@cortexkit/opencode-anthropic-auth 1.22.0 → 1.23.0

package/src/rpc/protocol.ts

@@ -1,3 +1,5 @@
+import type { ClaustrumEnrollmentStatus } from '@cortexkit/anthropic-auth-core'
+
 export const COMMAND_MODAL_NAMES = [
   'claude-account',
   'claude-cache',
@@ -17,17 +19,31 @@ export type CommandModalName = (typeof COMMAND_MODAL_NAMES)[number]
 export interface AccountDialogAccount {
   id: string
   label: string
-  role: string
+  role: 'main' | 'fallback'
   enabled: boolean
   quotaPercent: number | null
   tierLabel?: string
   claustrumGate: 'on' | 'off' | 'na'
   vaultServed: boolean
+  vaultReauth: boolean
+  custodyState:
+    | 'na'
+    | 'off'
+    | 'on-vault-served'
+    | 'on-vault-reauth'
+    | 'on-cold'
+    | 'unknown-identity'
+    | 'on-identity-mismatch'
+    | 'on-corrupt-binding'
 }
 
 export interface AccountDialogKnobs {
   accounts: AccountDialogAccount[]
   claustrumDetection: string
+  custodyMode?: 'local' | 'claustrum'
+  custodyModeKnown?: boolean
+  enrollmentStatus?: string
+  claustrumEnrollment?: ClaustrumEnrollmentStatus
   [key: string]: unknown
 }
 
@@ -41,7 +57,7 @@ export interface RpcNotification {
   id: number
   type: 'open-dialog'
   payload: OpenDialogPayload
-  sessionId?: string
+  sessionId: string
 }
 
 export interface ApplyRequest {

package/src/rpc/rpc-client.ts

@@ -4,7 +4,7 @@ import type { ApplyRequest, ApplyResult, RpcNotification } from './protocol'
 export interface RpcClient {
   pending: (
     lastReceivedId: number,
-    sessionId?: string,
+    sessionId: string,
   ) => Promise<RpcNotification[]>
   apply: (request: ApplyRequest) => Promise<ApplyResult>
 }

package/src/rpc/rpc-server.ts

@@ -1,5 +1,5 @@
 import { randomBytes, timingSafeEqual } from 'node:crypto'
-import { unlink } from 'node:fs/promises'
+import { readFile, unlink } from 'node:fs/promises'
 import {
   createServer,
   type IncomingMessage,
@@ -74,9 +74,15 @@ export async function startRpcServer(
         unknown
       >
       if (method === 'pending-notifications') {
+        if (
+          typeof params.sessionId !== 'string' ||
+          params.sessionId.length === 0
+        ) {
+          return json(400, { error: 'sessionId is required' })
+        }
         const messages = options.drain(
           Number(params.lastReceivedId ?? 0),
-          typeof params.sessionId === 'string' ? params.sessionId : undefined,
+          params.sessionId,
         )
         return json(200, { messages })
       }
@@ -115,9 +121,16 @@ export async function startRpcServer(
     token,
     async stop() {
       await new Promise<void>((resolve) => server.close(() => resolve()))
-      await unlink(join(options.dir, `port-${process.pid}.json`)).catch(
-        () => {},
-      )
+      try {
+        const portFile = join(options.dir, `port-${process.pid}.json`)
+        const current = JSON.parse(await readFile(portFile, 'utf8')) as {
+          port?: unknown
+          pid?: unknown
+        }
+        if (current.port === port && current.pid === process.pid) {
+          await unlink(portFile)
+        }
+      } catch {}
     },
   }
 }

package/src/rpc/server-registry.ts

@@ -0,0 +1,61 @@
+import type { RpcServerHandle } from './rpc-server'
+
+type RpcServerGlobal = typeof globalThis & {
+  __anthropicAuthRpcServers?: Map<string, RpcServerHandle>
+  __anthropicAuthRpcServersPending?: Map<string, Promise<void>>
+}
+
+export interface RpcServerAdoption {
+  server: RpcServerHandle
+  release: () => Promise<void>
+}
+
+/**
+ * Serializes same-directory replacement and returns an identity-fenced lease.
+ * Distinct project directories remain independent.
+ */
+export async function adoptRpcServer(
+  rpcDir: string,
+  create: () => Promise<RpcServerHandle>,
+): Promise<RpcServerAdoption> {
+  const rpcGlobal = globalThis as RpcServerGlobal
+  const servers =
+    rpcGlobal.__anthropicAuthRpcServers ?? new Map<string, RpcServerHandle>()
+  const pending =
+    rpcGlobal.__anthropicAuthRpcServersPending ??
+    new Map<string, Promise<void>>()
+  rpcGlobal.__anthropicAuthRpcServers = servers
+  rpcGlobal.__anthropicAuthRpcServersPending = pending
+
+  const predecessor = pending.get(rpcDir) ?? Promise.resolve()
+  let server: RpcServerHandle | undefined
+  const start = predecessor
+    .catch(() => {})
+    .then(async () => {
+      const previous = servers.get(rpcDir)
+      if (previous) {
+        await previous.stop()
+        if (servers.get(rpcDir) === previous) servers.delete(rpcDir)
+      }
+      server = await create()
+      servers.set(rpcDir, server)
+    })
+  pending.set(rpcDir, start)
+
+  try {
+    await start
+  } finally {
+    if (pending.get(rpcDir) === start) pending.delete(rpcDir)
+  }
+  const adoptedServer = server
+  if (!adoptedServer) throw new Error('RPC server failed to start')
+
+  return {
+    server: adoptedServer,
+    release: async () => {
+      if (servers.get(rpcDir) !== adoptedServer) return
+      await adoptedServer.stop()
+      if (servers.get(rpcDir) === adoptedServer) servers.delete(rpcDir)
+    },
+  }
+}

package/src/sidebar-state.ts

@@ -36,6 +36,16 @@ export interface SidebarAccountState {
   needsReauth: boolean
   // True when the vault copy needs re-importing while the sidecar remains usable.
   vaultReauth?: boolean
+  // A gate alone does not prove the sidecar can serve a request.
+  vaultServed?: boolean
+  custodyState?:
+    | 'off'
+    | 'on-vault-served'
+    | 'on-vault-reauth'
+    | 'on-cold'
+    | 'unknown-identity'
+    | 'on-identity-mismatch'
+    | 'on-corrupt-binding'
   tierLabel?: string
 }
 
@@ -59,7 +69,7 @@ export interface PrimeSidebarAccountState {
   label: string
   nextDueAt?: number | null
   lastPrimedAt?: number | null
-  lastResult?: 'ok' | 'error'
+  lastResult?: 'ok' | 'error' | 'skipped'
   usage?: PrimeUsageCounters
   estimatedCostUsd?: number
 }
@@ -180,7 +190,11 @@ function normalizePrimeAccount(
   } else if (isFiniteNumber(value.lastPrimedAt)) {
     account.lastPrimedAt = value.lastPrimedAt
   }
-  if (value.lastResult === 'ok' || value.lastResult === 'error') {
+  if (
+    value.lastResult === 'ok' ||
+    value.lastResult === 'error' ||
+    value.lastResult === 'skipped'
+  ) {
     account.lastResult = value.lastResult
   }
   const usage = normalizePrimeUsage(value.usage)
@@ -338,6 +352,11 @@ export function normalizeSidebarState(raw: unknown): SidebarState {
           needsReauth:
             typeof entry.needsReauth === 'boolean' ? entry.needsReauth : false,
           ...(entry.vaultReauth === true && { vaultReauth: true }),
+          ...(entry.vaultServed === true && { vaultServed: true }),
+          ...(typeof entry.custodyState === 'string' && {
+            custodyState:
+              entry.custodyState as SidebarAccountState['custodyState'],
+          }),
           tierLabel:
             typeof entry.tierLabel === 'string' && entry.tierLabel.trim()
               ? entry.tierLabel.trim()
@@ -817,6 +836,8 @@ export function formatFallbackModelLabel(modelId: string | undefined): string {
     return 'Fable 5.1'
   if (modelId === 'claude-fable-5' || modelId?.startsWith('claude-fable-5-'))
     return 'Fable 5'
+  if (modelId === 'claude-opus-5-5' || modelId?.startsWith('claude-opus-5-5-'))
+    return 'Opus 5.5'
   if (modelId === 'claude-opus-5' || modelId?.startsWith('claude-opus-5-'))
     return 'Opus 5'
   if (modelId === 'claude-opus-4-8' || modelId?.startsWith('claude-opus-4-8-'))
@@ -844,6 +865,9 @@ export function formatPrimeAccountValue(account: PrimeSidebarAccountState): {
   if (account.lastResult === 'error') {
     return { text: 'err', hasError: true }
   }
+  if (account.lastResult === 'skipped') {
+    return { text: 'skip', hasError: false }
+  }
   if (account.nextDueAt && account.nextDueAt > Date.now()) {
     return { text: formatPrimeTime(account.nextDueAt), hasError: false }
   }

package/src/tui/command-dialogs.tsx

@@ -1,5 +1,8 @@
 /** @jsxImportSource @opentui/solid */
-import type { PrimeAccountStatus } from '@cortexkit/anthropic-auth-core'
+import {
+  custodyStatusLabel,
+  type PrimeAccountStatus,
+} from '@cortexkit/anthropic-auth-core'
 import type { TuiPluginApi } from '@opencode-ai/plugin/tui'
 import type { AccountDialogAccount } from '../rpc/protocol'
 import type { OpenDialogPayload } from '../rpc/protocol.js'
@@ -16,6 +19,27 @@ type KillswitchDialogConfig = {
   accounts?: Record<string, Record<string, number>>
 }
 
+type TuiAccountDialogAccount = Omit<
+  AccountDialogAccount,
+  'vaultReauth' | 'custodyState'
+> &
+  Partial<Pick<AccountDialogAccount, 'vaultReauth' | 'custodyState'>>
+
+type TuiAccountDialogPayload = {
+  accounts: TuiAccountDialogAccount[]
+  claustrumDetection: string
+  custodyMode?: TuiCustodyMode
+  enrollmentStatus?: string
+}
+
+type TuiCustodyMode = 'local' | 'claustrum' | `mismatch: ${string}`
+
+type AccountDialogOption = {
+  title: string
+  value: string
+  description?: string
+}
+
 export const PRIME_DIALOG_OPTIONS = [
   { title: 'Enable', value: 'on' },
   { title: 'Disable', value: 'off' },
@@ -49,24 +73,189 @@ export function buildKillswitchThresholdSeed(
   return seedParts.join(' ')
 }
 
-export function buildAccountDialogOption(account: AccountDialogAccount) {
+function normalizeTuiCustodyMode(value: string): TuiCustodyMode {
+  return value === 'local' || value === 'claustrum'
+    ? value
+    : `mismatch: ${value}`
+}
+
+export function normalizeAccountDialogPayload(
+  value: unknown,
+): TuiAccountDialogPayload {
+  const payload =
+    value && typeof value === 'object' ? (value as Record<string, unknown>) : {}
+  const rawAccounts = Array.isArray(payload.accounts) ? payload.accounts : []
+  const accounts = rawAccounts.flatMap((value) => {
+    if (!value || typeof value !== 'object') return []
+    const account = value as Record<string, unknown>
+    const quotaPercent = account.quotaPercent
+    if (
+      typeof account.id !== 'string' ||
+      typeof account.label !== 'string' ||
+      (account.role !== 'main' && account.role !== 'fallback') ||
+      typeof account.enabled !== 'boolean' ||
+      (quotaPercent !== null &&
+        (typeof quotaPercent !== 'number' || !Number.isFinite(quotaPercent))) ||
+      (account.claustrumGate !== 'on' &&
+        account.claustrumGate !== 'off' &&
+        account.claustrumGate !== 'na') ||
+      typeof account.vaultServed !== 'boolean'
+    ) {
+      return []
+    }
+    const normalized = {
+      id: account.id,
+      label: account.label,
+      role: account.role,
+      enabled: account.enabled,
+      quotaPercent,
+      ...(typeof account.tierLabel === 'string' && {
+        tierLabel: account.tierLabel,
+      }),
+      claustrumGate: account.claustrumGate,
+      vaultServed: account.vaultServed,
+    } satisfies TuiAccountDialogAccount
+    const custodyState = account.custodyState
+    if (
+      (custodyState === 'na' ||
+        custodyState === 'off' ||
+        custodyState === 'on-vault-served' ||
+        custodyState === 'on-vault-reauth' ||
+        custodyState === 'on-cold') &&
+      typeof account.vaultReauth === 'boolean'
+    ) {
+      return [
+        {
+          ...normalized,
+          custodyState,
+          vaultReauth: account.vaultReauth,
+        },
+      ]
+    }
+    return [normalized]
+  })
+  const custodyMode: TuiCustodyMode | undefined =
+    payload.custodyModeKnown === true && typeof payload.custodyMode === 'string'
+      ? normalizeTuiCustodyMode(payload.custodyMode)
+      : undefined
+  return {
+    accounts,
+    claustrumDetection:
+      typeof payload.claustrumDetection === 'string'
+        ? payload.claustrumDetection
+        : 'unknown',
+    ...(custodyMode && { custodyMode }),
+    ...(typeof payload.enrollmentStatus === 'string' &&
+      payload.enrollmentStatus.length <= 2_000 && {
+        enrollmentStatus: payload.enrollmentStatus,
+      }),
+  }
+}
+
+export function buildAccountDialogOption(account: TuiAccountDialogAccount) {
   const pct =
     account.quotaPercent != null
       ? ` ${Math.round(account.quotaPercent)}%`
       : ' \u2013%'
   const status = !account.enabled ? ' (disabled)' : ''
-  const gate = ` · gate ${account.claustrumGate === 'na' ? 'n/a' : account.claustrumGate}`
-  const vault =
-    account.role === 'main'
-      ? ' · vault n/a'
-      : ` · vault ${account.vaultServed ? 'served' : 'cold'}`
+  const custody = account.custodyState
+    ? account.custodyState === 'na'
+      ? undefined
+      : custodyStatusLabel(account.custodyState).replace(
+          ' (OpenCode managed)',
+          '',
+        )
+    : undefined
   return {
-    title: `${account.label} [${account.role}]${status}${pct}${gate}${vault}`,
+    title: `${account.label} [${account.role}]${status}${pct}${custody ? ` · custody ${custody}` : ''}`,
     value: account.id,
     ...(account.tierLabel && { description: account.tierLabel }),
   }
 }
 
+export function buildManageAccountOptions(account: TuiAccountDialogAccount) {
+  const options: AccountDialogOption[] = []
+  const toggleLabel = account.enabled ? 'Disable' : 'Enable'
+  options.push({
+    title: toggleLabel,
+    value: account.enabled ? 'disable' : 'enable',
+    description: account.enabled
+      ? 'Stop using this fallback account'
+      : 'Allow this fallback account to be used',
+  })
+  options.push({
+    title: 'Move up',
+    value: 'move-up',
+    description: 'Higher priority in fallback order',
+  })
+  options.push({
+    title: 'Move down',
+    value: 'move-down',
+    description: 'Lower priority in fallback order',
+  })
+  options.push({
+    title: 'Remove\u2026',
+    value: 'remove',
+    description: 'Delete this account permanently',
+  })
+  options.push({ title: 'Back', value: 'back' })
+  return options
+}
+
+export function buildAccountDialogL1(value: unknown): {
+  header: string
+  options: AccountDialogOption[]
+  enrollmentStatus?: string
+  modeAction?: { command: 'claude-account'; arguments: 'local' | 'claustrum' }
+} {
+  const payload = normalizeAccountDialogPayload(value)
+  const modeAction =
+    payload.custodyMode === 'local' || payload.custodyMode === 'claustrum'
+      ? {
+          command: 'claude-account' as const,
+          arguments:
+            payload.custodyMode === 'local'
+              ? ('claustrum' as const)
+              : ('local' as const),
+        }
+      : undefined
+  return {
+    header: payload.custodyMode
+      ? `Custody mode: ${payload.custodyMode}`
+      : 'Custody mode: unavailable from older server',
+    options: [
+      ...(modeAction
+        ? [
+            {
+              title:
+                payload.custodyMode === 'local'
+                  ? 'Use Claustrum custody'
+                  : 'Use local custody',
+              value: '__custody-mode__',
+            },
+          ]
+        : []),
+      {
+        title: 'Add account…',
+        value: '__add__',
+        description: 'Add an API key or OAuth fallback account',
+      },
+      ...payload.accounts.map(buildAccountDialogOption),
+    ],
+    ...(payload.enrollmentStatus && {
+      enrollmentStatus: payload.enrollmentStatus,
+    }),
+    ...(modeAction && { modeAction }),
+  }
+}
+
+export function retainAccountDialogProjection(
+  current: Record<string, unknown>,
+  incoming: Record<string, unknown>,
+): Record<string, unknown> {
+  return Array.isArray(incoming.accounts) ? incoming : current
+}
+
 function showText(api: TuiPluginApi, text: string) {
   api.ui.dialog.setSize('xlarge')
   api.ui.dialog.replace(() => (
@@ -99,6 +288,8 @@ export function buildPrimeStatusRows(accounts: PrimeAccountStatus[]): string[] {
       const time = formatPrimeTime(account.lastPrimedAt)
       if (account.lastResult === 'error') {
         rows.push(`${account.label} \u00b7 primed ${time} err`)
+      } else if (account.lastResult === 'skipped') {
+        rows.push(`${account.label} \u00b7 primed ${time} skipped`)
       } else {
         rows.push(`${account.label} \u00b7 primed ${time} \u2713`)
       }
@@ -377,17 +568,17 @@ export function openCommandDialog(
   }
 
   if (payload.command === 'claude-account') {
-    const accounts =
-      (payload.knobs.accounts as AccountDialogAccount[] | undefined) ?? []
-    const claustrumDetection =
-      (payload.knobs.claustrumDetection as string | undefined) ?? 'unknown'
+    let accountKnobs: Record<string, unknown> = payload.knobs
+    const accounts = normalizeAccountDialogPayload(accountKnobs).accounts
+    let statusMessage: { text: string; error?: boolean } | undefined
 
     const updateAccounts = (r: {
       text: string
       knobs: Record<string, unknown>
     }) => {
-      const updated = r.knobs.accounts as typeof accounts
-      if (updated && updated.length > 0) {
+      accountKnobs = retainAccountDialogProjection(accountKnobs, r.knobs)
+      const updated = normalizeAccountDialogPayload(accountKnobs).accounts
+      if (updated.length > 0) {
         accounts.length = 0
         accounts.push(...updated)
       }
@@ -395,31 +586,61 @@ export function openCommandDialog(
 
     const buildL1 = () => {
       const DialogSelect = api.ui.DialogSelect<string>
-      const l1Options: Array<{
-        title: string
-        value: string
-        description?: string
-      }> = [
-        {
-          title: 'Add account\u2026',
-          value: '__add__',
-          description: 'Add an API key or OAuth fallback account',
-        },
-        ...accounts.map(buildAccountDialogOption),
-      ]
+      const l1 = buildAccountDialogL1({ ...accountKnobs, accounts })
       api.ui.dialog.setSize('xlarge')
       api.ui.dialog.replace(() => (
         <box flexDirection='column' padding={1} width='100%'>
-          <text>{`Claustrum: ${claustrumDetection}`}</text>
+          <text>{`Claustrum: ${normalizeAccountDialogPayload(accountKnobs).claustrumDetection}`}</text>
+          <text>{l1.header}</text>
+          {l1.enrollmentStatus && (
+            <box marginTop={1}>
+              <text>{l1.enrollmentStatus}</text>
+            </box>
+          )}
+          {statusMessage && (
+            <box marginTop={1}>
+              <text fg={statusMessage.error ? '#ef4444' : '#22c55e'}>
+                {statusMessage.text}
+              </text>
+            </box>
+          )}
           <box marginTop={1}>
             <DialogSelect
               title='Claude accounts'
-              options={l1Options}
+              options={l1.options}
               onSelect={(option) => {
                 if (option.value === '__add__') {
+                  statusMessage = undefined
                   openAddType()
                   return
                 }
+                if (option.value === '__custody-mode__' && l1.modeAction) {
+                  void apply(l1.modeAction.command, l1.modeAction.arguments)
+                    .then((r) => {
+                      const isRefusalOrError =
+                        r.text.includes('refused') ||
+                        r.text.includes('unavailable') ||
+                        r.text.includes('failed') ||
+                        r.text.includes('Error') ||
+                        r.text.includes('error')
+                      if (isRefusalOrError) {
+                        statusMessage = { text: r.text, error: true }
+                      } else {
+                        statusMessage = { text: r.text, error: false }
+                        api.ui.toast({ message: r.text })
+                      }
+                      updateAccounts(r)
+                      buildL1()
+                    })
+                    .catch((err) => {
+                      const msg =
+                        err instanceof Error ? err.message : String(err)
+                      statusMessage = { text: `Error: ${msg}`, error: true }
+                      buildL1()
+                    })
+                  return
+                }
+                statusMessage = undefined
                 const account = accounts.find((a) => a.id === option.value)
                 if (!account) return
                 if (account.role === 'main') {
@@ -737,37 +958,9 @@ export function openCommandDialog(
       const DialogConfirm = api.ui.DialogConfirm
       api.ui.dialog.setSize('xlarge')
 
-      const options: Array<{
-        title: string
-        value: string
-        description?: string
-      }> = []
-      if (!isMain) {
-        const toggleLabel = account.enabled ? 'Disable' : 'Enable'
-        options.push({
-          title: toggleLabel,
-          value: account.enabled ? 'disable' : 'enable',
-          description: account.enabled
-            ? 'Stop using this fallback account'
-            : 'Allow this fallback account to be used',
-        })
-        options.push({
-          title: 'Move up',
-          value: 'move-up',
-          description: 'Higher priority in fallback order',
-        })
-        options.push({
-          title: 'Move down',
-          value: 'move-down',
-          description: 'Lower priority in fallback order',
-        })
-        options.push({
-          title: 'Remove\u2026',
-          value: 'remove',
-          description: 'Delete this account permanently',
-        })
-      }
-      options.push({ title: 'Back', value: 'back' })
+      const options = isMain
+        ? [{ title: 'Back', value: 'back' }]
+        : buildManageAccountOptions(account)
 
       api.ui.dialog.replace(() => (
         <DialogSelect
@@ -785,13 +978,18 @@ export function openCommandDialog(
                   title={`Remove ${account.label}?`}
                   message={`Are you sure you want to remove the fallback account "${account.label}"?`}
                   onConfirm={() => {
-                    void apply('claude-account', `remove ${account.id}`).then(
-                      (r) => {
+                    void apply('claude-account', `remove ${account.id}`)
+                      .then((r) => {
                         api.ui.toast({ message: r.text })
                         updateAccounts(r)
                         buildL1()
-                      },
-                    )
+                      })
+                      .catch((err) => {
+                        const msg =
+                          err instanceof Error ? err.message : String(err)
+                        statusMessage = { text: `Error: ${msg}`, error: true }
+                        buildL1()
+                      })
                   }}
                   onCancel={() => openManage(account, isMain)}
                 />
@@ -799,18 +997,25 @@ export function openCommandDialog(
               return
             }
 
-            void apply('claude-account', `${option.value} ${account.id}`).then(
-              (r) => {
+            const args = `${option.value} ${account.id}`
+            void apply('claude-account', args)
+              .then((r) => {
                 api.ui.toast({ message: r.text })
                 updateAccounts(r)
-                const updatedList = r.knobs.accounts as typeof accounts
+                const updatedList = normalizeAccountDialogPayload(
+                  r.knobs,
+                ).accounts
                 const refreshed =
                   (updatedList && updatedList.length > 0
                     ? updatedList.find((a) => a.id === account.id)
                     : undefined) ?? account
                 openManage(refreshed, isMain)
-              },
-            )
+              })
+              .catch((err) => {
+                const msg = err instanceof Error ? err.message : String(err)
+                statusMessage = { text: `Error: ${msg}`, error: true }
+                buildL1()
+              })
           }}
         />
       ))