@cortexkit/pi-anthropic-auth 1.19.1 → 1.20.0

package/README.md

@@ -2,7 +2,7 @@
 
 Pi package for CortexKit Anthropic OAuth support. It overrides Pi's built-in `anthropic` provider with a CortexKit provider extension backed by the shared `@cortexkit/anthropic-auth-core` package.
 
-The Pi provider catalog includes Claude Fable 5 (`claude-fable-5`), limited-access Claude Mythos 5 (`claude-mythos-5`), Claude Opus 4.8, Claude Opus 4.5, Claude Sonnet 4.5, and Claude Sonnet 5 (`claude-sonnet-5`). Fable/Mythos reasoning uses Anthropic adaptive thinking with `thinking.display: "summarized"` and `output_config.effort`; the package does not send rejected manual `thinking.budget_tokens` for those models.
+The Pi provider catalog includes Claude Fable 5 (`claude-fable-5`), limited-access Claude Mythos 5 (`claude-mythos-5`), Claude Opus 5 (`claude-opus-5`), Claude Opus 4.8, Claude Opus 4.5, Claude Sonnet 4.5, and Claude Sonnet 5 (`claude-sonnet-5`). Fable/Mythos reasoning uses Anthropic adaptive thinking with `thinking.display: "summarized"` and `output_config.effort`; the package does not send rejected manual `thinking.budget_tokens` for those models.
 
 This package is part of the CortexKit Anthropic Auth monorepo, which supports both OpenCode (`@cortexkit/opencode-anthropic-auth`) and Pi (`@cortexkit/pi-anthropic-auth`) through the same shared core logic.
 
@@ -42,7 +42,7 @@ Pi state is stored separately from OpenCode at:
 
 Override the path with `PI_ANTHROPIC_AUTH_FILE`. The package also respects `PI_AGENT_DIR` when deriving the default sidecar path.
 
-The sidecar uses the same JSON shape as the OpenCode package, including `routing`, `claudeCache`, `cacheKeep`, `claudeFast`, `dump`, `relay`, and fallback `accounts` blocks. Runtime OAuth/quota state is stored in `anthropic-auth-state.json`; sticky session assignments are stored separately in `anthropic-auth-routing-state.json` with SHA-256-hashed session IDs.
+The sidecar uses the same JSON shape as the OpenCode package, including `routing`, `claudeCache`, `cacheKeep`, `prime`, `claudeFast`, `dump`, `relay`, and fallback `accounts` blocks. Runtime OAuth/quota state is stored in `anthropic-auth-state.json`; sticky session assignments are stored separately in `anthropic-auth-routing-state.json` with SHA-256-hashed session IDs.
 
 ## Commands
 
@@ -59,6 +59,10 @@ The sidecar uses the same JSON shape as the OpenCode package, including `routing
 /claude-cachekeep 09-23
 /claude-cachekeep off
 
+/claude-prime
+/claude-prime on
+/claude-prime off
+
 /claude-dump
 /claude-dump on
 /claude-dump off
@@ -78,6 +82,16 @@ The sidecar uses the same JSON shape as the OpenCode package, including `routing
 
 `/claude-quota` reports sidecar OAuth fallback quota state from `~/.pi/agent/anthropic-auth.json`. `/claude-routing fallback-first` prefers usable OAuth fallback accounts before the main account; `/claude-routing main-first` restores the default. `/claude-routing sticky-balanced` assigns each Pi session to an OAuth account according to current 5-hour, 7-day, and matching model-scoped quota headroom, then persists that assignment across transient failures and process restarts. `/claude-routing reset` clears the current Pi session's assignment. Direct Opus sessions prefer usable accounts whose Fable quota is exhausted. API-key routes use the same sidecar shape as OpenCode and are sent directly to their configured Anthropic-compatible base URL, such as Kie's `https://api.kie.ai/claude`, but Pi only uses them after the main OAuth model response reports HTTP 429 or a streaming rate-limit error and a live quota check confirms 0% remaining. `/claude-cachekeep always` keeps active hybrid caches warm while Pi remains open; `/claude-cachekeep HH-HH` limits prewarms to a local time window. Both send `max_tokens: 0` pre-warm requests about five minutes before the 1-hour TTL expires. Running `/claude-cachekeep` without arguments lists live tracked sessions across Pi processes through a temporary lease registry that stores only session IDs and cache timing. `/claude-fast on` adds Anthropic `speed: "fast"` plus the `fast-mode-2026-02-01` beta header for supported Opus models (`claude-opus-4-6`, `claude-opus-4-7`, `claude-opus-4-8`, and `claude-opus-5`).
 
+### Claude quota window priming
+
+Priming is off by default. When enabled from OpenCode with `/claude-prime on`, it watches each OAuth account's 5-hour quota reset and sends one minimal `claude-haiku-4-5` request about one minute after a confirmed reset. This starts the next window without waiting for a normal prompt. Usage is measured from response accounting.
+
+For an idle account with no cached reset time, one bootstrap request establishes the first observed window. Atomic temporary-file claims limit multiple processes sharing an account config to one request per account and reset.
+
+Prime marker identities live in `anthropic-auth-state.json`. Plugin-owned refresh rotations preserve the main account's lineage, while a host credential replacement creates a new lineage. An existing main lineage without a refresh-token binding attaches to the current credential on its first check without changing identity. On upgrade, an existing fallback account receives an identity during its first prime check; that one-time marker change can send one extra request in the current window.
+
+Pi's `/claude-prime` command displays status only. The `on` and `off` arguments are ignored; toggling priming requires OpenCode.
+
 ## Relay
 
 The Pi package can use the same user-owned Cloudflare relay config as the OpenCode package. The relay setup helper currently lives in the OpenCode package CLI:

package/dist/commands.js

@@ -1,6 +1,6 @@
-import { buildClaudeQuotaSummary, buildFallbackQuotaSummaries, CLAUDE_ACCOUNT_COMMAND_NAME, CLAUDE_CACHE_KEEP_COMMAND_NAME, CLAUDE_ROUTING_COMMAND_NAME, createEmptyStorage, executeAccountCommand, executeCache1hCommand, executeCacheKeepCommand, executeDumpCommand, executeFastModeCommand, executeLoggingCommand, executeRoutingCommand, getCache1hPersistentMode, getCacheKeepWindow, getPersistedLogLevel, getRoutingMode, isCache1hPersistentlyEnabled, isCacheKeepAlways, isCacheKeepHybridActive, isCacheKeepPersistentlyEnabled, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, loadAccounts, parseCache1hCommandAction, parseCacheKeepCommandAction, parseDumpCommandAction, parseFastModeCommandAction, parseLoggingCommandAction, parseRoutingCommandAction, removeAccountPersistent, reorderAccountsPersistent, setAccountEnabledPersistent, setCache1hPersistentEnabled, setCache1hPersistentMode, setCacheKeepPersistentAlways, setCacheKeepPersistentEnabled, setCacheKeepPersistentWindow, setCacheKeepSubagentsEnabled, setDumpEnabled, setDumpPersistentEnabled, setFastModePersistentEnabled, setLogLevelPersistent, setRoutingMode, } from '@cortexkit/anthropic-auth-core';
-import { getPiAccountStoragePath } from "./paths.js";
-import { clearPiStickyRoutingSession, getPiTrackedCacheKeepSessions, } from "./stream.js";
+import { buildClaudeQuotaSummary, buildFallbackQuotaSummaries, buildPrimeAccountStatuses, CLAUDE_ACCOUNT_COMMAND_NAME, CLAUDE_CACHE_KEEP_COMMAND_NAME, CLAUDE_PRIME_COMMAND_NAME, CLAUDE_ROUTING_COMMAND_NAME, createEmptyStorage, executeAccountCommand, executeCache1hCommand, executeCacheKeepCommand, executeDumpCommand, executeFastModeCommand, executeLoggingCommand, executePrimeCommand, executeRoutingCommand, getCache1hPersistentMode, getCacheKeepWindow, getPersistedLogLevel, getRoutingMode, isCache1hPersistentlyEnabled, isCacheKeepAlways, isCacheKeepHybridActive, isCacheKeepPersistentlyEnabled, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, isPrimePersistentlyEnabled, loadAccounts, parseCache1hCommandAction, parseCacheKeepCommandAction, parseDumpCommandAction, parseFastModeCommandAction, parseLoggingCommandAction, parseRoutingCommandAction, removeAccountPersistent, reorderAccountsPersistent, setAccountEnabledPersistent, setCache1hPersistentEnabled, setCache1hPersistentMode, setCacheKeepPersistentAlways, setCacheKeepPersistentEnabled, setCacheKeepPersistentWindow, setCacheKeepSubagentsEnabled, setDumpEnabled, setDumpPersistentEnabled, setFastModePersistentEnabled, setLogLevelPersistent, setRoutingMode, } from '@cortexkit/anthropic-auth-core';
+import { getPiAccountStoragePath } from './paths.js';
+import { clearPiStickyRoutingSession, getPiTrackedCacheKeepSessions, } from './stream.js';
 function notify(ctx, message, kind = 'info') {
     ctx.ui.notify(message, kind);
 }
@@ -200,4 +200,21 @@ export function registerCommands(pi) {
             notify(ctx, executeLoggingCommand({ argumentsText: args ?? '', level }));
         },
     });
+    pi.registerCommand(CLAUDE_PRIME_COMMAND_NAME, {
+        description: "Show each OAuth account's five-hour quota window state",
+        handler: async (_args, ctx) => {
+            // Pi has no live PrimeManager; render persisted counters and the
+            // next-due timestamp from stored quota snapshots. Always pass
+            // `argumentsText: 'status'` to the pure executor so on/off args
+            // are display-only — Pi cannot toggle the setting.
+            const path = getPiAccountStoragePath();
+            const storage = await loadAccounts(path);
+            const accounts = buildPrimeAccountStatuses(storage, { now: Date.now() });
+            notify(ctx, executePrimeCommand({
+                argumentsText: 'status',
+                enabled: isPrimePersistentlyEnabled(storage),
+                accounts,
+            }).text);
+        },
+    });
 }

package/dist/convert.js

@@ -1,4 +1,8 @@
 import { applyClaudeCodeMetadata, buildBillingHeaderValue, CLAUDE_CODE_ENTRYPOINT, CLAUDE_CODE_IDENTITY, CLAUDE_FABLE_MYTHOS_5_SUMMARIZED_THINKING, CLAUDE_OPUS_5_ADAPTIVE_THINKING, CLAUDE_SONNET_5_ADAPTIVE_THINKING, isClaudeFableOrMythos5Model, isClaudeOpus5Model, isClaudeSonnet5Model, isFastModeSupportedModel, isOpenAIReasoningSignature, orderClaudeCodeBody, signRequestBody, } from '@cortexkit/anthropic-auth-core';
+// Anchor identifying Pi's documentation paragraph — the only part of the prompt
+// that Anthropic currently rejects in system[]. Unknown prompt shapes take the
+// service-preserving fallback below instead of returning the full prompt there.
+const PI_DOCS_ANCHOR = 'Pi documentation';
 const CLAUDE_CODE_TOOLS = new Map([
     'Read',
     'Write',
@@ -253,6 +257,38 @@ function addEphemeralCacheControl(body) {
         break;
     }
 }
+function splitPiSystemPrompt(prompt) {
+    const sanitized = sanitize(prompt);
+    const paragraphs = sanitized.split(/\n\n+/);
+    const docs = paragraphs.filter((paragraph) => paragraph.includes(PI_DOCS_ANCHOR));
+    // If Pi changes the heading or prompt layout, fail away from the request shape
+    // known to trigger billing rejection: carry the complete host prompt in the
+    // first user message until the new shape can be classified precisely.
+    if (docs.length === 0)
+        return { messageText: sanitized };
+    const keep = paragraphs.filter((paragraph) => !paragraph.includes(PI_DOCS_ANCHOR));
+    return {
+        ...(keep.length ? { systemText: keep.join('\n\n') } : {}),
+        messageText: docs.join('\n\n'),
+    };
+}
+function prependCachedPromptBlock(messages, text) {
+    const firstUser = messages.find((message) => message.role === 'user');
+    if (!firstUser)
+        return;
+    const promptBlock = {
+        type: 'text',
+        text,
+        cache_control: { type: 'ephemeral' },
+    };
+    if (typeof firstUser.content === 'string') {
+        firstUser.content = [promptBlock, { type: 'text', text: firstUser.content }];
+        return;
+    }
+    if (Array.isArray(firstUser.content)) {
+        firstUser.content.unshift(promptBlock);
+    }
+}
 function applyCacheMode(body, enabled, mode) {
     if (!enabled)
         return;
@@ -296,7 +332,35 @@ export async function buildAnthropicRequest(modelId, context, options, cache, fa
         { type: 'text', text: CLAUDE_CODE_IDENTITY },
     ];
     if (context.systemPrompt?.trim()) {
-        system.push({ type: 'text', text: sanitize(context.systemPrompt) });
+        // Pi's prompt cannot sit whole in the top-level system[] array: two lines of
+        // its documentation paragraph (the docs/*.md enumeration and the "follow .md
+        // cross-references" instruction) are each independently sufficient to make
+        // Anthropic reject the request with 400 "You're out of extra usage". Entry
+        // count and payload size are ruled out — 2697 bytes of neutral filler in the
+        // same position is accepted, and the same text is accepted inside messages[].
+        //
+        // For the recognized Pi prompt, keep the identity, tool contract, and
+        // guidelines in system[], where they carry system weight and survive context
+        // compaction, and carry only the documentation paragraph in messages[]. An
+        // unknown future prompt shape is moved whole rather than risking this 400.
+        //
+        // It goes in as its own content block ahead of the user's text, not merged
+        // into it and not as a separate message. A cache prefix matches contiguously
+        // from the start of the request, so a block boundary here lets the prefix end
+        // before the user's words: a new conversation with a different first message
+        // still reads the paragraph from cache instead of re-writing ~1.1k tokens.
+        // A role: "system" message cannot be used at messages[0] — Anthropic rejects
+        // that — and placing one after the first user message puts it behind content
+        // that varies, which defeats the caching.
+        //
+        // cache_control is set explicitly because addEphemeralCacheControl's
+        // message-level breakpoint only fires for array content on the *last* user
+        // message, which is not this one after the first turn.
+        const prompt = splitPiSystemPrompt(context.systemPrompt);
+        if (prompt.systemText) {
+            system.push({ type: 'text', text: prompt.systemText });
+        }
+        prependCachedPromptBlock(messages, prompt.messageText);
     }
     const body = {
         model: modelId,

package/dist/index.js

@@ -1,6 +1,6 @@
 import { authorize, CLAUDE_FABLE_MYTHOS_5_CONTEXT_WINDOW, CLAUDE_FABLE_MYTHOS_5_MAX_OUTPUT_TOKENS, CLAUDE_FABLE_MYTHOS_5_MODEL_SPECS, CLAUDE_FABLE_MYTHOS_5_PRICING, exchange, refreshClaudeOAuthToken, } from '@cortexkit/anthropic-auth-core';
-import { registerCommands } from "./commands.js";
-import { streamCortexKitAnthropic } from "./stream.js";
+import { registerCommands } from './commands.js';
+import { streamCortexKitAnthropic } from './stream.js';
 async function loginAnthropic(callbacks) {
     const auth = await authorize('max');
     callbacks.onAuth({ url: auth.url });
@@ -51,6 +51,15 @@ export default function cortexKitPiAnthropicAuth(pi) {
                 contextWindow: CLAUDE_FABLE_MYTHOS_5_CONTEXT_WINDOW,
                 maxTokens: CLAUDE_FABLE_MYTHOS_5_MAX_OUTPUT_TOKENS,
             })),
+            {
+                id: 'claude-opus-5',
+                name: 'Claude Opus 5',
+                reasoning: true,
+                input: textImageInput(),
+                cost: { input: 5, output: 25, cacheRead: 0.5, cacheWrite: 6.25 },
+                contextWindow: 1_000_000,
+                maxTokens: 128_000,
+            },
             {
                 id: 'claude-opus-4-8',
                 name: 'Claude Opus 4.8',

package/dist/stream.js

@@ -1,7 +1,7 @@
-import { applyClaudeCodeHeaders, CACHE_KEEP_EXTENDED_TTL_BETA, CacheKeepManager, CacheKeepSessionRegistry, createStickyNoRouteResponse, decideStickyQuotaFailure, dumpDirectRequest, FAST_MODE_BETA, FallbackAccountManager, getCache1hPersistentMode, getDefaultCacheKeepRegistryDirectory, getRelayConfig, getRoutingMode, getStickyRoutingStatePath, isApiKeyAccount, isCache1hPersistentlyEnabled, isCacheKeepHybridActive, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, isKillswitchEnabled, isOAuthAccount, isPermanentRefreshError, isValidApiBaseURL, killswitchPassesPolicy, loadAccounts, mergeAnthropicBetas, QuotaManager, quotaSnapshotModelScopeIsExhausted, quotaSnapshotPassesModelScope, quotaSnapshotPassesPolicy, resolveClaudeCodeIdentity, STICKY_ROUTING_MAIN_ACCOUNT_ID, StickySessionRouter, sendViaRelay, setDumpEnabled, shouldFallbackStatus, stickyQuotaSnapshotIsFresh, stickyRetryAfterWithJitter, stickyRouteFamilyForModel, } from '@cortexkit/anthropic-auth-core';
+import { applyClaudeCodeHeaders, CACHE_KEEP_EXTENDED_TTL_BETA, CacheKeepManager, CacheKeepSessionRegistry, createStickyNoRouteResponse, decideStickyQuotaFailure, dumpDirectRequest, FAST_MODE_BETA, FallbackAccountManager, getCache1hPersistentMode, getDefaultCacheKeepRegistryDirectory, getFallbackReauthLabels, getRelayConfig, getRoutingMode, getStickyRoutingStatePath, isApiKeyAccount, isCache1hPersistentlyEnabled, isCacheKeepHybridActive, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, isKillswitchEnabled, isOAuthAccount, isPermanentRefreshError, isValidApiBaseURL, killswitchPassesPolicy, loadAccounts, mergeAnthropicBetas, QuotaManager, quotaSnapshotModelScopeIsExhausted, quotaSnapshotPassesModelScope, quotaSnapshotPassesPolicy, resolveClaudeCodeIdentity, STICKY_ROUTING_MAIN_ACCOUNT_ID, StickySessionRouter, sendViaRelay, setDumpEnabled, shouldFallbackStatus, stickyQuotaSnapshotIsFresh, stickyRetryAfterWithJitter, stickyRouteFamilyForModel, } from '@cortexkit/anthropic-auth-core';
 import { calculateCost, createAssistantMessageEventStream, } from '@earendil-works/pi-ai';
-import { buildAnthropicRequest, fromClaudeCodeToolName } from "./convert.js";
-import { getPiAccountStoragePath } from "./paths.js";
+import { buildAnthropicRequest, fromClaudeCodeToolName } from './convert.js';
+import { getPiAccountStoragePath } from './paths.js';
 function errorText(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -504,6 +504,7 @@ async function executeWithFallback(options) {
         if (!resolution) {
             return createStickyNoRouteResponse({
                 mainRefreshError: storage?.refresh?.mainLastRefreshError,
+                fallbackReauthLabels: getFallbackReauthLabels(storage),
                 routeQuotas: routes.allRoutes.flatMap((route) => route.quota ? [route.quota] : []),
                 modelId: options.model.id,
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/pi-anthropic-auth",
-  "version": "1.19.1",
+  "version": "1.20.0",
   "type": "module",
   "repository": {
     "type": "git",
@@ -36,7 +36,7 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@cortexkit/anthropic-auth-core": "1.19.1"
+    "@cortexkit/anthropic-auth-core": "1.20.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "*",