@cortexkit/opencode-openai-auth 1.2.0 → 1.4.0

package/dist/bin.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
-import{c as _0}from"./index-qp5hdpw8.js";import{Cb as I0,Fa as j0,Ga as E,Ha as O,Ia as v,kb as A0,ta as k0,ua as f,va as o}from"./index-03em8hv1.js";import{$c as R0,gd as m,hd as P,jd as c,kd as q0}from"./index-f21addzm.js";import"./index-qxbchh2d.js";import{Ee as e,Ke as Y0,Le as C0,Oe as w0}from"./index-ehjj89rx.js";import"./index-r2s51ac1.js";import"./index-xwvze96g.js";import{spawn as L0}from"node:child_process";var M=4096,S0=1048576;class t{buffer=Buffer.alloc(M);start=0;length=0;truncated=!1;get didTruncate(){return this.truncated}push(G){if(G.length>=M){if(G.length>M||this.length>0)this.truncated=!0;G.copy(this.buffer,0,G.length-M),this.start=0,this.length=M;return}let b=Math.max(0,this.length+G.length-M);if(b>0)this.truncated=!0;this.start=(this.start+b)%M,this.length-=b;let z=(this.start+this.length)%M,J=Math.min(G.length,M-z);if(G.copy(this.buffer,z,0,J),J<G.length)G.copy(this.buffer,0,J);this.length+=G.length}toString(){let G=Buffer.alloc(this.length),b=Math.min(this.length,M-this.start);if(this.buffer.copy(G,0,this.start,this.start+b),b<this.length)this.buffer.copy(G,b,0,this.length-b);let z=0;while(z<G.length){let J=G[z];if(J===void 0||(J&192)!==128)break;z++}return G.subarray(z).toString("utf8")}}var A={run(G,b,z={}){return new Promise((J)=>{let K=performance.now(),Q=z.timeoutMs??15000,$=new t,W=[],q=0,Z=!1,x=!1,D=!1,U;try{U=L0(G,[...b],{env:z.env??process.env,windowsHide:!0,windowsVerbatimArguments:z.windowsVerbatimArguments,stdio:["ignore","pipe","pipe"]})}catch{J({exitCode:1,stdout:"",stderr:"",spawnError:!0,signal:null,timedOut:!1,durationMs:performance.now()-K});return}let j=Q>0?setTimeout(()=>{D=!0,U.kill("SIGTERM")},Q):void 0;U.stdout?.on("data",(X)=>{let R=S0-q,F=Math.min(R,X.length);if(F>0)W.push(X.subarray(0,F)),q+=F;if(X.length>R)Z=!0,U.kill("SIGTERM")}),U.stderr?.on("data",(X)=>$.push(X));let V=!1,B=(X,R)=>{if(V)return;if(V=!0,j)clearTimeout(j);J({exitCode:x?1:Z?1:X??1,stdout:Buffer.concat(W,q).toString("utf8"),stderr:$.toString(),stderrTruncated:$.didTruncate,...x?{spawnError:!0}:{},signal:R??null,timedOut:D,durationMs:performance.now()-K})};U.once("error",()=>{if(x=!0,U.pid===void 0)B(null,null)}),U.once("close",(X,R)=>B(X,R))})}};function g(G,b,z,J,K,Q=15000){if(b==="win32"&&/\.(cmd|bat)$/i.test(z)){if(/["%!\r\n]/.test(z)||J.some(($)=>!/^[a-zA-Z0-9@:/._+-]+$/.test($)))throw Error("Unsafe batch launcher or argument; use an executable instead.");return G.run("cmd.exe",["/d","/s","/c",`""${z}" ${J.join(" ")}"`],{env:K,timeoutMs:Q,windowsVerbatimArguments:!0})}return G.run(z,J,{env:K,timeoutMs:Q})}var y0="Pi install failed; run pi install after checking your npm connection.";function v0(G){let b=Buffer.from(G,"utf8");if(b.length<=M)return G;let z=b.length-M;while(z<b.length){let J=b[z];if(J===void 0||(J&192)!==128)break;z++}return b.subarray(z).toString("utf8")}function E0(G){let b=G.indexOf(`
-`);return b<0?"":G.slice(b+1)}class d extends Error{step="pi-install";exitCode;signal;stderrTail;constructor(G){super(y0);this.name="SetupCommandError",this.exitCode=G.exitCode,this.signal=G.signal;let b=G.stderrTruncated?E0(G.stderrTail):G.stderrTail,z=e(b);this.stderrTail=v0(typeof z==="string"?z:"")}}var f0={opencode:"OpenCode",pi:"Pi"},g0={enrolled:"connected to the vault","not-enrolled":"not connected",unknown:"unknown, check with ck auth status"};function G0({host:G,outcome:b}){return`${f0[G]}: ${g0[b]}`}var d0=new WeakMap;function b0(G,b){if(typeof G!=="object"&&typeof G!=="function"||!G)return;d0.set(G,Object.freeze(b.map((z)=>Object.freeze({...z}))))}import{accessSync as p0,constants as l0,existsSync as a0,readFileSync as i0,realpathSync as s0,statSync as r0}from"node:fs";import{mkdtemp as n0,rm as o0}from"node:fs/promises";import{tmpdir as t0}from"node:os";import{join as e0}from"node:path";import{parse as G1}from"jsonc-parser";import{homedir as m0}from"node:os";import{posix as c0,win32 as h0}from"node:path";import{fileURLToPath as u0}from"node:url";function N(G={}){let b=G.env??process.env,z=G.platform??process.platform,J=z==="win32"?h0:c0,K=G.home??(z==="win32"?b.USERPROFILE:b.HOME)??m0(),Q=G.cwd??process.cwd(),$=(x)=>J.resolve(Q,x),W=b.OPENCODE_CONFIG_DIR?.trim(),q=b.XDG_CONFIG_HOME?.trim(),Z=b.PI_CODING_AGENT_DIR?.trim()||J.join(K,".pi","agent");if(Z==="~")Z=K;else if(/^~[/\\]/.test(Z))Z=J.join(K,Z.slice(2));if(Z.startsWith("file://"))Z=u0(Z);return{env:b,platform:z,path:J,home:K,cwd:Q,opencode:W?$(W):q?J.join($(q),"opencode"):J.join(K,".config","opencode"),pi:$(Z)}}function h(G,b){try{return r0(G)[b]()}catch{return!1}}var _={exists:a0,isFile:(G)=>h(G,"isFile"),isDirectory:(G)=>h(G,"isDirectory"),isExecutable(G){try{return p0(G,l0.X_OK),h(G,"isFile")}catch{return!1}},readText:(G)=>i0(G,"utf8"),realpath:s0};function k(G,b={}){let{env:z,platform:J,path:K,cwd:Q}=N(b),$=b.fs??_,W=Object.entries(z).find(([Z])=>J==="win32"?Z.toUpperCase()==="PATH":Z==="PATH")?.[1]??"",q=J==="win32"?[".exe",".cmd",".bat",""]:[""];for(let Z of W.split(J==="win32"?";":":")){let x=Z.trim().replace(/^"|"$/g,"");if(!x)continue;for(let D of q){let U=K.resolve(Q,x,G+D);if(J==="win32"?$.isFile(U):$.isExecutable(U))return U}}return null}function z0(G={}){let{platform:b,home:z,env:J,path:K}=N(G);if(b==="darwin")return["/Applications/OpenCode.app","/Applications/OpenCode Beta.app",K.join(z,"Applications","OpenCode.app"),K.join(z,"Applications","OpenCode Beta.app")];if(b==="win32"){let Q=J.LOCALAPPDATA||K.join(z,"AppData","Local");return[K.join(Q,"Programs","opencode"),K.join(Q,"opencode")]}return["/opt/OpenCode","/usr/lib/opencode",K.join(z,".local","share","applications","opencode.desktop")]}function u(G,b){let z=b.fs??_,{path:J}=N(b);try{let K=z.readText(G);if(K.length>65536)return G;let Q=[...K.matchAll(/"%~?dp0%?\\([^"%\r\n]+)"/g)];if(!Q.length)Q.push(...K.matchAll(/"\$basedir\/([^"$\r\n]+)"/g));let $=Q.at(-1)?.[1];if($){let W=J.join(J.dirname(G),...$.split(/[/\\]+/));if(z.isFile(W))return z.realpath(W)}return z.realpath(G)}catch{return G}}function b1(G,b){let z=b.fs??_,{path:J}=N(b),K=J.dirname(u(G,b));for(;;){try{let $=JSON.parse(z.readText(J.join(K,"package.json")));if(["@opencode/cli","@opencode-ai/cli"].includes($.name))return"2";if($.name==="opencode-ai")return/^(?:[2-9]\d*|1\d+)\.|^0\.0\.0-(?:beta|dev)-/.test($.version??"")?"2":"1"}catch{}let Q=J.dirname(K);if(Q===K)return null;K=Q}}function J0(G={}){let b=k("opencode",G),z=k("opencode2",G),J=b&&z&&u(b,G)===u(z,G),K=G.fs??_,{path:Q,opencode:$}=N(G),W="1";for(let Z of["jsonc","json"]){let x=Q.join($,`opencode.${Z}`);if(!K.exists(x))continue;try{if(Object.hasOwn(G1(K.readText(x))??{},"plugins"))W="2"}catch{}break}let q=b?b1(b,G)??(J?"2":W):null;if(z&&q==="1"&&!J)return"ambiguous";return z||J?"2":q??W}async function p(G,b={}){let z=b.fs??_,{env:J,platform:K,opencode:Q,pi:$}=N(b),W=b.runner??A,q=k("opencode",b)??k("opencode2",b),Z=k("pi",b),x=k("ck",b),D=async(B)=>{if(!B)return null;let X;try{X=await n0(e0(t0(),"common-auth-setup-version-"));let R={...J,HOME:X,USERPROFILE:X,XDG_CONFIG_HOME:X,XDG_DATA_HOME:X,XDG_STATE_HOME:X,XDG_CACHE_HOME:X,OPENCODE_CONFIG_DIR:X,OPENCODE_CONFIG:void 0,OPENCODE_CONFIG_CONTENT:void 0,OPENCODE_AUTH_CONTENT:void 0,PI_CODING_AGENT_DIR:X},F=await g(W,K,B,["--version"],R,2000);return F.exitCode===0?/\b\d+\.\d+\.\d+(?:-[\w.-]+)?/.exec(F.stdout)?.[0]??null:null}catch{return null}finally{if(X)await o0(X,{recursive:!0,force:!0}).catch(()=>{})}},U=!1;if(x&&z.exists(G.vault.connectionFile))try{(await(b.connect??m)({connectionFile:G.vault.connectionFile,handshakeTimeoutMs:2000})).close(),U=!0}catch{U=!1}let[j,V]=await Promise.all([D(q),D(Z)]);return{opencode:{installed:z.isDirectory(Q)||z0(b).some((B)=>z.exists(B))||q!==null,executable:q,version:j,directory:Q,generation:J0(b)},pi:{installed:Z!==null||z.isDirectory($),executable:Z,version:V,directory:$},claustrum:{available:U,executable:x}}}import{setTimeout as U1}from"node:timers/promises";import{writeEnrollmentTokenFile as W1}from"@cortexkit/claustrum-client";var z1=45000,K0=new Set(["opencode","litecode","opencode2","pi"]),J1=new Set(["node","bun"]),K1=/(?:^|[/\\])pi-coding-agent[/\\]dist[/\\](?:(?:bundle|bun)[/\\])?cli\.m?js$/i;function Q1(G){return[...G.matchAll(/"([^"]*)"|(\S+)/g)].map((b)=>b[1]??b[2]??"")}function Q0(G){return(G.split(/[/\\]/).pop()??"").toLowerCase().replace(/\.(?:exe|cmd|bat|m?js)$/,"")}var Z1=new Set(["-r","--require","--import","--loader","--experimental-loader","-C","--conditions","--env-file","--title","--input-type","--preload","--cwd","-c","--config","--tsconfig-override","-d","--define","-l","--main-fields"]),$1=new Set(["-e","--eval","-p","--print"]);function q1(G,b){for(let z=0;z<b.length;z++){let J=b[z]??"";if(J==="--")return b[z+1];if($1.has(J))return;if(J.startsWith("-")){if(!J.includes("=")&&Z1.has(J))z++;continue}if(G==="bun"&&J==="run")continue;return J}return}function Z0(G){let[b,...z]=Q1(G);if(b===void 0)return null;let J=Q0(b);if(K0.has(J))return J;if(!J1.has(J))return null;let K=q1(J,z);if(K===void 0)return null;let Q=Q0(K);if(K0.has(Q))return Q;return K1.test(K)?"pi":null}class Y extends Error{code="process-inspection-failed";step;exitCode;signal;timedOut;durationMs;constructor(G){super("Process inspection failed; setup cannot prove hosts are stopped.");this.name="ProcessInspectionError",this.step=G.step,this.exitCode=G.exitCode,this.signal=G.signal,this.timedOut=G.timedOut,this.durationMs=G.durationMs}get refusalText(){let G=this.timedOut?"timed out":this.signal?`signal ${this.signal}`:this.exitCode===null?"could not start or complete":this.exitCode===0?"invalid output (exit code 0)":`exit code ${this.exitCode}`;return`${this.message} ${this.step}: ${G} after ${Math.round(this.durationMs)} ms.`}}class T extends Error{activeHosts;constructor(G){let b=G.map((z)=>({pid:z.pid,command:Z0(z.command)??"host"}));super(`OpenCode or Pi processes are currently running:
+import{c as _0}from"./index-1tdnrt68.js";import{Cb as I0,Fa as j0,Ga as E,Ha as O,Ia as v,kb as A0,ta as k0,ua as f,va as o}from"./index-vy729a0b.js";import{cd as R0,jd as m,kd as L,md as c,nd as q0}from"./index-brbqqer5.js";import"./index-ag04nyv7.js";import{Je as e,Pe as Y0,Qe as C0,Te as w0}from"./index-wgwze391.js";import"./index-5230x6s8.js";import"./index-d98f1xdp.js";import{spawn as P0}from"node:child_process";var M=4096,S0=1048576;class t{buffer=Buffer.alloc(M);start=0;length=0;truncated=!1;get didTruncate(){return this.truncated}push(G){if(G.length>=M){if(G.length>M||this.length>0)this.truncated=!0;G.copy(this.buffer,0,G.length-M),this.start=0,this.length=M;return}let b=Math.max(0,this.length+G.length-M);if(b>0)this.truncated=!0;this.start=(this.start+b)%M,this.length-=b;let z=(this.start+this.length)%M,K=Math.min(G.length,M-z);if(G.copy(this.buffer,z,0,K),K<G.length)G.copy(this.buffer,0,K);this.length+=G.length}toString(){let G=Buffer.alloc(this.length),b=Math.min(this.length,M-this.start);if(this.buffer.copy(G,0,this.start,this.start+b),b<this.length)this.buffer.copy(G,b,0,this.length-b);let z=0;while(z<G.length){let K=G[z];if(K===void 0||(K&192)!==128)break;z++}return G.subarray(z).toString("utf8")}}var A={run(G,b,z={}){return new Promise((K)=>{let J=performance.now(),Q=z.timeoutMs??15000,$=new t,q=[],U=0,Z=!1,D=!1,W=!1,F;try{F=P0(G,[...b],{env:z.env??process.env,windowsHide:!0,windowsVerbatimArguments:z.windowsVerbatimArguments,stdio:["ignore","pipe","pipe"]})}catch{K({exitCode:1,stdout:"",stderr:"",spawnError:!0,signal:null,timedOut:!1,durationMs:performance.now()-J});return}let x=Q>0?setTimeout(()=>{W=!0,F.kill("SIGTERM")},Q):void 0;F.stdout?.on("data",(j)=>{let R=S0-U,V=Math.min(R,j.length);if(V>0)q.push(j.subarray(0,V)),U+=V;if(j.length>R)Z=!0,F.kill("SIGTERM")}),F.stderr?.on("data",(j)=>$.push(j));let X=!1,B=(j,R)=>{if(X)return;if(X=!0,x)clearTimeout(x);K({exitCode:D?1:Z?1:j??1,stdout:Buffer.concat(q,U).toString("utf8"),stderr:$.toString(),stderrTruncated:$.didTruncate,...D?{spawnError:!0}:{},signal:R??null,timedOut:W,durationMs:performance.now()-J})};F.once("error",()=>{if(D=!0,F.pid===void 0)B(null,null)}),F.once("close",(j,R)=>B(j,R))})}};function g(G,b,z,K,J,Q=15000){if(b==="win32"&&/\.(cmd|bat)$/i.test(z)){if(/["%!\r\n]/.test(z)||K.some(($)=>!/^[a-zA-Z0-9@:/._+-]+$/.test($)))throw Error("Unsafe batch launcher or argument; use an executable instead.");return G.run("cmd.exe",["/d","/s","/c",`""${z}" ${K.join(" ")}"`],{env:J,timeoutMs:Q,windowsVerbatimArguments:!0})}return G.run(z,K,{env:J,timeoutMs:Q})}var y0="Pi install failed; run pi install after checking your npm connection.";function v0(G){let b=Buffer.from(G,"utf8");if(b.length<=M)return G;let z=b.length-M;while(z<b.length){let K=b[z];if(K===void 0||(K&192)!==128)break;z++}return b.subarray(z).toString("utf8")}function E0(G){let b=G.indexOf(`
+`);return b<0?"":G.slice(b+1)}class d extends Error{step="pi-install";exitCode;signal;stderrTail;constructor(G){super(y0);this.name="SetupCommandError",this.exitCode=G.exitCode,this.signal=G.signal;let b=G.stderrTruncated?E0(G.stderrTail):G.stderrTail,z=e(b);this.stderrTail=v0(typeof z==="string"?z:"")}}var f0={opencode:"OpenCode",pi:"Pi"},g0={enrolled:"connected to the vault","not-enrolled":"not connected",unknown:"unknown, check with ck auth status"};function G0({host:G,outcome:b}){return`${f0[G]}: ${g0[b]}`}var d0=new WeakMap;function b0(G,b){if(typeof G!=="object"&&typeof G!=="function"||!G)return;d0.set(G,Object.freeze(b.map((z)=>Object.freeze({...z}))))}import{accessSync as p0,constants as l0,existsSync as a0,readFileSync as i0,realpathSync as s0,statSync as r0}from"node:fs";import{mkdtemp as n0,rm as o0}from"node:fs/promises";import{tmpdir as t0}from"node:os";import{join as e0}from"node:path";import{parse as G2}from"jsonc-parser";import{homedir as m0}from"node:os";import{posix as c0,win32 as h0}from"node:path";import{fileURLToPath as u0}from"node:url";function N(G={}){let b=G.env??process.env,z=G.platform??process.platform,K=z==="win32"?h0:c0,J=G.home??(z==="win32"?b.USERPROFILE:b.HOME)??m0(),Q=G.cwd??process.cwd(),$=(D)=>K.resolve(Q,D),q=b.OPENCODE_CONFIG_DIR?.trim(),U=b.XDG_CONFIG_HOME?.trim(),Z=b.PI_CODING_AGENT_DIR?.trim()||K.join(J,".pi","agent");if(Z==="~")Z=J;else if(/^~[/\\]/.test(Z))Z=K.join(J,Z.slice(2));if(Z.startsWith("file://"))Z=u0(Z);return{env:b,platform:z,path:K,home:J,cwd:Q,opencode:q?$(q):U?K.join($(U),"opencode"):K.join(J,".config","opencode"),pi:$(Z)}}function h(G,b){try{return r0(G)[b]()}catch{return!1}}var _={exists:a0,isFile:(G)=>h(G,"isFile"),isDirectory:(G)=>h(G,"isDirectory"),isExecutable(G){try{return p0(G,l0.X_OK),h(G,"isFile")}catch{return!1}},readText:(G)=>i0(G,"utf8"),realpath:s0};function k(G,b={}){let{env:z,platform:K,path:J,cwd:Q}=N(b),$=b.fs??_,q=Object.entries(z).find(([Z])=>K==="win32"?Z.toUpperCase()==="PATH":Z==="PATH")?.[1]??"",U=K==="win32"?[".exe",".cmd",".bat",""]:[""];for(let Z of q.split(K==="win32"?";":":")){let D=Z.trim().replace(/^"|"$/g,"");if(!D)continue;for(let W of U){let F=J.resolve(Q,D,G+W);if(K==="win32"?$.isFile(F):$.isExecutable(F))return F}}return null}function z0(G={}){let{platform:b,home:z,env:K,path:J}=N(G);if(b==="darwin")return["/Applications/OpenCode.app","/Applications/OpenCode Beta.app",J.join(z,"Applications","OpenCode.app"),J.join(z,"Applications","OpenCode Beta.app")];if(b==="win32"){let Q=K.LOCALAPPDATA||J.join(z,"AppData","Local");return[J.join(Q,"Programs","opencode"),J.join(Q,"opencode")]}return["/opt/OpenCode","/usr/lib/opencode",J.join(z,".local","share","applications","opencode.desktop")]}function u(G,b){let z=b.fs??_,{path:K}=N(b);try{let J=z.readText(G);if(J.length>65536)return G;let Q=[...J.matchAll(/"%~?dp0%?\\([^"%\r\n]+)"/g)];if(!Q.length)Q.push(...J.matchAll(/"\$basedir\/([^"$\r\n]+)"/g));let $=Q.at(-1)?.[1];if($){let q=K.join(K.dirname(G),...$.split(/[/\\]+/));if(z.isFile(q))return z.realpath(q)}return z.realpath(G)}catch{return G}}function b2(G,b){let z=b.fs??_,{path:K}=N(b),J=K.dirname(u(G,b));for(;;){try{let $=JSON.parse(z.readText(K.join(J,"package.json")));if(["@opencode/cli","@opencode-ai/cli"].includes($.name))return"2";if($.name==="opencode-ai")return/^(?:[2-9]\d*|1\d+)\.|^0\.0\.0-(?:beta|dev)-/.test($.version??"")?"2":"1"}catch{}let Q=K.dirname(J);if(Q===J)return null;J=Q}}function J0(G={}){let b=k("opencode",G),z=k("opencode2",G),K=b&&z&&u(b,G)===u(z,G),J=G.fs??_,{path:Q,opencode:$}=N(G),q="1";for(let Z of["jsonc","json"]){let D=Q.join($,`opencode.${Z}`);if(!J.exists(D))continue;try{if(Object.hasOwn(G2(J.readText(D))??{},"plugins"))q="2"}catch{}break}let U=b?b2(b,G)??(K?"2":q):null;if(z&&U==="1"&&!K)return"ambiguous";return z||K?"2":U??q}async function p(G,b={}){let z=b.fs??_,{env:K,platform:J,opencode:Q,pi:$}=N(b),q=b.runner??A,U=k("opencode",b)??k("opencode2",b),Z=k("pi",b),D=k("ck",b),W=async(B)=>{if(!B)return null;let j;try{j=await n0(e0(t0(),"common-auth-setup-version-"));let R={...K,HOME:j,USERPROFILE:j,XDG_CONFIG_HOME:j,XDG_DATA_HOME:j,XDG_STATE_HOME:j,XDG_CACHE_HOME:j,OPENCODE_CONFIG_DIR:j,OPENCODE_CONFIG:void 0,OPENCODE_CONFIG_CONTENT:void 0,OPENCODE_AUTH_CONTENT:void 0,PI_CODING_AGENT_DIR:j},V=await g(q,J,B,["--version"],R,2000);return V.exitCode===0?/\b\d+\.\d+\.\d+(?:-[\w.-]+)?/.exec(V.stdout)?.[0]??null:null}catch{return null}finally{if(j)await o0(j,{recursive:!0,force:!0}).catch(()=>{})}},F=!1;if(D&&z.exists(G.vault.connectionFile))try{(await(b.connect??m)({connectionFile:G.vault.connectionFile,handshakeTimeoutMs:2000})).close(),F=!0}catch{F=!1}let[x,X]=await Promise.all([W(U),W(Z)]);return{opencode:{installed:z.isDirectory(Q)||z0(b).some((B)=>z.exists(B))||U!==null,executable:U,version:x,directory:Q,generation:J0(b)},pi:{installed:Z!==null||z.isDirectory($),executable:Z,version:X,directory:$},claustrum:{available:F,executable:D}}}import{setTimeout as U2}from"node:timers/promises";import{writeEnrollmentTokenFile as W2}from"@cortexkit/claustrum-client";var z2=45000,K0=new Set(["opencode","litecode","opencode2","pi"]),J2=new Set(["node","bun"]),K2=/(?:^|[/\\])pi-coding-agent[/\\]dist[/\\](?:(?:bundle|bun)[/\\])?cli\.m?js$/i;function Q2(G){return[...G.matchAll(/"([^"]*)"|(\S+)/g)].map((b)=>b[1]??b[2]??"")}function Q0(G){return(G.split(/[/\\]/).pop()??"").toLowerCase().replace(/\.(?:exe|cmd|bat|m?js)$/,"")}var Z2=new Set(["-r","--require","--import","--loader","--experimental-loader","-C","--conditions","--env-file","--title","--input-type","--preload","--cwd","-c","--config","--tsconfig-override","-d","--define","-l","--main-fields"]),$2=new Set(["-e","--eval","-p","--print"]);function q2(G,b){for(let z=0;z<b.length;z++){let K=b[z]??"";if(K==="--")return b[z+1];if($2.has(K))return;if(K.startsWith("-")){if(!K.includes("=")&&Z2.has(K))z++;continue}if(G==="bun"&&K==="run")continue;return K}return}function Z0(G){let[b,...z]=Q2(G);if(b===void 0)return null;let K=Q0(b);if(K0.has(K))return K;if(!J2.has(K))return null;let J=q2(K,z);if(J===void 0)return null;let Q=Q0(J);if(K0.has(Q))return Q;return K2.test(J)?"pi":null}class Y extends Error{code="process-inspection-failed";step;exitCode;signal;timedOut;durationMs;constructor(G){super("Process inspection failed; setup cannot prove hosts are stopped.");this.name="ProcessInspectionError",this.step=G.step,this.exitCode=G.exitCode,this.signal=G.signal,this.timedOut=G.timedOut,this.durationMs=G.durationMs}get refusalText(){let G=this.timedOut?"timed out":this.signal?`signal ${this.signal}`:this.exitCode===null?"could not start or complete":this.exitCode===0?"invalid output (exit code 0)":`exit code ${this.exitCode}`;return`${this.message} ${this.step}: ${G} after ${Math.round(this.durationMs)} ms.`}}class T extends Error{activeHosts;constructor(G){let b=G.map((z)=>({pid:z.pid,command:Z0(z.command)??"host"}));super(`OpenCode or Pi processes are currently running:
 ${b.map((z)=>`  - PID ${z.pid}: ${z.command}`).join(`
 `)}
 
-Please quit all OpenCode, LiteCode, and Pi processes before running setup.`);this.activeHosts=b,this.name="ProcessFenceViolationError"}}async function l(G=A,b={}){let z=(b.platform??process.platform)==="win32",J={step:z?"tasklist":"ps",exitCode:null,signal:null,timedOut:!1,durationMs:0},K=async(Q,$,W,q)=>{let Z=performance.now();J={step:Q,exitCode:null,signal:null,timedOut:!1,durationMs:0};try{let x=await G.run($,W,{env:b.env,timeoutMs:q});return J={step:Q,exitCode:x.exitCode,signal:x.signal??null,timedOut:x.timedOut??!1,durationMs:x.durationMs??performance.now()-Z},x}finally{if(J.exitCode===null)J.durationMs=performance.now()-Z;b.onStep?.({...J})}};try{let Q=await K(z?"tasklist":"ps",z?"tasklist.exe":"ps",z?["/fo","csv","/nh"]:["-eo","pid,command"]);if(Q.exitCode!==0)throw new Y(J);let $=[];for(let q of Q.stdout.split(/\r?\n/)){let Z=q.trim();if(!Z)continue;let x,D;if(z){let U=/^"([^"]+)","(\d+)"(?:,|$)/.exec(Z);if(!U)throw new Y(J);D=U[1]??"",x=Number(U[2])}else{let U=/^(\d+)\s+(.+)$/.exec(Z);if(!U){if(/^PID\s+COMMAND$/i.test(Z))continue;throw new Y(J)}x=Number(U[1]),D=U[2]??""}if(!Number.isSafeInteger(x)||x<0)throw new Y(J);$.push({pid:x,command:D})}if(!$.length)throw new Y(J);let W=$.filter((q)=>q.pid!==process.pid&&/^(?:node|bun)\.exe$/i.test(q.command));if(z&&W.length&&b.inspectRuntimes!==!1){let q=await K("CIM","powershell.exe",["-NoProfile","-NonInteractive","-Command",`$ErrorActionPreference = 'Stop'; Get-CimInstance Win32_Process -Filter "Name = 'node.exe' OR Name = 'bun.exe'" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress`],z1);if(q.exitCode!==0)throw new Y(J);let Z=JSON.parse(q.stdout||"null"),x=Z===null?[]:Array.isArray(Z)?Z:[Z],D=new Map;for(let U of x){if(!U||typeof U!=="object"||!("ProcessId"in U)||!("CommandLine"in U)||!Number.isSafeInteger(U.ProcessId))throw new Y(J);if(typeof U.CommandLine==="string")D.set(Number(U.ProcessId),U.CommandLine);else if(W.some((j)=>j.pid===U.ProcessId))throw new Y(J)}for(let U of W)U.command=D.get(U.pid)??""}return $}catch(Q){if(Q instanceof Y)throw Q;throw new Y(J)}}function S(G=A,b={}){let z=(J)=>J.pid!==process.pid&&Z0(J.command)!==null;return{async listRunningHosts(J){return(await l(G,{...b,env:J})).filter(z)},async previewRunningHosts(J){let K=await l(G,{...b,env:J,inspectRuntimes:!1}),Q=(b.platform??process.platform)==="win32";return{hosts:K.filter(z),uncheckedRuntimes:Q?K.filter(($)=>$.pid!==process.pid&&/^(?:node|bun)\.exe$/i.test($.command)).length:0}}}}async function y(G,b){let z=await G.listRunningHosts(b);if(z.length)throw new T(z)}var $0="Claustrum enrollment did not complete. Inspect and approve with ck, then rerun setup.";class I extends Error{}async function U0(G,b,z,J,K){let{name:Q,paths:$}=G.vault.hosts[b],W=P($);await K();let q=await(z.connect??m)({connectionFile:G.vault.connectionFile,handshakeTimeoutMs:2000}).catch(()=>{throw new I("Claustrum connection failed; start ck and rerun setup.")});try{let Z=new q0({proposedName:Q,paths:W,client:{enrollPropose:async(D)=>{return await K(),q.enrollPropose(D)},enrollPoll:async(D)=>{return await K(),q.enrollPoll(D)}},writeTokenFile:async(D,U)=>{await K(),await W1(D,U)}}),x;for(let D=0;D<300;D++){await K();let U=await Z.reconcile();if(U.state==="approved"){O(J,`Connected ${b} to Claustrum.`);return}if(U.state!=="pending"&&U.state!=="busy")throw new I("Claustrum enrollment refused; inspect its status with ck before rerunning setup.");if(U.state==="pending"&&U.requestId&&U.requestId!==x){if(!/^[a-zA-Z0-9_-]+$/.test(U.requestId))throw new I("Invalid enrollment request id.");x=U.requestId,O(J,"Waiting for approval. In another terminal, run:"),O(J,`  ck auth enroll approve --request-id ${U.requestId} --name ${Q}`),O(J,`Enrollment files: ${W.statePath}, ${W.tokenPath}`)}await(z.wait??U1)(1000)}throw new I("Claustrum approval is still pending; approve with ck and rerun setup.")}catch(Z){if(Z instanceof T||Z instanceof Y)throw Z;if(Z instanceof I)throw new I($0);throw Error($0)}finally{q.close()}}async function W0(G,b){let z=new Set(b);for(;;){let J=await v(G,[...["opencode","pi"].map((K)=>({value:K,label:`[${z.has(K)?"x":" "}] ${K==="opencode"?"OpenCode":"Pi"}`,hint:b.includes(K)?"found":"not found"})),{value:"done",label:"Continue with selected hosts"}],{message:"Select hosts to set up",subtitle:"Enter toggles a host; choose Continue when ready."});if(J===null)return null;if(J==="done")return[...z];if(z.has(J))z.delete(J);else z.add(J)}}import{applyEdits as a,createScanner as H1,findNodeAtLocation as M1,modify as D0,parse as N1,parseTree as R1}from"jsonc-parser";import{randomUUID as x1}from"node:crypto";import{mkdir as D1,open as F1,rename as V1,stat as X1,unlink as j1}from"node:fs/promises";import{basename as O1,dirname as B1,join as Y1}from"node:path";import{setTimeout as C1}from"node:timers/promises";async function x0(G,b,z={}){let J=(z.platform??process.platform)==="win32",K=B1(G);await D1(K,{recursive:!0});let Q;if(!J)try{Q=(await X1(G)).mode&4095}catch(q){if(q.code!=="ENOENT")throw q}let $=Y1(K,`.${O1(G)}.${(z.stageName??x1)()}.tmp`),W=!1;try{let q=await F1($,"wx",Q??438);W=!0;try{if(await q.writeFile(b,"utf8"),Q!==void 0)await q.chmod(Q)}finally{await q.close()}let Z=z.now??(()=>performance.now()),x=Z();for(let D=0;;D++){await z.beforeRename?.();try{await(z.rename??V1)($,G),W=!1;return}catch(U){let j=U.code,V=2000-(Z()-x);if(!J||!["EPERM","EBUSY","EACCES"].includes(j??"")||V<=0||D>=40)throw Error(`Unable to replace host config ${G}. Close editors or other programs using the file, then rerun setup.`);await(z.wait??C1)(Math.min(V,25*2**Math.min(D,2)))}}}finally{if(W)await j1($).catch(()=>{})}}function F0(G){let b=typeof G==="string"?G:Array.isArray(G)?G[0]:G&&typeof G==="object"&&("package"in G)?G.package:null;if(typeof b!=="string")return null;let z=b.indexOf("@",b.startsWith("@")?1:0);return z<0?b:b.slice(0,z)}function V0(G,b,z){let J=R1(G),K=J&&M1(J,[b]),Q=K?.children??[],$=Q[z];if(!$||!K)throw Error("Invalid plugin array edit.");let W=[{offset:$.offset,length:$.length,content:""}],q=(Z,x)=>{let D=H1(G.slice(Z,x),!0);if(D.scan(),G[Z+D.getTokenOffset()]===",")W.push({offset:Z+D.getTokenOffset(),length:1,content:""})};if(z===Q.length-1){let Z=Q[z-1];if(Z)q(Z.offset+Z.length,$.offset);q($.offset+$.length,K.offset+K.length-1)}else q($.offset+$.length,Q[z+1]?.offset??$.offset+$.length);return a(G,W)}function X0(G,b,z,J){let K=[],Q=N1(G,K,{allowTrailingComma:!0});if(K.length||!Q||typeof Q!=="object"||Array.isArray(Q))throw Error("Invalid OpenCode config; refusing to overwrite it.");let $={formattingOptions:{insertSpaces:!/^\t+/m.test(G),tabSize:/^([ ]+)"/m.exec(G)?.[1]?.length??2,eol:G.includes(`\r
+Please quit all OpenCode, LiteCode, and Pi processes before running setup.`);this.activeHosts=b,this.name="ProcessFenceViolationError"}}async function l(G=A,b={}){let z=(b.platform??process.platform)==="win32",K=b.selfPid??process.pid,J={step:z?"tasklist":"ps",exitCode:null,signal:null,timedOut:!1,durationMs:0},Q=async($,q,U,Z)=>{let D=performance.now();J={step:$,exitCode:null,signal:null,timedOut:!1,durationMs:0};try{let W=await G.run(q,U,{env:b.env,timeoutMs:Z});return J={step:$,exitCode:W.exitCode,signal:W.signal??null,timedOut:W.timedOut??!1,durationMs:W.durationMs??performance.now()-D},W}finally{if(J.exitCode===null)J.durationMs=performance.now()-D;b.onStep?.({...J})}};try{let $=await Q(z?"tasklist":"ps",z?"tasklist.exe":"ps",z?["/fo","csv","/nh"]:["-eo","pid,command"]);if($.exitCode!==0)throw new Y(J);let q=[];for(let Z of $.stdout.split(/\r?\n/)){let D=Z.trim();if(!D)continue;let W,F;if(z){let x=/^"([^"]+)","(\d+)"(?:,|$)/.exec(D);if(!x)throw new Y(J);F=x[1]??"",W=Number(x[2])}else{let x=/^(\d+)\s+(.+)$/.exec(D);if(!x){if(/^PID\s+COMMAND$/i.test(D))continue;throw new Y(J)}W=Number(x[1]),F=x[2]??""}if(!Number.isSafeInteger(W)||W<0)throw new Y(J);q.push({pid:W,command:F})}if(!q.length)throw new Y(J);let U=q.filter((Z)=>Z.pid!==K&&/^(?:node|bun)\.exe$/i.test(Z.command));if(z&&U.length&&b.inspectRuntimes!==!1){let Z=await Q("CIM","powershell.exe",["-NoProfile","-NonInteractive","-Command",`$ErrorActionPreference = 'Stop'; Get-CimInstance Win32_Process -Filter "Name = 'node.exe' OR Name = 'bun.exe'" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress`],z2);if(Z.exitCode!==0)throw new Y(J);let D=JSON.parse(Z.stdout||"null"),W=D===null?[]:Array.isArray(D)?D:[D],F=new Map;for(let x of W){if(!x||typeof x!=="object"||!("ProcessId"in x)||!("CommandLine"in x)||!Number.isSafeInteger(x.ProcessId))throw new Y(J);if(typeof x.CommandLine==="string")F.set(Number(x.ProcessId),x.CommandLine);else if(U.some((X)=>X.pid===x.ProcessId))throw new Y(J)}for(let x of U)x.command=F.get(x.pid)??""}return q}catch($){if($ instanceof Y)throw $;throw new Y(J)}}function S(G=A,b={}){let z=b.selfPid??process.pid,K=(J)=>J.pid!==z&&Z0(J.command)!==null;return{async listRunningHosts(J){return(await l(G,{...b,env:J})).filter(K)},async previewRunningHosts(J){let Q=await l(G,{...b,env:J,inspectRuntimes:!1}),$=(b.platform??process.platform)==="win32";return{hosts:Q.filter(K),uncheckedRuntimes:$?Q.filter((q)=>q.pid!==z&&/^(?:node|bun)\.exe$/i.test(q.command)).length:0}}}}async function y(G,b){let z=await G.listRunningHosts(b);if(z.length)throw new T(z)}var $0="Claustrum enrollment did not complete. Inspect and approve with ck, then rerun setup.";class I extends Error{}async function U0(G,b,z,K,J){let{name:Q,paths:$}=G.vault.hosts[b],q=L($);await J();let U=await(z.connect??m)({connectionFile:G.vault.connectionFile,handshakeTimeoutMs:2000}).catch(()=>{throw new I("Claustrum connection failed; start ck and rerun setup.")});try{let Z=new q0({proposedName:Q,paths:q,client:{enrollPropose:async(W)=>{return await J(),U.enrollPropose(W)},enrollPoll:async(W)=>{return await J(),U.enrollPoll(W)}},writeTokenFile:async(W,F)=>{await J(),await W2(W,F)}}),D;for(let W=0;W<300;W++){await J();let F=await Z.reconcile();if(F.state==="approved"){O(K,`Connected ${b} to Claustrum.`);return}if(F.state!=="pending"&&F.state!=="busy")throw new I("Claustrum enrollment refused; inspect its status with ck before rerunning setup.");if(F.state==="pending"&&F.requestId&&F.requestId!==D){if(!/^[a-zA-Z0-9_-]+$/.test(F.requestId))throw new I("Invalid enrollment request id.");D=F.requestId,O(K,"Waiting for approval. In another terminal, run:"),O(K,`  ck auth enroll approve --request-id ${F.requestId} --name ${Q}`),O(K,`Enrollment files: ${q.statePath}, ${q.tokenPath}`)}await(z.wait??U2)(1000)}throw new I("Claustrum approval is still pending; approve with ck and rerun setup.")}catch(Z){if(Z instanceof T||Z instanceof Y)throw Z;if(Z instanceof I)throw new I($0);throw Error($0)}finally{U.close()}}async function W0(G,b){let z=new Set(b);for(;;){let K=await v(G,[...["opencode","pi"].map((J)=>({value:J,label:`[${z.has(J)?"x":" "}] ${J==="opencode"?"OpenCode":"Pi"}`,hint:b.includes(J)?"found":"not found"})),{value:"done",label:"Continue with selected hosts"}],{message:"Select hosts to set up",subtitle:"Enter toggles a host; choose Continue when ready."});if(K===null)return null;if(K==="done")return[...z];if(z.has(K))z.delete(K);else z.add(K)}}import{applyEdits as a,createScanner as H2,findNodeAtLocation as M2,modify as D0,parse as N2,parseTree as R2}from"jsonc-parser";import{randomUUID as x2}from"node:crypto";import{mkdir as D2,open as F2,rename as V2,stat as X2,unlink as j2}from"node:fs/promises";import{basename as O2,dirname as B2,join as Y2}from"node:path";import{setTimeout as C2}from"node:timers/promises";async function x0(G,b,z={}){let K=(z.platform??process.platform)==="win32",J=B2(G);await D2(J,{recursive:!0});let Q;if(!K)try{Q=(await X2(G)).mode&4095}catch(U){if(U.code!=="ENOENT")throw U}let $=Y2(J,`.${O2(G)}.${(z.stageName??x2)()}.tmp`),q=!1;try{let U=await F2($,"wx",Q??438);q=!0;try{if(await U.writeFile(b,"utf8"),Q!==void 0)await U.chmod(Q)}finally{await U.close()}let Z=z.now??(()=>performance.now()),D=Z();for(let W=0;;W++){await z.beforeRename?.();try{await(z.rename??V2)($,G),q=!1;return}catch(F){let x=F.code,X=2000-(Z()-D);if(!K||!["EPERM","EBUSY","EACCES"].includes(x??"")||X<=0||W>=40)throw Error(`Unable to replace host config ${G}. Close editors or other programs using the file, then rerun setup.`);await(z.wait??C2)(Math.min(X,25*2**Math.min(W,2)))}}}finally{if(q)await j2($).catch(()=>{})}}function F0(G){let b=typeof G==="string"?G:Array.isArray(G)?G[0]:G&&typeof G==="object"&&("package"in G)?G.package:null;if(typeof b!=="string")return null;let z=b.indexOf("@",b.startsWith("@")?1:0);return z<0?b:b.slice(0,z)}function V0(G,b,z){let K=R2(G),J=K&&M2(K,[b]),Q=J?.children??[],$=Q[z];if(!$||!J)throw Error("Invalid plugin array edit.");let q=[{offset:$.offset,length:$.length,content:""}],U=(Z,D)=>{let W=H2(G.slice(Z,D),!0);if(W.scan(),G[Z+W.getTokenOffset()]===",")q.push({offset:Z+W.getTokenOffset(),length:1,content:""})};if(z===Q.length-1){let Z=Q[z-1];if(Z)U(Z.offset+Z.length,$.offset);U($.offset+$.length,J.offset+J.length-1)}else U($.offset+$.length,Q[z+1]?.offset??$.offset+$.length);return a(G,q)}function X0(G,b,z,K){let J=[],Q=N2(G,J,{allowTrailingComma:!0});if(J.length||!Q||typeof Q!=="object"||Array.isArray(Q))throw Error("Invalid OpenCode config; refusing to overwrite it.");let $={formattingOptions:{insertSpaces:!/^\t+/m.test(G),tabSize:/^([ ]+)"/m.exec(G)?.[1]?.length??2,eol:G.includes(`\r
 `)?`\r
 `:`
-`}},W=G,q=Q[b];if(q!==void 0&&!Array.isArray(q))throw Error(`OpenCode ${b} must be an array.`);let Z=Array.isArray(q)?[...q]:[],x=Z.flatMap((j,V)=>F0(j)===z?[V]:[]),D=`${z}@${J}`;if(!x.length)W=a(W,D0(W,q===void 0?[b]:[b,Z.length],q===void 0?[D]:D,$));else{let j=x[0],V=Z[j],B=Array.isArray(V)?[D,...V.slice(1)]:V&&typeof V==="object"?{...V,package:D}:D;if(JSON.stringify(V)!==JSON.stringify(B))W=a(W,D0(W,[b,j],B,$));for(let X of x.slice(1).reverse())W=V0(W,b,X)}let U=b==="plugin"?"plugins":"plugin";if(Array.isArray(Q[U])){let j=Q[U];for(let V=j.length-1;V>=0;V--)if(F0(j[V])===z)W=V0(W,U,V)}return W}function i(G,b,z={}){let J=z.fs??_,{path:K,opencode:Q}=N(z),$=b==="2"?"plugins":"plugin";return(b==="2"?["opencode"]:["opencode","tui"]).map((q)=>{let Z=K.join(Q,`${q}.jsonc`),x=K.join(Q,`${q}.json`),D=J.exists(Z)?Z:J.exists(x)?x:Z,U=J.exists(D),j=U?J.readText(D):`${JSON.stringify({$schema:`https://opencode.ai/${q==="tui"?"tui":"config"}.json`},null,2)}
-`,V=X0(j,$,G.packages.opencode,G.version);return{path:D,content:V,changed:!U||V!==j}})}async function s(G,b){for(let z of G){if(!z.changed)continue;await b?.(),await x0(z.path,z.content,{beforeRename:b})}}async function r(G,b,z={}){let{platform:J,env:K}=N(z),Q=await g(z.runner??A,J,b,["install",`npm:${G.packages.pi}@${G.version}`],K);if(Q.exitCode!==0||Q.timedOut)throw new d({exitCode:Q.spawnError?null:Q.exitCode,signal:Q.signal??null,stderrTail:Q.stderr,stderrTruncated:Q.stderrTruncated??!1})}var O0="Multiple OpenCode generations found. Choose --opencode=1|2|both before running noninteractive setup.";function k1(G){let b={yes:!1,dryRun:!1,claustrum:!1,noClaustrum:!1,login:!1,opencode:void 0};for(let z of G)if(z==="--yes")b.yes=!0;else if(z==="--dry-run")b.dryRun=!0;else if(z==="--claustrum")b.claustrum=!0;else if(z==="--no-claustrum")b.noClaustrum=!0;else if(z==="--login")b.login=!0;else if(/^--opencode=(1|2|both)$/.test(z))b.opencode=z.slice(11);else throw Error(`Unknown setup argument: ${z}`);if(b.claustrum&&b.noClaustrum)throw Error("--claustrum and --no-claustrum cannot be used together.");if(b.login&&b.claustrum)throw Error("--login and --claustrum cannot be used together.");return b}function w1(G){for(let b of Object.values(G.packages))if(!/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/.test(b))throw Error("Setup requires npm package names.");if(!/^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?(?:\+[a-zA-Z0-9.-]+)?$/.test(G.version))throw Error("Setup requires a concrete package version.");for(let b of Object.values(G.vault.hosts))if(!/^[a-z0-9][a-z0-9-]*$/.test(b.name))throw Error("Setup requires lowercase vault names containing only letters, digits and dashes.")}async function A1(G,b,z){let J=[];for(let K of b){let Q=z.get(K)??"not-enrolled";if(Q==="unknown"){let{name:$,paths:W}=G.vault.hosts[K],q=await c(P(W),$).catch(()=>"unreadable");if(q==="vault")Q="enrolled";else if(q==="local")Q="not-enrolled"}J.push({host:K,outcome:Q})}return J}async function n(G,b=[],z={}){let J=k1(b);w1(G);let K=z.terminal??j0(),Q=await p(G,z);O(K,`${G.displayName} setup`);for(let[F,H]of[["OpenCode",Q.opencode],["Pi",Q.pi]])O(K,`${F}: ${H.installed?`found (version ${H.version??"unknown"})`:"not found"} — ${H.directory}`);O(K,`Claustrum: ${Q.claustrum.available?"available":"not available"}`);let $=Q.pi.installed&&!Q.pi.executable;if($)O(K,"Pi: skipped, because its folder exists but pi is not on PATH. Install the Pi CLI and rerun setup to add it.");let W=["opencode","pi"].filter((F)=>Q[F].installed&&!(F==="pi"&&$)),q=J.yes||J.dryRun&&!E(K);if(!q&&!E(K))throw Error("Setup requires a TTY or --yes.");let Z=q?W:await W0(K,W)??[],x=J.opencode??(Q.opencode.generation==="ambiguous"?"1":Q.opencode.generation);if(Z.includes("opencode")&&!J.opencode&&Q.opencode.generation==="ambiguous"){if(q||!E(K))throw Error(O0);let F=await v(K,[{value:"1",label:"OpenCode 1"},{value:"2",label:"OpenCode 2"},{value:"both",label:"Both (one compatible registration)"}],{message:"Which OpenCode generation should be registered?"});if(F===null)return{hosts:[],dryRun:J.dryRun,mode:"local",detection:Q};x=F}if(!Z.length)return O(K,"No hosts selected. Install OpenCode or Pi and rerun setup."),{hosts:Z,dryRun:J.dryRun,mode:"local",detection:Q};let{env:D,platform:U}=N(z),j=z.fence??S(z.runner??A,{platform:U}),V=async()=>{try{await y(j,D)}catch(F){if(F instanceof Y)O(K,F.refusalText);throw F}};if(O(K,"Checking that OpenCode and Pi are not running…"),J.dryRun)try{let F=j.previewRunningHosts?await j.previewRunningHosts(D):{hosts:await j.listRunningHosts(D),uncheckedRuntimes:0},H=F.hosts;if(F.uncheckedRuntimes>0)O(K,"Node or Bun programs are running; a real run checks whether any of them is OpenCode or Pi.");let C=new Set(new T(H).activeHosts.map((w)=>w.command.toLowerCase()==="pi"?"Pi":"OpenCode"));for(let w of C)O(K,`${w} is running; setup will ask you to quit it.`)}catch(F){if(O(K,"Process inspection failed; real setup will require successful inspection and stopped OpenCode/Pi hosts."),F instanceof Y)O(K,F.refusalText)}else await V();if(J.claustrum&&!Q.claustrum.available)throw Error("Claustrum is not available. Start ck or use --no-claustrum for local sign-in.");let B=Boolean(J.claustrum);if(!B&&!J.login&&!J.noClaustrum&&!q&&Q.claustrum.available&&E(K)){let F=await v(K,[{label:"No",value:!1},{label:"Yes",value:!0}],{message:"Connect these hosts to the Claustrum vault?"});if(F===null)return O(K,"Setup cancelled. Nothing was changed."),{hosts:[],dryRun:J.dryRun,mode:"local",detection:Q};B=F===!0}let X=B?"claustrum":"local",R=Z.includes("opencode")?i(G,x,z):[];if(J.dryRun){O(K,"Dry run: no registrations, enrollment, sign-in or migration will be performed.");for(let F of Z){if(G.beforeSignIn)O(K,`Would run beforeSignIn(${F}, ${X}).`);if(B){let H=P(G.vault.hosts[F].paths);O(K,`Would Connect ${F}: write ${H.statePath} and ${H.tokenPath}; wait for ck auth enroll approve.`)}else O(K,`Would sign in locally for ${F}.`);if(G.beforeRegister)O(K,`Would run beforeRegister(${F}, ${X}).`)}for(let F of R)O(K,`${F.changed?"Would write":"Unchanged"} ${F.path}:
-${F.content}`);if(Z.includes("pi"))O(K,`Would run ${Q.pi.executable} install npm:${G.packages.pi}@${G.version}`);for(let F of Z)O(K,`Would migrate ${F} using the plugin callback (provider-specific writes).`)}else{let F={opencodeGeneration:x,mode:X,hosts:Object.freeze([...Z]),piAgentDir:Q.pi.directory},H=new Map;try{for(let C of Z){if(await V(),await G.beforeSignIn?.(C,F),await V(),B){H.set(C,"unknown");try{await U0(G,C,z,K,V)}catch(w){if(w instanceof I)H.set(C,"not-enrolled");throw w}H.set(C,"enrolled")}else await G.signInLocal(C,F);if(await V(),await G.beforeRegister?.(C,X,F),await V(),C==="opencode")await s(R,V);else await r(G,Q.pi.executable,z);await V(),await G.migrate(C,F)}}catch(C){if(H.size===0)throw C;try{let w=await A1(G,Z,H);b0(C,w);for(let P0 of w)O(K,G0(P0))}catch{}throw C}}return O(K,`${J.dryRun?"Planned":"Configured"} ${G.displayName} for ${Z.join(", ")} (${X}).`),O(K,`Next: ${Z.includes("opencode")?"start OpenCode":"start Pi"} and run ${G.slashCommand}.`),{hosts:Z,dryRun:J.dryRun,mode:X,detection:Q}}import{basename as S1}from"node:path";import{resolveClaustrumConnectionPath as y1}from"@cortexkit/claustrum-client";var B0={name:"@cortexkit/pi-openai-auth",version:"1.2.0",license:"MIT",type:"module",repository:{type:"git",url:"git+https://github.com/cortexkit/openai-auth.git",directory:"packages/pi"},main:"./dist/index.js",types:"./dist/index.d.ts",exports:{".":{import:"./dist/index.js",types:"./dist/index.d.ts"}},files:["dist","README.md","LICENSE"],keywords:["pi-package"],pi:{extensions:["./dist/index.js"]},scripts:{build:"rm -rf dist && bun build src/index.ts --outdir dist --target node --format esm --external '@earendil-works/pi-ai' --external '@earendil-works/pi-ai/*' --external '@earendil-works/pi-coding-agent' --external '@earendil-works/pi-coding-agent/*' --external '@earendil-works/pi-tui' --external '@earendil-works/pi-tui/*' --external @cortexkit/private-files --external @cortexkit/claustrum-client --external @cortexkit/subc-client --minify && bun run build:types","build:types":"cd ../core && bun run build && cd ../pi && tsdown --config tsdown.config.ts --config-loader native",test:"bun test src/tests",typecheck:"tsc",types:"tsc",prepublishOnly:"bun run build"},devDependencies:{"@cortexkit/common-auth":"^0.19.0","@cortexkit/openai-auth-core":"workspace:*"},dependencies:{"@cortexkit/claustrum-client":"^0.10.0","@cortexkit/private-files":"^0.2.1","@cortexkit/subc-client":"^0.16.0"},peerDependencies:{"@earendil-works/pi-ai":">=1.0.1","@earendil-works/pi-coding-agent":">=1.0.1","@earendil-works/pi-tui":">=1.0.1"}};import{homedir as _1}from"node:os";import{join as H0}from"node:path";function T1(){return process.env.PI_AGENT_DIR?.trim()||H0(_1(),".pi","agent")}function M0(){return process.env.PI_OPENAI_AUTH_FILE?.trim()||H0(T1(),Y0)}function P1(G=M0()){return process.env.PI_OPENAI_AUTH_STATE_FILE?.trim()||C0(G)}function N0(G=M0()){return{configPath:G,statePath:P1(G)}}var L={name:"@cortexkit/opencode-openai-auth",version:"1.2.0",license:"MIT",type:"module",repository:{type:"git",url:"git+https://github.com/cortexkit/openai-auth.git",directory:"packages/opencode"},main:"./dist/index.js",types:"./dist/index.d.ts",bin:{"opencode-openai-auth":"./dist/bin.js"},exports:{".":{import:"./dist/index.js",types:"./dist/index.d.ts"},"./tui":{types:"./dist/tui.d.ts",import:"./src/tui/entry.mjs"},"./tui-prefs":{types:"./dist/tui-preferences.d.ts",import:"./dist/tui-preferences.js"},"./server":{types:"./dist/v2/server.d.ts",import:"./dist/v2/server.js"}},"oc-plugin":["server","tui"],engines:{bun:"1.3.14"},files:["dist","src/tui/entry.mjs","src/tui-compiled","README.md","LICENSE"],scripts:{build:"rm -rf dist && bun build src/index.ts src/v2/server.ts src/sidebar-state.ts src/tui-preferences.ts src/rpc/rpc-client.ts src/rpc/port-file.ts src/rpc/protocol.ts src/rpc/rpc-dir.ts src/bin.ts --root src --outdir dist --target node --format esm --splitting --external @opencode-ai/plugin --external @opencode/plugin --external @cortexkit/private-files --external jsonc-parser --external @cortexkit/claustrum-client --external @cortexkit/subc-client --minify && bun run build:types && bun run build:tui","build:tui":"bun scripts/build-tui.ts","build:types":"cd ../core && bun run build && cd ../opencode && tsdown --config tsdown.config.ts --config-loader native","build:dev":"rm -rf dist && tsc -p tsconfig.build.json",test:"bun test src/tests",typecheck:"tsc",types:"tsc",prepublishOnly:"bun run build"},peerDependencies:{"@opencode-ai/plugin":"*","@opencode/plugin":">=2.0.21"},peerDependenciesMeta:{"@opencode/plugin":{optional:!0}},devDependencies:{"@ai-sdk/openai":"3.0.88","@cortexkit/common-auth":"^0.19.0","@cortexkit/openai-auth-core":"workspace:*","@opencode/plugin":"2.0.27"},dependencies:{"@cortexkit/claustrum-client":"^0.10.0","@cortexkit/private-files":"^0.2.1","@cortexkit/subc-client":"^0.16.0","@opentui/core":">=0.6.1","@opentui/solid":">=0.6.1",ai:"^7.0.137","jsonc-parser":"^3.3.1","solid-js":"1.9.12"}};function T0(G={}){let b=G.print??console.log,z=G.fence??S(),J={opencode:{stateDir:o(A0().statePath),host:"opencode"},pi:{stateDir:o(N0().statePath),host:"pi"}},K=async(Q)=>{if(await c(P(J[Q]),f(Q))!=="local")throw Error(`${Q} is enrolled in Claustrum or its enrollment is unreadable. Disconnect it from the vault before using local sign-in.`)};return{packages:{opencode:L.name,pi:B0.name},version:L.version,displayName:"OpenAI Auth",slashCommand:"/openai",vault:{connectionFile:y1(),hosts:{opencode:{name:f("opencode"),paths:J.opencode},pi:{name:f("pi"),paths:J.pi}}},async beforeRegister(Q,$){if($==="claustrum"){if(b(`Allow this host to read OpenAI accounts with:
-  ck auth grant --principal enrolled:${f(Q)} --selector-kind category --selector ${k0.category} --operation read`),Q==="opencode")b("Then run opencode auth login and choose ChatGPT accounts in the vault to activate vault routing without local sign-in.");return}await K(Q)},async signInLocal(Q,$){if(await K(Q),Q==="pi"){b("Start Pi and run /login openai-codex to sign in with Pi itself.");return}if($.opencodeGeneration!=="1"){let X=S1(k("opencode2",G.io)??k("opencode",G.io)??"opencode");b(`In OpenCode 2, run ${X} auth login openai and choose "ChatGPT (openai-auth pool, browser)" or "ChatGPT (openai-auth pool, headless)" to sign in to the account pool and activate it.`)}if($.opencodeGeneration==="2")return;if(I0(process.env))throw Error("Unset OPENCODE_AUTH_CONTENT before local setup sign-in.");let W=_0(),q={path:{id:"openai"}};if(await W.get(q)!==void 0){b("OpenCode already has an OpenAI login. Use opencode auth login to change it.");return}let Z=G.beginLogin??R0,x=new AbortController,D=Boolean(process.env.SSH_CONNECTION||process.env.SSH_TTY||process.platform==="linux"&&!process.env.DISPLAY&&!process.env.WAYLAND_DISPLAY),U={version:L.version,signal:x.signal},j,V=!D;try{j=await Z({...U,headless:D})}catch(X){if(D)throw X;V=!1,b("Browser callback unavailable; using device-code sign-in."),j=await Z({version:L.version,headless:!0})}if(V){if(!(G.openBrowser??w0)(j.url))x.abort(),await j.completion.catch(()=>{}),b("Browser unavailable; using device-code sign-in."),j=await Z({version:L.version,headless:!0})}b(`${j.url}
-${j.instructions}`);let B=await j.completion;await y(z),await K(Q),await W.set({...q,body:{type:"oauth",access:B.access,refresh:B.refresh,expires:B.expires,...B.accountId?{accountId:B.accountId}:{}}}),b("Signed in to OpenCode. The first plugin start adopts this login into the account pool.")},async migrate(Q){b(`${Q}: account migration runs on first plugin start; setup leaves existing credentials unchanged.`)}}}if(process.argv[2]!=="setup")console.log("Usage: opencode-openai-auth setup [options]");else try{await n(T0(),process.argv.slice(3))}catch(G){console.error(G instanceof Error?G.message:String(G)),process.exitCode=1}
+`}},q=G,U=Q[b];if(U!==void 0&&!Array.isArray(U))throw Error(`OpenCode ${b} must be an array.`);let Z=Array.isArray(U)?[...U]:[],D=Z.flatMap((x,X)=>F0(x)===z?[X]:[]),W=`${z}@${K}`;if(!D.length)q=a(q,D0(q,U===void 0?[b]:[b,Z.length],U===void 0?[W]:W,$));else{let x=D[0],X=Z[x],B=Array.isArray(X)?[W,...X.slice(1)]:X&&typeof X==="object"?{...X,package:W}:W;if(JSON.stringify(X)!==JSON.stringify(B))q=a(q,D0(q,[b,x],B,$));for(let j of D.slice(1).reverse())q=V0(q,b,j)}let F=b==="plugin"?"plugins":"plugin";if(Array.isArray(Q[F])){let x=Q[F];for(let X=x.length-1;X>=0;X--)if(F0(x[X])===z)q=V0(q,F,X)}return q}function i(G,b,z={}){let K=z.fs??_,{path:J,opencode:Q}=N(z),$=b==="2"?"plugins":"plugin";return(b==="2"?["opencode"]:["opencode","tui"]).map((U)=>{let Z=J.join(Q,`${U}.jsonc`),D=J.join(Q,`${U}.json`),W=K.exists(Z)?Z:K.exists(D)?D:Z,F=K.exists(W),x=F?K.readText(W):`${JSON.stringify({$schema:`https://opencode.ai/${U==="tui"?"tui":"config"}.json`},null,2)}
+`,X=X0(x,$,G.packages.opencode,G.version);return{path:W,content:X,changed:!F||X!==x}})}async function s(G,b){for(let z of G){if(!z.changed)continue;await b?.(),await x0(z.path,z.content,{beforeRename:b})}}async function r(G,b,z={}){let{platform:K,env:J}=N(z),Q=await g(z.runner??A,K,b,["install",`npm:${G.packages.pi}@${G.version}`],J);if(Q.exitCode!==0||Q.timedOut)throw new d({exitCode:Q.spawnError?null:Q.exitCode,signal:Q.signal??null,stderrTail:Q.stderr,stderrTruncated:Q.stderrTruncated??!1})}var O0="Multiple OpenCode generations found. Choose --opencode=1|2|both before running noninteractive setup.";function k2(G){let b={yes:!1,dryRun:!1,claustrum:!1,noClaustrum:!1,login:!1,opencode:void 0};for(let z of G)if(z==="--yes")b.yes=!0;else if(z==="--dry-run")b.dryRun=!0;else if(z==="--claustrum")b.claustrum=!0;else if(z==="--no-claustrum")b.noClaustrum=!0;else if(z==="--login")b.login=!0;else if(/^--opencode=(1|2|both)$/.test(z))b.opencode=z.slice(11);else throw Error(`Unknown setup argument: ${z}`);if(b.claustrum&&b.noClaustrum)throw Error("--claustrum and --no-claustrum cannot be used together.");if(b.login&&b.claustrum)throw Error("--login and --claustrum cannot be used together.");return b}function w2(G){for(let b of Object.values(G.packages))if(!/^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/.test(b))throw Error("Setup requires npm package names.");if(!/^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?(?:\+[a-zA-Z0-9.-]+)?$/.test(G.version))throw Error("Setup requires a concrete package version.");for(let b of Object.values(G.vault.hosts))if(!/^[a-z0-9][a-z0-9-]*$/.test(b.name))throw Error("Setup requires lowercase vault names containing only letters, digits and dashes.")}async function A2(G,b,z){let K=[];for(let J of b){let Q=z.get(J)??"not-enrolled";if(Q==="unknown"){let{name:$,paths:q}=G.vault.hosts[J],U=await c(L(q),$).catch(()=>"unreadable");if(U==="vault")Q="enrolled";else if(U==="local")Q="not-enrolled"}K.push({host:J,outcome:Q})}return K}async function n(G,b=[],z={}){let K=k2(b);w2(G);let J=z.terminal??j0(),Q=await p(G,z);O(J,`${G.displayName} setup`);for(let[V,H]of[["OpenCode",Q.opencode],["Pi",Q.pi]])O(J,`${V}: ${H.installed?`found (version ${H.version??"unknown"})`:"not found"} — ${H.directory}`);O(J,`Claustrum: ${Q.claustrum.available?"available":"not available"}`);let $=Q.pi.installed&&!Q.pi.executable;if($)O(J,"Pi: skipped, because its folder exists but pi is not on PATH. Install the Pi CLI and rerun setup to add it.");let q=["opencode","pi"].filter((V)=>Q[V].installed&&!(V==="pi"&&$)),U=K.yes||K.dryRun&&!E(J);if(!U&&!E(J))throw Error("Setup requires a TTY or --yes.");let Z=U?q:await W0(J,q)??[],D=K.opencode??(Q.opencode.generation==="ambiguous"?"1":Q.opencode.generation);if(Z.includes("opencode")&&!K.opencode&&Q.opencode.generation==="ambiguous"){if(U||!E(J))throw Error(O0);let V=await v(J,[{value:"1",label:"OpenCode 1"},{value:"2",label:"OpenCode 2"},{value:"both",label:"Both (one compatible registration)"}],{message:"Which OpenCode generation should be registered?"});if(V===null)return{hosts:[],dryRun:K.dryRun,mode:"local",detection:Q};D=V}if(!Z.length)return O(J,"No hosts selected. Install OpenCode or Pi and rerun setup."),{hosts:Z,dryRun:K.dryRun,mode:"local",detection:Q};let{env:W,platform:F}=N(z),x=z.fence??S(z.runner??A,{platform:F}),X=async()=>{try{await y(x,W)}catch(V){if(V instanceof Y)O(J,V.refusalText);throw V}};if(O(J,"Checking that OpenCode and Pi are not running…"),K.dryRun)try{let V=x.previewRunningHosts?await x.previewRunningHosts(W):{hosts:await x.listRunningHosts(W),uncheckedRuntimes:0},H=V.hosts;if(V.uncheckedRuntimes>0)O(J,"Node or Bun programs are running; a real run checks whether any of them is OpenCode or Pi.");let C=new Set(new T(H).activeHosts.map((w)=>w.command.toLowerCase()==="pi"?"Pi":"OpenCode"));for(let w of C)O(J,`${w} is running; setup will ask you to quit it.`)}catch(V){if(O(J,"Process inspection failed; real setup will require successful inspection and stopped OpenCode/Pi hosts."),V instanceof Y)O(J,V.refusalText)}else await X();if(K.claustrum&&!Q.claustrum.available)throw Error("Claustrum is not available. Start ck or use --no-claustrum for local sign-in.");let B=Boolean(K.claustrum);if(!B&&!K.login&&!K.noClaustrum&&!U&&Q.claustrum.available&&E(J)){let V=await v(J,[{label:"No",value:!1},{label:"Yes",value:!0}],{message:"Connect these hosts to the Claustrum vault?"});if(V===null)return O(J,"Setup cancelled. Nothing was changed."),{hosts:[],dryRun:K.dryRun,mode:"local",detection:Q};B=V===!0}let j=B?"claustrum":"local",R=Z.includes("opencode")?i(G,D,z):[];if(K.dryRun){O(J,"Dry run: no registrations, enrollment, sign-in or migration will be performed.");for(let V of Z){if(G.beforeSignIn)O(J,`Would run beforeSignIn(${V}, ${j}).`);if(B){let H=L(G.vault.hosts[V].paths);O(J,`Would Connect ${V}: write ${H.statePath} and ${H.tokenPath}; wait for ck auth enroll approve.`)}else O(J,`Would sign in locally for ${V}.`);if(G.beforeRegister)O(J,`Would run beforeRegister(${V}, ${j}).`)}for(let V of R)O(J,`${V.changed?"Would write":"Unchanged"} ${V.path}:
+${V.content}`);if(Z.includes("pi"))O(J,`Would run ${Q.pi.executable} install npm:${G.packages.pi}@${G.version}`);for(let V of Z)O(J,`Would migrate ${V} using the plugin callback (provider-specific writes).`)}else{let V={opencodeGeneration:D,mode:j,hosts:Object.freeze([...Z]),piAgentDir:Q.pi.directory},H=new Map;try{for(let C of Z){if(await X(),await G.beforeSignIn?.(C,V),await X(),B){H.set(C,"unknown");try{await U0(G,C,z,J,X)}catch(w){if(w instanceof I)H.set(C,"not-enrolled");throw w}H.set(C,"enrolled")}else await G.signInLocal(C,V);if(await X(),await G.beforeRegister?.(C,j,V),await X(),C==="opencode")await s(R,X);else await r(G,Q.pi.executable,z);await X(),await G.migrate(C,V)}}catch(C){if(H.size===0)throw C;try{let w=await A2(G,Z,H);b0(C,w);for(let L0 of w)O(J,G0(L0))}catch{}throw C}}return O(J,`${K.dryRun?"Planned":"Configured"} ${G.displayName} for ${Z.join(", ")} (${j}).`),O(J,`Next: ${Z.includes("opencode")?"start OpenCode":"start Pi"} and run ${G.slashCommand}.`),{hosts:Z,dryRun:K.dryRun,mode:j,detection:Q}}import{basename as S2}from"node:path";import{resolveClaustrumConnectionPath as y2}from"@cortexkit/claustrum-client";var B0={name:"@cortexkit/pi-openai-auth",version:"1.4.0",license:"MIT",type:"module",repository:{type:"git",url:"git+https://github.com/cortexkit/openai-auth.git",directory:"packages/pi"},main:"./dist/index.js",types:"./dist/index.d.ts",exports:{".":{import:"./dist/index.js",types:"./dist/index.d.ts"}},files:["dist","README.md","LICENSE"],keywords:["pi-package"],pi:{extensions:["./dist/index.js"]},scripts:{build:"rm -rf dist && bun build src/index.ts --outdir dist --target node --format esm --external '@earendil-works/pi-ai' --external '@earendil-works/pi-ai/*' --external '@earendil-works/pi-coding-agent' --external '@earendil-works/pi-coding-agent/*' --external '@earendil-works/pi-tui' --external '@earendil-works/pi-tui/*' --external @cortexkit/private-files --external @cortexkit/claustrum-client --external @cortexkit/subc-client --minify && bun run build:types","build:types":"cd ../core && bun run build && cd ../pi && tsdown --config tsdown.config.ts --config-loader native",test:"bun test src/tests",typecheck:"tsc",types:"tsc",prepublishOnly:"bun run build"},devDependencies:{"@cortexkit/common-auth":"^0.23.0","@cortexkit/openai-auth-core":"workspace:*"},dependencies:{"@cortexkit/claustrum-client":"^0.12.0","@cortexkit/private-files":"^0.2.1","@cortexkit/subc-client":"^0.22.0"},peerDependencies:{"@earendil-works/pi-ai":">=1.0.1","@earendil-works/pi-coding-agent":">=1.0.1","@earendil-works/pi-tui":">=1.0.1"}};import{homedir as _2}from"node:os";import{join as H0}from"node:path";function T2(){return process.env.PI_AGENT_DIR?.trim()||H0(_2(),".pi","agent")}function M0(){return process.env.PI_OPENAI_AUTH_FILE?.trim()||H0(T2(),Y0)}function L2(G=M0()){return process.env.PI_OPENAI_AUTH_STATE_FILE?.trim()||C0(G)}function N0(G=M0()){return{configPath:G,statePath:L2(G)}}var P={name:"@cortexkit/opencode-openai-auth",version:"1.4.0",license:"MIT",type:"module",repository:{type:"git",url:"git+https://github.com/cortexkit/openai-auth.git",directory:"packages/opencode"},main:"./dist/index.js",types:"./dist/index.d.ts",bin:{"opencode-openai-auth":"./dist/bin.js"},exports:{".":{import:"./dist/index.js",types:"./dist/index.d.ts"},"./tui":{types:"./dist/tui.d.ts",import:"./src/tui/entry.mjs"},"./tui-prefs":{types:"./dist/tui-preferences.d.ts",import:"./dist/tui-preferences.js"},"./server":{types:"./dist/v2/server.d.ts",import:"./dist/v2/server.js"}},"oc-plugin":["server","tui"],engines:{bun:"1.3.14"},files:["dist","src/tui/entry.mjs","src/tui-compiled","README.md","LICENSE"],scripts:{build:"rm -rf dist && bun build src/index.ts src/v2/server.ts src/sidebar-state.ts src/tui-preferences.ts src/rpc/rpc-client.ts src/rpc/port-file.ts src/rpc/protocol.ts src/rpc/rpc-dir.ts src/bin.ts --root src --outdir dist --target node --format esm --splitting --external @opencode-ai/plugin --external @opencode/plugin --external @cortexkit/private-files --external jsonc-parser --external @cortexkit/claustrum-client --external @cortexkit/subc-client --minify && bun run build:types && bun run build:tui","build:tui":"bun scripts/build-tui.ts","build:types":"cd ../core && bun run build && cd ../opencode && tsdown --config tsdown.config.ts --config-loader native","build:dev":"rm -rf dist && tsc -p tsconfig.build.json",test:"bun test src/tests",typecheck:"tsc",types:"tsc",prepublishOnly:"bun run build"},peerDependencies:{"@opencode-ai/plugin":"*","@opencode/plugin":">=2.0.21"},peerDependenciesMeta:{"@opencode/plugin":{optional:!0}},devDependencies:{"@ai-sdk/openai":"3.0.88","@cortexkit/common-auth":"^0.23.0","@cortexkit/openai-auth-core":"workspace:*","@opencode/plugin":"2.0.32"},dependencies:{"@cortexkit/claustrum-client":"^0.12.0","@cortexkit/private-files":"^0.2.1","@cortexkit/subc-client":"^0.22.0","@opentui/core":">=0.6.1","@opentui/solid":">=0.6.1",ai:"^7.0.143","jsonc-parser":"^3.3.1","solid-js":"1.9.12"}};function T0(G={}){let b=G.print??console.log,z=G.fence??S(),K={opencode:{stateDir:o(A0().statePath),host:"opencode"},pi:{stateDir:o(N0().statePath),host:"pi"}},J=async(Q)=>{if(await c(L(K[Q]),f(Q))!=="local")throw Error(`${Q} is enrolled in Claustrum or its enrollment is unreadable. Disconnect it from the vault before using local sign-in.`)};return{packages:{opencode:P.name,pi:B0.name},version:P.version,displayName:"OpenAI Auth",slashCommand:"/openai",vault:{connectionFile:y2(),hosts:{opencode:{name:f("opencode"),paths:K.opencode},pi:{name:f("pi"),paths:K.pi}}},async beforeRegister(Q,$){if($==="claustrum"){if(b(`Allow this host to read OpenAI accounts with:
+  ck auth grant --principal enrolled:${f(Q)} --selector-kind category --selector ${k0.category} --operation read`),Q==="opencode")b("Then run opencode auth login and choose ChatGPT accounts in the vault to activate vault routing without local sign-in.");return}await J(Q)},async signInLocal(Q,$){if(await J(Q),Q==="pi"){b("Start Pi and run /login openai-codex to sign in with Pi itself.");return}if($.opencodeGeneration!=="1"){let j=S2(k("opencode2",G.io)??k("opencode",G.io)??"opencode");b(`In OpenCode 2, run ${j} auth login openai and choose "ChatGPT (openai-auth pool, browser)" or "ChatGPT (openai-auth pool, headless)" to sign in to the account pool and activate it.`)}if($.opencodeGeneration==="2")return;if(I0(process.env))throw Error("Unset OPENCODE_AUTH_CONTENT before local setup sign-in.");let q=_0(),U={path:{id:"openai"}};if(await q.get(U)!==void 0){b("OpenCode already has an OpenAI login. Use opencode auth login to change it.");return}let Z=G.beginLogin??R0,D=new AbortController,W=Boolean(process.env.SSH_CONNECTION||process.env.SSH_TTY||process.platform==="linux"&&!process.env.DISPLAY&&!process.env.WAYLAND_DISPLAY),F={version:P.version,signal:D.signal},x,X=!W;try{x=await Z({...F,headless:W})}catch(j){if(W)throw j;X=!1,b("Browser callback unavailable; using device-code sign-in."),x=await Z({version:P.version,headless:!0})}if(X){if(!(G.openBrowser??w0)(x.url))D.abort(),await x.completion.catch(()=>{}),b("Browser unavailable; using device-code sign-in."),x=await Z({version:P.version,headless:!0})}b(`${x.url}
+${x.instructions}`);let B=await x.completion;await y(z),await J(Q),await q.set({...U,body:{type:"oauth",access:B.access,refresh:B.refresh,expires:B.expires,...B.accountId?{accountId:B.accountId}:{}}}),b("Signed in to OpenCode. The first plugin start adopts this login into the account pool.")},async migrate(Q){b(`${Q}: account migration runs on first plugin start; setup leaves existing credentials unchanged.`)}}}if(process.argv[2]!=="setup")console.log("Usage: opencode-openai-auth setup [options]");else try{await n(T0(),process.argv.slice(3))}catch(G){console.error(G instanceof Error?G.message:String(G)),process.exitCode=1}

package/dist/{codex-request-CjXETpTA.d.ts → codex-request-hw0XcldE.d.ts}

@@ -1,8 +1,8 @@
-import { a as KnobValues, c as PluginExtraSection, i as CommandInvocation, l as PluginSection, o as MenuKnob, t as CommandApplyRequest } from "./model-CQcw10oW.js";
-import { mt as QuotaMap } from "./sidebar-state-BfQ4mpZO.js";
+import { a as KnobValues, c as PluginExtraSection, i as CommandInvocation, l as PluginSection, o as MenuKnob, t as CommandApplyRequest } from "./model-DphbMQce.js";
+import { _t as QuotaMap } from "./sidebar-state-pTd9gg9W.js";
 import { ClaustrumClient, EnrollmentPollOutcome } from "@cortexkit/claustrum-client";
 import "@cortexkit/private-files";
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/schema.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/schema.d.ts
 type OAuthCredential = {
   type: 'oauth';
   access?: string;
@@ -191,7 +191,7 @@ interface PoolRow {
   unbound?: true;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/errors.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/errors.d.ts
 /** Every library operation that can fail, as named in the failure value. */
 type PoolOperation = 'initialize' | 'add' | 'replace' | 'rotate' | 'disable' | 'enable' | 'remove' | 'reorder' | 'updateSettings' | 'recordIdentity' | 'updateProviderState' | 'refresh' | 'pull' | 'publishRoster';
 /**
@@ -238,12 +238,12 @@ declare class PoolOperationError extends Error {
   });
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/hooks.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/hooks.d.ts
 interface PoolLogger {
   warn(message: string, data?: unknown): void;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.d.ts
 interface LockLoss {
   readonly reason: 'taken-over' | 'expired' | 'unreadable' | 'renewal-failed' | 'marker-lost';
   readonly expectedOwnerId: string;
@@ -278,7 +278,7 @@ type RefreshFileLockOptions = {
 /** Filesystem leases share wall time across all callers and processes. */
 declare function acquireRefreshFileLock(options: RefreshFileLockOptions): Promise<RefreshFileLock | null>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.d.ts
 type LockStep = NonNullable<Parameters<typeof acquireRefreshFileLock>[0]['onStep']> extends ((step: infer S) => unknown) ? S : never;
 /** Tuning shared by every lock the store takes; each field is overridable. */
 interface PoolLockOptions {
@@ -310,7 +310,7 @@ interface LockEnvironment {
   }, event: 'scheduled' | 'cancelled') => void;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/mutate.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/mutate.d.ts
 /** Named points on the write path, for crash and ownership injection. */
 type WriteStep = 'before-config-write' | 'after-config-write' | 'before-state-write' | 'after-state-write';
 /** Awaitable pause points on the pull and refresh paths. */
@@ -345,11 +345,11 @@ interface StoreContext {
 /** What `initializePool` did. */
 type InitializeOutcome = 'initialized' | 'already-ready';
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/runtime.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/runtime.d.ts
 /** Where a pull was fired from; `load` fires at most once per process per row. */
 type PullReason = 'load' | 'add' | 'replace' | 'admission';
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/attribution.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/attribution.d.ts
 /**
  * What a pull or refresh captured about its row (named by id alongside) when
  * it was issued. A result applies only while the row with that id still has
@@ -372,7 +372,7 @@ interface Attribution {
   identity?: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/rows.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/rows.d.ts
 type FailureHook = (rowId: string, error: PoolOperationError) => void | Promise<void>;
 interface RowOperationOptions {
   /** Called once, awaited, on every non-success path, before locks release. */
@@ -588,7 +588,7 @@ interface RowTransitionResult {
   providerState?: unknown;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/provider-state.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/provider-state.d.ts
 /**
  * Receives a private copy of the row's provider state (undefined when the row
  * shows none) and the row as loaded under the locks, and returns the next
@@ -624,7 +624,7 @@ declare const DECLINE_TRANSITION: unique symbol;
  */
 type RowTransitionMutator = (current: unknown | undefined, row: PoolRow) => unknown | typeof DECLINE_TRANSITION | Promise<unknown | typeof DECLINE_TRANSITION>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/publication.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/publication.d.ts
 interface PublishPlan {
   operationId: string;
   remove: Array<{
@@ -667,7 +667,7 @@ interface PublishResult {
   receipt: PublicationReceipt;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/pull.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/pull.d.ts
 /** What a pull is issued with: the credential and its attribution tuple. */
 interface PullRequest {
   id: string;
@@ -678,7 +678,7 @@ interface PullRequest {
 }
 type PullHook = (request: PullRequest) => Promise<unknown>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/refresh.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/refresh.d.ts
 /** What the injected provider refresh function returns. */
 interface ProviderRefreshResult {
   access: string;
@@ -741,7 +741,7 @@ type RefreshOutcome = {
   reason: string;
 };
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/settings.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/settings.d.ts
 /** The plugin's settings: every top-level config key except the pool-owned ones. */
 type PoolSettings = Record<string, unknown>;
 type SettingsRead = {
@@ -785,7 +785,7 @@ type UpdateSettingsResult = {
   outcome: 'updated' | 'unchanged';
 };
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/pool.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/pool.d.ts
 interface OpenPoolStoreOptions {
   /** The provider every row of this pool belongs to; keys the provider-wide lock. */
   provider: string;
@@ -971,13 +971,13 @@ interface PoolStore {
   pullsSettled(): Promise<void>;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/commands/seam.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/commands/seam.d.ts
 /** Where a dropped field is reported. Names only, never values. */
 interface SeamLogger {
   warn(message: string, data?: unknown): void;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/commands/builtins.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/commands/builtins.d.ts
 /**
  * What a plugin's login hands back. `ready` adds the account now. `pending`
  * means the user must finish somewhere else (a browser, a device code):
@@ -1097,17 +1097,92 @@ interface BeginAccountLoginResult {
  */
 declare function beginAccountLogin(opts: BeginAccountLoginOptions): Promise<BeginAccountLoginResult>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/claustrum/insula.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/watch.d.ts
+/**
+ * How a host currently learns about changes, for logs and status displays.
+ * `watching`: a watch was accepted and is open, so polling is reduced to a
+ * slow safety read. `polling`: no watch is open yet (not started, opening, or
+ * re-subscribing after a close), so the host polls at its usual interval.
+ * `fallback`: the watch is unavailable (an older module or client, a refusal,
+ * the watch limit, or repeated failures), so the host polls at its usual
+ * interval and may try a watch again later. Never carries secrets.
+ */
+type WatchMode = 'watching' | 'polling' | 'fallback';
+/**
+ * The fields every change notice carries, from the vault's watchScoped and
+ * insula's usage.watch alike.
+ */
+interface ChangeNotice {
+  readonly kind: string;
+  readonly epoch: string;
+  readonly seq: number;
+}
+/** A vault watch notice: `view` is the same digest `list_scoped` returns. */
+interface ScopedWatchNoticeShape extends ChangeNotice {
+  readonly view: string;
+}
+/**
+ * How a vault watch ended, as claustrum-client 0.12.0 reports it. `refused`
+ * and `not_accepting` both mean the watch closed before its first notice; the
+ * client then made one `list_scoped` read to learn why, and `refused` carries
+ * that read's refusal.
+ */
+type ScopedWatchEnd = {
+  readonly kind: 'refused';
+  readonly error: unknown;
+} | {
+  readonly kind: 'transport_lost';
+  readonly error: unknown;
+} | {
+  readonly kind: 'ended' | 'not_accepting' | 'unsupported' | 'stopped';
+};
+interface ScopedWatchHandle {
+  stop(): void;
+  readonly closed: Promise<ScopedWatchEnd>;
+}
+/**
+ * The part of a vault client that can watch. claustrum-client added
+ * `watchScoped` in 0.12.0; the peer range still admits 0.6.2, so it is
+ * optional and detected at run time.
+ */
+interface ScopedWatchSource {
+  watchScoped?(onNotice: (notice: ScopedWatchNoticeShape) => void, options?: {
+    enrollmentToken?: string;
+  }): ScopedWatchHandle;
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/insula.d.ts
+/**
+ * A held-open `usage.watch` stream. `closed` resolves when insula ends the
+ * stream (STREAM_END at shutdown, or a reply that ends it) or after `stop()`,
+ * and rejects with insula's refusal (an error with a `code`, such as
+ * `unknown_method` from an insula that predates the method, or
+ * `usage_watch_limit` when 64 watches are already open) or with the
+ * transport failure.
+ */
+interface InsulaUsageWatch {
+  stop(): void;
+  readonly closed: Promise<void>;
+}
 /** Optional transport for custom scoped clients; getUsage must not retry refusals. */
 interface InsulaUsageTransport {
   connectionFile: string;
   getUsage(): Promise<unknown>;
+  /**
+   * Open a `usage.watch` stream, passing each notice's raw JSON body to
+   * `onNotice`. Optional: a transport without it is polled as before.
+   */
+  watchUsage?(onNotice: (body: Uint8Array) => void): InsulaUsageWatch;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/claustrum/custody.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/custody.d.ts
+/**
+ * `watchScoped` is present from claustrum-client 0.12.0. Hosts detect it at
+ * run time and keep polling without it.
+ */
 type ClaustrumScopedClient = Pick<ClaustrumClient, 'listScoped' | 'getScoped' | 'reportAuthFailureScoped' | 'close'> & {
   insula?: InsulaUsageTransport;
-};
+} & ScopedWatchSource;
 /** The two credential types a plugin's family can hold; routing differs by type. */
 type VaultCredentialType = 'oauth' | 'api_key';
 /**
@@ -1192,9 +1267,20 @@ interface ClaustrumScopedAttempt {
   readonly accessToken: string;
   readonly recordVersion: number;
   readonly expiresAtMs: number | null;
+  /**
+   * True when this receipt was not freshly served but is the last token kept
+   * from an earlier read, used because the vault could not be reached. A 401
+   * with such a receipt must not be retried and is not reported to the vault,
+   * which is unreachable.
+   */
+  readonly fromKeptReceipt?: true;
+}
+interface KeptReceiptState {
+  readonly active: boolean;
+  readonly since: number | null;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.d.ts
 /**
  * The declined-account interlock: the user's "do not use this vault account",
  * kept on the consumer side because the vault has no notion of it.
@@ -1213,7 +1299,7 @@ interface DeclinedAccount {
   readonly accountIdentity?: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/claustrum/roster.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/roster.d.ts
 /**
  * One vault account as the pool sees it. It carries no bearer material: the
  * access token is fetched from the vault for every send. Several vault
@@ -1268,7 +1354,18 @@ interface VaultRosterFile {
  */
 type QuotaReceipt = Pick<ClaustrumScopedAttempt, 'credentialId' | 'accountIdentity' | 'accountIdentitySource' | 'expectedAccountIdentity'>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/consumer.d.ts
+/**
+ * How a started consumer learns about changes, for logs and status displays.
+ * `insula` is present when the consumer was given an insula source. Never
+ * carries secrets.
+ */
+interface ClaustrumWatchState {
+  readonly vault: WatchMode;
+  readonly insula?: WatchMode;
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.d.ts
 interface ClaustrumEnrollmentClient {
   enrollPropose(input: {
     name: string;
@@ -1369,6 +1466,12 @@ interface OpenAiVaultOptions {
   pollIntervalMs?: number;
   fetchImpl?: () => typeof fetch;
   now?: () => number;
+  /**
+   * Replace the timers behind the background poll, the vault and insula
+   * watches' retries and the outage probe (tests).
+   */
+  setTimeoutImpl?: typeof setTimeout;
+  clearTimeoutImpl?: typeof clearTimeout;
 }
 /** One host's view of its OpenAI accounts in the vault. */
 declare class OpenAiVault {
@@ -1387,9 +1490,13 @@ declare class OpenAiVault {
    */
   enrolled(): boolean;
   /**
-   * Polls enrollment files and the vault's accounts. With local authority the
-   * consumer sends no vault request. A new enrollment completed by another
-   * process is detected on the next poll.
+   * Starts the consumer's background poll and its vault and insula watches.
+   * With local authority the consumer sends no vault request. A new
+   * enrollment completed by another process is detected on the next poll.
+   * While the vault watch is open the poll lists the vault only every five
+   * minutes, and a notice that the visible accounts changed starts a
+   * discovery at once; without a watch (an older vault or client, or a
+   * refusal) every poll lists the vault as before.
    */
   start(): void;
   /**
@@ -1414,6 +1521,16 @@ declare class OpenAiVault {
    */
   refresh(): Promise<VaultRosterFile | undefined>;
   snapshot(): VaultRosterFile | undefined;
+  /**
+   * Whether the consumer learns about vault and insula changes from a watch
+   * or by polling, without any I/O.
+   */
+  watchState(): ClaustrumWatchState;
+  /**
+   * Whether any account is being served the last token the vault gave it
+   * because the vault cannot be reached, without any I/O.
+   */
+  keptReceiptState(): KeptReceiptState;
   /**
    * What the vault says this host is granted, from the latest list, without
    * any I/O. Undefined is unknown (a vault that does not report grants, or
@@ -1476,7 +1593,7 @@ declare class OpenAiVault {
    * the background; a failure is logged.
    */
   recordSnapshot(routeId: string, snapshot: unknown, complete: boolean, receipt: QuotaReceipt): Promise<void>;
-  /** Joins a quota poll; current insula quota for the same account replaces a background ChatGPT wham/usage request. */
+  /** Joins a quota poll; insula decides whether a background provider read is needed. */
   pollQuota(routeId: string, background?: boolean): Promise<{
     ok: boolean;
     error?: string;