@cortexkit/opencode-anthropic-auth 1.21.0 → 1.23.0

package/src/tui/command-dialogs.tsx

@@ -1,6 +1,10 @@
 /** @jsxImportSource @opentui/solid */
-import type { PrimeAccountStatus } from '@cortexkit/anthropic-auth-core'
+import {
+  custodyStatusLabel,
+  type PrimeAccountStatus,
+} from '@cortexkit/anthropic-auth-core'
 import type { TuiPluginApi } from '@opencode-ai/plugin/tui'
+import type { AccountDialogAccount } from '../rpc/protocol'
 import type { OpenDialogPayload } from '../rpc/protocol.js'
 import { formatPrimeCost, formatPrimeTime } from '../sidebar-state.js'
 
@@ -15,6 +19,27 @@ type KillswitchDialogConfig = {
   accounts?: Record<string, Record<string, number>>
 }
 
+type TuiAccountDialogAccount = Omit<
+  AccountDialogAccount,
+  'vaultReauth' | 'custodyState'
+> &
+  Partial<Pick<AccountDialogAccount, 'vaultReauth' | 'custodyState'>>
+
+type TuiAccountDialogPayload = {
+  accounts: TuiAccountDialogAccount[]
+  claustrumDetection: string
+  custodyMode?: TuiCustodyMode
+  enrollmentStatus?: string
+}
+
+type TuiCustodyMode = 'local' | 'claustrum' | `mismatch: ${string}`
+
+type AccountDialogOption = {
+  title: string
+  value: string
+  description?: string
+}
+
 export const PRIME_DIALOG_OPTIONS = [
   { title: 'Enable', value: 'on' },
   { title: 'Disable', value: 'off' },
@@ -48,26 +73,189 @@ export function buildKillswitchThresholdSeed(
   return seedParts.join(' ')
 }
 
-export function buildAccountDialogOption(account: {
-  id: string
-  label: string
-  role: string
-  enabled: boolean
-  quotaPercent: number | null
-  tierLabel?: string
-}) {
+function normalizeTuiCustodyMode(value: string): TuiCustodyMode {
+  return value === 'local' || value === 'claustrum'
+    ? value
+    : `mismatch: ${value}`
+}
+
+export function normalizeAccountDialogPayload(
+  value: unknown,
+): TuiAccountDialogPayload {
+  const payload =
+    value && typeof value === 'object' ? (value as Record<string, unknown>) : {}
+  const rawAccounts = Array.isArray(payload.accounts) ? payload.accounts : []
+  const accounts = rawAccounts.flatMap((value) => {
+    if (!value || typeof value !== 'object') return []
+    const account = value as Record<string, unknown>
+    const quotaPercent = account.quotaPercent
+    if (
+      typeof account.id !== 'string' ||
+      typeof account.label !== 'string' ||
+      (account.role !== 'main' && account.role !== 'fallback') ||
+      typeof account.enabled !== 'boolean' ||
+      (quotaPercent !== null &&
+        (typeof quotaPercent !== 'number' || !Number.isFinite(quotaPercent))) ||
+      (account.claustrumGate !== 'on' &&
+        account.claustrumGate !== 'off' &&
+        account.claustrumGate !== 'na') ||
+      typeof account.vaultServed !== 'boolean'
+    ) {
+      return []
+    }
+    const normalized = {
+      id: account.id,
+      label: account.label,
+      role: account.role,
+      enabled: account.enabled,
+      quotaPercent,
+      ...(typeof account.tierLabel === 'string' && {
+        tierLabel: account.tierLabel,
+      }),
+      claustrumGate: account.claustrumGate,
+      vaultServed: account.vaultServed,
+    } satisfies TuiAccountDialogAccount
+    const custodyState = account.custodyState
+    if (
+      (custodyState === 'na' ||
+        custodyState === 'off' ||
+        custodyState === 'on-vault-served' ||
+        custodyState === 'on-vault-reauth' ||
+        custodyState === 'on-cold') &&
+      typeof account.vaultReauth === 'boolean'
+    ) {
+      return [
+        {
+          ...normalized,
+          custodyState,
+          vaultReauth: account.vaultReauth,
+        },
+      ]
+    }
+    return [normalized]
+  })
+  const custodyMode: TuiCustodyMode | undefined =
+    payload.custodyModeKnown === true && typeof payload.custodyMode === 'string'
+      ? normalizeTuiCustodyMode(payload.custodyMode)
+      : undefined
+  return {
+    accounts,
+    claustrumDetection:
+      typeof payload.claustrumDetection === 'string'
+        ? payload.claustrumDetection
+        : 'unknown',
+    ...(custodyMode && { custodyMode }),
+    ...(typeof payload.enrollmentStatus === 'string' &&
+      payload.enrollmentStatus.length <= 2_000 && {
+        enrollmentStatus: payload.enrollmentStatus,
+      }),
+  }
+}
+
+export function buildAccountDialogOption(account: TuiAccountDialogAccount) {
   const pct =
     account.quotaPercent != null
       ? ` ${Math.round(account.quotaPercent)}%`
       : ' \u2013%'
   const status = !account.enabled ? ' (disabled)' : ''
+  const custody = account.custodyState
+    ? account.custodyState === 'na'
+      ? undefined
+      : custodyStatusLabel(account.custodyState).replace(
+          ' (OpenCode managed)',
+          '',
+        )
+    : undefined
   return {
-    title: `${account.label} [${account.role}]${status}${pct}`,
+    title: `${account.label} [${account.role}]${status}${pct}${custody ? ` · custody ${custody}` : ''}`,
     value: account.id,
     ...(account.tierLabel && { description: account.tierLabel }),
   }
 }
 
+export function buildManageAccountOptions(account: TuiAccountDialogAccount) {
+  const options: AccountDialogOption[] = []
+  const toggleLabel = account.enabled ? 'Disable' : 'Enable'
+  options.push({
+    title: toggleLabel,
+    value: account.enabled ? 'disable' : 'enable',
+    description: account.enabled
+      ? 'Stop using this fallback account'
+      : 'Allow this fallback account to be used',
+  })
+  options.push({
+    title: 'Move up',
+    value: 'move-up',
+    description: 'Higher priority in fallback order',
+  })
+  options.push({
+    title: 'Move down',
+    value: 'move-down',
+    description: 'Lower priority in fallback order',
+  })
+  options.push({
+    title: 'Remove\u2026',
+    value: 'remove',
+    description: 'Delete this account permanently',
+  })
+  options.push({ title: 'Back', value: 'back' })
+  return options
+}
+
+export function buildAccountDialogL1(value: unknown): {
+  header: string
+  options: AccountDialogOption[]
+  enrollmentStatus?: string
+  modeAction?: { command: 'claude-account'; arguments: 'local' | 'claustrum' }
+} {
+  const payload = normalizeAccountDialogPayload(value)
+  const modeAction =
+    payload.custodyMode === 'local' || payload.custodyMode === 'claustrum'
+      ? {
+          command: 'claude-account' as const,
+          arguments:
+            payload.custodyMode === 'local'
+              ? ('claustrum' as const)
+              : ('local' as const),
+        }
+      : undefined
+  return {
+    header: payload.custodyMode
+      ? `Custody mode: ${payload.custodyMode}`
+      : 'Custody mode: unavailable from older server',
+    options: [
+      ...(modeAction
+        ? [
+            {
+              title:
+                payload.custodyMode === 'local'
+                  ? 'Use Claustrum custody'
+                  : 'Use local custody',
+              value: '__custody-mode__',
+            },
+          ]
+        : []),
+      {
+        title: 'Add account…',
+        value: '__add__',
+        description: 'Add an API key or OAuth fallback account',
+      },
+      ...payload.accounts.map(buildAccountDialogOption),
+    ],
+    ...(payload.enrollmentStatus && {
+      enrollmentStatus: payload.enrollmentStatus,
+    }),
+    ...(modeAction && { modeAction }),
+  }
+}
+
+export function retainAccountDialogProjection(
+  current: Record<string, unknown>,
+  incoming: Record<string, unknown>,
+): Record<string, unknown> {
+  return Array.isArray(incoming.accounts) ? incoming : current
+}
+
 function showText(api: TuiPluginApi, text: string) {
   api.ui.dialog.setSize('xlarge')
   api.ui.dialog.replace(() => (
@@ -100,6 +288,8 @@ export function buildPrimeStatusRows(accounts: PrimeAccountStatus[]): string[] {
       const time = formatPrimeTime(account.lastPrimedAt)
       if (account.lastResult === 'error') {
         rows.push(`${account.label} \u00b7 primed ${time} err`)
+      } else if (account.lastResult === 'skipped') {
+        rows.push(`${account.label} \u00b7 primed ${time} skipped`)
       } else {
         rows.push(`${account.label} \u00b7 primed ${time} \u2713`)
       }
@@ -378,22 +568,17 @@ export function openCommandDialog(
   }
 
   if (payload.command === 'claude-account') {
-    const accounts =
-      (payload.knobs.accounts as Array<{
-        id: string
-        label: string
-        role: string
-        enabled: boolean
-        quotaPercent: number | null
-        tierLabel?: string
-      }>) ?? []
+    let accountKnobs: Record<string, unknown> = payload.knobs
+    const accounts = normalizeAccountDialogPayload(accountKnobs).accounts
+    let statusMessage: { text: string; error?: boolean } | undefined
 
     const updateAccounts = (r: {
       text: string
       knobs: Record<string, unknown>
     }) => {
-      const updated = r.knobs.accounts as typeof accounts
-      if (updated && updated.length > 0) {
+      accountKnobs = retainAccountDialogProjection(accountKnobs, r.knobs)
+      const updated = normalizeAccountDialogPayload(accountKnobs).accounts
+      if (updated.length > 0) {
         accounts.length = 0
         accounts.push(...updated)
       }
@@ -401,44 +586,79 @@ export function openCommandDialog(
 
     const buildL1 = () => {
       const DialogSelect = api.ui.DialogSelect<string>
-      const l1Options: Array<{
-        title: string
-        value: string
-        description?: string
-      }> = [
-        {
-          title: 'Add account\u2026',
-          value: '__add__',
-          description: 'Add an API key or OAuth fallback account',
-        },
-        ...accounts.map(buildAccountDialogOption),
-      ]
+      const l1 = buildAccountDialogL1({ ...accountKnobs, accounts })
       api.ui.dialog.setSize('xlarge')
       api.ui.dialog.replace(() => (
-        <DialogSelect
-          title='Claude accounts'
-          options={l1Options}
-          onSelect={(option) => {
-            if (option.value === '__add__') {
-              openAddType()
-              return
-            }
-            const account = accounts.find((a) => a.id === option.value)
-            if (!account) return
-            if (account.role === 'main') {
-              const pct =
-                account.quotaPercent != null
-                  ? ` ${Math.round(account.quotaPercent)}%`
-                  : ' \u2013%'
-              showText(
-                api,
-                `${account.label}\nRole: main (read-only)\nQuota:${pct}`,
-              )
-              return
-            }
-            openManage(account, false)
-          }}
-        />
+        <box flexDirection='column' padding={1} width='100%'>
+          <text>{`Claustrum: ${normalizeAccountDialogPayload(accountKnobs).claustrumDetection}`}</text>
+          <text>{l1.header}</text>
+          {l1.enrollmentStatus && (
+            <box marginTop={1}>
+              <text>{l1.enrollmentStatus}</text>
+            </box>
+          )}
+          {statusMessage && (
+            <box marginTop={1}>
+              <text fg={statusMessage.error ? '#ef4444' : '#22c55e'}>
+                {statusMessage.text}
+              </text>
+            </box>
+          )}
+          <box marginTop={1}>
+            <DialogSelect
+              title='Claude accounts'
+              options={l1.options}
+              onSelect={(option) => {
+                if (option.value === '__add__') {
+                  statusMessage = undefined
+                  openAddType()
+                  return
+                }
+                if (option.value === '__custody-mode__' && l1.modeAction) {
+                  void apply(l1.modeAction.command, l1.modeAction.arguments)
+                    .then((r) => {
+                      const isRefusalOrError =
+                        r.text.includes('refused') ||
+                        r.text.includes('unavailable') ||
+                        r.text.includes('failed') ||
+                        r.text.includes('Error') ||
+                        r.text.includes('error')
+                      if (isRefusalOrError) {
+                        statusMessage = { text: r.text, error: true }
+                      } else {
+                        statusMessage = { text: r.text, error: false }
+                        api.ui.toast({ message: r.text })
+                      }
+                      updateAccounts(r)
+                      buildL1()
+                    })
+                    .catch((err) => {
+                      const msg =
+                        err instanceof Error ? err.message : String(err)
+                      statusMessage = { text: `Error: ${msg}`, error: true }
+                      buildL1()
+                    })
+                  return
+                }
+                statusMessage = undefined
+                const account = accounts.find((a) => a.id === option.value)
+                if (!account) return
+                if (account.role === 'main') {
+                  const pct =
+                    account.quotaPercent != null
+                      ? ` ${Math.round(account.quotaPercent)}%`
+                      : ' \u2013%'
+                  showText(
+                    api,
+                    `${account.label}\nRole: main (read-only)\nQuota:${pct}`,
+                  )
+                  return
+                }
+                openManage(account, false)
+              }}
+            />
+          </box>
+        </box>
       ))
     }
 
@@ -738,37 +958,9 @@ export function openCommandDialog(
       const DialogConfirm = api.ui.DialogConfirm
       api.ui.dialog.setSize('xlarge')
 
-      const options: Array<{
-        title: string
-        value: string
-        description?: string
-      }> = []
-      if (!isMain) {
-        const toggleLabel = account.enabled ? 'Disable' : 'Enable'
-        options.push({
-          title: toggleLabel,
-          value: account.enabled ? 'disable' : 'enable',
-          description: account.enabled
-            ? 'Stop using this fallback account'
-            : 'Allow this fallback account to be used',
-        })
-        options.push({
-          title: 'Move up',
-          value: 'move-up',
-          description: 'Higher priority in fallback order',
-        })
-        options.push({
-          title: 'Move down',
-          value: 'move-down',
-          description: 'Lower priority in fallback order',
-        })
-        options.push({
-          title: 'Remove\u2026',
-          value: 'remove',
-          description: 'Delete this account permanently',
-        })
-      }
-      options.push({ title: 'Back', value: 'back' })
+      const options = isMain
+        ? [{ title: 'Back', value: 'back' }]
+        : buildManageAccountOptions(account)
 
       api.ui.dialog.replace(() => (
         <DialogSelect
@@ -786,13 +978,18 @@ export function openCommandDialog(
                   title={`Remove ${account.label}?`}
                   message={`Are you sure you want to remove the fallback account "${account.label}"?`}
                   onConfirm={() => {
-                    void apply('claude-account', `remove ${account.id}`).then(
-                      (r) => {
+                    void apply('claude-account', `remove ${account.id}`)
+                      .then((r) => {
                         api.ui.toast({ message: r.text })
                         updateAccounts(r)
                         buildL1()
-                      },
-                    )
+                      })
+                      .catch((err) => {
+                        const msg =
+                          err instanceof Error ? err.message : String(err)
+                        statusMessage = { text: `Error: ${msg}`, error: true }
+                        buildL1()
+                      })
                   }}
                   onCancel={() => openManage(account, isMain)}
                 />
@@ -800,18 +997,25 @@ export function openCommandDialog(
               return
             }
 
-            void apply('claude-account', `${option.value} ${account.id}`).then(
-              (r) => {
+            const args = `${option.value} ${account.id}`
+            void apply('claude-account', args)
+              .then((r) => {
                 api.ui.toast({ message: r.text })
                 updateAccounts(r)
-                const updatedList = r.knobs.accounts as typeof accounts
+                const updatedList = normalizeAccountDialogPayload(
+                  r.knobs,
+                ).accounts
                 const refreshed =
                   (updatedList && updatedList.length > 0
                     ? updatedList.find((a) => a.id === account.id)
                     : undefined) ?? account
                 openManage(refreshed, isMain)
-              },
-            )
+              })
+              .catch((err) => {
+                const msg = err instanceof Error ? err.message : String(err)
+                statusMessage = { text: `Error: ${msg}`, error: true }
+                buildL1()
+              })
           }}
         />
       ))

package/src/tui-compiled/rpc/protocol.ts

@@ -1,3 +1,5 @@
+import type { ClaustrumEnrollmentStatus } from '@cortexkit/anthropic-auth-core'
+
 export const COMMAND_MODAL_NAMES = [
   'claude-account',
   'claude-cache',
@@ -14,6 +16,37 @@ export const COMMAND_MODAL_NAMES = [
 
 export type CommandModalName = (typeof COMMAND_MODAL_NAMES)[number]
 
+export interface AccountDialogAccount {
+  id: string
+  label: string
+  role: 'main' | 'fallback'
+  enabled: boolean
+  quotaPercent: number | null
+  tierLabel?: string
+  claustrumGate: 'on' | 'off' | 'na'
+  vaultServed: boolean
+  vaultReauth: boolean
+  custodyState:
+    | 'na'
+    | 'off'
+    | 'on-vault-served'
+    | 'on-vault-reauth'
+    | 'on-cold'
+    | 'unknown-identity'
+    | 'on-identity-mismatch'
+    | 'on-corrupt-binding'
+}
+
+export interface AccountDialogKnobs {
+  accounts: AccountDialogAccount[]
+  claustrumDetection: string
+  custodyMode?: 'local' | 'claustrum'
+  custodyModeKnown?: boolean
+  enrollmentStatus?: string
+  claustrumEnrollment?: ClaustrumEnrollmentStatus
+  [key: string]: unknown
+}
+
 export interface OpenDialogPayload {
   command: CommandModalName
   text: string
@@ -24,7 +57,7 @@ export interface RpcNotification {
   id: number
   type: 'open-dialog'
   payload: OpenDialogPayload
-  sessionId?: string
+  sessionId: string
 }
 
 export interface ApplyRequest {

package/src/tui-compiled/rpc/rpc-client.ts

@@ -4,7 +4,7 @@ import type { ApplyRequest, ApplyResult, RpcNotification } from './protocol'
 export interface RpcClient {
   pending: (
     lastReceivedId: number,
-    sessionId?: string,
+    sessionId: string,
   ) => Promise<RpcNotification[]>
   apply: (request: ApplyRequest) => Promise<ApplyResult>
 }

package/src/tui-compiled/sidebar-state.ts

@@ -34,6 +34,18 @@ export interface SidebarAccountState {
   // True when the account's refresh token is permanently dead (400
   // invalid_grant) and it needs a re-login — distinct from a transient backoff.
   needsReauth: boolean
+  // True when the vault copy needs re-importing while the sidecar remains usable.
+  vaultReauth?: boolean
+  // A gate alone does not prove the sidecar can serve a request.
+  vaultServed?: boolean
+  custodyState?:
+    | 'off'
+    | 'on-vault-served'
+    | 'on-vault-reauth'
+    | 'on-cold'
+    | 'unknown-identity'
+    | 'on-identity-mismatch'
+    | 'on-corrupt-binding'
   tierLabel?: string
 }
 
@@ -57,7 +69,7 @@ export interface PrimeSidebarAccountState {
   label: string
   nextDueAt?: number | null
   lastPrimedAt?: number | null
-  lastResult?: 'ok' | 'error'
+  lastResult?: 'ok' | 'error' | 'skipped'
   usage?: PrimeUsageCounters
   estimatedCostUsd?: number
 }
@@ -178,7 +190,11 @@ function normalizePrimeAccount(
   } else if (isFiniteNumber(value.lastPrimedAt)) {
     account.lastPrimedAt = value.lastPrimedAt
   }
-  if (value.lastResult === 'ok' || value.lastResult === 'error') {
+  if (
+    value.lastResult === 'ok' ||
+    value.lastResult === 'error' ||
+    value.lastResult === 'skipped'
+  ) {
     account.lastResult = value.lastResult
   }
   const usage = normalizePrimeUsage(value.usage)
@@ -335,6 +351,12 @@ export function normalizeSidebarState(raw: unknown): SidebarState {
           enabled: typeof entry.enabled === 'boolean' ? entry.enabled : false,
           needsReauth:
             typeof entry.needsReauth === 'boolean' ? entry.needsReauth : false,
+          ...(entry.vaultReauth === true && { vaultReauth: true }),
+          ...(entry.vaultServed === true && { vaultServed: true }),
+          ...(typeof entry.custodyState === 'string' && {
+            custodyState:
+              entry.custodyState as SidebarAccountState['custodyState'],
+          }),
           tierLabel:
             typeof entry.tierLabel === 'string' && entry.tierLabel.trim()
               ? entry.tierLabel.trim()
@@ -715,6 +737,8 @@ export async function setSidebarState(
               lastUpdated: Math.max(current.lastUpdated, state.lastUpdated),
             }
           }
+          // The state file is a cross-process artifact; future account fields must fail closed.
+          stateToWrite = normalizeSidebarState(stateToWrite)
           result = await writeSidebarStateAtomic(
             stateFile,
             stateToWrite,
@@ -795,13 +819,25 @@ export function formatScopedQuotaLabel(title: string) {
 }
 
 /**
- * Pretty label for a recoverable-refusal source model (Fable 5 or Opus 5).
+ * Pretty label for a recoverable-refusal source model (Fable 5/5.1 or Opus 5).
  * Falls back to the raw id for unrecognized ids so the sidebar never goes
  * blank on a future model that has not yet been cataloged here.
  */
 export function formatFallbackModelLabel(modelId: string | undefined): string {
+  if (
+    modelId === 'claude-mythos-5-1' ||
+    modelId?.startsWith('claude-mythos-5-1-')
+  )
+    return 'Mythos 5.1'
+  if (
+    modelId === 'claude-fable-5-1' ||
+    modelId?.startsWith('claude-fable-5-1-')
+  )
+    return 'Fable 5.1'
   if (modelId === 'claude-fable-5' || modelId?.startsWith('claude-fable-5-'))
     return 'Fable 5'
+  if (modelId === 'claude-opus-5-5' || modelId?.startsWith('claude-opus-5-5-'))
+    return 'Opus 5.5'
   if (modelId === 'claude-opus-5' || modelId?.startsWith('claude-opus-5-'))
     return 'Opus 5'
   if (modelId === 'claude-opus-4-8' || modelId?.startsWith('claude-opus-4-8-'))
@@ -829,6 +865,9 @@ export function formatPrimeAccountValue(account: PrimeSidebarAccountState): {
   if (account.lastResult === 'error') {
     return { text: 'err', hasError: true }
   }
+  if (account.lastResult === 'skipped') {
+    return { text: 'skip', hasError: false }
+  }
   if (account.nextDueAt && account.nextDueAt > Date.now()) {
     return { text: formatPrimeTime(account.nextDueAt), hasError: false }
   }