {
             return { tracked: false, reason: 'cache mode is not hybrid' };
         }
+        if (input.bodyText.length > CACHE_KEEP_MAX_BODY_BYTES) {
+            return { tracked: false, reason: 'body exceeds cachekeep memory budget' };
+        }
         const now = this.options.now?.() ?? Date.now();
         const window = getCacheKeepWindow(input.storage);
         if (!isWithinCacheKeepWindow(window, new Date(now))) {
             return { tracked: false, reason: 'outside configured window' };
         }
+        const today = localWindowKey(window, new Date(now));
+        this.pruneTargets(now, today);
+        if (this.targets.has(input.sessionId))
+            this.targets.delete(input.sessionId);
         const headers = {};
         input.headers.forEach((value, key) => {
             headers[key] = value;
@@ -232,8 +269,9 @@ export class CacheKeepManager {
             headers,
             bodyText: input.bodyText,
             cacheExpiresAt: now + CACHE_KEEP_TTL_MS,
-            dayKey: localWindowKey(window, new Date(now)),
+            dayKey: today,
         });
+        this.pruneTargets(now, today);
         this.start();
         return { tracked: true };
     }
@@ -242,10 +280,7 @@ export class CacheKeepManager {
         const window = getCacheKeepWindow(storage);
         const now = this.options.now?.() ?? Date.now();
         const today = localWindowKey(window, new Date(now));
-        for (const [id, target] of this.targets) {
-            if (target.dayKey !== today)
-                this.targets.delete(id);
-        }
+        this.pruneTargets(now, today);
         if (!this.targets.size) {
             this.stop();
             return;

package/dist/claude-code.js

@@ -22,7 +22,10 @@ export function getClaudeCodeIdentity(seed) {
     setBounded(identityCache, cacheKey, identity);
     return identity;
 }
+const BOOTSTRAP_IDENTITY_CACHE_TTL_MS = 24 * 60 * 60_000;
+const BOOTSTRAP_IDENTITY_NEGATIVE_TTL_MS = 5 * 60_000;
 const bootstrapFetches = new Map();
+const bootstrapResults = new Map();
 async function fetchClaudeCodeAccountUuid(accessToken, model) {
     if (!accessToken.startsWith('sk-ant-oat'))
         return null;
@@ -61,16 +64,35 @@ export async function resolveClaudeCodeIdentity(accessToken, model) {
     const identity = getClaudeCodeIdentity(accessToken);
     if (!accessToken.startsWith('sk-ant-oat'))
         return identity;
+    const now = Date.now();
+    const cachedResult = bootstrapResults.get(accessToken);
+    if (cachedResult && cachedResult.expiresAt > now) {
+        if (!cachedResult.accountUuid)
+            return identity;
+        const accountCacheKey = `account:${cachedResult.accountUuid}`;
+        const accountIdentity = identityCache.get(accountCacheKey);
+        if (accountIdentity) {
+            setBounded(identityCache, accessToken, accountIdentity);
+            return accountIdentity;
+        }
+    }
     let fetchPromise = bootstrapFetches.get(accessToken);
     if (!fetchPromise) {
         fetchPromise = fetchClaudeCodeAccountUuid(accessToken, model);
         bootstrapFetches.set(accessToken, fetchPromise);
     }
-    const accountUuid = await fetchPromise;
-    if (!accountUuid) {
+    const accountUuid = await fetchPromise.finally(() => {
         bootstrapFetches.delete(accessToken);
+    });
+    setBounded(bootstrapResults, accessToken, {
+        accountUuid,
+        expiresAt: now +
+            (accountUuid
+                ? BOOTSTRAP_IDENTITY_CACHE_TTL_MS
+                : BOOTSTRAP_IDENTITY_NEGATIVE_TTL_MS),
+    });
+    if (!accountUuid)
         return identity;
-    }
     const accountCacheKey = `account:${accountUuid}`;
     const accountIdentity = identityCache.get(accountCacheKey);
     if (accountIdentity) {

package/dist/index.d.ts

@@ -9,6 +9,7 @@ export * from './dump.ts';
 export * from './fast.ts';
 export * from './killswitch.ts';
 export * from './logger.ts';
+export * from './models.ts';
 export * from './pkce.ts';
 export * from './quota-manager.ts';
 export * from './quotas.ts';

package/dist/index.js

@@ -9,6 +9,7 @@ export * from "./dump.js";
 export * from "./fast.js";
 export * from "./killswitch.js";
 export * from "./logger.js";
+export * from "./models.js";
 export * from "./pkce.js";
 export * from "./quota-manager.js";
 export * from "./quotas.js";

package/dist/models.d.ts

@@ -0,0 +1,20 @@
+export declare const CLAUDE_FABLE_5_MODEL_ID = "claude-fable-5";
+export declare const CLAUDE_MYTHOS_5_MODEL_ID = "claude-mythos-5";
+export declare const CLAUDE_FABLE_MYTHOS_5_MODEL_IDS: readonly ["claude-fable-5", "claude-mythos-5"];
+export type ClaudeFableMythos5ModelId = (typeof CLAUDE_FABLE_MYTHOS_5_MODEL_IDS)[number];
+export declare const CLAUDE_FABLE_MYTHOS_5_PRICING: {
+    readonly input: 10;
+    readonly output: 50;
+    readonly cacheRead: 1;
+    readonly cacheWrite5m: 12.5;
+    readonly cacheWrite1h: 20;
+};
+export declare const CLAUDE_FABLE_MYTHOS_5_CONTEXT_WINDOW = 1000000;
+export declare const CLAUDE_FABLE_MYTHOS_5_MAX_OUTPUT_TOKENS = 128000;
+export declare const CLAUDE_FABLE_MYTHOS_5_RELEASE_DATE = "2026-06-09";
+export declare const CLAUDE_FABLE_MYTHOS_5_MODEL_SPECS: Record<ClaudeFableMythos5ModelId, {
+    id: ClaudeFableMythos5ModelId;
+    name: string;
+    limited?: boolean;
+}>;
+export declare function isClaudeFableOrMythos5Model(model: unknown): boolean;

package/dist/models.js

@@ -0,0 +1,31 @@
+export const CLAUDE_FABLE_5_MODEL_ID = 'claude-fable-5';
+export const CLAUDE_MYTHOS_5_MODEL_ID = 'claude-mythos-5';
+export const CLAUDE_FABLE_MYTHOS_5_MODEL_IDS = [
+    CLAUDE_FABLE_5_MODEL_ID,
+    CLAUDE_MYTHOS_5_MODEL_ID,
+];
+export const CLAUDE_FABLE_MYTHOS_5_PRICING = {
+    input: 10,
+    output: 50,
+    cacheRead: 1,
+    cacheWrite5m: 12.5,
+    cacheWrite1h: 20,
+};
+export const CLAUDE_FABLE_MYTHOS_5_CONTEXT_WINDOW = 1_000_000;
+export const CLAUDE_FABLE_MYTHOS_5_MAX_OUTPUT_TOKENS = 128_000;
+export const CLAUDE_FABLE_MYTHOS_5_RELEASE_DATE = '2026-06-09';
+export const CLAUDE_FABLE_MYTHOS_5_MODEL_SPECS = {
+    [CLAUDE_FABLE_5_MODEL_ID]: {
+        id: CLAUDE_FABLE_5_MODEL_ID,
+        name: 'Claude Fable 5',
+    },
+    [CLAUDE_MYTHOS_5_MODEL_ID]: {
+        id: CLAUDE_MYTHOS_5_MODEL_ID,
+        name: 'Claude Mythos 5',
+        limited: true,
+    },
+};
+export function isClaudeFableOrMythos5Model(model) {
+    return (typeof model === 'string' &&
+        CLAUDE_FABLE_MYTHOS_5_MODEL_IDS.some((id) => model === id || model.startsWith(`${id}-`)));
+}

package/dist/quota-manager.d.ts

@@ -94,6 +94,7 @@ export declare class QuotaManager {
     /** Minimum gap between consecutive quota API calls (ms). */
     private static readonly API_CALL_GAP_MS;
     private static fallbackInflightKey;
+    private static quotaLockName;
     /**
      * Serialize API calls through a shared gate so only one
      * quota API request runs at a time, with a minimum gap

package/dist/quota-manager.js

@@ -284,6 +284,10 @@ export class QuotaManager {
     static fallbackInflightKey(accountId, accessToken) {
         return JSON.stringify([accountId, tokenFingerprint(accessToken)]);
     }
+    static quotaLockName(accountId) {
+        const safeId = accountId.replace(/[^a-zA-Z0-9._-]+/g, '-');
+        return `opencode-fallback-quota-refresh-${safeId || 'account'}`;
+    }
     /**
      * Serialize API calls through a shared gate so only one
      * quota API request runs at a time, with a minimum gap
@@ -367,20 +371,35 @@ export class QuotaManager {
                         return cached.quota;
                     throw new Error('Quota API rate-limited — try again later');
                 }
-                const quota = await fetchOAuthQuotaSnapshot({
-                    accessToken,
-                    fetchImpl: this.fetchImpl,
-                    now: this.now,
+                const fileLock = await acquireRefreshFileLock({
+                    name: QuotaManager.quotaLockName(accountId),
+                    ttlMs: 30_000,
                 });
-                const now = this.now();
-                this.setFallback(accountId, {
-                    quota,
-                    refreshAfter: now + getQuotaCheckIntervalMs(this.storage),
-                    checkedAt: now,
-                }, accessToken);
-                this.fallbackApiErrors.delete(accountId);
-                this.fallbackErrorTokenFps.delete(accountId);
-                return quota;
+                if (!fileLock) {
+                    const cached = this.getFallback(accountId, accessToken);
+                    if (cached)
+                        return cached.quota;
+                    throw new Error('Quota refresh is already in progress');
+                }
+                try {
+                    const quota = await fetchOAuthQuotaSnapshot({
+                        accessToken,
+                        fetchImpl: this.fetchImpl,
+                        now: this.now,
+                    });
+                    const now = this.now();
+                    this.setFallback(accountId, {
+                        quota,
+                        refreshAfter: now + getQuotaCheckIntervalMs(this.storage),
+                        checkedAt: now,
+                    }, accessToken);
+                    this.fallbackApiErrors.delete(accountId);
+                    this.fallbackErrorTokenFps.delete(accountId);
+                    return quota;
+                }
+                finally {
+                    await fileLock.release();
+                }
             }
             catch (error) {
                 this._handleFallbackFetchError(accountId, accessToken, error);

package/dist/quotas.js

@@ -1,3 +1,4 @@
+import { isOAuthAccount } from "./accounts.js";
 export const CLAUDE_QUOTAS_COMMAND_NAME = 'claude-quota';
 const WINDOW_LABELS = {
     five_hour: '5h',
@@ -60,7 +61,7 @@ function accountStoredError(account) {
 export function buildFallbackQuotaSummaries(storage, errors = new Map()) {
     if (!storage?.accounts.length)
         return [];
-    return storage.accounts.map((account) => {
+    return storage.accounts.filter(isOAuthAccount).map((account) => {
         const error = errors.get(account.id) ?? accountStoredError(account);
         return {
             name: accountName(account),

package/dist/relay.js

@@ -21,6 +21,10 @@ class RelayWebSocketConnectionResetError extends Error {
 const sessionState = new Map();
 const websocketSessions = new Map();
 const loggedRelayConfigMessages = new Set();
+const RELAY_SESSION_STATE_TTL_MS = 2 * 60 * 60_000;
+const RELAY_WEBSOCKET_IDLE_TTL_MS = 30 * 60_000;
+const MAX_RELAY_SESSION_STATES = 128;
+const MAX_RELAY_WEBSOCKET_SESSIONS = 32;
 let nextRequestId = 0;
 function createRequestId() {
     nextRequestId += 1;
@@ -136,14 +140,23 @@ function jsonHeaders(headers) {
     }
     return result;
 }
-async function postRelay(config, payload) {
+async function postRelay(config, payload, signal) {
+    const stringifyStart = perfNowMs();
+    const body = JSON.stringify(payload);
+    relayPerfLog('http_payload_stringify', {
+        session: shortAffinity(payload.affinity),
+        ms: formatMs(perfNowMs() - stringifyStart),
+        relayBytes: body.length,
+        mode: payload.mode,
+    });
     return fetch(config.url, {
         method: 'POST',
         headers: {
             'content-type': 'application/json',
             'x-relay-token': config.token,
         },
-        body: JSON.stringify(payload),
+        body,
+        signal: signal ?? undefined,
     });
 }
 function shortAffinity(affinity) {
@@ -155,6 +168,14 @@ function perfNowMs() {
 function formatMs(value) {
     return Math.round(value * 10) / 10;
 }
+function relayPerfLoggingEnabled() {
+    return process.env.OPENCODE_ANTHROPIC_AUTH_PERF === '1';
+}
+function relayPerfLog(stage, data) {
+    if (!relayPerfLoggingEnabled())
+        return;
+    relayLog(`[perf] relay ${stage} ${JSON.stringify(data)}`);
+}
 function createRelayPayload(options) {
     const { input, init, headers, bodyText, affinity, previous, nextHash } = options;
     const rewrittenUrl = input instanceof Request ? input.url : input.toString();
@@ -197,21 +218,25 @@ function createFullSyncPayload(payload, bodyText) {
     };
 }
 function updateLocalRelayState(affinity, bodyText, nextHash, revision) {
+    const now = Date.now();
+    sessionState.delete(affinity);
     sessionState.set(affinity, {
         body: bodyText,
         hash: nextHash,
         revision,
+        updatedAt: now,
     });
+    cleanupRelaySessionCaches(now);
 }
 async function sendRelayHttp(options) {
-    const { config, payload, bodyText, fallback } = options;
+    const { config, payload, bodyText, fallback, signal } = options;
     let actualPayload = payload;
-    let response = await postRelay(config, actualPayload);
+    let response = await postRelay(config, actualPayload, signal);
     if (response.status === 409 && actualPayload.mode === 'patch') {
         relayLog(`state mismatch from relay session=${shortAffinity(actualPayload.affinity)}; retrying full_sync`);
         await response.body?.cancel().catch(() => { });
         actualPayload = createFullSyncPayload(actualPayload, bodyText);
-        response = await postRelay(config, actualPayload);
+        response = await postRelay(config, actualPayload, signal);
     }
     if (!response.ok && response.status >= 500 && config.fallbackToDirect) {
         relayLog(`relay returned ${response.status}; falling back direct session=${shortAffinity(actualPayload.affinity)}`);
@@ -279,11 +304,27 @@ class PersistentRelaySession {
     queue = Promise.resolve();
     pending;
     serverState;
+    lastUsedAt = Date.now();
     constructor(config, affinity) {
         this.config = config;
         this.affinity = affinity;
     }
+    touch(now = Date.now()) {
+        this.lastUsedAt = now;
+    }
+    canEvict(now = Date.now()) {
+        return (!this.pending &&
+            !this.connecting &&
+            now - this.lastUsedAt > RELAY_WEBSOCKET_IDLE_TTL_MS);
+    }
+    dispose() {
+        this.socket?.close();
+        this.socket = undefined;
+        this.serverState = undefined;
+        this.connecting = undefined;
+    }
     send(payload, bodyText, optimisticResponse = false) {
+        this.touch();
         const enqueuedAt = perfNowMs();
         const start = this.queue
             .catch(() => { })
@@ -638,12 +679,48 @@ class PersistentRelaySession {
         pending.rejectDone(error);
     }
 }
+function cleanupRelaySessionCaches(now = Date.now()) {
+    for (const [affinity, state] of sessionState) {
+        if (now - state.updatedAt > RELAY_SESSION_STATE_TTL_MS) {
+            sessionState.delete(affinity);
+        }
+    }
+    while (sessionState.size > MAX_RELAY_SESSION_STATES) {
+        const oldest = sessionState.keys().next().value;
+        if (oldest === undefined)
+            break;
+        sessionState.delete(oldest);
+    }
+    for (const [affinity, session] of websocketSessions) {
+        if (session.canEvict(now)) {
+            session.dispose();
+            websocketSessions.delete(affinity);
+        }
+    }
+    while (websocketSessions.size > MAX_RELAY_WEBSOCKET_SESSIONS) {
+        let evicted = false;
+        for (const [affinity, session] of websocketSessions) {
+            if (!session.canEvict(now))
+                continue;
+            session.dispose();
+            websocketSessions.delete(affinity);
+            evicted = true;
+            break;
+        }
+        if (!evicted)
+            break;
+    }
+}
 function getPersistentRelaySession(config, affinity) {
+    cleanupRelaySessionCaches();
     const existing = websocketSessions.get(affinity);
-    if (existing)
+    if (existing) {
+        existing.touch();
         return existing;
+    }
     const session = new PersistentRelaySession(config, affinity);
     websocketSessions.set(affinity, session);
+    cleanupRelaySessionCaches();
     return session;
 }
 export async function sendViaRelay(options) {
@@ -658,8 +735,15 @@ export async function sendViaRelay(options) {
         return fallback();
     }
     const bodyText = body;
+    const hashStart = perfNowMs();
     const nextHash = hashBody(bodyText);
+    relayPerfLog('hash_body', {
+        session: shortAffinity(affinity),
+        ms: formatMs(perfNowMs() - hashStart),
+        bodyBytes: bodyText.length,
+    });
     const previous = sessionState.get(affinity);
+    const payloadStart = perfNowMs();
     const payload = createRelayPayload({
         input,
         init,
@@ -669,8 +753,16 @@ export async function sendViaRelay(options) {
         previous,
         nextHash,
     });
+    relayPerfLog('create_payload', {
+        session: shortAffinity(affinity),
+        ms: formatMs(perfNowMs() - payloadStart),
+        mode: payload.mode,
+        bodyBytes: bodyText.length,
+        previousBytes: previous?.body.length,
+    });
     try {
         let result;
+        const sendStart = perfNowMs();
         if (config.transport === 'websocket') {
             try {
                 const session = getPersistentRelaySession(config, affinity);
@@ -678,19 +770,47 @@ export async function sendViaRelay(options) {
             }
             catch (error) {
                 relayLog(`websocket relay failed session=${shortAffinity(affinity)}; trying http relay: ${error instanceof Error ? error.message : String(error)}`);
-                result = await sendRelayHttp({ config, payload, bodyText, fallback });
+                result = await sendRelayHttp({
+                    config,
+                    payload,
+                    bodyText,
+                    fallback,
+                    signal: init?.signal,
+                });
             }
         }
         else {
-            result = await sendRelayHttp({ config, payload, bodyText, fallback });
+            result = await sendRelayHttp({
+                config,
+                payload,
+                bodyText,
+                fallback,
+                signal: init?.signal,
+            });
         }
+        relayPerfLog('send', {
+            session: shortAffinity(affinity),
+            ms: formatMs(perfNowMs() - sendStart),
+            transport: result.transport,
+            protocol: result.protocol,
+            mode: result.payload.mode,
+            status: result.response.status,
+            usedRelay: result.usedRelay,
+        });
         if (!result.usedRelay)
             return result.response;
         if (result.transport === 'http') {
             updateLocalRelayState(affinity, bodyText, result.payload.next_hash, result.payload.revision);
         }
+        const payloadStringifyStart = perfNowMs();
         const actualPayloadBytes = JSON.stringify(result.payload).length;
+        relayPerfLog('payload_stringify', {
+            session: shortAffinity(affinity),
+            ms: formatMs(perfNowMs() - payloadStringifyStart),
+            relayBytes: actualPayloadBytes,
+        });
         relayLog(`used relay transport=${result.transport} protocol=${result.protocol} mode=${result.payload.mode} status=${result.response.status} session=${shortAffinity(affinity)} bodyBytes=${bodyText.length} relayBytes=${actualPayloadBytes}`);
+        const dumpStart = perfNowMs();
         await dumpRelayRequest({
             affinity,
             transport: result.transport,
@@ -702,6 +822,11 @@ export async function sendViaRelay(options) {
             payload: result.payload,
             relayBytes: actualPayloadBytes,
         });
+        relayPerfLog('dump', {
+            session: shortAffinity(affinity),
+            ms: formatMs(perfNowMs() - dumpStart),
+            enabled: true,
+        });
         return result.response;
     }
     catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "type": "module",
   "repository": {
     "type": "git",