@cortexkit/opencode-anthropic-auth 2.3.0 → 2.4.1

package/dist/sidebar-state.js

@@ -1 +1 @@
-import{$ as u,H as a,I as b,J as c,K as d,L as e,M as f,N as g,O as h,P as i,Q as j,R as k,S as l,T as m,U as n,V as o,W as p,X as q,Y as r,Z as s,_ as t,aa as v,ba as w,ca as x,da as y,ea as z,fa as A}from"./index-46e2gk3c.js";import"./index-71temqvq.js";export{i as setSidebarState,r as scopedQuotaShortNames,k as resolveActiveAccount,s as quotaLabelColumnWidth,c as normalizeSidebarState,a as getSidebarStateFile,h as getSidebarState,f as getInitialSidebarRoutingTestHooks,p as getFableRecoverySummary,w as getCollapsedQuotaSummary,x as getCollapsedAccounts,q as formatQuotaRowLabel,m as formatPrimeTime,n as formatPrimeCost,o as formatPrimeAccountValue,l as formatFallbackModelLabel,u as fitQuotaRow,v as fitPaceLine,j as drainSidebarWrites,A as computeQuotaPacing,d as __setSidebarStateWriteTestHooks,e as __setInitialSidebarRoutingTestHooks,g as __acquireSidebarStateLockForTest,z as SEVEN_DAY_MS,t as QUOTA_BAR_MIN_CELLS,y as FIVE_HOUR_MS,b as DEFAULT_SIDEBAR_STATE};
+import{$ as u,H as a,I as b,J as c,K as d,L as e,M as f,N as g,O as h,P as i,Q as j,R as k,S as l,T as m,U as n,V as o,W as p,X as q,Y as r,Z as s,_ as t,aa as v,ba as w,ca as x,da as y,ea as z,fa as A}from"./index-12km9x91.js";import"./index-71temqvq.js";export{i as setSidebarState,r as scopedQuotaShortNames,k as resolveActiveAccount,s as quotaLabelColumnWidth,c as normalizeSidebarState,a as getSidebarStateFile,h as getSidebarState,f as getInitialSidebarRoutingTestHooks,p as getFableRecoverySummary,w as getCollapsedQuotaSummary,x as getCollapsedAccounts,q as formatQuotaRowLabel,m as formatPrimeTime,n as formatPrimeCost,o as formatPrimeAccountValue,l as formatFallbackModelLabel,u as fitQuotaRow,v as fitPaceLine,j as drainSidebarWrites,A as computeQuotaPacing,d as __setSidebarStateWriteTestHooks,e as __setInitialSidebarRoutingTestHooks,g as __acquireSidebarStateLockForTest,z as SEVEN_DAY_MS,t as QUOTA_BAR_MIN_CELLS,y as FIVE_HOUR_MS,b as DEFAULT_SIDEBAR_STATE};

package/dist/transform.d.ts

@@ -99,6 +99,7 @@ export declare function rewriteRequestBody(body: string, options?: {
     midConversationEffortEnabled?: boolean;
     midConversationEffortPlan?: string;
     midConversationEffortResolvedPlan?: OpenCodeEffortMarkerPlan;
+    midConversationEffortPlanVersions?: readonly OpenCodeEffortMarkerPlan[];
     turnEndNoteEnabled?: boolean;
     turnEndNote?: {
         tools: string[];

package/dist/v2/adapter.d.ts

@@ -1,4 +1,4 @@
-import { AnthropicOAuthOriginError, type ClaudeCodeIdentity, type RequestGzipLatch, TrailingAssistantHistoryError } from '@cortexkit/anthropic-auth-core';
+import { AnthropicOAuthOriginError, type ClaudeCodeIdentity, type HolderRegistrationError, type RelocatedError, type RequestGzipLatch, TrailingAssistantHistoryError } from '@cortexkit/anthropic-auth-core';
 import type { AccountRequest, AttemptOutcome, ChooseAccountInput, ChooseAccountResult, HeaderEdits, HostError, LimitSignal, OpenCode2AuthAdapter, RequestScope, Transport } from '@cortexkit/common-auth/opencode2';
 import { EffortMarkerCorrelationError } from '../effort-history';
 import { createStrippedStream, rewriteRequestBody } from '../transform';
@@ -198,6 +198,14 @@ export interface NativeAnthropicSource<Q, P> {
      * 401 can be reported against the exact vault receipt version served.
      */
     readonly onAttemptEnd?: (input: NativeAnthropicAttemptContext<P>, outcome: NativeAnthropicAttemptOutcome) => Promise<void> | void;
+    /**
+     * Whether request dumps are enabled in the current custody mode's settings.
+     * The adapter consults this before writing any dump, so a stale global flag
+     * from another host mode never decides. Sources backed by the native runtime
+     * read `dump.enabled` from the current snapshot; synthetic test sources may
+     * omit it, in which case the adapter falls back to the Core global flag.
+     */
+    readonly isDumpEnabled?: () => Promise<boolean> | boolean;
     /**
      * Called by the adapter's `forgetSession`; drops whatever the source keeps
      * for the session.
@@ -292,5 +300,17 @@ export declare class NativeAnthropicLocalRefusal extends Error {
     readonly check: string;
     constructor(cause: TrailingAssistantHistoryError | EffortMarkerCorrelationError | AnthropicOAuthOriginError);
 }
+/**
+ * The request was refused because a newer anthropic-auth version moved the
+ * account state files this process uses, or because this process could not
+ * record its use of a folder it may only use once recorded. Nothing was
+ * sent. The message is Core's fixed text and names no path; the plugin log
+ * names the folders.
+ */
+export declare class NativeAnthropicStateRefusal extends Error {
+    readonly kind = "state-relocated";
+    readonly providerID = "anthropic";
+    constructor(cause: RelocatedError | HolderRegistrationError);
+}
 export declare function createNativeAnthropicAdapter<Q, P>(deps: NativeAnthropicAdapterDeps<Q, P>): NativeAnthropicAdapter<Q, P>;
 export {};

package/dist/v2/cachekeep.d.ts

@@ -6,10 +6,19 @@ export interface NativeCacheKeepOptions {
     readonly clearIntervalImpl?: typeof globalThis.clearInterval;
     readonly registryDirectory?: string;
 }
-/** Keep admitted hybrid-cache prefixes warm using fresh native authorization for each send. */
+/**
+ * Keep admitted hybrid-cache prefixes warm using fresh native authorization for
+ * each send. Instances for the same account storage share one set of tracked
+ * sessions: a later instance takes over sending for sessions an earlier one
+ * tracked, and the timer stops only when the last instance is disposed. The
+ * sessions themselves outlive the last instance until their cache expires, so
+ * an instance that boots for the same storage in that time adopts them.
+ */
 export declare function createNativeCacheKeep(options: NativeCacheKeepOptions & {
     runtime: NativeAccountRuntime;
     source: NativeSource;
+    /** Identity of the account storage; instances that share it share sessions. */
+    storageId: string;
     fetch?: typeof fetch;
     isSubagent?: (sessionID: string) => Promise<boolean>;
 }): {

package/dist/v2/server.js

@@ -1,13 +1,13 @@
-import{a as f2,b as e$,c as X1,d as F$,e as L$,f as g2,g as k2,h as C$,i as P$,j as T$,k as Z1,l as E$,m as O$,n as S$,o as R$,p as x$,q as W1}from"../index-2jsr8wvj.js";import"../index-sg0knfec.js";import"../index-c8ehrd0p.js";import{v as V1}from"../index-dpnhamzw.js";import{w as v2,x as m2,z as G1}from"../index-m4dazzyf.js";import"../index-naff9h33.js";import{J as u$}from"../index-46e2gk3c.js";import"../index-bcp23wwb.js";import"../index-71temqvq.js";import{acquireNativeAccountRuntime as iX,authorize as oX,createNativeUi as nX,disconnectNativeVaultForHost as rX,exchange as sX,logger as Y1,readNativeEnrollmentMode as aX,resolveNativePoolPaths as tX}from"@cortexkit/anthropic-auth-core";class T2 extends Error{kind;providerID;sessionID;requestKind;constructor(X){super(X.message??`${X.providerID} ${X.requestKind} request refused (${X.kind})`);this.name="OpenCode2AuthError",this.kind=X.kind,this.providerID=X.providerID,this.sessionID=X.sessionID,this.requestKind=X.requestKind}}function M2(X){return`common-auth-placeholder.${X}`}function Q$(X){let Z=M2(X.integrationID);return{type:"oauth",methodID:X.methodID,access:Z,refresh:Z,expires:X.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function i2(X,Z){if(X?.type!=="oauth")return!1;let z=Z===void 0?void 0:M2(Z),W=(N)=>z===void 0?N.startsWith("common-auth-placeholder."):N===z;return W(X.access)&&W(X.refresh)}var B$="No browser sign-in: this connects the plugin to the accounts in its vault.";async function o2(X,Z){let z=Z.now??Date.now,{integrationID:W}=Z,N=(P)=>Q$({integrationID:W,methodID:P,now:z()}),L=async(P,M)=>{return await Z.onLogin(P,{integrationID:W,methodID:M}),N(M)},C=(P)=>async(M)=>{let Y=P.method.id,U=await P.authorize(M),B={url:U.url,instructions:U.instructions,...U.expiresAt===void 0?{}:{expiresAt:U.expiresAt}};if(U.mode==="auto")return{...B,mode:"auto",callback:U.callback.then((E)=>L(E,Y))};let K=U.callback;return{...B,mode:"code",callback:async(E)=>L(await K(E),Y)}};return X.integration.transform((P)=>{let M=Z.label===void 0?{}:{label:()=>Z.label};for(let B of Z.methods)P.method.update({integrationID:W,method:B.method,authorize:C(B),refresh:async(K)=>{if(!i2(K,W))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return N(K.methodID)},...M});let Y=Z.vault;if(Y===void 0)return;let U=Y.method.id;P.method.update({integrationID:W,method:Y.method,authorize:async()=>({url:"",instructions:Y.instructions??B$,mode:"auto",callback:Promise.resolve().then(()=>Y.activate({integrationID:W,methodID:U})).then(()=>N(U))}),refresh:async(B)=>{if(!i2(B,W)||B.methodID!==U)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return N(U)},...M})})}function U1(X){let Z=[],z;for(let W of X.split(/\r?\n/))if(W.startsWith("data:"))Z.push(W.slice(5).replace(/^ /,""));else if(W.startsWith("event:"))z=W.slice(6).trim();if(Z.length===0)return;return z===void 0?{data:Z.join(`
+import{a as d2,b as B1,c as z1,d as R$,e as S$,f as p2,g as A2,h as q$,i as A$,j as x$,k as K1,l as k$,m as b$,n as w$,o as D$,p as J$,q as F1}from"../index-xarkyfqd.js";import"../index-sg0knfec.js";import"../index-hc7bm3yf.js";import{v as N1}from"../index-a1k6z503.js";import{w as c2,x as i2,z as _1}from"../index-m4dazzyf.js";import"../index-naff9h33.js";import{J as e$}from"../index-12km9x91.js";import"../index-gvswxab8.js";import"../index-71temqvq.js";import{acquireNativeAccountRuntime as jZ,authorize as QZ,createNativeUi as WZ,disconnectNativeVaultForHost as BZ,exchange as UZ,isDumpPersistentlyEnabled as zZ,logger as H1,openCodeHolderKind as KZ,readNativeEnrollmentMode as MZ,registerNativePoolHolder as HZ,resolveNativePoolPaths as _Z,setDumpEnabled as NZ}from"@cortexkit/anthropic-auth-core";class x2 extends Error{kind;providerID;sessionID;requestKind;constructor(X){super(X.message??`${X.providerID} ${X.requestKind} request refused (${X.kind})`);this.name="OpenCode2AuthError",this.kind=X.kind,this.providerID=X.providerID,this.sessionID=X.sessionID,this.requestKind=X.requestKind}}function O2(X){return`common-auth-placeholder.${X}`}function K$(X){let Z=O2(X.integrationID);return{type:"oauth",methodID:X.methodID,access:Z,refresh:Z,expires:X.now+31536000000,metadata:{["commonAuthPlaceholder"]:!0}}}function t2(X,Z){if(X?.type!=="oauth")return!1;let z=Z===void 0?void 0:O2(Z),W=(F)=>z===void 0?F.startsWith("common-auth-placeholder."):F===z;return W(X.access)&&W(X.refresh)}var M$="No browser sign-in: this connects the plugin to the accounts in its vault.";async function e2(X,Z){let z=Z.now??Date.now,{integrationID:W}=Z,F=(T)=>K$({integrationID:W,methodID:T,now:z()}),L=async(T,K)=>{return await Z.onLogin(T,{integrationID:W,methodID:K}),F(K)},C=(T)=>async(K)=>{let Y=T.method.id,U=await T.authorize(K),H={url:U.url,instructions:U.instructions,...U.expiresAt===void 0?{}:{expiresAt:U.expiresAt}};if(U.mode==="auto")return{...H,mode:"auto",callback:U.callback.then((P)=>L(P,Y))};let V=U.callback;return{...H,mode:"code",callback:async(P)=>L(await V(P),Y)}};return X.integration.transform((T)=>{let K=Z.label===void 0?{}:{label:()=>Z.label};for(let H of Z.methods)T.method.update({integrationID:W,method:H.method,authorize:C(H),refresh:async(V)=>{if(!t2(V,W))throw Error("This login method refreshes only its pool placeholder; sign in again with the plugin's login method.");return F(V.methodID)},...K});let Y=Z.vault;if(Y===void 0)return;let U=Y.method.id;T.method.update({integrationID:W,method:Y.method,authorize:async()=>({url:"",instructions:Y.instructions??M$,mode:"auto",callback:Promise.resolve().then(()=>Y.activate({integrationID:W,methodID:U})).then(()=>F(U))}),refresh:async(H)=>{if(!t2(H,W)||H.methodID!==U)throw Error("This login method refreshes only its vault placeholder; choose the plugin's vault login method again.");return F(U)},...K})})}function T1(X){let Z=[],z;for(let W of X.split(/\r?\n/))if(W.startsWith("data:"))Z.push(W.slice(5).replace(/^ /,""));else if(W.startsWith("event:"))z=W.slice(6).trim();if(Z.length===0)return;return z===void 0?{data:Z.join(`
 `)}:{event:z,data:Z.join(`
-`)}}function n2(X,Z){let z=new TextDecoder,W="",N=(C)=>{let P=U1(C);if(!P)return;try{X(P)}catch(M){Z(M)}},L=()=>{for(;;){let C=/\r?\n\r?\n/.exec(W);if(!C)return;let P=W.slice(0,C.index);W=W.slice(C.index+C[0].length),N(P)}};return new TransformStream({transform(C,P){P.enqueue(C),W+=z.decode(C,{stream:!0}),L()},flush(){if(W+=z.decode(),L(),W.trim()!=="")N(W);W=""}})}var U$=512,H$=1200000,E2="x-common-auth-attempt",C2=(X,Z)=>JSON.stringify([X,Z]),V2=(X)=>({providerID:X.model.providerID,modelID:X.model.id,sessionID:X.sessionID,agent:X.agent,kind:X.kind});function H1(X){let Z=X.headers;return typeof Z==="object"&&Z!==null}function K1(X,Z){let z=X.getReader();return new ReadableStream({async pull(W){let N;try{N=await z.read()}catch(L){Z({reason:"failed",message:L instanceof Error?L.message:String(L)}),W.error(L);return}if(N.done)Z(),W.close();else W.enqueue(N.value)},async cancel(W){Z({reason:"cancelled",...W===void 0?{}:{message:String(W)}}),await z.cancel(W)}})}function y2(X,Z){for(let[z,W]of Object.entries(Z)){let N=z.toLowerCase();for(let L of Object.keys(X))if(L.toLowerCase()===N)delete X[L];if(W!==null)X[z]=W}}function M1(X,Z){for(let[z,W]of Object.entries(Z))if(W===null)X.delete(z);else X.set(z,W)}async function r2(X,Z,z={}){let{providerID:W}=Z,N=z.gateOnPlaceholder,L=($)=>N===void 0||N.credential($)===M2(W),C=z.logger,P=Math.max(1,z.maxRecords??U$),M=[...z.hostCredentials??[M2(W)],...N?[M2(W)]:[]].filter(($)=>$!==""),Y=new Map,U=new WeakMap,B=new Map,K=0,E=new Set,k=new Map,A=new Map,h=($)=>{let j=A.get($);return j?.ownedSeen===!0&&j.foreignSeen},y=($,j)=>{k.set($,j);let _=A.get($)??{ownedSeen:!1,foreignSeen:!1};if(j)_.ownedSeen=!0;else _.foreignSeen=!0;A.set($,_)},c=($,j)=>{let _=N?.refuseMisplaced,S=_?[...j].filter(([,m])=>m.includes(M2(W))):[],T=L(j)&&(!_||S.length>0);if(_){if(S.length>0&&(S.length!==1||!T))throw y($.sessionID,!1),new T2({kind:"placement-refused",providerID:W,sessionID:$.sessionID,requestKind:$.kind,message:_(S[0]?.[0]??"")})}return y($.sessionID,T),T},s=!1,t=!1,a=new Map,J=0,Q=!1,V=new Map,R=($,j)=>{try{C?.warn($,j)}catch{}},O=($)=>$ instanceof Error?$.message:String($),b=new Map,I=($,j)=>{let _=(b.get($)??Promise.resolve()).then(j),S=_.then(()=>{},()=>{});return b.set($,S),S.then(()=>{if(b.get($)===S)b.delete($)}),_},d=($,j)=>{let _=b.get($);return _?_.then(()=>d($,j)):j()},l=async($)=>{try{await Z.dropChoice?.({...$.input,accountId:$.accountId})}catch(j){R("opencode2 auth dropChoice threw; the request is unaffected",{sessionID:$.input.sessionID,error:O(j)})}},r=($)=>{let j=B.get($);if(B.delete($),j?.next){let _=j.next;I(j.sessionID,()=>l(_))}},v=async($,j)=>{let _=a.get($);if(!_||_.size===0)return;await Promise.all([..._].map(async(S)=>{try{await S(j)}catch(T){R("opencode2 auth listener threw; the request is unaffected",{event:$,error:O(T)})}}))},i=async($,j)=>{try{await Z.onAttemptEnd?.($,j)}catch(_){R("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:$.attemptId,error:O(_)})}},G=($,j)=>{if($.ended||!$.attempt)return;let _={...$.status===void 0?{}:{status:$.status},outputStarted:$.outputStarted,...$.limit?{limit:$.limit.signal}:{},...j?{error:j}:{}};if(j)$.endError=j;$.ended=i($.attempt,_)},H=($,j)=>G($,{reason:"abandoned",message:j}),F=($)=>[...Y.values()].filter((j)=>j.key===$),x=($)=>F($).at(-1),q=($)=>{if(Y.delete($.id),B.get($.key)?.attemptId===$.id||!F($.key).length)r($.key)},w=($)=>{Y.set($.id,$);while(Y.size>P){let j=Y.values().next().value;if(j===void 0)break;H(j,"dropped to keep the record bound"),q(j)}},f=($)=>$.accountId===void 0?void 0:{...$.scope,accountId:$.accountId},p=($,j)=>new T2({kind:"no-account",providerID:W,sessionID:$.sessionID,requestKind:$.kind,...j===void 0?{}:{message:j}}),u=($)=>{V.get($)?.clear(),V.delete($)},Z2=async($,j)=>{let _=()=>p($,`${W} ${$.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(Q)throw _();let S=V.get($.sessionID);if(!S)S=new Set,V.set($.sessionID,S);let T={};S.add(T);let m=()=>{if(!S.has(T))throw _()};try{return await j(m)}finally{if(S.delete(T),S.size===0&&V.get($.sessionID)===S)V.delete($.sessionID)}},J2=($,j)=>{for(let[_,S]of j)if(M.some((T)=>S.includes(T)))throw new T2({kind:"host-credential-on-wire",providerID:W,sessionID:$.sessionID,requestKind:$.kind,message:`${W} ${$.kind} request still carries the host's placeholder credential in ${_}; the adapter's account headers must replace it`})},Y2=($)=>{for(let j of F($))if(j.ended||!j.attempt)q(j);else if(j.transport==="ws"||j.judged)H(j,"a newer attempt of its session and kind began"),q(j)},B2=async($,j,_,S)=>{let T=C2($.sessionID,$.kind),{input:m,accountId:D}=await d($.sessionID,async()=>{_();let e=B.get(T);B.delete(T);let j2=e?.accountId??x(T)?.accountId;Y2(T);let W2=e?.next,X2=W2!==void 0&&W2.input.modelID===$.modelID&&W2.input.agent===$.agent,x2={...$,phase:"request",...j2===void 0?{}:{previousAccountId:j2},...e?.rerouteFrom?{rerouteFrom:e.rerouteFrom}:{}};if(W2&&!X2)await I($.sessionID,()=>l(W2)),_();let K2=X2?W2.accountId:await Z.chooseAccount(x2);return{input:x2,accountId:typeof K2==="string"?K2:void 0}});_();let g={},n;if(D!==void 0){let e=await Z.accountHeaders({...$,accountId:D});if(_(),H1(e))g=e.headers,n=e.attempt;else g=e}let F2=`attempt-${++J}`,G2={id:F2,key:T,scope:$,accountId:D,headers:g,attempt:D===void 0?void 0:{...$,accountId:D,attemptId:F2,transport:S,data:n},...S===void 0?{}:{transport:S},outputStarted:!1};if(w(G2),G2.attempt)v("select",{...$,accountId:G2.attempt.accountId,hook:j,...m.previousAccountId===void 0?{}:{previousAccountId:m.previousAccountId},...m.rerouteFrom===void 0?{}:{rerouteFrom:m.rerouteFrom},handle:G2.attempt});return G2},$2=async($,j,_,S,T)=>{let m=C2($.sessionID,$.kind),D=S===void 0?void 0:Y.get(S);if(D?.key!==m)D=void 0;if(!D){if(D=x(m),F(m).filter((n)=>n.transport===void 0&&!n.ended).length>1&&!t)t=!0,R("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:$.sessionID,kind:$.kind})}if(!D||D.transport!==void 0||D.ended)D=await B2($,j,T,_);else if(D.transport=_,D.attempt)D.attempt.transport=_;if(_==="ws"){for(let g of F(m))if(g!==D&&g.transport==="ws")H(g,"a newer attempt of its session and kind went out over WebSocket")}return D},o=async($,j)=>{try{return await j()}catch(_){throw G($,{reason:"failed",message:O(_)}),_}},U2=($,j)=>{let _=F(C2($,j)).filter((S)=>S.transport==="ws").at(-1);return _?.attempt!==void 0&&!_.ended?_:void 0},Q2=($,j,_)=>{let S=f($);if(!S||!$.attempt||$.limit)return;$.limit={signal:j,delivered:v("limit",{...S,via:_,limit:j,outputStarted:$.outputStarted,handle:$.attempt})}},z2=($,j,_,S)=>{let T=f($);if(!T||!$.attempt)return;v("quota",{...T,transport:j,...S===void 0?{}:{status:S},quota:_,handle:$.attempt})},R2=($,j,_,S)=>{let T=$.attempt;if(!T)return;let m=Z.inspectEvent?.(S===void 0?{transport:j,data:_,attempt:T}:{transport:j,data:_,event:S,attempt:T});if(!m)return;if(m.quota!==void 0)z2($,j,m.quota);if(m.outputStarted)$.outputStarted=!0;if(m.limit)Q2($,m.limit,j);if(m.error!==void 0)G($,{reason:"failed",message:m.error});else if(m.done)G($)},_2=($,j)=>{let _=$.attempt;if(!_||j.accountId===$.accountId)return;if(_.reboundFrom??=_.accountId,_.accountId=j.accountId,"data"in j)_.data=j.data;$.accountId=j.accountId},Q1=($)=>!$.attempt||$.endError!==void 0||$.status!==void 0&&$.status>=400,B1=($)=>{let j=[...Y.values()].filter((g)=>g.scope.sessionID===$),_=j.filter((g)=>g.limit&&!g.rerouted).at(-1);if(_)return _;let S=j.filter((g)=>g.scope.kind==="primary"),T=S.length>0?S:j;if(T.length<=1)return T[0];let m=T.filter((g)=>!g.judged&&Q1(g)).at(-1);if(m)return m;let D=T.filter((g)=>g.attempt&&!g.ended);if(D.length>1)return"ambiguous";return D[0]??T.at(-1)},N2={providerID:W},H2=[];H2.push(await X.session.hook("model.request",($)=>{if(N)return;return Z2(V2($),async(j)=>{let _=await B2(V2($),"model.request",j);if(j(),_.accountId===void 0)throw p(_.scope);y2($.headers,{..._.headers,[E2]:_.id})})},N2)),H2.push(await X.session.hook("http.request",($)=>{if(N){if(!c(V2($),$.request.headers))return}return Z2(V2($),async(j)=>{let _=$.request.headers.get(E2)??void 0,S=N?await B2(V2($),"http.request",j,"http"):await $2(V2($),"http.request","http",_,j);j();let T=f(S),m=S.attempt;if(!T||!m)throw p(S.scope);await o(S,async()=>{let D=$.request;if(Z.rewriteRequest){if(_!==void 0){let F2=new Headers(D.headers);F2.delete(E2),D=new Request(D,{headers:F2})}D=await Z.rewriteRequest({...T,request:D,attempt:m})??D,j()}let g=new Headers(D.headers);g.delete(E2),M1(g,S.headers),J2(S.scope,g.entries());let n=new Request(D,{headers:g});U.set(n,S),$.request=n})})},N2)),H2.push(await X.session.hook("http.response",async($)=>{let j=U.get($.request);if(!j){if(N)return;if(!s)s=!0,R("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:$.sessionID,kind:$.kind});return}let _=$.response;if(Z.answeredBy&&j.attempt){let g=j.attempt,n=await o(j,async()=>Z.answeredBy?.({request:$.request,response:_,attempt:g}));if(n)_2(j,n)}let S=f(j),T=j.attempt;if(!S||!T)return;j.status=_.status;let m=Z.quotaFromHeaders?.(_.headers,_.status,T);if(m!==void 0)z2(j,"http",m,_.status);if(!_.ok&&Z.limitFromResponse){let g=await Z.limitFromResponse({status:_.status,headers:_.headers,body:()=>_.clone().text(),attempt:T});if(g)Q2(j,g,"http")}if(!_.ok||!_.body)G(j);let D=_;if(_.body&&(Z.inspectEvent||Z.onAttemptEnd)){let g=_.body;if(Z.inspectEvent)g=g.pipeThrough(n2((n)=>R2(j,"http",n.data,n.event),(n)=>R("opencode2 auth event inspection threw",{error:O(n)})));D=new Response(K1(g,(n)=>G(j,n)),{status:_.status,statusText:_.statusText,headers:_.headers})}if(Z.rewriteResponse)D=await Z.rewriteResponse({...S,request:$.request,response:D,attempt:T})??D;if(D!==_)$.response=D},N2)),H2.push(await X.session.hook("experimental.ws.handshake",($)=>{if(N){let j=C2($.sessionID,$.kind);if(E.delete(j),!c(V2($),new Headers($.headers)))return}return Z2(V2($),async(j)=>{let _;for(let D of Object.keys($.headers)){if(D.toLowerCase()!==E2)continue;_??=$.headers[D],delete $.headers[D]}let S=N?await B2(V2($),"experimental.ws.handshake",j,"ws"):await $2(V2($),"experimental.ws.handshake","ws",_,j);j();let T=f(S),m=S.attempt;if(!T||!m)throw p(S.scope);await o(S,async()=>{if(!N?.refuseMisplaced)y2($.headers,S.headers);let D=Z.rewriteHandshakeURL?.({...T,url:$.url,attempt:m});if(D!==void 0)$.url=D;if(N?.refuseMisplaced)y2($.headers,S.headers);if(J2(S.scope,Object.entries($.headers)),N)E.add(S.key)})})},N2));let V$=Z.rewriteWebSocketFrame?.bind(Z);if(V$)H2.push(await X.session.hook("experimental.ws.send",async($)=>{let j=V2($);if(N&&!E.has(C2(j.sessionID,j.kind)))return;let _=U2(j.sessionID,j.kind),S=await V$({...j,attempt:_?.attempt,frame:$.frame});if(S!==void 0)$.frame=S},N2));H2.push(await X.session.hook("experimental.ws.receive",($)=>{if(N&&!E.has(C2($.sessionID,$.kind)))return;let j=U2($.sessionID,$.kind);if(!j)return;try{R2(j,"ws",$.frame)}catch(_){R("opencode2 auth frame inspection threw",{error:O(_)})}},N2)),H2.push(await X.session.hook("retry",async($)=>{if(N&&k.get($.sessionID)!==!0)return;let j=$.decision,_=()=>v("retry",{sessionID:$.sessionID,attempt:$.attempt,reason:"host-decides",hostDecision:j,decision:j});if(h($.sessionID)){await _();return}let S=B1($.sessionID);if(!S)return;if(S==="ambiguous"){await v("retry",{sessionID:$.sessionID,attempt:$.attempt,reason:"host-decides",hostDecision:j,decision:j});return}let T=S;await Z2(T.scope,async(m)=>{let D=m;if(h($.sessionID)){await _();return}T.judged=!0;let g=T.attempt;if(g&&!T.outputStarted){if(!T.limit){let G2=Z.limitFromError?.($.error,g);if(G2)Q2(T,G2,"error")}if(T.ended)await T.ended;if(T.limit)await T.limit.delivered}D();let{decision:n,reason:F2}=await I(T.scope.sessionID,async()=>{if(D(),h($.sessionID))return{decision:j,reason:"host-decides"};let G2=B.get(T.key);if(B.delete(T.key),G2?.next)await l(G2.next);if(D(),h($.sessionID))return{decision:j,reason:"host-decides"};let e=j,j2,W2,X2;if(T.accountId===void 0||!g)e={retry:!1},j2="no-account";else if(T.outputStarted)e={retry:!1},j2="output-started";else if(T.limit){let x2={accountId:T.accountId,limit:T.limit.signal},K2,p2={...T.scope,phase:"retry",previousAccountId:T.accountId,rerouteFrom:x2};try{K2=await Z.chooseAccount(p2)}catch(c2){R("opencode2 auth chooseAccount threw while the retry hook looked for another account; the host decides the retry",{sessionID:T.scope.sessionID,error:O(c2)})}let L2=typeof K2==="object"?K2.hold:void 0,w2=typeof K2==="string"?K2:L2?T.accountId:void 0;if(w2!==void 0)X2={accountId:w2,input:p2};try{D()}catch(c2){if(X2)await l(X2);throw c2}if(h($.sessionID)){if(X2)await l(X2);return{decision:j,reason:"host-decides"}}if(L2&&Number.isFinite(L2.delayMs)&&L2.delayMs>=0)e={retry:!0,delay:Math.min(L2.delayMs,H$)},j2="hold";else if(!L2&&w2!==void 0&&w2!==T.accountId)T.rerouted=!0,W2=x2,e={retry:!0,delay:0},j2="reroute";else{if(L2&&X2)await l(X2),X2=void 0;j2="host-decides-last-account"}}else j2="host-decides";if($.decision=e,e.retry&&T.accountId!==void 0&&Y.has(T.id))B.set(T.key,{attemptId:T.id,sessionID:T.scope.sessionID,order:++K,accountId:T.accountId,...W2===void 0?{}:{rerouteFrom:W2},...X2===void 0?{}:{next:X2}});else if(X2)await l(X2);return{decision:e,reason:j2}});D(),await v("retry",{sessionID:$.sessionID,...T.accountId===void 0?{}:{accountId:T.accountId},kind:T.scope.kind,attempt:$.attempt,reason:F2,hostDecision:j,decision:n,...g===void 0?{}:{handle:g}})})},N2));let j$=($)=>{if(u($),k.delete($),!A.get($)?.foreignSeen)A.delete($);for(let j of E)if(JSON.parse(j)[0]===$)E.delete(j);for(let j of[...Y.values()]){if(j.scope.sessionID!==$)continue;H(j,"its session was forgotten"),Y.delete(j.id)}for(let[j,_]of B)if(_.sessionID===$)r(j)},u2=new AbortController,W$=X.event;if(W$)(async()=>{try{for await(let $ of W$.subscribe({signal:u2.signal}))if($.type==="session.deleted")j$($.data.sessionID);else if($.type==="session.status"&&$.data.status.type==="idle"){let j=$.data.sessionID,_=++K;I(j,async()=>{for(let[S,T]of B)if(T.sessionID===j&&T.order<_){if(B.delete(S),T.next)await l(T.next)}})}}catch($){if(!u2.signal.aborted)R("opencode2 auth stopped listening for session deletion",{error:O($)})}})();return{on($,j){let _=a.get($);if(!_)_=new Set,a.set($,_);let S=j;return _.add(S),()=>{_.delete(S)}},accountFor($,j){return x(C2($,j))?.accountId},forgetSession:j$,get size(){return Y.size},async dispose(){if(Q)return;Q=!0;for(let $ of V.keys())u($);u2.abort();for(let $ of Y.values())H($,"the installation was disposed");Y.clear();for(let $ of B.keys())r($);E.clear(),k.clear(),A.clear(),a.clear(),await Promise.all(b.values()),await Promise.all(H2.map(async($)=>{try{await $.dispose()}catch(j){R("opencode2 auth hook did not dispose cleanly",{error:O(j)})}}))}}}import{CacheKeepManager as l1,CacheKeepSessionRegistry as d1,getDefaultCacheKeepRegistryDirectory as u1,isCacheKeepActiveNow as b$,isCacheKeepHybridActive as t2,isCacheKeepSubagentsEnabled as e2,logger as p1}from"@cortexkit/anthropic-auth-core";import{createHash as z1}from"node:crypto";import{AnthropicOAuthOriginError as _1,applyCustomHeaders as N1,assertNotCustodyTombstone as F1,classifyGzipRejection as L1,createProviderErrorRedactor as K$,createProviderErrorResponseScope as M$,decideRequestGzip as C1,encodeGzipRequestBody as P1,getAccountStoragePath as T1,getRequestGzipLatch as E1,getRequestGzipLatchPath as O1,mergeAnthropicBetas as S1,remapModelId as z$,remapRequestBodyModel as R1,stripEmptyTrailingAssistantMessages as x1,TrailingAssistantHistoryError as A1}from"@cortexkit/anthropic-auth-core";var q2="anthropic",A$="x-common-auth-attempt",q1=["x-session-affinity","x-opencode-session","x-parent-session-id",F$,f2,k2,A$],I2=new Set(["authorization","x-api-key"]),k1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",b1=512,D1=5000,w1=500,_$=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class q$ extends Error{sessionID;requestKind;kind="no-account";providerID=q2;constructor(X,Z){super(k1);this.sessionID=X;this.requestKind=Z;this.name="NativeAnthropicNoAccountError"}}class a2 extends Error{sessionID;requestKind;kind="session-forgotten";providerID=q2;constructor(X,Z){super("request refused: its session was closed while it was being prepared");this.sessionID=X;this.requestKind=Z;this.name="NativeAnthropicRevokedError"}}class O2 extends Error{kind="unsupported-transport";providerID=q2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class k$ extends Error{kind="local-invalid-request";status=400;check;constructor(X){super(X.message,{cause:X});this.name="NativeAnthropicLocalRefusal",this.check=X.check}}var P2=(X)=>typeof X==="object"&&X!==null&&!Array.isArray(X);function A2(X){try{return JSON.parse(X)}catch{return}}function s2(X){let Z={};for(let[z,W]of Object.entries(X??{}))Z[z.toLowerCase()]=W;return Z}function N$(X){let Z={};for(let z of q1){let W=X.get(z);if(W!==null&&z!==A$)Z[z]=W;X.delete(z)}return Z}function y1(X){try{return new URL(X).pathname.endsWith("/messages")}catch{return!1}}function I1(X){return X instanceof A1||X instanceof L$||X instanceof _1?new k$(X):void 0}function f1(X,Z){let z=[];if(X.oauth)z.push(X.oauth.accessToken);for(let[W,N]of Object.entries(X.apiHeaders??{})){if(N===null||!I2.has(W))continue;z.push(N.replace(/^Bearer\s+/i,""))}for(let W of I2){let N=Z.get(W);if(N!==null)z.push(N.replace(/^Bearer\s+/i,""))}if(X.dispatch?.kind==="http-relay")z.push(X.dispatch.token);return[...new Set(z.filter(Boolean))]}var g1=new Set(["oauth-2025-04-20","claude-code-20250219",T$]);function v1(X){let Z=X.split(",").map((z)=>z.trim()).filter((z)=>z&&!g1.has(z));return S1(null,Z)}function m1(X){let Z=A2(X);if(!P2(Z))return X;let z=x1(Z.messages),W=Object.hasOwn(Z,"fallbacks"),{droppedMarkers:N}=E$(Z,!1),L=W&&!Object.hasOwn(Z,"fallbacks"),C=R1(Z);return z>0||N>0||L||C?JSON.stringify(Z):X}async function h1(X,Z){if(!(X instanceof Promise))return"settled";let z;try{return await Promise.race([X.then(()=>"settled"),new Promise((W)=>{z=setTimeout(()=>W("timed-out"),Z)})])}finally{if(z!==void 0)clearTimeout(z)}}function S2(X){let{source:Z,log:z}=X,W=Math.max(1,X.maxPendingSends??b1),N=X.attemptEndTimeoutMs??D1,L=X.requestGzipLatch??E1(O1(T1())),C=new WeakSet,P=new Map,M=new WeakMap,Y=new WeakMap,U=new WeakMap,B=new Map,K=new WeakMap,E=K$([]);E.dispose();let k=(G)=>(G&&B.get(G)?.redactor)??E,A=(G)=>{let H=B.get(G);if(!H)return;B.delete(G),H.redactor.dispose(),H.scope.dispose()},h=(G,H,F,x)=>{let q=f1(H,x),w=M$(q,F);y.set(G,F),B.set(G,{sessionID:H.sessionID,redactor:K$(q),scope:w}),w.settled.then(()=>A(G));while(B.size>W){let f=B.keys().next().value;if(f===void 0)break;A(f)}},y=new WeakMap,c=(G,H)=>{let F=G?y.get(G):void 0;if(!F||!H.ok)return E.redactResponse(H);let x=M$([],F),q=x.redactResponse(H);return x.dispose(),q},s=(G,H)=>{let F=G?B.get(G)?.scope:void 0;if(!F)return c(G,H);try{return F.redactResponse(H)}catch{return c(G,H)}},t=!1,a=new WeakMap,J=(G,H)=>{if(G&&!H.ok)a.set(H.headers,G);return H},Q=(G,H)=>{if(H.dispatch!=="http-relay")return!0;let F=/^req_[A-Za-z0-9_-]+$/.test(G.get("request-id")??"");return Y.set(H,F),F},V=(G)=>new q$(G.sessionID,G.kind),R=new Map,O=async(G,H)=>{if(t)throw new a2(G.sessionID,G.kind);let F={revoked:!1},x=R.get(G.sessionID);if(!x)x=new Set,R.set(G.sessionID,x);x.add(F);let q=()=>{if(t||F.revoked)throw new a2(G.sessionID,G.kind)};try{let w=await H(q);return q(),w}finally{let w=R.get(G.sessionID);if(w?.delete(F)&&w.size===0)R.delete(G.sessionID)}},b=(G,H)=>{P.set(G,H);while(P.size>W){let F=P.keys().next().value;if(F===void 0)break;P.delete(F),z?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:W})}},I=(G,H)=>({providerID:G.providerID,modelID:G.modelID,sessionID:G.sessionID,agent:G.agent,kind:G.kind,accountId:G.accountId,attemptId:G.attemptId,transport:G.transport,route:H.route,provenance:H.provenance,dispatch:H.dispatch}),d=(G)=>O(G,async(H)=>{let{accountId:F,...x}=G,q=await Z.authorizeAccount(x,F);return H(),l(x,q)}),l=(G,H)=>{if(!H)throw V(G);if(H.dispatch?.kind==="websocket-relay")throw new O2;let F=H.dispatch?.kind==="http-relay"?"http-relay":"direct",x=H.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":H.dispatch.token}:void 0;if(H.route==="oauth"){if(!H.accessToken)throw V(G);F1(H.accessToken,q2);let f=Object.freeze({route:"oauth",provenance:H.provenance,dispatch:F});b(f,{sessionID:G.sessionID,oauth:{accessToken:H.accessToken,...H.identity?{identity:H.identity}:{}},dispatch:H.dispatch,oauthHeaders:H.headers});let p=s2(H.headers);for(let u of I2)delete p[u];return delete p["anthropic-beta"],{headers:x??{...p,"x-api-key":null,authorization:`Bearer ${H.accessToken}`},attempt:f}}let q={authorization:null,"x-api-key":null,...s2(H.headers)};if(!q.authorization&&!q["x-api-key"])throw V(G);let w=Object.freeze({route:"api",provenance:H.provenance,dispatch:F});return b(w,{sessionID:G.sessionID,...H.baseURL?{baseURL:H.baseURL}:{},dispatch:H.dispatch,apiHeaders:q}),{headers:x??q,attempt:w}},r=(G)=>O(G,(H)=>v(G,H)),v=async(G,H)=>{let{request:F,attempt:x}=G,q=x.data,w=q?P.get(q):void 0;if(q)P.delete(q);if(!q||!w||q.route==="oauth"&&!w.oauth)throw V(G);let f=new Headers(F.headers);N1(f);let p=N$(f),u=F.body===null?void 0:await F.text();H();let Z2=u!==void 0&&y1(F.url),J2=S$(F.url,w.baseURL!==void 0?{baseURL:w.baseURL}:{}).url?.toString()??F.url;try{if(q.route==="oauth"&&w.oauth){C$(J2);let{accessToken:$2,identity:o}=w.oauth;for(let[Q2,z2]of Object.entries(s2(w.oauthHeaders))){if(I2.has(Q2))continue;if(z2===null)f.delete(Q2);else f.set(Q2,z2)}let U2=null;if(u!==void 0&&Z2){let Q2={...I(x,q),modelID:(()=>{let _2=A2(u);return z$(P2(_2)&&typeof _2.model==="string"?_2.model:G.modelID)})(),route:"oauth",correlation:p},z2=await Z.requestOptions?.(Q2)??{};H(),u=await R$(u,{...z2,...o?{identity:o}:{},sessionId:G.sessionID,onToolNameMap:(_2)=>U.set(q,_2)});let R2=A2(u);U2=P2(R2)?R2:null}O$(f,$2,{body:U2,...o?{identity:o}:{},requestClass:P$(x.agent)?"auxiliary":"main"})}else{if(u!==void 0&&Z2)u=m1(u);f.delete("authorization"),f.delete("x-api-key");for(let[o,U2]of Object.entries(w.apiHeaders??{}))if(U2===null)f.delete(o);else f.set(o,U2);if(u!==void 0&&Z2&&!f.has("content-type"))f.set("content-type","application/json");let $2=f.get("anthropic-beta");if($2!==null){let o=v1($2);if(o)f.set("anthropic-beta",o);else f.delete("anthropic-beta")}}}catch($2){let o=I1($2);if(!o)throw $2;throw M.set(q,o.check),z?.warn("refused an Anthropic request locally; nothing was sent",{check:o.check}),o}let Y2=u!==void 0?A2(u):void 0;if(await Z.admitRequest?.({...I(x,q),modelID:z$(P2(Y2)&&typeof Y2.model==="string"?Y2.model:G.modelID)}),N$(f),u!==void 0)f.delete("content-length");if(H(),h(q,w,P2(Y2)&&Y2.stream===!0?"event-stream":"http",f),q.route==="oauth"&&Z2&&u!==void 0)await Z.onRequestPrepared?.({...I(x,q),url:J2,bodyText:u}),H();if(w.dispatch?.kind==="http-relay"){let $2=u??"";f.delete("x-relay-token");let o={protocol:1,type:"request",affinity:G.sessionID,upstream:{url:J2,method:F.method,headers:Object.fromEntries(f)},mode:"full_sync",revision:1,body:$2,next_hash:`sha256:${z1("sha256").update($2).digest("hex")}`};return new Request(w.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":w.dispatch.token},redirect:"error",signal:F.signal,body:JSON.stringify(o)})}let B2=u;if(q.route==="oauth"&&Z2&&u!==void 0){let $2=await C1({url:J2,body:u,latch:L});if(H(),$2.gzip)B2=await P1(u),f.set("content-encoding","gzip"),C.add(q),H()}return new Request(J2,{method:F.method,headers:f,redirect:q.route==="oauth"?"error":F.redirect,signal:F.signal,...B2!==void 0?{body:B2}:{}})};return{adapter:{providerID:q2,chooseAccount:(G)=>O(G,async()=>{let H=await Z.chooseAccount(G);if(typeof H==="object"&&G.phase==="retry")return H;if(typeof H!=="string"||!H)throw V(G);return H}),dropChoice:(G)=>Z.dropChoice?.(G),accountHeaders:d,rewriteRequest:r,rewriteHandshakeURL(){throw new O2},rewriteResponse({response:G,attempt:H}){let F=H.data;if(F&&!Q(G.headers,F)){if(G.status===401)return A(F),G.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return s(F,G)}if(F&&C.has(F))C.delete(F),L1(G).then((p)=>{if(!p)return;L.latchProcess(),z?.warn("gzipped request body rejected; later requests go uncompressed",{kind:p,status:G.status})},()=>{});let x=s(F,G);if(F?.route!=="oauth"||!x.body)return J(F,x);let q={...I(H,F),status:G.status},w=Z.responseOptions?.(q)??{},f=(G.headers.get("content-type")??"").includes("application/json");return J(F,x$(x,{...w,toolNameMap:U.get(F),onToolNameRefusal:()=>{M.set(F,"response_tool_names"),A(F)},laneStartOAuthServed:!0,...f?{responseMode:"json"}:{}}))},quotaFromHeaders(G,H,F){let x=F.data;if(!x||!Q(G,x))return;return Z.quotaFromHeaders?.(G,{...I(F,x),status:H})},async limitFromResponse({status:G,headers:H,body:F,attempt:x}){let q=x.data;if(!q||M.get(q)==="response_tool_names")return;if(!Q(H,q))return Z.limitFromRelayFailure?.({...I(x,q),status:G});if(K.set(q,`provider responded with HTTP ${G}`),!Z.limitFromResponse)return;let w=a.get(H)===q,f=k(q);return Z.limitFromResponse({...I(x,q),status:G,headers:H,body:async()=>w?await F():f.redactText(await F())})},inspectEvent({data:G,event:H,attempt:F}){if(F.data&&M.get(F.data)==="response_tool_names")return;let x=A2(G);if(!P2(x))return;let q=typeof x.type==="string"?x.type:H;if(q==="content_block_start"||q==="content_block_delta")return{outputStarted:!0};if(q==="message_stop")return{done:!0};if(q!=="error")return;let w=F.data,f=k(w),p=P2(x.error)?x.error:{},u=typeof p.type!=="string"?void 0:_$.has(p.type)?p.type:f.redactText(p.type),Z2=typeof p.message==="string"?f.redactText(p.message):void 0;if(w?.dispatch==="http-relay"&&Y.get(w)===!1)return;let J2=w?Z.limitFromStreamError?.({...I(F,w),errorType:u,message:Z2}):void 0,Y2={error:[u??"error",Z2].filter(Boolean).join(": ").slice(0,w1),...J2?{limit:J2}:{}};if(w&&Y2.error)K.set(w,Y2.error);return Y2},limitFromError(G,H){let F=H.data;if(!F||M.has(F))return;let x={type:_$.has(G.type)?G.type:"provider_error",message:K.get(F)??"provider request failed",...G.status!==void 0?{status:G.status}:{}};if(A(F),F.dispatch==="http-relay"&&Y.get(F)===!1)return;return Z.limitFromHostError?.(x,I(H,F))},async onAttemptEnd(G,H){let F=G.data;if(!F)return;P.delete(F);let x=H.error?.reason;if(x==="cancelled"||x==="abandoned"||x===void 0&&(H.status===void 0||H.status<400))A(F);let q=M.get(F),{status:w,...f}=H,p=Z.onAttemptEnd?.(I(G,F),{...f,...w!==void 0&&(F.dispatch!=="http-relay"||Y.get(F)===!0)?{status:w}:{},...q!==void 0?{localRefusal:{check:q}}:{}});if(await h1(p,N)==="timed-out")z?.warn("the account source did not finish recording a send",{timeoutMs:N})}},dispose(){t=!0;for(let[G,H]of R){for(let F of H)F.revoked=!0;Z.forgetSession?.(G)}R.clear(),P.clear();for(let G of[...B.keys()])A(G)},forgetSession(G){for(let H of R.get(G)??[])H.revoked=!0;R.delete(G);for(let[H,F]of P)if(F.sessionID===G)P.delete(H);for(let[H,F]of[...B])if(F.sessionID===G)A(H);Z.forgetSession?.(G)},get pendingSendCount(){return P.size},get heldCredentialCount(){let G=0;for(let H of P.values())if(H.oauth)G++;return G},get heldRedactorCount(){return B.size},get operationsInProgress(){let G=0;for(let H of R.values())G+=H.size;return G}}}function b2(X){return JSON.stringify([X.source,X.accountIdentity,X.credentialId,X.binding?.storageId,X.binding?.rowId,X.binding?.credentialEpoch])}function D$(X){let{runtime:Z,source:z}=X,W=new AbortController,N=!1,L=new d1({directory:X.registryDirectory||process.env.OPENCODE_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR||u1("opencode"),now:X.now}),C=new Map,P=async(B,K,E)=>{let k=E?AbortSignal.any([W.signal,E]):W.signal;k.throwIfAborted();let A=JSON.parse(await K.text()),h={providerID:"anthropic",modelID:A.model,sessionID:`oc2-cachekeep:${B.id}`,agent:"cachekeep",kind:"generate"},y=S2({source:{...z,onRequestPrepared:void 0,responseOptions:void 0,async requestOptions(J){return{...await z.requestOptions?.(J),laneStart:!1,billingLineage:void 0,cacheDiagnosticsPreviousMessageId:void 0}},async authorizeAccount(J,Q){let V=await Z.read();k.throwIfAborted();let R=V.accounts.find((b)=>b.id===Q);if(R?.type!=="oauth"||b2(R)!==B.oauthAccountIdentity||B.isSubagent&&!e2(V.policyStorage)||!t2(V.policyStorage)||!b$(V.policyStorage,new Date(X.now?.()??Date.now())))return;let O=await z.authorizeAccount(J,Q);if(O?.provenance.kind==="local"&&b2({...R,binding:O.provenance.subject.binding,accountIdentity:O.provenance.subject.binding.identity})!==B.oauthAccountIdentity)return;if(O?.provenance.kind==="vault"&&O.provenance.credentialId!==R.credentialId)return;return O},async admitRequest(J){await z.admitRequest?.(J);let Q=await Z.read(),V=Q.accounts.find((R)=>R.id===J.accountId);if(k.throwIfAborted(),!V||b2(V)!==B.oauthAccountIdentity||B.isSubagent&&!e2(Q.policyStorage)||!t2(Q.policyStorage)||!b$(Q.policyStorage,new Date(X.now?.()??Date.now())))throw Error("CacheKeep policy changed before dispatch")}}}),c,s,t=!1,a=()=>y.forgetSession(h.sessionID);k.addEventListener("abort",a,{once:!0});try{let J=(await Z.read()).accounts.find((I)=>b2(I)===B.oauthAccountIdentity)?.id;if(!J)throw Error("CacheKeep account is unavailable");let Q=await y.adapter.accountHeaders({...h,accountId:J});if(!("headers"in Q)||typeof Q.headers!=="object"||Q.headers===null||typeof Q.attempt!=="object"||Q.attempt===null||Q.attempt.route!=="oauth")throw Error("CacheKeep authorization refused");c={...h,accountId:J,attemptId:crypto.randomUUID(),transport:"http",data:Q.attempt};let V=await y.adapter.rewriteRequest?.({...h,accountId:J,attempt:c,request:new Request(B.url,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(A),signal:k})});if(!V)throw Error("CacheKeep rewrite refused");k.throwIfAborted();let R=await(X.fetch??fetch)(V),O=await y.adapter.rewriteResponse?.({...h,accountId:J,attempt:c,request:V,response:R});if(!O)throw Error("CacheKeep response rewrite refused");if(s=O.status,y.adapter.quotaFromHeaders?.(O.headers,O.status,c),!O.ok)await y.adapter.limitFromResponse?.({status:s,headers:O.headers,body:()=>O.clone().text(),attempt:c});let b=await O.arrayBuffer();return t=!0,new Response(b,{status:s,headers:O.headers})}catch{throw Error("Native CacheKeep was not completed")}finally{k.removeEventListener("abort",a);try{if(c)await y.adapter.onAttemptEnd?.(c,{status:s,outputStarted:!1,...t?{}:{error:{reason:"cancelled"}}})}finally{y.dispose(),z.forgetSession?.(h.sessionID)}}},M=X.setIntervalImpl??globalThis.setInterval,Y=new l1({loadStorage:async()=>N?null:(await Z.read()).policyStorage,now:X.now,setIntervalImpl:(B,K)=>M(()=>Y.tick().catch(()=>{p1.warn("cachekeep","tick failed")}),K),clearIntervalImpl:X.clearIntervalImpl,onTrackedSessionsChanged:(B)=>L.publish(N?[]:B),prepareHeaders(B,K,E){if(N)return;return C.set(E.id,{target:K,attempt:E}),new Headers({"x-native-cachekeep-attempt":String(E.id)})},fetchImpl:async(B,K)=>{let E=new Request(B,K),k=Number(E.headers.get("x-native-cachekeep-attempt")),A=C.get(k);if(C.delete(k),!A)throw Error("CacheKeep attempt is unavailable");return P(A.target,E,A.attempt.signal)},onComplete:({attempt:B})=>{C.delete(B.id)}}),U;return{async track(B){if(N||B.route!=="oauth"||B.agent==="cachekeep"||B.agent==="prime"||B.kind!=="primary")return;let K=await Z.read();if(N||!t2(K.policyStorage))return;let E=!1;try{E=await X.isSubagent?.(B.sessionID)??!1}catch{return}if(N||E&&!e2(K.policyStorage))return;let k=K.accounts.find((A)=>A.id===B.accountId);if(!k?.accountIdentity)return;if(B.provenance.kind==="local"&&JSON.stringify(k.binding)!==JSON.stringify(B.provenance.subject.binding))return;if(B.provenance.kind==="vault"&&k.credentialId!==B.provenance.credentialId)return;Y.track({sessionId:B.sessionID,url:B.url,headers:new Headers,bodyText:B.bodyText,storage:K.policyStorage,cacheMode:"hybrid",oauthAccountId:B.accountId,oauthAccountIdentity:b2(k),isSubagent:E}),await L.publish(Y.trackedSessions())},registry:L,dispose(){if(U)return U;return N=!0,Y.stop(),W.abort(),U=(async()=>{try{await Y.tick()}finally{C.clear(),await L.dispose()}})(),U}}}async function w$(X,Z,z){let W=S2(Z),N=[],L=async(K,E,k)=>{let A=await X.session.hook(K,E,k);return N.push(A),A},C=new AbortController,P;try{P=await r2({session:{hook:L},event:X.event},W.adapter,{logger:Z.log,gateOnPlaceholder:z})}catch(K){throw W.dispose(),await Promise.allSettled(N.map((E)=>E.dispose())),K}let M=(K)=>{W.forgetSession(K),P.forgetSession(K)},Y=X.event,U=Y?(async()=>{try{for await(let K of Y.subscribe({signal:C.signal}))if(K.type==="session.deleted")M(K.data.sessionID)}catch(K){if(!C.signal.aborted)Z.log?.warn("stopped listening for session deletion",{error:K instanceof Error?K.name:"unknown"})}})():Promise.resolve(),B;return{installation:P,forgetSession:M,dispose(){if(B)return B;return W.dispose(),C.abort(),B=(async()=>{await P.dispose(),await U})(),B}}}import{effectiveRelayTransport as y$,getQuotaCheckIntervalMs as c1,logger as i1,nativeAccountCanServe as o1,oauthProfileIsFresh as n1,quotaSnapshotCheckedAt as r1}from"@cortexkit/anthropic-auth-core";function I$(X,Z){let z=new AbortController,W,N=!1,L=async()=>{let M=await X.read();if(z.signal.throwIfAborted(),M.policyStorage.relay?.enabled===!0&&y$(M.policyStorage.relay.transport,M.policyStorage.relay.url)==="websocket")return;let Y=M,U=c1(Y.policyStorage);for(let B of Y.accounts){if(z.signal.aborted)return;if(!o1(B)||B.type!=="oauth")continue;if(Y.policyStorage.quota?.enabled!==!1&&Date.now()-r1(B.quota)>=U)await X.fetchQuota(B.id,Z,z.signal,void 0,"background").catch(()=>{});if(!n1(B.profile)&&!z.signal.aborted)await X.fetchProfile(B.id,Z,z.signal).catch(()=>{})}},C=()=>{if(N||W)return W;return W=L().catch(()=>{if(!z.signal.aborted)i1.debug("opencode2","native background readings did not complete")}).finally(()=>{W=void 0}),W},P=X.vault.watch({intervalMs:60000,onRefresh:C,shouldRefresh:async()=>{let M=await X.read();return M.policyStorage.relay?.enabled!==!0||y$(M.policyStorage.relay.transport,M.policyStorage.relay.url)==="http"}});return P.ready.catch(()=>{}),{async dispose(){N=!0,P.close(),z.abort(),await W}}}import{authorize as jX,buildCacheKeepStatusSummary as WX,buildClaudeQuotaSummary as QX,buildPrimeAccountStatuses as BX,buildPrimeStatusSummary as UX,CLAUSTRUM_OPENCODE_ENROLLMENT_NAME as HX,exchange as KX,formatNativeAccountState as MX,formatOAuthAccountTier as zX,getCacheKeepWindow as _X,getHostClaustrumEnrollmentPaths as NX,isCacheKeepAlways as FX,isCacheKeepHybridActive as LX,isCacheKeepPersistentlyEnabled as CX,nativeAccountCanServe as PX,resetClaustrumEnrollmentState as TX}from"@cortexkit/anthropic-auth-core";import{buildPrimeAccountStatuses as s1,effectiveRelayStatus as a1,formatNativeAccountState as t1,formatOAuthAccountTier as f$,getCacheKeepWindow as e1,getRoutingMode as $X,isCacheKeepAlways as XX,isCacheKeepHybridActive as ZX,isPermanentRefreshError as JX,isPrimePersistentlyEnabled as YX,nativeAccountCanServe as m$,refreshBackoffActive as g$}from"@cortexkit/anthropic-auth-core";var v$=(X)=>m$(X)&&X.state!=="unsupported-access"?void 0:t1(X)||void 0,GX=(X)=>{if(X.source!=="vault")return"off";if(X.state==="needs_reauth")return"on-vault-reauth";return m$(X)?"on-vault-served":"on-cold"},VX=(X,Z)=>typeof X==="number"&&X>Z;function h$(X,Z){let{now:z}=Z,W=X.policyStorage,N=X.accounts.filter((U)=>U.type==="oauth"),L=N.find((U)=>U.id==="main"),C=L?v$(L):void 0,P=L?.lastQuotaRefreshError?.nextRetryAt,M=L?.lastRefreshError,Y=e1(W);return{main:{quota:L?.quota??null,enabled:L?.enabled,tierLabel:f$(L?.profile),quotaBackedOff:VX(P,z),quotaBackoffUntil:P,refreshBackedOff:g$(M,L?.accountIdentity,z,void 0),refreshBackoffUntil:M?.nextRetryAt,stateLine:C,quotaDated:Boolean(C)},fallbacks:N.filter((U)=>U.id!=="main"&&(U.enabled||U.source==="vault")).map((U)=>{let B=v$(U),K=GX(U);return{id:U.id,label:U.label,quota:U.quota??null,enabled:U.enabled,tierLabel:f$(U.profile),needsReauth:JX(U.lastRefreshError)&&g$(U.lastRefreshError,U.accountIdentity,z,void 0),...K==="on-vault-reauth"?{vaultReauth:!0}:{},...K==="on-vault-served"?{vaultServed:!0}:{},...K!=="off"?{custodyState:K}:{},stateLine:B,quotaDated:Boolean(B)}}),...Z.activeId!==void 0&&{activeId:Z.activeId},route:$X(W),relay:a1(W.relay),fastMode:W.claudeFast?.enabled===!0,cacheKeep:{enabled:ZX(W),...XX(W)?{window:"always"}:Y&&{window:`${Y.startHour}-${Y.endHour}`},trackedSessions:Z.trackedSessions},prime:YX(W)?{enabled:!0,accounts:s1(W,{now:z})}:void 0,lastUpdated:z}}var $$=(X)=>X!==null&&typeof X==="object"&&!Array.isArray(X)?X:{},l$=`For first-time model access, connect Anthropic with "${m2}".
-Run: opencode auth login anthropic --method ${v2}`,d$=(X)=>X.mode==="local"&&!X.accounts.some((Z)=>Z.id==="main"),EX=(X)=>{let Z=X.id==="main"?"main":"fallback",z=`${X.enabled?"enabled":"disabled"}, ${X.type}, ${X.source}${X.state?`, ${MX(X)}`:""}`;if(X.label)return`${X.label} [${Z}]: ${z}
-  Route: ${X.id}`;return`${Z==="main"?"Main account":`Fallback ${X.id}`}: ${z}`};function p$(X){let{runtime:Z,source:z}=X,W=new Map,N=!1,L=async(Y,U)=>{await Z.updateSettings((B)=>({...B,[Y]:{...$$(B[Y]),...U}}))},C=()=>({ok:!0,text:"Native Claude settings updated."}),P=async(Y,U)=>{if(N)throw Error("Native menu is closed");switch(U.signal?.throwIfAborted(),Y.action){case"enable":case"disable":return await Z.setEnabled(Y.values.id,Y.action==="enable"),C();case"remove":return await Z.remove(Y.values.id),C();case"move-up":case"move-down":{let K=(await Z.read()).accounts.map((y)=>y.id),E=K.indexOf(Y.values.id),k=E+(Y.action==="move-up"?-1:1);if(E<0||k<0||k>=K.length)return{ok:!1,text:"Account cannot move in that direction."};let A=K[E],h=K[k];if(A===void 0||h===void 0)return{ok:!1,text:"Account order changed."};return K[E]=h,K[k]=A,await Z.reorder(K),C()}case"add-apikey":return await Z.addApi(Y.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let B=new AbortController;W.get(Y.sessionId)?.active.abort();let K={active:B,auth:void 0};W.set(Y.sessionId,K);let E=await jX("max");if(N||B.signal.aborted||U.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return K.auth=E,{ok:!0,text:`Open ${E.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let B=W.get(Y.sessionId);if(!B?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let K=await KX(Y.values.code,B.auth.verifier,B.auth.redirectUri,B.auth.state);if(B.active.signal.throwIfAborted(),U.signal?.throwIfAborted(),N||K.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await Z.loginOAuth({routeId:crypto.randomUUID(),credential:{access:K.access,refresh:K.refresh,expires:K.expires},label:Y.values.label}),B.active.signal.throwIfAborted(),U.signal?.throwIfAborted(),N)return{ok:!1,text:"Sign-in cancelled."};W.delete(Y.sessionId);let E="OAuth account stored in the native account pool.";return{ok:!0,text:d$(await Z.read())?`${E}
+`)}}function $$(X,Z){let z=new TextDecoder,W="",F=(C)=>{let T=T1(C);if(!T)return;try{X(T)}catch(K){Z(K)}},L=()=>{for(;;){let C=/\r?\n\r?\n/.exec(W);if(!C)return;let T=W.slice(0,C.index);W=W.slice(C.index+C[0].length),F(T)}};return new TransformStream({transform(C,T){T.enqueue(C),W+=z.decode(C,{stream:!0}),L()},flush(){if(W+=z.decode(),L(),W.trim()!=="")F(W);W=""}})}var H$=512,_$=1200000,k2="x-common-auth-attempt",S2=(X,Z)=>JSON.stringify([X,Z]),N2=(X)=>({providerID:X.model.providerID,modelID:X.model.id,sessionID:X.sessionID,agent:X.agent,kind:X.kind});function P1(X){let Z=X.headers;return typeof Z==="object"&&Z!==null}function C1(X,Z){let z=X.getReader();return new ReadableStream({async pull(W){let F;try{F=await z.read()}catch(L){Z({reason:"failed",message:L instanceof Error?L.message:String(L)}),W.error(L);return}if(F.done)Z(),W.close();else W.enqueue(F.value)},async cancel(W){Z({reason:"cancelled",...W===void 0?{}:{message:String(W)}}),await z.cancel(W)}})}function m2(X,Z){for(let[z,W]of Object.entries(Z)){let F=z.toLowerCase();for(let L of Object.keys(X))if(L.toLowerCase()===F)delete X[L];if(W!==null)X[z]=W}}function O1(X,Z){for(let[z,W]of Object.entries(Z))if(W===null)X.delete(z);else X.set(z,W)}async function X$(X,Z,z={}){let{providerID:W}=Z,F=z.gateOnPlaceholder,L=($)=>F===void 0||F.credential($)===O2(W),C=z.logger,T=Math.max(1,z.maxRecords??H$),K=[...z.hostCredentials??[O2(W)],...F?[O2(W)]:[]].filter(($)=>$!==""),Y=new Map,U=new WeakMap,H=new Map,V=0,P=new Set,x=new Map,q=new Map,f=($)=>{let G=q.get($);return G?.ownedSeen===!0&&G.foreignSeen},c=($,G)=>{x.set($,G);let _=q.get($)??{ownedSeen:!1,foreignSeen:!1};if(G)_.ownedSeen=!0;else _.foreignSeen=!0;q.set($,_)},D=($,G)=>{let _=F?.refuseMisplaced,S=_?[...G].filter(([,u])=>u.includes(O2(W))):[],O=L(G)&&(!_||S.length>0);if(_){if(S.length>0&&(S.length!==1||!O))throw c($.sessionID,!1),new x2({kind:"placement-refused",providerID:W,sessionID:$.sessionID,requestKind:$.kind,message:_(S[0]?.[0]??"")})}return c($.sessionID,O),O},r=!1,$2=!1,a=new Map,H2=0,n=!1,J=new Map,j=($,G)=>{try{C?.warn($,G)}catch{}},B=($)=>$ instanceof Error?$.message:String($),E=new Map,k=($,G)=>{let _=(E.get($)??Promise.resolve()).then(G),S=_.then(()=>{},()=>{});return E.set($,S),S.then(()=>{if(E.get($)===S)E.delete($)}),_},I=($,G)=>{let _=E.get($);return _?_.then(()=>I($,G)):G()},h=async($)=>{try{await Z.dropChoice?.({...$.input,accountId:$.accountId})}catch(G){j("opencode2 auth dropChoice threw; the request is unaffected",{sessionID:$.input.sessionID,error:B(G)})}},i=($)=>{let G=H.get($);if(H.delete($),G?.next){let _=G.next;k(G.sessionID,()=>h(_))}},p=async($,G)=>{let _=a.get($);if(!_||_.size===0)return;await Promise.all([..._].map(async(S)=>{try{await S(G)}catch(O){j("opencode2 auth listener threw; the request is unaffected",{event:$,error:B(O)})}}))},J2=async($,G)=>{try{await Z.onAttemptEnd?.($,G)}catch(_){j("opencode2 auth onAttemptEnd threw; the request is unaffected",{attemptId:$.attemptId,error:B(_)})}},g=($,G)=>{if($.ended||!$.attempt)return;let _={...$.status===void 0?{}:{status:$.status},outputStarted:$.outputStarted,...$.limit?{limit:$.limit.signal}:{},...G?{error:G}:{}};if(G)$.endError=G;$.ended=J2($.attempt,_)},m=($,G)=>g($,{reason:"abandoned",message:G}),l=($)=>[...Y.values()].filter((G)=>G.key===$),z2=($)=>l($).at(-1),P2=($)=>{if(Y.delete($.id),H.get($.key)?.attemptId===$.id||!l($.key).length)i($.key)},t=($)=>{Y.set($.id,$);while(Y.size>T){let G=Y.values().next().value;if(G===void 0)break;m(G,"dropped to keep the record bound"),P2(G)}},j2=($)=>$.accountId===void 0?void 0:{...$.scope,accountId:$.accountId},Q=($,G)=>new x2({kind:"no-account",providerID:W,sessionID:$.sessionID,requestKind:$.kind,...G===void 0?{}:{message:G}}),N=($)=>{J.get($)?.clear(),J.delete($)},M=async($,G)=>{let _=()=>Q($,`${W} ${$.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);if(n)throw _();let S=J.get($.sessionID);if(!S)S=new Set,J.set($.sessionID,S);let O={};S.add(O);let u=()=>{if(!S.has(O))throw _()};try{return await G(u)}finally{if(S.delete(O),S.size===0&&J.get($.sessionID)===S)J.delete($.sessionID)}},A=($,G)=>{for(let[_,S]of G)if(K.some((O)=>S.includes(O)))throw new x2({kind:"host-credential-on-wire",providerID:W,sessionID:$.sessionID,requestKind:$.kind,message:`${W} ${$.kind} request still carries the host's placeholder credential in ${_}; the adapter's account headers must replace it`})},R=($)=>{for(let G of l($))if(G.ended||!G.attempt)P2(G);else if(G.transport==="ws"||G.judged)m(G,"a newer attempt of its session and kind began"),P2(G)},w=async($,G,_,S)=>{let O=S2($.sessionID,$.kind),{input:u,accountId:b}=await I($.sessionID,async()=>{_();let W2=H.get(O);H.delete(O);let L2=W2?.accountId??z2(O)?.accountId;R(O);let F2=W2?.next,U2=F2!==void 0&&F2.input.modelID===$.modelID&&F2.input.agent===$.agent,y2={...$,phase:"request",...L2===void 0?{}:{previousAccountId:L2},...W2?.rerouteFrom?{rerouteFrom:W2.rerouteFrom}:{}};if(F2&&!U2)await k($.sessionID,()=>h(F2)),_();let C2=U2?F2.accountId:await Z.chooseAccount(y2);return{input:y2,accountId:typeof C2==="string"?C2:void 0}});_();let v={},Z2;if(b!==void 0){let W2=await Z.accountHeaders({...$,accountId:b});if(_(),P1(W2))v=W2.headers,Z2=W2.attempt;else v=W2}let E2=`attempt-${++H2}`,_2={id:E2,key:O,scope:$,accountId:b,headers:v,attempt:b===void 0?void 0:{...$,accountId:b,attemptId:E2,transport:S,data:Z2},...S===void 0?{}:{transport:S},outputStarted:!1};if(t(_2),_2.attempt)p("select",{...$,accountId:_2.attempt.accountId,hook:G,...u.previousAccountId===void 0?{}:{previousAccountId:u.previousAccountId},...u.rerouteFrom===void 0?{}:{rerouteFrom:u.rerouteFrom},handle:_2.attempt});return _2},y=async($,G,_,S,O)=>{let u=S2($.sessionID,$.kind),b=S===void 0?void 0:Y.get(S);if(b?.key!==u)b=void 0;if(!b){if(b=z2(u),l(u).filter((Z2)=>Z2.transport===void 0&&!Z2.ended).length>1&&!$2)$2=!0,j("opencode2 auth tied a send without its attempt mark to the newest of several waiting attempts",{sessionID:$.sessionID,kind:$.kind})}if(!b||b.transport!==void 0||b.ended)b=await w($,G,O,_);else if(b.transport=_,b.attempt)b.attempt.transport=_;if(_==="ws"){for(let v of l(u))if(v!==b&&v.transport==="ws")m(v,"a newer attempt of its session and kind went out over WebSocket")}return b},s=async($,G)=>{try{return await G()}catch(_){throw g($,{reason:"failed",message:B(_)}),_}},d=($,G)=>{let _=l(S2($,G)).filter((S)=>S.transport==="ws").at(-1);return _?.attempt!==void 0&&!_.ended?_:void 0},Y2=($,G,_)=>{let S=j2($);if(!S||!$.attempt||$.limit)return;$.limit={signal:G,delivered:p("limit",{...S,via:_,limit:G,outputStarted:$.outputStarted,handle:$.attempt})}},Q2=($,G,_,S)=>{let O=j2($);if(!O||!$.attempt)return;p("quota",{...O,transport:G,...S===void 0?{}:{status:S},quota:_,handle:$.attempt})},B2=($,G,_,S)=>{let O=$.attempt;if(!O)return;let u=Z.inspectEvent?.(S===void 0?{transport:G,data:_,attempt:O}:{transport:G,data:_,event:S,attempt:O});if(!u)return;if(u.quota!==void 0)Q2($,G,u.quota);if(u.outputStarted)$.outputStarted=!0;if(u.limit)Y2($,u.limit,G);if(u.error!==void 0)g($,{reason:"failed",message:u.error});else if(u.done)g($)},T2=($,G)=>{let _=$.attempt;if(!_||G.accountId===$.accountId)return;if(_.reboundFrom??=_.accountId,_.accountId=G.accountId,"data"in G)_.data=G.data;$.accountId=G.accountId},X2=($)=>!$.attempt||$.endError!==void 0||$.status!==void 0&&$.status>=400,e=($)=>{let G=[...Y.values()].filter((v)=>v.scope.sessionID===$),_=G.filter((v)=>v.limit&&!v.rerouted).at(-1);if(_)return _;let S=G.filter((v)=>v.scope.kind==="primary"),O=S.length>0?S:G;if(O.length<=1)return O[0];let u=O.filter((v)=>!v.judged&&X2(v)).at(-1);if(u)return u;let b=O.filter((v)=>v.attempt&&!v.ended);if(b.length>1)return"ambiguous";return b[0]??O.at(-1)},G2={providerID:W},V2=[];V2.push(await X.session.hook("model.request",($)=>{if(F)return;return M(N2($),async(G)=>{let _=await w(N2($),"model.request",G);if(G(),_.accountId===void 0)throw Q(_.scope);m2($.headers,{..._.headers,[k2]:_.id})})},G2)),V2.push(await X.session.hook("http.request",($)=>{if(F){if(!D(N2($),$.request.headers))return}return M(N2($),async(G)=>{let _=$.request.headers.get(k2)??void 0,S=F?await w(N2($),"http.request",G,"http"):await y(N2($),"http.request","http",_,G);G();let O=j2(S),u=S.attempt;if(!O||!u)throw Q(S.scope);await s(S,async()=>{let b=$.request;if(Z.rewriteRequest){if(_!==void 0){let E2=new Headers(b.headers);E2.delete(k2),b=new Request(b,{headers:E2})}b=await Z.rewriteRequest({...O,request:b,attempt:u})??b,G()}let v=new Headers(b.headers);v.delete(k2),O1(v,S.headers),A(S.scope,v.entries());let Z2=new Request(b,{headers:v});U.set(Z2,S),$.request=Z2})})},G2)),V2.push(await X.session.hook("http.response",async($)=>{let G=U.get($.request);if(!G){if(F)return;if(!r)r=!0,j("opencode2 auth dropped an http.response whose request it did not produce",{sessionID:$.sessionID,kind:$.kind});return}let _=$.response;if(Z.answeredBy&&G.attempt){let v=G.attempt,Z2=await s(G,async()=>Z.answeredBy?.({request:$.request,response:_,attempt:v}));if(Z2)T2(G,Z2)}let S=j2(G),O=G.attempt;if(!S||!O)return;G.status=_.status;let u=Z.quotaFromHeaders?.(_.headers,_.status,O);if(u!==void 0)Q2(G,"http",u,_.status);if(!_.ok&&Z.limitFromResponse){let v=await Z.limitFromResponse({status:_.status,headers:_.headers,body:()=>_.clone().text(),attempt:O});if(v)Y2(G,v,"http")}if(!_.ok||!_.body)g(G);let b=_;if(_.body&&(Z.inspectEvent||Z.onAttemptEnd)){let v=_.body;if(Z.inspectEvent)v=v.pipeThrough($$((Z2)=>B2(G,"http",Z2.data,Z2.event),(Z2)=>j("opencode2 auth event inspection threw",{error:B(Z2)})));b=new Response(C1(v,(Z2)=>g(G,Z2)),{status:_.status,statusText:_.statusText,headers:_.headers})}if(Z.rewriteResponse)b=await Z.rewriteResponse({...S,request:$.request,response:b,attempt:O})??b;if(b!==_)$.response=b},G2)),V2.push(await X.session.hook("experimental.ws.handshake",($)=>{if(F){let G=S2($.sessionID,$.kind);if(P.delete(G),!D(N2($),new Headers($.headers)))return}return M(N2($),async(G)=>{let _;for(let b of Object.keys($.headers)){if(b.toLowerCase()!==k2)continue;_??=$.headers[b],delete $.headers[b]}let S=F?await w(N2($),"experimental.ws.handshake",G,"ws"):await y(N2($),"experimental.ws.handshake","ws",_,G);G();let O=j2(S),u=S.attempt;if(!O||!u)throw Q(S.scope);await s(S,async()=>{if(!F?.refuseMisplaced)m2($.headers,S.headers);let b=Z.rewriteHandshakeURL?.({...O,url:$.url,attempt:u});if(b!==void 0)$.url=b;if(F?.refuseMisplaced)m2($.headers,S.headers);if(A(S.scope,Object.entries($.headers)),F)P.add(S.key)})})},G2));let o=Z.rewriteWebSocketFrame?.bind(Z);if(o)V2.push(await X.session.hook("experimental.ws.send",async($)=>{let G=N2($);if(F&&!P.has(S2(G.sessionID,G.kind)))return;let _=d(G.sessionID,G.kind),S=await o({...G,attempt:_?.attempt,frame:$.frame});if(S!==void 0)$.frame=S},G2));V2.push(await X.session.hook("experimental.ws.receive",($)=>{if(F&&!P.has(S2($.sessionID,$.kind)))return;let G=d($.sessionID,$.kind);if(!G)return;try{B2(G,"ws",$.frame)}catch(_){j("opencode2 auth frame inspection threw",{error:B(_)})}},G2)),V2.push(await X.session.hook("retry",async($)=>{if(F&&x.get($.sessionID)!==!0)return;let G=$.decision,_=()=>p("retry",{sessionID:$.sessionID,attempt:$.attempt,reason:"host-decides",hostDecision:G,decision:G});if(f($.sessionID)){await _();return}let S=e($.sessionID);if(!S)return;if(S==="ambiguous"){await p("retry",{sessionID:$.sessionID,attempt:$.attempt,reason:"host-decides",hostDecision:G,decision:G});return}let O=S;await M(O.scope,async(u)=>{let b=u;if(f($.sessionID)){await _();return}O.judged=!0;let v=O.attempt;if(v&&!O.outputStarted){if(!O.limit){let _2=Z.limitFromError?.($.error,v);if(_2)Y2(O,_2,"error")}if(O.ended)await O.ended;if(O.limit)await O.limit.delivered}b();let{decision:Z2,reason:E2}=await k(O.scope.sessionID,async()=>{if(b(),f($.sessionID))return{decision:G,reason:"host-decides"};let _2=H.get(O.key);if(H.delete(O.key),_2?.next)await h(_2.next);if(b(),f($.sessionID))return{decision:G,reason:"host-decides"};let W2=G,L2,F2,U2;if(O.accountId===void 0||!v)W2={retry:!1},L2="no-account";else if(O.outputStarted)W2={retry:!1},L2="output-started";else if(O.limit){let y2={accountId:O.accountId,limit:O.limit.signal},C2,s2={...O.scope,phase:"retry",previousAccountId:O.accountId,rerouteFrom:y2};try{C2=await Z.chooseAccount(s2)}catch(a2){j("opencode2 auth chooseAccount threw while the retry hook looked for another account; the host decides the retry",{sessionID:O.scope.sessionID,error:B(a2)})}let R2=typeof C2==="object"?C2.hold:void 0,h2=typeof C2==="string"?C2:R2?O.accountId:void 0;if(h2!==void 0)U2={accountId:h2,input:s2};try{b()}catch(a2){if(U2)await h(U2);throw a2}if(f($.sessionID)){if(U2)await h(U2);return{decision:G,reason:"host-decides"}}if(R2&&Number.isFinite(R2.delayMs)&&R2.delayMs>=0)W2={retry:!0,delay:Math.min(R2.delayMs,_$)},L2="hold";else if(!R2&&h2!==void 0&&h2!==O.accountId)O.rerouted=!0,F2=y2,W2={retry:!0,delay:0},L2="reroute";else{if(R2&&U2)await h(U2),U2=void 0;L2="host-decides-last-account"}}else L2="host-decides";if($.decision=W2,W2.retry&&O.accountId!==void 0&&Y.has(O.id))H.set(O.key,{attemptId:O.id,sessionID:O.scope.sessionID,order:++V,accountId:O.accountId,...F2===void 0?{}:{rerouteFrom:F2},...U2===void 0?{}:{next:U2}});else if(U2)await h(U2);return{decision:W2,reason:L2}});b(),await p("retry",{sessionID:$.sessionID,...O.accountId===void 0?{}:{accountId:O.accountId},kind:O.scope.kind,attempt:$.attempt,reason:E2,hostDecision:G,decision:Z2,...v===void 0?{}:{handle:v}})})},G2));let M2=($)=>{if(N($),x.delete($),!q.get($)?.foreignSeen)q.delete($);for(let G of P)if(JSON.parse(G)[0]===$)P.delete(G);for(let G of[...Y.values()]){if(G.scope.sessionID!==$)continue;m(G,"its session was forgotten"),Y.delete(G.id)}for(let[G,_]of H)if(_.sessionID===$)i(G)},K2=new AbortController,g2=X.event;if(g2)(async()=>{try{for await(let $ of g2.subscribe({signal:K2.signal}))if($.type==="session.deleted")M2($.data.sessionID);else if($.type==="session.status"&&$.data.status.type==="idle"){let G=$.data.sessionID,_=++V;k(G,async()=>{for(let[S,O]of H)if(O.sessionID===G&&O.order<_){if(H.delete(S),O.next)await h(O.next)}})}}catch($){if(!K2.signal.aborted)j("opencode2 auth stopped listening for session deletion",{error:B($)})}})();return{on($,G){let _=a.get($);if(!_)_=new Set,a.set($,_);let S=G;return _.add(S),()=>{_.delete(S)}},accountFor($,G){return z2(S2($,G))?.accountId},forgetSession:M2,get size(){return Y.size},async dispose(){if(n)return;n=!0;for(let $ of J.keys())N($);K2.abort();for(let $ of Y.values())m($,"the installation was disposed");Y.clear();for(let $ of H.keys())i($);P.clear(),x.clear(),q.clear(),a.clear(),await Promise.all(E.values()),await Promise.all(V2.map(async($)=>{try{await $.dispose()}catch(G){j("opencode2 auth hook did not dispose cleanly",{error:B(G)})}}))}}}import{CacheKeepManager as $X,CacheKeepSessionRegistry as XX,getDefaultCacheKeepRegistryDirectory as ZX,isCacheKeepActiveNow as g$,isCacheKeepHybridActive as G$,isCacheKeepSubagentsEnabled as V$,logger as h$}from"@cortexkit/anthropic-auth-core";import{createHash as E1}from"node:crypto";import{AnthropicOAuthOriginError as R1,applyCustomHeaders as S1,assertNotCustodyTombstone as q1,classifyGzipRejection as A1,createProviderErrorRedactor as N$,createProviderErrorResponseScope as L$,decideRequestGzip as x1,dumpDirectRequest as F$,dumpRelayRequest as T$,dumpResponseArtifact as l2,encodeGzipRequestBody as k1,getAccountStoragePath as b1,getRequestGzipLatch as w1,getRequestGzipLatchPath as D1,isDumpEnabled as y1,mergeAnthropicBetas as I1,remapModelId as P$,remapRequestBodyModel as f1,setDumpEnabled as C$,stateRefusalCause as v1,stripEmptyTrailingAssistantMessages as g1,TrailingAssistantHistoryError as h1}from"@cortexkit/anthropic-auth-core";var b2="anthropic",y$="x-common-auth-attempt",m1=["x-session-affinity","x-opencode-session","x-parent-session-id",R$,d2,A2,y$],u2=new Set(["authorization","x-api-key"]),l1="physical send before a response",u1="Claude pool login is selected but no native account is usable. Complete offline migration or repair the pool and its quota policy before retrying.",d1=512,p1=5000,c1=500,O$=new Set(["invalid_request_error","authentication_error","billing_error","permission_error","not_found_error","request_too_large","rate_limit_error","timeout_error","api_error","overloaded_error"]);class I$ extends Error{sessionID;requestKind;kind="no-account";providerID=b2;constructor(X,Z){super(u1);this.sessionID=X;this.requestKind=Z;this.name="NativeAnthropicNoAccountError"}}class Y$ extends Error{sessionID;requestKind;kind="session-forgotten";providerID=b2;constructor(X,Z){super("request refused: its session was closed while it was being prepared");this.sessionID=X;this.requestKind=Z;this.name="NativeAnthropicRevokedError"}}class w2 extends Error{kind="unsupported-transport";providerID=b2;constructor(){super("request refused: WebSocket relay is not supported on OpenCode 2; select HTTP relay or direct transport");this.name="NativeAnthropicTransportRefusal"}}class f$ extends Error{kind="local-invalid-request";status=400;check;constructor(X){super(X.message,{cause:X});this.name="NativeAnthropicLocalRefusal",this.check=X.check}}class v$ extends Error{kind="state-relocated";providerID=b2;constructor(X){super(X.message,{cause:X});this.name="NativeAnthropicStateRefusal"}}function i1(X){let Z=v1(X);return Z?new v$(Z):void 0}var q2=(X)=>typeof X==="object"&&X!==null&&!Array.isArray(X);function I2(X){try{return JSON.parse(X)}catch{return}}function Z$(X){let Z={};for(let[z,W]of Object.entries(X??{}))Z[z.toLowerCase()]=W;return Z}function E$(X){let Z={};for(let z of m1){let W=X.get(z);if(W!==null&&z!==y$)Z[z]=W;X.delete(z)}return Z}function o1(X){try{return new URL(X).pathname.endsWith("/messages")}catch{return!1}}function r1(X){return X instanceof h1||X instanceof S$||X instanceof R1?new f$(X):void 0}function n1(X,Z){let z=[];if(X.oauth)z.push(X.oauth.accessToken);for(let[W,F]of Object.entries(X.apiHeaders??{})){if(F===null||!u2.has(W))continue;z.push(F.replace(/^Bearer\s+/i,""))}for(let W of u2){let F=Z.get(W);if(F!==null)z.push(F.replace(/^Bearer\s+/i,""))}if(X.dispatch?.kind==="http-relay")z.push(X.dispatch.token);return[...new Set(z.filter(Boolean))]}var s1=new Set(["oauth-2025-04-20","claude-code-20250219",x$]);function a1(X){let Z=X.split(",").map((z)=>z.trim()).filter((z)=>z&&!s1.has(z));return I1(null,Z)}function t1(X){let Z=I2(X);if(!q2(Z))return X;let z=g1(Z.messages),W=Object.hasOwn(Z,"fallbacks"),{droppedMarkers:F}=k$(Z,!1),L=W&&!Object.hasOwn(Z,"fallbacks"),C=f1(Z);return z>0||F>0||L||C?JSON.stringify(Z):X}async function e1(X,Z){if(!(X instanceof Promise))return"settled";let z;try{return await Promise.race([X.then(()=>"settled"),new Promise((W)=>{z=setTimeout(()=>W("timed-out"),Z)})])}finally{if(z!==void 0)clearTimeout(z)}}function D2(X){let{source:Z,log:z}=X,W=Math.max(1,X.maxPendingSends??d1),F=X.attemptEndTimeoutMs??p1,L=X.requestGzipLatch??w1(D1(b1())),C=new WeakSet,T=new Map,K=new WeakMap,Y=new WeakMap,U=new WeakMap,H=new Map,V=new WeakMap,P=N$([]);P.dispose();let x=(Q)=>(Q&&H.get(Q)?.redactor)??P,q=(Q)=>{let N=H.get(Q);if(!N)return;H.delete(Q),N.redactor.dispose(),N.scope.dispose()},f=(Q,N,M,A)=>{let R=n1(N,A),w=L$(R,M);c.set(Q,M),H.set(Q,{sessionID:N.sessionID,redactor:N$(R),scope:w}),w.settled.then(()=>q(Q));while(H.size>W){let y=H.keys().next().value;if(y===void 0)break;q(y)}},c=new WeakMap,D=(Q,N)=>{let M=Q?c.get(Q):void 0;if(!M||!N.ok)return P.redactResponse(N);let A=L$([],M),R=A.redactResponse(N);return A.dispose(),R},r=(Q,N)=>{let M=Q?H.get(Q)?.scope:void 0;if(!M)return D(Q,N);try{return M.redactResponse(N)}catch{return D(Q,N)}},$2=!1,a=new Map,H2=new WeakMap,n=new WeakMap,J=new WeakMap,j=(Q)=>Q.agent==="cachekeep"||Q.agent==="prime",B=async()=>{try{if(Z.isDumpEnabled)return await Z.isDumpEnabled()}catch{return!1}try{return y1()}catch{return!1}},E=(Q)=>{a.delete(Q)},k=new WeakMap,I=(Q,N)=>{if(Q&&!N.ok)k.set(N.headers,Q);return N},h=(Q,N)=>{if(N.dispatch!=="http-relay")return!0;let M=/^req_[A-Za-z0-9_-]+$/.test(Q.get("request-id")??"");return Y.set(N,M),M},i=(Q)=>new I$(Q.sessionID,Q.kind),p=new Map,J2=async(Q,N)=>{if($2)throw new Y$(Q.sessionID,Q.kind);let M={revoked:!1},A=p.get(Q.sessionID);if(!A)A=new Set,p.set(Q.sessionID,A);A.add(M);let R=()=>{if($2||M.revoked)throw new Y$(Q.sessionID,Q.kind)};try{let w=await N(R);return R(),w}finally{let w=p.get(Q.sessionID);if(w?.delete(M)&&w.size===0)p.delete(Q.sessionID)}},g=(Q,N)=>{T.set(Q,N);while(T.size>W){let M=T.keys().next().value;if(M===void 0)break;T.delete(M),z?.warn("dropped the oldest pending Anthropic send to stay bounded",{bound:W})}},m=(Q,N)=>({providerID:Q.providerID,modelID:Q.modelID,sessionID:Q.sessionID,agent:Q.agent,kind:Q.kind,accountId:Q.accountId,attemptId:Q.attemptId,transport:Q.transport,route:N.route,provenance:N.provenance,dispatch:N.dispatch}),l=(Q)=>J2(Q,async(N)=>{let{accountId:M,...A}=Q,R;try{R=await Z.authorizeAccount(A,M)}catch(w){let y=i1(w);if(y)throw z?.warn("refused an Anthropic request: its account state was moved or could not be recorded",{error:y.cause instanceof Error?y.cause.name:""}),y;throw w}return N(),z2(A,R)}),z2=(Q,N)=>{if(!N)throw i(Q);if(N.dispatch?.kind==="websocket-relay")throw new w2;let M=N.dispatch?.kind==="http-relay"?"http-relay":"direct",A=N.dispatch?.kind==="http-relay"?{authorization:null,"x-api-key":null,"x-relay-token":N.dispatch.token}:void 0;if(N.route==="oauth"){if(!N.accessToken)throw i(Q);q1(N.accessToken,b2);let y=Object.freeze({route:"oauth",provenance:N.provenance,dispatch:M});g(y,{sessionID:Q.sessionID,oauth:{accessToken:N.accessToken,...N.identity?{identity:N.identity}:{}},dispatch:N.dispatch,oauthHeaders:N.headers});let s=Z$(N.headers);for(let d of u2)delete s[d];return delete s["anthropic-beta"],{headers:A??{...s,"x-api-key":null,authorization:`Bearer ${N.accessToken}`},attempt:y}}let R={authorization:null,"x-api-key":null,...Z$(N.headers)};if(!R.authorization&&!R["x-api-key"])throw i(Q);let w=Object.freeze({route:"api",provenance:N.provenance,dispatch:M});return g(w,{sessionID:Q.sessionID,...N.baseURL?{baseURL:N.baseURL}:{},dispatch:N.dispatch,apiHeaders:R}),{headers:A??R,attempt:w}},P2=(Q)=>J2(Q,(N)=>t(Q,N)),t=async(Q,N)=>{let{request:M,attempt:A}=Q,R=A.data,w=R?T.get(R):void 0;if(R)T.delete(R);if(!R||!w||R.route==="oauth"&&!w.oauth)throw i(Q);let y=new Headers(M.headers);S1(y);let s=E$(y),d=M.body===null?void 0:await M.text();N();let Y2=d!==void 0&&o1(M.url),Q2=w$(M.url,w.baseURL!==void 0?{baseURL:w.baseURL}:{}).url?.toString()??M.url;try{if(R.route==="oauth"&&w.oauth){q$(Q2);let{accessToken:X2,identity:e}=w.oauth;for(let[V2,o]of Object.entries(Z$(w.oauthHeaders))){if(u2.has(V2))continue;if(o===null)y.delete(V2);else y.set(V2,o)}let G2=null;if(d!==void 0&&Y2){let V2={...m(A,R),modelID:(()=>{let K2=I2(d);return P$(q2(K2)&&typeof K2.model==="string"?K2.model:Q.modelID)})(),route:"oauth",correlation:s},o=await Z.requestOptions?.(V2)??{};N(),d=await D$(d,{...o,...e?{identity:e}:{},sessionId:Q.sessionID,onToolNameMap:(K2)=>U.set(R,K2)});let M2=I2(d);G2=q2(M2)?M2:null}b$(y,X2,{body:G2,...e?{identity:e}:{},requestClass:A$(A.agent)?"auxiliary":"main"})}else{if(d!==void 0&&Y2)d=t1(d);y.delete("authorization"),y.delete("x-api-key");for(let[e,G2]of Object.entries(w.apiHeaders??{}))if(G2===null)y.delete(e);else y.set(e,G2);if(d!==void 0&&Y2&&!y.has("content-type"))y.set("content-type","application/json");let X2=y.get("anthropic-beta");if(X2!==null){let e=a1(X2);if(e)y.set("anthropic-beta",e);else y.delete("anthropic-beta")}}}catch(X2){let e=r1(X2);if(!e)throw X2;throw K.set(R,e.check),z?.warn("refused an Anthropic request locally; nothing was sent",{check:e.check}),e}let B2=d!==void 0?I2(d):void 0;if(await Z.admitRequest?.({...m(A,R),modelID:P$(q2(B2)&&typeof B2.model==="string"?B2.model:Q.modelID)}),E$(y),d!==void 0)y.delete("content-length");if(N(),f(R,w,q2(B2)&&B2.stream===!0?"event-stream":"http",y),R.route==="oauth"&&Y2&&d!==void 0)await Z.onRequestPrepared?.({...m(A,R),url:Q2,bodyText:d}),N();if(w.dispatch?.kind==="http-relay"){let X2=d??"";y.delete("x-relay-token");let e={protocol:1,type:"request",affinity:Q.sessionID,upstream:{url:Q2,method:M.method,headers:Object.fromEntries(y)},mode:"full_sync",revision:1,body:X2,next_hash:`sha256:${E1("sha256").update(X2).digest("hex")}`};if(Y2&&d!==void 0&&!j(A)){let G2=s[A2]==="1"?"start":void 0,V2=JSON.stringify(e);a.set(R,{affinity:Q.sessionID,route:Q.accountId,bodyText:X2,url:Q2,method:M.method,headers:new Headers(y),dispatch:"http-relay",relayUrl:w.dispatch.url,envelope:e,relayBytes:V2.length,...G2?{tag:G2}:{}})}else E(R);return new Request(w.dispatch.url,{method:"POST",headers:{"content-type":"application/json","x-relay-token":w.dispatch.token},redirect:"error",signal:M.signal,body:JSON.stringify(e)})}let T2=d;if(R.route==="oauth"&&Y2&&d!==void 0){let X2=await x1({url:Q2,body:d,latch:L});if(N(),X2.gzip)T2=await k1(d),y.set("content-encoding","gzip"),C.add(R),N()}if(Y2&&d!==void 0&&!j(A)){let X2=s[A2]==="1"?"start":void 0;a.set(R,{affinity:Q.sessionID,route:Q.accountId,bodyText:d,url:Q2,method:M.method,headers:new Headers(y),dispatch:"direct",...X2?{tag:X2}:{}})}else E(R);return new Request(Q2,{method:M.method,headers:y,redirect:R.route==="oauth"?"error":M.redirect,signal:M.signal,...T2!==void 0?{body:T2}:{}})};return{adapter:{providerID:b2,chooseAccount:(Q)=>J2(Q,async()=>{let N=await Z.chooseAccount(Q);if(typeof N==="object"&&Q.phase==="retry")return N;if(typeof N!=="string"||!N)throw i(Q);return N}),dropChoice:(Q)=>Z.dropChoice?.(Q),accountHeaders:l,rewriteRequest:P2,rewriteHandshakeURL(){throw new w2},async rewriteResponse({response:Q,attempt:N}){let M=N.data;if(M&&!h(Q.headers,M)){if(M)E(M);if(Q.status===401)return q(M),Q.body?.cancel().catch(()=>{}),Response.json({type:"error",error:{type:"api_error",message:"Relay authentication failed before Anthropic received the request"}},{status:502});return r(M,Q)}if(M&&C.has(M))C.delete(M),A1(Q).then((o)=>{if(!o)return;L.latchProcess(),z?.warn("gzipped request body rejected; later requests go uncompressed",{kind:o,status:Q.status})},()=>{});let A=null,R=M?a.get(M):void 0;if(M&&R){let o=!1;try{o=await B()}catch{o=!1}if(!o)E(M);else{try{C$(!0)}catch{}try{if(R.dispatch==="http-relay")A=await T$({affinity:R.affinity,transport:"http",protocol:1,mode:"full_sync",status:Q.status,bodyText:R.bodyText,payload:R.envelope??{},relayBytes:R.relayBytes??0,...R.tag?{tag:R.tag}:{}});else A=await F$({affinity:R.affinity,route:R.route,status:Q.status,bodyText:R.bodyText,url:R.url,method:R.method,headers:R.headers,...R.tag?{tag:R.tag}:{}})}catch{A=null}if(E(M),A){H2.set(M,A);try{await l2(A,{status:Q.status,message:null,complete:!1})}catch{}J.set(M,Promise.resolve())}}}let w=r(M,Q);if(M?.route!=="oauth"||!w.body)return I(M,w);let y={...m(N,M),status:Q.status},s=Z.responseOptions?.(y)??{},d=(Q.headers.get("content-type")??"").includes("application/json"),Y2={...s,toolNameMap:M?U.get(M):void 0,onToolNameRefusal:()=>{if(!M)return;K.set(M,"response_tool_names"),q(M)},laneStartOAuthServed:!0,...d?{responseMode:"json"}:{}};if(!M||!A)return I(M,J$(w,Y2));let Q2=A,B2=Q.status,T2=(o)=>{let K2=(J.get(M)??Promise.resolve()).then(()=>o().then(()=>{return})).catch(()=>{return});J.set(M,K2)},X2=s.onMessageStart,e=s.onMessageDelta,G2=s.onMessageResponse,V2=s.onStreamEnd;return I(M,J$(w,{...Y2,onMessageStart:(o)=>{try{X2?.(o)}catch{}try{n.set(M,{...o}),T2(()=>l2(Q2,{status:B2,message:o,complete:!1}))}catch{}},onMessageDelta:(o)=>{try{e?.(o)}catch{}try{let M2=n.get(M)??{},K2=M2.usage&&typeof M2.usage==="object"&&!Array.isArray(M2.usage)?M2.usage:{},g2={...M2,...o.usage?{usage:{...K2,...o.usage}}:{},...o.stopReason?{stop_reason:o.stopReason}:{}};T2(()=>l2(Q2,{status:B2,message:g2,complete:!0}))}catch{}},onMessageResponse:(o)=>{try{G2?.(o)}catch{}try{T2(()=>l2(Q2,{status:B2,message:o,complete:!0}))}catch{}},onStreamEnd:async()=>{try{await V2?.()}catch{}try{await(J.get(M)??Promise.resolve())}catch{}}}))},quotaFromHeaders(Q,N,M){let A=M.data;if(!A||!h(Q,A))return;return Z.quotaFromHeaders?.(Q,{...m(M,A),status:N})},async limitFromResponse({status:Q,headers:N,body:M,attempt:A}){let R=A.data;if(!R||K.get(R)==="response_tool_names")return;if(!h(N,R))return Z.limitFromRelayFailure?.({...m(A,R),status:Q});if(V.set(R,`provider responded with HTTP ${Q}`),!Z.limitFromResponse)return;let w=k.get(N)===R,y=x(R);return Z.limitFromResponse({...m(A,R),status:Q,headers:N,body:async()=>w?await M():y.redactText(await M())})},inspectEvent({data:Q,event:N,attempt:M}){if(M.data&&K.get(M.data)==="response_tool_names")return;let A=I2(Q);if(!q2(A))return;let R=typeof A.type==="string"?A.type:N;if(R==="content_block_start"||R==="content_block_delta")return{outputStarted:!0};if(R==="message_stop")return{done:!0};if(R!=="error")return;let w=M.data,y=x(w),s=q2(A.error)?A.error:{},d=typeof s.type!=="string"?void 0:O$.has(s.type)?s.type:y.redactText(s.type),Y2=typeof s.message==="string"?y.redactText(s.message):void 0;if(w?.dispatch==="http-relay"&&Y.get(w)===!1)return;let Q2=w?Z.limitFromStreamError?.({...m(M,w),errorType:d,message:Y2}):void 0,B2={error:[d??"error",Y2].filter(Boolean).join(": ").slice(0,c1),...Q2?{limit:Q2}:{}};if(w&&B2.error)V.set(w,B2.error);return B2},limitFromError(Q,N){let M=N.data;if(!M||K.has(M))return;let A={type:O$.has(Q.type)?Q.type:"provider_error",message:V.get(M)??"provider request failed",...Q.status!==void 0?{status:Q.status}:{}};if(q(M),M.dispatch==="http-relay"&&Y.get(M)===!1)return;return Z.limitFromHostError?.(A,m(N,M))},async onAttemptEnd(Q,N){let M=Q.data;if(!M)return;T.delete(M);let A=a.get(M);if(A){E(M);try{if(await B()){try{C$(!0)}catch{}try{if(A.dispatch==="http-relay"){if(N.status!==void 0)await T$({affinity:A.affinity,transport:"http",protocol:1,mode:"full_sync",status:N.status,bodyText:A.bodyText,payload:A.envelope??{},relayBytes:A.relayBytes??0,...A.tag?{tag:A.tag}:{}})}else await F$({affinity:A.affinity,route:A.route,status:N.status,error:N.status===void 0?l1:void 0,bodyText:A.bodyText,url:A.url,method:A.method,headers:A.headers,...A.tag?{tag:A.tag}:{}})}catch{}}}catch{}}let R=N.error?.reason;if(R==="cancelled"||R==="abandoned"||R===void 0&&(N.status===void 0||N.status<400))q(M);let w=K.get(M),{status:y,...s}=N,d=Z.onAttemptEnd?.(m(Q,M),{...s,...y!==void 0&&(M.dispatch!=="http-relay"||Y.get(M)===!0)?{status:y}:{},...w!==void 0?{localRefusal:{check:w}}:{}});if(await e1(d,F)==="timed-out")z?.warn("the account source did not finish recording a send",{timeoutMs:F})}},dispose(){$2=!0;for(let[Q,N]of p){for(let M of N)M.revoked=!0;Z.forgetSession?.(Q)}p.clear(),T.clear(),a.clear();for(let Q of[...H.keys()])q(Q)},forgetSession(Q){for(let N of p.get(Q)??[])N.revoked=!0;p.delete(Q);for(let[N,M]of T)if(M.sessionID===Q)T.delete(N);for(let[N,M]of[...H])if(M.sessionID===Q)q(N);for(let[N,M]of[...a])if(M.affinity===Q)a.delete(N);Z.forgetSession?.(Q)},get pendingSendCount(){return T.size},get heldCredentialCount(){let Q=0;for(let N of T.values())if(N.oauth)Q++;return Q},get heldRedactorCount(){return H.size},get operationsInProgress(){let Q=0;for(let N of p.values())Q+=N.size;return Q}}}function f2(X){return JSON.stringify([X.source,X.accountIdentity,X.credentialId,X.binding?.storageId,X.binding?.rowId,X.binding?.credentialEpoch])}var m$=Symbol.for("cortexkit.anthropic-auth.opencode2.cachekeep.v1");function l$(){let X=globalThis;return X[m$]??=new Map,X[m$]}function JX(X,Z){let z=new Map,W=new Map,F=new XX({directory:Z.registryDirectory||process.env.OPENCODE_ANTHROPIC_AUTH_CACHEKEEP_REGISTRY_DIR||ZX("opencode"),now:Z.now}),L=()=>{let V;for(let P of W.values())V=P;return V},C=Z.setIntervalImpl??globalThis.setInterval,T=new $X({loadStorage:async()=>{let V=L();return V?V.loadStorage():null},now:Z.now,setIntervalImpl:(V,P)=>C(()=>{let x=T.tick();return H.ticking=x.catch(()=>{h$.warn("cachekeep","tick failed")}),H.ticking},P),clearIntervalImpl:Z.clearIntervalImpl,onTrackedSessionsChanged:(V)=>F.publish(W.size===0?[]:V),prepareHeaders(V,P,x){let q=L();if(!q)return;return z.set(x.id,{target:P,attempt:x,lease:q}),new Headers({"x-native-cachekeep-attempt":String(x.id)})},fetchImpl:async(V,P)=>{let x=new Request(V,P),q=Number(x.headers.get("x-native-cachekeep-attempt")),f=z.get(q);if(z.delete(q),!f||f.lease.stopped)throw Error("CacheKeep attempt is unavailable");let c=f.lease.send(f.target,x,f.attempt.signal),D=c.then(()=>{},()=>{});return f.lease.inflight.add(D),D.then(()=>f.lease.inflight.delete(D)),c},onComplete:({attempt:V})=>{z.delete(V.id)}}),K,Y=()=>{if(K!==void 0)clearTimeout(K);K=void 0},U=()=>{if(Y(),W.size>0)return;let V=T.dropExpiredTargets();if(V===void 0){let x=l$();if(x.get(X)===H)x.delete(X);return}let P=Z.now?.()??Date.now();if(K=setTimeout(U,Math.max(0,V-P)),typeof K==="object"&&"unref"in K)K.unref()},H={manager:T,registry:F,prepared:z,leases:W,nextGeneration:0,retain(){T.stop(),z.clear(),U()},adopt(){if(Y(),T.dropExpiredTargets()===void 0)return;T.start(),F.publish(T.trackedSessions()).catch(()=>{h$.warn("cachekeep","failed to publish tracked sessions")})}};return H}function u$(X){let{runtime:Z,source:z}=X,W=new AbortController,F=l$(),L=F.get(X.storageId)??JX(X.storageId,X);F.set(X.storageId,L);let{manager:C,registry:T}=L,K=async(V,P,x)=>{let q=x?AbortSignal.any([W.signal,x]):W.signal;q.throwIfAborted();let f=JSON.parse(await P.text()),c={providerID:"anthropic",modelID:f.model,sessionID:`oc2-cachekeep:${V.id}`,agent:"cachekeep",kind:"generate"},D=D2({source:{...z,onRequestPrepared:void 0,responseOptions:void 0,async requestOptions(n){return{...await z.requestOptions?.(n),laneStart:!1,billingLineage:void 0,cacheDiagnosticsPreviousMessageId:void 0}},async authorizeAccount(n,J){let j=await Z.read();q.throwIfAborted();let B=j.accounts.find((k)=>k.id===J);if(B?.type!=="oauth"||f2(B)!==V.oauthAccountIdentity||V.isSubagent&&!V$(j.policyStorage)||!G$(j.policyStorage)||!g$(j.policyStorage,new Date(X.now?.()??Date.now())))return;let E=await z.authorizeAccount(n,J);if(E?.provenance.kind==="local"&&f2({...B,binding:E.provenance.subject.binding,accountIdentity:E.provenance.subject.binding.identity})!==V.oauthAccountIdentity)return;if(E?.provenance.kind==="vault"&&E.provenance.credentialId!==B.credentialId)return;return E},async admitRequest(n){await z.admitRequest?.(n);let J=await Z.read(),j=J.accounts.find((B)=>B.id===n.accountId);if(q.throwIfAborted(),!j||f2(j)!==V.oauthAccountIdentity||V.isSubagent&&!V$(J.policyStorage)||!G$(J.policyStorage)||!g$(J.policyStorage,new Date(X.now?.()??Date.now())))throw Error("CacheKeep policy changed before dispatch")}}}),r,$2,a=!1,H2=()=>D.forgetSession(c.sessionID);q.addEventListener("abort",H2,{once:!0});try{let n=(await Z.read()).accounts.find((I)=>f2(I)===V.oauthAccountIdentity)?.id;if(!n)throw Error("CacheKeep account is unavailable");let J=await D.adapter.accountHeaders({...c,accountId:n});if(!("headers"in J)||typeof J.headers!=="object"||J.headers===null||typeof J.attempt!=="object"||J.attempt===null||J.attempt.route!=="oauth")throw Error("CacheKeep authorization refused");r={...c,accountId:n,attemptId:crypto.randomUUID(),transport:"http",data:J.attempt};let j=await D.adapter.rewriteRequest?.({...c,accountId:n,attempt:r,request:new Request(V.url,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(f),signal:q})});if(!j)throw Error("CacheKeep rewrite refused");q.throwIfAborted();let B=await(X.fetch??fetch)(j),E=await D.adapter.rewriteResponse?.({...c,accountId:n,attempt:r,request:j,response:B});if(!E)throw Error("CacheKeep response rewrite refused");if($2=E.status,D.adapter.quotaFromHeaders?.(E.headers,E.status,r),!E.ok)await D.adapter.limitFromResponse?.({status:$2,headers:E.headers,body:()=>E.clone().text(),attempt:r});let k=await E.arrayBuffer();return a=!0,new Response(k,{status:$2,headers:E.headers})}catch{throw Error("Native CacheKeep was not completed")}finally{q.removeEventListener("abort",H2);try{if(r)await D.adapter.onAttemptEnd?.(r,{status:$2,outputStarted:!1,...a?{}:{error:{reason:"cancelled"}}})}finally{D.dispose(),z.forgetSession?.(c.sessionID)}}},Y={generation:L.nextGeneration++,stopped:!1,loadStorage:async()=>(await Z.read()).policyStorage,send:K,inflight:new Set},U=L.leases.size===0;if(L.leases.set(Y.generation,Y),U)L.adopt();let H;return{async track(V){if(Y.stopped||V.route!=="oauth"||V.agent==="cachekeep"||V.agent==="prime"||V.kind!=="primary")return;let P=await Z.read();if(Y.stopped||!G$(P.policyStorage))return;let x=!1;try{x=await X.isSubagent?.(V.sessionID)??!1}catch{return}if(Y.stopped||x&&!V$(P.policyStorage))return;let q=P.accounts.find((f)=>f.id===V.accountId);if(!q?.accountIdentity)return;if(V.provenance.kind==="local"&&JSON.stringify(q.binding)!==JSON.stringify(V.provenance.subject.binding))return;if(V.provenance.kind==="vault"&&q.credentialId!==V.provenance.credentialId)return;C.track({sessionId:V.sessionID,url:V.url,headers:new Headers,bodyText:V.bodyText,storage:P.policyStorage,cacheMode:"hybrid",oauthAccountId:V.accountId,oauthAccountIdentity:f2(q),isSubagent:x}),await T.publish(C.trackedSessions())},registry:T,dispose(){if(H)return H;Y.stopped=!0,W.abort();for(let[P,x]of L.prepared)if(x.lease===Y)L.prepared.delete(P);let V=L.leases.delete(Y.generation)&&L.leases.size===0;if(V)L.retain();return H=(async()=>{try{if(V)await L.ticking;await Promise.all(Y.inflight)}finally{if(V&&L.leases.size===0)await T.dispose()}})(),H}}}async function d$(X,Z,z){let W=D2(Z),F=[],L=async(V,P,x)=>{let q=await X.session.hook(V,P,x);return F.push(q),q},C=new AbortController,T;try{T=await X$({session:{hook:L},event:X.event},W.adapter,{logger:Z.log,gateOnPlaceholder:z})}catch(V){throw W.dispose(),await Promise.allSettled(F.map((P)=>P.dispose())),V}let K=(V)=>{W.forgetSession(V),T.forgetSession(V)},Y=X.event,U=Y?(async()=>{try{for await(let V of Y.subscribe({signal:C.signal}))if(V.type==="session.deleted")K(V.data.sessionID)}catch(V){if(!C.signal.aborted)Z.log?.warn("stopped listening for session deletion",{error:V instanceof Error?V.name:"unknown"})}})():Promise.resolve(),H;return{installation:T,forgetSession:K,dispose(){if(H)return H;return W.dispose(),C.abort(),H=(async()=>{await T.dispose(),await U})(),H}}}import{effectiveRelayTransport as p$,getQuotaCheckIntervalMs as YX,logger as GX,nativeAccountCanServe as VX,oauthProfileIsFresh as jX,quotaSnapshotCheckedAt as QX}from"@cortexkit/anthropic-auth-core";function c$(X,Z){let z=new AbortController,W,F=!1,L=async()=>{let K=await X.read();if(z.signal.throwIfAborted(),K.policyStorage.relay?.enabled===!0&&p$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="websocket")return;let Y=K,U=YX(Y.policyStorage);for(let H of Y.accounts){if(z.signal.aborted)return;if(!VX(H)||H.type!=="oauth")continue;if(Y.policyStorage.quota?.enabled!==!1&&Date.now()-QX(H.quota)>=U)await X.fetchQuota(H.id,Z,z.signal,void 0,"background").catch(()=>{});if(!jX(H.profile)&&!z.signal.aborted)await X.fetchProfile(H.id,Z,z.signal).catch(()=>{})}},C=()=>{if(F||W)return W;return W=L().catch(()=>{if(!z.signal.aborted)GX.debug("opencode2","native background readings did not complete")}).finally(()=>{W=void 0}),W},T=X.vault.watch({intervalMs:60000,onRefresh:C,shouldRefresh:async()=>{let K=await X.read();return K.policyStorage.relay?.enabled!==!0||p$(K.policyStorage.relay.transport,K.policyStorage.relay.url)==="http"}});return T.ready.catch(()=>{}),{async dispose(){F=!0,T.close(),z.abort(),await W}}}import{authorize as TX,buildCacheKeepStatusSummary as PX,buildClaudeQuotaSummary as CX,buildPrimeAccountStatuses as OX,buildPrimeStatusSummary as EX,CLAUSTRUM_OPENCODE_ENROLLMENT_NAME as RX,exchange as SX,formatNativeAccountState as qX,formatOAuthAccountTier as AX,getCacheKeepWindow as xX,getHostClaustrumEnrollmentPaths as kX,isCacheKeepAlways as bX,isCacheKeepHybridActive as wX,isCacheKeepPersistentlyEnabled as DX,nativeAccountCanServe as yX,resetClaustrumEnrollmentState as IX,setDumpEnabled as fX}from"@cortexkit/anthropic-auth-core";import{buildPrimeAccountStatuses as WX,effectiveRelayStatus as BX,formatNativeAccountState as UX,formatOAuthAccountTier as i$,getCacheKeepWindow as zX,getRoutingMode as KX,isCacheKeepAlways as MX,isCacheKeepHybridActive as HX,isPermanentRefreshError as _X,isPrimePersistentlyEnabled as NX,nativeAccountCanServe as n$,refreshBackoffActive as o$}from"@cortexkit/anthropic-auth-core";var r$=(X)=>n$(X)&&X.state!=="unsupported-access"?void 0:UX(X)||void 0,LX=(X)=>{if(X.source!=="vault")return"off";if(X.state==="needs_reauth")return"on-vault-reauth";return n$(X)?"on-vault-served":"on-cold"},FX=(X,Z)=>typeof X==="number"&&X>Z;function s$(X,Z){let{now:z}=Z,W=X.policyStorage,F=X.accounts.filter((U)=>U.type==="oauth"),L=F.find((U)=>U.id==="main"),C=L?r$(L):void 0,T=L?.lastQuotaRefreshError?.nextRetryAt,K=L?.lastRefreshError,Y=zX(W);return{main:{quota:L?.quota??null,enabled:L?.enabled,tierLabel:i$(L?.profile),quotaBackedOff:FX(T,z),quotaBackoffUntil:T,refreshBackedOff:o$(K,L?.accountIdentity,z,void 0),refreshBackoffUntil:K?.nextRetryAt,stateLine:C,quotaDated:Boolean(C)},fallbacks:F.filter((U)=>U.id!=="main"&&(U.enabled||U.source==="vault")).map((U)=>{let H=r$(U),V=LX(U);return{id:U.id,label:U.label,quota:U.quota??null,enabled:U.enabled,tierLabel:i$(U.profile),needsReauth:_X(U.lastRefreshError)&&o$(U.lastRefreshError,U.accountIdentity,z,void 0),...V==="on-vault-reauth"?{vaultReauth:!0}:{},...V==="on-vault-served"?{vaultServed:!0}:{},...V!=="off"?{custodyState:V}:{},stateLine:H,quotaDated:Boolean(H)}}),...Z.activeId!==void 0&&{activeId:Z.activeId},route:KX(W),relay:BX(W.relay),fastMode:W.claudeFast?.enabled===!0,cacheKeep:{enabled:HX(W),...MX(W)?{window:"always"}:Y&&{window:`${Y.startHour}-${Y.endHour}`},trackedSessions:Z.trackedSessions},prime:NX(W)?{enabled:!0,accounts:WX(W,{now:z})}:void 0,lastUpdated:z}}var j$=(X)=>X!==null&&typeof X==="object"&&!Array.isArray(X)?X:{},a$=`For first-time model access, connect Anthropic with "${i2}".
+Run: opencode auth login anthropic --method ${c2}`,t$=(X)=>X.mode==="local"&&!X.accounts.some((Z)=>Z.id==="main"),vX=(X)=>{let Z=X.id==="main"?"main":"fallback",z=`${X.enabled?"enabled":"disabled"}, ${X.type}, ${X.source}${X.state?`, ${qX(X)}`:""}`;if(X.label)return`${X.label} [${Z}]: ${z}
+  Route: ${X.id}`;return`${Z==="main"?"Main account":`Fallback ${X.id}`}: ${z}`};function $1(X){let{runtime:Z,source:z}=X,W=new Map,F=!1,L=async(Y,U)=>{await Z.updateSettings((H)=>({...H,[Y]:{...j$(H[Y]),...U}}))},C=()=>({ok:!0,text:"Native Claude settings updated."}),T=async(Y,U)=>{if(F)throw Error("Native menu is closed");switch(U.signal?.throwIfAborted(),Y.action){case"enable":case"disable":return await Z.setEnabled(Y.values.id,Y.action==="enable"),C();case"remove":return await Z.remove(Y.values.id),C();case"move-up":case"move-down":{let V=(await Z.read()).accounts.map((c)=>c.id),P=V.indexOf(Y.values.id),x=P+(Y.action==="move-up"?-1:1);if(P<0||x<0||x>=V.length)return{ok:!1,text:"Account cannot move in that direction."};let q=V[P],f=V[x];if(q===void 0||f===void 0)return{ok:!1,text:"Account order changed."};return V[P]=f,V[x]=q,await Z.reorder(V),C()}case"add-apikey":return await Z.addApi(Y.values),{ok:!0,text:"API route stored in the native account pool."};case"add-oauth-start":{let H=new AbortController;W.get(Y.sessionId)?.active.abort();let V={active:H,auth:void 0};W.set(Y.sessionId,V);let P=await TX("max");if(F||H.signal.aborted||U.signal?.aborted)return{ok:!1,text:"Sign-in cancelled."};return V.auth=P,{ok:!0,text:`Open ${P.url} and paste the returned code using Finish OAuth sign-in.`}}case"add-oauth-finish":{let H=W.get(Y.sessionId);if(!H?.auth)return{ok:!1,text:"Start OAuth sign-in in this session first."};let V=await SX(Y.values.code,H.auth.verifier,H.auth.redirectUri,H.auth.state);if(H.active.signal.throwIfAborted(),U.signal?.throwIfAborted(),F||V.type!=="success")return{ok:!1,text:"OAuth sign-in did not complete."};if(await Z.loginOAuth({routeId:crypto.randomUUID(),credential:{access:V.access,refresh:V.refresh,expires:V.expires},label:Y.values.label}),H.active.signal.throwIfAborted(),U.signal?.throwIfAborted(),F)return{ok:!1,text:"Sign-in cancelled."};W.delete(Y.sessionId);let P="OAuth account stored in the native account pool.";return{ok:!0,text:t$(await Z.read())?`${P}
 
-${l$}
+${a$}
 
-Adding an account here does not change OpenCode's Anthropic connection.`:E}}case"reset-backoff":{let B=await Z.read();for(let K of B.accounts){if(U.signal?.throwIfAborted(),K.type!=="oauth")continue;let E=K.source==="vault"?await Z.authorizeVault(K.id,U.signal):await Z.captureLocalSubject(K.id);await Z.resetBackoff(K.id,E)}return C()}case"enrollment-reset":{let B=await TX(NX("opencode"),HX);return{ok:B==="reset",text:B==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":B==="refused-pending"?"An enrollment request may still be in progress. Quit OpenCode and run setup again; it picks up the same request.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let K=(await Z.read()).accounts.filter((A)=>A.type==="oauth"&&PX(A)),E=await Promise.allSettled(K.map((A)=>Z.fetchQuota(A.id,void 0,U.signal)));return{ok:E.every((A)=>A.status==="fulfilled"),text:`${E.filter((A)=>A.status==="fulfilled").length}/${K.length} native quota readings refreshed.`}}case"routing-reset":return await z.resetRouting(Y.sessionId),C();case"routing-mode":return await L("routing",{mode:Y.values.mode}),C();case"killswitch-on":case"killswitch-off":return await L("killswitch",{enabled:Y.action==="killswitch-on"}),C();case"killswitch-set":return await Z.updateSettings((B)=>{let K=$$(B.killswitch),E={...$$(K.accounts)},k=K.main;for(let A of Y.values.entries){let h={five_hour:A.fh,seven_day:A.sd,...A.scoped!==void 0?{scoped:A.scoped}:{}};if(A.account==="main"||A.account==="all")k=h;if(A.account==="all")for(let y of Object.keys(E))E[y]=h;else if(A.account!=="main")E[A.account]=h}return{...B,killswitch:{...K,main:k,accounts:E}}}),C();case"cache-on":case"cache-off":return await L("claudeCache",{enabled:Y.action==="cache-on"}),C();case"cache-mode":return await L("claudeCache",{mode:Y.values.mode}),C();case"cachekeep-always":return await L("cacheKeep",{enabled:!0,always:!0}),C();case"cachekeep-off":return await L("cacheKeep",{enabled:!1}),C();case"cachekeep-window":return await L("cacheKeep",{enabled:!0,always:!1,startHour:Y.values.startHour,endHour:Y.values.endHour}),C();case"cachekeep-subagents":return await L("cacheKeep",{subagents:Y.values.enabled==="on"}),C();case"dump-on":case"dump-off":return await L("dump",{enabled:Y.action==="dump-on"}),C();case"logging-level":return await L("logging",{level:Y.values.level}),C();case"fast-on":case"fast-off":return await L("claudeFast",{enabled:Y.action==="fast-on"}),C();case"prime-on":case"prime-off":return await L("prime",{enabled:Y.action==="prime-on"}),C();case"start-fire":return await M(Y.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},M=(Y)=>X.start(Y,g2);return{dispatch:P,async readStatus(Y){let U=await Z.read();if(Y==="account"){let K=U.accounts.map(EX).join(`
-`)||"No native Claude accounts.";return d$(U)?`${K}
+Adding an account here does not change OpenCode's Anthropic connection.`:P}}case"reset-backoff":{let H=await Z.read();for(let V of H.accounts){if(U.signal?.throwIfAborted(),V.type!=="oauth")continue;let P=V.source==="vault"?await Z.authorizeVault(V.id,U.signal):await Z.captureLocalSubject(V.id);await Z.resetBackoff(V.id,P)}return C()}case"enrollment-reset":{let H=await IX(kX("opencode"),RX);return{ok:H==="reset",text:H==="reset"?"Terminal enrollment state reset. Run offline setup to reconnect.":H==="refused-pending"?"An enrollment request may still be in progress. Quit OpenCode and run setup again; it picks up the same request.":"Only terminal enrollment state may be reset; active enrollment was left unchanged."}}case"quota-refresh":{let V=(await Z.read()).accounts.filter((q)=>q.type==="oauth"&&yX(q)),P=await Promise.allSettled(V.map((q)=>Z.fetchQuota(q.id,void 0,U.signal)));return{ok:P.every((q)=>q.status==="fulfilled"),text:`${P.filter((q)=>q.status==="fulfilled").length}/${V.length} native quota readings refreshed.`}}case"routing-reset":return await z.resetRouting(Y.sessionId),C();case"routing-mode":return await L("routing",{mode:Y.values.mode}),C();case"killswitch-on":case"killswitch-off":return await L("killswitch",{enabled:Y.action==="killswitch-on"}),C();case"killswitch-set":return await Z.updateSettings((H)=>{let V=j$(H.killswitch),P={...j$(V.accounts)},x=V.main;for(let q of Y.values.entries){let f={five_hour:q.fh,seven_day:q.sd,...q.scoped!==void 0?{scoped:q.scoped}:{}};if(q.account==="main"||q.account==="all")x=f;if(q.account==="all")for(let c of Object.keys(P))P[c]=f;else if(q.account!=="main")P[q.account]=f}return{...H,killswitch:{...V,main:x,accounts:P}}}),C();case"cache-on":case"cache-off":return await L("claudeCache",{enabled:Y.action==="cache-on"}),C();case"cache-mode":return await L("claudeCache",{mode:Y.values.mode}),C();case"cachekeep-always":return await L("cacheKeep",{enabled:!0,always:!0}),C();case"cachekeep-off":return await L("cacheKeep",{enabled:!1}),C();case"cachekeep-window":return await L("cacheKeep",{enabled:!0,always:!1,startHour:Y.values.startHour,endHour:Y.values.endHour}),C();case"cachekeep-subagents":return await L("cacheKeep",{subagents:Y.values.enabled==="on"}),C();case"dump-on":case"dump-off":{let H=Y.action==="dump-on";await L("dump",{enabled:H});try{fX(H)}catch{}return C()}case"logging-level":return await L("logging",{level:Y.values.level}),C();case"fast-on":case"fast-off":return await L("claudeFast",{enabled:Y.action==="fast-on"}),C();case"prime-on":case"prime-off":return await L("prime",{enabled:Y.action==="prime-on"}),C();case"start-fire":return await K(Y.sessionId),{ok:!0,text:"Claude lane start queued in this session."}}},K=(Y)=>X.start(Y,p2);return{dispatch:T,async readStatus(Y){let U=await Z.read();if(Y==="account"){let V=U.accounts.map(vX).join(`
+`)||"No native Claude accounts.";return t$(U)?`${V}
 
-${l$}
-Quota refresh checks the pool; it does not check OpenCode's Anthropic connection.`:K}if(Y==="quota")return QX({accounts:U.accounts.filter((K)=>K.type==="oauth").map((K)=>({name:K.label??K.id,role:K.id==="main"?"main":"fallback",enabled:K.enabled,quota:K.quota,tierLabel:zX(K.profile),lastRefreshedAt:K.lastRefreshedAt,error:K.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(Y==="prime")return UX({enabled:U.policyStorage.prime?.enabled===!0,accounts:BX(U.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");if(Y==="cachekeep"){let K=await X.cacheKeepRegistry?.list()??[];return WX({enabled:CX(U.policyStorage),always:FX(U.policyStorage),hybridActive:LX(U.policyStorage),trackedSessionDetails:K,window:_X(U.policyStorage),trackedSessions:K.length,nextPrewarmAt:K.length?Math.min(...K.map((E)=>E.nextPrewarmAt)):void 0})}let B={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(U.settings[B[Y]]??{})},async readSidebar(Y){let[U,B]=await Promise.all([Z.read(),X.cacheKeepRegistry?.list()??[]]);return u$(h$(U,{activeId:z.servedAccount(Y),trackedSessions:B.length,now:Date.now()}))},forgetSession(Y){W.get(Y)?.active.abort(),W.delete(Y)},close(){N=!0;for(let Y of W.values())Y.active.abort();W.clear()}}}import{resolveClaudeModelCapabilities as OX}from"@cortexkit/anthropic-auth-core";function c$(){let X=new Map;return{install:(z)=>z.model.transform((W)=>{X.clear();for(let N of W.list("anthropic")){X.set(String(N.id),String(N.modelID));let L=OX(N.modelID)?.efforts.variants;if(!L)continue;W.update("anthropic",String(N.id),(C)=>{let P=C.variants.filter((M)=>!L.some((Y)=>Y===String(M.id)));C.variants=[...P,...L.map((M)=>({id:M,settings:{effort:M,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(z)=>X.get(z)??z}}function i$(X){return X.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??X.get("x-api-key")??void 0}import{buildPrimeRequestBody as o$,effectiveRelayTransport as n$,nativeAccountCanServe as SX,PrimeManager as RX,tokenFingerprint as r$}from"@cortexkit/anthropic-auth-core";var s$=(X)=>X!==null&&typeof X==="object"&&!Array.isArray(X)?X:{};function a$(X){let{runtime:Z,source:z}=X,W=new AbortController,N=new Set,L=(M)=>({providerID:"anthropic",modelID:o$().model,sessionID:`oc2-prime:${M}`,agent:"prime",kind:"generate"}),C=async(M)=>{let Y=L(M),U=S2({source:z}),B=performance.now();try{for(let K=0;K<3;K++){if(W.signal.throwIfAborted(),(await Z.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let k=await U.adapter.accountHeaders({...Y,accountId:M});if(!("headers"in k)||typeof k.headers!=="object"||k.headers===null||typeof k.attempt!=="object"||k.attempt===null)throw Error("Native Prime authorization refused");let A={...Y,accountId:M,attemptId:crypto.randomUUID(),transport:"http",data:k.attempt},h,y=!1,c=!1,s=(t)=>{c=!0,t.body?.cancel().catch(()=>{})};try{let t=await U.adapter.rewriteRequest?.({...Y,accountId:M,attempt:A,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(o$()),signal:W.signal})});if(!t)throw Error("Native Prime rewrite refused");let a=new Headers(t.headers);for(let[d,l]of Object.entries(k.headers))if(l===null)a.delete(d);else a.set(d,l);let J=new Request(t,{headers:a}),Q=await(X.fetch??fetch)(J),V=await U.adapter.rewriteResponse?.({...Y,accountId:M,request:J,response:Q,attempt:A})??Q;h=V.status,U.adapter.quotaFromHeaders?.(V.headers,V.status,A);let R=V.ok?void 0:await U.adapter.limitFromResponse?.({status:V.status,headers:V.headers,body:()=>V.clone().text(),attempt:A});if(R&&/^(vault-newer|local-newer|relay-direct):/.test(R.reason)&&K<2){s(V);let d={...Y,phase:"retry",rerouteFrom:{accountId:M,limit:R}};if(await z.chooseAccount(d)!==M)throw Error("Native Prime retry changed account");continue}if(!V.ok)return s(V),{ok:!1,status:h,ms:performance.now()-B,error:"Native Prime upstream refused the request"};let O=s$(await V.json()),b=s$(O.usage),I={inputTokens:typeof b.input_tokens==="number"?b.input_tokens:void 0,outputTokens:typeof b.output_tokens==="number"?b.output_tokens:void 0};if(A.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(V.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(y=await z.recordPrime(k.attempt.provenance,I),!y)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:h,ms:performance.now()-B,usage:I}}finally{await U.adapter.onAttemptEnd?.(A,{status:h,outputStarted:!1,...y?{}:{error:{reason:c?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-B}}finally{U.dispose()}},P=new RX({storagePath:X.paths.legacyConfig,loadStorage:async()=>(await Z.read()).policyStorage,async getAccountFingerprint(M){let Y=await Z.read(),U=Y.accounts.find((E)=>E.id===M);if(!SX(U)||U?.type!=="oauth")return;if(Y.policyStorage.relay?.enabled===!0&&n$(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")return;if(U.source==="vault"){let E=await Z.authorizeVault(M,W.signal),k=await Z.getOrCreateAuthLineage(M,E);return k?r$(k):void 0}let B=await Z.authorizeLocal(M,{signal:W.signal});if(B.status!=="usable")return;let K=await Z.getOrCreateAuthLineage(M,B.subject);return K?r$(K):void 0},async refreshQuota(M){let Y=await Z.read();if(Y.policyStorage.relay?.enabled===!0&&n$(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await Z.fetchQuota(M,X.fetch,W.signal),fresh:!0}},sendPrime(M){let Y=C(M);return N.add(Y),Y.finally(()=>N.delete(Y)),Y},async recordSuccess(M){let Y=(await Z.read()).accounts.find((U)=>U.id===M);if(!Y?.prime)throw Error("Native Prime counters are unavailable");return Y.prime}});return P.start(),{manager:P,async dispose(){P.stop(),W.abort(),await Promise.allSettled(N)}}}import{createNativeUsagePublisher as xX,decideStickyQuotaFailure as AX,effectiveRelayTransport as qX,getClaudeCodeIdentityForVerifiedAccount as h2,getQuotaCheckIntervalMs as kX,getRoutingMode as Y$,isQuotaBearingHeaderFrame as bX,logger as DX,mergeHeaderQuotaForPersistence as wX,NativeVaultNoAccountError as yX,nativeAccountCanServe as X$,nativeAccountPolicy as l2,nativeLocalQuotaLineage as IX,nativePollQuotaGenerallyExhausted as fX,normalizeQuotaHeaders as gX,quotaSnapshotCheckedAt as t$,quotaSnapshotHasStandardWindows as vX,readNativeAccountsForRequest as mX,remapModelId as Z$,StickySessionRouter as hX,shouldFallbackStatus as lX,stickyQuotaSnapshotIsFresh as D2,stickyRetryAfterWithJitter as dX,stickyRouteFamilyForModel as uX}from"@cortexkit/anthropic-auth-core";var J$=(X)=>["five_hour","seven_day"].some((Z)=>(X?.[Z]?.remainingPercent??1)<=0);function pX(X,Z,z,W){let N=X.rerouteFrom;if(X.phase!=="retry"||N?.limit.status!==429||Y$(Z.policyStorage)!=="sticky-balanced")return;let L=z.find((P)=>P.id===N.accountId);if(!L||!D2(L.quota,Z.policyStorage,Date.now(),W))return;let C=AX({quota:L.quota,modelId:W});if(C.action!=="hold")return;return{hold:{delayMs:dX(X.sessionID,C.retryAfterSeconds)*1000}}}function $1(X){let{runtime:Z}=X,z=xX("native-auth"),W=new Map,N=(J)=>{let Q=J.routingPath;if(!Q)throw Error("Native routing storage is unavailable");let V=W.get(Q);if(!V)V=new hX({path:Q,vaultSeed:J.routingSeed,onLockEvent:Z.onLockEvent,localRecoveryPath:J.mode==="local"?J.routingRecoveryPath:void 0}),W.set(Q,V);return V.setVaultSeed(J.routingSeed),V},L=new WeakMap,C=new Map,P=new Map,M=new Map,Y=new Map,U=new WeakSet,B=!1,K=()=>{while(C.size>512){let J=C.keys().next();if(!J.done)C.delete(J.value)}},E=(J,Q)=>JSON.stringify([J.sessionID,J.kind,J.modelID,Q]),k=(J)=>{if(B)throw Error("Native Anthropic source is closed");let Q=M.get(J.sessionID);if(!Q){Q=new AbortController,M.set(J.sessionID,Q);while(M.size>512){let V=M.keys().next();if(!V.done)a.forgetSession?.(V.value)}}return Q},A=(J,Q,V)=>X$(J)&&(J.type==="api"||l2(J,Q,Z$(V)).status==="allowed"),h=async(J,Q,V,R)=>{let O=await Z.read();R.signal.throwIfAborted(),y(O);let b=O.accounts.find((I)=>I.id===J);if(!b||b.type!==V||!A(b,O,Q))return!1;if(V==="api"){let I=O.accounts.find((d)=>d.id==="main"&&d.type==="oauth");return!!I&&D2(I.quota,O.policyStorage)&&J$(I.quota)}return!0},y=(J)=>{let Q=J.policyStorage.relay;if(Q?.enabled===!0&&qX(Q.transport,Q.url)==="websocket")throw new O2},c=async(J,Q)=>{if(y(J),Q||J.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let V=await Z.getRelayConfig();if(!V)throw Error("request refused: native HTTP relay configuration is unavailable");if(V.transport!=="http")throw new O2;return{dispatch:{kind:"http-relay",url:V.url,token:V.token},relayFallback:V.fallbackToDirect}};async function s(J,Q,V){if(J.kind==="local"){let R=await Z.publishLocal(J.subject,V);if(!R&&V.quota)DX.warn("quota","Quota publication discarded");return R}if(J.kind==="vault"&&Q.receipt)await Z.vault.publish(Q.receipt,V);else if(J.kind==="api"&&V.lastUsed!==void 0)await Z.publishApi(J.subject,{lastUsed:V.lastUsed});return!0}function t(J,Q,V){if(J.kind!=="local")return;let R=J.subject.binding,O=t$(V),b={lineage:IX(R),accountUuid:R.identity,entry:{quota:V,checkedAt:O,refreshAfter:O},generalExhausted:fX(V),routeBeforeSave:!0};return Z.quotaObservations.hold(Q.account.id,b)?b:void 0}let a={async chooseAccount(J){let Q=k(J);X.onOwnedRequest?.();let V=await Z.read();Q.signal.throwIfAborted(),y(V);let R=Z$(await X.resolveModelId?.(J)??J.modelID);if(Q.signal.throwIfAborted(),V.mode==="claustrum")V=await mX(Z,Q.signal),Q.signal.throwIfAborted();if(V.policyStorage.quota?.enabled!==!1){let v=!1;for(let i of V.accounts){if(!X$(i)||i.type!=="oauth")continue;if(vX(i.quota)?D2(i.quota,V.policyStorage,Date.now(),R):Date.now()-t$(i.quota)<kX(V.policyStorage))continue;try{await Z.fetchQuota(i.id,X.fetch,Q.signal,void 0,"admission"),v=!0}catch{Q.signal.throwIfAborted()}}if(v)V=await Z.read();Q.signal.throwIfAborted()}let O=J.rerouteFrom?C.get(J.rerouteFrom.limit.reason):void 0;if(J.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(J.rerouteFrom.limit.reason)&&!O)return;if(O&&J.rerouteFrom){let v=V.accounts.find((H)=>H.id===O.accountId);if(!v||!A(v,V,R))return;C.delete(J.rerouteFrom.limit.reason);let i=E(J,O.accountId),G=P.get(i)??[];return G.push(O),P.set(i,G),O.accountId}let b=[];for(let v of V.accounts){if(v.type!=="oauth"||!A(v,V,R))continue;if(v.source==="local"){let i=await Z.authorizeLocal(v.id,{signal:Q.signal,policy:(G,H)=>l2(G,H,R)});if(Q.signal.throwIfAborted(),i.status!=="usable")continue}b.push(v)}let I=pX(J,V,b,R);if(I)return I;let d=b.filter((v)=>v.id!==J.rerouteFrom?.accountId);if(Y$(V.policyStorage)==="sticky-balanced"){let v=d.map((G,H)=>({accountId:G.id,order:H,quota:G.quota??{kind:"unknown"}})),i=await N(V).resolve({sessionId:J.sessionID,family:uX(R),modelId:R,affinityModelId:J.modelID,candidates:v,retainAccountIds:new Set(d.map((G)=>G.id)),...V.mode==="claustrum"?{accountIdentities:new Map(V.accounts.flatMap((G)=>G.accountIdentity?[[G.id,G.accountIdentity]]:[]))}:{},storage:V.policyStorage,inputBytes:1,preferredAccountId:J.previousAccountId,preserveOnNoCandidate:!0});if(Q.signal.throwIfAborted(),i)return i.accountId}else{let i=Y$(V.policyStorage)==="fallback-first"?[...d.filter((G)=>G.id!=="main"),...d.filter((G)=>G.id==="main")]:[...d.filter((G)=>G.id==="main"),...d.filter((G)=>G.id!=="main")];if(i[0])return i[0].id}if(V.mode==="claustrum")throw new yX;let l=V.accounts.find((v)=>v.id==="main"&&v.type==="oauth");if(!l)return;let r=l.quota;if(J.rerouteFrom?.limit.status===429||!D2(r,V.policyStorage))try{r=await Z.fetchQuota("main",X.fetch,Q.signal)}catch{return}if(Q.signal.throwIfAborted(),!J$(r))return;return V.accounts.find((v)=>v.type==="api"&&X$(v)&&v.id!==J.rerouteFrom?.accountId)?.id},dropChoice(J){let Q=E(J,J.accountId),V=P.get(Q);if(V?.shift(),V?.length===0)P.delete(Q)},async authorizeAccount(J,Q){let V=k(J),R=await Z.read();V.signal.throwIfAborted(),y(R);let O=Z$(await X.resolveModelId?.(J)??J.modelID);V.signal.throwIfAborted();let b=R.accounts.find((x)=>x.id===Q);if(!b||!A(b,R,O))return;let I=E(J,Q),d=P.get(I),l=d?.shift();if(d?.length===0)P.delete(I);let{dispatch:r,relayFallback:v}=await c(R,l?.direct===!0);if(V.signal.throwIfAborted(),l?.auth){if(!await h(Q,O,l.auth.route,V))return;let x=L.get(l.auth.provenance);if(x?.receipt?.expiresAtMs!==void 0&&x.receipt.expiresAtMs!==null&&x.receipt.expiresAtMs<Date.now()+300000)return;if(x)L.set(l.auth.provenance,{...x,scope:{...J,modelID:O},account:b,active:V,relayFallback:v});return Y.set(J.sessionID,Q),{...l.auth,dispatch:r}}let i={scope:{...J,modelID:O},active:V,account:b,retry:l?.retry??!1,relayFallback:v,quota:b.quota};if(b.type==="api"){let x=R.accounts.find((p)=>p.id==="main"&&p.type==="oauth");if(!x||!D2(x.quota,R.policyStorage)||!J$(x.quota))return;let q=await Z.authorizeApi(Q,V.signal);if(V.signal.throwIfAborted(),!await h(Q,O,"api",V))return;let w={kind:"api",subject:q.subject};return L.set(w,i),Y.set(J.sessionID,Q),{route:"api",headers:q.authHeader==="authorization-bearer"?{authorization:`Bearer ${q.apiKey}`}:{"x-api-key":q.apiKey},baseURL:q.baseURL,provenance:w,dispatch:r}}if(b.source==="vault"){let x=await Z.authorizeVault(Q,V.signal);if(V.signal.throwIfAborted(),!await h(Q,O,"oauth",V))return;let q={kind:"vault",credentialId:x.credentialId,recordVersion:x.recordVersion};L.set(q,{...i,receipt:x});let w=x.assertedAccountIdentity;if(!w)return;return Y.set(J.sessionID,Q),{route:"oauth",accessToken:x.accessToken,provenance:q,dispatch:r,identity:h2(w,w)}}let G=await Z.authorizeLocal(Q,{signal:V.signal,policy:(x,q)=>l2(x,q,O)});if(V.signal.throwIfAborted(),G.status!=="usable")return;if(!await h(Q,O,"oauth",V))return;let H={kind:"local",subject:G.subject};L.set(H,{...i,access:G.access}),Y.set(J.sessionID,Q);let F=G.subject.binding.identity;return{route:"oauth",accessToken:G.access,provenance:H,dispatch:r,identity:h2(F,F)}},async requestOptions(J){let Q=k(J),V=await Z.read();Q.signal.throwIfAborted();let R=V.accounts.find((b)=>b.id===J.accountId);if(!R||!A(R,V,J.modelID))throw Error("request refused: native account is ineligible for this model");let O=L.get(J.provenance);if(O)L.set(J.provenance,{...O,scope:{...O.scope,modelID:J.modelID}});return X.requestOptions(J,V)},async admitRequest(J){let Q=L.get(J.provenance);if(!Q||!await h(J.accountId,J.modelID,J.route,Q.active))throw Error("request refused: native account policy changed before dispatch");L.set(J.provenance,{...Q,scope:{...Q.scope,modelID:J.modelID}})},onRequestPrepared:(J)=>X.onRequestPrepared?.(J),responseOptions(J){return X.responseOptions?.({...J,modelID:L.get(J.provenance)?.scope.modelID??J.modelID})},quotaFromHeaders(J,Q){let V=L.get(Q.provenance),R=e$(J);if(R)X.onRequestId?.(Q,R);if(!V||Q.route!=="oauth"||!bX(J))return;let O=Q.provenance.kind==="local"?Q.provenance.subject.binding.identity:V.receipt?.assertedAccountIdentity,b={...gX(J),...O?{accountIdentity:O}:{}},I=wX(V.quota,b);V.quota=I;let d=t(Q.provenance,V,I),l=V.account.id,r=()=>{if(d)Z.quotaObservations.forget(l,d)};return z.observe(s(Q.provenance,V,{quota:I}).then((v)=>{if(!v)r()},(v)=>{throw r(),v})),b},async limitFromResponse(J){let Q=L.get(J.provenance);if(!Q)return;if(J.status===401&&Q.receipt){if(!U.has(Q.receipt))U.add(Q.receipt),await Z.vault.reportFailure(Q.receipt,401,J.dispatch==="http-relay"?"relay_status_field":"direct");if(Q.retry||Q.active.signal.aborted)return;let R=Q.active,O=await Z.vault.prepareRetry(Q.receipt,R.signal);if(R.signal.throwIfAborted(),!O.retry)return;let b=O.receipt,I=b.assertedAccountIdentity;if(!I)return;let d={kind:"vault",credentialId:b.credentialId,recordVersion:b.recordVersion};L.set(d,{...Q,receipt:b,retry:!0});let l=`vault-newer:${J.attemptId}`;return C.set(l,{sessionID:J.sessionID,accountId:J.accountId,retry:!0,auth:{route:"oauth",accessToken:b.accessToken,provenance:d,identity:h2(I,I)}}),K(),{reason:l,status:401}}if(J.status===401&&J.provenance.kind==="local"&&Q.access&&!Q.retry){if(Q.active.signal.aborted)return;let R=Q.active,O=await Z.authorizeLocal(J.accountId,{rejectedAccessToken:Q.access,signal:R.signal,policy:(l,r)=>l2(l,r,Q.scope.modelID)});if(R.signal.throwIfAborted(),O.status!=="usable"||O.access===Q.access)return;let b={kind:"local",subject:O.subject};L.set(b,{...Q,access:O.access,retry:!0});let I=O.subject.binding.identity,d=`local-newer:${J.attemptId}`;return C.set(d,{sessionID:J.sessionID,accountId:J.accountId,retry:!0,auth:{route:"oauth",accessToken:O.access,provenance:b,identity:h2(I,I)}}),K(),{reason:d,status:401}}let V=await Z.read();if(lX(J.status,V.policyStorage))return{reason:`provider-${J.status}`,status:J.status};return},limitFromRelayFailure(J){let Q=L.get(J.provenance);if(!Q?.relayFallback||Q.active.signal.aborted||!(J.status===401||J.status>=500))return;let V=`relay-direct:${J.attemptId}`;return C.set(V,{sessionID:J.sessionID,accountId:J.accountId,direct:!0,retry:!1}),K(),{reason:V}},limitFromStreamError(J){return J.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(J,Q){let V=L.get(Q.provenance);if(Q.dispatch==="http-relay"&&V?.relayFallback&&!V.active.signal.aborted&&J.status===void 0){let R=`relay-direct:${Q.attemptId}`;return C.set(R,{sessionID:Q.sessionID,accountId:Q.accountId,direct:!0,retry:!1}),K(),{reason:R}}return},async onAttemptEnd(J,Q){let V=L.get(J.provenance);if(!V)return;try{if(Q.status===401&&V.receipt&&!U.has(V.receipt))U.add(V.receipt),await Z.vault.reportFailure(V.receipt,401,J.dispatch==="http-relay"?"relay_status_field":"direct");if(!Q.localRefusal&&Q.status!==void 0)z.publish(()=>s(J.provenance,V,{lastUsed:Date.now()}))}finally{L.delete(J.provenance)}},forgetSession(J){M.get(J)?.abort(),M.delete(J),Y.delete(J);for(let[Q,V]of C)if(V.sessionID===J)C.delete(Q);for(let[Q,V]of P)if(V[0]?.sessionID===J)P.delete(Q);X.onForgetSession?.(J)},servedAccount:(J)=>Y.get(J),resetRouting:async(J)=>N(await Z.read()).clear(J),async recordPrime(J,Q){let V=L.get(J);if(!V||V.active.signal.aborted)return!1;if(J.kind==="local")return Z.incrementPrimeUsage(V.account.id,J.subject,Q);if(J.kind==="vault"&&V.receipt)return Z.incrementPrimeUsage(V.account.id,V.receipt,Q);return!1},drainRoutingPublications:()=>Promise.all([Z.drainRoutingPublications(),...[...W.values()].map((J)=>J.drain())]).then(()=>{}),close(){B=!0;for(let J of M.values())J.abort();return M.clear(),P.clear(),C.clear(),Promise.all([z.drain(),a.drainRoutingPublications()]).then(()=>{})}};return a}import{remapModelId as cX}from"@cortexkit/anthropic-auth-core";function J1(){let X=new X1,Z=new Map,z=new Map,W=new Map,N=new Set,L=new Set,C=new Map,P=(M)=>{while(M.size>512){let Y=M.keys().next();if(!Y.done)M.delete(Y.value)}};return{async install(M){let Y=[];try{Y.push(await M.session.hook("context",(U)=>{let B=U.messages.map((E)=>{return{info:{id:E.id,sessionID:U.sessionID,role:E.role,agent:U.agent,model:{providerID:U.model.providerID,modelID:U.model.id}},parts:E.content.map((k)=>({type:k.type,...k.type==="text"?{text:k.text}:{}}))}});X.observeMessages(B);let K=U.messages.findLast((E)=>E.role==="user"&&E.id);if(K?.id)Z.set(U.sessionID,K.id);if(K?.content.some((E)=>E.type==="text"&&E.text===g2))N.add(U.sessionID);else N.delete(U.sessionID);P(Z)},{providerID:"anthropic"})),Y.push(await M.session.hook("model.request",(U)=>{if(U.kind!=="primary")return;let B=Z.get(U.sessionID);if(!B)return;if(X.markHeaders({sessionId:U.sessionID,messageId:B,agent:U.agent,headers:U.headers}),N.has(U.sessionID))U.headers[k2]="1"},{providerID:"anthropic"}))}catch(U){throw await Promise.allSettled(Y.map((B)=>B.dispose())),U}return{dispose:async()=>{await Promise.all(Y.map((U)=>U.dispose()))}}},requestOptions(M,Y){let U=X.resolveHeader(M.correlation[f2]);if(U)z.set(M.attemptId,U),P(z);C.set(M.attemptId,M.sessionID),P(C);let B=M.correlation[k2]==="1";if(B)L.add(M.attemptId);return{cache1hEnabled:M.agent!=="compaction"&&M.agent!=="title"&&(Y.policyStorage.claudeCache?.enabled??!0),cache1hMode:Y.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:Y.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:Y.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,turnEndNoteEnabled:!0,turnEndNote:Y.policyStorage.turnEndNote,serverSideFallbackEnabled:Z1(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:B,billingLineage:U?{promptId:U.promptId,previousRequestId:U.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:W.get(M.sessionID)}},responseOptions(M){return{serverSideFallbackModel:cX(M.modelID),laneStart:L.has(M.attemptId),onMessageStart(Y){if(M.kind==="primary"&&typeof Y.id==="string")W.set(M.sessionID,Y.id),P(W)},onStreamEnd(){z.delete(M.attemptId),L.delete(M.attemptId),C.delete(M.attemptId)}}},onRequestId(M,Y){X.commit(z.get(M.attemptId),Y)},forgetSession(M){X.clearSession(M),Z.delete(M),W.delete(M),N.delete(M);for(let[Y,U]of C)if(U===M)z.delete(Y),L.delete(Y),C.delete(Y)}}}var d2="cortexkit-anthropic-auth",eX='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',$Z="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",XZ="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function ZZ(X){let Z=X.authorize??oX,z=X.exchange??sX,W=()=>{if(!X.isActive())throw Error("Claude authentication setup is closed")},N=async()=>{let P;try{P=await X.readMode()}catch{throw Error(XZ)}return W(),P},L=async()=>{if(await N()!=="local")throw Error(eX)};return{integrationID:"anthropic",methods:[{method:{id:v2,type:"oauth",label:m2},async authorize(){W(),await L();let P=await Z("max");return W(),{mode:"code",url:P.url,instructions:"Paste the authorization code returned by Claude.",callback:async(M)=>{W();let Y=await z(M,P.verifier,P.redirectUri,P.state);if(!X.isActive()||Y.type!=="success")throw Error("Claude sign-in did not complete");return{access:Y.access,refresh:Y.refresh,expires:Y.expires}}}}}],vault:{method:{id:G1,type:"oauth",label:"Claude vault accounts"},async activate(){if(W(),await N()!=="claustrum")throw Error($Z)}},async onLogin(P){W(),await L(),await X.runtime.loginOAuth({routeId:"main",credential:P,replace:!0}),W()},label:"Claude native account pool"}}function JZ(X){return{readMode:()=>aX("opencode",X),disconnectVault:()=>rX({host:"opencode",env:X})}}function G$(X={}){return{id:d2,setup:(Z)=>j1(Z,X)}}async function j1(X,Z={}){let z=Z.paths??await tX(),W=iX({paths:z,host:"opencode",local:Z.local,vault:Z.vault}),N=JZ(Z.vault?.env??process.env),L=!0,C=J1(),P=c$(),M,Y,U,B=$1({runtime:W,paths:z,fetch:Z.fetch,requestOptions:C.requestOptions,responseOptions:C.responseOptions,onRequestId:C.onRequestId,onForgetSession:C.forgetSession,onRequestPrepared:async(y)=>{try{await U?.track(y)}catch{Y1.warn("cachekeep","live request tracking failed")}},resolveModelId:async(y)=>P.modelId(y.modelID),onOwnedRequest:()=>{M??=I$(W,Z.fetch),Y??=a$({runtime:W,paths:z,source:B,fetch:Z.fetch})}});U=D$({...Z.cacheKeep,runtime:W,source:B,fetch:Z.fetch,isSubagent:async(y)=>Boolean((await X.session.get({sessionID:y})).parentID)});let K=p$({runtime:W,source:B,cacheKeepRegistry:U.registry,start:async(y,c)=>{await X.session.synthetic({sessionID:y,text:c,description:"Claude lane start",resume:!0})}}),E=[],k=await w$(X,{source:B,log:{warn:(y,c)=>Y1.warn("opencode2",y,c)}},{credential:i$}).catch(async(y)=>{throw K.close(),await U?.dispose(),await B.close(),await W.drainQuotaPublications(),await W.close(),y}),A,h=()=>{if(A)return A;return L=!1,K.close(),B.close(),A=(async()=>{await Promise.allSettled([k.dispose(),M?.dispose(),Y?.dispose(),U?.dispose(),...E.map((y)=>y.dispose())]),await B.close(),await W.drainQuotaPublications(),await W.close()})(),A};try{E.push(await C.install(X)),E.push(await P.install(X)),E.push(await o2(X,ZZ({isActive:()=>L,readMode:N.readMode,runtime:W})));let y={host:"opencode",dispatch:K.dispatch,readStatus:(s)=>K.readStatus(s),readAccounts:()=>W.read(),readMode:N.readMode,disconnectVault:N.disconnectVault,interactive:!0},c=nX(y);return E.push(await V1(X,c,K)),h}catch(y){throw await h(),y}}var T0={id:d2,setup:G$().setup,server:W1};export{j1 as setupAnthropicAuth,T0 as default,G$ as createAnthropicAuthPlugin,d2 as ANTHROPIC_AUTH_PLUGIN_ID};
+${a$}
+Quota refresh checks the pool; it does not check OpenCode's Anthropic connection.`:V}if(Y==="quota")return CX({accounts:U.accounts.filter((V)=>V.type==="oauth").map((V)=>({name:V.label??V.id,role:V.id==="main"?"main":"fallback",enabled:V.enabled,quota:V.quota,tierLabel:AX(V.profile),lastRefreshedAt:V.lastRefreshedAt,error:V.lastQuotaRefreshError?.message}))}).replace(/Usage:[^\n]*/,"Use /claude to refresh native quota readings.");if(Y==="prime")return EX({enabled:U.policyStorage.prime?.enabled===!0,accounts:OX(U.policyStorage)}).replace(/Usage:[^\n]*/,"Use /claude to change Prime settings.");if(Y==="cachekeep"){let V=await X.cacheKeepRegistry?.list()??[];return PX({enabled:DX(U.policyStorage),always:bX(U.policyStorage),hybridActive:wX(U.policyStorage),trackedSessionDetails:V,window:xX(U.policyStorage),trackedSessions:V.length,nextPrewarmAt:V.length?Math.min(...V.map((P)=>P.nextPrewarmAt)):void 0})}let H={routing:"routing",killswitch:"killswitch",cache:"claudeCache",cachekeep:"cacheKeep",dump:"dump",logging:"logging",fast:"claudeFast",prime:"prime"};return JSON.stringify(U.settings[H[Y]]??{})},async readSidebar(Y){let[U,H]=await Promise.all([Z.read(),X.cacheKeepRegistry?.list()??[]]);return e$(s$(U,{activeId:z.servedAccount(Y),trackedSessions:H.length,now:Date.now()}))},forgetSession(Y){W.get(Y)?.active.abort(),W.delete(Y)},close(){F=!0;for(let Y of W.values())Y.active.abort();W.clear()}}}import{resolveClaudeModelCapabilities as gX}from"@cortexkit/anthropic-auth-core";function X1(){let X=new Map;return{install:(z)=>z.model.transform((W)=>{X.clear();for(let F of W.list("anthropic")){X.set(String(F.id),String(F.modelID));let L=gX(F.modelID)?.efforts.variants;if(!L)continue;W.update("anthropic",String(F.id),(C)=>{let T=C.variants.filter((K)=>!L.some((Y)=>Y===String(K.id)));C.variants=[...T,...L.map((K)=>({id:K,settings:{effort:K,thinking:{type:"adaptive",display:"summarized"}}}))]})}}),modelId:(z)=>X.get(z)??z}}function Z1(X){return X.get("authorization")?.match(/^Bearer ([^\s]+)$/i)?.[1]??X.get("x-api-key")??void 0}import{buildPrimeRequestBody as J1,effectiveRelayTransport as Y1,nativeAccountCanServe as hX,PrimeManager as mX,tokenFingerprint as G1}from"@cortexkit/anthropic-auth-core";var V1=(X)=>X!==null&&typeof X==="object"&&!Array.isArray(X)?X:{};function j1(X){let{runtime:Z,source:z}=X,W=new AbortController,F=new Set,L=(K)=>({providerID:"anthropic",modelID:J1().model,sessionID:`oc2-prime:${K}`,agent:"prime",kind:"generate"}),C=async(K)=>{let Y=L(K),U=D2({source:z}),H=performance.now();try{for(let V=0;V<3;V++){if(W.signal.throwIfAborted(),(await Z.read()).policyStorage.prime?.enabled!==!0)throw Error("Native Prime is disabled");let x=await U.adapter.accountHeaders({...Y,accountId:K});if(!("headers"in x)||typeof x.headers!=="object"||x.headers===null||typeof x.attempt!=="object"||x.attempt===null)throw Error("Native Prime authorization refused");let q={...Y,accountId:K,attemptId:crypto.randomUUID(),transport:"http",data:x.attempt},f,c=!1,D=!1,r=($2)=>{D=!0,$2.body?.cancel().catch(()=>{})};try{let $2=await U.adapter.rewriteRequest?.({...Y,accountId:K,attempt:q,request:new Request("https://api.anthropic.com/v1/messages",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(J1()),signal:W.signal})});if(!$2)throw Error("Native Prime rewrite refused");let a=new Headers($2.headers);for(let[I,h]of Object.entries(x.headers))if(h===null)a.delete(I);else a.set(I,h);let H2=new Request($2,{headers:a}),n=await(X.fetch??fetch)(H2),J=await U.adapter.rewriteResponse?.({...Y,accountId:K,request:H2,response:n,attempt:q})??n;f=J.status,U.adapter.quotaFromHeaders?.(J.headers,J.status,q);let j=J.ok?void 0:await U.adapter.limitFromResponse?.({status:J.status,headers:J.headers,body:()=>J.clone().text(),attempt:q});if(j&&/^(vault-newer|local-newer|relay-direct):/.test(j.reason)&&V<2){r(J);let I={...Y,phase:"retry",rerouteFrom:{accountId:K,limit:j}};if(await z.chooseAccount(I)!==K)throw Error("Native Prime retry changed account");continue}if(!J.ok)return r(J),{ok:!1,status:f,ms:performance.now()-H,error:"Native Prime upstream refused the request"};let B=V1(await J.json()),E=V1(B.usage),k={inputTokens:typeof E.input_tokens==="number"?E.input_tokens:void 0,outputTokens:typeof E.output_tokens==="number"?E.output_tokens:void 0};if(q.data?.dispatch==="http-relay"&&!/^req_[A-Za-z0-9_-]+$/.test(J.headers.get("request-id")??""))throw Error("Native Prime relay response has no upstream provenance");if(c=await z.recordPrime(x.attempt.provenance,k),!c)throw Error("Native Prime counter attribution was superseded");return{ok:!0,status:f,ms:performance.now()-H,usage:k}}finally{await U.adapter.onAttemptEnd?.(q,{status:f,outputStarted:!1,...c?{}:{error:{reason:D?"cancelled":"failed"}}})}}return{ok:!1,error:"Native Prime retry budget exhausted"}}catch{return{ok:!1,error:"Native Prime was not completed",ms:performance.now()-H}}finally{U.dispose()}},T=new mX({storagePath:X.paths.legacyConfig,loadStorage:async()=>(await Z.read()).policyStorage,async getAccountFingerprint(K){let Y=await Z.read(),U=Y.accounts.find((P)=>P.id===K);if(!hX(U)||U?.type!=="oauth")return;if(Y.policyStorage.relay?.enabled===!0&&Y1(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")return;if(U.source==="vault"){let P=await Z.authorizeVault(K,W.signal),x=await Z.getOrCreateAuthLineage(K,P);return x?G1(x):void 0}let H=await Z.authorizeLocal(K,{signal:W.signal});if(H.status!=="usable")return;let V=await Z.getOrCreateAuthLineage(K,H.subject);return V?G1(V):void 0},async refreshQuota(K){let Y=await Z.read();if(Y.policyStorage.relay?.enabled===!0&&Y1(Y.policyStorage.relay.transport,Y.policyStorage.relay.url)==="websocket")throw Error("WebSocket relay is unsupported on OpenCode 2");return{quota:await Z.fetchQuota(K,X.fetch,W.signal),fresh:!0}},sendPrime(K){let Y=C(K);return F.add(Y),Y.finally(()=>F.delete(Y)),Y},async recordSuccess(K){let Y=(await Z.read()).accounts.find((U)=>U.id===K);if(!Y?.prime)throw Error("Native Prime counters are unavailable");return Y.prime}});return T.start(),{manager:T,async dispose(){T.stop(),W.abort(),await Promise.allSettled(F)}}}import{createNativeUsagePublisher as lX,decideStickyQuotaFailure as uX,effectiveRelayTransport as dX,getClaudeCodeIdentityForVerifiedAccount as o2,getQuotaCheckIntervalMs as pX,getRoutingMode as U$,isDumpPersistentlyEnabled as Q1,isQuotaBearingHeaderFrame as cX,logger as iX,mergeHeaderQuotaForPersistence as oX,NativeVaultNoAccountError as rX,nativeAccountCanServe as Q$,nativeAccountPolicy as r2,nativeLocalQuotaLineage as nX,nativePollQuotaGenerallyExhausted as sX,normalizeQuotaHeaders as aX,quotaSnapshotCheckedAt as W1,quotaSnapshotHasStandardWindows as tX,readNativeAccountsForRequest as eX,remapModelId as W$,StickySessionRouter as $Z,setDumpEnabled as XZ,shouldFallbackStatus as ZZ,stickyQuotaSnapshotIsFresh as v2,stickyRetryAfterWithJitter as JZ,stickyRouteFamilyForModel as YZ}from"@cortexkit/anthropic-auth-core";var B$=(X)=>["five_hour","seven_day"].some((Z)=>(X?.[Z]?.remainingPercent??1)<=0);function GZ(X,Z,z,W){let F=X.rerouteFrom;if(X.phase!=="retry"||F?.limit.status!==429||U$(Z.policyStorage)!=="sticky-balanced")return;let L=z.find((T)=>T.id===F.accountId);if(!L||!v2(L.quota,Z.policyStorage,Date.now(),W))return;let C=uX({quota:L.quota,modelId:W});if(C.action!=="hold")return;return{hold:{delayMs:JZ(X.sessionID,C.retryAfterSeconds)*1000}}}function U1(X){let{runtime:Z}=X,z=lX("native-auth"),W=new Map,F=(J)=>{let j=J.routingPath;if(!j)throw Error("Native routing storage is unavailable");let B=W.get(j);if(!B)B=new $Z({path:j,vaultSeed:J.routingSeed,onLockEvent:Z.onLockEvent,relocationGuard:Z.relocationGuard,localRecoveryPath:J.mode==="local"?J.routingRecoveryPath:void 0}),W.set(j,B);return B.setVaultSeed(J.routingSeed),B},L=new WeakMap,C=new Map,T=new Map,K=new Map,Y=new Map,U=new WeakSet,H=!1,V=()=>{while(C.size>512){let J=C.keys().next();if(!J.done)C.delete(J.value)}},P=(J)=>{try{XZ(Q1(J.policyStorage))}catch{}},x=async()=>{try{let J=await Z.read();return P(J),Q1(J.policyStorage)}catch{return!1}},q=(J,j)=>JSON.stringify([J.sessionID,J.kind,J.modelID,j]),f=(J)=>{if(H)throw Error("Native Anthropic source is closed");let j=K.get(J.sessionID);if(!j){j=new AbortController,K.set(J.sessionID,j);while(K.size>512){let B=K.keys().next();if(!B.done)n.forgetSession?.(B.value)}}return j},c=(J,j,B)=>Q$(J)&&(J.type==="api"||r2(J,j,W$(B)).status==="allowed"),D=async(J,j,B,E)=>{let k=await Z.read();P(k),E.signal.throwIfAborted(),r(k);let I=k.accounts.find((h)=>h.id===J);if(!I||I.type!==B||!c(I,k,j))return!1;if(B==="api"){let h=k.accounts.find((i)=>i.id==="main"&&i.type==="oauth");return!!h&&v2(h.quota,k.policyStorage)&&B$(h.quota)}return!0},r=(J)=>{let j=J.policyStorage.relay;if(j?.enabled===!0&&dX(j.transport,j.url)==="websocket")throw new w2},$2=async(J,j)=>{if(r(J),j||J.policyStorage.relay?.enabled!==!0)return{dispatch:{kind:"direct"},relayFallback:!1};let B=await Z.getRelayConfig();if(!B)throw Error("request refused: native HTTP relay configuration is unavailable");if(B.transport!=="http")throw new w2;return{dispatch:{kind:"http-relay",url:B.url,token:B.token},relayFallback:B.fallbackToDirect}};async function a(J,j,B){if(J.kind==="local"){let E=await Z.publishLocal(J.subject,B);if(!E&&B.quota)iX.warn("quota","Quota publication discarded");return E}if(J.kind==="vault"&&j.receipt)await Z.vault.publish(j.receipt,B);else if(J.kind==="api"&&B.lastUsed!==void 0)await Z.publishApi(J.subject,{lastUsed:B.lastUsed});return!0}function H2(J,j,B){if(J.kind!=="local")return;let E=J.subject.binding,k=W1(B),I={lineage:nX(E),accountUuid:E.identity,entry:{quota:B,checkedAt:k,refreshAfter:k},generalExhausted:sX(B),routeBeforeSave:!0};return Z.quotaObservations.hold(j.account.id,I)?I:void 0}let n={async chooseAccount(J){let j=f(J);X.onOwnedRequest?.();let B=await Z.read();P(B),j.signal.throwIfAborted(),r(B);let E=W$(await X.resolveModelId?.(J)??J.modelID);if(j.signal.throwIfAborted(),B.mode==="claustrum")B=await eX(Z,j.signal),j.signal.throwIfAborted();if(B.policyStorage.quota?.enabled!==!1){let g=!1;for(let m of B.accounts){if(!Q$(m)||m.type!=="oauth")continue;if(tX(m.quota)?v2(m.quota,B.policyStorage,Date.now(),E):Date.now()-W1(m.quota)<pX(B.policyStorage))continue;try{await Z.fetchQuota(m.id,X.fetch,j.signal,void 0,"admission"),g=!0}catch{j.signal.throwIfAborted()}}if(g)B=await Z.read();j.signal.throwIfAborted()}let k=J.rerouteFrom?C.get(J.rerouteFrom.limit.reason):void 0;if(J.rerouteFrom&&/^(vault-newer|local-newer|relay-direct):/.test(J.rerouteFrom.limit.reason)&&!k)return;if(k&&J.rerouteFrom){let g=B.accounts.find((z2)=>z2.id===k.accountId);if(!g||!c(g,B,E))return;C.delete(J.rerouteFrom.limit.reason);let m=q(J,k.accountId),l=T.get(m)??[];return l.push(k),T.set(m,l),k.accountId}let I=[];for(let g of B.accounts){if(g.type!=="oauth"||!c(g,B,E))continue;if(g.source==="local"){let m=await Z.authorizeLocal(g.id,{signal:j.signal,policy:(l,z2)=>r2(l,z2,E)});if(j.signal.throwIfAborted(),m.status!=="usable")continue}I.push(g)}let h=GZ(J,B,I,E);if(h)return h;let i=I.filter((g)=>g.id!==J.rerouteFrom?.accountId);if(U$(B.policyStorage)==="sticky-balanced"){let g=i.map((l,z2)=>({accountId:l.id,order:z2,quota:l.quota??{kind:"unknown"}})),m=await F(B).resolve({sessionId:J.sessionID,family:YZ(E),modelId:E,affinityModelId:J.modelID,candidates:g,retainAccountIds:new Set(i.map((l)=>l.id)),...B.mode==="claustrum"?{accountIdentities:new Map(B.accounts.flatMap((l)=>l.accountIdentity?[[l.id,l.accountIdentity]]:[]))}:{},storage:B.policyStorage,inputBytes:1,preferredAccountId:J.previousAccountId,preserveOnNoCandidate:!0});if(j.signal.throwIfAborted(),m)return m.accountId}else{let m=U$(B.policyStorage)==="fallback-first"?[...i.filter((l)=>l.id!=="main"),...i.filter((l)=>l.id==="main")]:[...i.filter((l)=>l.id==="main"),...i.filter((l)=>l.id!=="main")];if(m[0])return m[0].id}if(B.mode==="claustrum")throw new rX;let p=B.accounts.find((g)=>g.id==="main"&&g.type==="oauth");if(!p)return;let J2=p.quota;if(J.rerouteFrom?.limit.status===429||!v2(J2,B.policyStorage))try{J2=await Z.fetchQuota("main",X.fetch,j.signal)}catch{return}if(j.signal.throwIfAborted(),!B$(J2))return;return B.accounts.find((g)=>g.type==="api"&&Q$(g)&&g.id!==J.rerouteFrom?.accountId)?.id},dropChoice(J){let j=q(J,J.accountId),B=T.get(j);if(B?.shift(),B?.length===0)T.delete(j)},async authorizeAccount(J,j){let B=f(J),E=await Z.read();P(E),B.signal.throwIfAborted(),r(E);let k=W$(await X.resolveModelId?.(J)??J.modelID);B.signal.throwIfAborted();let I=E.accounts.find((t)=>t.id===j);if(!I||!c(I,E,k))return;let h=q(J,j),i=T.get(h),p=i?.shift();if(i?.length===0)T.delete(h);let{dispatch:J2,relayFallback:g}=await $2(E,p?.direct===!0);if(B.signal.throwIfAborted(),p?.auth){if(!await D(j,k,p.auth.route,B))return;let t=L.get(p.auth.provenance);if(t?.receipt?.expiresAtMs!==void 0&&t.receipt.expiresAtMs!==null&&t.receipt.expiresAtMs<Date.now()+300000)return;if(t)L.set(p.auth.provenance,{...t,scope:{...J,modelID:k},account:I,active:B,relayFallback:g});return Y.set(J.sessionID,j),{...p.auth,dispatch:J2}}let m={scope:{...J,modelID:k},active:B,account:I,retry:p?.retry??!1,relayFallback:g,quota:I.quota};if(I.type==="api"){let t=E.accounts.find((M)=>M.id==="main"&&M.type==="oauth");if(!t||!v2(t.quota,E.policyStorage)||!B$(t.quota))return;let j2=await Z.authorizeApi(j,B.signal);if(B.signal.throwIfAborted(),!await D(j,k,"api",B))return;let Q={kind:"api",subject:j2.subject};return L.set(Q,m),Y.set(J.sessionID,j),{route:"api",headers:j2.authHeader==="authorization-bearer"?{authorization:`Bearer ${j2.apiKey}`}:{"x-api-key":j2.apiKey},baseURL:j2.baseURL,provenance:Q,dispatch:J2}}if(I.source==="vault"){let t=await Z.authorizeVault(j,B.signal);if(B.signal.throwIfAborted(),!await D(j,k,"oauth",B))return;let j2={kind:"vault",credentialId:t.credentialId,recordVersion:t.recordVersion};L.set(j2,{...m,receipt:t});let Q=t.assertedAccountIdentity;if(!Q)return;return Y.set(J.sessionID,j),{route:"oauth",accessToken:t.accessToken,provenance:j2,dispatch:J2,identity:o2(Q,Q)}}let l=await Z.authorizeLocal(j,{signal:B.signal,policy:(t,j2)=>r2(t,j2,k)});if(B.signal.throwIfAborted(),l.status!=="usable")return;if(!await D(j,k,"oauth",B))return;let z2={kind:"local",subject:l.subject};L.set(z2,{...m,access:l.access}),Y.set(J.sessionID,j);let P2=l.subject.binding.identity;return{route:"oauth",accessToken:l.access,provenance:z2,dispatch:J2,identity:o2(P2,P2)}},async requestOptions(J){let j=f(J),B=await Z.read();P(B),j.signal.throwIfAborted();let E=B.accounts.find((I)=>I.id===J.accountId);if(!E||!c(E,B,J.modelID))throw Error("request refused: native account is ineligible for this model");let k=L.get(J.provenance);if(k)L.set(J.provenance,{...k,scope:{...k.scope,modelID:J.modelID}});return X.requestOptions(J,B)},async admitRequest(J){let j=L.get(J.provenance);if(!j||!await D(J.accountId,J.modelID,J.route,j.active))throw Error("request refused: native account policy changed before dispatch");L.set(J.provenance,{...j,scope:{...j.scope,modelID:J.modelID}})},isDumpEnabled:()=>x(),onRequestPrepared:(J)=>X.onRequestPrepared?.(J),responseOptions(J){return X.responseOptions?.({...J,modelID:L.get(J.provenance)?.scope.modelID??J.modelID})},quotaFromHeaders(J,j){let B=L.get(j.provenance),E=B1(J);if(E)X.onRequestId?.(j,E);if(!B||j.route!=="oauth"||!cX(J))return;let k=j.provenance.kind==="local"?j.provenance.subject.binding.identity:B.receipt?.assertedAccountIdentity,I={...aX(J),...k?{accountIdentity:k}:{}},h=oX(B.quota,I);B.quota=h;let i=H2(j.provenance,B,h),p=B.account.id,J2=()=>{if(i)Z.quotaObservations.forget(p,i)};return z.observe(a(j.provenance,B,{quota:h}).then((g)=>{if(!g)J2()},(g)=>{throw J2(),g})),I},async limitFromResponse(J){let j=L.get(J.provenance);if(!j)return;if(J.status===401&&j.receipt){if(!U.has(j.receipt))U.add(j.receipt),await Z.vault.reportFailure(j.receipt,401,J.dispatch==="http-relay"?"relay_status_field":"direct");if(j.retry||j.active.signal.aborted)return;let E=j.active,k=await Z.vault.prepareRetry(j.receipt,E.signal);if(E.signal.throwIfAborted(),!k.retry)return;let I=k.receipt,h=I.assertedAccountIdentity;if(!h)return;let i={kind:"vault",credentialId:I.credentialId,recordVersion:I.recordVersion};L.set(i,{...j,receipt:I,retry:!0});let p=`vault-newer:${J.attemptId}`;return C.set(p,{sessionID:J.sessionID,accountId:J.accountId,retry:!0,auth:{route:"oauth",accessToken:I.accessToken,provenance:i,identity:o2(h,h)}}),V(),{reason:p,status:401}}if(J.status===401&&J.provenance.kind==="local"&&j.access&&!j.retry){if(j.active.signal.aborted)return;let E=j.active,k=await Z.authorizeLocal(J.accountId,{rejectedAccessToken:j.access,signal:E.signal,policy:(p,J2)=>r2(p,J2,j.scope.modelID)});if(E.signal.throwIfAborted(),k.status!=="usable"||k.access===j.access)return;let I={kind:"local",subject:k.subject};L.set(I,{...j,access:k.access,retry:!0});let h=k.subject.binding.identity,i=`local-newer:${J.attemptId}`;return C.set(i,{sessionID:J.sessionID,accountId:J.accountId,retry:!0,auth:{route:"oauth",accessToken:k.access,provenance:I,identity:o2(h,h)}}),V(),{reason:i,status:401}}let B=await Z.read();if(ZZ(J.status,B.policyStorage))return{reason:`provider-${J.status}`,status:J.status};return},limitFromRelayFailure(J){let j=L.get(J.provenance);if(!j?.relayFallback||j.active.signal.aborted||!(J.status===401||J.status>=500))return;let B=`relay-direct:${J.attemptId}`;return C.set(B,{sessionID:J.sessionID,accountId:J.accountId,direct:!0,retry:!1}),V(),{reason:B}},limitFromStreamError(J){return J.errorType==="rate_limit_error"?{reason:"provider-rate-limit",status:429}:void 0},limitFromHostError(J,j){let B=L.get(j.provenance);if(j.dispatch==="http-relay"&&B?.relayFallback&&!B.active.signal.aborted&&J.status===void 0){let E=`relay-direct:${j.attemptId}`;return C.set(E,{sessionID:j.sessionID,accountId:j.accountId,direct:!0,retry:!1}),V(),{reason:E}}return},async onAttemptEnd(J,j){let B=L.get(J.provenance);if(!B)return;try{if(j.status===401&&B.receipt&&!U.has(B.receipt))U.add(B.receipt),await Z.vault.reportFailure(B.receipt,401,J.dispatch==="http-relay"?"relay_status_field":"direct");if(!j.localRefusal&&j.status!==void 0)z.publish(()=>a(J.provenance,B,{lastUsed:Date.now()}))}finally{L.delete(J.provenance)}},forgetSession(J){K.get(J)?.abort(),K.delete(J),Y.delete(J);for(let[j,B]of C)if(B.sessionID===J)C.delete(j);for(let[j,B]of T)if(B[0]?.sessionID===J)T.delete(j);X.onForgetSession?.(J)},servedAccount:(J)=>Y.get(J),resetRouting:async(J)=>F(await Z.read()).clear(J),async recordPrime(J,j){let B=L.get(J);if(!B||B.active.signal.aborted)return!1;if(J.kind==="local")return Z.incrementPrimeUsage(B.account.id,J.subject,j);if(J.kind==="vault"&&B.receipt)return Z.incrementPrimeUsage(B.account.id,B.receipt,j);return!1},drainRoutingPublications:()=>Promise.all([Z.drainRoutingPublications(),...[...W.values()].map((J)=>J.drain())]).then(()=>{}),close(){H=!0;for(let J of K.values())J.abort();return K.clear(),T.clear(),C.clear(),Promise.all([z.drain(),n.drainRoutingPublications()]).then(()=>{})}};return n}import{remapModelId as VZ}from"@cortexkit/anthropic-auth-core";function M1(){let X=new z1,Z=new Map,z=new Map,W=new Map,F=new Set,L=new Set,C=new Map,T=(K)=>{while(K.size>512){let Y=K.keys().next();if(!Y.done)K.delete(Y.value)}};return{async install(K){let Y=[];try{Y.push(await K.session.hook("context",(U)=>{let H=U.messages.map((P)=>{return{info:{id:P.id,sessionID:U.sessionID,role:P.role,agent:U.agent,model:{providerID:U.model.providerID,modelID:U.model.id}},parts:P.content.map((x)=>({type:x.type,...x.type==="text"?{text:x.text}:{}}))}});X.observeMessages(H);let V=U.messages.findLast((P)=>P.role==="user"&&P.id);if(V?.id)Z.set(U.sessionID,V.id);if(V?.content.some((P)=>P.type==="text"&&P.text===p2))F.add(U.sessionID);else F.delete(U.sessionID);T(Z)},{providerID:"anthropic"})),Y.push(await K.session.hook("model.request",(U)=>{if(U.kind!=="primary")return;let H=Z.get(U.sessionID);if(!H)return;if(X.markHeaders({sessionId:U.sessionID,messageId:H,agent:U.agent,headers:U.headers}),F.has(U.sessionID))U.headers[A2]="1"},{providerID:"anthropic"}))}catch(U){throw await Promise.allSettled(Y.map((H)=>H.dispose())),U}return{dispose:async()=>{await Promise.all(Y.map((U)=>U.dispose()))}}},requestOptions(K,Y){let U=X.resolveHeader(K.correlation[d2]);if(U)z.set(K.attemptId,U),T(z);C.set(K.attemptId,K.sessionID),T(C);let H=K.correlation[A2]==="1";if(H)L.add(K.attemptId);return{cache1hEnabled:K.agent!=="compaction"&&K.agent!=="title"&&(Y.policyStorage.claudeCache?.enabled??!0),cache1hMode:Y.policyStorage.claudeCache?.mode??"explicit",fastModeEnabled:Y.policyStorage.claudeFast?.enabled===!0,thinkingPrefixMismatchBehavior:Y.policyStorage.thinkingBinding?.prefixMismatchBehavior,midConversationEffortEnabled:!1,turnEndNoteEnabled:!0,turnEndNote:Y.policyStorage.turnEndNote,serverSideFallbackEnabled:K1(process.env.OPENCODE_ANTHROPIC_AUTH_CONTENT_FILTER_FALLBACK)==="server",laneStart:H,billingLineage:U?{promptId:U.promptId,previousRequestId:U.previousRequestId}:void 0,cacheDiagnosticsPreviousMessageId:W.get(K.sessionID)}},responseOptions(K){return{serverSideFallbackModel:VZ(K.modelID),laneStart:L.has(K.attemptId),onMessageStart(Y){if(K.kind==="primary"&&typeof Y.id==="string")W.set(K.sessionID,Y.id),T(W)},onStreamEnd(){z.delete(K.attemptId),L.delete(K.attemptId),C.delete(K.attemptId)}}},onRequestId(K,Y){X.commit(z.get(K.attemptId),Y)},forgetSession(K){X.clearSession(K),Z.delete(K),W.delete(K),F.delete(K);for(let[Y,U]of C)if(U===K)z.delete(Y),L.delete(Y),C.delete(Y)}}}var n2="cortexkit-anthropic-auth",LZ='This OpenCode is enrolled in the Claude vault and uses only vault accounts. Choose "Claude vault accounts" instead; no local account was changed.',FZ="This OpenCode is not enrolled in the Claude vault. Enroll it first, or sign in with Claude Pro / Max.",TZ="The Claude vault enrollment could not be read; repair it and retry. Nothing was changed.";function PZ(X){let Z=X.authorize??QZ,z=X.exchange??UZ,W=()=>{if(!X.isActive())throw Error("Claude authentication setup is closed")},F=async()=>{let T;try{T=await X.readMode()}catch{throw Error(TZ)}return W(),T},L=async()=>{if(await F()!=="local")throw Error(LZ)};return{integrationID:"anthropic",methods:[{method:{id:c2,type:"oauth",label:i2},async authorize(){W(),await L();let T=await Z("max");return W(),{mode:"code",url:T.url,instructions:"Paste the authorization code returned by Claude.",callback:async(K)=>{W();let Y=await z(K,T.verifier,T.redirectUri,T.state);if(!X.isActive()||Y.type!=="success")throw Error("Claude sign-in did not complete");return{access:Y.access,refresh:Y.refresh,expires:Y.expires}}}}}],vault:{method:{id:_1,type:"oauth",label:"Claude vault accounts"},async activate(){if(W(),await F()!=="claustrum")throw Error(FZ)}},async onLogin(T){W(),await L(),await X.runtime.loginOAuth({routeId:"main",credential:T,replace:!0}),W()},label:"Claude native account pool"}}function CZ(X){return{readMode:()=>MZ("opencode",X),disconnectVault:()=>BZ({host:"opencode",env:X})}}function z$(X={}){return{id:n2,setup:(Z)=>L1(Z,X)}}async function L1(X,Z={}){let z=Z.paths??await _Z(),W=await HZ({paths:z,role:"opencode2",kind:KZ(),onLockEvent:Z.local?.onLockEvent}),F=jZ({paths:z,host:"opencode",local:Z.local,vault:Z.vault}),L=CZ(Z.vault?.env??process.env);try{let D=await F.read();NZ(zZ(D.policyStorage))}catch{}let C=!0,T=M1(),K=X1(),Y,U,H,V=U1({runtime:F,paths:z,fetch:Z.fetch,requestOptions:T.requestOptions,responseOptions:T.responseOptions,onRequestId:T.onRequestId,onForgetSession:T.forgetSession,onRequestPrepared:async(D)=>{try{await H?.track(D)}catch{H1.warn("cachekeep","live request tracking failed")}},resolveModelId:async(D)=>K.modelId(D.modelID),onOwnedRequest:()=>{Y??=c$(F,Z.fetch),U??=j1({runtime:F,paths:z,source:V,fetch:Z.fetch})}});H=u$({...Z.cacheKeep,runtime:F,source:V,storageId:z.storageId,fetch:Z.fetch,isSubagent:async(D)=>Boolean((await X.session.get({sessionID:D})).parentID)});let P=$1({runtime:F,source:V,cacheKeepRegistry:H.registry,start:async(D,r)=>{await X.session.synthetic({sessionID:D,text:r,description:"Claude lane start",resume:!0})}}),x=[],q=await d$(X,{source:V,log:{warn:(D,r)=>H1.warn("opencode2",D,r)}},{credential:Z1}).catch(async(D)=>{throw W.close(),P.close(),await H?.dispose(),await V.close(),await F.drainQuotaPublications(),await F.close(),D}),f,c=()=>{if(f)return f;return C=!1,W.close(),P.close(),V.close(),f=(async()=>{await Promise.allSettled([q.dispose(),Y?.dispose(),U?.dispose(),H?.dispose(),...x.map((D)=>D.dispose())]),await V.close(),await F.drainQuotaPublications(),await F.close()})(),f};try{x.push(await T.install(X)),x.push(await K.install(X)),x.push(await e2(X,PZ({isActive:()=>C,readMode:L.readMode,runtime:F})));let D={host:"opencode",dispatch:P.dispatch,readStatus:($2)=>P.readStatus($2),readAccounts:()=>F.read(),readMode:L.readMode,disconnectVault:L.disconnectVault,interactive:!0},r=WZ(D);return x.push(await N1(X,r,P)),c}catch(D){throw await c(),D}}var l0={id:n2,setup:z$().setup,server:F1};export{L1 as setupAnthropicAuth,l0 as default,z$ as createAnthropicAuthPlugin,n2 as ANTHROPIC_AUTH_PLUGIN_ID};

package/dist/v2/tui.js

@@ -1,4 +1,4 @@
-import{u as q}from"../index-dpnhamzw.js";import"../index-46e2gk3c.js";import"../index-71temqvq.js";var N="Open this link in your browser and sign in. Then choose Finish OAuth sign-in in the Accounts menu and paste the code Claude shows you.";async function g(D,M={}){let B=D.client.rpc(q),Z=!0,V=!1,Y=new AbortController,$=()=>{let j=D.ui.router.current();return j.type==="session"?j.sessionID:void 0};function C(j){return new Promise((Q)=>{let z="",J=!1,G=D.keymap.mode.push("cortexkit-protected-entry"),X=(H,W=!0)=>{if(J)return;J=!0,D.renderer.keyInput.off("keypress",O),D.renderer.keyInput.off("paste",P),Y.signal.removeEventListener("abort",K),G();let F=H?z:void 0;if(z="",W)D.ui.dialog.clear();Q(F)},K=()=>X(!1),O=(H)=>{if(H.preventDefault(),H.stopPropagation(),H.name==="escape"||H.ctrl&&H.name==="c")return X(!1);if(H.name==="return"||H.name==="enter")return X(!0);if(H.name==="backspace"){z=Array.from(z).slice(0,-1).join("");return}if(!H.ctrl&&!H.meta&&!H.option&&Array.from(H.sequence).every((W)=>W.charCodeAt(0)>=32&&W.charCodeAt(0)!==127))z=(z+H.sequence).slice(0,4096)},P=(H)=>{H.preventDefault(),H.stopPropagation(),z=(z+Array.from(new TextDecoder().decode(H.bytes)).filter((W)=>W.charCodeAt(0)>=32&&W.charCodeAt(0)!==127).join("")).slice(0,4096)};if(D.renderer.keyInput.prependListener("keypress",O),D.renderer.keyInput.prependListener("paste",P),Y.signal.addEventListener("abort",K,{once:!0}),D.ui.dialog.alert({title:j,message:"Type or paste the value. Input is hidden. Enter accepts; Escape cancels."}).then(()=>X(!1,!1),()=>X(!1,!1)),Y.signal.aborted)K()})}async function E(j){let Q={};for(let z of j.knobs){if(!Z)return;if(z.kind==="choice"){let J=await D.ui.dialog.select({title:z.label,options:z.choices.map((G)=>({title:G.label,value:G.value})),current:z.value});if(J===void 0)return;Q[z.id]=J}else if(z.kind==="toggle"){let J=await D.ui.dialog.select({title:z.label,options:[{title:"On",value:!0},{title:"Off",value:!1}],current:z.value});if(J===void 0)return;Q[z.id]=J}else{let J=z.kind==="text"&&z.masked?await C(z.label):await D.ui.dialog.prompt({title:z.label,value:z.value===void 0?void 0:String(z.value),placeholder:z.kind==="text"?z.placeholder:void 0});if(J===void 0)return;Q[z.id]=J===""&&!z.required?null:z.kind==="number"?Number(J):J}}return Q}async function A(j){if(M.showSignInLink)try{await M.showSignInLink(D,j,Y.signal);return}catch{}await D.ui.dialog.alert({title:"Claude sign-in",message:`${N}
+import{u as q}from"../index-a1k6z503.js";import"../index-12km9x91.js";import"../index-71temqvq.js";var N="Open this link in your browser and sign in. Then choose Finish OAuth sign-in in the Accounts menu and paste the code Claude shows you.";async function g(D,M={}){let B=D.client.rpc(q),Z=!0,V=!1,Y=new AbortController,$=()=>{let j=D.ui.router.current();return j.type==="session"?j.sessionID:void 0};function C(j){return new Promise((Q)=>{let z="",J=!1,G=D.keymap.mode.push("cortexkit-protected-entry"),X=(H,W=!0)=>{if(J)return;J=!0,D.renderer.keyInput.off("keypress",O),D.renderer.keyInput.off("paste",P),Y.signal.removeEventListener("abort",K),G();let F=H?z:void 0;if(z="",W)D.ui.dialog.clear();Q(F)},K=()=>X(!1),O=(H)=>{if(H.preventDefault(),H.stopPropagation(),H.name==="escape"||H.ctrl&&H.name==="c")return X(!1);if(H.name==="return"||H.name==="enter")return X(!0);if(H.name==="backspace"){z=Array.from(z).slice(0,-1).join("");return}if(!H.ctrl&&!H.meta&&!H.option&&Array.from(H.sequence).every((W)=>W.charCodeAt(0)>=32&&W.charCodeAt(0)!==127))z=(z+H.sequence).slice(0,4096)},P=(H)=>{H.preventDefault(),H.stopPropagation(),z=(z+Array.from(new TextDecoder().decode(H.bytes)).filter((W)=>W.charCodeAt(0)>=32&&W.charCodeAt(0)!==127).join("")).slice(0,4096)};if(D.renderer.keyInput.prependListener("keypress",O),D.renderer.keyInput.prependListener("paste",P),Y.signal.addEventListener("abort",K,{once:!0}),D.ui.dialog.alert({title:j,message:"Type or paste the value. Input is hidden. Enter accepts; Escape cancels."}).then(()=>X(!1,!1),()=>X(!1,!1)),Y.signal.aborted)K()})}async function E(j){let Q={};for(let z of j.knobs){if(!Z)return;if(z.kind==="choice"){let J=await D.ui.dialog.select({title:z.label,options:z.choices.map((G)=>({title:G.label,value:G.value})),current:z.value});if(J===void 0)return;Q[z.id]=J}else if(z.kind==="toggle"){let J=await D.ui.dialog.select({title:z.label,options:[{title:"On",value:!0},{title:"Off",value:!1}],current:z.value});if(J===void 0)return;Q[z.id]=J}else{let J=z.kind==="text"&&z.masked?await C(z.label):await D.ui.dialog.prompt({title:z.label,value:z.value===void 0?void 0:String(z.value),placeholder:z.kind==="text"?z.placeholder:void 0});if(J===void 0)return;Q[z.id]=J===""&&!z.required?null:z.kind==="number"?Number(J):J}}return Q}async function A(j){if(M.showSignInLink)try{await M.showSignInLink(D,j,Y.signal);return}catch{}await D.ui.dialog.alert({title:"Claude sign-in",message:`${N}
 
 ${j}
 `})}async function T(j,Q){let z=`${Q.title} status`;if(M.showStatus)try{await M.showStatus(D,{title:z,lines:Q.lines,...Q.slot==="quota"&&{readQuota:(J)=>B.sidebar({sessionId:j},{signal:J,location:D.location})}},Y.signal);return}catch{}await D.ui.dialog.alert({title:z,message:Q.lines.join(`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/opencode-anthropic-auth",
-  "version": "2.3.0",
+  "version": "2.4.1",
   "type": "module",
   "repository": {
     "type": "git",
@@ -77,18 +77,18 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.6.0",
-    "@cortexkit/anthropic-auth-core": "2.3.0",
+    "@cortexkit/anthropic-auth-core": "2.4.1",
     "@cortexkit/claustrum-client": "0.12.0",
     "@cortexkit/private-files": "0.2.1",
     "@cortexkit/subc-client": "^0.22.0",
-    "@opentui/core": "0.6.6",
-    "@opentui/solid": "0.6.6",
+    "@opentui/core": "0.7.0",
+    "@opentui/solid": "0.7.0",
     "jsonc-parser": "^3.3.1",
     "solid-js": "1.9.12",
     "xxhash-wasm": "^1.1.0"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "4.0.82",
-    "@opencode/plugin": "2.0.32"
+    "@opencode/plugin": "2.2.0"
   }
 }

package/src/rpc/port-file.ts

@@ -7,12 +7,18 @@ import {
   writeFile,
 } from 'node:fs/promises'
 import { join } from 'node:path'
+import { type WriterStamp, writerStamp } from '@cortexkit/anthropic-auth-core'
 
 export interface PortFileEntry {
   port: number
   token: string
   pid: number
   startedAt: number
+  /**
+   * Present in files written by 2.3.0 and later, so a later version can tell
+   * them from files of older versions. Older readers ignore it.
+   */
+  writer?: WriterStamp
 }
 
 function pidAlive(pid: number): boolean {
@@ -29,7 +35,11 @@ export async function writePortFile(
   entry: { port: number; token: string; pid: number },
 ): Promise<string> {
   await mkdir(dir, { recursive: true })
-  const full: PortFileEntry = { ...entry, startedAt: Date.now() }
+  const full: PortFileEntry = {
+    ...entry,
+    startedAt: Date.now(),
+    writer: writerStamp(),
+  }
   const target = join(dir, `port-${entry.pid}.json`)
   const tmp = `${target}.${process.pid}.tmp`
   await writeFile(tmp, JSON.stringify(full), { encoding: 'utf8', mode: 0o600 })

package/src/rpc/rpc-dir.ts

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto'
 import { homedir, tmpdir } from 'node:os'
 import { join, resolve } from 'node:path'
+import { anthropicAuthStateRoot } from '@cortexkit/anthropic-auth-core'
 
 const RPC_DIR_ENV = 'OPENCODE_ANTHROPIC_AUTH_RPC_DIR'
 
@@ -12,8 +13,12 @@ export function getRpcDir(projectDirectory: string): string {
     .update(projectDirectory)
     .digest('hex')
     .slice(0, 16)
-  const base = process.env.XDG_STATE_HOME || join(homedir(), '.local', 'state')
-  return join(base, 'cortexkit', 'anthropic-auth', 'rpc', hash)
+  const root = anthropicAuthStateRoot({
+    xdgStateHome: process.env.XDG_STATE_HOME,
+    home: homedir(),
+    acceptRelative: true,
+  })
+  return join(root, 'rpc', hash)
 }
 
 export { tmpdir }