@cortexkit/opencode-anthropic-auth 2.0.3 → 2.1.1

package/dist/{index-5hyennzm.js → index-ah5s0bew.js}

@@ -1,2 +1,2 @@
 import{mkdir as l,readdir as u,readFile as c,rename as p,unlink as m,writeFile as d}from"node:fs/promises";import{join as a}from"node:path";function f(t){try{return process.kill(t,0),!0}catch(r){return r.code==="EPERM"}}async function b(t,r){await l(t,{recursive:!0});let s={...r,startedAt:Date.now()},e=a(t,`port-${r.pid}.json`),i=`${e}.${process.pid}.tmp`;return await d(i,JSON.stringify(s),{encoding:"utf8",mode:384}),await p(i,e),e}async function h(t,r){let s;try{s=await u(t)}catch{return null}let e=[];for(let n of s){if(!n.startsWith("port-")||!n.endsWith(".json"))continue;try{let o=JSON.parse(await c(a(t,n),"utf8"));if(Number.isFinite(o.port))if(f(o.pid))e.push(o);else m(a(t,n)).catch(()=>{})}catch{}}if(e.length===0)return null;let i=r&&r>=1?e.filter((n)=>n.pid===r):[];return(i.length>0?i:e).sort((n,o)=>o.startedAt-n.startedAt)[0]??null}
-export{b as lf,h as mf};
+export{b as aa,h as ba};

package/dist/{index-jmjevtm1.js → index-b1dvkp15.js}

@@ -1,2 +1,2 @@
 import{existsSync as $,readFileSync as F}from"node:fs";import{homedir as Y}from"node:os";import{dirname as X,join as J,resolve as V}from"node:path";import{fileURLToPath as Z}from"node:url";var b="@cortexkit/opencode-anthropic-auth",G="@cortexkit/pi-anthropic-auth";function W(q=process.env,w=process.platform){return(w==="win32"?q.USERPROFILE||q.HOME:q.HOME)||Y()}function K(q=process.env,w=process.platform){let B=q.OPENCODE_CONFIG_DIR?.trim();if(B)return V(B);return J(q.XDG_CONFIG_HOME||J(W(q,w),".config"),"opencode")}function I(q=process.env){let w=q.XDG_DATA_HOME?.trim();if(w)return J(V(w),"opencode");return J(Y(),".local","share","opencode")}function M(q=process.env){return J(I(q),"auth.json")}function R(q=process.env,w=process.platform){let B=q.PI_CODING_AGENT_DIR?.trim()||q.PI_AGENT_DIR?.trim();if(B)return V(B);return J(W(q,w),".pi","agent")}function k(q=process.env){let w=q.PI_CODING_AGENT_DIR,B=W(q),z=w||J(B,".pi","agent");if(z==="~")z=B;else if(z.startsWith("~/")||process.platform==="win32"&&z.startsWith("~\\"))z=J(B,z.slice(2));if(z.startsWith("file://"))z=Z(z);return J(z,"auth.json")}async function x(){let q=X(Z(import.meta.url));for(let w=0;w<5;w++){let B=J(q,"package.json");if($(B))try{let Q=JSON.parse(F(B,"utf8"));if(typeof Q.version==="string"&&Q.version.trim())return Q.version.trim()}catch{}let z=X(q);if(z===q)break;q=z}return"1.22.0"}
-export{b as y,G as z,K as A,M as B,R as C,k as D,x as E};
+export{b as z,G as A,K as B,M as C,R as D,k as E,x as F};

package/dist/{index-rftced5v.js → index-f2ne65w4.js}

@@ -1,2 +1,2 @@
 import{createRequire as q}from"node:module";var j=Object.create;var{getPrototypeOf:k,defineProperty:i,getOwnPropertyNames:l}=Object;var m=Object.prototype.hasOwnProperty;function n(a){return this[a]}var o,p,r=(a,b,d)=>{var f=a!=null&&typeof a==="object";if(f){var g=b?o??=new WeakMap:p??=new WeakMap,h=g.get(a);if(h)return h}d=a!=null?j(k(a)):{};let c=b||!a||!a.__esModule?i(d,"default",{value:a,enumerable:!0}):d;for(let e of l(a))if(!m.call(c,e))i(c,e,{get:n.bind(a,e),enumerable:!0});if(f)g.set(a,c);return c};var s=(a,b)=>()=>(b||a((b={exports:{}}).exports,b),b.exports);var u=q(import.meta.url);
-export{r as nf,s as of,u as pf};
+export{r as ca,s as da,u as ea};

package/dist/{index-rqync0pc.js → index-hazrk5c3.js}

@@ -1 +1 @@
-import{createHash as z}from"node:crypto";import{homedir as F,tmpdir as O}from"node:os";import{join as q,resolve as G}from"node:path";var J="OPENCODE_ANTHROPIC_AUTH_RPC_DIR";function T(g){let k=process.env[J]?.trim();if(k)return G(g,k);let w=z("sha256").update(g).digest("hex").slice(0,16),x=process.env.XDG_STATE_HOME||q(F(),".local","state");return q(x,"cortexkit","anthropic-auth","rpc",w)}export{O as q,T as r};
+import{createHash as z}from"node:crypto";import{homedir as F,tmpdir as O}from"node:os";import{join as q,resolve as G}from"node:path";var J="OPENCODE_ANTHROPIC_AUTH_RPC_DIR";function T(g){let k=process.env[J]?.trim();if(k)return G(g,k);let w=z("sha256").update(g).digest("hex").slice(0,16),x=process.env.XDG_STATE_HOME||q(F(),".local","state");return q(x,"cortexkit","anthropic-auth","rpc",w)}export{O as r,T as s};

package/dist/{index-1jkyhgyr.js → index-jexctf5w.js}

@@ -1,2 +1,2 @@
 var z=(f)=>f!==null&&typeof f==="object"&&!Array.isArray(f),G=(f)=>z(f)&&typeof f.sessionId==="string"&&f.sessionId.length>0,Z=(f)=>{if(!G(f)||!z(f)||f.command!=="claude"||typeof f.sectionId!=="string"||typeof f.actionId!=="string")return!1;if(f.itemId!==void 0&&typeof f.itemId!=="string")return!1;if(f.confirmed!==void 0&&typeof f.confirmed!=="boolean")return!1;if(f.values!==void 0&&(!z(f.values)||!Object.values(f.values).every((q)=>q===null||typeof q==="string"||typeof q==="boolean"||typeof q==="number"&&Number.isFinite(q))))return!1;return!0};function B(f){return{"~standard":{version:1,vendor:"cortexkit-native",validate:(q)=>f(q)?{value:q}:{issues:[{message:"Invalid native menu payload"}]}}}}var W=(f)=>z(f)&&f.command==="claude"&&z(f.menu)&&f.menu.command==="claude"&&typeof f.menu.title==="string"&&Array.isArray(f.menu.sections),$=(f)=>z(f)&&f.command==="claude"&&typeof f.ok==="boolean"&&typeof f.text==="string"&&z(f.menu)&&Array.isArray(f.menu.sections),A={id:"cortexkit-anthropic-native",methods:{open:{input:B(G),output:B(W)},apply:{input:B(Z),output:B($)}},events:{opened:{schema:B((f)=>G(f)&&W(f.payload))},notification:{schema:B((f)=>G(f)&&typeof f.message==="string"&&["info","warning","error"].includes(String(f.kind)))}}};async function L(f,q,X){let K=new AbortController,H=(j)=>({sessionId:j,notify(F,J="info"){D.events.emit("notification",{sessionId:j,message:F,kind:J}).catch(()=>{})}}),D=await f.rpc.register(A,{open:(j)=>q.open(H(j.sessionId)),apply:(j)=>q.apply(j,H(j.sessionId))}),Q;try{Q=await f.command.transform((j)=>j.add({name:"claude",description:"Native Claude accounts and settings",async execute(F){let J=await q.open(H(F.sessionID));await D.events.emit("opened",{sessionId:F.sessionID,payload:J})}}))}catch(j){throw await D.dispose(),j}let Y=(async()=>{try{for await(let j of f.event.subscribe({signal:K.signal}))if(j.type==="session.deleted")X.forgetSession(j.data.sessionID)}catch{}})(),S=!1;return{async dispose(){if(S)return;S=!0,K.abort(),await Promise.all([D.dispose(),Q.dispose(),Y])}}}
-export{A as s,L as t};
+export{A as t,L as u};

package/dist/index.js

@@ -1 +1 @@
-import{o as a}from"./index-nfcp0m1t.js";import"./index-2arfb1y3.js";import"./index-rqync0pc.js";import"./index-jmjevtm1.js";import"./index-qttfa42y.js";import"./index-mdpyfkv3.js";import"./index-fncp6r0j.js";import"./index-5hyennzm.js";import"./index-rftced5v.js";export{a as AnthropicAuthPlugin};
+import{p as a}from"./index-1nwcnxp8.js";import"./index-6chd6jnr.js";import"./index-hazrk5c3.js";import"./index-b1dvkp15.js";import"./index-53nnxq39.js";import"./index-ah5s0bew.js";import"./index-f2ne65w4.js";export{a as AnthropicAuthPlugin};

package/dist/request-class.d.ts

@@ -0,0 +1,10 @@
+import type { ClaudeCodeRequestClass } from '@cortexkit/anthropic-auth-core';
+/**
+ * Plugin-internal header that carries a request's Claude Code request class
+ * from the host's per-message hook to the fetch wrapper. It is removed before
+ * the request leaves.
+ */
+export declare const REQUEST_CLASS_REQUEST_HEADER = "x-cortexkit-request-class";
+export declare function isAuxiliaryAgent(agent: unknown): boolean;
+/** Read and remove the internal request-class header. */
+export declare function takeRequestClassHeader(headers: Headers): ClaudeCodeRequestClass;

package/dist/rpc/port-file.js

@@ -1 +1 @@
-import{lf as a,mf as b}from"../index-5hyennzm.js";import"../index-rftced5v.js";export{a as writePortFile,b as discoverPortFile};
+import{aa as a,ba as b}from"../index-ah5s0bew.js";import"../index-f2ne65w4.js";export{a as writePortFile,b as discoverPortFile};

package/dist/rpc/protocol.js

@@ -1 +1 @@
-import{p as a}from"../index-2arfb1y3.js";import"../index-rftced5v.js";export{a as COMMAND_MODAL_NAMES};
+import{q as a}from"../index-6chd6jnr.js";import"../index-f2ne65w4.js";export{a as COMMAND_MODAL_NAMES};

package/dist/rpc/rpc-client.js

@@ -1 +1 @@
-import{mf as s}from"../index-5hyennzm.js";import"../index-rftced5v.js";async function i(e,o,t,n){let r=await s(e,n);if(!r)return null;let a=new AbortController,l=setTimeout(()=>a.abort(),2000);try{let p=await fetch(`http://127.0.0.1:${r.port}/rpc/${o}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${r.token}`},body:JSON.stringify(t),signal:a.signal});if(!p.ok)return null;return await p.json()}catch{return null}finally{clearTimeout(l)}}function c(e,o){return{async pending(t,n){return(await i(e,"pending-notifications",{lastReceivedId:t,sessionId:n},o))?.messages??[]},async apply(t){return await i(e,"apply",{...t},o)??{text:"apply failed",knobs:{}}},async applyMenu(t){if(t.command!=="claude"||!t.sessionId?.trim())throw TypeError("A claude menu sessionId is required");let n=await i(e,"apply-menu",{...t},o);if(!n)throw Error("Menu apply unavailable; outcome unknown");return n}}}export{c as createRpcClient};
+import{ba as s}from"../index-ah5s0bew.js";import"../index-f2ne65w4.js";async function i(e,o,t,n){let r=await s(e,n);if(!r)return null;let a=new AbortController,l=setTimeout(()=>a.abort(),2000);try{let p=await fetch(`http://127.0.0.1:${r.port}/rpc/${o}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${r.token}`},body:JSON.stringify(t),signal:a.signal});if(!p.ok)return null;return await p.json()}catch{return null}finally{clearTimeout(l)}}function c(e,o){return{async pending(t,n){return(await i(e,"pending-notifications",{lastReceivedId:t,sessionId:n},o))?.messages??[]},async apply(t){return await i(e,"apply",{...t},o)??{text:"apply failed",knobs:{}}},async applyMenu(t){if(t.command!=="claude"||!t.sessionId?.trim())throw TypeError("A claude menu sessionId is required");let n=await i(e,"apply-menu",{...t},o);if(!n)throw Error("Menu apply unavailable; outcome unknown");return n}}}export{c as createRpcClient};

package/dist/rpc/rpc-dir.js

@@ -1 +1 @@
-import{q as a,r as b}from"../index-rqync0pc.js";import"../index-rftced5v.js";export{a as tmpdir,b as getRpcDir};
+import{r as a,s as b}from"../index-hazrk5c3.js";import"../index-f2ne65w4.js";export{a as tmpdir,b as getRpcDir};

package/dist/setup/native-activation.d.ts

@@ -2,9 +2,13 @@ import { type NativeCustodyActivationHooks, type NativeCustodyInventory } from '
 import { type NativeVaultEnrollmentOptions } from './native-enrollment.ts';
 import { type NativeSetupPaths } from './native-paths.ts';
 import { type CommandRunner, type HarnessKind, type ProcessFence } from './types.ts';
+type HostIndependentActivationCode = 'auth-content-refused' | 'host-auth-invalid' | 'primary-conflict' | 'consent-required' | 'primary-unverified';
+/** Activation codes whose remedy names the host, so the host is required. */
+type HostActivationCode = 'no-read-grant' | 'grant-reaches-nothing';
 export declare class NativeVaultActivationError extends Error {
-    readonly code: 'auth-content-refused' | 'host-auth-invalid' | 'primary-conflict' | 'consent-required' | 'primary-unverified';
-    constructor(code: 'auth-content-refused' | 'host-auth-invalid' | 'primary-conflict' | 'consent-required' | 'primary-unverified');
+    readonly code: HostIndependentActivationCode | HostActivationCode;
+    constructor(code: HostIndependentActivationCode);
+    constructor(code: HostActivationCode, host: HarnessKind);
 }
 export interface NativeVaultActivationOptions {
     env: NodeJS.ProcessEnv;
@@ -35,3 +39,4 @@ export declare function preflightNativeVaultForHost(host: HarnessKind, options:
 export declare function completeNativeVaultActivation(host: HarnessKind, options: NativeVaultActivationOptions, preflight: NativeVaultPreflight): Promise<'committed' | 'already-vault'>;
 /** Outside runSetup, check inputs, enroll the host, then grant and activate vault access. runSetup owns enrollment and calls preflight and completion separately. */
 export declare function activateNativeVaultForHost(host: HarnessKind, options: NativeVaultActivationOptions): Promise<'committed' | 'already-vault'>;
+export {};

package/dist/setup/native-enrollment.d.ts

@@ -37,5 +37,11 @@ export declare class NativeVaultEnrollmentError extends Error {
  * account discovery and the credential-store switch are separate setup steps.
  */
 export declare function enrollNativeVaultForHost(host: HarnessKind, options: NativeVaultEnrollmentOptions): Promise<void>;
+/**
+ * The `ck` arguments that grant this host's enrolled principal read access to
+ * the vault's anthropic-native category. Setup runs them, and the empty-vault
+ * message shows the same command so the user can run it by hand.
+ */
+export declare function nativeVaultGrantArgs(host: HarnessKind): string[];
 /** Grant this OpenCode or Pi principal read access to the vault's anthropic-native category; enrollment alone grants no provider access. */
 export declare function grantNativeVaultForHost(host: HarnessKind, options: Pick<NativeVaultEnrollmentOptions, 'env' | 'runner' | 'processFence' | 'ckBinary'>): Promise<void>;

package/dist/setup/native-login.d.ts

@@ -1,3 +1,14 @@
+import { isCancel, text } from '@clack/prompts';
+import { authorize, exchange, resolveClaudeCodeIdentity } from '@cortexkit/anthropic-auth-core';
 import type { NativeOfflineLogin } from './native-local';
 import type { HarnessKind } from './types';
-export declare function loginNativeOffline(host: HarnessKind): Promise<NativeOfflineLogin>;
+interface NativeLoginDependencies {
+    authorize: typeof authorize;
+    exchange: typeof exchange;
+    resolveClaudeCodeIdentity: typeof resolveClaudeCodeIdentity;
+    text: typeof text;
+    isCancel: typeof isCancel;
+    print: (line: string) => void;
+}
+export declare function loginNativeOffline(host: HarnessKind, dependencies?: NativeLoginDependencies): Promise<NativeOfflineLogin>;
+export {};

package/dist/sidebar-state.js

@@ -1 +1 @@
-import{F as a,G as b,H as c,I as d,J as e,K as f,L as g,M as h,N as i,O as j,P as k,Q as l,R as m,S as n,T as o,U as p,V as q,W as r,X as s,Y as t,Z as u,_ as v}from"./index-qttfa42y.js";import"./index-mdpyfkv3.js";import"./index-fncp6r0j.js";import"./index-rftced5v.js";export{i as setSidebarState,k as resolveActiveAccount,c as normalizeSidebarState,a as getSidebarStateFile,h as getSidebarState,f as getInitialSidebarRoutingTestHooks,p as getFableRecoverySummary,r as getCollapsedQuotaSummary,s as getCollapsedAccounts,q as formatQuotaRowLabel,m as formatPrimeTime,n as formatPrimeCost,o as formatPrimeAccountValue,l as formatFallbackModelLabel,j as drainSidebarWrites,v as computeQuotaPacing,d as __setSidebarStateWriteTestHooks,e as __setInitialSidebarRoutingTestHooks,g as __acquireSidebarStateLockForTest,u as SEVEN_DAY_MS,t as FIVE_HOUR_MS,b as DEFAULT_SIDEBAR_STATE};
+import{$ as v,G as a,H as b,I as c,J as d,K as e,L as f,M as g,N as h,O as i,P as j,Q as k,R as l,S as m,T as n,U as o,V as p,W as q,X as r,Y as s,Z as t,_ as u}from"./index-53nnxq39.js";import"./index-f2ne65w4.js";export{i as setSidebarState,k as resolveActiveAccount,c as normalizeSidebarState,a as getSidebarStateFile,h as getSidebarState,f as getInitialSidebarRoutingTestHooks,p as getFableRecoverySummary,r as getCollapsedQuotaSummary,s as getCollapsedAccounts,q as formatQuotaRowLabel,m as formatPrimeTime,n as formatPrimeCost,o as formatPrimeAccountValue,l as formatFallbackModelLabel,j as drainSidebarWrites,v as computeQuotaPacing,d as __setSidebarStateWriteTestHooks,e as __setInitialSidebarRoutingTestHooks,g as __acquireSidebarStateLockForTest,u as SEVEN_DAY_MS,t as FIVE_HOUR_MS,b as DEFAULT_SIDEBAR_STATE};

package/dist/transform.d.ts

@@ -1,4 +1,4 @@
-import { type BillingLineageFields, type Cache1hMode, type ClaudeCodeIdentity, type ThinkingPrefixMismatchBehavior } from '@cortexkit/anthropic-auth-core';
+import { type BillingLineageFields, type Cache1hMode, type ClaudeCodeIdentity, type ClaudeCodeRequestClass, type ThinkingPrefixMismatchBehavior } from '@cortexkit/anthropic-auth-core';
 import { type OpenCodeEffortMarkerPlan } from './effort-history';
 import { type ServerSideFallbackOutcome } from './server-fallback';
 export declare const NON_STREAMING_DIAGNOSTICS_MAX_BYTES: number;
@@ -31,6 +31,7 @@ export declare function addFastModeBetaHeader(headers: Headers): Headers;
 export declare function setOAuthHeaders(headers: Headers, accessToken: string, options?: {
     body?: Record<string, unknown> | null;
     identity?: ClaudeCodeIdentity;
+    requestClass?: ClaudeCodeRequestClass;
 }): Headers;
 /**
  * Add TOOL_PREFIX to tool names in the request body.
@@ -81,13 +82,6 @@ export type HybridMessageCacheAnchor = {
     messageCount: number;
 };
 export declare function extractLatestHybridMessageCacheAnchor(bodyText: string): HybridMessageCacheAnchor | undefined;
-export declare function prepareFableCacheWarmSource(bodyText: string, fableModel?: string): {
-    ok: true;
-    bodyText: string;
-} | {
-    ok: false;
-    reason: string;
-};
 /**
  * Rewrite the full request body: sanitize system prompt and prefix tool names.
  */

package/dist/tui-preferences.js

@@ -1,4 +1,4 @@
-import"./index-rftced5v.js";import{readFileSync as k,watch as C}from"node:fs";import{mkdir as _,readFile as I,rename as E,writeFile as b}from"node:fs/promises";import{homedir as g}from"node:os";import{basename as F,dirname as P,join as N}from"node:path";import{clearTimeout as D,setTimeout as L}from"node:timers";import{applyEdits as T,modify as y,parse as f}from"jsonc-parser";var v="OPENCODE_TUI_PREFERENCES_FILE",h="tui-preferences.jsonc";function A(){let J=process.env[v];if(J)return J;let z=process.env.OPENCODE_CONFIG_DIR||N(process.env.XDG_CONFIG_HOME||N(g(),".config"),"opencode");return N(z,h)}function H(J){return typeof J==="object"&&J!==null&&!Array.isArray(J)}async function qq(){try{let J=await I(A(),"utf8"),z=[],q=f(J,z,{allowTrailingComma:!0});if(z.length>0)return{};return H(q)?q:{}}catch{return{}}}var m="anthropic-auth",p=160,R={forceToTop:!1,order:p,startCollapsed:!1,rememberCollapsed:!0,collapsed:null,pollMs:1500,refreshDebounceMs:200,header:{label:"CLAUDE",showVersion:!0},sections:{quota:!0,fallbackAccounts:!0,routing:!0,cache:!0,health:!0,pacing:!0},appearance:{barWidth:10,barFilledChar:"█",barEmptyChar:"░",warnThreshold:50,errorThreshold:80}};function $(J,z){return typeof J==="boolean"?J:z}function Y(J,z,q,X){if(typeof J!=="number"||!Number.isFinite(J))return z;return Math.min(Math.max(Math.round(J),q),X)}function c(J,z,q){if(typeof J!=="string"||J.length===0)return z;return J.slice(0,q)}function w(J,z){if(typeof J!=="string")return z;return[...J][0]??z}function zq(J){let z=J[m];if(!H(z))return structuredClone(R);let q=R,X=H(z.header)?z.header:{},Q=H(z.sections)?z.sections:{},Z=H(z.appearance)?z.appearance:{},G=Y(Z.warnThreshold,q.appearance.warnThreshold,0,99),V=Math.max(Y(Z.errorThreshold,q.appearance.errorThreshold,0,100),Math.min(G+1,100));return{forceToTop:$(z.forceToTop,q.forceToTop),order:Y(z.order,q.order,-1e4,1e4),startCollapsed:$(z.startCollapsed,q.startCollapsed),rememberCollapsed:$(z.rememberCollapsed,q.rememberCollapsed),collapsed:typeof z.collapsed==="boolean"?z.collapsed:null,pollMs:Y(z.pollMs,q.pollMs,500,30000),refreshDebounceMs:Y(z.refreshDebounceMs,q.refreshDebounceMs,50,5000),header:{label:c(X.label,q.header.label,20),showVersion:$(X.showVersion,q.header.showVersion)},sections:{quota:$(Q.quota,q.sections.quota),fallbackAccounts:$(Q.fallbackAccounts,q.sections.fallbackAccounts),routing:$(Q.routing,q.sections.routing),cache:$(Q.cache,q.sections.cache),health:$(Q.health,q.sections.health),pacing:$(Q.pacing,q.sections.pacing)},appearance:{barWidth:Y(Z.barWidth,q.appearance.barWidth,4,40),barFilledChar:w(Z.barFilledChar,q.appearance.barFilledChar),barEmptyChar:w(Z.barEmptyChar,q.appearance.barEmptyChar),warnThreshold:G,errorThreshold:V}}}var u=-1e5;function Jq(J,z,q){let X=J[z];if(!H(X))return q;if(X.forceToTop===!0)return u+Object.keys(J).indexOf(z);return Y(X.order,q,-1e4,1e4)}var s=`// Shared preferences for opencode TUI plugins.
+import"./index-f2ne65w4.js";import{readFileSync as k,watch as C}from"node:fs";import{mkdir as _,readFile as I,rename as E,writeFile as b}from"node:fs/promises";import{homedir as g}from"node:os";import{basename as F,dirname as P,join as N}from"node:path";import{clearTimeout as D,setTimeout as L}from"node:timers";import{applyEdits as T,modify as y,parse as f}from"jsonc-parser";var v="OPENCODE_TUI_PREFERENCES_FILE",h="tui-preferences.jsonc";function A(){let J=process.env[v];if(J)return J;let z=process.env.OPENCODE_CONFIG_DIR||N(process.env.XDG_CONFIG_HOME||N(g(),".config"),"opencode");return N(z,h)}function H(J){return typeof J==="object"&&J!==null&&!Array.isArray(J)}async function qq(){try{let J=await I(A(),"utf8"),z=[],q=f(J,z,{allowTrailingComma:!0});if(z.length>0)return{};return H(q)?q:{}}catch{return{}}}var m="anthropic-auth",p=160,R={forceToTop:!1,order:p,startCollapsed:!1,rememberCollapsed:!0,collapsed:null,pollMs:1500,refreshDebounceMs:200,header:{label:"CLAUDE",showVersion:!0},sections:{quota:!0,fallbackAccounts:!0,routing:!0,cache:!0,health:!0,pacing:!0},appearance:{barWidth:10,barFilledChar:"█",barEmptyChar:"░",warnThreshold:50,errorThreshold:80}};function $(J,z){return typeof J==="boolean"?J:z}function Y(J,z,q,X){if(typeof J!=="number"||!Number.isFinite(J))return z;return Math.min(Math.max(Math.round(J),q),X)}function c(J,z,q){if(typeof J!=="string"||J.length===0)return z;return J.slice(0,q)}function w(J,z){if(typeof J!=="string")return z;return[...J][0]??z}function zq(J){let z=J[m];if(!H(z))return structuredClone(R);let q=R,X=H(z.header)?z.header:{},Q=H(z.sections)?z.sections:{},Z=H(z.appearance)?z.appearance:{},G=Y(Z.warnThreshold,q.appearance.warnThreshold,0,99),V=Math.max(Y(Z.errorThreshold,q.appearance.errorThreshold,0,100),Math.min(G+1,100));return{forceToTop:$(z.forceToTop,q.forceToTop),order:Y(z.order,q.order,-1e4,1e4),startCollapsed:$(z.startCollapsed,q.startCollapsed),rememberCollapsed:$(z.rememberCollapsed,q.rememberCollapsed),collapsed:typeof z.collapsed==="boolean"?z.collapsed:null,pollMs:Y(z.pollMs,q.pollMs,500,30000),refreshDebounceMs:Y(z.refreshDebounceMs,q.refreshDebounceMs,50,5000),header:{label:c(X.label,q.header.label,20),showVersion:$(X.showVersion,q.header.showVersion)},sections:{quota:$(Q.quota,q.sections.quota),fallbackAccounts:$(Q.fallbackAccounts,q.sections.fallbackAccounts),routing:$(Q.routing,q.sections.routing),cache:$(Q.cache,q.sections.cache),health:$(Q.health,q.sections.health),pacing:$(Q.pacing,q.sections.pacing)},appearance:{barWidth:Y(Z.barWidth,q.appearance.barWidth,4,40),barFilledChar:w(Z.barFilledChar,q.appearance.barFilledChar),barEmptyChar:w(Z.barEmptyChar,q.appearance.barEmptyChar),warnThreshold:G,errorThreshold:V}}}var u=-1e5;function Jq(J,z,q){let X=J[z];if(!H(X))return q;if(X.forceToTop===!0)return u+Object.keys(J).indexOf(z);return Y(X.order,q,-1e4,1e4)}var s=`// Shared preferences for opencode TUI plugins.
 // One top-level key per plugin (short name). See each plugin's README for
 // its supported settings. This file is safe to hand-edit; plugins update
 // individual keys in place and preserve comments.

package/dist/v2/adapter.d.ts

@@ -1,4 +1,4 @@
-import { type ClaudeCodeIdentity, TrailingAssistantHistoryError } from '@cortexkit/anthropic-auth-core';
+import { type ClaudeCodeIdentity, type RequestGzipLatch, TrailingAssistantHistoryError } from '@cortexkit/anthropic-auth-core';
 import type { AccountRequest, AttemptOutcome, ChooseAccountInput, HeaderEdits, HostError, LimitSignal, OpenCode2AuthAdapter, RequestScope, Transport } from '@cortexkit/common-auth/opencode2';
 import { EffortMarkerCorrelationError } from '../effort-history';
 import { createStrippedStream, rewriteRequestBody } from '../transform';
@@ -211,6 +211,11 @@ export interface NativeAnthropicAdapterDeps<Q, P> {
      * ended; the source's work is not cancelled.
      */
     readonly attemptEndTimeoutMs?: number;
+    /**
+     * Remembers a rejected gzipped body. Defaults to the latch next to the
+     * OpenCode account storage file.
+     */
+    readonly requestGzipLatch?: RequestGzipLatch;
 }
 export interface NativeAnthropicAdapter<Q, P> {
     readonly adapter: OpenCode2AuthAdapter<Q, NativeAnthropicAttemptData<P>>;

package/dist/v2/server.js

@@ -1,4 +1,4 @@
-import{a as k2,b as B1,c as K1,d as H$,e as U$,f as f2,g as O2,h as L$,i as z1,j as M$,k as _$,l as C$,m as N$,n as P$,o as E1}from"../index-nfcp0m1t.js";import"../index-2arfb1y3.js";import"../index-rqync0pc.js";import{t as T1}from"../index-1jkyhgyr.js";import{u as N1,v as P1,x as F1}from"../index-kd89hcr3.js";import"../index-jmjevtm1.js";import"../index-qttfa42y.js";import{$c as q$,Ad as X1,Ae as V1,Eb as p$,Ee as d$,Fa as w2,Fe as K$,Ga as e$,Gd as x2,Ge as z$,Hc as p2,Hd as Y1,He as a2,Ic as c2,Lc as D$,Ld as G1,Ma as D2,Mc as w$,Nc as b$,Oa as $1,Ob as c$,Oc as _2,Od as L1,Pc as o2,Pd as V2,Qc as y$,Sc as E$,Tc as S$,Ua as b2,Uc as x$,Ud as M1,Vc as I$,Vd as R2,Xb as i$,Xc as f$,Zc as g$,_a as Z1,ad as v$,fc as o$,fd as B$,ia as j$,ie as _1,je as W1,ke as J1,la as V$,nc as S2,nd as j2,od as Q$,oe as C1,qe as m$,re as l$,ta as y2,td as X2,te as r2,ua as I2,ud as h$,ve as a$,wc as H2,wd as U1,ze as j1}from"../index-mdpyfkv3.js";import"../index-fncp6r0j.js";import"../index-5hyennzm.js";import"../index-rftced5v.js";class P2 extends Error{kind;providerID;sessionID;requestKind;constructor($){super($.message??`${$.providerID} ${$.requestKind} request refused (${$.kind})`);this.name="OpenCode2AuthError",this.kind=$.kind,this.providerID=$.providerID,this.sessionID=$.sessionID,this.requestKind=$.requestKind}}function Q2($){return`common-auth-placeholder.${$}`}function X$($){let X=Q2($.integrationID);return{type:"oauth",methodID:$.methodID,access:X,refresh:X,expires:$.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function v2($,X){if($?.type!=="oauth")return!1;let L=X===void 0?void 0:Q2(X),V=(C)=>L===void 0?C.startsWith("common-auth-placeholder."):C===L;return V($.access)&&V($.refresh)}var Y$="No browser sign-in: this connects the plugin to the accounts in its vault.";async function h2($,X){let L=X.now??Date.now,{integrationID:V}=X,C=(E)=>X$({integrationID:V,methodID:E,now:L()}),_=async(E,H)=>{return await X.onLogin(E,{integrationID:V,methodID:H}),C(H)},P=(E)=>async(H)=>{let Y=E.method.id,U=await E.authorize(H),Q={url:U.url,instructions:U.instructions,...U.expiresAt===void 0?{}:{expiresAt:U.expiresAt}};if(U.mode==="auto")return{...Q,mode:"auto",callback:U.callback.then((T)=>_(T,Y))};let K=U.callback;return{...Q,mode:"code",callback:async(T)=>_(await K(T),Y)}};return $.integration.transform((E)=>{let H=X.label===void 0?{}:{label:()=>X.label};for(let Q of X.methods)E.method.update({integrationID:V,method:Q.method,authorize:P(Q),refresh:async(K)=>{if(!v2(K,V))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return C(K.methodID)},...H});let Y=X.vault;if(Y===void 0)return;let U=Y.method.id;E.method.update({integrationID:V,method:Y.method,authorize:async()=>({url:"",instructions:Y.instructions??Y$,mode:"auto",callback:Promise.resolve().then(()=>Y.activate({integrationID:V,methodID:U})).then(()=>C(U))}),refresh:async(Q)=>{if(!v2(Q,V)||Q.methodID!==U)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return C(U)},...H})})}function S1($){let X=[],L;for(let V of $.split(/\r?\n/))if(V.startsWith("data:"))X.push(V.slice(5).replace(/^ /,""));else if(V.startsWith("event:"))L=V.slice(6).trim();if(X.length===0)return;return L===void 0?{data:X.join(`
-`)}:{event:L,data:X.join(`
-`)}}function m2($,X){let L=new TextDecoder,V="",C=(P)=>{let E=S1(P);if(!E)return;try{$(E)}catch(H){X(H)}},_=()=>{for(;;){let P=/\r?\n\r?\n/.exec(V);if(!P)return;let E=V.slice(0,P.index);V=V.slice(P.index+P[0].length),C(E)}};return new TransformStream({transform(P,E){E.enqueue(P),V+=L.decode(P,{stream:!0}),_()},flush(){if(V+=L.decode(),_(),V.trim()!=="")C(V);V=""}})}var G$=512,U2="x-common-auth-attempt",K2=($,X)=>JSON.stringify([$,X]),J2=($)=>({providerID:$.model.providerID,modelID:$.model.id,sessionID:$.sessionID,agent:$.agent,kind:$.kind});function x1($){let X=$.headers;return typeof X==="object"&&X!==null}function R1($,X){let L=$.getReader();return new ReadableStream({async pull(V){let C;try{C=await L.read()}catch(_){X({reason:"failed",message:_ instanceof Error?_.message:String(_)}),V.error(_);return}if(C.done)X(),V.close();else V.enqueue(C.value)},async cancel(V){X({reason:"cancelled",...V===void 0?{}:{message:String(V)}}),await L.cancel(V)}})}function l2($,X){for(let[L,V]of Object.entries(X)){let C=L.toLowerCase();for(let _ of Object.keys($))if(_.toLowerCase()===C)delete $[_];if(V!==null)$[L]=V}}function A1($,X){for(let[L,V]of Object.entries(X))if(V===null)$.delete(L);else $.set(L,V)}async function d2($,X,L={}){let{providerID:V}=X,C=L.gateOnPlaceholder,_=(Z)=>C===void 0||C.credential(Z)===Q2(V),P=L.logger,E=Math.max(1,L.maxRecords??G$),H=[...L.hostCredentials??[Q2(V)],...C?[Q2(V)]:[]].filter((Z)=>Z!==""),Y=new Map,U=new WeakMap,Q=new Map,K=new Set,T=new Map,q=!1,A=!1,m=new Map,I=0,d=!1,n=new Map,i=(Z,B)=>{try{P?.warn(Z,B)}catch{}},G=(Z)=>Z instanceof Error?Z.message:String(Z),j=async(Z,B)=>{let M=m.get(Z);if(!M||M.size===0)return;await Promise.all([...M].map(async(F)=>{try{await F(B)}catch(y){i("opencode2 auth listener threw; the request is unaffected",{event:Z,error:G(y)})}}))},J=async(Z,B)=>{try{await X.onAttemptEnd?.(Z,B)}catch(M){i("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:Z.attemptId,error:G(M)})}},S=(Z,B)=>{if(Z.ended||!Z.attempt)return;let M={...Z.status===void 0?{}:{status:Z.status},outputStarted:Z.outputStarted,...Z.limit?{limit:Z.limit.signal}:{},...B?{error:B}:{}};if(B)Z.endError=B;Z.ended=J(Z.attempt,M)},R=(Z,B)=>S(Z,{reason:"abandoned",message:B}),x=(Z)=>[...Y.values()].filter((B)=>B.key===Z),v=(Z)=>x(Z).at(-1),c=(Z)=>{if(Y.delete(Z.id),!x(Z.key).length)Q.delete(Z.key)},o=(Z)=>{Y.set(Z.id,Z);while(Y.size>E){let B=Y.values().next().value;if(B===void 0)break;R(B,"dropped to keep the record bound"),c(B)}},f=(Z)=>Z.accountId===void 0?void 0:{...Z.scope,accountId:Z.accountId},u=(Z,B)=>new P2({kind:"no-account",providerID:V,sessionID:Z.sessionID,requestKind:Z.kind,...B===void 0?{}:{message:B}}),W=(Z)=>{n.get(Z)?.clear(),n.delete(Z)},z=async(Z,B)=>{let M=()=>u(Z,`${V} ${Z.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(d)throw M();let F=n.get(Z.sessionID);if(!F)F=new Set,n.set(Z.sessionID,F);let y={};F.add(y);let h=()=>{if(!F.has(y))throw M()};try{return await B(h)}finally{if(F.delete(y),F.size===0&&n.get(Z.sessionID)===F)n.delete(Z.sessionID)}},N=(Z,B)=>{for(let[M,F]of B)if(H.some((y)=>F.includes(y)))throw new P2({kind:"host-credential-on-wire",providerID:V,sessionID:Z.sessionID,requestKind:Z.kind,message:`${V} ${Z.kind} request still carries the host's placeholder credential in ${M}; the adapter's account headers must replace it`})},D=(Z)=>{for(let B of x(Z))if(B.ended||!B.attempt)c(B);else if(B.transport==="ws"||B.judged)R(B,"a newer attempt of its session and kind began"),c(B)},O=async(Z,B,M,F)=>{let y=K2(Z.sessionID,Z.kind),h=Q.get(y);Q.delete(y);let w=h?.accountId??v(y)?.accountId;D(y);let g={...Z,...w===void 0?{}:{previousAccountId:w},...h?.rerouteFrom===void 0?{}:{rerouteFrom:h.rerouteFrom}},p=await X.chooseAccount(g);M();let W2={},$$;if(p!==void 0){let A2=await X.accountHeaders({...Z,accountId:p});if(M(),x1(A2))W2=A2.headers,$$=A2.attempt;else W2=A2}let Z$=`attempt-${++I}`,N2={id:Z$,key:y,scope:Z,accountId:p,headers:W2,attempt:p===void 0?void 0:{...Z,accountId:p,attemptId:Z$,transport:F,data:$$},...F===void 0?{}:{transport:F},outputStarted:!1};if(o(N2),N2.attempt)j("select",{...Z,accountId:N2.attempt.accountId,hook:B,...g.previousAccountId===void 0?{}:{previousAccountId:g.previousAccountId},...g.rerouteFrom===void 0?{}:{rerouteFrom:g.rerouteFrom},handle:N2.attempt});return N2},k=async(Z,B,M,F,y)=>{let h=K2(Z.sessionID,Z.kind),w=F===void 0?void 0:Y.get(F);if(w?.key!==h)w=void 0;if(!w){if(w=v(h),x(h).filter((p)=>p.transport===void 0&&!p.ended).length>1&&!A)A=!0,i("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:Z.sessionID,kind:Z.kind})}if(!w||w.transport!==void 0||w.ended)w=await O(Z,B,y,M);else if(w.transport=M,w.attempt)w.attempt.transport=M;if(M==="ws"){for(let g of x(h))if(g!==w&&g.transport==="ws")R(g,"a newer attempt of its session and kind went out over WebSocket")}return w},b=async(Z,B)=>{try{return await B()}catch(M){throw S(Z,{reason:"failed",message:G(M)}),M}},s=(Z,B)=>{let M=x(K2(Z,B)).filter((F)=>F.transport==="ws").at(-1);return M?.attempt!==void 0&&!M.ended?M:void 0},l=(Z,B,M)=>{let F=f(Z);if(!F||!Z.attempt||Z.limit)return;Z.limit={signal:B,delivered:j("limit",{...F,via:M,limit:B,outputStarted:Z.outputStarted,handle:Z.attempt})}},Z2=(Z,B,M,F)=>{let y=f(Z);if(!y||!Z.attempt)return;j("quota",{...y,transport:B,...F===void 0?{}:{status:F},quota:M,handle:Z.attempt})},$2=(Z,B,M,F)=>{let y=Z.attempt;if(!y)return;let h=X.inspectEvent?.(F===void 0?{transport:B,data:M,attempt:y}:{transport:B,data:M,event:F,attempt:y});if(!h)return;if(h.quota!==void 0)Z2(Z,B,h.quota);if(h.outputStarted)Z.outputStarted=!0;if(h.limit)l(Z,h.limit,B);if(h.error!==void 0)S(Z,{reason:"failed",message:h.error});else if(h.done)S(Z)},Y2=(Z,B)=>{let M=Z.attempt;if(!M||B.accountId===Z.accountId)return;if(M.reboundFrom??=M.accountId,M.accountId=B.accountId,"data"in B)M.data=B.data;Z.accountId=B.accountId},e=(Z)=>!Z.attempt||Z.endError!==void 0||Z.status!==void 0&&Z.status>=400,r=(Z)=>{let B=[...Y.values()].filter((g)=>g.scope.sessionID===Z),M=B.filter((g)=>g.limit&&!g.rerouted).at(-1);if(M)return M;let F=B.filter((g)=>g.scope.kind==="primary"),y=F.length>0?F:B;if(y.length<=1)return y[0];let h=y.filter((g)=>!g.judged&&e(g)).at(-1);if(h)return h;let w=y.filter((g)=>g.attempt&&!g.ended);if(w.length>1)return"ambiguous";return w[0]??y.at(-1)},t={providerID:V},a=[];a.push(await $.session.hook("model.request",(Z)=>{if(C)return;return z(J2(Z),async(B)=>{let M=await O(J2(Z),"model.request",B);if(B(),M.accountId===void 0)throw u(M.scope);l2(Z.headers,{...M.headers,[U2]:M.id})})},t)),a.push(await $.session.hook("http.request",(Z)=>{if(C){let B=_(Z.request.headers);if(T.set(Z.sessionID,B),!B)return}return z(J2(Z),async(B)=>{let M=Z.request.headers.get(U2)??void 0,F=C?await O(J2(Z),"http.request",B,"http"):await k(J2(Z),"http.request","http",M,B);B();let y=f(F),h=F.attempt;if(!y||!h)throw u(F.scope);await b(F,async()=>{let w=Z.request;if(X.rewriteRequest){if(M!==void 0){let W2=new Headers(w.headers);W2.delete(U2),w=new Request(w,{headers:W2})}w=await X.rewriteRequest({...y,request:w,attempt:h})??w,B()}let g=new Headers(w.headers);g.delete(U2),A1(g,F.headers),N(F.scope,g.entries());let p=new Request(w,{headers:g});U.set(p,F),Z.request=p})})},t)),a.push(await $.session.hook("http.response",async(Z)=>{let B=U.get(Z.request);if(!B){if(C)return;if(!q)q=!0,i("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:Z.sessionID,kind:Z.kind});return}let M=Z.response;if(X.answeredBy&&B.attempt){let g=B.attempt,p=await b(B,async()=>X.answeredBy?.({request:Z.request,response:M,attempt:g}));if(p)Y2(B,p)}let F=f(B),y=B.attempt;if(!F||!y)return;B.status=M.status;let h=X.quotaFromHeaders?.(M.headers,M.status,y);if(h!==void 0)Z2(B,"http",h,M.status);if(!M.ok&&X.limitFromResponse){let g=await X.limitFromResponse({status:M.status,headers:M.headers,body:()=>M.clone().text(),attempt:y});if(g)l(B,g,"http")}if(!M.ok||!M.body)S(B);let w=M;if(M.body&&(X.inspectEvent||X.onAttemptEnd)){let g=M.body;if(X.inspectEvent)g=g.pipeThrough(m2((p)=>$2(B,"http",p.data,p.event),(p)=>i("opencode2 auth event inspection threw",{error:G(p)})));w=new Response(R1(g,(p)=>S(B,p)),{status:M.status,statusText:M.statusText,headers:M.headers})}if(X.rewriteResponse)w=await X.rewriteResponse({...F,request:Z.request,response:w,attempt:y})??w;if(w!==M)Z.response=w},t)),a.push(await $.session.hook("experimental.ws.handshake",(Z)=>{if(C){let B=_(new Headers(Z.headers)),M=K2(Z.sessionID,Z.kind);if(T.set(Z.sessionID,B),K.delete(M),!B)return}return z(J2(Z),async(B)=>{let M;for(let w of Object.keys(Z.headers)){if(w.toLowerCase()!==U2)continue;M??=Z.headers[w],delete Z.headers[w]}let F=C?await O(J2(Z),"experimental.ws.handshake",B,"ws"):await k(J2(Z),"experimental.ws.handshake","ws",M,B);B();let y=f(F),h=F.attempt;if(!y||!h)throw u(F.scope);await b(F,async()=>{l2(Z.headers,F.headers);let w=X.rewriteHandshakeURL?.({...y,url:Z.url,attempt:h});if(w!==void 0)Z.url=w;if(N(F.scope,Object.entries(Z.headers)),C)K.add(F.key)})})},t));let B2=X.rewriteWebSocketFrame?.bind(X);if(B2)a.push(await $.session.hook("experimental.ws.send",async(Z)=>{let B=J2(Z);if(C&&!K.has(K2(B.sessionID,B.kind)))return;let M=s(B.sessionID,B.kind),F=await B2({...B,attempt:M?.attempt,frame:Z.frame});if(F!==void 0)Z.frame=F},t));a.push(await $.session.hook("experimental.ws.receive",(Z)=>{if(C&&!K.has(K2(Z.sessionID,Z.kind)))return;let B=s(Z.sessionID,Z.kind);if(!B)return;try{$2(B,"ws",Z.frame)}catch(M){i("opencode2 auth frame inspection threw",{error:G(M)})}},t)),a.push(await $.session.hook("retry",async(Z)=>{if(C&&T.get(Z.sessionID)!==!0)return;let B=r(Z.sessionID);if(!B)return;let M=Z.decision;if(B==="ambiguous"){await j("retry",{sessionID:Z.sessionID,attempt:Z.attempt,reason:"host-decides",hostDecision:M,decision:M});return}let F=B;await z(F.scope,async(y)=>{F.judged=!0;let h=M,w,g,p=F.attempt;if(F.accountId===void 0||!p)h={retry:!1},w="no-account";else if(F.outputStarted)h={retry:!1},w="output-started";else{if(!F.limit){let W2=X.limitFromError?.(Z.error,p);if(W2)l(F,W2,"error")}if(F.ended)await F.ended,y();if(F.limit)await F.limit.delivered,y(),F.rerouted=!0,g={accountId:F.accountId,limit:F.limit.signal},h={retry:!0,delay:0},w="reroute";else w="host-decides"}if(Z.decision=h,h.retry&&F.accountId!==void 0)Q.set(F.key,{sessionID:F.scope.sessionID,accountId:F.accountId,...g===void 0?{}:{rerouteFrom:g}});await j("retry",{sessionID:Z.sessionID,...F.accountId===void 0?{}:{accountId:F.accountId},kind:F.scope.kind,attempt:Z.attempt,reason:w,hostDecision:M,decision:h,...p===void 0?{}:{handle:p}})})},t));let C2=(Z)=>{W(Z),T.delete(Z);for(let B of K)if(JSON.parse(B)[0]===Z)K.delete(B);for(let B of[...Y.values()]){if(B.scope.sessionID!==Z)continue;R(B,"its session was forgotten"),Y.delete(B.id)}for(let[B,M]of Q)if(M.sessionID===Z)Q.delete(B)},G2=new AbortController,e2=$.event;if(e2)(async()=>{try{for await(let Z of e2.subscribe({signal:G2.signal}))if(Z.type==="session.deleted")C2(Z.data.sessionID)}catch(Z){if(!G2.signal.aborted)i("opencode2 auth stopped listening for session deletion",{error:G(Z)})}})();return{on(Z,B){let M=m.get(Z);if(!M)M=new Set,m.set(Z,M);let F=B;return M.add(F),()=>{M.delete(F)}},accountFor(Z,B){return v(K2(Z,B))?.accountId},forgetSession:C2,get size(){return Y.size},async dispose(){if(d)return;d=!0;for(let Z of n.keys())W(Z);G2.abort();for(let Z of Y.values())R(Z,"the installation was disposed");Y.clear(),Q.clear(),K.clear(),T.clear(),m.clear(),await Promise.all(a.map(async(Z)=>{try{await Z.dispose()}catch(B){i("opencode2 auth hook did not dispose cleanly",{error:G(B)})}}))}}}import{createHash as q1}from"node:crypto";var T2="anthropic",F$="x-common-auth-attempt",k1=["x-session-affinity","x-opencode-session","x-parent-session-id",H$,k2,O2,F$],q2=new Set(["authorization","x-api-key"]),D1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",w1=512,b1=5000,y1=500,W$=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class T$ extends Error{sessionID;requestKind;kind="no-account";providerID=T2;constructor($,X){super(D1);this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicNoAccountError"}}class i2 extends Error{sessionID;requestKind;kind="session-forgotten";providerID=T2;constructor($,X){super("request refused: its session was closed while it was being prepared");this.sessionID=$;this.requestKind=X;this.name="NativeAnthropicRevokedError"}}class L2 extends Error{kind="unsupported-transport";providerID=T2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class O$ extends Error{kind="local-invalid-request";status=400;check;constructor($){super($.message,{cause:$});this.name="NativeAnthropicLocalRefusal",this.check=$.check}}var z2=($)=>typeof $==="object"&&$!==null&&!Array.isArray($);function F2($){try{return JSON.parse($)}catch{return}}function u2($){let X={};for(let[L,V]of Object.entries($??{}))X[L.toLowerCase()]=V;return X}function J$($){let X={};for(let L of k1){let V=$.get(L);if(V!==null&&L!==F$)X[L]=V;$.delete(L)}return X}function I1($){try{return new URL($).pathname.endsWith("/messages")}catch{return!1}}function f1($){return $ instanceof K$||$ instanceof U$?new O$($):void 0}function g1($,X){let L=[];if($.oauth)L.push($.oauth.accessToken);for(let[V,C]of Object.entries($.apiHeaders??{})){if(C===null||!q2.has(V))continue;L.push(C.replace(/^Bearer\s+/i,""))}for(let V of q2){let C=X.get(V);if(C!==null)L.push(C.replace(/^Bearer\s+/i,""))}if($.dispatch?.kind==="http-relay")L.push($.dispatch.token);return[...new Set(L.filter(Boolean))]}var v1=new Set(["oauth-2025-04-20","claude-code-20250219",L$]);function h1($){let X=$.split(",").map((L)=>L.trim()).filter((L)=>L&&!v1.has(L));return V$(null,X)}function m1($){let X=F2($);if(!z2(X))return $;let L=z$(X.messages),V=Object.hasOwn(X,"fallbacks"),{droppedMarkers:C}=M$(X,!1),_=V&&!Object.hasOwn(X,"fallbacks"),P=Q$(X);return L>0||C>0||_||P?JSON.stringify(X):$}async function l1($,X){if(!($ instanceof Promise))return"settled";let L;try{return await Promise.race([$.then(()=>"settled"),new Promise((V)=>{L=setTimeout(()=>V("timed-out"),X)})])}finally{if(L!==void 0)clearTimeout(L)}}function M2($){let{source:X,log:L}=$,V=Math.max(1,$.maxPendingSends??w1),C=$.attemptEndTimeoutMs??b1,_=new Map,P=new WeakMap,E=new WeakMap,H=new WeakMap,Y=new Map,U=new WeakMap,Q=p2([]);Q.dispose();let K=(W)=>(W&&Y.get(W)?.redactor)??Q,T=(W)=>{let z=Y.get(W);if(!z)return;Y.delete(W),z.redactor.dispose(),z.scope.dispose()},q=(W,z,N,D)=>{let O=g1(z,D),k=c2(O,N);A.set(W,N),Y.set(W,{sessionID:z.sessionID,redactor:p2(O),scope:k}),k.settled.then(()=>T(W));while(Y.size>V){let b=Y.keys().next().value;if(b===void 0)break;T(b)}},A=new WeakMap,m=(W,z)=>{let N=W?A.get(W):void 0;if(!N||!z.ok)return Q.redactResponse(z);let D=c2([],N),O=D.redactResponse(z);return D.dispose(),O},I=(W,z)=>{let N=W?Y.get(W)?.scope:void 0;if(!N)return m(W,z);try{return N.redactResponse(z)}catch{return m(W,z)}},d=!1,n=new WeakMap,i=(W,z)=>{if(W&&!z.ok)n.set(z.headers,W);return z},G=(W,z)=>{if(z.dispatch!=="http-relay")return!0;let N=/^req_[A-Za-z0-9_-]+$/.test(W.get("request-id")??"");return E.set(z,N),N},j=(W)=>new T$(W.sessionID,W.kind),J=new Map,S=async(W,z)=>{if(d)throw new i2(W.sessionID,W.kind);let N={revoked:!1},D=J.get(W.sessionID);if(!D)D=new Set,J.set(W.sessionID,D);D.add(N);let O=()=>{if(d||N.revoked)throw new i2(W.sessionID,W.kind)};try{let k=await z(O);return O(),k}finally{let k=J.get(W.sessionID);if(k?.delete(N)&&k.size===0)J.delete(W.sessionID)}},R=(W,z)=>{_.set(W,z);while(_.size>V){let N=_.keys().next().value;if(N===void 0)break;_.delete(N),L?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:V})}},x=(W,z)=>({providerID:W.providerID,modelID:W.modelID,sessionID:W.sessionID,agent:W.agent,kind:W.kind,accountId:W.accountId,attemptId:W.attemptId,transport:W.transport,route:z.route,provenance:z.provenance,dispatch:z.dispatch}),v=(W)=>S(W,async(z)=>{let{accountId:N,...D}=W,O=await X.authorizeAccount(D,N);return z(),c(D,O)}),c=(W,z)=>{if(!z)throw j(W);if(z.dispatch?.kind==="websocket-relay")throw new L2;let N=z.dispatch?.kind==="http-relay"?"http-relay":"direct",D=z.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":z.dispatch.token}:void 0;if(z.route==="oauth"){if(!z.accessToken)throw j(W);j$(z.accessToken,T2);let b=Object.freeze({route:"oauth",provenance:z.provenance,dispatch:N});R(b,{sessionID:W.sessionID,oauth:{accessToken:z.accessToken,...z.identity?{identity:z.identity}:{}},dispatch:z.dispatch,oauthHeaders:z.headers});let s=u2(z.headers);for(let l of q2)delete s[l];return delete s["anthropic-beta"],{headers:D??{...s,"x-api-key":null,authorization:`Bearer ${z.accessToken}`},attempt:b}}let O={authorization:null,"x-api-key":null,...u2(z.headers)};if(!O.authorization&&!O["x-api-key"])throw j(W);let k=Object.freeze({route:"api",provenance:z.provenance,dispatch:N});return R(k,{sessionID:W.sessionID,...z.baseURL?{baseURL:z.baseURL}:{},dispatch:z.dispatch,apiHeaders:O}),{headers:D??O,attempt:k}},o=(W)=>S(W,(z)=>f(W,z)),f=async(W,z)=>{let{request:N,attempt:D}=W,O=D.data,k=O?_.get(O):void 0;if(O)_.delete(O);if(!O||!k||O.route==="oauth"&&!k.oauth)throw j(W);let b=new Headers(N.headers);B$(b);let s=J$(b),l=N.body===null?void 0:await N.text();z();let Z2=l!==void 0&&I1(N.url);try{if(O.route==="oauth"&&k.oauth){let{accessToken:e,identity:r}=k.oauth;for(let[a,B2]of Object.entries(u2(k.oauthHeaders))){if(q2.has(a))continue;if(B2===null)b.delete(a);else b.set(a,B2)}let t=null;if(l!==void 0&&Z2){let a={...x(D,O),modelID:(()=>{let G2=F2(l);return j2(z2(G2)&&typeof G2.model==="string"?G2.model:W.modelID)})(),route:"oauth",correlation:s},B2=await X.requestOptions?.(a)??{};z(),l=await N$(l,{...B2,...r?{identity:r}:{},sessionId:W.sessionID,onToolNameMap:(G2)=>H.set(O,G2)});let C2=F2(l);t=z2(C2)?C2:null}_$(b,e,{body:t,...r?{identity:r}:{}})}else{if(l!==void 0&&Z2)l=m1(l);b.delete("authorization"),b.delete("x-api-key");for(let[r,t]of Object.entries(k.apiHeaders??{}))if(t===null)b.delete(r);else b.set(r,t);if(l!==void 0&&Z2&&!b.has("content-type"))b.set("content-type","application/json");let e=b.get("anthropic-beta");if(e!==null){let r=h1(e);if(r)b.set("anthropic-beta",r);else b.delete("anthropic-beta")}}}catch(e){let r=f1(e);if(!r)throw e;throw P.set(O,r.check),L?.warn("refused an Anthropic request locally; nothing was sent",{check:r.check}),r}let $2=l!==void 0?F2(l):void 0;if(await X.admitRequest?.({...x(D,O),modelID:j2(z2($2)&&typeof $2.model==="string"?$2.model:W.modelID)}),J$(b),l!==void 0)b.delete("content-length");z(),q(O,k,z2($2)&&$2.stream===!0?"event-stream":"http",b);let Y2=C$(N.url,k.baseURL!==void 0?{baseURL:k.baseURL}:{}).url?.toString()??N.url;if(O.route==="oauth"&&Z2&&l!==void 0)await X.onRequestPrepared?.({...x(D,O),url:Y2,bodyText:l}),z();if(k.dispatch?.kind==="http-relay"){let e=l??"";b.delete("x-relay-token");let r={protocol:1,type:"request",affinity:W.sessionID,upstream:{url:Y2,method:N.method,headers:Object.fromEntries(b)},mode:"full_sync",revision:1,body:e,next_hash:`sha256:${q1("sha256").update(e).digest("hex")}`};return new Request(k.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":k.dispatch.token},redirect:"error",signal:N.signal,body:JSON.stringify(r)})}return new Request(Y2,{method:N.method,headers:b,redirect:N.redirect,signal:N.signal,...l!==void 0?{body:l}:{}})};return{adapter:{providerID:T2,chooseAccount:(W)=>S(W,async()=>{let z=await X.chooseAccount(W);if(!z)throw j(W);return z}),accountHeaders:v,rewriteRequest:o,rewriteHandshakeURL(){throw new L2},rewriteResponse({response:W,attempt:z}){let N=z.data;if(N&&!G(W.headers,N)){if(W.status===401)return T(N),W.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return I(N,W)}let D=I(N,W);if(N?.route!=="oauth"||!D.body)return i(N,D);let O={...x(z,N),status:W.status},k=X.responseOptions?.(O)??{},b=(W.headers.get("content-type")??"").includes("application/json");return i(N,P$(D,{...k,toolNameMap:H.get(N),onToolNameRefusal:()=>{P.set(N,"response_tool_names"),T(N)},laneStartOAuthServed:!0,...b?{responseMode:"json"}:{}}))},quotaFromHeaders(W,z,N){let D=N.data;if(!D||!G(W,D))return;return X.quotaFromHeaders?.(W,{...x(N,D),status:z})},async limitFromResponse({status:W,headers:z,body:N,attempt:D}){let O=D.data;if(!O||P.get(O)==="response_tool_names")return;if(!G(z,O))return X.limitFromRelayFailure?.({...x(D,O),status:W});if(U.set(O,`provider responded with HTTP ${W}`),!X.limitFromResponse)return;let k=n.get(z)===O,b=K(O);return X.limitFromResponse({...x(D,O),status:W,headers:z,body:async()=>k?await N():b.redactText(await N())})},inspectEvent({data:W,event:z,attempt:N}){if(N.data&&P.get(N.data)==="response_tool_names")return;let D=F2(W);if(!z2(D))return;let O=typeof D.type==="string"?D.type:z;if(O==="content_block_start"||O==="content_block_delta")return{outputStarted:!0};if(O==="message_stop")return{done:!0};if(O!=="error")return;let k=N.data,b=K(k),s=z2(D.error)?D.error:{},l=typeof s.type!=="string"?void 0:W$.has(s.type)?s.type:b.redactText(s.type),Z2=typeof s.message==="string"?b.redactText(s.message):void 0;if(k?.dispatch==="http-relay"&&E.get(k)===!1)return;let $2=k?X.limitFromStreamError?.({...x(N,k),errorType:l,message:Z2}):void 0,Y2={error:[l??"error",Z2].filter(Boolean).join(": ").slice(0,y1),...$2?{limit:$2}:{}};if(k&&Y2.error)U.set(k,Y2.error);return Y2},limitFromError(W,z){let N=z.data;if(!N||P.has(N))return;let D={type:W$.has(W.type)?W.type:"provider_error",message:U.get(N)??"provider request failed",...W.status!==void 0?{status:W.status}:{}};if(T(N),N.dispatch==="http-relay"&&E.get(N)===!1)return;return X.limitFromHostError?.(D,x(z,N))},async onAttemptEnd(W,z){let N=W.data;if(!N)return;_.delete(N);let D=z.error?.reason;if(D==="cancelled"||D==="abandoned"||D===void 0&&(z.status===void 0||z.status<400))T(N);let O=P.get(N),{status:k,...b}=z,s=X.onAttemptEnd?.(x(W,N),{...b,...k!==void 0&&(N.dispatch!=="http-relay"||E.get(N)===!0)?{status:k}:{},...O!==void 0?{localRefusal:{check:O}}:{}});if(await l1(s,C)==="timed-out")L?.warn("the account source did not finish recording a send",{timeoutMs:C})}},dispose(){d=!0;for(let[W,z]of J){for(let N of z)N.revoked=!0;X.forgetSession?.(W)}J.clear(),_.clear();for(let W of[...Y.keys()])T(W)},forgetSession(W){for(let z of J.get(W)??[])z.revoked=!0;J.delete(W);for(let[z,N]of _)if(N.sessionID===W)_.delete(z);for(let[z,N]of[...Y])if(N.sessionID===W)T(z);X.forgetSession?.(W)},get pendingSendCount(){return _.size},get heldCredentialCount(){let W=0;for(let z of _.values())if(z.oauth)W++;return W},get heldRedactorCount(){return Y.size},get operationsInProgress(){let W=0;for(let z of J.values())W+=z.size;return W}}}function E2($){return JSON.stringify([$.source,$.accountIdentity,$.credentialId,$.binding?.storageId,$.binding?.rowId,$.binding?.credentialEpoch])}function R$($){let{runtime:X,source:L}=$,V=new AbortController,C=!1,_=new x$({directory:$.registryDirectory||process.env.OPENCODE_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR||S$("opencode"),now:$.now}),P=new Map,E=async(Q,K,T)=>{let q=T?AbortSignal.any([V.signal,T]):V.signal;q.throwIfAborted();let A=JSON.parse(await K.text()),m={providerID:"anthropic",modelID:A.model,sessionID:`oc2-cachekeep:${Q.id}`,agent:"cachekeep",kind:"generate"},I=M2({source:{...L,onRequestPrepared:void 0,responseOptions:void 0,async requestOptions(j){return{...await L.requestOptions?.(j),laneStart:!1,billingLineage:void 0,cacheDiagnosticsPreviousMessageId:void 0}},async authorizeAccount(j,J){let S=await X.read();q.throwIfAborted();let R=S.accounts.find((v)=>v.id===J);if(R?.type!=="oauth"||E2(R)!==Q.oauthAccountIdentity||Q.isSubagent&&!D2(S.policyStorage)||!_2(S.policyStorage)||!o2(S.policyStorage,new Date($.now?.()??Date.now())))return;let x=await L.authorizeAccount(j,J);if(x?.provenance.kind==="local"&&E2({...R,binding:x.provenance.subject.binding,accountIdentity:x.provenance.subject.binding.identity})!==Q.oauthAccountIdentity)return;if(x?.provenance.kind==="vault"&&x.provenance.credentialId!==R.credentialId)return;return x},async admitRequest(j){await L.admitRequest?.(j);let J=await X.read(),S=J.accounts.find((R)=>R.id===j.accountId);if(q.throwIfAborted(),!S||E2(S)!==Q.oauthAccountIdentity||Q.isSubagent&&!D2(J.policyStorage)||!_2(J.policyStorage)||!o2(J.policyStorage,new Date($.now?.()??Date.now())))throw Error("CacheKeep policy changed before dispatch")}}}),d,n,i=!1,G=()=>I.forgetSession(m.sessionID);q.addEventListener("abort",G,{once:!0});try{let j=(await X.read()).accounts.find((c)=>E2(c)===Q.oauthAccountIdentity)?.id;if(!j)throw Error("CacheKeep account is unavailable");let J=await I.adapter.accountHeaders({...m,accountId:j});if(!("headers"in J)||typeof J.headers!=="object"||J.headers===null||typeof J.attempt!=="object"||J.attempt===null||J.attempt.route!=="oauth")throw Error("CacheKeep authorization refused");d={...m,accountId:j,attemptId:crypto.randomUUID(),transport:"http",data:J.attempt};let S=await I.adapter.rewriteRequest?.({...m,accountId:j,attempt:d,request:new Request(Q.url,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(A),signal:q})});if(!S)throw Error("CacheKeep rewrite refused");q.throwIfAborted();let R=await($.fetch??fetch)(S),x=await I.adapter.rewriteResponse?.({...m,accountId:j,attempt:d,request:S,response:R});if(!x)throw Error("CacheKeep response rewrite refused");if(n=x.status,I.adapter.quotaFromHeaders?.(x.headers,x.status,d),!x.ok)await I.adapter.limitFromResponse?.({status:n,headers:x.headers,body:()=>x.clone().text(),attempt:d});let v=await x.arrayBuffer();return i=!0,new Response(v,{status:n,headers:x.headers})}catch{throw Error("Native CacheKeep was not completed")}finally{q.removeEventListener("abort",G);try{if(d)await I.adapter.onAttemptEnd?.(d,{status:n,outputStarted:!1,...i?{}:{error:{reason:"cancelled"}}})}finally{I.dispose(),L.forgetSession?.(m.sessionID)}}},H=$.setIntervalImpl??globalThis.setInterval,Y=new E$({loadStorage:async()=>C?null:(await X.read()).policyStorage,now:$.now,setIntervalImpl:(Q,K)=>H(()=>Y.tick().catch(()=>{H2.warn("cachekeep","tick failed")}),K),clearIntervalImpl:$.clearIntervalImpl,onTrackedSessionsChanged:(Q)=>_.publish(C?[]:Q),prepareHeaders(Q,K,T){if(C)return;return P.set(T.id,{target:K,attempt:T}),new Headers({"x-native-cachekeep-attempt":String(T.id)})},fetchImpl:async(Q,K)=>{let T=new Request(Q,K),q=Number(T.headers.get("x-native-cachekeep-attempt")),A=P.get(q);if(P.delete(q),!A)throw Error("CacheKeep attempt is unavailable");return E(A.target,T,A.attempt.signal)},onComplete:({attempt:Q})=>{P.delete(Q.id)}}),U;return{async track(Q){if(C||Q.route!=="oauth"||Q.agent==="cachekeep"||Q.agent==="prime"||Q.kind!=="primary")return;let K=await X.read();if(C||!_2(K.policyStorage))return;let T=!1;try{T=await $.isSubagent?.(Q.sessionID)??!1}catch{return}if(C||T&&!D2(K.policyStorage))return;let q=K.accounts.find((A)=>A.id===Q.accountId);if(!q?.accountIdentity)return;if(Q.provenance.kind==="local"&&JSON.stringify(q.binding)!==JSON.stringify(Q.provenance.subject.binding))return;if(Q.provenance.kind==="vault"&&q.credentialId!==Q.provenance.credentialId)return;Y.track({sessionId:Q.sessionID,url:Q.url,headers:new Headers,bodyText:Q.bodyText,storage:K.policyStorage,cacheMode:"hybrid",oauthAccountId:Q.accountId,oauthAccountIdentity:E2(q),isSubagent:T}),await _.publish(Y.trackedSessions())},registry:_,dispose(){if(U)return U;return C=!0,Y.stop(),V.abort(),U=(async()=>{try{await Y.tick()}finally{P.clear(),await _.dispose()}})(),U}}}async function A$($,X,L){let V=M2(X),C=[],_=async(K,T,q)=>{let A=await $.session.hook(K,T,q);return C.push(A),A},P=new AbortController,E;try{E=await d2({session:{hook:_},event:$.event},V.adapter,{logger:X.log,gateOnPlaceholder:L})}catch(K){throw V.dispose(),await Promise.allSettled(C.map((T)=>T.dispose())),K}let H=(K)=>{V.forgetSession(K),E.forgetSession(K)},Y=$.event,U=Y?(async()=>{try{for await(let K of Y.subscribe({signal:P.signal}))if(K.type==="session.deleted")H(K.data.sessionID)}catch(K){if(!P.signal.aborted)X.log?.warn("stopped listening for session deletion",{error:K instanceof Error?K.name:"unknown"})}})():Promise.resolve(),Q;return{installation:E,forgetSession:H,dispose(){if(Q)return Q;return V.dispose(),P.abort(),Q=(async()=>{await E.dispose(),await U})(),Q}}}function k$($,X){let L=new AbortController,V,C=!1,_=async()=>{let H=await $.read();if(L.signal.throwIfAborted(),H.policyStorage.relay?.enabled===!0&&V2(H.policyStorage.relay.transport,H.policyStorage.relay.url)==="websocket")return;let Y=H,U=b2(Y.policyStorage);for(let Q of Y.accounts){if(L.signal.aborted)return;if(!X2(Q)||Q.type!=="oauth")continue;if(Y.policyStorage.quota?.enabled!==!1&&Date.now()-w2(Q.quota)>=U)await $.fetchQuota(Q.id,X,L.signal).catch(()=>{});if(!q$(Q.profile)&&!L.signal.aborted)await $.fetchProfile(Q.id,X,L.signal).catch(()=>{})}},P=()=>{if(C||V)return V;return V=_().catch(()=>{if(!L.signal.aborted)H2.debug("opencode2","native background readings did not complete")}).finally(()=>{V=void 0}),V},E=$.vault.watch({intervalMs:60000,onRefresh:P,shouldRefresh:async()=>{let H=await $.read();return H.policyStorage.relay?.enabled!==!0||V2(H.policyStorage.relay.transport,H.policyStorage.relay.url)==="http"}});return E.ready.catch(()=>{}),{async dispose(){C=!0,E.close(),L.abort(),await V}}}var n2=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{};function u$($){let{runtime:X,source:L}=$,V=new Map,C=!1,_=async(Y,U)=>{await X.updateSettings((Q)=>({...Q,[Y]:{...n2(Q[Y]),...U}}))},P=()=>({ok:!0,text:"Native Claude settings updated."}),E=async(Y,U)=>{if(C)throw Error("Native menu is closed");switch(U.signal?.throwIfAborted(),Y.action){case"enable":case"disable":return await X.setEnabled(Y.values.id,Y.action==="enable"),P();case"remove":return await X.remove(Y.values.id),P();case"move-up":case"move-down":{let K=(await X.read()).accounts.map((I)=>I.id),T=K.indexOf(Y.values.id),q=T+(Y.action==="move-up"?-1:1);if(T<0||q<0||q>=K.length)return{ok:!1,text:"Account cannot move in that direction."};let A=K[T],m=K[q];if(A===void 0||m===void 0)return{ok:!1,text:"Account order changed."};return K[T]=m,K[q]=A,await X.reorder(K),P()}case"add-apikey":return await X.addApi(Y.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let Q=new AbortController;V.get(Y.sessionId)?.active.abort();let K={active:Q,auth:void 0};V.set(Y.sessionId,K);let T=await y2("max");if(C||Q.signal.aborted||U.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return K.auth=T,{ok:!0,text:`Open ${T.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let Q=V.get(Y.sessionId);if(!Q?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let K=await I2(Y.values.code,Q.auth.verifier,Q.auth.redirectUri,Q.auth.state);if(Q.active.signal.throwIfAborted(),U.signal?.throwIfAborted(),C||K.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await X.loginOAuth({routeId:crypto.randomUUID(),credential:K,label:Y.values.label}),Q.active.signal.throwIfAborted(),U.signal?.throwIfAborted(),C)return{ok:!1,text:"Sign-in cancelled."};return V.delete(Y.sessionId),{ok:!0,text:"OAuth account stored in the native account pool."}}case"reset-backoff":{let Q=await X.read();for(let K of Q.accounts){if(U.signal?.throwIfAborted(),K.type!=="oauth")continue;let T=K.source==="vault"?await X.authorizeVault(K.id,U.signal):await X.captureLocalSubject(K.id);await X.resetBackoff(K.id,T)}return P()}case"enrollment-reset":{let Q=await g$(f$("opencode"),I$);return{ok:Q==="reset",text:Q==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let K=(await X.read()).accounts.filter((A)=>A.type==="oauth"&&X2(A)),T=await Promise.allSettled(K.map((A)=>X.fetchQuota(A.id,void 0,U.signal)));return{ok:T.every((A)=>A.status==="fulfilled"),text:`${T.filter((A)=>A.status==="fulfilled").length}/${K.length} native quota readings refreshed.`}}case"routing-reset":return await L.resetRouting(Y.sessionId),P();case"routing-mode":return await _("routing",{mode:Y.values.mode}),P();case"killswitch-on":case"killswitch-off":return await _("killswitch",{enabled:Y.action==="killswitch-on"}),P();case"killswitch-set":return await X.updateSettings((Q)=>{let K=n2(Q.killswitch),T={...n2(K.accounts)},q=K.main;for(let A of Y.values.entries){let m={five_hour:A.fh,seven_day:A.sd,...A.scoped!==void 0?{scoped:A.scoped}:{}};if(A.account==="main"||A.account==="all")q=m;if(A.account==="all")for(let I of Object.keys(T))T[I]=m;else if(A.account!=="main")T[A.account]=m}return{...Q,killswitch:{...K,main:q,accounts:T}}}),P();case"cache-on":case"cache-off":return await _("claudeCache",{enabled:Y.action==="cache-on"}),P();case"cache-mode":return await _("claudeCache",{mode:Y.values.mode}),P();case"cachekeep-always":return await _("cacheKeep",{enabled:!0,always:!0}),P();case"cachekeep-off":return await _("cacheKeep",{enabled:!1}),P();case"cachekeep-window":return await _("cacheKeep",{enabled:!0,always:!1,startHour:Y.values.startHour,endHour:Y.values.endHour}),P();case"cachekeep-subagents":return await _("cacheKeep",{subagents:Y.values.enabled==="on"}),P();case"dump-on":case"dump-off":return await _("dump",{enabled:Y.action==="dump-on"}),P();case"logging-level":return await _("logging",{level:Y.values.level}),P();case"fast-on":case"fast-off":return await _("claudeFast",{enabled:Y.action==="fast-on"}),P();case"prime-on":case"prime-off":return await _("prime",{enabled:Y.action==="prime-on"}),P();case"start-fire":return await H(Y.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},H=(Y)=>$.start(Y,f2);return{dispatch:E,async readStatus(Y){let U=await X.read();if(Y==="account")return U.accounts.map((K)=>`${K.id}${K.label?` (${K.label})`:""}: ${K.type}, ${K.source}, ${K.enabled?"enabled":"disabled"}${K.state?`, ${h$(K)}`:""}${K.accountIdentity?`, ${K.accountIdentity}`:""}`).join(`
-`)||"No native Claude accounts.";if(Y==="quota")return d$({accounts:U.accounts.filter((K)=>K.type==="oauth").map((K)=>({name:K.label??K.id,role:K.id==="main"?"main":"fallback",enabled:K.enabled,quota:K.quota,tierLabel:v$(K.profile),lastRefreshedAt:K.lastRefreshedAt,error:K.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(Y==="prime")return l$({enabled:U.policyStorage.prime?.enabled===!0,accounts:m$(U.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");if(Y==="cachekeep"){let K=await $.cacheKeepRegistry?.list()??[];return y$({enabled:b$(U.policyStorage),always:w$(U.policyStorage),hybridActive:_2(U.policyStorage),trackedSessionDetails:K,window:D$(U.policyStorage),trackedSessions:K.length,nextPrewarmAt:K.length?Math.min(...K.map((T)=>T.nextPrewarmAt)):void 0})}let Q={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(U.settings[Q[Y]]??{})},forgetSession(Y){V.get(Y)?.active.abort(),V.delete(Y)},close(){C=!0;for(let Y of V.values())Y.active.abort();V.clear()}}}function n$(){let $=new Map;return{install:(L)=>L.model.transform((V)=>{$.clear();for(let C of V.list("anthropic")){if($.set(String(C.id),String(C.modelID)),!(p$(C.modelID)||o$(C.modelID)||c$(C.modelID)||i$(C.modelID)))continue;V.update("anthropic",String(C.id),(_)=>{let P=["low","medium","high","xhigh","max"],E=_.variants.filter((H)=>!P.some((Y)=>Y===String(H.id)));_.variants=[...E,...P.map((H)=>({id:H,settings:{effort:H,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(L)=>$.get(L)??L}}function r$($){return $.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??$.get("x-api-key")??void 0}var s$=($)=>$!==null&&typeof $==="object"&&!Array.isArray($)?$:{};function t$($){let{runtime:X,source:L}=$,V=new AbortController,C=new Set,_=(H)=>({providerID:"anthropic",modelID:r2().model,sessionID:`oc2-prime:${H}`,agent:"prime",kind:"generate"}),P=async(H)=>{let Y=_(H),U=M2({source:L}),Q=performance.now();try{for(let K=0;K<3;K++){if(V.signal.throwIfAborted(),(await X.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let q=await U.adapter.accountHeaders({...Y,accountId:H});if(!("headers"in q)||typeof q.headers!=="object"||q.headers===null||typeof q.attempt!=="object"||q.attempt===null)throw Error("Native Prime authorization refused");let A={...Y,accountId:H,attemptId:crypto.randomUUID(),transport:"http",data:q.attempt},m,I=!1,d=!1,n=(i)=>{d=!0,i.body?.cancel().catch(()=>{})};try{let i=await U.adapter.rewriteRequest?.({...Y,accountId:H,attempt:A,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r2()),signal:V.signal})});if(!i)throw Error("Native Prime rewrite refused");let G=new Headers(i.headers);for(let[o,f]of Object.entries(q.headers))if(f===null)G.delete(o);else G.set(o,f);let j=new Request(i,{headers:G}),J=await($.fetch??fetch)(j),S=await U.adapter.rewriteResponse?.({...Y,accountId:H,request:j,response:J,attempt:A})??J;m=S.status,U.adapter.quotaFromHeaders?.(S.headers,S.status,A);let R=S.ok?void 0:await U.adapter.limitFromResponse?.({status:S.status,headers:S.headers,body:()=>S.clone().text(),attempt:A});if(R&&/^(vault-newer|local-newer|relay-direct):/.test(R.reason)&&K<2){if(n(S),await L.chooseAccount({...Y,rerouteFrom:{accountId:H,limit:R}})!==H)throw Error("Native Prime retry changed account");continue}if(!S.ok)return n(S),{ok:!1,status:m,ms:performance.now()-Q,error:"Native Prime upstream refused the request"};let x=s$(await S.json()),v=s$(x.usage),c={inputTokens:typeof v.input_tokens==="number"?v.input_tokens:void 0,outputTokens:typeof v.output_tokens==="number"?v.output_tokens:void 0};if(A.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(S.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(I=await L.recordPrime(q.attempt.provenance,c),!I)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:m,ms:performance.now()-Q,usage:c}}finally{await U.adapter.onAttemptEnd?.(A,{status:m,outputStarted:!1,...I?{}:{error:{reason:d?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-Q}}finally{U.dispose()}},E=new a$({storagePath:$.paths.legacyConfig,loadStorage:async()=>(await X.read()).policyStorage,async getAccountFingerprint(H){let Y=await X.read(),U=Y.accounts.find((K)=>K.id===H);if(!X2(U)||U?.type!=="oauth")return;if(Y.policyStorage.relay?.enabled===!0&&V2(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")return;if(U.source==="vault"){let K=await X.authorizeVault(H,V.signal);return X.getOrCreateAuthLineage(H,K)}let Q=await X.authorizeLocal(H,{signal:V.signal});return Q.status==="usable"?X.getOrCreateAuthLineage(H,Q.subject):void 0},async refreshQuota(H){let Y=await X.read();if(Y.policyStorage.relay?.enabled===!0&&V2(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await X.fetchQuota(H,$.fetch,V.signal),fresh:!0}},sendPrime(H){let Y=P(H);return C.add(Y),Y.finally(()=>C.delete(Y)),Y},async recordSuccess(H){let Y=(await X.read()).accounts.find((U)=>U.id===H);if(!Y?.prime)throw Error("Native Prime counters are unavailable");return Y.prime}});return E.start(),{manager:E,async dispose(){E.stop(),V.abort(),await Promise.allSettled(C)}}}var s2=($)=>["five_hour","seven_day"].some((X)=>($?.[X]?.remainingPercent??1)<=0);function Q1($){let{runtime:X}=$,L=X1("native-auth"),V=new Map,C=(G)=>{let j=G.routingPath;if(!j)throw Error("Native routing storage is unavailable");let J=V.get(j);if(!J)J=new G1({path:j,vaultSeed:G.routingSeed,localRecoveryPath:G.mode==="local"?G.routingRecoveryPath:void 0}),V.set(j,J);return J.setVaultSeed(G.routingSeed),J},_=new WeakMap,P=new Map,E=new Map,H=new Map,Y=new WeakSet,U=!1,Q=()=>{while(P.size>512){let G=P.keys().next();if(!G.done)P.delete(G.value)}},K=(G,j)=>JSON.stringify([G.sessionID,G.kind,G.modelID,j]),T=(G)=>{if(U)throw Error("Native Anthropic source is closed");let j=H.get(G.sessionID);if(!j){j=new AbortController,H.set(G.sessionID,j);while(H.size>512){let J=H.keys().next();if(!J.done)n.forgetSession?.(J.value)}}return j},q=(G,j,J)=>X2(G)&&(G.type==="api"||R2(G,j,j2(J)).status==="allowed"),A=async(G,j,J,S)=>{let R=await X.read();S.signal.throwIfAborted(),m(R);let x=R.accounts.find((v)=>v.id===G);if(!x||x.type!==J||!q(x,R,j))return!1;if(J==="api"){let v=R.accounts.find((c)=>c.id==="main"&&c.type==="oauth");return!!v&&x2(v.quota,R.policyStorage)&&s2(v.quota)}return!0},m=(G)=>{let j=G.policyStorage.relay;if(j?.enabled===!0&&V2(j.transport,j.url)==="websocket")throw new L2},I=async(G,j)=>{if(m(G),j||G.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let J=await X.getRelayConfig();if(!J)throw Error("request refused: native HTTP relay configuration is unavailable");if(J.transport!=="http")throw new L2;return{dispatch:{kind:"http-relay",url:J.url,token:J.token},relayFallback:J.fallbackToDirect}};async function d(G,j,J){if(G.kind==="local")await X.publishLocal(G.subject,J);else if(G.kind==="vault"&&j.receipt)await X.vault.publish(j.receipt,J);else if(G.kind==="api"&&J.lastUsed!==void 0)await X.publishApi(G.subject,{lastUsed:J.lastUsed})}let n={async chooseAccount(G){let j=T(G);$.onOwnedRequest?.();let J=await X.read();j.signal.throwIfAborted(),m(J);let S=j2(await $.resolveModelId?.(G)??G.modelID);if(j.signal.throwIfAborted(),J.mode==="claustrum")J=await J1(X,j.signal),j.signal.throwIfAborted();if(J.policyStorage.quota?.enabled!==!1){let f=!1;for(let u of J.accounts){if(!X2(u)||u.type!=="oauth")continue;if(Z1(u.quota)?x2(u.quota,J.policyStorage,Date.now(),S):Date.now()-w2(u.quota)<b2(J.policyStorage))continue;try{await X.fetchQuota(u.id,$.fetch,j.signal),f=!0}catch{j.signal.throwIfAborted()}}if(f)J=await X.read();j.signal.throwIfAborted()}let R=G.rerouteFrom?P.get(G.rerouteFrom.limit.reason):void 0;if(G.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(G.rerouteFrom.limit.reason)&&!R)return;if(R&&G.rerouteFrom){P.delete(G.rerouteFrom.limit.reason);let f=J.accounts.find((z)=>z.id===R.accountId);if(!f||!q(f,J,S))return;let u=K(G,R.accountId),W=E.get(u)??[];return W.push(R),E.set(u,W),R.accountId}let x=[];for(let f of J.accounts){if(f.type!=="oauth"||!q(f,J,S))continue;if(f.source==="local"){let u=await X.authorizeLocal(f.id,{signal:j.signal,policy:(W,z)=>R2(W,z,S)});if(j.signal.throwIfAborted(),u.status!=="usable")continue}x.push(f)}let v=x.filter((f)=>f.id!==G.rerouteFrom?.accountId);if(a2(J.policyStorage)==="sticky-balanced"){let f=v.map((W,z)=>({accountId:W.id,order:z,quota:W.quota??{kind:"unknown"}})),u=await C(J).resolve({sessionId:G.sessionID,family:Y1(S),modelId:S,affinityModelId:G.modelID,candidates:f,retainAccountIds:new Set(v.map((W)=>W.id)),...J.mode==="claustrum"?{accountIdentities:new Map(J.accounts.flatMap((W)=>W.accountIdentity?[[W.id,W.accountIdentity]]:[]))}:{},storage:J.policyStorage,inputBytes:1,preferredAccountId:G.previousAccountId});if(j.signal.throwIfAborted(),u)return u.accountId}else{let u=a2(J.policyStorage)==="fallback-first"?[...v.filter((W)=>W.id!=="main"),...v.filter((W)=>W.id==="main")]:[...v.filter((W)=>W.id==="main"),...v.filter((W)=>W.id!=="main")];if(u[0])return u[0].id}if(J.mode==="claustrum")throw new W1;let c=J.accounts.find((f)=>f.id==="main"&&f.type==="oauth");if(!c)return;let o=c.quota;if(G.rerouteFrom?.limit.status===429||!x2(o,J.policyStorage))try{o=await X.fetchQuota("main",$.fetch,j.signal)}catch{return}if(j.signal.throwIfAborted(),!s2(o))return;return J.accounts.find((f)=>f.type==="api"&&X2(f)&&f.id!==G.rerouteFrom?.accountId)?.id},async authorizeAccount(G,j){let J=T(G),S=await X.read();J.signal.throwIfAborted(),m(S);let R=j2(await $.resolveModelId?.(G)??G.modelID);J.signal.throwIfAborted();let x=S.accounts.find((O)=>O.id===j);if(!x||!q(x,S,R))return;let v=K(G,j),c=E.get(v),o=c?.shift();if(c?.length===0)E.delete(v);let{dispatch:f,relayFallback:u}=await I(S,o?.direct===!0);if(J.signal.throwIfAborted(),o?.auth){if(!await A(j,R,o.auth.route,J))return;let O=_.get(o.auth.provenance);if(O?.receipt?.expiresAtMs!==void 0&&O.receipt.expiresAtMs!==null&&O.receipt.expiresAtMs<Date.now()+300000)return;if(O)_.set(o.auth.provenance,{...O,scope:{...G,modelID:R},account:x,active:J,relayFallback:u});return{...o.auth,dispatch:f}}let W={scope:{...G,modelID:R},active:J,account:x,retry:o?.retry??!1,relayFallback:u,quota:x.quota};if(x.type==="api"){let O=S.accounts.find((l)=>l.id==="main"&&l.type==="oauth");if(!O||!x2(O.quota,S.policyStorage)||!s2(O.quota))return;let k=await X.authorizeApi(j,J.signal);if(J.signal.throwIfAborted(),!await A(j,R,"api",J))return;let b={kind:"api",subject:k.subject};return _.set(b,W),{route:"api",headers:k.authHeader==="authorization-bearer"?{authorization:`Bearer ${k.apiKey}`}:{"x-api-key":k.apiKey},baseURL:k.baseURL,provenance:b,dispatch:f}}if(x.source==="vault"){let O=await X.authorizeVault(j,J.signal);if(J.signal.throwIfAborted(),!await A(j,R,"oauth",J))return;let k={kind:"vault",credentialId:O.credentialId,recordVersion:O.recordVersion};_.set(k,{...W,receipt:O});let b=O.assertedAccountIdentity;if(!b)return;return{route:"oauth",accessToken:O.accessToken,provenance:k,dispatch:f,identity:S2(b,b)}}let z=await X.authorizeLocal(j,{signal:J.signal,policy:(O,k)=>R2(O,k,R)});if(J.signal.throwIfAborted(),z.status!=="usable")return;if(!await A(j,R,"oauth",J))return;let N={kind:"local",subject:z.subject};_.set(N,{...W,access:z.access});let D=z.subject.binding.identity;return{route:"oauth",accessToken:z.access,provenance:N,dispatch:f,identity:S2(D,D)}},async requestOptions(G){let j=T(G),J=await X.read();j.signal.throwIfAborted();let S=J.accounts.find((x)=>x.id===G.accountId);if(!S||!q(S,J,G.modelID))throw Error("request refused: native account is ineligible for this model");let R=_.get(G.provenance);if(R)_.set(G.provenance,{...R,scope:{...R.scope,modelID:G.modelID}});return $.requestOptions(G,J)},async admitRequest(G){let j=_.get(G.provenance);if(!j||!await A(G.accountId,G.modelID,G.route,j.active))throw Error("request refused: native account policy changed before dispatch");_.set(G.provenance,{...j,scope:{...j.scope,modelID:G.modelID}})},onRequestPrepared:(G)=>$.onRequestPrepared?.(G),responseOptions(G){return $.responseOptions?.({...G,modelID:_.get(G.provenance)?.scope.modelID??G.modelID})},quotaFromHeaders(G,j){let J=_.get(j.provenance),S=B1(G);if(S)$.onRequestId?.(j,S);if(!J||j.route!=="oauth"||!j1(G))return;let R=j.provenance.kind==="local"?j.provenance.subject.binding.identity:J.receipt?.assertedAccountIdentity,x={...V1(G),...R?{accountIdentity:R}:{}};J.quota=e$(J.quota,x);let v=L.observe(d(j.provenance,J,{quota:J.quota}));return i.set(j.provenance,v),x},async limitFromResponse(G){let j=_.get(G.provenance);if(!j)return;if(G.status===401&&j.receipt){if(!Y.has(j.receipt))Y.add(j.receipt),await X.vault.reportFailure(j.receipt,401,G.dispatch==="http-relay"?"relay_status_field":"direct");if(j.retry||j.active.signal.aborted)return;let S=j.active,R=await X.vault.prepareRetry(j.receipt,S.signal);if(S.signal.throwIfAborted(),!R.retry)return;let x=R.receipt,v=x.assertedAccountIdentity;if(!v)return;let c={kind:"vault",credentialId:x.credentialId,recordVersion:x.recordVersion};_.set(c,{...j,receipt:x,retry:!0});let o=`vault-newer:${G.attemptId}`;return P.set(o,{sessionID:G.sessionID,accountId:G.accountId,retry:!0,auth:{route:"oauth",accessToken:x.accessToken,provenance:c,identity:S2(v,v)}}),Q(),{reason:o,status:401}}if(G.status===401&&G.provenance.kind==="local"&&j.access&&!j.retry){if(j.active.signal.aborted)return;let S=j.active,R=await X.authorizeLocal(G.accountId,{rejectedAccessToken:j.access,signal:S.signal,policy:(o,f)=>R2(o,f,j.scope.modelID)});if(S.signal.throwIfAborted(),R.status!=="usable"||R.access===j.access)return;let x={kind:"local",subject:R.subject};_.set(x,{...j,access:R.access,retry:!0});let v=R.subject.binding.identity,c=`local-newer:${G.attemptId}`;return P.set(c,{sessionID:G.sessionID,accountId:G.accountId,retry:!0,auth:{route:"oauth",accessToken:R.access,provenance:x,identity:S2(v,v)}}),Q(),{reason:c,status:401}}let J=await X.read();if($1(G.status,J.policyStorage))return{reason:`provider-${G.status}`,status:G.status};return},limitFromRelayFailure(G){let j=_.get(G.provenance);if(!j?.relayFallback||j.active.signal.aborted||!(G.status===401||G.status>=500))return;let J=`relay-direct:${G.attemptId}`;return P.set(J,{sessionID:G.sessionID,accountId:G.accountId,direct:!0,retry:!1}),Q(),{reason:J}},limitFromStreamError(G){return G.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(G,j){let J=_.get(j.provenance);if(j.dispatch==="http-relay"&&J?.relayFallback&&!J.active.signal.aborted&&G.status===void 0){let S=`relay-direct:${j.attemptId}`;return P.set(S,{sessionID:j.sessionID,accountId:j.accountId,direct:!0,retry:!1}),Q(),{reason:S}}return},async onAttemptEnd(G,j){let J=_.get(G.provenance);if(!J)return;try{if(await i.get(G.provenance),j.status===401&&J.receipt&&!Y.has(J.receipt))Y.add(J.receipt),await X.vault.reportFailure(J.receipt,401,G.dispatch==="http-relay"?"relay_status_field":"direct");if(!j.localRefusal&&j.status!==void 0)L.publish(()=>d(G.provenance,J,{lastUsed:Date.now()}))}finally{_.delete(G.provenance),i.delete(G.provenance)}},forgetSession(G){H.get(G)?.abort(),H.delete(G);for(let[j,J]of P)if(J.sessionID===G)P.delete(j);for(let[j,J]of E)if(J[0]?.sessionID===G)E.delete(j);$.onForgetSession?.(G)},resetRouting:async(G)=>C(await X.read()).clear(G),async recordPrime(G,j){let J=_.get(G);if(!J||J.active.signal.aborted)return!1;if(G.kind==="local")return X.incrementPrimeUsage(J.account.id,G.subject,j);if(G.kind==="vault"&&J.receipt)return X.incrementPrimeUsage(J.account.id,J.receipt,j);return!1},close(){U=!0;for(let G of H.values())G.abort();return H.clear(),E.clear(),P.clear(),L.drain()}},i=new WeakMap;return n}function H1(){let $=new K1,X=new Map,L=new Map,V=new Map,C=new Set,_=new Set,P=new Map,E=(H)=>{while(H.size>512){let Y=H.keys().next();if(!Y.done)H.delete(Y.value)}};return{async install(H){let Y=[];try{Y.push(await H.session.hook("context",(U)=>{let Q=U.messages.map((T)=>{return{info:{id:T.id,sessionID:U.sessionID,role:T.role,agent:U.agent,model:{providerID:U.model.providerID,modelID:U.model.id}},parts:T.content.map((q)=>({type:q.type,...q.type==="text"?{text:q.text}:{}}))}});$.observeMessages(Q);let K=U.messages.findLast((T)=>T.role==="user"&&T.id);if(K?.id)X.set(U.sessionID,K.id);if(K?.content.some((T)=>T.type==="text"&&T.text===f2))C.add(U.sessionID);else C.delete(U.sessionID);E(X)},{providerID:"anthropic"})),Y.push(await H.session.hook("model.request",(U)=>{if(U.kind!=="primary")return;let Q=X.get(U.sessionID);if(!Q)return;if($.markHeaders({sessionId:U.sessionID,messageId:Q,agent:U.agent,headers:U.headers}),C.has(U.sessionID))U.headers[O2]="1"},{providerID:"anthropic"}))}catch(U){throw await Promise.allSettled(Y.map((Q)=>Q.dispose())),U}return{dispose:async()=>{await Promise.all(Y.map((U)=>U.dispose()))}}},requestOptions(H,Y){let U=$.resolveHeader(H.correlation[k2]);if(U)L.set(H.attemptId,U),E(L);P.set(H.attemptId,H.sessionID),E(P);let Q=H.correlation[O2]==="1";if(Q)_.add(H.attemptId);return{cache1hEnabled:H.agent!=="compaction"&&H.agent!=="title"&&(Y.policyStorage.claudeCache?.enabled??!0),cache1hMode:Y.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:Y.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:Y.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,serverSideFallbackEnabled:z1(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:Q,billingLineage:U?{promptId:U.promptId,previousRequestId:U.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:V.get(H.sessionID)}},responseOptions(H){return{serverSideFallbackModel:j2(H.modelID),laneStart:_.has(H.attemptId),onMessageStart(Y){if(H.kind==="primary"&&typeof Y.id==="string")V.set(H.sessionID,Y.id),E(V)},onStreamEnd(){L.delete(H.attemptId),_.delete(H.attemptId),P.delete(H.attemptId)}}},onRequestId(H,Y){$.commit(L.get(H.attemptId),Y)},forgetSession(H){$.clearSession(H),X.delete(H),V.delete(H),C.delete(H);for(let[Y,U]of P)if(U===H)L.delete(Y),_.delete(Y),P.delete(Y)}}}var g2="cortexkit-anthropic-auth",d1='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',u1="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",p1="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function c1($){let X=$.authorize??y2,L=$.exchange??I2,V=()=>{if(!$.isActive())throw Error("Claude authentication setup is closed")},C=async()=>{let E;try{E=await $.readMode()}catch{throw Error(p1)}return V(),E},_=async()=>{if(await C()!=="local")throw Error(d1)};return{integrationID:"anthropic",methods:[{method:{id:N1,type:"oauth",label:P1},async authorize(){V(),await _();let E=await X("max");return V(),{mode:"code",url:E.url,instructions:"Paste the authorization code returned by Claude.",callback:async(H)=>{V();let Y=await L(H,E.verifier,E.redirectUri,E.state);if(!$.isActive()||Y.type!=="success")throw Error("Claude sign-in did not complete");return{access:Y.access,refresh:Y.refresh,expires:Y.expires}}}}}],vault:{method:{id:F1,type:"oauth",label:"Claude vault accounts"},async activate(){if(V(),await C()!=="claustrum")throw Error(u1)}},async onLogin(E){V(),await _(),await $.runtime.loginOAuth({routeId:"main",credential:E,replace:!0}),V()},label:"Claude native account pool"}}function i1($){return{readMode:()=>U1("opencode",$),disconnectVault:()=>C1({host:"opencode",env:$})}}function t2($={}){return{id:g2,setup:(X)=>O1(X,$)}}async function O1($,X={}){let L=X.paths??await L1(),V=M1({paths:L,host:"opencode",local:X.local,vault:X.vault}),C=i1(X.vault?.env??process.env),_=!0,P=H1(),E=n$(),H,Y,U,Q=Q1({runtime:V,paths:L,fetch:X.fetch,requestOptions:P.requestOptions,responseOptions:P.responseOptions,onRequestId:P.onRequestId,onForgetSession:P.forgetSession,onRequestPrepared:async(I)=>{try{await U?.track(I)}catch{H2.warn("cachekeep","live request tracking failed")}},resolveModelId:async(I)=>E.modelId(I.modelID),onOwnedRequest:()=>{H??=k$(V,X.fetch),Y??=t$({runtime:V,paths:L,source:Q,fetch:X.fetch})}});U=R$({...X.cacheKeep,runtime:V,source:Q,fetch:X.fetch,isSubagent:async(I)=>Boolean((await $.session.get({sessionID:I})).parentID)});let K=u$({runtime:V,source:Q,cacheKeepRegistry:U.registry,start:async(I,d)=>{await $.session.synthetic({sessionID:I,text:d,description:"Claude lane start",resume:!0})}}),T=[],q=await A$($,{source:Q,log:{warn:(I,d)=>H2.warn("opencode2",I,d)}},{credential:r$}).catch(async(I)=>{throw K.close(),await U?.dispose(),await Q.close(),V.close(),I}),A,m=()=>{if(A)return A;return _=!1,K.close(),Q.close(),A=(async()=>{await Promise.allSettled([q.dispose(),H?.dispose(),Y?.dispose(),U?.dispose(),...T.map((I)=>I.dispose())]),await Q.close(),V.close()})(),A};try{T.push(await P.install($)),T.push(await E.install($)),T.push(await h2($,c1({isActive:()=>_,readMode:C.readMode,runtime:V})));let I={host:"opencode",dispatch:K.dispatch,readStatus:(n)=>K.readStatus(n),readAccounts:()=>V.read(),readMode:C.readMode,disconnectVault:C.disconnectVault,interactive:!0},d=_1(I);return T.push(await T1($,d,K)),m}catch(I){throw await m(),I}}var G0={id:g2,setup:t2().setup,server:E1};export{O1 as setupAnthropicAuth,G0 as default,t2 as createAnthropicAuthPlugin,g2 as ANTHROPIC_AUTH_PLUGIN_ID};
+import{a as O2,b as E$,c as x$,d as e2,e as $$,f as E2,g as N2,h as X$,i as J$,j as R$,k as Z$,l as Y$,m as W$,n as G$,o as j$,p as I$}from"../index-1nwcnxp8.js";import"../index-6chd6jnr.js";import"../index-hazrk5c3.js";import{u as b$}from"../index-jexctf5w.js";import{v as k$,w as D$,y as w$}from"../index-0kxy8k2c.js";import"../index-b1dvkp15.js";import"../index-53nnxq39.js";import"../index-ah5s0bew.js";import"../index-f2ne65w4.js";import{acquireNativeAccountRuntime as JX,authorize as ZX,createNativeUi as YX,disconnectNativeVaultForHost as WX,exchange as GX,logger as q$,readNativeEnrollmentMode as jX,resolveNativePoolPaths as VX}from"@cortexkit/anthropic-auth-core";class _2 extends Error{kind;providerID;sessionID;requestKind;constructor(X){super(X.message??`${X.providerID} ${X.requestKind} request refused (${X.kind})`);this.name="OpenCode2AuthError",this.kind=X.kind,this.providerID=X.providerID,this.sessionID=X.sessionID,this.requestKind=X.requestKind}}function B2(X){return`common-auth-placeholder.${X}`}function c2(X){let J=B2(X.integrationID);return{type:"oauth",methodID:X.methodID,access:J,refresh:J,expires:X.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function q2(X,J){if(X?.type!=="oauth")return!1;let _=J===void 0?void 0:B2(J),G=(L)=>_===void 0?L.startsWith("common-auth-placeholder."):L===_;return G(X.access)&&G(X.refresh)}var i2="No browser sign-in: this connects the plugin to the accounts in its vault.";async function k2(X,J){let _=J.now??Date.now,{integrationID:G}=J,L=(F)=>c2({integrationID:G,methodID:F,now:_()}),T=async(F,U)=>{return await J.onLogin(F,{integrationID:G,methodID:U}),L(U)},N=(F)=>async(U)=>{let Y=F.method.id,M=await F.authorize(U),j={url:M.url,instructions:M.instructions,...M.expiresAt===void 0?{}:{expiresAt:M.expiresAt}};if(M.mode==="auto")return{...j,mode:"auto",callback:M.callback.then((O)=>T(O,Y))};let Q=M.callback;return{...j,mode:"code",callback:async(O)=>T(await Q(O),Y)}};return X.integration.transform((F)=>{let U=J.label===void 0?{}:{label:()=>J.label};for(let j of J.methods)F.method.update({integrationID:G,method:j.method,authorize:N(j),refresh:async(Q)=>{if(!q2(Q,G))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return L(Q.methodID)},...U});let Y=J.vault;if(Y===void 0)return;let M=Y.method.id;F.method.update({integrationID:G,method:Y.method,authorize:async()=>({url:"",instructions:Y.instructions??i2,mode:"auto",callback:Promise.resolve().then(()=>Y.activate({integrationID:G,methodID:M})).then(()=>L(M))}),refresh:async(j)=>{if(!q2(j,G)||j.methodID!==M)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return L(M)},...U})})}function f$(X){let J=[],_;for(let G of X.split(/\r?\n/))if(G.startsWith("data:"))J.push(G.slice(5).replace(/^ /,""));else if(G.startsWith("event:"))_=G.slice(6).trim();if(J.length===0)return;return _===void 0?{data:J.join(`
+`)}:{event:_,data:J.join(`
+`)}}function D2(X,J){let _=new TextDecoder,G="",L=(N)=>{let F=f$(N);if(!F)return;try{X(F)}catch(U){J(U)}},T=()=>{for(;;){let N=/\r?\n\r?\n/.exec(G);if(!N)return;let F=G.slice(0,N.index);G=G.slice(N.index+N[0].length),L(F)}};return new TransformStream({transform(N,F){F.enqueue(N),G+=_.decode(N,{stream:!0}),T()},flush(){if(G+=_.decode(),T(),G.trim()!=="")L(G);G=""}})}var o2=512,H2="x-common-auth-attempt",Q2=(X,J)=>JSON.stringify([X,J]),G2=(X)=>({providerID:X.model.providerID,modelID:X.model.id,sessionID:X.sessionID,agent:X.agent,kind:X.kind});function v$(X){let J=X.headers;return typeof J==="object"&&J!==null}function g$(X,J){let _=X.getReader();return new ReadableStream({async pull(G){let L;try{L=await _.read()}catch(T){J({reason:"failed",message:T instanceof Error?T.message:String(T)}),G.error(T);return}if(L.done)J(),G.close();else G.enqueue(L.value)},async cancel(G){J({reason:"cancelled",...G===void 0?{}:{message:String(G)}}),await _.cancel(G)}})}function w2(X,J){for(let[_,G]of Object.entries(J)){let L=_.toLowerCase();for(let T of Object.keys(X))if(T.toLowerCase()===L)delete X[T];if(G!==null)X[_]=G}}function h$(X,J){for(let[_,G]of Object.entries(J))if(G===null)X.delete(_);else X.set(_,G)}async function b2(X,J,_={}){let{providerID:G}=J,L=_.gateOnPlaceholder,T=($)=>L===void 0||L.credential($)===B2(G),N=_.logger,F=Math.max(1,_.maxRecords??o2),U=[..._.hostCredentials??[B2(G)],...L?[B2(G)]:[]].filter(($)=>$!==""),Y=new Map,M=new WeakMap,j=new Map,Q=new Set,O=new Map,k=!1,x=!1,l=new Map,I=0,c=!1,r=new Map,o=($,W)=>{try{N?.warn($,W)}catch{}},Z=($)=>$ instanceof Error?$.message:String($),V=async($,W)=>{let C=l.get($);if(!C||C.size===0)return;await Promise.all([...C].map(async(P)=>{try{await P(W)}catch(y){o("opencode2 auth listener threw; the request is unaffected",{event:$,error:Z(y)})}}))},B=async($,W)=>{try{await J.onAttemptEnd?.($,W)}catch(C){o("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:$.attemptId,error:Z(C)})}},E=($,W)=>{if($.ended||!$.attempt)return;let C={...$.status===void 0?{}:{status:$.status},outputStarted:$.outputStarted,...$.limit?{limit:$.limit.signal}:{},...W?{error:W}:{}};if(W)$.endError=W;$.ended=B($.attempt,C)},S=($,W)=>E($,{reason:"abandoned",message:W}),q=($)=>[...Y.values()].filter((W)=>W.key===$),g=($)=>q($).at(-1),m=($)=>{if(Y.delete($.id),!q($.key).length)j.delete($.key)},n=($)=>{Y.set($.id,$);while(Y.size>F){let W=Y.values().next().value;if(W===void 0)break;S(W,"dropped to keep the record bound"),m(W)}},f=($)=>$.accountId===void 0?void 0:{...$.scope,accountId:$.accountId},p=($,W)=>new _2({kind:"no-account",providerID:G,sessionID:$.sessionID,requestKind:$.kind,...W===void 0?{}:{message:W}}),d=($)=>{r.get($)?.clear(),r.delete($)},e=async($,W)=>{let C=()=>p($,`${G} ${$.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(c)throw C();let P=r.get($.sessionID);if(!P)P=new Set,r.set($.sessionID,P);let y={};P.add(y);let h=()=>{if(!P.has(y))throw C()};try{return await W(h)}finally{if(P.delete(y),P.size===0&&r.get($.sessionID)===P)r.delete($.sessionID)}},K=($,W)=>{for(let[C,P]of W)if(U.some((y)=>P.includes(y)))throw new _2({kind:"host-credential-on-wire",providerID:G,sessionID:$.sessionID,requestKind:$.kind,message:`${G} ${$.kind} request still carries the host's placeholder credential in ${C}; the adapter's account headers must replace it`})},z=($)=>{for(let W of q($))if(W.ended||!W.attempt)m(W);else if(W.transport==="ws"||W.judged)S(W,"a newer attempt of its session and kind began"),m(W)},H=async($,W,C,P)=>{let y=Q2($.sessionID,$.kind),h=j.get(y);j.delete(y);let D=h?.accountId??g(y)?.accountId;z(y);let v={...$,...D===void 0?{}:{previousAccountId:D},...h?.rerouteFrom===void 0?{}:{rerouteFrom:h.rerouteFrom}},i=await J.chooseAccount(v);C();let W2={},u2;if(i!==void 0){let T2=await J.accountHeaders({...$,accountId:i});if(C(),v$(T2))W2=T2.headers,u2=T2.attempt;else W2=T2}let p2=`attempt-${++I}`,M2={id:p2,key:y,scope:$,accountId:i,headers:W2,attempt:i===void 0?void 0:{...$,accountId:i,attemptId:p2,transport:P,data:u2},...P===void 0?{}:{transport:P},outputStarted:!1};if(n(M2),M2.attempt)V("select",{...$,accountId:M2.attempt.accountId,hook:W,...v.previousAccountId===void 0?{}:{previousAccountId:v.previousAccountId},...v.rerouteFrom===void 0?{}:{rerouteFrom:v.rerouteFrom},handle:M2.attempt});return M2},A=async($,W,C,P,y)=>{let h=Q2($.sessionID,$.kind),D=P===void 0?void 0:Y.get(P);if(D?.key!==h)D=void 0;if(!D){if(D=g(h),q(h).filter((i)=>i.transport===void 0&&!i.ended).length>1&&!x)x=!0,o("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:$.sessionID,kind:$.kind})}if(!D||D.transport!==void 0||D.ended)D=await H($,W,y,C);else if(D.transport=C,D.attempt)D.attempt.transport=C;if(C==="ws"){for(let v of q(h))if(v!==D&&v.transport==="ws")S(v,"a newer attempt of its session and kind went out over WebSocket")}return D},R=async($,W)=>{try{return await W()}catch(C){throw E($,{reason:"failed",message:Z(C)}),C}},b=($,W)=>{let C=q(Q2($,W)).filter((P)=>P.transport==="ws").at(-1);return C?.attempt!==void 0&&!C.ended?C:void 0},w=($,W,C)=>{let P=f($);if(!P||!$.attempt||$.limit)return;$.limit={signal:W,delivered:V("limit",{...P,via:C,limit:W,outputStarted:$.outputStarted,handle:$.attempt})}},a=($,W,C,P)=>{let y=f($);if(!y||!$.attempt)return;V("quota",{...y,transport:W,...P===void 0?{}:{status:P},quota:C,handle:$.attempt})},u=($,W,C,P)=>{let y=$.attempt;if(!y)return;let h=J.inspectEvent?.(P===void 0?{transport:W,data:C,attempt:y}:{transport:W,data:C,event:P,attempt:y});if(!h)return;if(h.quota!==void 0)a($,W,h.quota);if(h.outputStarted)$.outputStarted=!0;if(h.limit)w($,h.limit,W);if(h.error!==void 0)E($,{reason:"failed",message:h.error});else if(h.done)E($)},X2=($,W)=>{let C=$.attempt;if(!C||W.accountId===$.accountId)return;if(C.reboundFrom??=C.accountId,C.accountId=W.accountId,"data"in W)C.data=W.data;$.accountId=W.accountId},J2=($)=>!$.attempt||$.endError!==void 0||$.status!==void 0&&$.status>=400,Z2=($)=>{let W=[...Y.values()].filter((v)=>v.scope.sessionID===$),C=W.filter((v)=>v.limit&&!v.rerouted).at(-1);if(C)return C;let P=W.filter((v)=>v.scope.kind==="primary"),y=P.length>0?P:W;if(y.length<=1)return y[0];let h=y.filter((v)=>!v.judged&&J2(v)).at(-1);if(h)return h;let D=y.filter((v)=>v.attempt&&!v.ended);if(D.length>1)return"ambiguous";return D[0]??y.at(-1)},$2={providerID:G},s=[];s.push(await X.session.hook("model.request",($)=>{if(L)return;return e(G2($),async(W)=>{let C=await H(G2($),"model.request",W);if(W(),C.accountId===void 0)throw p(C.scope);w2($.headers,{...C.headers,[H2]:C.id})})},$2)),s.push(await X.session.hook("http.request",($)=>{if(L){let W=T($.request.headers);if(O.set($.sessionID,W),!W)return}return e(G2($),async(W)=>{let C=$.request.headers.get(H2)??void 0,P=L?await H(G2($),"http.request",W,"http"):await A(G2($),"http.request","http",C,W);W();let y=f(P),h=P.attempt;if(!y||!h)throw p(P.scope);await R(P,async()=>{let D=$.request;if(J.rewriteRequest){if(C!==void 0){let W2=new Headers(D.headers);W2.delete(H2),D=new Request(D,{headers:W2})}D=await J.rewriteRequest({...y,request:D,attempt:h})??D,W()}let v=new Headers(D.headers);v.delete(H2),h$(v,P.headers),K(P.scope,v.entries());let i=new Request(D,{headers:v});M.set(i,P),$.request=i})})},$2)),s.push(await X.session.hook("http.response",async($)=>{let W=M.get($.request);if(!W){if(L)return;if(!k)k=!0,o("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:$.sessionID,kind:$.kind});return}let C=$.response;if(J.answeredBy&&W.attempt){let v=W.attempt,i=await R(W,async()=>J.answeredBy?.({request:$.request,response:C,attempt:v}));if(i)X2(W,i)}let P=f(W),y=W.attempt;if(!P||!y)return;W.status=C.status;let h=J.quotaFromHeaders?.(C.headers,C.status,y);if(h!==void 0)a(W,"http",h,C.status);if(!C.ok&&J.limitFromResponse){let v=await J.limitFromResponse({status:C.status,headers:C.headers,body:()=>C.clone().text(),attempt:y});if(v)w(W,v,"http")}if(!C.ok||!C.body)E(W);let D=C;if(C.body&&(J.inspectEvent||J.onAttemptEnd)){let v=C.body;if(J.inspectEvent)v=v.pipeThrough(D2((i)=>u(W,"http",i.data,i.event),(i)=>o("opencode2 auth event inspection threw",{error:Z(i)})));D=new Response(g$(v,(i)=>E(W,i)),{status:C.status,statusText:C.statusText,headers:C.headers})}if(J.rewriteResponse)D=await J.rewriteResponse({...P,request:$.request,response:D,attempt:y})??D;if(D!==C)$.response=D},$2)),s.push(await X.session.hook("experimental.ws.handshake",($)=>{if(L){let W=T(new Headers($.headers)),C=Q2($.sessionID,$.kind);if(O.set($.sessionID,W),Q.delete(C),!W)return}return e(G2($),async(W)=>{let C;for(let D of Object.keys($.headers)){if(D.toLowerCase()!==H2)continue;C??=$.headers[D],delete $.headers[D]}let P=L?await H(G2($),"experimental.ws.handshake",W,"ws"):await A(G2($),"experimental.ws.handshake","ws",C,W);W();let y=f(P),h=P.attempt;if(!y||!h)throw p(P.scope);await R(P,async()=>{w2($.headers,P.headers);let D=J.rewriteHandshakeURL?.({...y,url:$.url,attempt:h});if(D!==void 0)$.url=D;if(K(P.scope,Object.entries($.headers)),L)Q.add(P.key)})})},$2));let t=J.rewriteWebSocketFrame?.bind(J);if(t)s.push(await X.session.hook("experimental.ws.send",async($)=>{let W=G2($);if(L&&!Q.has(Q2(W.sessionID,W.kind)))return;let C=b(W.sessionID,W.kind),P=await t({...W,attempt:C?.attempt,frame:$.frame});if(P!==void 0)$.frame=P},$2));s.push(await X.session.hook("experimental.ws.receive",($)=>{if(L&&!Q.has(Q2($.sessionID,$.kind)))return;let W=b($.sessionID,$.kind);if(!W)return;try{u(W,"ws",$.frame)}catch(C){o("opencode2 auth frame inspection threw",{error:Z(C)})}},$2)),s.push(await X.session.hook("retry",async($)=>{if(L&&O.get($.sessionID)!==!0)return;let W=Z2($.sessionID);if(!W)return;let C=$.decision;if(W==="ambiguous"){await V("retry",{sessionID:$.sessionID,attempt:$.attempt,reason:"host-decides",hostDecision:C,decision:C});return}let P=W;await e(P.scope,async(y)=>{P.judged=!0;let h=C,D,v,i=P.attempt;if(P.accountId===void 0||!i)h={retry:!1},D="no-account";else if(P.outputStarted)h={retry:!1},D="output-started";else{if(!P.limit){let W2=J.limitFromError?.($.error,i);if(W2)w(P,W2,"error")}if(P.ended)await P.ended,y();if(P.limit)await P.limit.delivered,y(),P.rerouted=!0,v={accountId:P.accountId,limit:P.limit.signal},h={retry:!0,delay:0},D="reroute";else D="host-decides"}if($.decision=h,h.retry&&P.accountId!==void 0)j.set(P.key,{sessionID:P.scope.sessionID,accountId:P.accountId,...v===void 0?{}:{rerouteFrom:v}});await V("retry",{sessionID:$.sessionID,...P.accountId===void 0?{}:{accountId:P.accountId},kind:P.scope.kind,attempt:$.attempt,reason:D,hostDecision:C,decision:h,...i===void 0?{}:{handle:i}})})},$2));let j2=($)=>{d($),O.delete($);for(let W of Q)if(JSON.parse(W)[0]===$)Q.delete(W);for(let W of[...Y.values()]){if(W.scope.sessionID!==$)continue;S(W,"its session was forgotten"),Y.delete(W.id)}for(let[W,C]of j)if(C.sessionID===$)j.delete(W)},Y2=new AbortController,V2=X.event;if(V2)(async()=>{try{for await(let $ of V2.subscribe({signal:Y2.signal}))if($.type==="session.deleted")j2($.data.sessionID)}catch($){if(!Y2.signal.aborted)o("opencode2 auth stopped listening for session deletion",{error:Z($)})}})();return{on($,W){let C=l.get($);if(!C)C=new Set,l.set($,C);let P=W;return C.add(P),()=>{C.delete(P)}},accountFor($,W){return g(Q2($,W))?.accountId},forgetSession:j2,get size(){return Y.size},async dispose(){if(c)return;c=!0;for(let $ of r.keys())d($);Y2.abort();for(let $ of Y.values())S($,"the installation was disposed");Y.clear(),j.clear(),Q.clear(),O.clear(),l.clear(),await Promise.all(s.map(async($)=>{try{await $.dispose()}catch(W){o("opencode2 auth hook did not dispose cleanly",{error:Z(W)})}}))}}}import{CacheKeepManager as K1,CacheKeepSessionRegistry as H1,getDefaultCacheKeepRegistryDirectory as U1,isCacheKeepActiveNow as K$,isCacheKeepHybridActive as f2,isCacheKeepSubagentsEnabled as v2,logger as z1}from"@cortexkit/anthropic-auth-core";import{createHash as m$}from"node:crypto";import{applyCustomHeaders as l$,assertNotCustodyTombstone as d$,classifyGzipRejection as u$,createProviderErrorRedactor as n2,createProviderErrorResponseScope as r2,decideRequestGzip as p$,encodeGzipRequestBody as c$,getAccountStoragePath as i$,getRequestGzipLatch as o$,getRequestGzipLatchPath as n$,mergeAnthropicBetas as r$,remapModelId as s2,remapRequestBodyModel as s$,stripEmptyTrailingAssistantMessages as a$,TrailingAssistantHistoryError as t$}from"@cortexkit/anthropic-auth-core";var L2="anthropic",V$="x-common-auth-attempt",e$=["x-session-affinity","x-opencode-session","x-parent-session-id",e2,O2,N2,V$],F2=new Set(["authorization","x-api-key"]),$1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",X1=512,J1=5000,Z1=500,a2=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class B$ extends Error{sessionID;requestKind;kind="no-account";providerID=L2;constructor(X,J){super($1);this.sessionID=X;this.requestKind=J;this.name="NativeAnthropicNoAccountError"}}class I2 extends Error{sessionID;requestKind;kind="session-forgotten";providerID=L2;constructor(X,J){super("request refused: its session was closed while it was being prepared");this.sessionID=X;this.requestKind=J;this.name="NativeAnthropicRevokedError"}}class U2 extends Error{kind="unsupported-transport";providerID=L2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class Q$ extends Error{kind="local-invalid-request";status=400;check;constructor(X){super(X.message,{cause:X});this.name="NativeAnthropicLocalRefusal",this.check=X.check}}var K2=(X)=>typeof X==="object"&&X!==null&&!Array.isArray(X);function C2(X){try{return JSON.parse(X)}catch{return}}function y2(X){let J={};for(let[_,G]of Object.entries(X??{}))J[_.toLowerCase()]=G;return J}function t2(X){let J={};for(let _ of e$){let G=X.get(_);if(G!==null&&_!==V$)J[_]=G;X.delete(_)}return J}function Y1(X){try{return new URL(X).pathname.endsWith("/messages")}catch{return!1}}function W1(X){return X instanceof t$||X instanceof $$?new Q$(X):void 0}function G1(X,J){let _=[];if(X.oauth)_.push(X.oauth.accessToken);for(let[G,L]of Object.entries(X.apiHeaders??{})){if(L===null||!F2.has(G))continue;_.push(L.replace(/^Bearer\s+/i,""))}for(let G of F2){let L=J.get(G);if(L!==null)_.push(L.replace(/^Bearer\s+/i,""))}if(X.dispatch?.kind==="http-relay")_.push(X.dispatch.token);return[...new Set(_.filter(Boolean))]}var j1=new Set(["oauth-2025-04-20","claude-code-20250219",J$]);function V1(X){let J=X.split(",").map((_)=>_.trim()).filter((_)=>_&&!j1.has(_));return r$(null,J)}function B1(X){let J=C2(X);if(!K2(J))return X;let _=a$(J.messages),G=Object.hasOwn(J,"fallbacks"),{droppedMarkers:L}=Z$(J,!1),T=G&&!Object.hasOwn(J,"fallbacks"),N=s$(J);return _>0||L>0||T||N?JSON.stringify(J):X}async function Q1(X,J){if(!(X instanceof Promise))return"settled";let _;try{return await Promise.race([X.then(()=>"settled"),new Promise((G)=>{_=setTimeout(()=>G("timed-out"),J)})])}finally{if(_!==void 0)clearTimeout(_)}}function z2(X){let{source:J,log:_}=X,G=Math.max(1,X.maxPendingSends??X1),L=X.attemptEndTimeoutMs??J1,T=X.requestGzipLatch??o$(n$(i$())),N=new WeakSet,F=new Map,U=new WeakMap,Y=new WeakMap,M=new WeakMap,j=new Map,Q=new WeakMap,O=n2([]);O.dispose();let k=(K)=>(K&&j.get(K)?.redactor)??O,x=(K)=>{let z=j.get(K);if(!z)return;j.delete(K),z.redactor.dispose(),z.scope.dispose()},l=(K,z,H,A)=>{let R=G1(z,A),b=r2(R,H);I.set(K,H),j.set(K,{sessionID:z.sessionID,redactor:n2(R),scope:b}),b.settled.then(()=>x(K));while(j.size>G){let w=j.keys().next().value;if(w===void 0)break;x(w)}},I=new WeakMap,c=(K,z)=>{let H=K?I.get(K):void 0;if(!H||!z.ok)return O.redactResponse(z);let A=r2([],H),R=A.redactResponse(z);return A.dispose(),R},r=(K,z)=>{let H=K?j.get(K)?.scope:void 0;if(!H)return c(K,z);try{return H.redactResponse(z)}catch{return c(K,z)}},o=!1,Z=new WeakMap,V=(K,z)=>{if(K&&!z.ok)Z.set(z.headers,K);return z},B=(K,z)=>{if(z.dispatch!=="http-relay")return!0;let H=/^req_[A-Za-z0-9_-]+$/.test(K.get("request-id")??"");return Y.set(z,H),H},E=(K)=>new B$(K.sessionID,K.kind),S=new Map,q=async(K,z)=>{if(o)throw new I2(K.sessionID,K.kind);let H={revoked:!1},A=S.get(K.sessionID);if(!A)A=new Set,S.set(K.sessionID,A);A.add(H);let R=()=>{if(o||H.revoked)throw new I2(K.sessionID,K.kind)};try{let b=await z(R);return R(),b}finally{let b=S.get(K.sessionID);if(b?.delete(H)&&b.size===0)S.delete(K.sessionID)}},g=(K,z)=>{F.set(K,z);while(F.size>G){let H=F.keys().next().value;if(H===void 0)break;F.delete(H),_?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:G})}},m=(K,z)=>({providerID:K.providerID,modelID:K.modelID,sessionID:K.sessionID,agent:K.agent,kind:K.kind,accountId:K.accountId,attemptId:K.attemptId,transport:K.transport,route:z.route,provenance:z.provenance,dispatch:z.dispatch}),n=(K)=>q(K,async(z)=>{let{accountId:H,...A}=K,R=await J.authorizeAccount(A,H);return z(),f(A,R)}),f=(K,z)=>{if(!z)throw E(K);if(z.dispatch?.kind==="websocket-relay")throw new U2;let H=z.dispatch?.kind==="http-relay"?"http-relay":"direct",A=z.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":z.dispatch.token}:void 0;if(z.route==="oauth"){if(!z.accessToken)throw E(K);d$(z.accessToken,L2);let w=Object.freeze({route:"oauth",provenance:z.provenance,dispatch:H});g(w,{sessionID:K.sessionID,oauth:{accessToken:z.accessToken,...z.identity?{identity:z.identity}:{}},dispatch:z.dispatch,oauthHeaders:z.headers});let a=y2(z.headers);for(let u of F2)delete a[u];return delete a["anthropic-beta"],{headers:A??{...a,"x-api-key":null,authorization:`Bearer ${z.accessToken}`},attempt:w}}let R={authorization:null,"x-api-key":null,...y2(z.headers)};if(!R.authorization&&!R["x-api-key"])throw E(K);let b=Object.freeze({route:"api",provenance:z.provenance,dispatch:H});return g(b,{sessionID:K.sessionID,...z.baseURL?{baseURL:z.baseURL}:{},dispatch:z.dispatch,apiHeaders:R}),{headers:A??R,attempt:b}},p=(K)=>q(K,(z)=>d(K,z)),d=async(K,z)=>{let{request:H,attempt:A}=K,R=A.data,b=R?F.get(R):void 0;if(R)F.delete(R);if(!R||!b||R.route==="oauth"&&!b.oauth)throw E(K);let w=new Headers(H.headers);l$(w);let a=t2(w),u=H.body===null?void 0:await H.text();z();let X2=u!==void 0&&Y1(H.url);try{if(R.route==="oauth"&&b.oauth){let{accessToken:s,identity:t}=b.oauth;for(let[Y2,V2]of Object.entries(y2(b.oauthHeaders))){if(F2.has(Y2))continue;if(V2===null)w.delete(Y2);else w.set(Y2,V2)}let j2=null;if(u!==void 0&&X2){let Y2={...m(A,R),modelID:(()=>{let W=C2(u);return s2(K2(W)&&typeof W.model==="string"?W.model:K.modelID)})(),route:"oauth",correlation:a},V2=await J.requestOptions?.(Y2)??{};z(),u=await G$(u,{...V2,...t?{identity:t}:{},sessionId:K.sessionID,onToolNameMap:(W)=>M.set(R,W)});let $=C2(u);j2=K2($)?$:null}Y$(w,s,{body:j2,...t?{identity:t}:{},requestClass:X$(A.agent)?"auxiliary":"main"})}else{if(u!==void 0&&X2)u=B1(u);w.delete("authorization"),w.delete("x-api-key");for(let[t,j2]of Object.entries(b.apiHeaders??{}))if(j2===null)w.delete(t);else w.set(t,j2);if(u!==void 0&&X2&&!w.has("content-type"))w.set("content-type","application/json");let s=w.get("anthropic-beta");if(s!==null){let t=V1(s);if(t)w.set("anthropic-beta",t);else w.delete("anthropic-beta")}}}catch(s){let t=W1(s);if(!t)throw s;throw U.set(R,t.check),_?.warn("refused an Anthropic request locally; nothing was sent",{check:t.check}),t}let J2=u!==void 0?C2(u):void 0;if(await J.admitRequest?.({...m(A,R),modelID:s2(K2(J2)&&typeof J2.model==="string"?J2.model:K.modelID)}),t2(w),u!==void 0)w.delete("content-length");z(),l(R,b,K2(J2)&&J2.stream===!0?"event-stream":"http",w);let Z2=W$(H.url,b.baseURL!==void 0?{baseURL:b.baseURL}:{}).url?.toString()??H.url;if(R.route==="oauth"&&X2&&u!==void 0)await J.onRequestPrepared?.({...m(A,R),url:Z2,bodyText:u}),z();if(b.dispatch?.kind==="http-relay"){let s=u??"";w.delete("x-relay-token");let t={protocol:1,type:"request",affinity:K.sessionID,upstream:{url:Z2,method:H.method,headers:Object.fromEntries(w)},mode:"full_sync",revision:1,body:s,next_hash:`sha256:${m$("sha256").update(s).digest("hex")}`};return new Request(b.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":b.dispatch.token},redirect:"error",signal:H.signal,body:JSON.stringify(t)})}let $2=u;if(R.route==="oauth"&&X2&&u!==void 0){let s=await p$({url:Z2,body:u,latch:T});if(z(),s.gzip)$2=await c$(u),w.set("content-encoding","gzip"),N.add(R),z()}return new Request(Z2,{method:H.method,headers:w,redirect:H.redirect,signal:H.signal,...$2!==void 0?{body:$2}:{}})};return{adapter:{providerID:L2,chooseAccount:(K)=>q(K,async()=>{let z=await J.chooseAccount(K);if(!z)throw E(K);return z}),accountHeaders:n,rewriteRequest:p,rewriteHandshakeURL(){throw new U2},rewriteResponse({response:K,attempt:z}){let H=z.data;if(H&&!B(K.headers,H)){if(K.status===401)return x(H),K.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return r(H,K)}if(H&&N.has(H))N.delete(H),u$(K).then((a)=>{if(!a)return;T.latchProcess(),_?.warn("gzipped request body rejected; later requests go uncompressed",{kind:a,status:K.status})},()=>{});let A=r(H,K);if(H?.route!=="oauth"||!A.body)return V(H,A);let R={...m(z,H),status:K.status},b=J.responseOptions?.(R)??{},w=(K.headers.get("content-type")??"").includes("application/json");return V(H,j$(A,{...b,toolNameMap:M.get(H),onToolNameRefusal:()=>{U.set(H,"response_tool_names"),x(H)},laneStartOAuthServed:!0,...w?{responseMode:"json"}:{}}))},quotaFromHeaders(K,z,H){let A=H.data;if(!A||!B(K,A))return;return J.quotaFromHeaders?.(K,{...m(H,A),status:z})},async limitFromResponse({status:K,headers:z,body:H,attempt:A}){let R=A.data;if(!R||U.get(R)==="response_tool_names")return;if(!B(z,R))return J.limitFromRelayFailure?.({...m(A,R),status:K});if(Q.set(R,`provider responded with HTTP ${K}`),!J.limitFromResponse)return;let b=Z.get(z)===R,w=k(R);return J.limitFromResponse({...m(A,R),status:K,headers:z,body:async()=>b?await H():w.redactText(await H())})},inspectEvent({data:K,event:z,attempt:H}){if(H.data&&U.get(H.data)==="response_tool_names")return;let A=C2(K);if(!K2(A))return;let R=typeof A.type==="string"?A.type:z;if(R==="content_block_start"||R==="content_block_delta")return{outputStarted:!0};if(R==="message_stop")return{done:!0};if(R!=="error")return;let b=H.data,w=k(b),a=K2(A.error)?A.error:{},u=typeof a.type!=="string"?void 0:a2.has(a.type)?a.type:w.redactText(a.type),X2=typeof a.message==="string"?w.redactText(a.message):void 0;if(b?.dispatch==="http-relay"&&Y.get(b)===!1)return;let J2=b?J.limitFromStreamError?.({...m(H,b),errorType:u,message:X2}):void 0,Z2={error:[u??"error",X2].filter(Boolean).join(": ").slice(0,Z1),...J2?{limit:J2}:{}};if(b&&Z2.error)Q.set(b,Z2.error);return Z2},limitFromError(K,z){let H=z.data;if(!H||U.has(H))return;let A={type:a2.has(K.type)?K.type:"provider_error",message:Q.get(H)??"provider request failed",...K.status!==void 0?{status:K.status}:{}};if(x(H),H.dispatch==="http-relay"&&Y.get(H)===!1)return;return J.limitFromHostError?.(A,m(z,H))},async onAttemptEnd(K,z){let H=K.data;if(!H)return;F.delete(H);let A=z.error?.reason;if(A==="cancelled"||A==="abandoned"||A===void 0&&(z.status===void 0||z.status<400))x(H);let R=U.get(H),{status:b,...w}=z,a=J.onAttemptEnd?.(m(K,H),{...w,...b!==void 0&&(H.dispatch!=="http-relay"||Y.get(H)===!0)?{status:b}:{},...R!==void 0?{localRefusal:{check:R}}:{}});if(await Q1(a,L)==="timed-out")_?.warn("the account source did not finish recording a send",{timeoutMs:L})}},dispose(){o=!0;for(let[K,z]of S){for(let H of z)H.revoked=!0;J.forgetSession?.(K)}S.clear(),F.clear();for(let K of[...j.keys()])x(K)},forgetSession(K){for(let z of S.get(K)??[])z.revoked=!0;S.delete(K);for(let[z,H]of F)if(H.sessionID===K)F.delete(z);for(let[z,H]of[...j])if(H.sessionID===K)x(z);J.forgetSession?.(K)},get pendingSendCount(){return F.size},get heldCredentialCount(){let K=0;for(let z of F.values())if(z.oauth)K++;return K},get heldRedactorCount(){return j.size},get operationsInProgress(){let K=0;for(let z of S.values())K+=z.size;return K}}}function P2(X){return JSON.stringify([X.source,X.accountIdentity,X.credentialId,X.binding?.storageId,X.binding?.rowId,X.binding?.credentialEpoch])}function H$(X){let{runtime:J,source:_}=X,G=new AbortController,L=!1,T=new H1({directory:X.registryDirectory||process.env.OPENCODE_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR||U1("opencode"),now:X.now}),N=new Map,F=async(j,Q,O)=>{let k=O?AbortSignal.any([G.signal,O]):G.signal;k.throwIfAborted();let x=JSON.parse(await Q.text()),l={providerID:"anthropic",modelID:x.model,sessionID:`oc2-cachekeep:${j.id}`,agent:"cachekeep",kind:"generate"},I=z2({source:{..._,onRequestPrepared:void 0,responseOptions:void 0,async requestOptions(V){return{...await _.requestOptions?.(V),laneStart:!1,billingLineage:void 0,cacheDiagnosticsPreviousMessageId:void 0}},async authorizeAccount(V,B){let E=await J.read();k.throwIfAborted();let S=E.accounts.find((g)=>g.id===B);if(S?.type!=="oauth"||P2(S)!==j.oauthAccountIdentity||j.isSubagent&&!v2(E.policyStorage)||!f2(E.policyStorage)||!K$(E.policyStorage,new Date(X.now?.()??Date.now())))return;let q=await _.authorizeAccount(V,B);if(q?.provenance.kind==="local"&&P2({...S,binding:q.provenance.subject.binding,accountIdentity:q.provenance.subject.binding.identity})!==j.oauthAccountIdentity)return;if(q?.provenance.kind==="vault"&&q.provenance.credentialId!==S.credentialId)return;return q},async admitRequest(V){await _.admitRequest?.(V);let B=await J.read(),E=B.accounts.find((S)=>S.id===V.accountId);if(k.throwIfAborted(),!E||P2(E)!==j.oauthAccountIdentity||j.isSubagent&&!v2(B.policyStorage)||!f2(B.policyStorage)||!K$(B.policyStorage,new Date(X.now?.()??Date.now())))throw Error("CacheKeep policy changed before dispatch")}}}),c,r,o=!1,Z=()=>I.forgetSession(l.sessionID);k.addEventListener("abort",Z,{once:!0});try{let V=(await J.read()).accounts.find((m)=>P2(m)===j.oauthAccountIdentity)?.id;if(!V)throw Error("CacheKeep account is unavailable");let B=await I.adapter.accountHeaders({...l,accountId:V});if(!("headers"in B)||typeof B.headers!=="object"||B.headers===null||typeof B.attempt!=="object"||B.attempt===null||B.attempt.route!=="oauth")throw Error("CacheKeep authorization refused");c={...l,accountId:V,attemptId:crypto.randomUUID(),transport:"http",data:B.attempt};let E=await I.adapter.rewriteRequest?.({...l,accountId:V,attempt:c,request:new Request(j.url,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(x),signal:k})});if(!E)throw Error("CacheKeep rewrite refused");k.throwIfAborted();let S=await(X.fetch??fetch)(E),q=await I.adapter.rewriteResponse?.({...l,accountId:V,attempt:c,request:E,response:S});if(!q)throw Error("CacheKeep response rewrite refused");if(r=q.status,I.adapter.quotaFromHeaders?.(q.headers,q.status,c),!q.ok)await I.adapter.limitFromResponse?.({status:r,headers:q.headers,body:()=>q.clone().text(),attempt:c});let g=await q.arrayBuffer();return o=!0,new Response(g,{status:r,headers:q.headers})}catch{throw Error("Native CacheKeep was not completed")}finally{k.removeEventListener("abort",Z);try{if(c)await I.adapter.onAttemptEnd?.(c,{status:r,outputStarted:!1,...o?{}:{error:{reason:"cancelled"}}})}finally{I.dispose(),_.forgetSession?.(l.sessionID)}}},U=X.setIntervalImpl??globalThis.setInterval,Y=new K1({loadStorage:async()=>L?null:(await J.read()).policyStorage,now:X.now,setIntervalImpl:(j,Q)=>U(()=>Y.tick().catch(()=>{z1.warn("cachekeep","tick failed")}),Q),clearIntervalImpl:X.clearIntervalImpl,onTrackedSessionsChanged:(j)=>T.publish(L?[]:j),prepareHeaders(j,Q,O){if(L)return;return N.set(O.id,{target:Q,attempt:O}),new Headers({"x-native-cachekeep-attempt":String(O.id)})},fetchImpl:async(j,Q)=>{let O=new Request(j,Q),k=Number(O.headers.get("x-native-cachekeep-attempt")),x=N.get(k);if(N.delete(k),!x)throw Error("CacheKeep attempt is unavailable");return F(x.target,O,x.attempt.signal)},onComplete:({attempt:j})=>{N.delete(j.id)}}),M;return{async track(j){if(L||j.route!=="oauth"||j.agent==="cachekeep"||j.agent==="prime"||j.kind!=="primary")return;let Q=await J.read();if(L||!f2(Q.policyStorage))return;let O=!1;try{O=await X.isSubagent?.(j.sessionID)??!1}catch{return}if(L||O&&!v2(Q.policyStorage))return;let k=Q.accounts.find((x)=>x.id===j.accountId);if(!k?.accountIdentity)return;if(j.provenance.kind==="local"&&JSON.stringify(k.binding)!==JSON.stringify(j.provenance.subject.binding))return;if(j.provenance.kind==="vault"&&k.credentialId!==j.provenance.credentialId)return;Y.track({sessionId:j.sessionID,url:j.url,headers:new Headers,bodyText:j.bodyText,storage:Q.policyStorage,cacheMode:"hybrid",oauthAccountId:j.accountId,oauthAccountIdentity:P2(k),isSubagent:O}),await T.publish(Y.trackedSessions())},registry:T,dispose(){if(M)return M;return L=!0,Y.stop(),G.abort(),M=(async()=>{try{await Y.tick()}finally{N.clear(),await T.dispose()}})(),M}}}async function U$(X,J,_){let G=z2(J),L=[],T=async(Q,O,k)=>{let x=await X.session.hook(Q,O,k);return L.push(x),x},N=new AbortController,F;try{F=await b2({session:{hook:T},event:X.event},G.adapter,{logger:J.log,gateOnPlaceholder:_})}catch(Q){throw G.dispose(),await Promise.allSettled(L.map((O)=>O.dispose())),Q}let U=(Q)=>{G.forgetSession(Q),F.forgetSession(Q)},Y=X.event,M=Y?(async()=>{try{for await(let Q of Y.subscribe({signal:N.signal}))if(Q.type==="session.deleted")U(Q.data.sessionID)}catch(Q){if(!N.signal.aborted)J.log?.warn("stopped listening for session deletion",{error:Q instanceof Error?Q.name:"unknown"})}})():Promise.resolve(),j;return{installation:F,forgetSession:U,dispose(){if(j)return j;return G.dispose(),N.abort(),j=(async()=>{await F.dispose(),await M})(),j}}}import{effectiveRelayTransport as z$,getQuotaCheckIntervalMs as M1,logger as _1,nativeAccountCanServe as C1,oauthProfileIsFresh as L1,quotaSnapshotCheckedAt as N1}from"@cortexkit/anthropic-auth-core";function M$(X,J){let _=new AbortController,G,L=!1,T=async()=>{let U=await X.read();if(_.signal.throwIfAborted(),U.policyStorage.relay?.enabled===!0&&z$(U.policyStorage.relay.transport,U.policyStorage.relay.url)==="websocket")return;let Y=U,M=M1(Y.policyStorage);for(let j of Y.accounts){if(_.signal.aborted)return;if(!C1(j)||j.type!=="oauth")continue;if(Y.policyStorage.quota?.enabled!==!1&&Date.now()-N1(j.quota)>=M)await X.fetchQuota(j.id,J,_.signal,void 0,"background").catch(()=>{});if(!L1(j.profile)&&!_.signal.aborted)await X.fetchProfile(j.id,J,_.signal).catch(()=>{})}},N=()=>{if(L||G)return G;return G=T().catch(()=>{if(!_.signal.aborted)_1.debug("opencode2","native background readings did not complete")}).finally(()=>{G=void 0}),G},F=X.vault.watch({intervalMs:60000,onRefresh:N,shouldRefresh:async()=>{let U=await X.read();return U.policyStorage.relay?.enabled!==!0||z$(U.policyStorage.relay.transport,U.policyStorage.relay.url)==="http"}});return F.ready.catch(()=>{}),{async dispose(){L=!0,F.close(),_.abort(),await G}}}import{authorize as P1,buildCacheKeepStatusSummary as T1,buildClaudeQuotaSummary as F1,buildPrimeAccountStatuses as O1,buildPrimeStatusSummary as E1,CLAUSTRUM_OPENCODE_ENROLLMENT_NAME as S1,exchange as x1,formatNativeAccountState as R1,formatOAuthAccountTier as A1,getCacheKeepWindow as q1,getHostClaustrumEnrollmentPaths as k1,isCacheKeepAlways as D1,isCacheKeepHybridActive as w1,isCacheKeepPersistentlyEnabled as b1,nativeAccountCanServe as y1,resetClaustrumEnrollmentState as I1}from"@cortexkit/anthropic-auth-core";var g2=(X)=>X!==null&&typeof X==="object"&&!Array.isArray(X)?X:{};function _$(X){let{runtime:J,source:_}=X,G=new Map,L=!1,T=async(Y,M)=>{await J.updateSettings((j)=>({...j,[Y]:{...g2(j[Y]),...M}}))},N=()=>({ok:!0,text:"Native Claude settings updated."}),F=async(Y,M)=>{if(L)throw Error("Native menu is closed");switch(M.signal?.throwIfAborted(),Y.action){case"enable":case"disable":return await J.setEnabled(Y.values.id,Y.action==="enable"),N();case"remove":return await J.remove(Y.values.id),N();case"move-up":case"move-down":{let Q=(await J.read()).accounts.map((I)=>I.id),O=Q.indexOf(Y.values.id),k=O+(Y.action==="move-up"?-1:1);if(O<0||k<0||k>=Q.length)return{ok:!1,text:"Account cannot move in that direction."};let x=Q[O],l=Q[k];if(x===void 0||l===void 0)return{ok:!1,text:"Account order changed."};return Q[O]=l,Q[k]=x,await J.reorder(Q),N()}case"add-apikey":return await J.addApi(Y.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let j=new AbortController;G.get(Y.sessionId)?.active.abort();let Q={active:j,auth:void 0};G.set(Y.sessionId,Q);let O=await P1("max");if(L||j.signal.aborted||M.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return Q.auth=O,{ok:!0,text:`Open ${O.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let j=G.get(Y.sessionId);if(!j?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let Q=await x1(Y.values.code,j.auth.verifier,j.auth.redirectUri,j.auth.state);if(j.active.signal.throwIfAborted(),M.signal?.throwIfAborted(),L||Q.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await J.loginOAuth({routeId:crypto.randomUUID(),credential:Q,label:Y.values.label}),j.active.signal.throwIfAborted(),M.signal?.throwIfAborted(),L)return{ok:!1,text:"Sign-in cancelled."};return G.delete(Y.sessionId),{ok:!0,text:"OAuth account stored in the native account pool."}}case"reset-backoff":{let j=await J.read();for(let Q of j.accounts){if(M.signal?.throwIfAborted(),Q.type!=="oauth")continue;let O=Q.source==="vault"?await J.authorizeVault(Q.id,M.signal):await J.captureLocalSubject(Q.id);await J.resetBackoff(Q.id,O)}return N()}case"enrollment-reset":{let j=await I1(k1("opencode"),S1);return{ok:j==="reset",text:j==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let Q=(await J.read()).accounts.filter((x)=>x.type==="oauth"&&y1(x)),O=await Promise.allSettled(Q.map((x)=>J.fetchQuota(x.id,void 0,M.signal)));return{ok:O.every((x)=>x.status==="fulfilled"),text:`${O.filter((x)=>x.status==="fulfilled").length}/${Q.length} native quota readings refreshed.`}}case"routing-reset":return await _.resetRouting(Y.sessionId),N();case"routing-mode":return await T("routing",{mode:Y.values.mode}),N();case"killswitch-on":case"killswitch-off":return await T("killswitch",{enabled:Y.action==="killswitch-on"}),N();case"killswitch-set":return await J.updateSettings((j)=>{let Q=g2(j.killswitch),O={...g2(Q.accounts)},k=Q.main;for(let x of Y.values.entries){let l={five_hour:x.fh,seven_day:x.sd,...x.scoped!==void 0?{scoped:x.scoped}:{}};if(x.account==="main"||x.account==="all")k=l;if(x.account==="all")for(let I of Object.keys(O))O[I]=l;else if(x.account!=="main")O[x.account]=l}return{...j,killswitch:{...Q,main:k,accounts:O}}}),N();case"cache-on":case"cache-off":return await T("claudeCache",{enabled:Y.action==="cache-on"}),N();case"cache-mode":return await T("claudeCache",{mode:Y.values.mode}),N();case"cachekeep-always":return await T("cacheKeep",{enabled:!0,always:!0}),N();case"cachekeep-off":return await T("cacheKeep",{enabled:!1}),N();case"cachekeep-window":return await T("cacheKeep",{enabled:!0,always:!1,startHour:Y.values.startHour,endHour:Y.values.endHour}),N();case"cachekeep-subagents":return await T("cacheKeep",{subagents:Y.values.enabled==="on"}),N();case"dump-on":case"dump-off":return await T("dump",{enabled:Y.action==="dump-on"}),N();case"logging-level":return await T("logging",{level:Y.values.level}),N();case"fast-on":case"fast-off":return await T("claudeFast",{enabled:Y.action==="fast-on"}),N();case"prime-on":case"prime-off":return await T("prime",{enabled:Y.action==="prime-on"}),N();case"start-fire":return await U(Y.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},U=(Y)=>X.start(Y,E2);return{dispatch:F,async readStatus(Y){let M=await J.read();if(Y==="account")return M.accounts.map((Q)=>`${Q.id}${Q.label?` (${Q.label})`:""}: ${Q.type}, ${Q.source}, ${Q.enabled?"enabled":"disabled"}${Q.state?`, ${R1(Q)}`:""}${Q.accountIdentity?`, ${Q.accountIdentity}`:""}`).join(`
+`)||"No native Claude accounts.";if(Y==="quota")return F1({accounts:M.accounts.filter((Q)=>Q.type==="oauth").map((Q)=>({name:Q.label??Q.id,role:Q.id==="main"?"main":"fallback",enabled:Q.enabled,quota:Q.quota,tierLabel:A1(Q.profile),lastRefreshedAt:Q.lastRefreshedAt,error:Q.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(Y==="prime")return E1({enabled:M.policyStorage.prime?.enabled===!0,accounts:O1(M.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");if(Y==="cachekeep"){let Q=await X.cacheKeepRegistry?.list()??[];return T1({enabled:b1(M.policyStorage),always:D1(M.policyStorage),hybridActive:w1(M.policyStorage),trackedSessionDetails:Q,window:q1(M.policyStorage),trackedSessions:Q.length,nextPrewarmAt:Q.length?Math.min(...Q.map((O)=>O.nextPrewarmAt)):void 0})}let j={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(M.settings[j[Y]]??{})},forgetSession(Y){G.get(Y)?.active.abort(),G.delete(Y)},close(){L=!0;for(let Y of G.values())Y.active.abort();G.clear()}}}import{isClaudeFable51Model as f1,isClaudeHaiku55Model as v1,isClaudeOpus5FamilyModel as g1,isClaudeSonnet55Model as h1}from"@cortexkit/anthropic-auth-core";function C$(){let X=new Map;return{install:(_)=>_.model.transform((G)=>{X.clear();for(let L of G.list("anthropic")){if(X.set(String(L.id),String(L.modelID)),!(f1(L.modelID)||g1(L.modelID)||h1(L.modelID)||v1(L.modelID)))continue;G.update("anthropic",String(L.id),(T)=>{let N=["low","medium","high","xhigh","max"],F=T.variants.filter((U)=>!N.some((Y)=>Y===String(U.id)));T.variants=[...F,...N.map((U)=>({id:U,settings:{effort:U,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(_)=>X.get(_)??_}}function L$(X){return X.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??X.get("x-api-key")??void 0}import{buildPrimeRequestBody as N$,effectiveRelayTransport as P$,nativeAccountCanServe as m1,PrimeManager as l1}from"@cortexkit/anthropic-auth-core";var T$=(X)=>X!==null&&typeof X==="object"&&!Array.isArray(X)?X:{};function F$(X){let{runtime:J,source:_}=X,G=new AbortController,L=new Set,T=(U)=>({providerID:"anthropic",modelID:N$().model,sessionID:`oc2-prime:${U}`,agent:"prime",kind:"generate"}),N=async(U)=>{let Y=T(U),M=z2({source:_}),j=performance.now();try{for(let Q=0;Q<3;Q++){if(G.signal.throwIfAborted(),(await J.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let k=await M.adapter.accountHeaders({...Y,accountId:U});if(!("headers"in k)||typeof k.headers!=="object"||k.headers===null||typeof k.attempt!=="object"||k.attempt===null)throw Error("Native Prime authorization refused");let x={...Y,accountId:U,attemptId:crypto.randomUUID(),transport:"http",data:k.attempt},l,I=!1,c=!1,r=(o)=>{c=!0,o.body?.cancel().catch(()=>{})};try{let o=await M.adapter.rewriteRequest?.({...Y,accountId:U,attempt:x,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(N$()),signal:G.signal})});if(!o)throw Error("Native Prime rewrite refused");let Z=new Headers(o.headers);for(let[n,f]of Object.entries(k.headers))if(f===null)Z.delete(n);else Z.set(n,f);let V=new Request(o,{headers:Z}),B=await(X.fetch??fetch)(V),E=await M.adapter.rewriteResponse?.({...Y,accountId:U,request:V,response:B,attempt:x})??B;l=E.status,M.adapter.quotaFromHeaders?.(E.headers,E.status,x);let S=E.ok?void 0:await M.adapter.limitFromResponse?.({status:E.status,headers:E.headers,body:()=>E.clone().text(),attempt:x});if(S&&/^(vault-newer|local-newer|relay-direct):/.test(S.reason)&&Q<2){if(r(E),await _.chooseAccount({...Y,rerouteFrom:{accountId:U,limit:S}})!==U)throw Error("Native Prime retry changed account");continue}if(!E.ok)return r(E),{ok:!1,status:l,ms:performance.now()-j,error:"Native Prime upstream refused the request"};let q=T$(await E.json()),g=T$(q.usage),m={inputTokens:typeof g.input_tokens==="number"?g.input_tokens:void 0,outputTokens:typeof g.output_tokens==="number"?g.output_tokens:void 0};if(x.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(E.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(I=await _.recordPrime(k.attempt.provenance,m),!I)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:l,ms:performance.now()-j,usage:m}}finally{await M.adapter.onAttemptEnd?.(x,{status:l,outputStarted:!1,...I?{}:{error:{reason:c?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-j}}finally{M.dispose()}},F=new l1({storagePath:X.paths.legacyConfig,loadStorage:async()=>(await J.read()).policyStorage,async getAccountFingerprint(U){let Y=await J.read(),M=Y.accounts.find((Q)=>Q.id===U);if(!m1(M)||M?.type!=="oauth")return;if(Y.policyStorage.relay?.enabled===!0&&P$(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")return;if(M.source==="vault"){let Q=await J.authorizeVault(U,G.signal);return J.getOrCreateAuthLineage(U,Q)}let j=await J.authorizeLocal(U,{signal:G.signal});return j.status==="usable"?J.getOrCreateAuthLineage(U,j.subject):void 0},async refreshQuota(U){let Y=await J.read();if(Y.policyStorage.relay?.enabled===!0&&P$(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await J.fetchQuota(U,X.fetch,G.signal),fresh:!0}},sendPrime(U){let Y=N(U);return L.add(Y),Y.finally(()=>L.delete(Y)),Y},async recordSuccess(U){let Y=(await J.read()).accounts.find((M)=>M.id===U);if(!Y?.prime)throw Error("Native Prime counters are unavailable");return Y.prime}});return F.start(),{manager:F,async dispose(){F.stop(),G.abort(),await Promise.allSettled(L)}}}import{createNativeUsagePublisher as d1,effectiveRelayTransport as u1,getClaudeCodeIdentityForVerifiedAccount as S2,getQuotaCheckIntervalMs as p1,getRoutingMode as O$,isQuotaBearingHeaderFrame as c1,mergeHeaderQuotaForPersistence as i1,NativeVaultNoAccountError as o1,nativeAccountCanServe as h2,nativeAccountPolicy as x2,normalizeQuotaHeaders as n1,quotaSnapshotCheckedAt as r1,quotaSnapshotHasStandardWindows as s1,readNativeAccountsForRequest as a1,remapModelId as m2,StickySessionRouter as t1,shouldFallbackStatus as e1,stickyQuotaSnapshotIsFresh as R2,stickyRouteFamilyForModel as $X}from"@cortexkit/anthropic-auth-core";var l2=(X)=>["five_hour","seven_day"].some((J)=>(X?.[J]?.remainingPercent??1)<=0);function S$(X){let{runtime:J}=X,_=d1("native-auth"),G=new Map,L=(Z)=>{let V=Z.routingPath;if(!V)throw Error("Native routing storage is unavailable");let B=G.get(V);if(!B)B=new t1({path:V,vaultSeed:Z.routingSeed,localRecoveryPath:Z.mode==="local"?Z.routingRecoveryPath:void 0}),G.set(V,B);return B.setVaultSeed(Z.routingSeed),B},T=new WeakMap,N=new Map,F=new Map,U=new Map,Y=new WeakSet,M=!1,j=()=>{while(N.size>512){let Z=N.keys().next();if(!Z.done)N.delete(Z.value)}},Q=(Z,V)=>JSON.stringify([Z.sessionID,Z.kind,Z.modelID,V]),O=(Z)=>{if(M)throw Error("Native Anthropic source is closed");let V=U.get(Z.sessionID);if(!V){V=new AbortController,U.set(Z.sessionID,V);while(U.size>512){let B=U.keys().next();if(!B.done)r.forgetSession?.(B.value)}}return V},k=(Z,V,B)=>h2(Z)&&(Z.type==="api"||x2(Z,V,m2(B)).status==="allowed"),x=async(Z,V,B,E)=>{let S=await J.read();E.signal.throwIfAborted(),l(S);let q=S.accounts.find((g)=>g.id===Z);if(!q||q.type!==B||!k(q,S,V))return!1;if(B==="api"){let g=S.accounts.find((m)=>m.id==="main"&&m.type==="oauth");return!!g&&R2(g.quota,S.policyStorage)&&l2(g.quota)}return!0},l=(Z)=>{let V=Z.policyStorage.relay;if(V?.enabled===!0&&u1(V.transport,V.url)==="websocket")throw new U2},I=async(Z,V)=>{if(l(Z),V||Z.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let B=await J.getRelayConfig();if(!B)throw Error("request refused: native HTTP relay configuration is unavailable");if(B.transport!=="http")throw new U2;return{dispatch:{kind:"http-relay",url:B.url,token:B.token},relayFallback:B.fallbackToDirect}};async function c(Z,V,B){if(Z.kind==="local")await J.publishLocal(Z.subject,B);else if(Z.kind==="vault"&&V.receipt)await J.vault.publish(V.receipt,B);else if(Z.kind==="api"&&B.lastUsed!==void 0)await J.publishApi(Z.subject,{lastUsed:B.lastUsed})}let r={async chooseAccount(Z){let V=O(Z);X.onOwnedRequest?.();let B=await J.read();V.signal.throwIfAborted(),l(B);let E=m2(await X.resolveModelId?.(Z)??Z.modelID);if(V.signal.throwIfAborted(),B.mode==="claustrum")B=await a1(J,V.signal),V.signal.throwIfAborted();if(B.policyStorage.quota?.enabled!==!1){let f=!1;for(let p of B.accounts){if(!h2(p)||p.type!=="oauth")continue;if(s1(p.quota)?R2(p.quota,B.policyStorage,Date.now(),E):Date.now()-r1(p.quota)<p1(B.policyStorage))continue;try{await J.fetchQuota(p.id,X.fetch,V.signal,void 0,"admission"),f=!0}catch{V.signal.throwIfAborted()}}if(f)B=await J.read();V.signal.throwIfAborted()}let S=Z.rerouteFrom?N.get(Z.rerouteFrom.limit.reason):void 0;if(Z.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(Z.rerouteFrom.limit.reason)&&!S)return;if(S&&Z.rerouteFrom){N.delete(Z.rerouteFrom.limit.reason);let f=B.accounts.find((e)=>e.id===S.accountId);if(!f||!k(f,B,E))return;let p=Q(Z,S.accountId),d=F.get(p)??[];return d.push(S),F.set(p,d),S.accountId}let q=[];for(let f of B.accounts){if(f.type!=="oauth"||!k(f,B,E))continue;if(f.source==="local"){let p=await J.authorizeLocal(f.id,{signal:V.signal,policy:(d,e)=>x2(d,e,E)});if(V.signal.throwIfAborted(),p.status!=="usable")continue}q.push(f)}let g=q.filter((f)=>f.id!==Z.rerouteFrom?.accountId);if(O$(B.policyStorage)==="sticky-balanced"){let f=g.map((d,e)=>({accountId:d.id,order:e,quota:d.quota??{kind:"unknown"}})),p=await L(B).resolve({sessionId:Z.sessionID,family:$X(E),modelId:E,affinityModelId:Z.modelID,candidates:f,retainAccountIds:new Set(g.map((d)=>d.id)),...B.mode==="claustrum"?{accountIdentities:new Map(B.accounts.flatMap((d)=>d.accountIdentity?[[d.id,d.accountIdentity]]:[]))}:{},storage:B.policyStorage,inputBytes:1,preferredAccountId:Z.previousAccountId});if(V.signal.throwIfAborted(),p)return p.accountId}else{let p=O$(B.policyStorage)==="fallback-first"?[...g.filter((d)=>d.id!=="main"),...g.filter((d)=>d.id==="main")]:[...g.filter((d)=>d.id==="main"),...g.filter((d)=>d.id!=="main")];if(p[0])return p[0].id}if(B.mode==="claustrum")throw new o1;let m=B.accounts.find((f)=>f.id==="main"&&f.type==="oauth");if(!m)return;let n=m.quota;if(Z.rerouteFrom?.limit.status===429||!R2(n,B.policyStorage))try{n=await J.fetchQuota("main",X.fetch,V.signal)}catch{return}if(V.signal.throwIfAborted(),!l2(n))return;return B.accounts.find((f)=>f.type==="api"&&h2(f)&&f.id!==Z.rerouteFrom?.accountId)?.id},async authorizeAccount(Z,V){let B=O(Z),E=await J.read();B.signal.throwIfAborted(),l(E);let S=m2(await X.resolveModelId?.(Z)??Z.modelID);B.signal.throwIfAborted();let q=E.accounts.find((H)=>H.id===V);if(!q||!k(q,E,S))return;let g=Q(Z,V),m=F.get(g),n=m?.shift();if(m?.length===0)F.delete(g);let{dispatch:f,relayFallback:p}=await I(E,n?.direct===!0);if(B.signal.throwIfAborted(),n?.auth){if(!await x(V,S,n.auth.route,B))return;let H=T.get(n.auth.provenance);if(H?.receipt?.expiresAtMs!==void 0&&H.receipt.expiresAtMs!==null&&H.receipt.expiresAtMs<Date.now()+300000)return;if(H)T.set(n.auth.provenance,{...H,scope:{...Z,modelID:S},account:q,active:B,relayFallback:p});return{...n.auth,dispatch:f}}let d={scope:{...Z,modelID:S},active:B,account:q,retry:n?.retry??!1,relayFallback:p,quota:q.quota};if(q.type==="api"){let H=E.accounts.find((w)=>w.id==="main"&&w.type==="oauth");if(!H||!R2(H.quota,E.policyStorage)||!l2(H.quota))return;let A=await J.authorizeApi(V,B.signal);if(B.signal.throwIfAborted(),!await x(V,S,"api",B))return;let R={kind:"api",subject:A.subject};return T.set(R,d),{route:"api",headers:A.authHeader==="authorization-bearer"?{authorization:`Bearer ${A.apiKey}`}:{"x-api-key":A.apiKey},baseURL:A.baseURL,provenance:R,dispatch:f}}if(q.source==="vault"){let H=await J.authorizeVault(V,B.signal);if(B.signal.throwIfAborted(),!await x(V,S,"oauth",B))return;let A={kind:"vault",credentialId:H.credentialId,recordVersion:H.recordVersion};T.set(A,{...d,receipt:H});let R=H.assertedAccountIdentity;if(!R)return;return{route:"oauth",accessToken:H.accessToken,provenance:A,dispatch:f,identity:S2(R,R)}}let e=await J.authorizeLocal(V,{signal:B.signal,policy:(H,A)=>x2(H,A,S)});if(B.signal.throwIfAborted(),e.status!=="usable")return;if(!await x(V,S,"oauth",B))return;let K={kind:"local",subject:e.subject};T.set(K,{...d,access:e.access});let z=e.subject.binding.identity;return{route:"oauth",accessToken:e.access,provenance:K,dispatch:f,identity:S2(z,z)}},async requestOptions(Z){let V=O(Z),B=await J.read();V.signal.throwIfAborted();let E=B.accounts.find((q)=>q.id===Z.accountId);if(!E||!k(E,B,Z.modelID))throw Error("request refused: native account is ineligible for this model");let S=T.get(Z.provenance);if(S)T.set(Z.provenance,{...S,scope:{...S.scope,modelID:Z.modelID}});return X.requestOptions(Z,B)},async admitRequest(Z){let V=T.get(Z.provenance);if(!V||!await x(Z.accountId,Z.modelID,Z.route,V.active))throw Error("request refused: native account policy changed before dispatch");T.set(Z.provenance,{...V,scope:{...V.scope,modelID:Z.modelID}})},onRequestPrepared:(Z)=>X.onRequestPrepared?.(Z),responseOptions(Z){return X.responseOptions?.({...Z,modelID:T.get(Z.provenance)?.scope.modelID??Z.modelID})},quotaFromHeaders(Z,V){let B=T.get(V.provenance),E=E$(Z);if(E)X.onRequestId?.(V,E);if(!B||V.route!=="oauth"||!c1(Z))return;let S=V.provenance.kind==="local"?V.provenance.subject.binding.identity:B.receipt?.assertedAccountIdentity,q={...n1(Z),...S?{accountIdentity:S}:{}};B.quota=i1(B.quota,q);let g=_.observe(c(V.provenance,B,{quota:B.quota}));return o.set(V.provenance,g),q},async limitFromResponse(Z){let V=T.get(Z.provenance);if(!V)return;if(Z.status===401&&V.receipt){if(!Y.has(V.receipt))Y.add(V.receipt),await J.vault.reportFailure(V.receipt,401,Z.dispatch==="http-relay"?"relay_status_field":"direct");if(V.retry||V.active.signal.aborted)return;let E=V.active,S=await J.vault.prepareRetry(V.receipt,E.signal);if(E.signal.throwIfAborted(),!S.retry)return;let q=S.receipt,g=q.assertedAccountIdentity;if(!g)return;let m={kind:"vault",credentialId:q.credentialId,recordVersion:q.recordVersion};T.set(m,{...V,receipt:q,retry:!0});let n=`vault-newer:${Z.attemptId}`;return N.set(n,{sessionID:Z.sessionID,accountId:Z.accountId,retry:!0,auth:{route:"oauth",accessToken:q.accessToken,provenance:m,identity:S2(g,g)}}),j(),{reason:n,status:401}}if(Z.status===401&&Z.provenance.kind==="local"&&V.access&&!V.retry){if(V.active.signal.aborted)return;let E=V.active,S=await J.authorizeLocal(Z.accountId,{rejectedAccessToken:V.access,signal:E.signal,policy:(n,f)=>x2(n,f,V.scope.modelID)});if(E.signal.throwIfAborted(),S.status!=="usable"||S.access===V.access)return;let q={kind:"local",subject:S.subject};T.set(q,{...V,access:S.access,retry:!0});let g=S.subject.binding.identity,m=`local-newer:${Z.attemptId}`;return N.set(m,{sessionID:Z.sessionID,accountId:Z.accountId,retry:!0,auth:{route:"oauth",accessToken:S.access,provenance:q,identity:S2(g,g)}}),j(),{reason:m,status:401}}let B=await J.read();if(e1(Z.status,B.policyStorage))return{reason:`provider-${Z.status}`,status:Z.status};return},limitFromRelayFailure(Z){let V=T.get(Z.provenance);if(!V?.relayFallback||V.active.signal.aborted||!(Z.status===401||Z.status>=500))return;let B=`relay-direct:${Z.attemptId}`;return N.set(B,{sessionID:Z.sessionID,accountId:Z.accountId,direct:!0,retry:!1}),j(),{reason:B}},limitFromStreamError(Z){return Z.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(Z,V){let B=T.get(V.provenance);if(V.dispatch==="http-relay"&&B?.relayFallback&&!B.active.signal.aborted&&Z.status===void 0){let E=`relay-direct:${V.attemptId}`;return N.set(E,{sessionID:V.sessionID,accountId:V.accountId,direct:!0,retry:!1}),j(),{reason:E}}return},async onAttemptEnd(Z,V){let B=T.get(Z.provenance);if(!B)return;try{if(await o.get(Z.provenance),V.status===401&&B.receipt&&!Y.has(B.receipt))Y.add(B.receipt),await J.vault.reportFailure(B.receipt,401,Z.dispatch==="http-relay"?"relay_status_field":"direct");if(!V.localRefusal&&V.status!==void 0)_.publish(()=>c(Z.provenance,B,{lastUsed:Date.now()}))}finally{T.delete(Z.provenance),o.delete(Z.provenance)}},forgetSession(Z){U.get(Z)?.abort(),U.delete(Z);for(let[V,B]of N)if(B.sessionID===Z)N.delete(V);for(let[V,B]of F)if(B[0]?.sessionID===Z)F.delete(V);X.onForgetSession?.(Z)},resetRouting:async(Z)=>L(await J.read()).clear(Z),async recordPrime(Z,V){let B=T.get(Z);if(!B||B.active.signal.aborted)return!1;if(Z.kind==="local")return J.incrementPrimeUsage(B.account.id,Z.subject,V);if(Z.kind==="vault"&&B.receipt)return J.incrementPrimeUsage(B.account.id,B.receipt,V);return!1},close(){M=!0;for(let Z of U.values())Z.abort();return U.clear(),F.clear(),N.clear(),_.drain()}},o=new WeakMap;return r}import{remapModelId as XX}from"@cortexkit/anthropic-auth-core";function A$(){let X=new x$,J=new Map,_=new Map,G=new Map,L=new Set,T=new Set,N=new Map,F=(U)=>{while(U.size>512){let Y=U.keys().next();if(!Y.done)U.delete(Y.value)}};return{async install(U){let Y=[];try{Y.push(await U.session.hook("context",(M)=>{let j=M.messages.map((O)=>{return{info:{id:O.id,sessionID:M.sessionID,role:O.role,agent:M.agent,model:{providerID:M.model.providerID,modelID:M.model.id}},parts:O.content.map((k)=>({type:k.type,...k.type==="text"?{text:k.text}:{}}))}});X.observeMessages(j);let Q=M.messages.findLast((O)=>O.role==="user"&&O.id);if(Q?.id)J.set(M.sessionID,Q.id);if(Q?.content.some((O)=>O.type==="text"&&O.text===E2))L.add(M.sessionID);else L.delete(M.sessionID);F(J)},{providerID:"anthropic"})),Y.push(await U.session.hook("model.request",(M)=>{if(M.kind!=="primary")return;let j=J.get(M.sessionID);if(!j)return;if(X.markHeaders({sessionId:M.sessionID,messageId:j,agent:M.agent,headers:M.headers}),L.has(M.sessionID))M.headers[N2]="1"},{providerID:"anthropic"}))}catch(M){throw await Promise.allSettled(Y.map((j)=>j.dispose())),M}return{dispose:async()=>{await Promise.all(Y.map((M)=>M.dispose()))}}},requestOptions(U,Y){let M=X.resolveHeader(U.correlation[O2]);if(M)_.set(U.attemptId,M),F(_);N.set(U.attemptId,U.sessionID),F(N);let j=U.correlation[N2]==="1";if(j)T.add(U.attemptId);return{cache1hEnabled:U.agent!=="compaction"&&U.agent!=="title"&&(Y.policyStorage.claudeCache?.enabled??!0),cache1hMode:Y.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:Y.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:Y.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,serverSideFallbackEnabled:R$(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:j,billingLineage:M?{promptId:M.promptId,previousRequestId:M.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:G.get(U.sessionID)}},responseOptions(U){return{serverSideFallbackModel:XX(U.modelID),laneStart:T.has(U.attemptId),onMessageStart(Y){if(U.kind==="primary"&&typeof Y.id==="string")G.set(U.sessionID,Y.id),F(G)},onStreamEnd(){_.delete(U.attemptId),T.delete(U.attemptId),N.delete(U.attemptId)}}},onRequestId(U,Y){X.commit(_.get(U.attemptId),Y)},forgetSession(U){X.clearSession(U),J.delete(U),G.delete(U),L.delete(U);for(let[Y,M]of N)if(M===U)_.delete(Y),T.delete(Y),N.delete(Y)}}}var A2="cortexkit-anthropic-auth",BX='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',QX="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",KX="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function HX(X){let J=X.authorize??ZX,_=X.exchange??GX,G=()=>{if(!X.isActive())throw Error("Claude authentication setup is closed")},L=async()=>{let F;try{F=await X.readMode()}catch{throw Error(KX)}return G(),F},T=async()=>{if(await L()!=="local")throw Error(BX)};return{integrationID:"anthropic",methods:[{method:{id:k$,type:"oauth",label:D$},async authorize(){G(),await T();let F=await J("max");return G(),{mode:"code",url:F.url,instructions:"Paste the authorization code returned by Claude.",callback:async(U)=>{G();let Y=await _(U,F.verifier,F.redirectUri,F.state);if(!X.isActive()||Y.type!=="success")throw Error("Claude sign-in did not complete");return{access:Y.access,refresh:Y.refresh,expires:Y.expires}}}}}],vault:{method:{id:w$,type:"oauth",label:"Claude vault accounts"},async activate(){if(G(),await L()!=="claustrum")throw Error(QX)}},async onLogin(F){G(),await T(),await X.runtime.loginOAuth({routeId:"main",credential:F,replace:!0}),G()},label:"Claude native account pool"}}function UX(X){return{readMode:()=>jX("opencode",X),disconnectVault:()=>WX({host:"opencode",env:X})}}function d2(X={}){return{id:A2,setup:(J)=>y$(J,X)}}async function y$(X,J={}){let _=J.paths??await VX(),G=JX({paths:_,host:"opencode",local:J.local,vault:J.vault}),L=UX(J.vault?.env??process.env),T=!0,N=A$(),F=C$(),U,Y,M,j=S$({runtime:G,paths:_,fetch:J.fetch,requestOptions:N.requestOptions,responseOptions:N.responseOptions,onRequestId:N.onRequestId,onForgetSession:N.forgetSession,onRequestPrepared:async(I)=>{try{await M?.track(I)}catch{q$.warn("cachekeep","live request tracking failed")}},resolveModelId:async(I)=>F.modelId(I.modelID),onOwnedRequest:()=>{U??=M$(G,J.fetch),Y??=F$({runtime:G,paths:_,source:j,fetch:J.fetch})}});M=H$({...J.cacheKeep,runtime:G,source:j,fetch:J.fetch,isSubagent:async(I)=>Boolean((await X.session.get({sessionID:I})).parentID)});let Q=_$({runtime:G,source:j,cacheKeepRegistry:M.registry,start:async(I,c)=>{await X.session.synthetic({sessionID:I,text:c,description:"Claude lane start",resume:!0})}}),O=[],k=await U$(X,{source:j,log:{warn:(I,c)=>q$.warn("opencode2",I,c)}},{credential:L$}).catch(async(I)=>{throw Q.close(),await M?.dispose(),await j.close(),G.close(),I}),x,l=()=>{if(x)return x;return T=!1,Q.close(),j.close(),x=(async()=>{await Promise.allSettled([k.dispose(),U?.dispose(),Y?.dispose(),M?.dispose(),...O.map((I)=>I.dispose())]),await j.close(),G.close()})(),x};try{O.push(await N.install(X)),O.push(await F.install(X)),O.push(await k2(X,HX({isActive:()=>T,readMode:L.readMode,runtime:G})));let I={host:"opencode",dispatch:Q.dispatch,readStatus:(r)=>Q.readStatus(r),readAccounts:()=>G.read(),readMode:L.readMode,disconnectVault:L.disconnectVault,interactive:!0},c=YX(I);return O.push(await b$(X,c,Q)),l}catch(I){throw await l(),I}}var xJ={id:A2,setup:d2().setup,server:I$};export{y$ as setupAnthropicAuth,xJ as default,d2 as createAnthropicAuthPlugin,A2 as ANTHROPIC_AUTH_PLUGIN_ID};

package/dist/v2/tui.js

@@ -1,2 +1,2 @@
-import{s as F}from"../index-1jkyhgyr.js";import"../index-rftced5v.js";async function V(B){let Y=B.client.rpc(F),K=!0,$=!1,L=new AbortController,O=()=>{let w=B.ui.router.current();return w.type==="session"?w.sessionID:void 0};function M(w){return new Promise((J)=>{let j="",G=!1,Q=B.keymap.mode.push("cortexkit-protected-entry"),H=(z,D=!0)=>{if(G)return;G=!0,B.renderer.keyInput.off("keypress",X),B.renderer.keyInput.off("paste",Z),L.signal.removeEventListener("abort",W),Q();let q=z?j:void 0;if(j="",D)B.ui.dialog.clear();J(q)},W=()=>H(!1),X=(z)=>{if(z.preventDefault(),z.stopPropagation(),z.name==="escape"||z.ctrl&&z.name==="c")return H(!1);if(z.name==="return"||z.name==="enter")return H(!0);if(z.name==="backspace"){j=Array.from(j).slice(0,-1).join("");return}if(!z.ctrl&&!z.meta&&!z.option&&Array.from(z.sequence).every((D)=>D.charCodeAt(0)>=32&&D.charCodeAt(0)!==127))j=(j+z.sequence).slice(0,4096)},Z=(z)=>{z.preventDefault(),z.stopPropagation(),j=(j+Array.from(new TextDecoder().decode(z.bytes)).filter((D)=>D.charCodeAt(0)>=32&&D.charCodeAt(0)!==127).join("")).slice(0,4096)};if(B.renderer.keyInput.prependListener("keypress",X),B.renderer.keyInput.prependListener("paste",Z),L.signal.addEventListener("abort",W,{once:!0}),B.ui.dialog.alert({title:w,message:"Type or paste the value. Input is hidden. Enter accepts; Escape cancels."}).then(()=>H(!1,!1),()=>H(!1,!1)),L.signal.aborted)W()})}async function P(w){let J={};for(let j of w.knobs){if(!K)return;if(j.kind==="choice"){let G=await B.ui.dialog.select({title:j.label,options:j.choices.map((Q)=>({title:Q.label,value:Q.value})),current:j.value});if(G===void 0)return;J[j.id]=G}else if(j.kind==="toggle"){let G=await B.ui.dialog.select({title:j.label,options:[{title:"On",value:!0},{title:"Off",value:!1}],current:j.value});if(G===void 0)return;J[j.id]=G}else{let G=j.kind==="text"&&j.masked?await M(j.label):await B.ui.dialog.prompt({title:j.label,value:j.value===void 0?void 0:String(j.value),placeholder:j.kind==="text"?j.placeholder:void 0});if(G===void 0)return;J[j.id]=G===""&&!j.required?null:j.kind==="number"?Number(G):G}}return J}async function C(w,J){if(!K||$||O()!==w)return;$=!0;let j=J;try{while(K&&O()===w){let G=await B.ui.dialog.select({title:j.menu.title,options:j.menu.sections.map((D)=>({title:D.title,description:D.lines.join(`
+import{t as F}from"../index-jexctf5w.js";import"../index-f2ne65w4.js";async function V(B){let Y=B.client.rpc(F),K=!0,$=!1,L=new AbortController,O=()=>{let w=B.ui.router.current();return w.type==="session"?w.sessionID:void 0};function M(w){return new Promise((J)=>{let j="",G=!1,Q=B.keymap.mode.push("cortexkit-protected-entry"),H=(z,D=!0)=>{if(G)return;G=!0,B.renderer.keyInput.off("keypress",X),B.renderer.keyInput.off("paste",Z),L.signal.removeEventListener("abort",W),Q();let q=z?j:void 0;if(j="",D)B.ui.dialog.clear();J(q)},W=()=>H(!1),X=(z)=>{if(z.preventDefault(),z.stopPropagation(),z.name==="escape"||z.ctrl&&z.name==="c")return H(!1);if(z.name==="return"||z.name==="enter")return H(!0);if(z.name==="backspace"){j=Array.from(j).slice(0,-1).join("");return}if(!z.ctrl&&!z.meta&&!z.option&&Array.from(z.sequence).every((D)=>D.charCodeAt(0)>=32&&D.charCodeAt(0)!==127))j=(j+z.sequence).slice(0,4096)},Z=(z)=>{z.preventDefault(),z.stopPropagation(),j=(j+Array.from(new TextDecoder().decode(z.bytes)).filter((D)=>D.charCodeAt(0)>=32&&D.charCodeAt(0)!==127).join("")).slice(0,4096)};if(B.renderer.keyInput.prependListener("keypress",X),B.renderer.keyInput.prependListener("paste",Z),L.signal.addEventListener("abort",W,{once:!0}),B.ui.dialog.alert({title:w,message:"Type or paste the value. Input is hidden. Enter accepts; Escape cancels."}).then(()=>H(!1,!1),()=>H(!1,!1)),L.signal.aborted)W()})}async function P(w){let J={};for(let j of w.knobs){if(!K)return;if(j.kind==="choice"){let G=await B.ui.dialog.select({title:j.label,options:j.choices.map((Q)=>({title:Q.label,value:Q.value})),current:j.value});if(G===void 0)return;J[j.id]=G}else if(j.kind==="toggle"){let G=await B.ui.dialog.select({title:j.label,options:[{title:"On",value:!0},{title:"Off",value:!1}],current:j.value});if(G===void 0)return;J[j.id]=G}else{let G=j.kind==="text"&&j.masked?await M(j.label):await B.ui.dialog.prompt({title:j.label,value:j.value===void 0?void 0:String(j.value),placeholder:j.kind==="text"?j.placeholder:void 0});if(G===void 0)return;J[j.id]=G===""&&!j.required?null:j.kind==="number"?Number(G):G}}return J}async function C(w,J){if(!K||$||O()!==w)return;$=!0;let j=J;try{while(K&&O()===w){let G=await B.ui.dialog.select({title:j.menu.title,options:j.menu.sections.map((D)=>({title:D.title,description:D.lines.join(`
 `),value:D}))});if(!G||!K||O()!==w)return;let Q=[...G.actions.map((D)=>({action:D,itemId:void 0})),...G.items.flatMap((D)=>D.actions.map((q)=>({action:q,itemId:D.id})))],H=await B.ui.dialog.select({title:G.title,options:Q.map((D)=>({title:D.action.label,description:D.action.description,value:D}))});if(!H)continue;let W=await P(H.action);if(!W||!K||O()!==w)return;let X=H.action.confirm?await B.ui.dialog.confirm({title:H.action.label,message:H.action.confirm.message}):void 0;if(H.action.confirm&&X!==!0)continue;if(!K||O()!==w)return;let Z={command:"claude",sectionId:G.id,itemId:H.itemId,actionId:H.action.id,sessionId:w,values:W,confirmed:X},z=await Y.apply(Z,{signal:L.signal,location:B.location});if(!K||O()!==w)return;await B.ui.dialog.alert({title:z.ok?"Claude":"Claude action refused",message:z.text}),j={command:z.command,menu:z.menu}}}finally{$=!1}}let R=Y.events.on("opened",(w)=>C(w.data.sessionId,w.data.payload),{signal:L.signal}),U=Y.events.on("notification",(w)=>{if(K&&O()===w.data.sessionId)B.ui.toast.show({title:"Claude",sessionID:w.data.sessionId,message:w.data.message,variant:w.data.kind})},{signal:L.signal});return B.keymap.layer(()=>({commands:[{id:"cortexkit.claude",title:"Claude",group:"Claude",palette:!0,slash:{name:"claude"},async run(){let w=O();if(!w){await B.ui.dialog.alert({title:"Claude",message:"Open a session before using the Claude menu."});return}let J=await Y.open({sessionId:w},{signal:L.signal,location:B.location});await C(w,J)}}]})),()=>{K=!1,L.abort(),R(),U()}}var T={id:"cortexkit-anthropic-auth",setup:V};export{V as setupAnthropicTui,T as default};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/opencode-anthropic-auth",
-  "version": "2.0.3",
+  "version": "2.1.1",
   "type": "module",
   "repository": {
     "type": "git",
@@ -53,7 +53,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "build": "rm -rf dist && bun build src/index.ts src/v2/server.ts src/v2/tui.ts src/cli.ts src/sidebar-state.ts src/tui-preferences.ts src/rpc/rpc-client.ts src/rpc/port-file.ts src/rpc/protocol.ts src/rpc/rpc-dir.ts --outdir dist --root src --target node --format esm --splitting --external @opencode-ai/plugin --external @opencode/plugin --external jsonc-parser --minify && tsc -p tsconfig.build.json --emitDeclarationOnly && bun run build:tui && bun run check:bundle",
+    "build": "rm -rf dist && bun build src/index.ts src/v2/server.ts src/v2/tui.ts src/cli.ts src/sidebar-state.ts src/tui-preferences.ts src/rpc/rpc-client.ts src/rpc/port-file.ts src/rpc/protocol.ts src/rpc/rpc-dir.ts --outdir dist --root src --target node --format esm --splitting --external @opencode-ai/plugin --external @opencode/plugin --external @cortexkit/anthropic-auth-core --external @cortexkit/private-files --external @cortexkit/claustrum-client --external @cortexkit/subc-client --external xxhash-wasm --external jsonc-parser --minify && tsc -p tsconfig.build.json --emitDeclarationOnly && bun run build:tui && bun run check:bundle",
     "build:tui": "bun scripts/build-tui.ts",
     "smoke:tui": "bun scripts/smoke-tui-pack-install.ts",
     "check:bundle": "bun scripts/check-bundle-globals.ts",
@@ -77,11 +77,15 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.6.0",
-    "@cortexkit/anthropic-auth-core": "2.0.3",
-    "@opentui/core": "0.6.0",
-    "@opentui/solid": "0.6.0",
+    "@cortexkit/anthropic-auth-core": "2.1.1",
+    "@cortexkit/claustrum-client": "0.12.0",
+    "@cortexkit/private-files": "0.2.1",
+    "@cortexkit/subc-client": "^0.22.0",
+    "@opentui/core": "0.6.5",
+    "@opentui/solid": "0.6.5",
     "jsonc-parser": "^3.3.1",
-    "solid-js": "1.9.12"
+    "solid-js": "1.9.12",
+    "xxhash-wasm": "^1.1.0"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "4.0.77",