@cortexkit/opencode-openai-auth 0.8.0 → 0.9.1

package/src/tui-compiled/raw/core-custody-state.ts

@@ -0,0 +1,243 @@
+export type CustodyMode = 'local' | 'claustrum'
+
+export type ManifestCustodyState = 'absent' | 'present' | 'unreadable'
+
+export type LocalCustodyState =
+  | 'real'
+  | 'tombstone'
+  | 'empty'
+  | 'gone'
+  | 'slot-absent'
+
+export type VaultCustodyState =
+  | 'serves'
+  | 'cold'
+  | 'needs_reauth'
+  | 'identity_mismatch'
+  | 'no_handle'
+
+export const CUSTODY_INERT_REASONS = [
+  'needs-login',
+  'mode-mismatch',
+  'corrupt-under-binding',
+  'manifest-unreadable',
+  'unbound-under-claustrum',
+  'orphan-tombstone',
+  'vault-cold',
+  'vault-reauth',
+  'identity-mismatch',
+  'no-handle',
+  'takeover-incomplete',
+  'new-local-family-under-claustrum',
+  'takeover-incomplete/vault-unavailable',
+  'takeover-incomplete/slot-absent',
+] as const
+
+export type CustodyInertReason = (typeof CUSTODY_INERT_REASONS)[number]
+
+export type CustodyVerdict =
+  | { kind: 'LOCAL' }
+  | {
+      kind: 'VAULT'
+      canonicalize?: boolean
+      installTombstone?: boolean
+    }
+  | {
+      kind: 'INERT'
+      reason: CustodyInertReason
+      installTombstone?: boolean
+      canonicalize?: boolean
+    }
+  | { kind: 'NEEDS_LOGIN'; reason?: 'corrupt' }
+
+export interface EvaluateCustodyStartupInput {
+  mode: CustodyMode
+  manifest: ManifestCustodyState
+  local: LocalCustodyState
+  vault: () => VaultCustodyState
+  manifestFailureReason?: string
+  fingerprintMatch?: boolean
+  verifiedInProcessLogin: boolean
+  isMain?: boolean
+}
+
+function unreachable(value: never): never {
+  return value
+}
+
+function withCanonicalization<
+  T extends Extract<CustodyVerdict, { kind: 'VAULT' | 'INERT' }>,
+>(local: LocalCustodyState, verdict: T): T | (T & { canonicalize: true }) {
+  return local === 'empty' ? { ...verdict, canonicalize: true } : verdict
+}
+
+function evaluateLocal(local: LocalCustodyState): CustodyVerdict {
+  switch (local) {
+    case 'real':
+      return { kind: 'LOCAL' }
+    case 'tombstone':
+    case 'empty':
+    case 'slot-absent':
+      return { kind: 'NEEDS_LOGIN' }
+    case 'gone':
+      return { kind: 'NEEDS_LOGIN', reason: 'corrupt' }
+  }
+  return unreachable(local)
+}
+
+function evaluateLocalWithBinding(
+  local: LocalCustodyState,
+  verifiedInProcessLogin: boolean,
+): CustodyVerdict {
+  switch (local) {
+    case 'real':
+      return verifiedInProcessLogin
+        ? { kind: 'LOCAL' }
+        : { kind: 'INERT', reason: 'needs-login' }
+    case 'tombstone':
+    case 'empty':
+    case 'slot-absent':
+      return { kind: 'INERT', reason: 'mode-mismatch' }
+    case 'gone':
+      return { kind: 'INERT', reason: 'corrupt-under-binding' }
+  }
+  return unreachable(local)
+}
+
+function evaluateUnboundClaustrum(local: LocalCustodyState): CustodyVerdict {
+  switch (local) {
+    case 'tombstone':
+    case 'empty':
+      return { kind: 'INERT', reason: 'orphan-tombstone' }
+    case 'real':
+    case 'gone':
+    case 'slot-absent':
+      return { kind: 'INERT', reason: 'unbound-under-claustrum' }
+  }
+  return unreachable(local)
+}
+
+function evaluateTombstone(
+  local: Extract<LocalCustodyState, 'tombstone' | 'empty'>,
+  vault: VaultCustodyState,
+): CustodyVerdict {
+  switch (vault) {
+    case 'serves':
+      return withCanonicalization(local, { kind: 'VAULT' })
+    case 'cold':
+      return withCanonicalization(local, {
+        kind: 'INERT',
+        reason: 'vault-cold',
+      })
+    case 'needs_reauth':
+      return withCanonicalization(local, {
+        kind: 'INERT',
+        reason: 'vault-reauth',
+      })
+    case 'identity_mismatch':
+      return withCanonicalization(local, {
+        kind: 'INERT',
+        reason: 'identity-mismatch',
+      })
+    case 'no_handle':
+      return withCanonicalization(local, { kind: 'INERT', reason: 'no-handle' })
+  }
+  return unreachable(vault)
+}
+
+function evaluateReal(
+  vault: VaultCustodyState,
+  fingerprintMatch: boolean | undefined,
+): CustodyVerdict {
+  switch (vault) {
+    case 'serves':
+      return fingerprintMatch === false
+        ? { kind: 'INERT', reason: 'new-local-family-under-claustrum' }
+        : { kind: 'INERT', reason: 'takeover-incomplete' }
+    case 'cold':
+    case 'needs_reauth':
+      return { kind: 'INERT', reason: 'takeover-incomplete/vault-unavailable' }
+    case 'identity_mismatch':
+      return { kind: 'INERT', reason: 'identity-mismatch' }
+    case 'no_handle':
+      return { kind: 'INERT', reason: 'no-handle' }
+  }
+  return unreachable(vault)
+}
+
+function evaluateGone(vault: VaultCustodyState): CustodyVerdict {
+  switch (vault) {
+    case 'serves':
+      return { kind: 'VAULT', installTombstone: true }
+    case 'cold':
+      return { kind: 'INERT', reason: 'vault-cold', installTombstone: true }
+    case 'needs_reauth':
+      return { kind: 'INERT', reason: 'vault-reauth', installTombstone: true }
+    case 'identity_mismatch':
+      return { kind: 'INERT', reason: 'identity-mismatch' }
+    case 'no_handle':
+      return { kind: 'INERT', reason: 'no-handle' }
+  }
+  return unreachable(vault)
+}
+
+function evaluateSlotAbsent(vault: VaultCustodyState): CustodyVerdict {
+  switch (vault) {
+    case 'serves':
+    case 'cold':
+    case 'needs_reauth':
+      return { kind: 'INERT', reason: 'takeover-incomplete/slot-absent' }
+    case 'identity_mismatch':
+      return { kind: 'INERT', reason: 'identity-mismatch' }
+    case 'no_handle':
+      return { kind: 'INERT', reason: 'no-handle' }
+  }
+  return unreachable(vault)
+}
+
+function evaluatePresentClaustrum(
+  local: LocalCustodyState,
+  vault: VaultCustodyState,
+  fingerprintMatch: boolean | undefined,
+): CustodyVerdict {
+  switch (local) {
+    case 'tombstone':
+    case 'empty':
+      return evaluateTombstone(local, vault)
+    case 'real':
+      return evaluateReal(vault, fingerprintMatch)
+    case 'gone':
+      return evaluateGone(vault)
+    case 'slot-absent':
+      return evaluateSlotAbsent(vault)
+  }
+  return unreachable(local)
+}
+
+export function evaluateCustodyStartup(
+  input: EvaluateCustodyStartupInput,
+): CustodyVerdict {
+  if (input.manifest === 'unreadable') {
+    return { kind: 'INERT', reason: 'manifest-unreadable' }
+  }
+
+  switch (input.mode) {
+    case 'local':
+      return input.manifest === 'present'
+        ? evaluateLocalWithBinding(input.local, input.verifiedInProcessLogin)
+        : evaluateLocal(input.local)
+    case 'claustrum':
+      if (input.manifest === 'absent') {
+        return evaluateUnboundClaustrum(input.local)
+      }
+      if (input.manifest === 'present') {
+        return evaluatePresentClaustrum(
+          input.local,
+          input.vault(),
+          input.fingerprintMatch,
+        )
+      }
+      return unreachable(input.manifest)
+  }
+  return unreachable(input.mode)
+}

package/src/tui-compiled/raw/sidebar-state.ts

@@ -6,10 +6,25 @@ export interface QuotaWindow {
   windowMinutes?: number
 }
 
+export interface SpendControlReading {
+  limit: number
+  used: number
+  remaining: number
+  usedPercent: number
+  remainingPercent: number
+  resetsAt?: string
+  unit?: string
+  source?: string
+  reached: boolean
+}
+
 export interface AccountQuota {
   checkedAt?: number
   primary?: QuotaWindow
   secondary?: QuotaWindow
+  spendControl?: SpendControlReading
+  // The source reported that no credit budget exists; see OAuthQuotaSnapshot.
+  spendControlCleared?: true
   resetCreditsAvailable?: number
 }
 
@@ -88,6 +103,17 @@ export interface SidebarAccountState {
   killed: boolean
   enabled: boolean
   resetCredits?: number
+  custody?: SidebarAccountCustody
+}
+
+export type SidebarCustodyState = 'vault' | 'needsLogin' | 'local' | 'inert'
+
+export type SidebarCustodyReason = CustodyInertReason | 'corrupt'
+
+export interface SidebarAccountCustody {
+  state: SidebarCustodyState
+  reason?: SidebarCustodyReason
+  recordVersion?: number
 }
 
 export interface ActiveRoutingEntry {
@@ -132,6 +158,7 @@ export interface SidebarState {
     quota: AccountQuota | null
     /** ChatGPT identity of the main account this quota belongs to. */
     mainAccountId?: string
+    custody?: SidebarAccountCustody
     killed: boolean
     quotaBackedOff?: boolean
     quotaBackoffUntil?: number
@@ -156,6 +183,11 @@ import { chmod, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { acquireRefreshFileLock } from '../shared/internal.ts'
+import {
+  CUSTODY_INERT_REASONS,
+  type CustodyInertReason,
+  type CustodyVerdict,
+} from './core-custody-state.ts'
 import { createLogger } from './logger.ts'
 
 const logSb = createLogger('sidebar')
@@ -183,6 +215,49 @@ function resetCreditsField(value: unknown): { resetCredits?: number } {
   return credits !== undefined ? { resetCredits: credits } : {}
 }
 
+const CUSTODY_STATES = new Set<SidebarCustodyState>([
+  'vault',
+  'needsLogin',
+  'local',
+  'inert',
+])
+
+const CUSTODY_REASONS = new Set<SidebarCustodyReason>([
+  ...CUSTODY_INERT_REASONS,
+  'corrupt',
+])
+
+/**
+ * Tolerant reader for the per-fallback `custody` projection. Unknown state
+ * or reason values are dropped (NOT replaced with a default — a stale state
+ * file with an experimental `vaultHealing` value must not silently render
+ * as `local`, it must render as no-projection-at-all). Valid values round-
+ * trip byte-identical. The output contains only `state` and `reason`.
+ */
+function normalizeSidebarCustody(
+  value: unknown,
+): SidebarAccountCustody | undefined {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+    return undefined
+  }
+  const c = value as Record<string, unknown>
+  if (
+    typeof c.state !== 'string' ||
+    !CUSTODY_STATES.has(c.state as SidebarCustodyState)
+  ) {
+    return undefined
+  }
+  const state = c.state as SidebarCustodyState
+  const out: SidebarAccountCustody = { state }
+  if (
+    typeof c.reason === 'string' &&
+    CUSTODY_REASONS.has(c.reason as SidebarCustodyReason)
+  ) {
+    out.reason = c.reason as SidebarCustodyReason
+  }
+  return out
+}
+
 function normalizeActiveRouting(value: unknown): ActiveRoutingMap | undefined {
   if (value === null || typeof value !== 'object' || Array.isArray(value)) {
     return undefined
@@ -276,6 +351,23 @@ export function getSidebarStateFile(): string {
   return process.env[STATE_FILE_ENV] || DEFAULT_STATE_FILE
 }
 
+export function projectCustodyForSidebar(
+  verdict: CustodyVerdict,
+): SidebarAccountCustody {
+  switch (verdict.kind) {
+    case 'LOCAL':
+      return { state: 'local' }
+    case 'VAULT':
+      return { state: 'vault' }
+    case 'INERT':
+      return { state: 'inert', reason: verdict.reason }
+    case 'NEEDS_LOGIN':
+      return verdict.reason === 'corrupt'
+        ? { state: 'needsLogin', reason: 'corrupt' }
+        : { state: 'needsLogin' }
+  }
+}
+
 export const DEFAULT_SIDEBAR_STATE: SidebarState = {
   main: { quota: null, killed: false },
   fallbacks: [],
@@ -315,6 +407,10 @@ export function normalizeSidebarState(raw: unknown): SidebarState {
       ...(typeof m.mainAccountId === 'string'
         ? { mainAccountId: m.mainAccountId }
         : {}),
+      ...(() => {
+        const custody = normalizeSidebarCustody(m.custody)
+        return custody ? { custody } : {}
+      })(),
       // Preserve optional backoff fields if present
       ...(typeof m.quotaBackedOff === 'boolean'
         ? { quotaBackedOff: m.quotaBackedOff }
@@ -347,17 +443,21 @@ export function normalizeSidebarState(raw: unknown): SidebarState {
             !Array.isArray(entry) &&
             typeof (entry as Record<string, unknown>).id === 'string',
         )
-        .map((e) => ({
-          id: e.id as string,
-          label: typeof e.label === 'string' ? e.label : undefined,
-          ...(typeof e.accountId === 'string'
-            ? { accountId: e.accountId }
-            : {}),
-          quota: ('quota' in e ? e.quota : null) as AccountQuota | null,
-          killed: typeof e.killed === 'boolean' ? e.killed : false,
-          enabled: typeof e.enabled === 'boolean' ? e.enabled : true,
-          ...resetCreditsField(e.resetCredits),
-        }))
+        .map((e) => {
+          const custody = normalizeSidebarCustody(e.custody)
+          return {
+            id: e.id as string,
+            label: typeof e.label === 'string' ? e.label : undefined,
+            ...(typeof e.accountId === 'string'
+              ? { accountId: e.accountId }
+              : {}),
+            quota: ('quota' in e ? e.quota : null) as AccountQuota | null,
+            killed: typeof e.killed === 'boolean' ? e.killed : false,
+            enabled: typeof e.enabled === 'boolean' ? e.enabled : true,
+            ...resetCreditsField(e.resetCredits),
+            ...(custody ? { custody } : {}),
+          }
+        })
     : []
 
   // activeId — string or undefined
@@ -428,6 +528,27 @@ export function isUsableRoutingEntry(
   )
 }
 
+// The credit budget's own exhaustion signal, shared by admission and sticky
+// migration so both agree on what "spent" means. `reached` is the provider's
+// authoritative boolean — the percentage is only a display approximation — and
+// the check fails open on a missing or lapsed reset exactly like a rate-limit
+// window, so a stale or corrupt reading never blocks.
+export function spendControlExhaustedResetAt(
+  quota: AccountQuota | null | undefined,
+  now = Date.now(),
+): { resetsAt: string; resetAtMs: number } | undefined {
+  const spendControl = quota?.spendControl
+  if (
+    spendControl?.reached !== true ||
+    typeof spendControl.resetsAt !== 'string'
+  ) {
+    return undefined
+  }
+  const resetAtMs = Date.parse(spendControl.resetsAt)
+  if (!Number.isFinite(resetAtMs) || resetAtMs <= now) return undefined
+  return { resetsAt: spendControl.resetsAt, resetAtMs }
+}
+
 // Earliest future reset among the quota's exhausted windows, or undefined when
 // no present window is exhausted. Every present window is evaluated — matching
 // the admission policy, which rejects an account when ANY live window is below
@@ -454,6 +575,12 @@ export function exhaustedQuotaResetAt(
       earliest = { resetsAt: window.resetsAt, resetAtMs }
     }
   }
+  // The credit budget is a third axis on its own reset clock (a month, not
+  // 5h/7d), judged by the same shared signal sticky migration uses.
+  const spendReset = spendControlExhaustedResetAt(quota, now)
+  if (spendReset && (!earliest || spendReset.resetAtMs < earliest.resetAtMs)) {
+    earliest = spendReset
+  }
   return earliest
 }
 
@@ -979,6 +1106,19 @@ function freshestWindow(
 // of the merged result. Only safe when both snapshots share an account identity
 // (sameAccountIdentity) — an identity switch must whole-pick (freshestQuota) so
 // windows from two accounts are never combined.
+// The fresher side decides the budget when it knows anything about it: its own
+// reading, or its report that no budget exists. Only when it says nothing (a
+// header or WebSocket push, which never carries spend control) does the other
+// side's reading survive, and even then not if that side reported none.
+function mergeSpendControl(
+  fresher: AccountQuota,
+  older: AccountQuota,
+): SpendControlReading | undefined {
+  if (fresher.spendControl !== undefined) return fresher.spendControl
+  if (fresher.spendControlCleared === true) return undefined
+  return older.spendControl
+}
+
 function mergeQuotaByWindow(
   incoming: AccountQuota | null,
   existing: AccountQuota | null,
@@ -1004,6 +1144,13 @@ function mergeQuotaByWindow(
     incoming.checkedAt,
     existing.checkedAt,
   )
+  const spendControl = existingSnapshotIsFresher
+    ? mergeSpendControl(existing, incoming)
+    : mergeSpendControl(incoming, existing)
+  const spendControlCleared =
+    spendControl === undefined &&
+    (incoming.spendControlCleared === true ||
+      existing.spendControlCleared === true)
   let checkedAt: number | undefined
   for (const stamp of [
     finiteWindowCheckedAt(primary),
@@ -1013,10 +1160,19 @@ function mergeQuotaByWindow(
       checkedAt = checkedAt === undefined ? stamp : Math.max(checkedAt, stamp)
     }
   }
+  // Both budget fields are decided above, so neither may leak in from the
+  // spread: an older incoming budget must not survive a fresher "no budget".
+  const {
+    spendControl: _incomingSpendControl,
+    spendControlCleared: _incomingCleared,
+    ...incomingRest
+  } = incoming
   return {
-    ...incoming,
+    ...incomingRest,
     primary,
     secondary,
+    ...(spendControl !== undefined ? { spendControl } : {}),
+    ...(spendControlCleared ? { spendControlCleared: true as const } : {}),
     checkedAt: checkedAt ?? incoming.checkedAt,
   }
 }

package/src/tui-compiled/raw/tui-command-dialogs.tsx

@@ -619,7 +619,7 @@ export function openCommandDialog(
   }
 
   if (payload.command === 'openai-account') {
-    openAccountDialog(api, apply, sessionId)
+    openAccountDialog(api, apply, sessionId, payload)
     return
   }
 
@@ -676,12 +676,71 @@ export function buildAccountDialogRows(
   ]
 }
 
+export function accountDialogModeOption(mode: unknown) {
+  const claustrum = mode === 'claustrum'
+  return {
+    title: claustrum ? 'Leave Claustrum' : 'Enter Claustrum',
+    value: claustrum ? '__local__' : '__claustrum__',
+    description: claustrum
+      ? 'Require fresh local logins before local refresh resumes'
+      : 'Verify every enabled account before custody takes over',
+  }
+}
+
+export function buildFallbackAccountOptions(input: {
+  id: string
+  label?: string
+  enabled: boolean
+  index: number
+  count: number
+}) {
+  const name = input.label ?? input.id
+  const options: Array<{
+    title: string
+    value: string
+    description: string
+  }> = [
+    {
+      title: input.enabled ? 'Disable' : 'Enable',
+      value: input.enabled ? 'disable' : 'enable',
+      description: `${input.enabled ? 'Disable' : 'Enable'} ${name}`,
+    },
+    {
+      title: 'Remove',
+      value: 'remove',
+      description: `Remove ${name}`,
+    },
+  ]
+  if (input.index > 0) {
+    options.push({
+      title: 'Move up',
+      value: 'move_up',
+      description: 'Swap with the preceding fallback',
+    })
+  }
+  if (input.index < input.count - 1) {
+    options.push({
+      title: 'Move down',
+      value: 'move_down',
+      description: 'Swap with the following fallback',
+    })
+  }
+  options.push({
+    title: 'Back',
+    value: 'back',
+    description: 'Return to account list',
+  })
+  return options
+}
+
 function openAccountDialog(
   api: TuiPluginApi,
   apply: ApplyFn,
   sessionId?: string,
+  payload?: OpenDialogPayload,
 ) {
   const DialogConfirm = api.ui.DialogConfirm
+  let claustrumMode = payload?.knobs.claustrumMode
 
   function showL1() {
     void getSidebarState().then((state) => {
@@ -691,6 +750,7 @@ function openAccountDialog(
         <DialogSelectInner
           title='OpenAI Accounts'
           options={[
+            accountDialogModeOption(claustrumMode),
             ...buildAccountDialogRows(state, sessionId),
             {
               title: 'Add account\u2026',
@@ -699,6 +759,19 @@ function openAccountDialog(
             },
           ]}
           onSelect={(option) => {
+            if (
+              option.value === '__claustrum__' ||
+              option.value === '__local__'
+            ) {
+              const args =
+                option.value === '__claustrum__' ? 'claustrum' : 'local'
+              void apply('openai-account', args).then((r) => {
+                api.ui.toast({ message: r.text })
+                claustrumMode = r.knobs.claustrumMode
+                showL1()
+              })
+              return
+            }
             if (option.value === '__add__') {
               showAddFlow()
               return
@@ -722,44 +795,12 @@ function openAccountDialog(
         showL1()
         return
       }
-      const options: Array<{
-        title: string
-        value: string
-        description: string
-      }> = []
-
-      options.push({
-        title: 'Remove',
-        value: 'remove',
-        description: `Remove ${fb.label ?? fb.id}`,
-      })
-
-      if (fbIndex > 0) {
-        const neighbor = state.fallbacks[fbIndex - 1]
-        if (neighbor) {
-          options.push({
-            title: 'Move up',
-            value: 'move_up',
-            description: `Swap with ${neighbor.label ?? neighbor.id}`,
-          })
-        }
-      }
-
-      if (fbIndex < state.fallbacks.length - 1) {
-        const neighbor = state.fallbacks[fbIndex + 1]
-        if (neighbor) {
-          options.push({
-            title: 'Move down',
-            value: 'move_down',
-            description: `Swap with ${neighbor.label ?? neighbor.id}`,
-          })
-        }
-      }
-
-      options.push({
-        title: 'Back',
-        value: 'back',
-        description: 'Return to account list',
+      const options = buildFallbackAccountOptions({
+        id: fb.id,
+        label: fb.label,
+        enabled: fb.enabled,
+        index: fbIndex,
+        count: state.fallbacks.length,
       })
 
       api.ui.dialog.setSize('xlarge')
@@ -785,6 +826,15 @@ function openAccountDialog(
               ))
               return
             }
+            if (option.value === 'enable' || option.value === 'disable') {
+              void apply('openai-account', `${option.value} ${id}`).then(
+                (r) => {
+                  api.ui.toast({ message: r.text })
+                  showL1()
+                },
+              )
+              return
+            }
             if (option.value === 'move_up') {
               const neighbor = state.fallbacks[fbIndex - 1]
               if (neighbor) {