@cortexkit/opencode-anthropic-auth 2.0.1 → 2.0.3

package/dist/setup/command.d.ts

@@ -1,20 +1,11 @@
-import type { Writable } from 'node:stream';
-import { detectAll } from './detect.ts';
-import { activateNativeVaultForHost } from './native-activation.ts';
+import { type SetupIO } from '@cortexkit/anthropic-auth-core';
+import { completeNativeVaultActivation, preflightNativeVaultForHost } from './native-activation.ts';
 import { migrateNativeLocalForHost } from './native-local.ts';
 import { loginNativeOffline } from './native-login.ts';
-import type { CommandRunner, ProcessFence } from './types.ts';
-export interface SetupCommandOptions {
-    runner?: CommandRunner;
-    fence?: ProcessFence;
-    env?: NodeJS.ProcessEnv;
-    isInteractive?: boolean;
-    /** Let tests substitute host detection and per-host vault activation. */
-    detect?: typeof detectAll;
-    activate?: typeof activateNativeVaultForHost;
+export interface SetupCommandOptions extends SetupIO {
     migrateLocal?: typeof migrateNativeLocalForHost;
     localLogin?: typeof loginNativeOffline;
-    /** Where setup prints its progress and errors; defaults to stdout. */
-    output?: Writable;
+    vaultPreflight?: typeof preflightNativeVaultForHost;
+    vaultActivate?: typeof completeNativeVaultActivation;
 }
 export declare function runSetupCommand(argv?: string[], options?: SetupCommandOptions): Promise<number>;

package/dist/setup/native-activation.d.ts

@@ -1,7 +1,7 @@
 import { type NativeCustodyActivationHooks, type NativeCustodyInventory } from '@cortexkit/anthropic-auth-core';
 import { type NativeVaultEnrollmentOptions } from './native-enrollment.ts';
 import { type NativeSetupPaths } from './native-paths.ts';
-import type { CommandRunner, HarnessKind, ProcessFence } from './types.ts';
+import { type CommandRunner, type HarnessKind, type ProcessFence } from './types.ts';
 export declare class NativeVaultActivationError extends Error {
     readonly code: 'auth-content-refused' | 'host-auth-invalid' | 'primary-conflict' | 'consent-required' | 'primary-unverified';
     constructor(code: 'auth-content-refused' | 'host-auth-invalid' | 'primary-conflict' | 'consent-required' | 'primary-unverified');
@@ -17,13 +17,21 @@ export interface NativeVaultActivationOptions {
      * production resolves them from the host's environment.
      */
     paths?: NativeSetupPaths;
+    /** Set false for OpenCode 2, whose setup must not read the OpenCode 1 auth file. */
+    inspectOpenCodeAuth?: boolean;
     enrollment?: Pick<NativeVaultEnrollmentOptions, 'paths' | 'client' | 'ckBinary' | 'connectionFile'>;
     discover?: () => Promise<NativeCustodyInventory>;
     hooks?: NativeCustodyActivationHooks;
 }
-/**
- * Enroll this stopped host, discover its verified default vault account and
- * leave the host auth slot untouched. Local credentials, migration journal,
- * account metadata and routing assignments are not inputs to this operation.
- */
+export interface NativeVaultPreflight {
+    priorMode: 'local' | 'claustrum';
+    fingerprint: string;
+    separateOpenCodeLogin?: boolean;
+}
+export declare function fingerprintNativeVaultInputs(host: HarnessKind, options: NativeVaultActivationOptions): Promise<string>;
+/** Validate vault inputs before the runner enrolls any selected host. */
+export declare function preflightNativeVaultForHost(host: HarnessKind, options: NativeVaultActivationOptions): Promise<NativeVaultPreflight>;
+/** Grant native-account read access and require a vault-backed default Claude account with an account identity before moving Pi's login aside. */
+export declare function completeNativeVaultActivation(host: HarnessKind, options: NativeVaultActivationOptions, preflight: NativeVaultPreflight): Promise<'committed' | 'already-vault'>;
+/** Outside runSetup, check inputs, enroll the host, then grant and activate vault access. runSetup owns enrollment and calls preflight and completion separately. */
 export declare function activateNativeVaultForHost(host: HarnessKind, options: NativeVaultActivationOptions): Promise<'committed' | 'already-vault'>;

package/dist/setup/native-enrollment.d.ts

@@ -1,5 +1,16 @@
 import { type ClaustrumEnrollmentClient, type ClaustrumEnrollmentPaths } from '@cortexkit/common-auth/claustrum';
 import type { CommandRunner, HarnessKind } from './types.ts';
+export declare const NATIVE_VAULT_HOST_NAMES: {
+    readonly opencode: "anthropic-auth-opencode";
+    readonly pi: "anthropic-auth-pi";
+};
+/** Convert the token file resolved by getHostClaustrumEnrollmentPaths into runSetup's path inputs; the runner derives the matching state file itself. */
+export declare function nativeVaultHostPaths(host: HarnessKind, env: NodeJS.ProcessEnv): {
+    stateDir: string;
+    host: HarnessKind;
+    override: string;
+};
+export declare function nativeVaultConnectionFile(host: HarnessKind, env: NodeJS.ProcessEnv): string;
 export interface NativeVaultEnrollmentOptions {
     env: NodeJS.ProcessEnv;
     runner: CommandRunner;
@@ -13,6 +24,8 @@ export interface NativeVaultEnrollmentOptions {
     client?: ClaustrumEnrollmentClient;
     ckBinary?: string;
     connectionFile?: string;
+    /** Defaults to granting native-account read access after enrollment. False leaves that grant to completeNativeVaultActivation, avoiding a duplicate grant. */
+    grantPermissions?: boolean;
 }
 export declare class NativeVaultEnrollmentError extends Error {
     readonly code: 'enrollment-refused' | 'enrollment-reset' | 'approval-refused' | 'permission-refused';
@@ -24,3 +37,5 @@ export declare class NativeVaultEnrollmentError extends Error {
  * account discovery and the credential-store switch are separate setup steps.
  */
 export declare function enrollNativeVaultForHost(host: HarnessKind, options: NativeVaultEnrollmentOptions): Promise<void>;
+/** Grant this OpenCode or Pi principal read access to the vault's anthropic-native category; enrollment alone grants no provider access. */
+export declare function grantNativeVaultForHost(host: HarnessKind, options: Pick<NativeVaultEnrollmentOptions, 'env' | 'runner' | 'processFence' | 'ckBinary'>): Promise<void>;

package/dist/setup/native-local.d.ts

@@ -1,5 +1,6 @@
+import { type NativeMigrationPreflight, readNativeMigrationJournal } from '@cortexkit/anthropic-auth-core';
 import { type NativeSetupPaths } from './native-paths';
-import type { HarnessKind, ProcessFence } from './types';
+import { type HarnessKind, type ProcessFence } from './types';
 export interface NativeOfflineLogin {
     credential: {
         type: 'oauth';
@@ -15,6 +16,35 @@ export interface NativeLocalSetupOptions {
     paths?: NativeSetupPaths;
     removePiAnthropicAuth: boolean;
     login?: (host: HarnessKind) => Promise<NativeOfflineLogin>;
+    preflight?: NativeMigrationPreflight;
+    skipMigration?: boolean;
+    beforeCommit?: () => Promise<void>;
 }
+export declare const SEPARATE_HOST_LOGIN_NOTICE = "OpenCode's separate Anthropic login is not used. Add that account through /claude Accounts if needed, or remove the separate login from OpenCode.";
+export declare function requireNativeLocalEnrollment(hosts: readonly HarnessKind[], env: NodeJS.ProcessEnv): Promise<void>;
+export declare function nativeLocalProcessFence(host: HarnessKind, options: NativeLocalSetupOptions): () => Promise<void>;
+export declare function nativeSetupFileFingerprint(path: string): Promise<string>;
+export declare function inspectSetupHostAuth(host: HarnessKind, path: string): Promise<{
+    kind: 'absent' | 'oauth' | 'api' | 'api_key' | 'activation';
+    digest: string;
+    realLogin: boolean;
+}>;
+export interface NativeLocalPlan {
+    paths: NativeSetupPaths;
+    generation2: boolean;
+    action: 'migration' | 'skip' | 'empty-init' | 'reuse';
+    slot?: Awaited<ReturnType<typeof inspectSetupHostAuth>>;
+    notice: boolean;
+    preflight?: NativeMigrationPreflight;
+    fingerprint: string;
+    authorityPhase: NonNullable<Awaited<ReturnType<typeof readNativeMigrationJournal>>>['phase'] | 'absent';
+    poolPopulation: boolean | 'not-evaluated';
+}
+/** Hash pool, journal and routing bytes and the host's Anthropic entry, so a credential replacement cannot hide behind an unchanged account count. */
+export declare function fingerprintNativeLocalPlan(plan: NativeLocalPlan, env: NodeJS.ProcessEnv): Promise<string>;
+/** Record journal status, the host's Anthropic entry and whether setup will import, skip import or initialize a new pool, without writing. */
+export declare function planNativeLocalSetup(host: HarnessKind, options: NativeLocalSetupOptions, generation2: boolean): Promise<NativeLocalPlan>;
+export declare function revalidateNativeLocalPlan(plan: NativeLocalPlan, options: NativeLocalSetupOptions): Promise<void>;
+export declare function installAbsentNativePlaceholder(plan: Pick<NativeLocalPlan, 'paths' | 'slot'>, options: NativeLocalSetupOptions): Promise<void>;
 /** Transfer local credentials while hosts are stopped, before telling the user to restart. */
 export declare function migrateNativeLocalForHost(host: HarnessKind, options: NativeLocalSetupOptions): Promise<void>;

package/dist/setup/process-fence.d.ts

@@ -1,4 +1,3 @@
-import type { CommandRunner, ProcessFence } from './types.ts';
 export declare class ProcessInspectionError extends Error {
     readonly code = "process-inspection-failed";
     constructor();
@@ -13,8 +12,3 @@ export declare class ProcessFenceViolationError extends Error {
         command: string;
     }>);
 }
-export declare function createProcessFence(runner?: CommandRunner, options?: {
-    platform?: NodeJS.Platform;
-}): ProcessFence;
-export declare const defaultProcessFence: ProcessFence;
-export declare function assertHostsStopped(fence?: ProcessFence): Promise<void>;

package/dist/setup/types.d.ts

@@ -1,4 +1,11 @@
 export type HarnessKind = 'opencode' | 'pi';
+export declare function setupRefusalMessage(error: unknown): string | undefined;
+/** runSetup prints failures from its own stopped-host checks; provider callbacks need a displayable refusal for their separate process checks. */
+export declare function setupProcessInspectionMessage(error: unknown): string | undefined;
+/** A setup refusal whose message is safe to show on the terminal. */
+export declare class SetupRefusal extends Error {
+    constructor(message: string);
+}
 export interface HostDetection {
     kind: HarnessKind;
     installed: boolean;
@@ -22,6 +29,8 @@ export interface CommandRunnerResult {
     exitCode: number;
     stdout: string;
     stderr: string;
+    signal?: NodeJS.Signals | null;
+    spawnError?: boolean;
 }
 export interface CommandRunner {
     run(command: string, args: string[], options?: {

package/dist/sidebar-state.d.ts

@@ -2,6 +2,7 @@ export interface QuotaWindow {
     usedPercent: number;
     remainingPercent: number;
     resetsAt?: string;
+    checkedAt?: number;
 }
 export interface ScopedQuotaWindow extends QuotaWindow {
     id: string;
@@ -10,6 +11,7 @@ export interface ScopedQuotaWindow extends QuotaWindow {
     modelName: string;
 }
 export interface AccountQuota {
+    checkedAt?: number;
     five_hour?: QuotaWindow;
     seven_day?: QuotaWindow;
     scoped?: ScopedQuotaWindow[];
@@ -36,6 +38,8 @@ export interface SidebarAccountState {
     label: string | undefined;
     quota: AccountQuota | null;
     enabled: boolean;
+    stateLine?: string;
+    quotaDated?: boolean;
     needsReauth: boolean;
     vaultReauth?: boolean;
     vaultServed?: boolean;
@@ -68,7 +72,10 @@ export interface PrimeSidebarAccountState {
 export interface SidebarState {
     main: {
         quota: AccountQuota | null;
+        enabled?: boolean;
         tierLabel?: string;
+        stateLine?: string;
+        quotaDated?: boolean;
         quotaBackedOff?: boolean;
         quotaBackoffUntil?: number;
         refreshBackedOff?: boolean;
@@ -140,8 +147,9 @@ export declare function resolveActiveAccount(state: SidebarState): {
     id: string;
     name: string;
     quota: AccountQuota | null;
+    stateLine?: string;
+    quotaDated?: boolean;
 };
-export declare function formatScopedQuotaLabel(title: string): string;
 /**
  * Pretty label for a recoverable-refusal source model (Fable 5/5.1 or Opus 5).
  * Falls back to the raw id for unrecognized ids so the sidebar never goes
@@ -155,12 +163,22 @@ export declare function formatPrimeAccountValue(account: PrimeSidebarAccountStat
     hasError: boolean;
 };
 export declare function getFableRecoverySummary(state: SidebarState, sessionId: string): string | undefined;
-export declare function getCollapsedQuotaSummary(quota: AccountQuota | null): {
+/** Keep full shared names when they fit; truncate only to preserve row columns. */
+export declare function formatQuotaRowLabel(name: string, width?: number): string;
+export declare function getCollapsedQuotaSummary(quota: AccountQuota | null, now?: number): {
     fiveHourUsedPercent: number | null;
     sevenDayUsedPercent: number | null;
     scopedUsedPercents: number[];
     text: string | null;
+    stale: boolean;
 };
+export declare function getCollapsedAccounts(state: SidebarState, showFallbacks?: boolean): {
+    id: string;
+    name: string;
+    quota: AccountQuota | null;
+    quotaDated: boolean | undefined;
+    active: boolean;
+}[];
 export declare const FIVE_HOUR_MS: number;
 export declare const SEVEN_DAY_MS: number;
 export interface QuotaPacing {

package/dist/sidebar-state.js

@@ -1 +1 @@
-import{F as a,G as b,H as c,I as d,J as e,K as f,L as g,M as h,N as i,O as j,P as k,Q as l,R as m,S as n,T as o,U as p,V as q,W as r,X as s,Y as t,Z as u}from"./index-04syas8a.js";import"./index-yxtdke11.js";import"./index-p4wvcwhh.js";import"./index-3xqv3rw3.js";export{i as setSidebarState,k as resolveActiveAccount,c as normalizeSidebarState,a as getSidebarStateFile,h as getSidebarState,f as getInitialSidebarRoutingTestHooks,q as getFableRecoverySummary,r as getCollapsedQuotaSummary,l as formatScopedQuotaLabel,n as formatPrimeTime,o as formatPrimeCost,p as formatPrimeAccountValue,m as formatFallbackModelLabel,j as drainSidebarWrites,u as computeQuotaPacing,d as __setSidebarStateWriteTestHooks,e as __setInitialSidebarRoutingTestHooks,g as __acquireSidebarStateLockForTest,t as SEVEN_DAY_MS,s as FIVE_HOUR_MS,b as DEFAULT_SIDEBAR_STATE};
+import{F as a,G as b,H as c,I as d,J as e,K as f,L as g,M as h,N as i,O as j,P as k,Q as l,R as m,S as n,T as o,U as p,V as q,W as r,X as s,Y as t,Z as u,_ as v}from"./index-qttfa42y.js";import"./index-mdpyfkv3.js";import"./index-fncp6r0j.js";import"./index-rftced5v.js";export{i as setSidebarState,k as resolveActiveAccount,c as normalizeSidebarState,a as getSidebarStateFile,h as getSidebarState,f as getInitialSidebarRoutingTestHooks,p as getFableRecoverySummary,r as getCollapsedQuotaSummary,s as getCollapsedAccounts,q as formatQuotaRowLabel,m as formatPrimeTime,n as formatPrimeCost,o as formatPrimeAccountValue,l as formatFallbackModelLabel,j as drainSidebarWrites,v as computeQuotaPacing,d as __setSidebarStateWriteTestHooks,e as __setInitialSidebarRoutingTestHooks,g as __acquireSidebarStateLockForTest,u as SEVEN_DAY_MS,t as FIVE_HOUR_MS,b as DEFAULT_SIDEBAR_STATE};

package/dist/transform.d.ts

@@ -2,6 +2,17 @@ import { type BillingLineageFields, type Cache1hMode, type ClaudeCodeIdentity, t
 import { type OpenCodeEffortMarkerPlan } from './effort-history';
 import { type ServerSideFallbackOutcome } from './server-fallback';
 export declare const NON_STREAMING_DIAGNOSTICS_MAX_BYTES: number;
+/** Request-local response spellings; null marks a spelling shared by multiple tools. */
+export type ToolNameMap = ReadonlyMap<string, string | null> & {
+    readonly declaredHostNames: ReadonlySet<string>;
+    readonly hazardousWireNames: ReadonlySet<string>;
+};
+export declare function normalizeToolNameResponseError(error: unknown, toolNameMap?: ToolNameMap): unknown;
+export declare function cancelUnsafeToolNameResponse(reader: {
+    cancel(reason?: unknown): Promise<void>;
+    readonly closed: Promise<void>;
+    releaseLock(): void;
+}, error: unknown): Promise<void>;
 export type FetchInput = string | URL | Request;
 /**
  * Merge headers from a Request object and/or a RequestInit headers value
@@ -27,9 +38,10 @@ export declare function setOAuthHeaders(headers: Headers, accessToken: string, o
  */
 export declare function prefixToolNames(parsed: Record<string, unknown>): string;
 /**
- * Strip TOOL_PREFIX from tool names in streaming response text.
+ * Use the map supplied to onToolNameMap by rewriteRequestBody for this response's request.
+ * Unmatched or ambiguous names stay unchanged for the host to handle.
  */
-export declare function stripToolPrefix(text: string): string;
+export declare function stripToolPrefix(text: string, toolNameMap?: ToolNameMap): string;
 /**
  * Check if TLS verification should be skipped for custom API endpoints.
  * Only effective when ANTHROPIC_BASE_URL is also set.
@@ -100,6 +112,7 @@ export declare function rewriteRequestBody(body: string, options?: {
     laneStart?: boolean;
     billingLineage?: BillingLineageFields;
     cacheDiagnosticsPreviousMessageId?: string | null;
+    onToolNameMap?: (map: ToolNameMap) => void;
 }): Promise<string>;
 type RelayUpstreamStatus = {
     status: number;
@@ -109,6 +122,8 @@ type RelayUpstreamStatus = {
  * Create a streaming response that strips the tool prefix from tool names.
  */
 export declare function createStrippedStream(response: Response, options?: {
+    toolNameMap?: ToolNameMap;
+    onToolNameRefusal?: () => void;
     perf?: RewritePerfCallback;
     onContentFilter?: (context?: {
         completedToolUse: boolean;

package/dist/tui-preferences.js

@@ -1,4 +1,4 @@
-import"./index-3xqv3rw3.js";import{readFileSync as k,watch as C}from"node:fs";import{mkdir as _,readFile as I,rename as E,writeFile as b}from"node:fs/promises";import{homedir as g}from"node:os";import{basename as F,dirname as P,join as N}from"node:path";import{clearTimeout as D,setTimeout as L}from"node:timers";import{applyEdits as T,modify as y,parse as f}from"jsonc-parser";var v="OPENCODE_TUI_PREFERENCES_FILE",h="tui-preferences.jsonc";function A(){let J=process.env[v];if(J)return J;let z=process.env.OPENCODE_CONFIG_DIR||N(process.env.XDG_CONFIG_HOME||N(g(),".config"),"opencode");return N(z,h)}function H(J){return typeof J==="object"&&J!==null&&!Array.isArray(J)}async function qq(){try{let J=await I(A(),"utf8"),z=[],q=f(J,z,{allowTrailingComma:!0});if(z.length>0)return{};return H(q)?q:{}}catch{return{}}}var m="anthropic-auth",p=160,R={forceToTop:!1,order:p,startCollapsed:!1,rememberCollapsed:!0,collapsed:null,pollMs:1500,refreshDebounceMs:200,header:{label:"CLAUDE",showVersion:!0},sections:{quota:!0,fallbackAccounts:!0,routing:!0,cache:!0,health:!0,pacing:!0},appearance:{barWidth:10,barFilledChar:"█",barEmptyChar:"░",warnThreshold:50,errorThreshold:80}};function $(J,z){return typeof J==="boolean"?J:z}function Y(J,z,q,X){if(typeof J!=="number"||!Number.isFinite(J))return z;return Math.min(Math.max(Math.round(J),q),X)}function c(J,z,q){if(typeof J!=="string"||J.length===0)return z;return J.slice(0,q)}function w(J,z){if(typeof J!=="string")return z;return[...J][0]??z}function zq(J){let z=J[m];if(!H(z))return structuredClone(R);let q=R,X=H(z.header)?z.header:{},Q=H(z.sections)?z.sections:{},Z=H(z.appearance)?z.appearance:{},G=Y(Z.warnThreshold,q.appearance.warnThreshold,0,99),V=Math.max(Y(Z.errorThreshold,q.appearance.errorThreshold,0,100),Math.min(G+1,100));return{forceToTop:$(z.forceToTop,q.forceToTop),order:Y(z.order,q.order,-1e4,1e4),startCollapsed:$(z.startCollapsed,q.startCollapsed),rememberCollapsed:$(z.rememberCollapsed,q.rememberCollapsed),collapsed:typeof z.collapsed==="boolean"?z.collapsed:null,pollMs:Y(z.pollMs,q.pollMs,500,30000),refreshDebounceMs:Y(z.refreshDebounceMs,q.refreshDebounceMs,50,5000),header:{label:c(X.label,q.header.label,20),showVersion:$(X.showVersion,q.header.showVersion)},sections:{quota:$(Q.quota,q.sections.quota),fallbackAccounts:$(Q.fallbackAccounts,q.sections.fallbackAccounts),routing:$(Q.routing,q.sections.routing),cache:$(Q.cache,q.sections.cache),health:$(Q.health,q.sections.health),pacing:$(Q.pacing,q.sections.pacing)},appearance:{barWidth:Y(Z.barWidth,q.appearance.barWidth,4,40),barFilledChar:w(Z.barFilledChar,q.appearance.barFilledChar),barEmptyChar:w(Z.barEmptyChar,q.appearance.barEmptyChar),warnThreshold:G,errorThreshold:V}}}var u=-1e5;function Jq(J,z,q){let X=J[z];if(!H(X))return q;if(X.forceToTop===!0)return u+Object.keys(J).indexOf(z);return Y(X.order,q,-1e4,1e4)}var s=`// Shared preferences for opencode TUI plugins.
+import"./index-rftced5v.js";import{readFileSync as k,watch as C}from"node:fs";import{mkdir as _,readFile as I,rename as E,writeFile as b}from"node:fs/promises";import{homedir as g}from"node:os";import{basename as F,dirname as P,join as N}from"node:path";import{clearTimeout as D,setTimeout as L}from"node:timers";import{applyEdits as T,modify as y,parse as f}from"jsonc-parser";var v="OPENCODE_TUI_PREFERENCES_FILE",h="tui-preferences.jsonc";function A(){let J=process.env[v];if(J)return J;let z=process.env.OPENCODE_CONFIG_DIR||N(process.env.XDG_CONFIG_HOME||N(g(),".config"),"opencode");return N(z,h)}function H(J){return typeof J==="object"&&J!==null&&!Array.isArray(J)}async function qq(){try{let J=await I(A(),"utf8"),z=[],q=f(J,z,{allowTrailingComma:!0});if(z.length>0)return{};return H(q)?q:{}}catch{return{}}}var m="anthropic-auth",p=160,R={forceToTop:!1,order:p,startCollapsed:!1,rememberCollapsed:!0,collapsed:null,pollMs:1500,refreshDebounceMs:200,header:{label:"CLAUDE",showVersion:!0},sections:{quota:!0,fallbackAccounts:!0,routing:!0,cache:!0,health:!0,pacing:!0},appearance:{barWidth:10,barFilledChar:"█",barEmptyChar:"░",warnThreshold:50,errorThreshold:80}};function $(J,z){return typeof J==="boolean"?J:z}function Y(J,z,q,X){if(typeof J!=="number"||!Number.isFinite(J))return z;return Math.min(Math.max(Math.round(J),q),X)}function c(J,z,q){if(typeof J!=="string"||J.length===0)return z;return J.slice(0,q)}function w(J,z){if(typeof J!=="string")return z;return[...J][0]??z}function zq(J){let z=J[m];if(!H(z))return structuredClone(R);let q=R,X=H(z.header)?z.header:{},Q=H(z.sections)?z.sections:{},Z=H(z.appearance)?z.appearance:{},G=Y(Z.warnThreshold,q.appearance.warnThreshold,0,99),V=Math.max(Y(Z.errorThreshold,q.appearance.errorThreshold,0,100),Math.min(G+1,100));return{forceToTop:$(z.forceToTop,q.forceToTop),order:Y(z.order,q.order,-1e4,1e4),startCollapsed:$(z.startCollapsed,q.startCollapsed),rememberCollapsed:$(z.rememberCollapsed,q.rememberCollapsed),collapsed:typeof z.collapsed==="boolean"?z.collapsed:null,pollMs:Y(z.pollMs,q.pollMs,500,30000),refreshDebounceMs:Y(z.refreshDebounceMs,q.refreshDebounceMs,50,5000),header:{label:c(X.label,q.header.label,20),showVersion:$(X.showVersion,q.header.showVersion)},sections:{quota:$(Q.quota,q.sections.quota),fallbackAccounts:$(Q.fallbackAccounts,q.sections.fallbackAccounts),routing:$(Q.routing,q.sections.routing),cache:$(Q.cache,q.sections.cache),health:$(Q.health,q.sections.health),pacing:$(Q.pacing,q.sections.pacing)},appearance:{barWidth:Y(Z.barWidth,q.appearance.barWidth,4,40),barFilledChar:w(Z.barFilledChar,q.appearance.barFilledChar),barEmptyChar:w(Z.barEmptyChar,q.appearance.barEmptyChar),warnThreshold:G,errorThreshold:V}}}var u=-1e5;function Jq(J,z,q){let X=J[z];if(!H(X))return q;if(X.forceToTop===!0)return u+Object.keys(J).indexOf(z);return Y(X.order,q,-1e4,1e4)}var s=`// Shared preferences for opencode TUI plugins.
 // One top-level key per plugin (short name). See each plugin's README for
 // its supported settings. This file is safe to hand-edit; plugins update
 // individual keys in place and preserve comments.

package/dist/tui.d.ts

@@ -1,7 +1,5 @@
 /** @jsxImportSource @opentui/solid */
-import { formatQuotaMoney } from '@cortexkit/anthropic-auth-core';
 import type { TuiPluginModule } from '@opencode-ai/plugin/tui';
-export { formatQuotaMoney };
 declare const plugin: TuiPluginModule & {
     id: string;
 };

package/dist/v2/activation.d.ts

@@ -1,5 +1,7 @@
 /** Explicit sign-in to the native Claude account pool creates this OAuth connection. Startup leaves existing OpenCode connections unchanged. */
 export declare const CLAUDE_POOL_LOGIN_METHOD_ID = "native-claude-oauth";
+export declare const CLAUDE_POOL_LOGIN_METHOD_LABEL = "Claude Pro / Max (native account pool)";
+export declare const CLAUDE_POOL_LOGIN_STEP = "In OpenCode, sign in to Anthropic with \"Claude Pro / Max (native account pool)\".";
 /**
  * Connects OpenCode to the Claude accounts held in the vault. It signs in to
  * nothing and stores no local account; only the host's placeholder is written.

package/dist/v2/adapter.d.ts

@@ -99,9 +99,10 @@ type RewriteBodyOptions = NonNullable<Parameters<typeof rewriteRequestBody>[1]>;
  * lineage, effort plan, cache, fast mode, safety and diagnostics inputs. Two
  * options are left out because the adapter sets them: the Claude Code
  * identity, which the source returns with the credential, and the session id,
- * which is the host's own session id for the request.
+ * which is the host's own session id for the request. The tool-name callback
+ * is private to the adapter so response names stay bound to that send.
  */
-export type NativeAnthropicBodyOptions = Omit<RewriteBodyOptions, 'identity' | 'sessionId'>;
+export type NativeAnthropicBodyOptions = Omit<RewriteBodyOptions, 'identity' | 'sessionId' | 'onToolNameMap'>;
 type StrippedStreamOptions = NonNullable<Parameters<typeof createStrippedStream>[1]>;
 /**
  * The response observers a source may attach to an OAuth response. Content
@@ -160,6 +161,11 @@ export interface NativeAnthropicSource<Q, P> {
     readonly requestOptions?: (input: NativeAnthropicRequestContext<P>) => Promise<NativeAnthropicBodyOptions> | NativeAnthropicBodyOptions;
     /** Rechecks policy after asynchronous rewriting, immediately before dispatch. */
     readonly admitRequest?: (input: NativeAnthropicAttemptContext<P>) => Promise<void> | void;
+    /** Observe the admitted OAuth wire body before any relay envelope is added. */
+    readonly onRequestPrepared?: (input: NativeAnthropicAttemptContext<P> & {
+        readonly url: string;
+        readonly bodyText: string;
+    }) => Promise<void> | void;
     /** Response observers for an OAuth response. */
     readonly responseOptions?: (input: NativeAnthropicResponseContext<P>) => NativeAnthropicResponseOptions | undefined;
     /** Quota carried by the upstream response headers, read once per response. */

package/dist/v2/cachekeep.d.ts

@@ -0,0 +1,19 @@
+import { CacheKeepSessionRegistry, type NativeAccountRuntime } from '@cortexkit/anthropic-auth-core';
+import type { NativeSource } from './source';
+export interface NativeCacheKeepOptions {
+    readonly now?: () => number;
+    readonly setIntervalImpl?: typeof globalThis.setInterval;
+    readonly clearIntervalImpl?: typeof globalThis.clearInterval;
+    readonly registryDirectory?: string;
+}
+/** Keep admitted hybrid-cache prefixes warm using fresh native authorization for each send. */
+export declare function createNativeCacheKeep(options: NativeCacheKeepOptions & {
+    runtime: NativeAccountRuntime;
+    source: NativeSource;
+    fetch?: typeof fetch;
+    isSubagent?: (sessionID: string) => Promise<boolean>;
+}): {
+    track(input: Parameters<NonNullable<NativeSource['onRequestPrepared']>>[0]): Promise<void>;
+    registry: CacheKeepSessionRegistry;
+    dispose(): Promise<void>;
+};

package/dist/v2/menu.d.ts

@@ -1,4 +1,4 @@
-import { type NativeAccountRuntime } from '@cortexkit/anthropic-auth-core';
+import { type CacheKeepSessionRegistry, type NativeAccountRuntime } from '@cortexkit/anthropic-auth-core';
 import type { NativeMenuCapabilities } from './menu-contract';
 import type { NativeSource } from './source';
 export type { NativeMenuCapabilities } from './menu-contract';
@@ -6,5 +6,6 @@ export type { NativeMenuCapabilities } from './menu-contract';
 export declare function createNativeMenuCapabilities(options: {
     readonly runtime: NativeAccountRuntime;
     readonly source: NativeSource;
+    readonly cacheKeepRegistry?: CacheKeepSessionRegistry;
     readonly start: (sessionID: string, text: string) => Promise<void>;
 }): NativeMenuCapabilities;