@cortexkit/opencode-anthropic-auth 1.22.0 → 2.0.0

package/dist/v2/source.d.ts

@@ -0,0 +1,41 @@
+import { type NativeAccountRuntime, type NativeAccountSnapshot, type NativeApiSubject, type NativeLocalCredentialValidation as NativeKnownCredentialSubject, type NativePoolPaths, type OAuthQuotaSnapshot } from '@cortexkit/anthropic-auth-core';
+import type { RequestScope } from '@cortexkit/common-auth/opencode2';
+import { type NativeAnthropicBodyOptions, type NativeAnthropicRequestContext, type NativeAnthropicResponseContext, type NativeAnthropicResponseOptions, type NativeAnthropicSource } from './adapter';
+/**
+ * Identifies the account and credential version that served a send, so a
+ * later 401 or quota reading is recorded against that exact version. It never
+ * holds OAuth tokens, API keys or the private vault authorization receipt.
+ */
+export type NativeSourceProvenance = {
+    readonly kind: 'local';
+    readonly subject: NativeKnownCredentialSubject;
+} | {
+    readonly kind: 'vault';
+    readonly credentialId: string;
+    readonly recordVersion: number;
+} | {
+    readonly kind: 'api';
+    readonly subject: NativeApiSubject;
+};
+export interface NativeSourceOptions {
+    readonly runtime: NativeAccountRuntime;
+    readonly paths: NativePoolPaths;
+    readonly requestOptions: (scope: NativeAnthropicRequestContext<NativeSourceProvenance>, snapshot: NativeAccountSnapshot) => NativeAnthropicBodyOptions;
+    readonly responseOptions?: (scope: NativeAnthropicResponseContext<NativeSourceProvenance>) => NativeAnthropicResponseOptions;
+    readonly onRequestId?: (scope: NativeAnthropicResponseContext<NativeSourceProvenance>, requestId: string) => void;
+    readonly onForgetSession?: (sessionID: string) => void;
+    readonly onOwnedRequest?: () => void;
+    readonly fetch?: typeof fetch;
+    /** Resolve a host model alias to the upstream ID before request-local policy. */
+    readonly resolveModelId?: (scope: RequestScope) => Promise<string>;
+}
+export interface NativeSource extends NativeAnthropicSource<OAuthQuotaSnapshot, NativeSourceProvenance> {
+    readonly close: () => Promise<void>;
+    readonly resetRouting: (sessionID: string) => Promise<void>;
+    readonly recordPrime: (provenance: NativeSourceProvenance, usage: {
+        inputTokens?: number;
+        outputTokens?: number;
+    }) => Promise<boolean>;
+}
+/** The native account service supplies fresh credentials; existing quota and routing rules choose each OpenCode 2 request's route. */
+export declare function createNativeAnthropicSource(options: NativeSourceOptions): NativeSource;

package/dist/v2/tui.d.ts

@@ -0,0 +1,13 @@
+import type { Plugin as Tui } from '@opencode/plugin/tui';
+/**
+ * Shows the `claude` account menu in OpenCode 2 dialogs. The menu's sections,
+ * items and actions come from the plugin server over NATIVE_MENU_RPC, built by
+ * the same Core menu code that OpenCode 1 and Pi render, so every host shows
+ * the same menu.
+ */
+export declare function setupAnthropicTui(ctx: Tui.Context): Promise<() => void>;
+declare const _default: {
+    id: string;
+    setup: typeof setupAnthropicTui;
+};
+export default _default;

package/dist/v2/tui.js

@@ -0,0 +1,2 @@
+import{s as F}from"../index-1jkyhgyr.js";import"../index-aaajxwzd.js";async function V(B){let Y=B.client.rpc(F),K=!0,$=!1,L=new AbortController,O=()=>{let w=B.ui.router.current();return w.type==="session"?w.sessionID:void 0};function M(w){return new Promise((J)=>{let j="",G=!1,Q=B.keymap.mode.push("cortexkit-protected-entry"),H=(z,D=!0)=>{if(G)return;G=!0,B.renderer.keyInput.off("keypress",X),B.renderer.keyInput.off("paste",Z),L.signal.removeEventListener("abort",W),Q();let q=z?j:void 0;if(j="",D)B.ui.dialog.clear();J(q)},W=()=>H(!1),X=(z)=>{if(z.preventDefault(),z.stopPropagation(),z.name==="escape"||z.ctrl&&z.name==="c")return H(!1);if(z.name==="return"||z.name==="enter")return H(!0);if(z.name==="backspace"){j=Array.from(j).slice(0,-1).join("");return}if(!z.ctrl&&!z.meta&&!z.option&&Array.from(z.sequence).every((D)=>D.charCodeAt(0)>=32&&D.charCodeAt(0)!==127))j=(j+z.sequence).slice(0,4096)},Z=(z)=>{z.preventDefault(),z.stopPropagation(),j=(j+Array.from(new TextDecoder().decode(z.bytes)).filter((D)=>D.charCodeAt(0)>=32&&D.charCodeAt(0)!==127).join("")).slice(0,4096)};if(B.renderer.keyInput.prependListener("keypress",X),B.renderer.keyInput.prependListener("paste",Z),L.signal.addEventListener("abort",W,{once:!0}),B.ui.dialog.alert({title:w,message:"Type or paste the value. Input is hidden. Enter accepts; Escape cancels."}).then(()=>H(!1,!1),()=>H(!1,!1)),L.signal.aborted)W()})}async function P(w){let J={};for(let j of w.knobs){if(!K)return;if(j.kind==="choice"){let G=await B.ui.dialog.select({title:j.label,options:j.choices.map((Q)=>({title:Q.label,value:Q.value})),current:j.value});if(G===void 0)return;J[j.id]=G}else if(j.kind==="toggle"){let G=await B.ui.dialog.select({title:j.label,options:[{title:"On",value:!0},{title:"Off",value:!1}],current:j.value});if(G===void 0)return;J[j.id]=G}else{let G=j.kind==="text"&&j.masked?await M(j.label):await B.ui.dialog.prompt({title:j.label,value:j.value===void 0?void 0:String(j.value),placeholder:j.kind==="text"?j.placeholder:void 0});if(G===void 0)return;J[j.id]=G===""&&!j.required?null:j.kind==="number"?Number(G):G}}return J}async function C(w,J){if(!K||$||O()!==w)return;$=!0;let j=J;try{while(K&&O()===w){let G=await B.ui.dialog.select({title:j.menu.title,options:j.menu.sections.map((D)=>({title:D.title,description:D.lines.join(`
+`),value:D}))});if(!G||!K||O()!==w)return;let Q=[...G.actions.map((D)=>({action:D,itemId:void 0})),...G.items.flatMap((D)=>D.actions.map((q)=>({action:q,itemId:D.id})))],H=await B.ui.dialog.select({title:G.title,options:Q.map((D)=>({title:D.action.label,description:D.action.description,value:D}))});if(!H)continue;let W=await P(H.action);if(!W||!K||O()!==w)return;let X=H.action.confirm?await B.ui.dialog.confirm({title:H.action.label,message:H.action.confirm.message}):void 0;if(H.action.confirm&&X!==!0)continue;if(!K||O()!==w)return;let Z={command:"claude",sectionId:G.id,itemId:H.itemId,actionId:H.action.id,sessionId:w,values:W,confirmed:X},z=await Y.apply(Z,{signal:L.signal,location:B.location});if(!K||O()!==w)return;await B.ui.dialog.alert({title:z.ok?"Claude":"Claude action refused",message:z.text}),j={command:z.command,menu:z.menu}}}finally{$=!1}}let R=Y.events.on("opened",(w)=>C(w.data.sessionId,w.data.payload),{signal:L.signal}),U=Y.events.on("notification",(w)=>{if(K&&O()===w.data.sessionId)B.ui.toast.show({title:"Claude",sessionID:w.data.sessionId,message:w.data.message,variant:w.data.kind})},{signal:L.signal});return B.keymap.layer(()=>({commands:[{id:"cortexkit.claude",title:"Claude",group:"Claude",palette:!0,slash:{name:"claude"},async run(){let w=O();if(!w){await B.ui.dialog.alert({title:"Claude",message:"Open a session before using the Claude menu."});return}let J=await Y.open({sessionId:w},{signal:L.signal,location:B.location});await C(w,J)}}]})),()=>{K=!1,L.abort(),R(),U()}}var T={id:"cortexkit-anthropic-auth",setup:V};export{V as setupAnthropicTui,T as default};

package/dist/v2/wire.d.ts

@@ -0,0 +1,36 @@
+import { type NativeAccountSnapshot } from '@cortexkit/anthropic-auth-core';
+import type { Plugin } from '@opencode/plugin';
+import type { Registration } from '@opencode/plugin/promise/registration';
+import type { NativeAnthropicRequestContext, NativeAnthropicResponseContext } from './adapter';
+import type { NativeSourceProvenance } from './source';
+/**
+ * Claude Code's billing header names the user prompt a request belongs to and
+ * the provider request-id of the previous request for that prompt. Track that
+ * chain per user turn with OpenCode's message IDs: one session spans many
+ * turns, so a session ID alone cannot tell which turn a request serves.
+ */
+export declare function createNativeWirePolicy(): {
+    install(ctx: Pick<Plugin.Context, 'session'>): Promise<Registration>;
+    requestOptions(input: NativeAnthropicRequestContext<NativeSourceProvenance>, snapshot: NativeAccountSnapshot): {
+        cache1hEnabled: boolean;
+        cache1hMode: "automatic" | "explicit" | "hybrid";
+        fastModeEnabled: boolean;
+        thinkingPrefixMismatchBehavior: "account-default" | "drop_block" | "error" | undefined;
+        midConversationEffortEnabled: boolean;
+        serverSideFallbackEnabled: boolean;
+        laneStart: boolean;
+        billingLineage: {
+            promptId: string;
+            previousRequestId: string | undefined;
+        } | undefined;
+        cacheDiagnosticsPreviousMessageId: string | undefined;
+    };
+    responseOptions(input: NativeAnthropicResponseContext<NativeSourceProvenance>): {
+        serverSideFallbackModel: string;
+        laneStart: boolean;
+        onMessageStart(message: Record<string, unknown>): void;
+        onStreamEnd(): void;
+    };
+    onRequestId(input: NativeAnthropicResponseContext<NativeSourceProvenance>, requestId: string): void;
+    forgetSession(sessionID: string): void;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/opencode-anthropic-auth",
-  "version": "1.22.0",
+  "version": "2.0.0",
   "type": "module",
   "repository": {
     "type": "git",
@@ -18,6 +18,14 @@
       "types": "./dist/tui.d.ts",
       "import": "./src/tui/entry.mjs"
     },
+    "./server": {
+      "types": "./dist/v2/server.d.ts",
+      "import": "./dist/v2/server.js"
+    },
+    "./rpc": {
+      "types": "./dist/rpc/rpc-client.d.ts",
+      "import": "./dist/rpc/rpc-client.js"
+    },
     "./tui-prefs": {
       "types": "./dist/tui-preferences.d.ts",
       "import": "./dist/tui-preferences.js"
@@ -45,9 +53,10 @@
     "LICENSE"
   ],
   "scripts": {
-    "build": "rm -rf dist && bun build src/index.ts src/cli.ts src/sidebar-state.ts src/tui-preferences.ts src/rpc/rpc-client.ts src/rpc/port-file.ts src/rpc/protocol.ts src/rpc/rpc-dir.ts --outdir dist --target node --format esm --splitting --external @opencode-ai/plugin --minify && tsc -p tsconfig.build.json --emitDeclarationOnly && bun run build:tui",
+    "build": "rm -rf dist && bun build src/index.ts src/v2/server.ts src/v2/tui.ts src/cli.ts src/sidebar-state.ts src/tui-preferences.ts src/rpc/rpc-client.ts src/rpc/port-file.ts src/rpc/protocol.ts src/rpc/rpc-dir.ts --outdir dist --root src --target node --format esm --splitting --external @opencode-ai/plugin --external @opencode/plugin --external jsonc-parser --minify && tsc -p tsconfig.build.json --emitDeclarationOnly && bun run build:tui && bun run check:bundle",
     "build:tui": "bun scripts/build-tui.ts",
     "smoke:tui": "bun scripts/smoke-tui-pack-install.ts",
+    "check:bundle": "bun scripts/check-bundle-globals.ts",
     "build:dev": "rm -rf dist && tsc -p tsconfig.build.json",
     "dev": "bun ../../scripts/dev.ts",
     "dev:clean": "bun ../../scripts/dev-clean.ts",
@@ -58,13 +67,24 @@
     "prepublishOnly": "bun run build"
   },
   "peerDependencies": {
-    "@opencode-ai/plugin": "*"
+    "@opencode-ai/plugin": "*",
+    "@opencode/plugin": ">=2.0.21"
+  },
+  "peerDependenciesMeta": {
+    "@opencode/plugin": {
+      "optional": true
+    }
   },
   "dependencies": {
-    "@cortexkit/anthropic-auth-core": "1.22.0",
-    "@opentui/core": "0.5.7",
-    "@opentui/solid": "0.5.7",
+    "@clack/prompts": "^1.6.0",
+    "@cortexkit/anthropic-auth-core": "2.0.0",
+    "@opentui/core": "0.5.11",
+    "@opentui/solid": "0.5.11",
     "jsonc-parser": "^3.3.1",
     "solid-js": "1.9.12"
+  },
+  "devDependencies": {
+    "@ai-sdk/anthropic": "4.0.58",
+    "@opencode/plugin": "2.0.22"
   }
 }

package/src/rpc/notifications.ts

@@ -1,54 +1,65 @@
+import type { CommandDialogPayload } from '@cortexkit/anthropic-auth-core'
 import type { OpenDialogPayload, RpcNotification } from './protocol'
 
 const QUEUE_CAP = 100
 const TUI_CONNECTED_WINDOW_MS = 3_000
 
+// One queue serves every RPC server in the process, and a process can hold one
+// server per project directory. Session ids are globally unique, so both
+// producers and drains require one: an unscoped drain could otherwise expose
+// another project's pending command dialog.
 let queue: RpcNotification[] = []
 let nextId = 1
-let lastDrainAtAny = 0
 const lastDrainAtBySession = new Map<string, number>()
 
+function assertSessionId(sessionId: string): void {
+  if (typeof sessionId !== 'string' || sessionId.length === 0) {
+    throw new TypeError('sessionId is required')
+  }
+}
+
 export function pushNotification(
-  payload: OpenDialogPayload,
-  sessionId?: string,
+  payload: OpenDialogPayload | CommandDialogPayload,
+  sessionId: string,
 ): void {
-  queue.push({ id: nextId++, type: 'open-dialog', payload, sessionId })
+  assertSessionId(sessionId)
+  if ('menu' in payload) {
+    if (payload.command !== 'claude' || payload.menu.command !== 'claude')
+      throw new TypeError('Only the claude menu is supported')
+    queue.push({ id: nextId++, type: 'open-menu', payload, sessionId })
+  } else {
+    queue.push({ id: nextId++, type: 'open-dialog', payload, sessionId })
+  }
   if (queue.length > QUEUE_CAP) queue = queue.slice(queue.length - QUEUE_CAP)
 }
 
 export function drainNotifications(
-  lastReceivedId = 0,
-  sessionId?: string,
+  lastReceivedId: number,
+  sessionId: string,
 ): RpcNotification[] {
-  const now = Date.now()
-  lastDrainAtAny = now
-  if (sessionId !== undefined) lastDrainAtBySession.set(sessionId, now)
-  const matches = (n: RpcNotification) =>
-    sessionId === undefined ||
-    n.sessionId === undefined ||
-    n.sessionId === sessionId
+  assertSessionId(sessionId)
+  lastDrainAtBySession.set(sessionId, Date.now())
   if (lastReceivedId > 0) {
-    queue = queue.filter((n) => {
-      if (n.id > lastReceivedId) return true
-      if (sessionId === undefined) return false
-      return n.sessionId !== sessionId
-    })
+    queue = queue.filter(
+      (notification) =>
+        notification.id > lastReceivedId ||
+        notification.sessionId !== sessionId,
+    )
   }
-  return queue.filter((n) => n.id > lastReceivedId && matches(n))
+  return queue.filter(
+    (notification) =>
+      notification.id > lastReceivedId && notification.sessionId === sessionId,
+  )
 }
 
-export function isTuiConnected(sessionId?: string): boolean {
+export function isTuiConnected(sessionId: string): boolean {
   const now = Date.now()
-  if (sessionId !== undefined) {
-    const at = lastDrainAtBySession.get(sessionId) ?? 0
-    return at > 0 && now - at < TUI_CONNECTED_WINDOW_MS
-  }
-  return lastDrainAtAny > 0 && now - lastDrainAtAny < TUI_CONNECTED_WINDOW_MS
+  const at = lastDrainAtBySession.get(sessionId) ?? 0
+  return at > 0 && now - at < TUI_CONNECTED_WINDOW_MS
 }
 
 export function resetNotificationsForTest(): void {
   queue = []
   nextId = 1
-  lastDrainAtAny = 0
   lastDrainAtBySession.clear()
 }

package/src/rpc/protocol.ts

@@ -1,3 +1,8 @@
+import type {
+  ClaustrumEnrollmentStatus,
+  CommandDialogPayload,
+} from '@cortexkit/anthropic-auth-core'
+
 export const COMMAND_MODAL_NAMES = [
   'claude-account',
   'claude-cache',
@@ -17,17 +22,31 @@ export type CommandModalName = (typeof COMMAND_MODAL_NAMES)[number]
 export interface AccountDialogAccount {
   id: string
   label: string
-  role: string
+  role: 'main' | 'fallback'
   enabled: boolean
   quotaPercent: number | null
   tierLabel?: string
   claustrumGate: 'on' | 'off' | 'na'
   vaultServed: boolean
+  vaultReauth: boolean
+  custodyState:
+    | 'na'
+    | 'off'
+    | 'on-vault-served'
+    | 'on-vault-reauth'
+    | 'on-cold'
+    | 'unknown-identity'
+    | 'on-identity-mismatch'
+    | 'on-corrupt-binding'
 }
 
 export interface AccountDialogKnobs {
   accounts: AccountDialogAccount[]
   claustrumDetection: string
+  custodyMode?: 'local' | 'claustrum'
+  custodyModeKnown?: boolean
+  enrollmentStatus?: string
+  claustrumEnrollment?: ClaustrumEnrollmentStatus
   [key: string]: unknown
 }
 
@@ -37,12 +56,10 @@ export interface OpenDialogPayload {
   knobs: Record<string, unknown>
 }
 
-export interface RpcNotification {
-  id: number
-  type: 'open-dialog'
-  payload: OpenDialogPayload
-  sessionId?: string
-}
+export type RpcNotification = { id: number; sessionId: string } & (
+  | { type: 'open-dialog'; payload: OpenDialogPayload }
+  | { type: 'open-menu'; payload: CommandDialogPayload }
+)
 
 export interface ApplyRequest {
   command: CommandModalName

package/src/rpc/rpc-client.ts

@@ -1,12 +1,17 @@
+import type {
+  CommandApplyRequest,
+  CommandApplyResult,
+} from '@cortexkit/anthropic-auth-core'
 import { discoverPortFile } from './port-file'
 import type { ApplyRequest, ApplyResult, RpcNotification } from './protocol'
 
 export interface RpcClient {
   pending: (
     lastReceivedId: number,
-    sessionId?: string,
+    sessionId: string,
   ) => Promise<RpcNotification[]>
   apply: (request: ApplyRequest) => Promise<ApplyResult>
+  applyMenu: (request: CommandApplyRequest) => Promise<CommandApplyResult>
 }
 
 async function call<T>(
@@ -58,5 +63,17 @@ export function createRpcClient(dir: string, expectedPid?: number): RpcClient {
       )
       return out ?? { text: 'apply failed', knobs: {} }
     },
+    async applyMenu(request) {
+      if (request.command !== 'claude' || !request.sessionId?.trim())
+        throw new TypeError('A claude menu sessionId is required')
+      const out = await call<CommandApplyResult>(
+        dir,
+        'apply-menu',
+        { ...request },
+        expectedPid,
+      )
+      if (!out) throw new Error('Menu apply unavailable; outcome unknown')
+      return out
+    },
   }
 }

package/src/rpc/rpc-server.ts

@@ -1,11 +1,16 @@
 import { randomBytes, timingSafeEqual } from 'node:crypto'
-import { unlink } from 'node:fs/promises'
+import { readFile, unlink } from 'node:fs/promises'
 import {
   createServer,
   type IncomingMessage,
   type ServerResponse,
 } from 'node:http'
 import { join } from 'node:path'
+import {
+  type CommandApplyRequest,
+  type CommandApplyResult,
+  parseApplyRequest,
+} from '@cortexkit/anthropic-auth-core'
 import type { drainNotifications } from './notifications'
 import { writePortFile } from './port-file'
 import type { ApplyRequest, ApplyResult } from './protocol'
@@ -19,7 +24,10 @@ export interface RpcServerHandle {
 export interface RpcServerOptions {
   dir: string
   drain: typeof drainNotifications
-  apply: (request: ApplyRequest) => Promise<ApplyResult>
+  /** Structured-menu hosts need no text parser; internal text consumers may still supply one. */
+  apply?: (request: ApplyRequest) => Promise<ApplyResult>
+  /** Run menu actions through the host's credential service, not legacy account-file writes. */
+  applyMenu?: (request: CommandApplyRequest) => Promise<CommandApplyResult>
 }
 
 function readBody(req: IncomingMessage): Promise<string> {
@@ -74,21 +82,36 @@ export async function startRpcServer(
         unknown
       >
       if (method === 'pending-notifications') {
+        if (
+          typeof params.sessionId !== 'string' ||
+          params.sessionId.length === 0
+        ) {
+          return json(400, { error: 'sessionId is required' })
+        }
         const messages = options.drain(
           Number(params.lastReceivedId ?? 0),
-          typeof params.sessionId === 'string' ? params.sessionId : undefined,
+          params.sessionId,
         )
         return json(200, { messages })
       }
       if (method === 'apply') {
+        if (!options.apply)
+          return json(501, { error: 'text apply unavailable' })
         const result = await options.apply(params as unknown as ApplyRequest)
         return json(200, result)
       }
+      if (method === 'apply-menu') {
+        const request = parseApplyRequest(params)
+        if (request?.command !== 'claude' || !request.sessionId?.trim())
+          return json(400, { error: 'invalid menu request' })
+        if (!options.applyMenu) return json(501, { error: 'menu unavailable' })
+        return json(200, await options.applyMenu(request))
+      }
       return json(404, { error: 'unknown method' })
-    } catch (error) {
+    } catch {
       if (!res.headersSent && !res.writableEnded && !res.destroyed) {
         json(500, {
-          error: error instanceof Error ? error.message : String(error),
+          error: 'RPC request failed',
         })
       }
     }
@@ -115,9 +138,16 @@ export async function startRpcServer(
     token,
     async stop() {
       await new Promise<void>((resolve) => server.close(() => resolve()))
-      await unlink(join(options.dir, `port-${process.pid}.json`)).catch(
-        () => {},
-      )
+      try {
+        const portFile = join(options.dir, `port-${process.pid}.json`)
+        const current = JSON.parse(await readFile(portFile, 'utf8')) as {
+          port?: unknown
+          pid?: unknown
+        }
+        if (current.port === port && current.pid === process.pid) {
+          await unlink(portFile)
+        }
+      } catch {}
     },
   }
 }

package/src/rpc/server-registry.ts

@@ -0,0 +1,61 @@
+import type { RpcServerHandle } from './rpc-server'
+
+type RpcServerGlobal = typeof globalThis & {
+  __anthropicAuthRpcServers?: Map<string, RpcServerHandle>
+  __anthropicAuthRpcServersPending?: Map<string, Promise<void>>
+}
+
+export interface RpcServerAdoption {
+  server: RpcServerHandle
+  release: () => Promise<void>
+}
+
+/**
+ * Serializes same-directory replacement and returns an identity-fenced lease.
+ * Distinct project directories remain independent.
+ */
+export async function adoptRpcServer(
+  rpcDir: string,
+  create: () => Promise<RpcServerHandle>,
+): Promise<RpcServerAdoption> {
+  const rpcGlobal = globalThis as RpcServerGlobal
+  const servers =
+    rpcGlobal.__anthropicAuthRpcServers ?? new Map<string, RpcServerHandle>()
+  const pending =
+    rpcGlobal.__anthropicAuthRpcServersPending ??
+    new Map<string, Promise<void>>()
+  rpcGlobal.__anthropicAuthRpcServers = servers
+  rpcGlobal.__anthropicAuthRpcServersPending = pending
+
+  const predecessor = pending.get(rpcDir) ?? Promise.resolve()
+  let server: RpcServerHandle | undefined
+  const start = predecessor
+    .catch(() => {})
+    .then(async () => {
+      const previous = servers.get(rpcDir)
+      if (previous) {
+        await previous.stop()
+        if (servers.get(rpcDir) === previous) servers.delete(rpcDir)
+      }
+      server = await create()
+      servers.set(rpcDir, server)
+    })
+  pending.set(rpcDir, start)
+
+  try {
+    await start
+  } finally {
+    if (pending.get(rpcDir) === start) pending.delete(rpcDir)
+  }
+  const adoptedServer = server
+  if (!adoptedServer) throw new Error('RPC server failed to start')
+
+  return {
+    server: adoptedServer,
+    release: async () => {
+      if (servers.get(rpcDir) !== adoptedServer) return
+      await adoptedServer.stop()
+      if (servers.get(rpcDir) === adoptedServer) servers.delete(rpcDir)
+    },
+  }
+}

package/src/sidebar-state.ts

@@ -36,6 +36,16 @@ export interface SidebarAccountState {
   needsReauth: boolean
   // True when the vault copy needs re-importing while the sidecar remains usable.
   vaultReauth?: boolean
+  // A gate alone does not prove the sidecar can serve a request.
+  vaultServed?: boolean
+  custodyState?:
+    | 'off'
+    | 'on-vault-served'
+    | 'on-vault-reauth'
+    | 'on-cold'
+    | 'unknown-identity'
+    | 'on-identity-mismatch'
+    | 'on-corrupt-binding'
   tierLabel?: string
 }
 
@@ -59,7 +69,7 @@ export interface PrimeSidebarAccountState {
   label: string
   nextDueAt?: number | null
   lastPrimedAt?: number | null
-  lastResult?: 'ok' | 'error'
+  lastResult?: 'ok' | 'error' | 'skipped'
   usage?: PrimeUsageCounters
   estimatedCostUsd?: number
 }
@@ -180,7 +190,11 @@ function normalizePrimeAccount(
   } else if (isFiniteNumber(value.lastPrimedAt)) {
     account.lastPrimedAt = value.lastPrimedAt
   }
-  if (value.lastResult === 'ok' || value.lastResult === 'error') {
+  if (
+    value.lastResult === 'ok' ||
+    value.lastResult === 'error' ||
+    value.lastResult === 'skipped'
+  ) {
     account.lastResult = value.lastResult
   }
   const usage = normalizePrimeUsage(value.usage)
@@ -338,6 +352,11 @@ export function normalizeSidebarState(raw: unknown): SidebarState {
           needsReauth:
             typeof entry.needsReauth === 'boolean' ? entry.needsReauth : false,
           ...(entry.vaultReauth === true && { vaultReauth: true }),
+          ...(entry.vaultServed === true && { vaultServed: true }),
+          ...(typeof entry.custodyState === 'string' && {
+            custodyState:
+              entry.custodyState as SidebarAccountState['custodyState'],
+          }),
           tierLabel:
             typeof entry.tierLabel === 'string' && entry.tierLabel.trim()
               ? entry.tierLabel.trim()
@@ -817,6 +836,8 @@ export function formatFallbackModelLabel(modelId: string | undefined): string {
     return 'Fable 5.1'
   if (modelId === 'claude-fable-5' || modelId?.startsWith('claude-fable-5-'))
     return 'Fable 5'
+  if (modelId === 'claude-opus-5-5' || modelId?.startsWith('claude-opus-5-5-'))
+    return 'Opus 5.5'
   if (modelId === 'claude-opus-5' || modelId?.startsWith('claude-opus-5-'))
     return 'Opus 5'
   if (modelId === 'claude-opus-4-8' || modelId?.startsWith('claude-opus-4-8-'))
@@ -844,6 +865,9 @@ export function formatPrimeAccountValue(account: PrimeSidebarAccountState): {
   if (account.lastResult === 'error') {
     return { text: 'err', hasError: true }
   }
+  if (account.lastResult === 'skipped') {
+    return { text: 'skip', hasError: false }
+  }
   if (account.nextDueAt && account.nextDueAt > Date.now()) {
     return { text: formatPrimeTime(account.nextDueAt), hasError: false }
   }