@cortexkit/opencode-anthropic-auth 2.0.2 → 2.1.0

package/dist/{index-2arfb1y3.js → index-6chd6jnr.js}

@@ -1,2 +1,2 @@
 var t=["claude-account","claude-cache","claude-cachekeep","claude-prime","claude-start","claude-quota","claude-dump","claude-fast","claude-routing","claude-killswitch","claude-logging"];
-export{t as p};
+export{t as q};

package/dist/{index-1tbpt45x.js → index-ah5s0bew.js}

@@ -1,2 +1,2 @@
 import{mkdir as l,readdir as u,readFile as c,rename as p,unlink as m,writeFile as d}from"node:fs/promises";import{join as a}from"node:path";function f(t){try{return process.kill(t,0),!0}catch(r){return r.code==="EPERM"}}async function b(t,r){await l(t,{recursive:!0});let s={...r,startedAt:Date.now()},e=a(t,`port-${r.pid}.json`),i=`${e}.${process.pid}.tmp`;return await d(i,JSON.stringify(s),{encoding:"utf8",mode:384}),await p(i,e),e}async function h(t,r){let s;try{s=await u(t)}catch{return null}let e=[];for(let n of s){if(!n.startsWith("port-")||!n.endsWith(".json"))continue;try{let o=JSON.parse(await c(a(t,n),"utf8"));if(Number.isFinite(o.port))if(f(o.pid))e.push(o);else m(a(t,n)).catch(()=>{})}catch{}}if(e.length===0)return null;let i=r&&r>=1?e.filter((n)=>n.pid===r):[];return(i.length>0?i:e).sort((n,o)=>o.startedAt-n.startedAt)[0]??null}
-export{b as Re,h as Se};
+export{b as aa,h as ba};

package/dist/index-b1dvkp15.js

@@ -0,0 +1,2 @@
+import{existsSync as $,readFileSync as F}from"node:fs";import{homedir as Y}from"node:os";import{dirname as X,join as J,resolve as V}from"node:path";import{fileURLToPath as Z}from"node:url";var b="@cortexkit/opencode-anthropic-auth",G="@cortexkit/pi-anthropic-auth";function W(q=process.env,w=process.platform){return(w==="win32"?q.USERPROFILE||q.HOME:q.HOME)||Y()}function K(q=process.env,w=process.platform){let B=q.OPENCODE_CONFIG_DIR?.trim();if(B)return V(B);return J(q.XDG_CONFIG_HOME||J(W(q,w),".config"),"opencode")}function I(q=process.env){let w=q.XDG_DATA_HOME?.trim();if(w)return J(V(w),"opencode");return J(Y(),".local","share","opencode")}function M(q=process.env){return J(I(q),"auth.json")}function R(q=process.env,w=process.platform){let B=q.PI_CODING_AGENT_DIR?.trim()||q.PI_AGENT_DIR?.trim();if(B)return V(B);return J(W(q,w),".pi","agent")}function k(q=process.env){let w=q.PI_CODING_AGENT_DIR,B=W(q),z=w||J(B,".pi","agent");if(z==="~")z=B;else if(z.startsWith("~/")||process.platform==="win32"&&z.startsWith("~\\"))z=J(B,z.slice(2));if(z.startsWith("file://"))z=Z(z);return J(z,"auth.json")}async function x(){let q=X(Z(import.meta.url));for(let w=0;w<5;w++){let B=J(q,"package.json");if($(B))try{let Q=JSON.parse(F(B,"utf8"));if(typeof Q.version==="string"&&Q.version.trim())return Q.version.trim()}catch{}let z=X(q);if(z===q)break;q=z}return"1.22.0"}
+export{b as z,G as A,K as B,M as C,R as D,k as E,x as F};

package/dist/{index-mge0rw54.js → index-f2ne65w4.js}

@@ -1,2 +1,2 @@
 import{createRequire as q}from"node:module";var j=Object.create;var{getPrototypeOf:k,defineProperty:i,getOwnPropertyNames:l}=Object;var m=Object.prototype.hasOwnProperty;function n(a){return this[a]}var o,p,r=(a,b,d)=>{var f=a!=null&&typeof a==="object";if(f){var g=b?o??=new WeakMap:p??=new WeakMap,h=g.get(a);if(h)return h}d=a!=null?j(k(a)):{};let c=b||!a||!a.__esModule?i(d,"default",{value:a,enumerable:!0}):d;for(let e of l(a))if(!m.call(c,e))i(c,e,{get:n.bind(a,e),enumerable:!0});if(f)g.set(a,c);return c};var s=(a,b)=>()=>(b||a((b={exports:{}}).exports,b),b.exports);var u=q(import.meta.url);
-export{r as Te,s as Ue,u as Ve};
+export{r as ca,s as da,u as ea};

package/dist/{index-rqync0pc.js → index-hazrk5c3.js}

@@ -1 +1 @@
-import{createHash as z}from"node:crypto";import{homedir as F,tmpdir as O}from"node:os";import{join as q,resolve as G}from"node:path";var J="OPENCODE_ANTHROPIC_AUTH_RPC_DIR";function T(g){let k=process.env[J]?.trim();if(k)return G(g,k);let w=z("sha256").update(g).digest("hex").slice(0,16),x=process.env.XDG_STATE_HOME||q(F(),".local","state");return q(x,"cortexkit","anthropic-auth","rpc",w)}export{O as q,T as r};
+import{createHash as z}from"node:crypto";import{homedir as F,tmpdir as O}from"node:os";import{join as q,resolve as G}from"node:path";var J="OPENCODE_ANTHROPIC_AUTH_RPC_DIR";function T(g){let k=process.env[J]?.trim();if(k)return G(g,k);let w=z("sha256").update(g).digest("hex").slice(0,16),x=process.env.XDG_STATE_HOME||q(F(),".local","state");return q(x,"cortexkit","anthropic-auth","rpc",w)}export{O as r,T as s};

package/dist/{index-1jkyhgyr.js → index-jexctf5w.js}

@@ -1,2 +1,2 @@
 var z=(f)=>f!==null&&typeof f==="object"&&!Array.isArray(f),G=(f)=>z(f)&&typeof f.sessionId==="string"&&f.sessionId.length>0,Z=(f)=>{if(!G(f)||!z(f)||f.command!=="claude"||typeof f.sectionId!=="string"||typeof f.actionId!=="string")return!1;if(f.itemId!==void 0&&typeof f.itemId!=="string")return!1;if(f.confirmed!==void 0&&typeof f.confirmed!=="boolean")return!1;if(f.values!==void 0&&(!z(f.values)||!Object.values(f.values).every((q)=>q===null||typeof q==="string"||typeof q==="boolean"||typeof q==="number"&&Number.isFinite(q))))return!1;return!0};function B(f){return{"~standard":{version:1,vendor:"cortexkit-native",validate:(q)=>f(q)?{value:q}:{issues:[{message:"Invalid native menu payload"}]}}}}var W=(f)=>z(f)&&f.command==="claude"&&z(f.menu)&&f.menu.command==="claude"&&typeof f.menu.title==="string"&&Array.isArray(f.menu.sections),$=(f)=>z(f)&&f.command==="claude"&&typeof f.ok==="boolean"&&typeof f.text==="string"&&z(f.menu)&&Array.isArray(f.menu.sections),A={id:"cortexkit-anthropic-native",methods:{open:{input:B(G),output:B(W)},apply:{input:B(Z),output:B($)}},events:{opened:{schema:B((f)=>G(f)&&W(f.payload))},notification:{schema:B((f)=>G(f)&&typeof f.message==="string"&&["info","warning","error"].includes(String(f.kind)))}}};async function L(f,q,X){let K=new AbortController,H=(j)=>({sessionId:j,notify(F,J="info"){D.events.emit("notification",{sessionId:j,message:F,kind:J}).catch(()=>{})}}),D=await f.rpc.register(A,{open:(j)=>q.open(H(j.sessionId)),apply:(j)=>q.apply(j,H(j.sessionId))}),Q;try{Q=await f.command.transform((j)=>j.add({name:"claude",description:"Native Claude accounts and settings",async execute(F){let J=await q.open(H(F.sessionID));await D.events.emit("opened",{sessionId:F.sessionID,payload:J})}}))}catch(j){throw await D.dispose(),j}let Y=(async()=>{try{for await(let j of f.event.subscribe({signal:K.signal}))if(j.type==="session.deleted")X.forgetSession(j.data.sessionID)}catch{}})(),S=!1;return{async dispose(){if(S)return;S=!0,K.abort(),await Promise.all([D.dispose(),Q.dispose(),Y])}}}
-export{A as s,L as t};
+export{A as t,L as u};

package/dist/index.js

@@ -1 +1 @@
-import{o as a}from"./index-227rsmfv.js";import"./index-2arfb1y3.js";import"./index-rqync0pc.js";import"./index-b3mxpp4w.js";import"./index-jc8p0tkv.js";import"./index-j0wsgy54.js";import"./index-fn0zqnnw.js";import"./index-1tbpt45x.js";import"./index-mge0rw54.js";export{a as AnthropicAuthPlugin};
+import{p as a}from"./index-1nwcnxp8.js";import"./index-6chd6jnr.js";import"./index-hazrk5c3.js";import"./index-b1dvkp15.js";import"./index-53nnxq39.js";import"./index-ah5s0bew.js";import"./index-f2ne65w4.js";export{a as AnthropicAuthPlugin};

package/dist/quota-preflight.d.ts

@@ -0,0 +1 @@
+export declare function logFallbackQuotaPreflightWarning(accountId: string, requiredByPolicy: boolean, error: unknown): void;

package/dist/request-class.d.ts

@@ -0,0 +1,10 @@
+import type { ClaudeCodeRequestClass } from '@cortexkit/anthropic-auth-core';
+/**
+ * Plugin-internal header that carries a request's Claude Code request class
+ * from the host's per-message hook to the fetch wrapper. It is removed before
+ * the request leaves.
+ */
+export declare const REQUEST_CLASS_REQUEST_HEADER = "x-cortexkit-request-class";
+export declare function isAuxiliaryAgent(agent: unknown): boolean;
+/** Read and remove the internal request-class header. */
+export declare function takeRequestClassHeader(headers: Headers): ClaudeCodeRequestClass;

package/dist/rpc/port-file.js

@@ -1 +1 @@
-import{Re as a,Se as b}from"../index-1tbpt45x.js";import"../index-mge0rw54.js";export{a as writePortFile,b as discoverPortFile};
+import{aa as a,ba as b}from"../index-ah5s0bew.js";import"../index-f2ne65w4.js";export{a as writePortFile,b as discoverPortFile};

package/dist/rpc/protocol.js

@@ -1 +1 @@
-import{p as a}from"../index-2arfb1y3.js";import"../index-mge0rw54.js";export{a as COMMAND_MODAL_NAMES};
+import{q as a}from"../index-6chd6jnr.js";import"../index-f2ne65w4.js";export{a as COMMAND_MODAL_NAMES};

package/dist/rpc/rpc-client.js

@@ -1 +1 @@
-import{Se as s}from"../index-1tbpt45x.js";import"../index-mge0rw54.js";async function i(e,o,t,n){let r=await s(e,n);if(!r)return null;let a=new AbortController,l=setTimeout(()=>a.abort(),2000);try{let p=await fetch(`http://127.0.0.1:${r.port}/rpc/${o}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${r.token}`},body:JSON.stringify(t),signal:a.signal});if(!p.ok)return null;return await p.json()}catch{return null}finally{clearTimeout(l)}}function c(e,o){return{async pending(t,n){return(await i(e,"pending-notifications",{lastReceivedId:t,sessionId:n},o))?.messages??[]},async apply(t){return await i(e,"apply",{...t},o)??{text:"apply failed",knobs:{}}},async applyMenu(t){if(t.command!=="claude"||!t.sessionId?.trim())throw TypeError("A claude menu sessionId is required");let n=await i(e,"apply-menu",{...t},o);if(!n)throw Error("Menu apply unavailable; outcome unknown");return n}}}export{c as createRpcClient};
+import{ba as s}from"../index-ah5s0bew.js";import"../index-f2ne65w4.js";async function i(e,o,t,n){let r=await s(e,n);if(!r)return null;let a=new AbortController,l=setTimeout(()=>a.abort(),2000);try{let p=await fetch(`http://127.0.0.1:${r.port}/rpc/${o}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${r.token}`},body:JSON.stringify(t),signal:a.signal});if(!p.ok)return null;return await p.json()}catch{return null}finally{clearTimeout(l)}}function c(e,o){return{async pending(t,n){return(await i(e,"pending-notifications",{lastReceivedId:t,sessionId:n},o))?.messages??[]},async apply(t){return await i(e,"apply",{...t},o)??{text:"apply failed",knobs:{}}},async applyMenu(t){if(t.command!=="claude"||!t.sessionId?.trim())throw TypeError("A claude menu sessionId is required");let n=await i(e,"apply-menu",{...t},o);if(!n)throw Error("Menu apply unavailable; outcome unknown");return n}}}export{c as createRpcClient};

package/dist/rpc/rpc-dir.js

@@ -1 +1 @@
-import{q as a,r as b}from"../index-rqync0pc.js";import"../index-mge0rw54.js";export{a as tmpdir,b as getRpcDir};
+import{r as a,s as b}from"../index-hazrk5c3.js";import"../index-f2ne65w4.js";export{a as tmpdir,b as getRpcDir};

package/dist/setup/command.d.ts

@@ -1,20 +1,11 @@
-import type { Writable } from 'node:stream';
-import { detectAll } from './detect.ts';
-import { activateNativeVaultForHost } from './native-activation.ts';
+import { type SetupIO } from '@cortexkit/anthropic-auth-core';
+import { completeNativeVaultActivation, preflightNativeVaultForHost } from './native-activation.ts';
 import { migrateNativeLocalForHost } from './native-local.ts';
 import { loginNativeOffline } from './native-login.ts';
-import type { CommandRunner, ProcessFence } from './types.ts';
-export interface SetupCommandOptions {
-    runner?: CommandRunner;
-    fence?: ProcessFence;
-    env?: NodeJS.ProcessEnv;
-    isInteractive?: boolean;
-    /** Let tests substitute host detection and per-host vault activation. */
-    detect?: typeof detectAll;
-    activate?: typeof activateNativeVaultForHost;
+export interface SetupCommandOptions extends SetupIO {
     migrateLocal?: typeof migrateNativeLocalForHost;
     localLogin?: typeof loginNativeOffline;
-    /** Where setup prints its progress and errors; defaults to stdout. */
-    output?: Writable;
+    vaultPreflight?: typeof preflightNativeVaultForHost;
+    vaultActivate?: typeof completeNativeVaultActivation;
 }
 export declare function runSetupCommand(argv?: string[], options?: SetupCommandOptions): Promise<number>;

package/dist/setup/native-activation.d.ts

@@ -1,10 +1,14 @@
 import { type NativeCustodyActivationHooks, type NativeCustodyInventory } from '@cortexkit/anthropic-auth-core';
 import { type NativeVaultEnrollmentOptions } from './native-enrollment.ts';
 import { type NativeSetupPaths } from './native-paths.ts';
-import type { CommandRunner, HarnessKind, ProcessFence } from './types.ts';
+import { type CommandRunner, type HarnessKind, type ProcessFence } from './types.ts';
+type HostIndependentActivationCode = 'auth-content-refused' | 'host-auth-invalid' | 'primary-conflict' | 'consent-required' | 'primary-unverified';
+/** Activation codes whose remedy names the host, so the host is required. */
+type HostActivationCode = 'no-read-grant' | 'grant-reaches-nothing';
 export declare class NativeVaultActivationError extends Error {
-    readonly code: 'auth-content-refused' | 'host-auth-invalid' | 'primary-conflict' | 'consent-required' | 'primary-unverified';
-    constructor(code: 'auth-content-refused' | 'host-auth-invalid' | 'primary-conflict' | 'consent-required' | 'primary-unverified');
+    readonly code: HostIndependentActivationCode | HostActivationCode;
+    constructor(code: HostIndependentActivationCode);
+    constructor(code: HostActivationCode, host: HarnessKind);
 }
 export interface NativeVaultActivationOptions {
     env: NodeJS.ProcessEnv;
@@ -17,13 +21,22 @@ export interface NativeVaultActivationOptions {
      * production resolves them from the host's environment.
      */
     paths?: NativeSetupPaths;
+    /** Set false for OpenCode 2, whose setup must not read the OpenCode 1 auth file. */
+    inspectOpenCodeAuth?: boolean;
     enrollment?: Pick<NativeVaultEnrollmentOptions, 'paths' | 'client' | 'ckBinary' | 'connectionFile'>;
     discover?: () => Promise<NativeCustodyInventory>;
     hooks?: NativeCustodyActivationHooks;
 }
-/**
- * Enroll this stopped host, discover its verified default vault account and
- * leave the host auth slot untouched. Local credentials, migration journal,
- * account metadata and routing assignments are not inputs to this operation.
- */
+export interface NativeVaultPreflight {
+    priorMode: 'local' | 'claustrum';
+    fingerprint: string;
+    separateOpenCodeLogin?: boolean;
+}
+export declare function fingerprintNativeVaultInputs(host: HarnessKind, options: NativeVaultActivationOptions): Promise<string>;
+/** Validate vault inputs before the runner enrolls any selected host. */
+export declare function preflightNativeVaultForHost(host: HarnessKind, options: NativeVaultActivationOptions): Promise<NativeVaultPreflight>;
+/** Grant native-account read access and require a vault-backed default Claude account with an account identity before moving Pi's login aside. */
+export declare function completeNativeVaultActivation(host: HarnessKind, options: NativeVaultActivationOptions, preflight: NativeVaultPreflight): Promise<'committed' | 'already-vault'>;
+/** Outside runSetup, check inputs, enroll the host, then grant and activate vault access. runSetup owns enrollment and calls preflight and completion separately. */
 export declare function activateNativeVaultForHost(host: HarnessKind, options: NativeVaultActivationOptions): Promise<'committed' | 'already-vault'>;
+export {};

package/dist/setup/native-enrollment.d.ts

@@ -1,5 +1,16 @@
 import { type ClaustrumEnrollmentClient, type ClaustrumEnrollmentPaths } from '@cortexkit/common-auth/claustrum';
 import type { CommandRunner, HarnessKind } from './types.ts';
+export declare const NATIVE_VAULT_HOST_NAMES: {
+    readonly opencode: "anthropic-auth-opencode";
+    readonly pi: "anthropic-auth-pi";
+};
+/** Convert the token file resolved by getHostClaustrumEnrollmentPaths into runSetup's path inputs; the runner derives the matching state file itself. */
+export declare function nativeVaultHostPaths(host: HarnessKind, env: NodeJS.ProcessEnv): {
+    stateDir: string;
+    host: HarnessKind;
+    override: string;
+};
+export declare function nativeVaultConnectionFile(host: HarnessKind, env: NodeJS.ProcessEnv): string;
 export interface NativeVaultEnrollmentOptions {
     env: NodeJS.ProcessEnv;
     runner: CommandRunner;
@@ -13,6 +24,8 @@ export interface NativeVaultEnrollmentOptions {
     client?: ClaustrumEnrollmentClient;
     ckBinary?: string;
     connectionFile?: string;
+    /** Defaults to granting native-account read access after enrollment. False leaves that grant to completeNativeVaultActivation, avoiding a duplicate grant. */
+    grantPermissions?: boolean;
 }
 export declare class NativeVaultEnrollmentError extends Error {
     readonly code: 'enrollment-refused' | 'enrollment-reset' | 'approval-refused' | 'permission-refused';
@@ -24,3 +37,11 @@ export declare class NativeVaultEnrollmentError extends Error {
  * account discovery and the credential-store switch are separate setup steps.
  */
 export declare function enrollNativeVaultForHost(host: HarnessKind, options: NativeVaultEnrollmentOptions): Promise<void>;
+/**
+ * The `ck` arguments that grant this host's enrolled principal read access to
+ * the vault's anthropic-native category. Setup runs them, and the empty-vault
+ * message shows the same command so the user can run it by hand.
+ */
+export declare function nativeVaultGrantArgs(host: HarnessKind): string[];
+/** Grant this OpenCode or Pi principal read access to the vault's anthropic-native category; enrollment alone grants no provider access. */
+export declare function grantNativeVaultForHost(host: HarnessKind, options: Pick<NativeVaultEnrollmentOptions, 'env' | 'runner' | 'processFence' | 'ckBinary'>): Promise<void>;

package/dist/setup/native-local.d.ts

@@ -1,5 +1,6 @@
+import { type NativeMigrationPreflight, readNativeMigrationJournal } from '@cortexkit/anthropic-auth-core';
 import { type NativeSetupPaths } from './native-paths';
-import type { HarnessKind, ProcessFence } from './types';
+import { type HarnessKind, type ProcessFence } from './types';
 export interface NativeOfflineLogin {
     credential: {
         type: 'oauth';
@@ -15,6 +16,35 @@ export interface NativeLocalSetupOptions {
     paths?: NativeSetupPaths;
     removePiAnthropicAuth: boolean;
     login?: (host: HarnessKind) => Promise<NativeOfflineLogin>;
+    preflight?: NativeMigrationPreflight;
+    skipMigration?: boolean;
+    beforeCommit?: () => Promise<void>;
 }
+export declare const SEPARATE_HOST_LOGIN_NOTICE = "OpenCode's separate Anthropic login is not used. Add that account through /claude Accounts if needed, or remove the separate login from OpenCode.";
+export declare function requireNativeLocalEnrollment(hosts: readonly HarnessKind[], env: NodeJS.ProcessEnv): Promise<void>;
+export declare function nativeLocalProcessFence(host: HarnessKind, options: NativeLocalSetupOptions): () => Promise<void>;
+export declare function nativeSetupFileFingerprint(path: string): Promise<string>;
+export declare function inspectSetupHostAuth(host: HarnessKind, path: string): Promise<{
+    kind: 'absent' | 'oauth' | 'api' | 'api_key' | 'activation';
+    digest: string;
+    realLogin: boolean;
+}>;
+export interface NativeLocalPlan {
+    paths: NativeSetupPaths;
+    generation2: boolean;
+    action: 'migration' | 'skip' | 'empty-init' | 'reuse';
+    slot?: Awaited<ReturnType<typeof inspectSetupHostAuth>>;
+    notice: boolean;
+    preflight?: NativeMigrationPreflight;
+    fingerprint: string;
+    authorityPhase: NonNullable<Awaited<ReturnType<typeof readNativeMigrationJournal>>>['phase'] | 'absent';
+    poolPopulation: boolean | 'not-evaluated';
+}
+/** Hash pool, journal and routing bytes and the host's Anthropic entry, so a credential replacement cannot hide behind an unchanged account count. */
+export declare function fingerprintNativeLocalPlan(plan: NativeLocalPlan, env: NodeJS.ProcessEnv): Promise<string>;
+/** Record journal status, the host's Anthropic entry and whether setup will import, skip import or initialize a new pool, without writing. */
+export declare function planNativeLocalSetup(host: HarnessKind, options: NativeLocalSetupOptions, generation2: boolean): Promise<NativeLocalPlan>;
+export declare function revalidateNativeLocalPlan(plan: NativeLocalPlan, options: NativeLocalSetupOptions): Promise<void>;
+export declare function installAbsentNativePlaceholder(plan: Pick<NativeLocalPlan, 'paths' | 'slot'>, options: NativeLocalSetupOptions): Promise<void>;
 /** Transfer local credentials while hosts are stopped, before telling the user to restart. */
 export declare function migrateNativeLocalForHost(host: HarnessKind, options: NativeLocalSetupOptions): Promise<void>;

package/dist/setup/native-login.d.ts

@@ -1,3 +1,14 @@
+import { isCancel, text } from '@clack/prompts';
+import { authorize, exchange, resolveClaudeCodeIdentity } from '@cortexkit/anthropic-auth-core';
 import type { NativeOfflineLogin } from './native-local';
 import type { HarnessKind } from './types';
-export declare function loginNativeOffline(host: HarnessKind): Promise<NativeOfflineLogin>;
+interface NativeLoginDependencies {
+    authorize: typeof authorize;
+    exchange: typeof exchange;
+    resolveClaudeCodeIdentity: typeof resolveClaudeCodeIdentity;
+    text: typeof text;
+    isCancel: typeof isCancel;
+    print: (line: string) => void;
+}
+export declare function loginNativeOffline(host: HarnessKind, dependencies?: NativeLoginDependencies): Promise<NativeOfflineLogin>;
+export {};

package/dist/setup/process-fence.d.ts

@@ -1,4 +1,3 @@
-import type { CommandRunner, ProcessFence } from './types.ts';
 export declare class ProcessInspectionError extends Error {
     readonly code = "process-inspection-failed";
     constructor();
@@ -13,8 +12,3 @@ export declare class ProcessFenceViolationError extends Error {
         command: string;
     }>);
 }
-export declare function createProcessFence(runner?: CommandRunner, options?: {
-    platform?: NodeJS.Platform;
-}): ProcessFence;
-export declare const defaultProcessFence: ProcessFence;
-export declare function assertHostsStopped(fence?: ProcessFence): Promise<void>;

package/dist/setup/types.d.ts

@@ -1,4 +1,11 @@
 export type HarnessKind = 'opencode' | 'pi';
+export declare function setupRefusalMessage(error: unknown): string | undefined;
+/** runSetup prints failures from its own stopped-host checks; provider callbacks need a displayable refusal for their separate process checks. */
+export declare function setupProcessInspectionMessage(error: unknown): string | undefined;
+/** A setup refusal whose message is safe to show on the terminal. */
+export declare class SetupRefusal extends Error {
+    constructor(message: string);
+}
 export interface HostDetection {
     kind: HarnessKind;
     installed: boolean;
@@ -22,6 +29,8 @@ export interface CommandRunnerResult {
     exitCode: number;
     stdout: string;
     stderr: string;
+    signal?: NodeJS.Signals | null;
+    spawnError?: boolean;
 }
 export interface CommandRunner {
     run(command: string, args: string[], options?: {

package/dist/sidebar-state.d.ts

@@ -2,6 +2,7 @@ export interface QuotaWindow {
     usedPercent: number;
     remainingPercent: number;
     resetsAt?: string;
+    checkedAt?: number;
 }
 export interface ScopedQuotaWindow extends QuotaWindow {
     id: string;
@@ -10,6 +11,7 @@ export interface ScopedQuotaWindow extends QuotaWindow {
     modelName: string;
 }
 export interface AccountQuota {
+    checkedAt?: number;
     five_hour?: QuotaWindow;
     seven_day?: QuotaWindow;
     scoped?: ScopedQuotaWindow[];
@@ -36,6 +38,8 @@ export interface SidebarAccountState {
     label: string | undefined;
     quota: AccountQuota | null;
     enabled: boolean;
+    stateLine?: string;
+    quotaDated?: boolean;
     needsReauth: boolean;
     vaultReauth?: boolean;
     vaultServed?: boolean;
@@ -68,7 +72,10 @@ export interface PrimeSidebarAccountState {
 export interface SidebarState {
     main: {
         quota: AccountQuota | null;
+        enabled?: boolean;
         tierLabel?: string;
+        stateLine?: string;
+        quotaDated?: boolean;
         quotaBackedOff?: boolean;
         quotaBackoffUntil?: number;
         refreshBackedOff?: boolean;
@@ -140,8 +147,9 @@ export declare function resolveActiveAccount(state: SidebarState): {
     id: string;
     name: string;
     quota: AccountQuota | null;
+    stateLine?: string;
+    quotaDated?: boolean;
 };
-export declare function formatScopedQuotaLabel(title: string): string;
 /**
  * Pretty label for a recoverable-refusal source model (Fable 5/5.1 or Opus 5).
  * Falls back to the raw id for unrecognized ids so the sidebar never goes
@@ -155,12 +163,22 @@ export declare function formatPrimeAccountValue(account: PrimeSidebarAccountStat
     hasError: boolean;
 };
 export declare function getFableRecoverySummary(state: SidebarState, sessionId: string): string | undefined;
-export declare function getCollapsedQuotaSummary(quota: AccountQuota | null): {
+/** Keep full shared names when they fit; truncate only to preserve row columns. */
+export declare function formatQuotaRowLabel(name: string, width?: number): string;
+export declare function getCollapsedQuotaSummary(quota: AccountQuota | null, now?: number): {
     fiveHourUsedPercent: number | null;
     sevenDayUsedPercent: number | null;
     scopedUsedPercents: number[];
     text: string | null;
+    stale: boolean;
 };
+export declare function getCollapsedAccounts(state: SidebarState, showFallbacks?: boolean): {
+    id: string;
+    name: string;
+    quota: AccountQuota | null;
+    quotaDated: boolean | undefined;
+    active: boolean;
+}[];
 export declare const FIVE_HOUR_MS: number;
 export declare const SEVEN_DAY_MS: number;
 export interface QuotaPacing {

package/dist/sidebar-state.js

@@ -1 +1 @@
-import{F as a,G as b,H as c,I as d,J as e,K as f,L as g,M as h,N as i,O as j,P as k,Q as l,R as m,S as n,T as o,U as p,V as q,W as r,X as s,Y as t,Z as u}from"./index-jc8p0tkv.js";import"./index-j0wsgy54.js";import"./index-fn0zqnnw.js";import"./index-mge0rw54.js";export{i as setSidebarState,k as resolveActiveAccount,c as normalizeSidebarState,a as getSidebarStateFile,h as getSidebarState,f as getInitialSidebarRoutingTestHooks,q as getFableRecoverySummary,r as getCollapsedQuotaSummary,l as formatScopedQuotaLabel,n as formatPrimeTime,o as formatPrimeCost,p as formatPrimeAccountValue,m as formatFallbackModelLabel,j as drainSidebarWrites,u as computeQuotaPacing,d as __setSidebarStateWriteTestHooks,e as __setInitialSidebarRoutingTestHooks,g as __acquireSidebarStateLockForTest,t as SEVEN_DAY_MS,s as FIVE_HOUR_MS,b as DEFAULT_SIDEBAR_STATE};
+import{$ as v,G as a,H as b,I as c,J as d,K as e,L as f,M as g,N as h,O as i,P as j,Q as k,R as l,S as m,T as n,U as o,V as p,W as q,X as r,Y as s,Z as t,_ as u}from"./index-53nnxq39.js";import"./index-f2ne65w4.js";export{i as setSidebarState,k as resolveActiveAccount,c as normalizeSidebarState,a as getSidebarStateFile,h as getSidebarState,f as getInitialSidebarRoutingTestHooks,p as getFableRecoverySummary,r as getCollapsedQuotaSummary,s as getCollapsedAccounts,q as formatQuotaRowLabel,m as formatPrimeTime,n as formatPrimeCost,o as formatPrimeAccountValue,l as formatFallbackModelLabel,j as drainSidebarWrites,v as computeQuotaPacing,d as __setSidebarStateWriteTestHooks,e as __setInitialSidebarRoutingTestHooks,g as __acquireSidebarStateLockForTest,u as SEVEN_DAY_MS,t as FIVE_HOUR_MS,b as DEFAULT_SIDEBAR_STATE};

package/dist/transform.d.ts

@@ -1,4 +1,4 @@
-import { type BillingLineageFields, type Cache1hMode, type ClaudeCodeIdentity, type ThinkingPrefixMismatchBehavior } from '@cortexkit/anthropic-auth-core';
+import { type BillingLineageFields, type Cache1hMode, type ClaudeCodeIdentity, type ClaudeCodeRequestClass, type ThinkingPrefixMismatchBehavior } from '@cortexkit/anthropic-auth-core';
 import { type OpenCodeEffortMarkerPlan } from './effort-history';
 import { type ServerSideFallbackOutcome } from './server-fallback';
 export declare const NON_STREAMING_DIAGNOSTICS_MAX_BYTES: number;
@@ -31,6 +31,7 @@ export declare function addFastModeBetaHeader(headers: Headers): Headers;
 export declare function setOAuthHeaders(headers: Headers, accessToken: string, options?: {
     body?: Record<string, unknown> | null;
     identity?: ClaudeCodeIdentity;
+    requestClass?: ClaudeCodeRequestClass;
 }): Headers;
 /**
  * Add TOOL_PREFIX to tool names in the request body.
@@ -81,13 +82,6 @@ export type HybridMessageCacheAnchor = {
     messageCount: number;
 };
 export declare function extractLatestHybridMessageCacheAnchor(bodyText: string): HybridMessageCacheAnchor | undefined;
-export declare function prepareFableCacheWarmSource(bodyText: string, fableModel?: string): {
-    ok: true;
-    bodyText: string;
-} | {
-    ok: false;
-    reason: string;
-};
 /**
  * Rewrite the full request body: sanitize system prompt and prefix tool names.
  */

package/dist/tui-preferences.js

@@ -1,4 +1,4 @@
-import"./index-mge0rw54.js";import{readFileSync as k,watch as C}from"node:fs";import{mkdir as _,readFile as I,rename as E,writeFile as b}from"node:fs/promises";import{homedir as g}from"node:os";import{basename as F,dirname as P,join as N}from"node:path";import{clearTimeout as D,setTimeout as L}from"node:timers";import{applyEdits as T,modify as y,parse as f}from"jsonc-parser";var v="OPENCODE_TUI_PREFERENCES_FILE",h="tui-preferences.jsonc";function A(){let J=process.env[v];if(J)return J;let z=process.env.OPENCODE_CONFIG_DIR||N(process.env.XDG_CONFIG_HOME||N(g(),".config"),"opencode");return N(z,h)}function H(J){return typeof J==="object"&&J!==null&&!Array.isArray(J)}async function qq(){try{let J=await I(A(),"utf8"),z=[],q=f(J,z,{allowTrailingComma:!0});if(z.length>0)return{};return H(q)?q:{}}catch{return{}}}var m="anthropic-auth",p=160,R={forceToTop:!1,order:p,startCollapsed:!1,rememberCollapsed:!0,collapsed:null,pollMs:1500,refreshDebounceMs:200,header:{label:"CLAUDE",showVersion:!0},sections:{quota:!0,fallbackAccounts:!0,routing:!0,cache:!0,health:!0,pacing:!0},appearance:{barWidth:10,barFilledChar:"█",barEmptyChar:"░",warnThreshold:50,errorThreshold:80}};function $(J,z){return typeof J==="boolean"?J:z}function Y(J,z,q,X){if(typeof J!=="number"||!Number.isFinite(J))return z;return Math.min(Math.max(Math.round(J),q),X)}function c(J,z,q){if(typeof J!=="string"||J.length===0)return z;return J.slice(0,q)}function w(J,z){if(typeof J!=="string")return z;return[...J][0]??z}function zq(J){let z=J[m];if(!H(z))return structuredClone(R);let q=R,X=H(z.header)?z.header:{},Q=H(z.sections)?z.sections:{},Z=H(z.appearance)?z.appearance:{},G=Y(Z.warnThreshold,q.appearance.warnThreshold,0,99),V=Math.max(Y(Z.errorThreshold,q.appearance.errorThreshold,0,100),Math.min(G+1,100));return{forceToTop:$(z.forceToTop,q.forceToTop),order:Y(z.order,q.order,-1e4,1e4),startCollapsed:$(z.startCollapsed,q.startCollapsed),rememberCollapsed:$(z.rememberCollapsed,q.rememberCollapsed),collapsed:typeof z.collapsed==="boolean"?z.collapsed:null,pollMs:Y(z.pollMs,q.pollMs,500,30000),refreshDebounceMs:Y(z.refreshDebounceMs,q.refreshDebounceMs,50,5000),header:{label:c(X.label,q.header.label,20),showVersion:$(X.showVersion,q.header.showVersion)},sections:{quota:$(Q.quota,q.sections.quota),fallbackAccounts:$(Q.fallbackAccounts,q.sections.fallbackAccounts),routing:$(Q.routing,q.sections.routing),cache:$(Q.cache,q.sections.cache),health:$(Q.health,q.sections.health),pacing:$(Q.pacing,q.sections.pacing)},appearance:{barWidth:Y(Z.barWidth,q.appearance.barWidth,4,40),barFilledChar:w(Z.barFilledChar,q.appearance.barFilledChar),barEmptyChar:w(Z.barEmptyChar,q.appearance.barEmptyChar),warnThreshold:G,errorThreshold:V}}}var u=-1e5;function Jq(J,z,q){let X=J[z];if(!H(X))return q;if(X.forceToTop===!0)return u+Object.keys(J).indexOf(z);return Y(X.order,q,-1e4,1e4)}var s=`// Shared preferences for opencode TUI plugins.
+import"./index-f2ne65w4.js";import{readFileSync as k,watch as C}from"node:fs";import{mkdir as _,readFile as I,rename as E,writeFile as b}from"node:fs/promises";import{homedir as g}from"node:os";import{basename as F,dirname as P,join as N}from"node:path";import{clearTimeout as D,setTimeout as L}from"node:timers";import{applyEdits as T,modify as y,parse as f}from"jsonc-parser";var v="OPENCODE_TUI_PREFERENCES_FILE",h="tui-preferences.jsonc";function A(){let J=process.env[v];if(J)return J;let z=process.env.OPENCODE_CONFIG_DIR||N(process.env.XDG_CONFIG_HOME||N(g(),".config"),"opencode");return N(z,h)}function H(J){return typeof J==="object"&&J!==null&&!Array.isArray(J)}async function qq(){try{let J=await I(A(),"utf8"),z=[],q=f(J,z,{allowTrailingComma:!0});if(z.length>0)return{};return H(q)?q:{}}catch{return{}}}var m="anthropic-auth",p=160,R={forceToTop:!1,order:p,startCollapsed:!1,rememberCollapsed:!0,collapsed:null,pollMs:1500,refreshDebounceMs:200,header:{label:"CLAUDE",showVersion:!0},sections:{quota:!0,fallbackAccounts:!0,routing:!0,cache:!0,health:!0,pacing:!0},appearance:{barWidth:10,barFilledChar:"█",barEmptyChar:"░",warnThreshold:50,errorThreshold:80}};function $(J,z){return typeof J==="boolean"?J:z}function Y(J,z,q,X){if(typeof J!=="number"||!Number.isFinite(J))return z;return Math.min(Math.max(Math.round(J),q),X)}function c(J,z,q){if(typeof J!=="string"||J.length===0)return z;return J.slice(0,q)}function w(J,z){if(typeof J!=="string")return z;return[...J][0]??z}function zq(J){let z=J[m];if(!H(z))return structuredClone(R);let q=R,X=H(z.header)?z.header:{},Q=H(z.sections)?z.sections:{},Z=H(z.appearance)?z.appearance:{},G=Y(Z.warnThreshold,q.appearance.warnThreshold,0,99),V=Math.max(Y(Z.errorThreshold,q.appearance.errorThreshold,0,100),Math.min(G+1,100));return{forceToTop:$(z.forceToTop,q.forceToTop),order:Y(z.order,q.order,-1e4,1e4),startCollapsed:$(z.startCollapsed,q.startCollapsed),rememberCollapsed:$(z.rememberCollapsed,q.rememberCollapsed),collapsed:typeof z.collapsed==="boolean"?z.collapsed:null,pollMs:Y(z.pollMs,q.pollMs,500,30000),refreshDebounceMs:Y(z.refreshDebounceMs,q.refreshDebounceMs,50,5000),header:{label:c(X.label,q.header.label,20),showVersion:$(X.showVersion,q.header.showVersion)},sections:{quota:$(Q.quota,q.sections.quota),fallbackAccounts:$(Q.fallbackAccounts,q.sections.fallbackAccounts),routing:$(Q.routing,q.sections.routing),cache:$(Q.cache,q.sections.cache),health:$(Q.health,q.sections.health),pacing:$(Q.pacing,q.sections.pacing)},appearance:{barWidth:Y(Z.barWidth,q.appearance.barWidth,4,40),barFilledChar:w(Z.barFilledChar,q.appearance.barFilledChar),barEmptyChar:w(Z.barEmptyChar,q.appearance.barEmptyChar),warnThreshold:G,errorThreshold:V}}}var u=-1e5;function Jq(J,z,q){let X=J[z];if(!H(X))return q;if(X.forceToTop===!0)return u+Object.keys(J).indexOf(z);return Y(X.order,q,-1e4,1e4)}var s=`// Shared preferences for opencode TUI plugins.
 // One top-level key per plugin (short name). See each plugin's README for
 // its supported settings. This file is safe to hand-edit; plugins update
 // individual keys in place and preserve comments.

package/dist/tui.d.ts

@@ -1,7 +1,5 @@
 /** @jsxImportSource @opentui/solid */
-import { formatQuotaMoney } from '@cortexkit/anthropic-auth-core';
 import type { TuiPluginModule } from '@opencode-ai/plugin/tui';
-export { formatQuotaMoney };
 declare const plugin: TuiPluginModule & {
     id: string;
 };

package/dist/v2/activation.d.ts

@@ -1,5 +1,7 @@
 /** Explicit sign-in to the native Claude account pool creates this OAuth connection. Startup leaves existing OpenCode connections unchanged. */
 export declare const CLAUDE_POOL_LOGIN_METHOD_ID = "native-claude-oauth";
+export declare const CLAUDE_POOL_LOGIN_METHOD_LABEL = "Claude Pro / Max (native account pool)";
+export declare const CLAUDE_POOL_LOGIN_STEP = "In OpenCode, sign in to Anthropic with \"Claude Pro / Max (native account pool)\".";
 /**
  * Connects OpenCode to the Claude accounts held in the vault. It signs in to
  * nothing and stores no local account; only the host's placeholder is written.

package/dist/v2/adapter.d.ts

@@ -1,4 +1,4 @@
-import { type ClaudeCodeIdentity, TrailingAssistantHistoryError } from '@cortexkit/anthropic-auth-core';
+import { type ClaudeCodeIdentity, type RequestGzipLatch, TrailingAssistantHistoryError } from '@cortexkit/anthropic-auth-core';
 import type { AccountRequest, AttemptOutcome, ChooseAccountInput, HeaderEdits, HostError, LimitSignal, OpenCode2AuthAdapter, RequestScope, Transport } from '@cortexkit/common-auth/opencode2';
 import { EffortMarkerCorrelationError } from '../effort-history';
 import { createStrippedStream, rewriteRequestBody } from '../transform';
@@ -161,6 +161,11 @@ export interface NativeAnthropicSource<Q, P> {
     readonly requestOptions?: (input: NativeAnthropicRequestContext<P>) => Promise<NativeAnthropicBodyOptions> | NativeAnthropicBodyOptions;
     /** Rechecks policy after asynchronous rewriting, immediately before dispatch. */
     readonly admitRequest?: (input: NativeAnthropicAttemptContext<P>) => Promise<void> | void;
+    /** Observe the admitted OAuth wire body before any relay envelope is added. */
+    readonly onRequestPrepared?: (input: NativeAnthropicAttemptContext<P> & {
+        readonly url: string;
+        readonly bodyText: string;
+    }) => Promise<void> | void;
     /** Response observers for an OAuth response. */
     readonly responseOptions?: (input: NativeAnthropicResponseContext<P>) => NativeAnthropicResponseOptions | undefined;
     /** Quota carried by the upstream response headers, read once per response. */
@@ -206,6 +211,11 @@ export interface NativeAnthropicAdapterDeps<Q, P> {
      * ended; the source's work is not cancelled.
      */
     readonly attemptEndTimeoutMs?: number;
+    /**
+     * Remembers a rejected gzipped body. Defaults to the latch next to the
+     * OpenCode account storage file.
+     */
+    readonly requestGzipLatch?: RequestGzipLatch;
 }
 export interface NativeAnthropicAdapter<Q, P> {
     readonly adapter: OpenCode2AuthAdapter<Q, NativeAnthropicAttemptData<P>>;

package/dist/v2/cachekeep.d.ts

@@ -0,0 +1,19 @@
+import { CacheKeepSessionRegistry, type NativeAccountRuntime } from '@cortexkit/anthropic-auth-core';
+import type { NativeSource } from './source';
+export interface NativeCacheKeepOptions {
+    readonly now?: () => number;
+    readonly setIntervalImpl?: typeof globalThis.setInterval;
+    readonly clearIntervalImpl?: typeof globalThis.clearInterval;
+    readonly registryDirectory?: string;
+}
+/** Keep admitted hybrid-cache prefixes warm using fresh native authorization for each send. */
+export declare function createNativeCacheKeep(options: NativeCacheKeepOptions & {
+    runtime: NativeAccountRuntime;
+    source: NativeSource;
+    fetch?: typeof fetch;
+    isSubagent?: (sessionID: string) => Promise<boolean>;
+}): {
+    track(input: Parameters<NonNullable<NativeSource['onRequestPrepared']>>[0]): Promise<void>;
+    registry: CacheKeepSessionRegistry;
+    dispose(): Promise<void>;
+};

package/dist/v2/menu.d.ts

@@ -1,4 +1,4 @@
-import { type NativeAccountRuntime } from '@cortexkit/anthropic-auth-core';
+import { type CacheKeepSessionRegistry, type NativeAccountRuntime } from '@cortexkit/anthropic-auth-core';
 import type { NativeMenuCapabilities } from './menu-contract';
 import type { NativeSource } from './source';
 export type { NativeMenuCapabilities } from './menu-contract';
@@ -6,5 +6,6 @@ export type { NativeMenuCapabilities } from './menu-contract';
 export declare function createNativeMenuCapabilities(options: {
     readonly runtime: NativeAccountRuntime;
     readonly source: NativeSource;
+    readonly cacheKeepRegistry?: CacheKeepSessionRegistry;
     readonly start: (sessionID: string, text: string) => Promise<void>;
 }): NativeMenuCapabilities;