@cortexkit/opencode-anthropic-auth 2.0.3 → 2.1.0

package/README.md

@@ -16,7 +16,7 @@ This project is not affiliated with or endorsed by Anthropic. Using Claude subsc
 ## Install
 
 ```bash
-bunx @cortexkit/opencode-anthropic-auth setup
+npx @cortexkit/opencode-anthropic-auth setup
 ```
 
 After setup:

package/dist/cli-failure.d.ts

@@ -1,4 +1,5 @@
-import { type ProviderErrorRedactor } from '@cortexkit/anthropic-auth-core';
+import { type OwnerOnlyOptions, type ProviderErrorRedactor } from '@cortexkit/anthropic-auth-core';
+import type { SetupEnrollmentOutcome } from '@cortexkit/common-auth/setup';
 declare const STAGE_LABELS: {
     readonly 'setup-activation': 'Vault custody setup';
     readonly 'setup-opencode-config': 'OpenCode configuration';
@@ -14,6 +15,11 @@ declare const STAGE_LABELS: {
     readonly 'cli-command': 'Command';
 };
 export type CliFailureStage = keyof typeof STAGE_LABELS;
+interface FailureReportOptions {
+    ownership?: OwnerOnlyOptions;
+    stderr?: (line: string) => void;
+}
+declare const SETUP_HOSTS: readonly ['opencode', 'pi'];
 /** UTF-8 bytes of redacted detail kept per diagnostics file. */
 export declare const CLI_FAILURE_DETAIL_MAX_BYTES: number;
 export declare const CLI_FAILURE_OMITTED = "[output beyond the diagnostic limit omitted]";
@@ -28,6 +34,19 @@ export declare const CLI_FAILURE_SECRETS_UNREADABLE = "[detail withheld: the kno
  * a running-host list rebuilt from validated own host names and PIDs.
  */
 export declare function knownFailureMessage(error: unknown): string | undefined;
+/**
+ * The vault enrollment outcome runSetup recorded for each selected host when
+ * it failed after enrollment began, or undefined when it recorded none.
+ * runSetup keeps that record beside the thrown value rather than on it, and
+ * the setupEnrollment that Core re-exports looks it up; it is asked only for a
+ * real (non-proxy) object, and each entry is accepted only when its host and
+ * outcome are own data properties holding known values, so no getter or proxy
+ * trap runs.
+ */
+export declare function setupEnrollmentOutcomes(error: unknown): {
+    host: (typeof SETUP_HOSTS)[number];
+    outcome: SetupEnrollmentOutcome;
+}[] | undefined;
 /**
  * Exact credentials a failing command may echo: the strings in `submitted`
  * (the API key, OAuth code and tokens, or Cloudflare and relay tokens the CLI
@@ -54,14 +73,25 @@ export declare function boundRedactedDetail(text: string, redactor: Pick<Provide
  * reading the environment would invoke caller code.
  */
 export declare function cliDiagnosticsDirectory(env: unknown): string | undefined;
+/**
+ * Write one failure detail to a new owner-only file and return its path, or
+ * undefined if that cannot be done safely. An existing non-private leaf
+ * directory is refused, never repaired. POSIX checks its uid/mode and creates
+ * missing directories with mode 0700; Windows uses native DACL checks and
+ * private directory creation. Files are exclusive mode 0600 on POSIX and
+ * protected owner-only DACL storage on Windows; a leaf symlink is never followed.
+ */
+export declare function writeDiagnosticFile(env: unknown, stage: CliFailureStage, contents: string, ownership?: OwnerOnlyOptions): Promise<string | undefined>;
 /**
  * Screen text for a thrown failure. A known failure is returned word for word
  * and not recorded; anything else is recorded in a private diagnostics file
  * and replaced by a fixed line naming that file. `env` supplies both the
  * secret-named values to scrub and the diagnostics location; `submitted`
  * holds the credentials the failing command handled.
+ * When the private file cannot be saved, one allowlisted metadata line is
+ * also emitted to stderr without changing the fixed screen text.
  */
-export declare function reportThrownFailure(stage: CliFailureStage, error: unknown, env: unknown, submitted?: unknown): Promise<string>;
+export declare function reportThrownFailure(stage: CliFailureStage, error: unknown, env: unknown, submitted?: unknown, options?: FailureReportOptions): Promise<string>;
 /** Screen text for a child process that exited unsuccessfully; its stderr tail goes to the diagnostics file. */
 export declare function reportInstallerFailure(stage: CliFailureStage, result: {
     exitCode: number;