@cortexkit/opencode-openai-auth 1.1.0 → 1.3.0

package/src/tui-compiled/raw/shared/375d9cca2def037d-private-files.js

@@ -184,19 +184,25 @@ export async function replaceWindowsFile(from, to, options = {}) {
     to = resolve(to);
     const now = options.now ?? (() => performance.now());
     const start = now();
-    const deadline = Math.min(start + 500, options.deadline ?? Infinity);
+    const leaseDeadline = options.deadline ?? Infinity;
+    let retryDeadline;
     const delays = [0, 10, 20, 40, 80, 100];
     let original;
     let attempts = 0;
     for (const delay of delays) {
+        const deadline = Math.min(retryDeadline ?? Infinity, leaseDeadline);
         if (now() >= deadline)
             break;
         if (delay)
             await (options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))))(Math.min(delay, Math.max(0, deadline - now())));
         if (now() >= deadline)
             break;
+        const fenceStart = now();
         await options.beforeRename?.();
-        if (now() >= deadline)
+        // Ownership checks fence every attempt but do not spend the sharing-retry budget.
+        if (retryDeadline !== undefined)
+            retryDeadline += now() - fenceStart;
+        if (now() >= leaseDeadline)
             break;
         attempts++;
         try {
@@ -212,6 +218,8 @@ export async function replaceWindowsFile(from, to, options = {}) {
                     !detail.reason;
             if (!candidate)
                 break;
+            // Start the retry window only once a rename has actually failed.
+            retryDeadline ??= now() + 500;
         }
     }
     const error = new PrivateFileError(to, 'rename', original ??

package/src/tui-compiled/raw/shared/94f53cfd572ba4bb-availability.js

@@ -0,0 +1,106 @@
+import { ClaustrumCredentialError } from "@cortexkit/claustrum-client";
+import { SocketClosedError, SocketTimeoutError, SubcCallError, } from "@cortexkit/subc-client";
+import { ClaustrumConsumerError } from "./ca0fccaba1d87af4-errors.js";
+/**
+ * Codes from claustrum-client's decoder and its subc transport. A retry action
+ * alone is not evidence of an outage: even transient vault refusals must win
+ * over a previously served credential. New codes fail closed until reviewed.
+ */
+export const VAULT_FAILURE_CLASSES = Object.freeze({
+    ECONNREFUSED: 'unreachable',
+    ENOENT: 'unreachable',
+    ECONNRESET: 'unreachable',
+    EPIPE: 'unreachable',
+    ETIMEDOUT: 'unreachable',
+    transport_error: 'unreachable',
+    unavailable: 'unreachable',
+    timeout: 'unreachable',
+    route_closed: 'unreachable',
+    daemon_draining: 'unreachable',
+    connection_closed: 'unreachable',
+    connection_dropped: 'unreachable',
+    request_deadline: 'unreachable',
+    deadline_exceeded_no_drop_observed: 'unreachable',
+    module_reloading: 'unreachable',
+    module_warming: 'unreachable',
+    target_unavailable: 'unreachable',
+    module_timeout: 'unreachable',
+    invalid_response: 'answered',
+    invalid_record_version: 'answered',
+    invalid_expiry: 'answered',
+    invalid_status: 'answered',
+    invalid_params: 'answered',
+    ttl_unsatisfiable: 'answered',
+    not_found: 'answered',
+    enrollment_revoked: 'answered',
+    enrollment_invalid: 'answered',
+    grant_denied: 'answered',
+    credential_unavailable: 'answered',
+    needs_reauth: 'answered',
+    declined: 'answered',
+    disabled: 'answered',
+    identity_changed: 'answered',
+    closed: 'answered',
+    client_closed: 'answered',
+    pending_exists: 'answered',
+    pending_queue_full: 'answered',
+    already_consumed: 'answered',
+    superseded: 'answered',
+    stale_generation: 'answered',
+    missing_identity: 'answered',
+    invalid_control_body: 'answered',
+    unknown_module: 'answered',
+    module_removed: 'answered',
+    capability_denied: 'answered',
+    unknown_channel: 'unreachable',
+    stale_route_epoch: 'unreachable',
+    capability_forbidden: 'answered',
+    capability_unprovided: 'answered',
+    capability_ambiguous: 'answered',
+    invalid_capability_identifier: 'answered',
+    binary_body_required: 'answered',
+    binary_call_requires_call_binary: 'answered',
+    corr_exhausted: 'answered',
+    late_route_cleanup_failed: 'answered',
+    reverse_request_capability_not_declared: 'answered',
+    stale_route_handle: 'answered',
+    reverse_request_unhandled: 'answered',
+    handler_error: 'answered',
+    health_error: 'answered',
+    duplicate_module_id: 'answered',
+    route_rejected: 'answered',
+    lock_busy: 'answered',
+    owner_invalid: 'answered',
+    renewal_failed: 'answered',
+    unsupported_platform: 'answered',
+    EACCES: 'answered',
+    EPERM: 'answered',
+    ERR_PRIVATE_FILES_SECURITY: 'answered',
+});
+/**
+ * An injected adapter may throw this ONLY when its connection/transport is
+ * unreachable, including a failed connect before getScoped. Do not wrap an
+ * adapter shutdown, cancellation, validation error or vault refusal in it.
+ * Its fixed message cannot echo enrollment or credential material, and its
+ * kind stays `unavailable` for callers handling ClaustrumConsumerError.
+ */
+export class ClaustrumUnreachableError extends ClaustrumConsumerError {
+    constructor() {
+        super('unavailable', 'Claustrum scoped operation unavailable');
+        this.name = 'ClaustrumUnreachableError';
+    }
+}
+export function classifyVaultFailure(error) {
+    if (error instanceof ClaustrumUnreachableError ||
+        error instanceof SocketClosedError ||
+        error instanceof SocketTimeoutError)
+        return 'unreachable';
+    const code = error instanceof ClaustrumCredentialError || error instanceof SubcCallError
+        ? error.code
+        : error instanceof Error && 'code' in error
+            ? error.code
+            : undefined;
+    if (typeof code !== 'string' || !Object.hasOwn(VAULT_FAILURE_CLASSES, code))
+        return 'answered';
+    return VAULT_FAILURE_CLASSES[code];
+}

package/src/tui-compiled/raw/shared/d0f0b6be200311af-insula.js

@@ -5,6 +5,8 @@ import { storeIdentity } from "@cortexkit/claustrum-client";
 // import makes bundlers emit a separate chunk that a running host loses when
 // its dist folder is rebuilt underneath it.
 import { SubcClient } from "@cortexkit/subc-client";
+import { classifyVaultFailure } from "./94f53cfd572ba4bb-availability.js";
+import { ChangeNoticeReader, CoalescedRead, RESUBSCRIBE_BACKOFF_MS, WATCH_RETRY_MS, } from "./dc9290c2a7552ba6-watch.js";
 /** Constructing this transport opens no connection; getUsage opens one per call. */
 export function insulaUsageTransport(options) {
     const identity = options.identity ??
@@ -49,6 +51,79 @@ export function insulaUsageTransport(options) {
                 client?.close();
             }
         },
+        watchUsage(onNotice) {
+            // The watch holds its own connection for as long as it is open: each
+            // usage.get above opens and closes a short-lived one, and the scoped
+            // credential connection is never shared with insula. The method name
+            // alone makes the request a watch; subc-client does not yet set the
+            // SUBSCRIPTION flag, and insula does not require it.
+            let client;
+            let subscription;
+            let stopped = false;
+            const closed = (async () => {
+                let deadline;
+                const timeout = new Promise((_resolve, reject) => {
+                    deadline = setTimeout(
+                    // Coded as a timeout, so InsulaQuotaSource treats a watch that could
+                    // not open in time as an unreachable insula and tries again later,
+                    // not as a refusal.
+                    () => reject(Object.assign(new Error('insula watch timeout'), {
+                        code: 'timeout',
+                    })), 3_000);
+                    deadline.unref?.();
+                });
+                const open = (async () => {
+                    const handshakeTimeoutMs = Math.min(options.handshakeTimeoutMs ?? 3_000, 3_000);
+                    const connected = options.connector
+                        ? await options.connector({
+                            connectionFile: options.connectionFile,
+                            handshakeTimeoutMs,
+                        })
+                        : await SubcClient.connect({
+                            connectionFile: options.connectionFile,
+                            handshakeTimeoutMs,
+                        });
+                    client = connected;
+                    // A connection that arrives after stop() or after the open deadline
+                    // must not keep a route or socket alive.
+                    if (stopped) {
+                        connected.close();
+                        return;
+                    }
+                    const route = await connected.routeOpen({ kind: 'management_surface', module_id: 'insula' }, identity);
+                    if (stopped) {
+                        connected.close();
+                        return;
+                    }
+                    subscription = connected.subscribe(route, { method: 'usage.watch' }, onNotice);
+                })();
+                try {
+                    await Promise.race([open, timeout]);
+                }
+                catch (error) {
+                    stopped = true;
+                    throw error;
+                }
+                finally {
+                    clearTimeout(deadline);
+                }
+                if (subscription)
+                    await subscription.closed;
+            })().finally(() => {
+                stopped = true;
+                client?.close();
+            });
+            return {
+                stop() {
+                    if (stopped)
+                        return;
+                    stopped = true;
+                    subscription?.unsubscribe();
+                    client?.close();
+                },
+                closed,
+            };
+        },
     };
 }
 const MINUTE = 60_000;
@@ -60,18 +135,92 @@ const attempts = new Map();
 function record(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+function decodeUsageNotice(body) {
+    let value;
+    try {
+        value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(body));
+    }
+    catch {
+        return undefined;
+    }
+    if (!record(value) ||
+        typeof value.kind !== 'string' ||
+        typeof value.epoch !== 'string' ||
+        value.epoch.length === 0 ||
+        typeof value.seq !== 'number' ||
+        !Number.isSafeInteger(value.seq) ||
+        value.seq < 1 ||
+        (value.provider !== undefined && typeof value.provider !== 'string'))
+        return undefined;
+    return {
+        kind: value.kind,
+        epoch: value.epoch,
+        seq: value.seq,
+        ...(typeof value.provider === 'string' && { provider: value.provider }),
+    };
+}
+function refusalCode(error) {
+    return error instanceof Error &&
+        'code' in error &&
+        typeof error.code === 'string'
+        ? error.code
+        : undefined;
+}
 export class InsulaQuotaSource {
     transport;
     key;
     #entries = [];
-    #pending;
+    /** Every usage.get, polled or watch-driven, shares this one slot. */
+    #reads = new CoalescedRead(async () => {
+        try {
+            const reply = await this.transport.getUsage();
+            if (!record(reply) ||
+                !Array.isArray(reply.result) ||
+                reply.error !== undefined)
+                throw new Error('unavailable insula usage');
+            // Each response is a snapshot, not a delta. Missing accounts fall back;
+            // neither pending nor the entry count asserts provider completeness.
+            this.#entries = reply.result.filter((entry) => record(entry) && typeof entry.provider === 'string');
+        }
+        catch {
+            // Refusal is absence, even if the previous reading was still young.
+            this.#entries = [];
+        }
+    }, () => { });
+    #reader = new ChangeNoticeReader();
+    #mode = 'polling';
+    #watchers = 0;
+    /**
+     * How many registered watchers read every provider. Watchers limited to one
+     * provider are counted per provider in `#providers` instead.
+     */
+    #everyProvider = 0;
+    #providers = new Map();
+    #watch;
+    #timer;
+    #timers = {};
+    /**
+     * How many accepted watches in a row have closed; each one doubles the wait
+     * before the next re-subscribe. Reset once a watch brings a second notice.
+     */
+    #closes = 0;
     constructor(transport, key) {
         this.transport = transport;
         this.key = key;
     }
+    /**
+     * The background poll: at most one usage.get per minute per daemon and
+     * enrollment token. While a watch is open it reads nothing, because insula's
+     * notices announce every new reading. If insula stops announcing an account,
+     * that account's last entry grows older than the freshness limit `current()`
+     * applies, `current()` returns nothing for it, and the plugin falls back to
+     * its own provider poll for that account.
+     */
     refresh(now) {
-        if (this.#pending)
-            return this.#pending;
+        if (this.#reads.running)
+            return this.#reads.running;
+        if (this.#mode === 'watching')
+            return Promise.resolve();
         for (const [key, time] of attempts) {
             if (now - time >= MINUTE)
                 attempts.delete(key);
@@ -81,25 +230,141 @@ export class InsulaQuotaSource {
             return Promise.resolve();
         // Reserve the minute before I/O, so concurrent projects cannot each poll.
         attempts.set(this.key, now);
-        this.#pending = (async () => {
-            try {
-                const reply = await this.transport.getUsage();
-                if (!record(reply) ||
-                    !Array.isArray(reply.result) ||
-                    reply.error !== undefined)
-                    throw new Error('unavailable insula usage');
-                // Each response is a snapshot, not a delta. Missing accounts fall back;
-                // neither pending nor the entry count asserts provider completeness.
-                this.#entries = reply.result.filter((entry) => record(entry) && typeof entry.provider === 'string');
-            }
-            catch {
-                // Refusal is absence, even if the previous reading was still young.
-                this.#entries = [];
+        return this.#reads.request();
+    }
+    /** How this source currently learns about usage changes, for logs. */
+    watchMode() {
+        return this.#mode;
+    }
+    /**
+     * Hold a `usage.watch` open while any watcher wants it, and re-read
+     * usage.get when a notice says something changed. Watchers of one source
+     * share one watch, since insula admits only 64 per process. Returns the
+     * release; the last release closes the watch.
+     */
+    watch(options = {}) {
+        this.#watchers++;
+        const provider = options.provider;
+        if (provider === undefined)
+            this.#everyProvider++;
+        else
+            this.#providers.set(provider, (this.#providers.get(provider) ?? 0) + 1);
+        if (this.#watchers === 1) {
+            this.#timers = options;
+            this.#open();
+        }
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            if (provider === undefined)
+                this.#everyProvider--;
+            else {
+                const left = (this.#providers.get(provider) ?? 1) - 1;
+                if (left > 0)
+                    this.#providers.set(provider, left);
+                else
+                    this.#providers.delete(provider);
             }
-        })().finally(() => {
-            this.#pending = undefined;
-        });
-        return this.#pending;
+            if (--this.#watchers === 0)
+                this.#stopWatch();
+        };
+    }
+    #stopWatch() {
+        if (this.#timer)
+            (this.#timers.clearTimeoutImpl ?? clearTimeout)(this.#timer);
+        this.#timer = undefined;
+        const watch = this.#watch;
+        this.#watch = undefined;
+        watch?.handle?.stop();
+        this.#mode = 'polling';
+    }
+    #later(delay) {
+        this.#timer = (this.#timers.setTimeoutImpl ?? setTimeout)(() => {
+            this.#timer = undefined;
+            if (this.#watchers > 0 && !this.#watch)
+                this.#open();
+        }, delay);
+        this.#timer.unref?.();
+    }
+    #open() {
+        const watchUsage = this.transport.watchUsage;
+        if (!watchUsage) {
+            // A custom transport that cannot watch: poll exactly as before.
+            this.#mode = 'fallback';
+            return;
+        }
+        this.#mode = 'polling';
+        this.#reader.restart();
+        const watch = { notices: 0 };
+        this.#watch = watch;
+        let handle;
+        try {
+            handle = watchUsage.call(this.transport, (body) => this.#notice(watch, body));
+        }
+        catch (error) {
+            this.#closed(watch, error);
+            return;
+        }
+        watch.handle = handle;
+        handle.closed.then(() => this.#closed(watch, undefined), (error) => this.#closed(watch, error));
+    }
+    #notice(watch, body) {
+        // Frames already in transport can arrive after a local stop.
+        if (this.#watch !== watch)
+            return;
+        watch.notices++;
+        if (watch.notices === 1)
+            this.#mode = 'watching';
+        // A second notice means the watch stayed up past its acceptance.
+        if (watch.notices === 2)
+            this.#closes = 0;
+        const notice = decodeUsageNotice(body);
+        // An unreadable notice may hide any change: treat it as a break, and
+        // make the next notice read as one too.
+        if (!notice)
+            this.#reader.restart();
+        const continuous = notice ? this.#reader.continuous(notice) : false;
+        // The first notice of every watch names no provider, so it always reads:
+        // nothing was watched before it. After a gap or a new epoch notices were
+        // lost, so read even when this notice names another provider.
+        if (!continuous ||
+            notice?.provider === undefined ||
+            this.#everyProvider > 0 ||
+            this.#providers.has(notice.provider))
+            void this.#reads.request();
+    }
+    #closed(watch, error) {
+        if (this.#watch !== watch)
+            return;
+        this.#watch = undefined;
+        const code = refusalCode(error);
+        if (code === 'unknown_method' || code === 'usage_watch_limit') {
+            // An insula that predates usage.watch, or one already holding 64
+            // watches: poll exactly as before until every watcher has released.
+            this.#mode = 'fallback';
+            return;
+        }
+        if (watch.notices > 0) {
+            // An accepted watch that closed (insula shut down, or the connection
+            // dropped) gets one new watch, whose first notice reads usage.get.
+            const delay = Math.min(RESUBSCRIBE_BACKOFF_MS * 2 ** Math.min(this.#closes, 16), WATCH_RETRY_MS);
+            this.#closes++;
+            this.#mode = 'polling';
+            this.#later(delay);
+            return;
+        }
+        // Closed before any notice, so never accepted: read once to learn
+        // whether insula answers at all, then poll as before. A refusal insula
+        // answered stands until every watcher has released. A close it did not
+        // explain (a
+        // dropped connection, a timeout, a stream ended at once while insula
+        // shuts down) earns one new watch much later.
+        this.#mode = 'fallback';
+        void this.#reads.request();
+        if (error === undefined || classifyVaultFailure(error) === 'unreachable')
+            this.#later(WATCH_RETRY_MS);
     }
     current(provider, accountId, now) {
         for (const entry of this.#entries) {

package/src/tui-compiled/raw/shared/d5a8f1061ee2f114-index.js

@@ -1,5 +1,5 @@
 export { quotaCodec } from "./053cc17b5419261e-codec.js";
-export { formatQuota, NO_LIMITS_REPORTED, NO_QUOTA_READING, QUOTA_STALE_AFTER_MS, quotaTextParts, quotaWindowName, quotaWindowParts, } from "./0332701351b3eeec-format.js";
+export { formatQuota, isQuotaStale, NO_LIMITS_REPORTED, NO_QUOTA_READING, QUOTA_STALE_AFTER_MS, quotaTextParts, quotaWindowName, quotaWindowParts, } from "./0332701351b3eeec-format.js";
 export { ALL_SCOPE, DEFAULT_REQUIRED_LABELS, decodeQuotaMap, emptyQuotaMap, isQuotaMap, } from "./905bffc0220f43d0-map.js";
 export { isQuotaObservation, mergeQuotaObservation, QuotaCodecError, } from "./4f36d333d081d040-merge.js";
 export { budgetExhaustedResetAt, futureResetAt, projectQuota, readsExhausted, } from "./39c3cb05738fcf6d-projection.js";