@cortexkit/opencode-openai-auth 0.4.2 → 0.5.0

package/dist/{quota-normalize-02mn21p4.js → quota-normalize-n02dfdx0.js}

@@ -1 +1 @@
-import{c as a,d as b,e as c,f as d,g as e}from"./index-2ng03cby.js";import"./index-jpx7h5gc.js";export{a as toResetIso,d as normalizeWsFrame,e as normalizeWham,b as normalizeQuotaHeaders,c as isCompleteQuotaHeaderFrame};
+import{c as a,d as b,e as c,f as d,g as e}from"./index-2ng03cby.js";import"./index-wpd7mg3p.js";export{a as toResetIso,d as normalizeWsFrame,e as normalizeWham,b as normalizeQuotaHeaders,c as isCompleteQuotaHeaderFrame};

package/dist/raw-ws-bun.d.ts

@@ -7,6 +7,7 @@ export declare class RawWebSocket {
     private listeners;
     private rxBuffer;
     private handshakeDone;
+    private upgradeFailureEmitted;
     private expectedAccept;
     private fragOpcode;
     private fragChunks;
@@ -21,6 +22,7 @@ export declare class RawWebSocket {
     private emit;
     private connect;
     private onData;
+    private emitRejectedUpgrade;
     private drainFrames;
     private handleFrame;
     send(data: string): void;

package/dist/raw-ws-node.d.ts

@@ -7,6 +7,7 @@ export declare class RawWebSocket {
     private listeners;
     private rxBuffer;
     private handshakeDone;
+    private upgradeFailureEmitted;
     private expectedAccept;
     private fragOpcode;
     private fragChunks;
@@ -20,6 +21,7 @@ export declare class RawWebSocket {
     private emit;
     private connect;
     private onData;
+    private emitRejectedUpgrade;
     private drainFrames;
     private handleFrame;
     send(data: string): void;

package/dist/raw-ws-upgrade.d.ts

@@ -0,0 +1,2 @@
+export declare function rejectedUpgradeStatus(statusLine: string): number | undefined;
+export declare function rejectedUpgradeEvent(buffer: Uint8Array, headerEnd: number, finalizePartial?: boolean): Record<string, unknown> | undefined;

package/dist/rpc/port-file.d.ts

@@ -8,5 +8,9 @@ export declare function writePortFile(dir: string, entry: {
     port: number;
     token: string;
     pid: number;
+}, options?: {
+    secureDir?: boolean;
+    beforeWrite?: () => void | Promise<void>;
 }): Promise<string>;
+export declare function sweepRpcState(root: string, activeDir: string): Promise<void>;
 export declare function discoverPortFile(dir: string, expectedPid?: number): Promise<PortFileEntry | null>;

package/dist/rpc/port-file.js

@@ -1 +1 @@
-import{na as a,oa as b}from"../index-qnd9x5jh.js";import"../index-jpx7h5gc.js";export{a as writePortFile,b as discoverPortFile};
+import{ua as a,va as b,wa as c}from"../index-zkzb0twr.js";import"../index-s5fbqqwx.js";import"../index-wpd7mg3p.js";export{a as writePortFile,b as sweepRpcState,c as discoverPortFile};

package/dist/rpc/protocol.d.ts

@@ -13,6 +13,7 @@ export interface RpcNotification {
 export interface ApplyRequest {
     command: CommandModalName;
     arguments: string;
+    sessionId?: string;
 }
 export interface ApplyResult {
     text: string;

package/dist/rpc/rpc-client.js

@@ -1 +1 @@
-import{oa as c}from"../index-qnd9x5jh.js";import"../index-jpx7h5gc.js";async function p(n,r,l,o,i){let t=await c(n,r);if(l?.(t),!t)return null;let e=new AbortController,s=setTimeout(()=>e.abort(),2000);try{let a=await fetch(`http://127.0.0.1:${t.port}/rpc/${o}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${t.token}`},body:JSON.stringify(i),signal:e.signal});if(!a.ok)return null;return await a.json()}catch{return null}finally{clearTimeout(s)}}function y(n,r,l){let o=!1,i=(t)=>{if(o)return;o=!0,l?.(t)};return{async pending(t,e){return(await p(n,r,i,"pending-notifications",{lastReceivedId:t,sessionId:e}))?.messages??[]},async apply(t){return await p(n,r,i,"apply",{...t})??{text:"apply failed",knobs:{}}}}}export{y as createRpcClient};
+import{wa as c}from"../index-zkzb0twr.js";import"../index-s5fbqqwx.js";import"../index-wpd7mg3p.js";async function p(n,r,l,o,i){let t=await c(n,r);if(l?.(t),!t)return null;let e=new AbortController,s=setTimeout(()=>e.abort(),2000);try{let a=await fetch(`http://127.0.0.1:${t.port}/rpc/${o}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${t.token}`},body:JSON.stringify(i),signal:e.signal});if(!a.ok)return null;return await a.json()}catch{return null}finally{clearTimeout(s)}}function y(n,r,l){let o=!1,i=(t)=>{if(o)return;o=!0,l?.(t)};return{async pending(t,e){return(await p(n,r,i,"pending-notifications",{lastReceivedId:t,sessionId:e}))?.messages??[]},async apply(t){return await p(n,r,i,"apply",{...t})??{text:"apply failed",knobs:{}}}}}export{y as createRpcClient};

package/dist/rpc/rpc-dir.d.ts

@@ -1,3 +1,9 @@
 import { tmpdir } from 'node:os';
+export interface RpcDirResolution {
+    dir: string;
+    secureDir: boolean;
+    sweepRoot?: string;
+}
 export declare function getRpcDir(projectDirectory: string): string;
+export declare function resolveRpcDir(projectDirectory: string): Promise<RpcDirResolution>;
 export { tmpdir };

package/dist/rpc/rpc-dir.js

@@ -1 +1 @@
-import{pa as a,qa as b}from"../index-hjgzqz1c.js";import"../index-jpx7h5gc.js";export{a as tmpdir,b as getRpcDir};
+import{Aa as a,Ba as b,Ca as c}from"../index-rfgyxxxq.js";import"../index-wpd7mg3p.js";export{a as tmpdir,c as resolveRpcDir,b as getRpcDir};

package/dist/rpc/rpc-server.d.ts

@@ -7,6 +7,8 @@ export interface RpcServerHandle {
 }
 export interface RpcServerOptions {
     dir: string;
+    secureDir?: boolean;
+    sweepRoot?: string;
     drain: typeof drainNotifications;
     apply: (request: ApplyRequest) => Promise<ApplyResult>;
     timeoutMs?: number;

package/dist/sidebar-state.d.ts

@@ -1,10 +1,12 @@
 export interface QuotaWindow {
     usedPercent: number;
     remainingPercent: number;
+    checkedAt?: number;
     resetsAt?: string;
     windowMinutes?: number;
 }
 export interface AccountQuota {
+    checkedAt?: number;
     primary?: QuotaWindow;
     secondary?: QuotaWindow;
     resetCreditsAvailable?: number;
@@ -21,6 +23,8 @@ export declare function getPresentQuotaWindows(quota: AccountQuota | null): Pres
 export interface SidebarAccountState {
     id: string;
     label: string | undefined;
+    /** ChatGPT identity of the account this quota belongs to. */
+    accountId?: string;
     quota: AccountQuota | null;
     killed: boolean;
     enabled: boolean;
@@ -32,9 +36,32 @@ export interface ActiveRoutingEntry {
     updatedAt: number;
 }
 export type ActiveRoutingMap = Record<string, ActiveRoutingEntry>;
+export interface StickyAssignment {
+    accountId: string;
+    assignedAt: number;
+    lastSeenAt: number;
+    inputBytes: number;
+    quotaCheckedAt?: number;
+}
+export type StickyAssignmentMap = Record<string, StickyAssignment>;
+export interface StickyAssignmentChoice {
+    accountId: string;
+    quotaCheckedAt?: number;
+}
+export interface ResolveStickyAssignmentInput {
+    sessionId: string;
+    requestBytes: number;
+    now: number;
+    validPinnedAccountIds: readonly string[];
+    excludeAccountIds?: readonly string[];
+    quotaCheckedAtByAccount: Readonly<Record<string, number | undefined>>;
+    choose: (pendingBytes: ReadonlyMap<string, number>) => StickyAssignmentChoice | undefined;
+}
 export interface SidebarState {
     main: {
         quota: AccountQuota | null;
+        /** ChatGPT identity of the main account this quota belongs to. */
+        mainAccountId?: string;
         killed: boolean;
         quotaBackedOff?: boolean;
         quotaBackoffUntil?: number;
@@ -48,10 +75,14 @@ export interface SidebarState {
     /** Machine-global routing mode and compatibility value for older readers. */
     route: string;
     activeRouting?: ActiveRoutingMap;
+    stickyAssignments?: StickyAssignmentMap;
     planType?: string;
     credits?: number;
     lastUpdated: number;
 }
+export declare const STICKY_ASSIGNMENT_MAX_AGE_MS: number;
+export declare const STICKY_ASSIGNMENT_MAX_ENTRIES = 256;
+export declare function hashSidebarSessionId(sessionId: string): string;
 export declare function getSidebarStateFile(): string;
 export declare const DEFAULT_SIDEBAR_STATE: SidebarState;
 /**
@@ -64,19 +95,27 @@ export declare const DEFAULT_SIDEBAR_STATE: SidebarState;
  * the I/O boundary, so a bad file can never crash the host TUI.
  */
 export declare function normalizeSidebarState(raw: unknown): SidebarState;
-export declare function getSidebarState(): Promise<SidebarState>;
+export declare function getSidebarState(stateFile?: string): Promise<SidebarState>;
 export declare const ACTIVE_ROUTING_MAX_AGE_MS: number;
 export declare const ACTIVE_ROUTING_MAX_ENTRIES = 128;
 export type SidebarRoutingAccount = {
     id: string;
     enabled?: boolean;
+    killed?: boolean;
 };
-export declare function isUsableRoutingEntry(entry: ActiveRoutingEntry, accounts: readonly SidebarRoutingAccount[], now?: number): boolean;
+export declare function isUsableRoutingEntry(entry: ActiveRoutingEntry, accounts: readonly SidebarRoutingAccount[] | undefined, now?: number): boolean;
+export declare function exhaustedQuotaResetAt(quota: AccountQuota | null | undefined, now?: number): {
+    resetsAt: string;
+    resetAtMs: number;
+} | undefined;
+export declare function isQuotaExhausted(quota: AccountQuota | null | undefined, now?: number): boolean;
+export declare function resolveSessionStickyAccount(state: SidebarState, sessionId: string | undefined, now?: number): string | undefined;
 export declare function resolveSessionSidebarRouting(state: SidebarState, sessionId?: string, now?: number): {
     activeId: string;
     route: string;
 };
-export declare function pruneActiveRouting(activeRouting: ActiveRoutingMap | undefined, accounts: readonly SidebarRoutingAccount[], now?: number, removedSessionId?: string): ActiveRoutingMap | undefined;
+export declare function pruneActiveRouting(activeRouting: ActiveRoutingMap | undefined, accounts: readonly SidebarRoutingAccount[] | undefined, now?: number, removedSessionId?: string): ActiveRoutingMap | undefined;
+export declare function pruneStickyAssignments(assignments: StickyAssignmentMap | undefined, validAccountIds: ReadonlySet<string> | undefined, now?: number, removedSessionHash?: string): StickyAssignmentMap | undefined;
 interface SidebarMergeHooks {
     beforeRecheck?: () => void | Promise<void>;
 }
@@ -98,9 +137,11 @@ export type SidebarMachineState = Pick<SidebarState, 'main' | 'fallbacks' | 'pla
 export declare function setSidebarMachineState(machineState: SidebarMachineState, file?: string, hooks?: SidebarMergeHooks): Promise<void>;
 export declare function upsertSidebarActiveRouting(input: {
     sessionId: string;
-} & ActiveRoutingEntry, accounts: readonly SidebarRoutingAccount[], file?: string, hooks?: SidebarMergeHooks): Promise<void>;
+} & ActiveRoutingEntry, accounts: readonly SidebarRoutingAccount[] | undefined, file?: string, hooks?: SidebarMergeHooks): Promise<void>;
 export declare function setSidebarLegacyRouting(input: ActiveRoutingEntry, file?: string): Promise<void>;
-export declare function removeSidebarActiveRouting(sessionId: string, accounts: readonly SidebarRoutingAccount[], file?: string, hooks?: SidebarMergeHooks): Promise<void>;
+export declare function removeSidebarActiveRouting(sessionId: string, accounts: readonly SidebarRoutingAccount[] | undefined, file?: string, hooks?: SidebarMergeHooks): Promise<void>;
+export declare function resolveSidebarStickyAssignment(input: ResolveStickyAssignmentInput, file?: string, hooks?: SidebarMergeHooks): Promise<StickyAssignment | undefined>;
+export declare function clearSidebarStickyAssignment(sessionId: string, file?: string): Promise<boolean>;
 /**
  * Await all pending sidebar writes. Tests call this before restoring env
  * vars in teardown so no in-flight write can re-resolve getSidebarStateFile()

package/dist/sidebar-state.js

@@ -1 +1 @@
-import{$ as k,R as a,S as b,T as c,U as d,V as e,W as f,X as g,Y as h,Z as i,_ as j,aa as l,ba as m,ca as n,da as o,ea as p,fa as q,ga as r,ha as s,ia as t}from"./index-wpk440dz.js";import"./index-72cas5ht.js";import"./index-jpx7h5gc.js";export{n as upsertSidebarActiveRouting,l as setSidebarState,m as setSidebarMachineState,o as setSidebarLegacyRouting,j as resolveSessionSidebarRouting,r as resolveActiveAccount,p as removeSidebarActiveRouting,k as pruneActiveRouting,e as normalizeSidebarState,i as isUsableRoutingEntry,c as getSidebarStateFile,f as getSidebarState,b as getPresentQuotaWindows,s as getCollapsedQuotaSummary,a as formatWindowLabel,q as drainSidebarWrites,t as computeQuotaPacing,d as DEFAULT_SIDEBAR_STATE,h as ACTIVE_ROUTING_MAX_ENTRIES,g as ACTIVE_ROUTING_MAX_AGE_MS};
+import{$ as j,S as a,T as b,U as c,V as d,W as e,X as f,Y as g,Z as h,_ as i,aa as k,ba as l,ca as m,da as n,ea as o,fa as p,ga as q,ha as r,ia as s,ja as t,ka as u,la as v,ma as w,na as x,oa as y,pa as z,qa as A,ra as B,sa as C}from"./index-wnxfzjfr.js";import"./index-vrdc90yd.js";import"./index-s5fbqqwx.js";import"./index-wpd7mg3p.js";export{u as upsertSidebarActiveRouting,s as setSidebarState,t as setSidebarMachineState,v as setSidebarLegacyRouting,x as resolveSidebarStickyAssignment,o as resolveSessionStickyAccount,p as resolveSessionSidebarRouting,A as resolveActiveAccount,w as removeSidebarActiveRouting,r as pruneStickyAssignments,q as pruneActiveRouting,h as normalizeSidebarState,l as isUsableRoutingEntry,n as isQuotaExhausted,e as hashSidebarSessionId,f as getSidebarStateFile,i as getSidebarState,b as getPresentQuotaWindows,B as getCollapsedQuotaSummary,a as formatWindowLabel,m as exhaustedQuotaResetAt,z as drainSidebarWrites,C as computeQuotaPacing,y as clearSidebarStickyAssignment,d as STICKY_ASSIGNMENT_MAX_ENTRIES,c as STICKY_ASSIGNMENT_MAX_AGE_MS,g as DEFAULT_SIDEBAR_STATE,k as ACTIVE_ROUTING_MAX_ENTRIES,j as ACTIVE_ROUTING_MAX_AGE_MS};

package/dist/{token-dab1ama0.js → token-5hdnazxp.js}

@@ -1 +1 @@
-import{a as U,b as V}from"./index-x1c39tzz.js";import{sa as R}from"./index-jpx7h5gc.js";var E=R((M,Q)=>{var{defineProperty:H,getOwnPropertyDescriptor:W,getOwnPropertyNames:X}=Object,Y=Object.prototype.hasOwnProperty,Z=(z,q)=>{for(var B in q)H(z,B,{get:q[B],enumerable:!0})},$=(z,q,B,F)=>{if(q&&typeof q==="object"||typeof q==="function"){for(let v of X(q))if(!Y.call(z,v)&&v!==B)H(z,v,{get:()=>q[v],enumerable:!(F=W(q,v))||F.enumerable})}return z},A=(z)=>$(H({},"__esModule",{value:!0}),z),L={};Z(L,{refreshToken:()=>D});Q.exports=A(L);var K=U(),G=V();async function D(z){let q=z?.project,B=z?.team;if(!q&&!B){let v=(0,G.findProjectInfo)();q=v.projectId,B=v.teamId}else if(!q||!B){let v=(0,G.findProjectInfo)();q=q??v.projectId,B=B??v.teamId}if(!q)throw new K.VercelOidcTokenError("Failed to refresh OIDC token: No project specified. Try re-linking your project with `vc link`");let F=(0,G.loadToken)(q);if(!F||(0,G.isExpired)((0,G.getTokenPayload)(F.token),z?.expirationBufferMs)){let v=await(0,G.getVercelToken)({expirationBufferMs:z?.expirationBufferMs});if(F=await(0,G.getVercelOidcToken)(v,q,B),!F)throw new K.VercelOidcTokenError("Failed to refresh OIDC token");(0,G.saveToken)(F,q)}process.env.VERCEL_OIDC_TOKEN=F.token;return}});export default E();
+import{a as U,b as V}from"./index-6rnw2cgs.js";import{Ea as R}from"./index-wpd7mg3p.js";var E=R((M,Q)=>{var{defineProperty:H,getOwnPropertyDescriptor:W,getOwnPropertyNames:X}=Object,Y=Object.prototype.hasOwnProperty,Z=(z,q)=>{for(var B in q)H(z,B,{get:q[B],enumerable:!0})},$=(z,q,B,F)=>{if(q&&typeof q==="object"||typeof q==="function"){for(let v of X(q))if(!Y.call(z,v)&&v!==B)H(z,v,{get:()=>q[v],enumerable:!(F=W(q,v))||F.enumerable})}return z},A=(z)=>$(H({},"__esModule",{value:!0}),z),L={};Z(L,{refreshToken:()=>D});Q.exports=A(L);var K=U(),G=V();async function D(z){let q=z?.project,B=z?.team;if(!q&&!B){let v=(0,G.findProjectInfo)();q=v.projectId,B=v.teamId}else if(!q||!B){let v=(0,G.findProjectInfo)();q=q??v.projectId,B=B??v.teamId}if(!q)throw new K.VercelOidcTokenError("Failed to refresh OIDC token: No project specified. Try re-linking your project with `vc link`");let F=(0,G.loadToken)(q);if(!F||(0,G.isExpired)((0,G.getTokenPayload)(F.token),z?.expirationBufferMs)){let v=await(0,G.getVercelToken)({expirationBufferMs:z?.expirationBufferMs});if(F=await(0,G.getVercelOidcToken)(v,q,B),!F)throw new K.VercelOidcTokenError("Failed to refresh OIDC token");(0,G.saveToken)(F,q)}process.env.VERCEL_OIDC_TOKEN=F.token;return}});export default E();

package/dist/token-util-3d2nj45d.js

@@ -0,0 +1 @@
+import{b as a}from"./index-6rnw2cgs.js";import"./index-wpd7mg3p.js";export default a();

package/dist/tui-preferences.js

@@ -1,4 +1,4 @@
-import{ra as P,sa as C,ua as _}from"./index-jpx7h5gc.js";var g=C((T,L)=>{(function(Q){if(typeof L==="object"&&typeof L.exports==="object"){var J=Q(_,T);if(J!==void 0)L.exports=J}else if(typeof define==="function"&&define.amd)define(["require","exports","./impl/format","./impl/edit","./impl/scanner","./impl/parser"],Q)})(function(Q,J){Object.defineProperty(J,"__esModule",{value:!0}),J.applyEdits=J.modify=J.format=J.printParseErrorCode=J.ParseErrorCode=J.stripComments=J.visit=J.getNodeValue=J.getNodePath=J.findNodeAtOffset=J.findNodeAtLocation=J.parseTree=J.parse=J.getLocation=J.SyntaxKind=J.ScanError=J.createScanner=void 0;let X=Q("./impl/format"),Z=Q("./impl/edit"),G=Q("./impl/scanner"),$=Q("./impl/parser");J.createScanner=G.createScanner;var W;(function(z){z[z.None=0]="None",z[z.UnexpectedEndOfComment=1]="UnexpectedEndOfComment",z[z.UnexpectedEndOfString=2]="UnexpectedEndOfString",z[z.UnexpectedEndOfNumber=3]="UnexpectedEndOfNumber",z[z.InvalidUnicode=4]="InvalidUnicode",z[z.InvalidEscapeCharacter=5]="InvalidEscapeCharacter",z[z.InvalidCharacter=6]="InvalidCharacter"})(W||(J.ScanError=W={}));var H;(function(z){z[z.OpenBraceToken=1]="OpenBraceToken",z[z.CloseBraceToken=2]="CloseBraceToken",z[z.OpenBracketToken=3]="OpenBracketToken",z[z.CloseBracketToken=4]="CloseBracketToken",z[z.CommaToken=5]="CommaToken",z[z.ColonToken=6]="ColonToken",z[z.NullKeyword=7]="NullKeyword",z[z.TrueKeyword=8]="TrueKeyword",z[z.FalseKeyword=9]="FalseKeyword",z[z.StringLiteral=10]="StringLiteral",z[z.NumericLiteral=11]="NumericLiteral",z[z.LineCommentTrivia=12]="LineCommentTrivia",z[z.BlockCommentTrivia=13]="BlockCommentTrivia",z[z.LineBreakTrivia=14]="LineBreakTrivia",z[z.Trivia=15]="Trivia",z[z.Unknown=16]="Unknown",z[z.EOF=17]="EOF"})(H||(J.SyntaxKind=H={})),J.getLocation=$.getLocation,J.parse=$.parse,J.parseTree=$.parseTree,J.findNodeAtLocation=$.findNodeAtLocation,J.findNodeAtOffset=$.findNodeAtOffset,J.getNodePath=$.getNodePath,J.getNodeValue=$.getNodeValue,J.visit=$.visit,J.stripComments=$.stripComments;var q;(function(z){z[z.InvalidSymbol=1]="InvalidSymbol",z[z.InvalidNumberFormat=2]="InvalidNumberFormat",z[z.PropertyNameExpected=3]="PropertyNameExpected",z[z.ValueExpected=4]="ValueExpected",z[z.ColonExpected=5]="ColonExpected",z[z.CommaExpected=6]="CommaExpected",z[z.CloseBraceExpected=7]="CloseBraceExpected",z[z.CloseBracketExpected=8]="CloseBracketExpected",z[z.EndOfFileExpected=9]="EndOfFileExpected",z[z.InvalidCommentToken=10]="InvalidCommentToken",z[z.UnexpectedEndOfComment=11]="UnexpectedEndOfComment",z[z.UnexpectedEndOfString=12]="UnexpectedEndOfString",z[z.UnexpectedEndOfNumber=13]="UnexpectedEndOfNumber",z[z.InvalidUnicode=14]="InvalidUnicode",z[z.InvalidEscapeCharacter=15]="InvalidEscapeCharacter",z[z.InvalidCharacter=16]="InvalidCharacter"})(q||(J.ParseErrorCode=q={}));function D(z){switch(z){case 1:return"InvalidSymbol";case 2:return"InvalidNumberFormat";case 3:return"PropertyNameExpected";case 4:return"ValueExpected";case 5:return"ColonExpected";case 6:return"CommaExpected";case 7:return"CloseBraceExpected";case 8:return"CloseBracketExpected";case 9:return"EndOfFileExpected";case 10:return"InvalidCommentToken";case 11:return"UnexpectedEndOfComment";case 12:return"UnexpectedEndOfString";case 13:return"UnexpectedEndOfNumber";case 14:return"InvalidUnicode";case 15:return"InvalidEscapeCharacter";case 16:return"InvalidCharacter"}return"<unknown ParseErrorCode>"}J.printParseErrorCode=D;function m(z,U,j){return X.format(z,U,j)}J.format=m;function f(z,U,j,A){return Z.setProperty(z,U,j,A)}J.modify=f;function u(z,U){let j=U.slice(0).sort((I,Y)=>{let F=I.offset-Y.offset;if(F===0)return I.length-Y.length;return F}),A=z.length;for(let I=j.length-1;I>=0;I--){let Y=j[I];if(Y.offset+Y.length<=A)z=Z.applyEdit(z,Y);else throw Error("Overlapping edit");A=Y.offset}return z}J.applyEdits=u})});var M=P(g(),1);import{watch as K}from"node:fs";import{mkdir as c,readFile as O,rename as y,writeFile as S}from"node:fs/promises";import{homedir as E}from"node:os";import{basename as l,dirname as v,join as k}from"node:path";var p="OPENCODE_TUI_PREFERENCES_FILE",x="tui-preferences.jsonc";function w(){let Q=process.env[p];if(Q)return Q;let J=process.env.OPENCODE_CONFIG_DIR||k(process.env.XDG_CONFIG_HOME||k(E(),".config"),"opencode");return k(J,x)}function N(Q){return typeof Q==="object"&&Q!==null&&!Array.isArray(Q)}async function Xz(){try{let Q=await O(w(),"utf8"),J=[],X=M.parse(Q,J,{allowTrailingComma:!0});if(J.length>0)return{};return N(X)?X:{}}catch{return{}}}var i="openai-auth",s=160,b={forceToTop:!1,order:s,startCollapsed:!1,rememberCollapsed:!0,collapsed:null,pollMs:1500,refreshDebounceMs:200,header:{label:"OPENAI",showVersion:!0},sections:{quota:!0,fallbackAccounts:!0,routing:!0,health:!0,pacing:!0},appearance:{barWidth:10,barFilledChar:"█",barEmptyChar:"░",warnThreshold:50,errorThreshold:80}};function V(Q,J){return typeof Q==="boolean"?Q:J}function B(Q,J,X,Z){if(typeof Q!=="number"||!Number.isFinite(Q))return J;return Math.min(Math.max(Math.round(Q),X),Z)}function d(Q,J,X){if(typeof Q!=="string"||Q.length===0)return J;return Q.slice(0,X)}function h(Q,J){if(typeof Q!=="string")return J;return[...Q][0]??J}function Zz(Q){let J=Q[i];if(!N(J))return structuredClone(b);let X=b,Z=N(J.header)?J.header:{},G=N(J.sections)?J.sections:{},$=N(J.appearance)?J.appearance:{},W=B($.warnThreshold,X.appearance.warnThreshold,0,99),H=Math.max(B($.errorThreshold,X.appearance.errorThreshold,0,100),Math.min(W+1,100));return{forceToTop:V(J.forceToTop,X.forceToTop),order:B(J.order,X.order,-1e4,1e4),startCollapsed:V(J.startCollapsed,X.startCollapsed),rememberCollapsed:V(J.rememberCollapsed,X.rememberCollapsed),collapsed:typeof J.collapsed==="boolean"?J.collapsed:null,pollMs:B(J.pollMs,X.pollMs,500,30000),refreshDebounceMs:B(J.refreshDebounceMs,X.refreshDebounceMs,50,5000),header:{label:d(Z.label,X.header.label,20),showVersion:V(Z.showVersion,X.header.showVersion)},sections:{quota:V(G.quota,X.sections.quota),fallbackAccounts:V(G.fallbackAccounts,X.sections.fallbackAccounts),routing:V(G.routing,X.sections.routing),health:V(G.health,X.sections.health),pacing:V(G.pacing,X.sections.pacing)},appearance:{barWidth:B($.barWidth,X.appearance.barWidth,4,40),barFilledChar:h($.barFilledChar,X.appearance.barFilledChar),barEmptyChar:h($.barEmptyChar,X.appearance.barEmptyChar),warnThreshold:W,errorThreshold:H}}}var n=-1e5;function $z(Q,J,X){let Z=Q[J];if(!N(Z))return X;if(Z.forceToTop===!0)return n+Object.keys(Q).indexOf(J);return B(Z.order,X,-1e4,1e4)}var t=`// Shared preferences for opencode TUI plugins.
+import{Da as P,Ea as C,Ga as _}from"./index-wpd7mg3p.js";var g=C((T,L)=>{(function(Q){if(typeof L==="object"&&typeof L.exports==="object"){var J=Q(_,T);if(J!==void 0)L.exports=J}else if(typeof define==="function"&&define.amd)define(["require","exports","./impl/format","./impl/edit","./impl/scanner","./impl/parser"],Q)})(function(Q,J){Object.defineProperty(J,"__esModule",{value:!0}),J.applyEdits=J.modify=J.format=J.printParseErrorCode=J.ParseErrorCode=J.stripComments=J.visit=J.getNodeValue=J.getNodePath=J.findNodeAtOffset=J.findNodeAtLocation=J.parseTree=J.parse=J.getLocation=J.SyntaxKind=J.ScanError=J.createScanner=void 0;let X=Q("./impl/format"),Z=Q("./impl/edit"),G=Q("./impl/scanner"),$=Q("./impl/parser");J.createScanner=G.createScanner;var W;(function(z){z[z.None=0]="None",z[z.UnexpectedEndOfComment=1]="UnexpectedEndOfComment",z[z.UnexpectedEndOfString=2]="UnexpectedEndOfString",z[z.UnexpectedEndOfNumber=3]="UnexpectedEndOfNumber",z[z.InvalidUnicode=4]="InvalidUnicode",z[z.InvalidEscapeCharacter=5]="InvalidEscapeCharacter",z[z.InvalidCharacter=6]="InvalidCharacter"})(W||(J.ScanError=W={}));var H;(function(z){z[z.OpenBraceToken=1]="OpenBraceToken",z[z.CloseBraceToken=2]="CloseBraceToken",z[z.OpenBracketToken=3]="OpenBracketToken",z[z.CloseBracketToken=4]="CloseBracketToken",z[z.CommaToken=5]="CommaToken",z[z.ColonToken=6]="ColonToken",z[z.NullKeyword=7]="NullKeyword",z[z.TrueKeyword=8]="TrueKeyword",z[z.FalseKeyword=9]="FalseKeyword",z[z.StringLiteral=10]="StringLiteral",z[z.NumericLiteral=11]="NumericLiteral",z[z.LineCommentTrivia=12]="LineCommentTrivia",z[z.BlockCommentTrivia=13]="BlockCommentTrivia",z[z.LineBreakTrivia=14]="LineBreakTrivia",z[z.Trivia=15]="Trivia",z[z.Unknown=16]="Unknown",z[z.EOF=17]="EOF"})(H||(J.SyntaxKind=H={})),J.getLocation=$.getLocation,J.parse=$.parse,J.parseTree=$.parseTree,J.findNodeAtLocation=$.findNodeAtLocation,J.findNodeAtOffset=$.findNodeAtOffset,J.getNodePath=$.getNodePath,J.getNodeValue=$.getNodeValue,J.visit=$.visit,J.stripComments=$.stripComments;var q;(function(z){z[z.InvalidSymbol=1]="InvalidSymbol",z[z.InvalidNumberFormat=2]="InvalidNumberFormat",z[z.PropertyNameExpected=3]="PropertyNameExpected",z[z.ValueExpected=4]="ValueExpected",z[z.ColonExpected=5]="ColonExpected",z[z.CommaExpected=6]="CommaExpected",z[z.CloseBraceExpected=7]="CloseBraceExpected",z[z.CloseBracketExpected=8]="CloseBracketExpected",z[z.EndOfFileExpected=9]="EndOfFileExpected",z[z.InvalidCommentToken=10]="InvalidCommentToken",z[z.UnexpectedEndOfComment=11]="UnexpectedEndOfComment",z[z.UnexpectedEndOfString=12]="UnexpectedEndOfString",z[z.UnexpectedEndOfNumber=13]="UnexpectedEndOfNumber",z[z.InvalidUnicode=14]="InvalidUnicode",z[z.InvalidEscapeCharacter=15]="InvalidEscapeCharacter",z[z.InvalidCharacter=16]="InvalidCharacter"})(q||(J.ParseErrorCode=q={}));function D(z){switch(z){case 1:return"InvalidSymbol";case 2:return"InvalidNumberFormat";case 3:return"PropertyNameExpected";case 4:return"ValueExpected";case 5:return"ColonExpected";case 6:return"CommaExpected";case 7:return"CloseBraceExpected";case 8:return"CloseBracketExpected";case 9:return"EndOfFileExpected";case 10:return"InvalidCommentToken";case 11:return"UnexpectedEndOfComment";case 12:return"UnexpectedEndOfString";case 13:return"UnexpectedEndOfNumber";case 14:return"InvalidUnicode";case 15:return"InvalidEscapeCharacter";case 16:return"InvalidCharacter"}return"<unknown ParseErrorCode>"}J.printParseErrorCode=D;function m(z,U,j){return X.format(z,U,j)}J.format=m;function f(z,U,j,A){return Z.setProperty(z,U,j,A)}J.modify=f;function u(z,U){let j=U.slice(0).sort((I,Y)=>{let F=I.offset-Y.offset;if(F===0)return I.length-Y.length;return F}),A=z.length;for(let I=j.length-1;I>=0;I--){let Y=j[I];if(Y.offset+Y.length<=A)z=Z.applyEdit(z,Y);else throw Error("Overlapping edit");A=Y.offset}return z}J.applyEdits=u})});var M=P(g(),1);import{watch as K}from"node:fs";import{mkdir as c,readFile as O,rename as y,writeFile as S}from"node:fs/promises";import{homedir as E}from"node:os";import{basename as l,dirname as v,join as k}from"node:path";var p="OPENCODE_TUI_PREFERENCES_FILE",x="tui-preferences.jsonc";function w(){let Q=process.env[p];if(Q)return Q;let J=process.env.OPENCODE_CONFIG_DIR||k(process.env.XDG_CONFIG_HOME||k(E(),".config"),"opencode");return k(J,x)}function N(Q){return typeof Q==="object"&&Q!==null&&!Array.isArray(Q)}async function Xz(){try{let Q=await O(w(),"utf8"),J=[],X=M.parse(Q,J,{allowTrailingComma:!0});if(J.length>0)return{};return N(X)?X:{}}catch{return{}}}var i="openai-auth",s=160,b={forceToTop:!1,order:s,startCollapsed:!1,rememberCollapsed:!0,collapsed:null,pollMs:1500,refreshDebounceMs:200,header:{label:"OPENAI",showVersion:!0},sections:{quota:!0,fallbackAccounts:!0,routing:!0,health:!0,pacing:!0},appearance:{barWidth:10,barFilledChar:"█",barEmptyChar:"░",warnThreshold:50,errorThreshold:80}};function V(Q,J){return typeof Q==="boolean"?Q:J}function B(Q,J,X,Z){if(typeof Q!=="number"||!Number.isFinite(Q))return J;return Math.min(Math.max(Math.round(Q),X),Z)}function d(Q,J,X){if(typeof Q!=="string"||Q.length===0)return J;return Q.slice(0,X)}function h(Q,J){if(typeof Q!=="string")return J;return[...Q][0]??J}function Zz(Q){let J=Q[i];if(!N(J))return structuredClone(b);let X=b,Z=N(J.header)?J.header:{},G=N(J.sections)?J.sections:{},$=N(J.appearance)?J.appearance:{},W=B($.warnThreshold,X.appearance.warnThreshold,0,99),H=Math.max(B($.errorThreshold,X.appearance.errorThreshold,0,100),Math.min(W+1,100));return{forceToTop:V(J.forceToTop,X.forceToTop),order:B(J.order,X.order,-1e4,1e4),startCollapsed:V(J.startCollapsed,X.startCollapsed),rememberCollapsed:V(J.rememberCollapsed,X.rememberCollapsed),collapsed:typeof J.collapsed==="boolean"?J.collapsed:null,pollMs:B(J.pollMs,X.pollMs,500,30000),refreshDebounceMs:B(J.refreshDebounceMs,X.refreshDebounceMs,50,5000),header:{label:d(Z.label,X.header.label,20),showVersion:V(Z.showVersion,X.header.showVersion)},sections:{quota:V(G.quota,X.sections.quota),fallbackAccounts:V(G.fallbackAccounts,X.sections.fallbackAccounts),routing:V(G.routing,X.sections.routing),health:V(G.health,X.sections.health),pacing:V(G.pacing,X.sections.pacing)},appearance:{barWidth:B($.barWidth,X.appearance.barWidth,4,40),barFilledChar:h($.barFilledChar,X.appearance.barFilledChar),barEmptyChar:h($.barEmptyChar,X.appearance.barEmptyChar),warnThreshold:W,errorThreshold:H}}}var n=-1e5;function $z(Q,J,X){let Z=Q[J];if(!N(Z))return X;if(Z.forceToTop===!0)return n+Object.keys(Q).indexOf(J);return B(Z.order,X,-1e4,1e4)}var t=`// Shared preferences for opencode TUI plugins.
 // One top-level key per plugin (short name). See each plugin's README for
 // its supported settings. This file is safe to hand-edit; plugins update
 // individual keys in place and preserve comments.

package/dist/tui.d.ts

@@ -1,6 +1,9 @@
 /** @jsxImportSource @opentui/solid */
 import type { TuiPluginModule } from '@opencode-ai/plugin/tui';
+import type { ApplyRequest, CommandModalName } from './rpc/protocol.js';
 import { type AccountQuota, type QuotaPacing, type QuotaWindow, type SidebarState } from './sidebar-state.js';
+export declare function buildApplyRequest(command: CommandModalName, arguments_: string, sessionId?: string): ApplyRequest;
+type Tone = 'ok' | 'warn' | 'err' | 'muted' | 'accent' | 'text';
 export declare function formatResetIn(resetsAt: string | undefined): string;
 export interface QuotaDisplayRow {
     key: 'primary' | 'secondary';
@@ -20,6 +23,12 @@ export declare function getAccountMetadataRows(resetCredits: number | undefined)
 }>;
 export declare function readStateFromFile(): Promise<SidebarState>;
 export declare function resolveQuotaDialogActiveId(state: SidebarState, sessionId: string | undefined, now?: number): string | undefined;
+export interface RoutingDisplayRow {
+    label: string;
+    value: string;
+    tone: Tone;
+}
+export declare function buildRoutingRowsForDisplay(state: SidebarState, sessionId: string | undefined, now?: number): RoutingDisplayRow[];
 declare const plugin: TuiPluginModule & {
     id: string;
 };

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const PackageVersion = "0.4.2";
+export declare const PackageVersion = "0.5.0";

package/dist/ws-pool.d.ts

@@ -20,17 +20,8 @@ export interface CreateWebSocketFetchOptions {
      * shared mutable global.
      */
     onQuota?: (s: Record<string, unknown>, accessToken: string, accountId: string | undefined, servedChatgptAccountId: string | undefined) => void;
-    /**
-     * Fires when a response.failed frame carries a rate_limit_reached_type —
-     * mid-stream quota exhaustion the reactive HTTP-status fallback cannot see
-     * on the WebSocket transport (ws.ts synthesizes status:200 at upgrade,
-     * before generation runs).
-     *
-     * Receives the window label plus the per-request internal quota account key
-     * captured at send time, same as onQuota, so the signal is attributed to
-     * the connection's own account rather than a shared mutable global.
-     */
-    onRateLimitReached?: (window: string, accountId: string | undefined) => void;
+    /** Receives quota exhaustion plus the account identity captured at send time. */
+    onRateLimitReached?: (window: string, accountId: string | undefined, resetAt?: number) => void;
 }
 interface PoolEntry {
     socket?: WebSocket;

package/dist/ws.d.ts

@@ -30,8 +30,8 @@ export interface StreamResponsesWebSocketOptions {
     onAbort?: (error: Error) => void;
     /** Push per-turn quota from a codex.rate_limits in-band frame. */
     onQuota?: (s: Record<string, unknown>) => void;
-    /** Called when response.failed carries a rate_limit_reached_type — the only mid-stream quota-exhaustion signal on this transport. */
-    onRateLimitReached?: (window: string) => void;
+    /** Called when the transport reports quota exhaustion for the current connection. */
+    onRateLimitReached?: (window: string, resetAt?: number) => void;
 }
 export interface WrappedError {
     status: number;
@@ -41,6 +41,11 @@ export interface WrappedError {
 export declare function toWebSocketUrl(url: string): string;
 export declare function normalizeHeaders(headers: HeadersInit | undefined): Record<string, string>;
 export declare function isAbortError(error: unknown): error is DOMException;
+export declare function isUpgradeFailure(error: unknown): boolean;
 export declare function connectResponsesWebSocket(options: ConnectResponsesWebSocketOptions): Promise<WebSocket>;
 export declare function streamResponsesWebSocket(options: StreamResponsesWebSocketOptions): Response;
+export declare function parseRateLimitSignal(value: unknown): {
+    window: string;
+    resetAt?: number;
+} | undefined;
 export * as OpenAIWebSocket from './ws';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/opencode-openai-auth",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "license": "MIT",
   "type": "module",
   "repository": {
@@ -63,7 +63,7 @@
   "dependencies": {
     "@opentui/core": ">=0.4.5",
     "@opentui/solid": ">=0.4.5",
-    "ai": "^7.0.34",
+    "ai": "^7.0.48",
     "jsonc-parser": "^3.3.1",
     "solid-js": "1.9.12"
   }

package/src/rpc/port-file.ts

@@ -1,12 +1,18 @@
+import type { Dirent } from 'node:fs'
 import {
+  chmod,
   mkdir,
   readdir,
   readFile,
   rename,
+  rmdir,
   unlink,
   writeFile,
 } from 'node:fs/promises'
-import { join } from 'node:path'
+import { join, resolve } from 'node:path'
+import { createLogger } from '../logger'
+
+const log = createLogger('rpc')
 
 export interface PortFileEntry {
   port: number
@@ -24,17 +30,118 @@ function pidAlive(pid: number): boolean {
   }
 }
 
+function isManagedRpcStateDir(name: string): boolean {
+  return /^(?:openai-auth-)?[0-9a-f]{16}$/.test(name)
+}
+
+function isUsablePortFileEntry(value: unknown): value is PortFileEntry {
+  return (
+    value !== null &&
+    typeof value === 'object' &&
+    !Array.isArray(value) &&
+    typeof (value as { pid?: unknown }).pid === 'number' &&
+    Number.isFinite((value as { pid: number }).pid) &&
+    typeof (value as { port?: unknown }).port === 'number' &&
+    Number.isFinite((value as { port: number }).port)
+  )
+}
+
+async function removeCorruptPortFile(portFile: string): Promise<void> {
+  log.debug('rpc corrupt port file', { pid: process.pid, portFile })
+  await unlink(portFile).catch(() => {})
+}
+
 export async function writePortFile(
   dir: string,
   entry: { port: number; token: string; pid: number },
+  options: {
+    secureDir?: boolean
+    beforeWrite?: () => void | Promise<void>
+  } = {},
 ): Promise<string> {
-  await mkdir(dir, { recursive: true })
-  const full: PortFileEntry = { ...entry, startedAt: Date.now() }
-  const target = join(dir, `port-${entry.pid}.json`)
-  const tmp = `${target}.${process.pid}.tmp`
-  await writeFile(tmp, JSON.stringify(full), { encoding: 'utf8', mode: 0o600 })
-  await rename(tmp, target)
-  return target
+  // The directory can be removed by another project's sweep between our
+  // mkdir and the first writeFile/rename, so the whole create-then-rename
+  // unit is retried once on ENOENT. The retry recreates the directory; a
+  // persistent ENOENT (e.g. permission, read-only parent) will surface on
+  // the second attempt — failing fast beats an unbounded loop.
+  const writeOnce = async (): Promise<string> => {
+    await mkdir(dir, {
+      recursive: true,
+      mode: options.secureDir ? 0o700 : undefined,
+    })
+    if (options.secureDir) await chmod(dir, 0o700)
+    await options.beforeWrite?.()
+    const full: PortFileEntry = { ...entry, startedAt: Date.now() }
+    const target = join(dir, `port-${entry.pid}.json`)
+    const tmp = `${target}.${process.pid}.tmp`
+    await writeFile(tmp, JSON.stringify(full), {
+      encoding: 'utf8',
+      mode: 0o600,
+    })
+    await rename(tmp, target)
+    return target
+  }
+  try {
+    return await writeOnce()
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+      return await writeOnce()
+    }
+    throw error
+  }
+}
+
+export async function sweepRpcState(
+  root: string,
+  activeDir: string,
+): Promise<void> {
+  let projectDirs: Dirent<string>[]
+  try {
+    projectDirs = await readdir(root, { withFileTypes: true })
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return
+    throw error
+  }
+
+  const active = resolve(activeDir)
+  for (const projectDir of projectDirs) {
+    if (!projectDir.isDirectory() || !isManagedRpcStateDir(projectDir.name)) {
+      continue
+    }
+    const dir = join(root, projectDir.name)
+    let names: string[]
+    try {
+      names = await readdir(dir)
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') continue
+      throw error
+    }
+    for (const name of names) {
+      if (!name.startsWith('port-') || !name.endsWith('.json')) continue
+      const portFile = join(dir, name)
+      let raw: string | undefined
+      try {
+        raw = await readFile(portFile, 'utf8')
+      } catch {
+        continue
+      }
+      if (raw === undefined) continue
+      let parsed: unknown
+      try {
+        parsed = JSON.parse(raw)
+      } catch {
+        await removeCorruptPortFile(portFile)
+        continue
+      }
+      if (!isUsablePortFileEntry(parsed)) {
+        await removeCorruptPortFile(portFile)
+        continue
+      }
+      const entry = parsed
+      if (!pidAlive(entry.pid)) await unlink(portFile).catch(() => {})
+    }
+    if (resolve(dir) !== active) await rmdir(dir).catch(() => {})
+  }
 }
 
 export async function discoverPortFile(

package/src/rpc/protocol.ts

@@ -23,6 +23,7 @@ export interface RpcNotification {
 export interface ApplyRequest {
   command: CommandModalName
   arguments: string
+  sessionId?: string
 }
 
 export interface ApplyResult {

package/src/rpc/rpc-dir.ts

@@ -1,9 +1,27 @@
 import { createHash } from 'node:crypto'
 import { homedir, tmpdir } from 'node:os'
-import { join, resolve } from 'node:path'
+import { dirname, join, resolve } from 'node:path'
 
 const RPC_DIR_ENV = 'OPENCODE_OPENAI_AUTH_RPC_DIR'
 
+export interface RpcDirResolution {
+  dir: string
+  secureDir: boolean
+  sweepRoot?: string
+}
+
+function rpcHash(projectDirectory: string): string {
+  return createHash('sha256')
+    .update(projectDirectory)
+    .digest('hex')
+    .slice(0, 16)
+}
+
+function defaultRpcRoot(): string {
+  const base = process.env.XDG_STATE_HOME || join(homedir(), '.local', 'state')
+  return join(base, 'cortexkit', 'openai-auth', 'rpc')
+}
+
 // Both processes must resolve the SAME dir from the SAME project directory.
 export function getRpcDir(projectDirectory: string): string {
   const override = process.env[RPC_DIR_ENV]?.trim()
@@ -11,12 +29,18 @@ export function getRpcDir(projectDirectory: string): string {
   // so server and TUI halves always resolve the same dir. An absolute override is
   // used as-is (resolve(base, absolute) returns the absolute path unchanged).
   if (override) return resolve(projectDirectory, override)
-  const hash = createHash('sha256')
-    .update(projectDirectory)
-    .digest('hex')
-    .slice(0, 16)
-  const base = process.env.XDG_STATE_HOME || join(homedir(), '.local', 'state')
-  return join(base, 'cortexkit', 'openai-auth', 'rpc', hash)
+  return join(defaultRpcRoot(), `openai-auth-${rpcHash(projectDirectory)}`)
+}
+
+export async function resolveRpcDir(
+  projectDirectory: string,
+): Promise<RpcDirResolution> {
+  const override = process.env[RPC_DIR_ENV]?.trim()
+  if (override) {
+    return { dir: resolve(projectDirectory, override), secureDir: false }
+  }
+  const dir = getRpcDir(projectDirectory)
+  return { dir, secureDir: true, sweepRoot: dirname(dir) }
 }
 
 export { tmpdir }

package/src/rpc/rpc-server.ts

@@ -8,7 +8,7 @@ import {
 import { join } from 'node:path'
 import { createLogger } from '../logger'
 import type { drainNotifications } from './notifications'
-import { writePortFile } from './port-file'
+import { sweepRpcState, writePortFile } from './port-file'
 import type { ApplyRequest, ApplyResult } from './protocol'
 
 const log = createLogger('rpc')
@@ -21,6 +21,8 @@ export interface RpcServerHandle {
 
 export interface RpcServerOptions {
   dir: string
+  secureDir?: boolean
+  sweepRoot?: string
   drain: typeof drainNotifications
   apply: (request: ApplyRequest) => Promise<ApplyResult>
   timeoutMs?: number
@@ -112,8 +114,22 @@ export async function startRpcServer(
     })
   })
   server.unref()
+  if (options.sweepRoot) {
+    try {
+      await sweepRpcState(options.sweepRoot, options.dir)
+    } catch (error) {
+      log.warn('rpc state sweep failed', {
+        pid: process.pid,
+        error: error instanceof Error ? error.message : String(error),
+      })
+    }
+  }
   try {
-    await writePortFile(options.dir, { port, token, pid: process.pid })
+    await writePortFile(
+      options.dir,
+      { port, token, pid: process.pid },
+      { secureDir: options.secureDir },
+    )
     log.debug('rpc server pid', {
       pid: process.pid,
       rpcPort: port,