@cortexkit/pi-anthropic-auth 1.19.1 → 1.21.0

package/README.md

@@ -2,7 +2,7 @@
 
 Pi package for CortexKit Anthropic OAuth support. It overrides Pi's built-in `anthropic` provider with a CortexKit provider extension backed by the shared `@cortexkit/anthropic-auth-core` package.
 
-The Pi provider catalog includes Claude Fable 5 (`claude-fable-5`), limited-access Claude Mythos 5 (`claude-mythos-5`), Claude Opus 4.8, Claude Opus 4.5, Claude Sonnet 4.5, and Claude Sonnet 5 (`claude-sonnet-5`). Fable/Mythos reasoning uses Anthropic adaptive thinking with `thinking.display: "summarized"` and `output_config.effort`; the package does not send rejected manual `thinking.budget_tokens` for those models.
+The Pi provider catalog includes Claude Fable 5 (`claude-fable-5`), limited-access Claude Mythos 5 (`claude-mythos-5`), Claude Opus 5 (`claude-opus-5`), Claude Opus 4.8, Claude Opus 4.5, Claude Sonnet 4.5, and Claude Sonnet 5 (`claude-sonnet-5`). Fable/Mythos reasoning uses Anthropic adaptive thinking with `thinking.display: "summarized"` and `output_config.effort`; the package does not send rejected manual `thinking.budget_tokens` for those models.
 
 This package is part of the CortexKit Anthropic Auth monorepo, which supports both OpenCode (`@cortexkit/opencode-anthropic-auth`) and Pi (`@cortexkit/pi-anthropic-auth`) through the same shared core logic.
 
@@ -42,7 +42,7 @@ Pi state is stored separately from OpenCode at:
 
 Override the path with `PI_ANTHROPIC_AUTH_FILE`. The package also respects `PI_AGENT_DIR` when deriving the default sidecar path.
 
-The sidecar uses the same JSON shape as the OpenCode package, including `routing`, `claudeCache`, `cacheKeep`, `claudeFast`, `dump`, `relay`, and fallback `accounts` blocks. Runtime OAuth/quota state is stored in `anthropic-auth-state.json`; sticky session assignments are stored separately in `anthropic-auth-routing-state.json` with SHA-256-hashed session IDs.
+The sidecar uses the same JSON shape as the OpenCode package, including `routing`, `claudeCache`, `cacheKeep`, `prime`, `claudeFast`, `dump`, `relay`, and fallback `accounts` blocks. Runtime OAuth/quota state is stored in `anthropic-auth-state.json`; sticky session assignments are stored separately in `anthropic-auth-routing-state.json` with SHA-256-hashed session IDs.
 
 ## Commands
 
@@ -59,6 +59,10 @@ The sidecar uses the same JSON shape as the OpenCode package, including `routing
 /claude-cachekeep 09-23
 /claude-cachekeep off
 
+/claude-prime
+/claude-prime on
+/claude-prime off
+
 /claude-dump
 /claude-dump on
 /claude-dump off
@@ -78,6 +82,16 @@ The sidecar uses the same JSON shape as the OpenCode package, including `routing
 
 `/claude-quota` reports sidecar OAuth fallback quota state from `~/.pi/agent/anthropic-auth.json`. `/claude-routing fallback-first` prefers usable OAuth fallback accounts before the main account; `/claude-routing main-first` restores the default. `/claude-routing sticky-balanced` assigns each Pi session to an OAuth account according to current 5-hour, 7-day, and matching model-scoped quota headroom, then persists that assignment across transient failures and process restarts. `/claude-routing reset` clears the current Pi session's assignment. Direct Opus sessions prefer usable accounts whose Fable quota is exhausted. API-key routes use the same sidecar shape as OpenCode and are sent directly to their configured Anthropic-compatible base URL, such as Kie's `https://api.kie.ai/claude`, but Pi only uses them after the main OAuth model response reports HTTP 429 or a streaming rate-limit error and a live quota check confirms 0% remaining. `/claude-cachekeep always` keeps active hybrid caches warm while Pi remains open; `/claude-cachekeep HH-HH` limits prewarms to a local time window. Both send `max_tokens: 0` pre-warm requests about five minutes before the 1-hour TTL expires. Running `/claude-cachekeep` without arguments lists live tracked sessions across Pi processes through a temporary lease registry that stores only session IDs and cache timing. `/claude-fast on` adds Anthropic `speed: "fast"` plus the `fast-mode-2026-02-01` beta header for supported Opus models (`claude-opus-4-6`, `claude-opus-4-7`, `claude-opus-4-8`, and `claude-opus-5`).
 
+### Claude quota window priming
+
+Priming is off by default. When enabled from OpenCode with `/claude-prime on`, it watches each OAuth account's 5-hour quota reset and sends one minimal `claude-haiku-4-5` request about one minute after a confirmed reset. This starts the next window without waiting for a normal prompt. Usage is measured from response accounting.
+
+For an idle account with no cached reset time, one bootstrap request establishes the first observed window. Atomic temporary-file claims limit multiple processes sharing an account config to one request per account and reset.
+
+Prime marker identities live in `anthropic-auth-state.json`. Plugin-owned refresh rotations preserve the main account's lineage, while a host credential replacement creates a new lineage. An existing main lineage without a refresh-token binding attaches to the current credential on its first check without changing identity. On upgrade, an existing fallback account receives an identity during its first prime check; that one-time marker change can send one extra request in the current window.
+
+Pi's `/claude-prime` command displays status only. The `on` and `off` arguments are ignored; toggling priming requires OpenCode.
+
 ## Relay
 
 The Pi package can use the same user-owned Cloudflare relay config as the OpenCode package. The relay setup helper currently lives in the OpenCode package CLI:

package/dist/commands.js

@@ -1,6 +1,6 @@
-import { buildClaudeQuotaSummary, buildFallbackQuotaSummaries, CLAUDE_ACCOUNT_COMMAND_NAME, CLAUDE_CACHE_KEEP_COMMAND_NAME, CLAUDE_ROUTING_COMMAND_NAME, createEmptyStorage, executeAccountCommand, executeCache1hCommand, executeCacheKeepCommand, executeDumpCommand, executeFastModeCommand, executeLoggingCommand, executeRoutingCommand, getCache1hPersistentMode, getCacheKeepWindow, getPersistedLogLevel, getRoutingMode, isCache1hPersistentlyEnabled, isCacheKeepAlways, isCacheKeepHybridActive, isCacheKeepPersistentlyEnabled, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, loadAccounts, parseCache1hCommandAction, parseCacheKeepCommandAction, parseDumpCommandAction, parseFastModeCommandAction, parseLoggingCommandAction, parseRoutingCommandAction, removeAccountPersistent, reorderAccountsPersistent, setAccountEnabledPersistent, setCache1hPersistentEnabled, setCache1hPersistentMode, setCacheKeepPersistentAlways, setCacheKeepPersistentEnabled, setCacheKeepPersistentWindow, setCacheKeepSubagentsEnabled, setDumpEnabled, setDumpPersistentEnabled, setFastModePersistentEnabled, setLogLevelPersistent, setRoutingMode, } from '@cortexkit/anthropic-auth-core';
-import { getPiAccountStoragePath } from "./paths.js";
-import { clearPiStickyRoutingSession, getPiTrackedCacheKeepSessions, } from "./stream.js";
+import { buildClaudeQuotaSummary, buildFallbackQuotaSummaries, buildPrimeAccountStatuses, CLAUDE_ACCOUNT_COMMAND_NAME, CLAUDE_CACHE_KEEP_COMMAND_NAME, CLAUDE_PRIME_COMMAND_NAME, CLAUDE_ROUTING_COMMAND_NAME, createEmptyStorage, executeAccountCommand, executeCache1hCommand, executeCacheKeepCommand, executeDumpCommand, executeFastModeCommand, executeLoggingCommand, executePrimeCommand, executeRoutingCommand, getCache1hPersistentMode, getCacheKeepWindow, getPersistedLogLevel, getRoutingMode, isCache1hPersistentlyEnabled, isCacheKeepAlways, isCacheKeepHybridActive, isCacheKeepPersistentlyEnabled, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, isPrimePersistentlyEnabled, loadAccounts, parseCache1hCommandAction, parseCacheKeepCommandAction, parseDumpCommandAction, parseFastModeCommandAction, parseLoggingCommandAction, parseRoutingCommandAction, removeAccountPersistent, reorderAccountsPersistent, setAccountEnabledPersistent, setCache1hPersistentEnabled, setCache1hPersistentMode, setCacheKeepPersistentAlways, setCacheKeepPersistentEnabled, setCacheKeepPersistentWindow, setCacheKeepSubagentsEnabled, setDumpEnabled, setDumpPersistentEnabled, setFastModePersistentEnabled, setLogLevelPersistent, setRoutingMode, } from '@cortexkit/anthropic-auth-core';
+import { getPiAccountStoragePath } from './paths.js';
+import { clearPiStickyRoutingSession, getPiTrackedCacheKeepSessions, } from './stream.js';
 function notify(ctx, message, kind = 'info') {
     ctx.ui.notify(message, kind);
 }
@@ -200,4 +200,21 @@ export function registerCommands(pi) {
             notify(ctx, executeLoggingCommand({ argumentsText: args ?? '', level }));
         },
     });
+    pi.registerCommand(CLAUDE_PRIME_COMMAND_NAME, {
+        description: "Show each OAuth account's five-hour quota window state",
+        handler: async (_args, ctx) => {
+            // Pi has no live PrimeManager; render persisted counters and the
+            // next-due timestamp from stored quota snapshots. Always pass
+            // `argumentsText: 'status'` to the pure executor so on/off args
+            // are display-only — Pi cannot toggle the setting.
+            const path = getPiAccountStoragePath();
+            const storage = await loadAccounts(path);
+            const accounts = buildPrimeAccountStatuses(storage, { now: Date.now() });
+            notify(ctx, executePrimeCommand({
+                argumentsText: 'status',
+                enabled: isPrimePersistentlyEnabled(storage),
+                accounts,
+            }).text);
+        },
+    });
 }

package/dist/convert.js

@@ -1,4 +1,12 @@
 import { applyClaudeCodeMetadata, buildBillingHeaderValue, CLAUDE_CODE_ENTRYPOINT, CLAUDE_CODE_IDENTITY, CLAUDE_FABLE_MYTHOS_5_SUMMARIZED_THINKING, CLAUDE_OPUS_5_ADAPTIVE_THINKING, CLAUDE_SONNET_5_ADAPTIVE_THINKING, isClaudeFableOrMythos5Model, isClaudeOpus5Model, isClaudeSonnet5Model, isFastModeSupportedModel, isOpenAIReasoningSignature, orderClaudeCodeBody, signRequestBody, } from '@cortexkit/anthropic-auth-core';
+// Anchor identifying Pi's documentation paragraph — the only part of the prompt
+// that Anthropic currently rejects in system[]. Unknown prompt shapes take the
+// service-preserving fallback below instead of returning the full prompt there.
+const PI_DOCS_ANCHOR = 'Pi documentation';
+const ANTHROPIC_REPLAY_APIS = new Set([
+    'anthropic-messages',
+    'cortexkit-anthropic-messages',
+]);
 const CLAUDE_CODE_TOOLS = new Map([
     'Read',
     'Write',
@@ -101,7 +109,7 @@ function convertTextAndImages(content) {
     }
     return blocks;
 }
-function convertMessages(messages) {
+function convertMessages(messages, targetModelId) {
     const result = [];
     for (let index = 0; index < messages.length; index++) {
         const message = messages[index];
@@ -136,33 +144,63 @@ function convertMessages(messages) {
                 if (block.type === 'text' && block.text.trim()) {
                     blocks.push({ type: 'text', text: sanitize(block.text) });
                 }
-                else if (block.type === 'thinking' && block.thinking.trim()) {
+                else if (block.type === 'thinking') {
                     const thinking = block;
-                    if (isOpenAIReasoningSignature(thinking.thinkingSignature)) {
-                        // OpenAI reasoningEncryptedContent is also opaque encrypted state,
-                        // but it is not an Anthropic thinking signature. Sending it as
-                        // `thinking.signature` makes Anthropic reject the request.
+                    const signature = thinking.thinkingSignature;
+                    const hasSignature = typeof signature === 'string' && signature.trim().length > 0;
+                    const signatureBelongsToTarget = message.provider === 'anthropic' &&
+                        ANTHROPIC_REPLAY_APIS.has(message.api) &&
+                        message.model === targetModelId &&
+                        !isOpenAIReasoningSignature(signature);
+                    // Match Pi's built-in origin check: only replay signatures from the
+                    // same Anthropic API/model. Preserve visible foreign reasoning as
+                    // ordinary text, but drop opaque redacted/OpenAI encrypted state.
+                    if (hasSignature && !signatureBelongsToTarget) {
+                        if (!thinking.redacted &&
+                            !isOpenAIReasoningSignature(signature) &&
+                            thinking.thinking.trim()) {
+                            blocks.push({ type: 'text', text: sanitize(thinking.thinking) });
+                        }
                         continue;
                     }
-                    if (thinking.thinkingSignature &&
-                        !hasLoneSurrogate(thinking.thinking)) {
-                        // Signed thinking blocks must be sent back verbatim — the signature
-                        // is computed over the original text. Sanitizing would alter it and
-                        // Anthropic rejects the block as "modified". Anthropic-origin
-                        // thinking is valid UTF-8, so this is the normal path.
+                    if (thinking.redacted) {
+                        if (hasSignature) {
+                            blocks.push({
+                                type: 'redacted_thinking',
+                                data: signature,
+                            });
+                        }
+                        continue;
+                    }
+                    if (!hasSignature) {
+                        // Anthropic rejects unsigned thinking blocks. Preserve readable
+                        // output from interrupted streams as ordinary assistant text.
+                        if (thinking.thinking.trim()) {
+                            blocks.push({
+                                type: 'text',
+                                text: sanitize(thinking.thinking),
+                            });
+                        }
+                        continue;
+                    }
+                    if (hasLoneSurrogate(thinking.thinking)) {
+                        // Signature authenticates the thinking bytes exactly. Sanitizing the
+                        // text would invalidate it, so downgrade malformed signed thinking
+                        // to plain text and omit the signature instead.
+                        if (thinking.thinking.trim()) {
+                            blocks.push({
+                                type: 'text',
+                                text: sanitize(thinking.thinking),
+                            });
+                        }
+                    }
+                    else {
                         blocks.push({
                             type: 'thinking',
                             thinking: thinking.thinking,
-                            signature: thinking.thinkingSignature,
+                            signature,
                         });
                     }
-                    else {
-                        // Either unsigned, or signed-but-contains a lone surrogate. In the
-                        // latter case we cannot keep the signature: sanitizing breaks it and
-                        // sending the raw lone surrogate is an invalid-UTF8 400. Drop the
-                        // signature and downgrade to sanitized text.
-                        blocks.push({ type: 'text', text: sanitize(thinking.thinking) });
-                    }
                 }
                 else if (block.type === 'toolCall') {
                     blocks.push({
@@ -253,6 +291,38 @@ function addEphemeralCacheControl(body) {
         break;
     }
 }
+function splitPiSystemPrompt(prompt) {
+    const sanitized = sanitize(prompt);
+    const paragraphs = sanitized.split(/\n\n+/);
+    const docs = paragraphs.filter((paragraph) => paragraph.includes(PI_DOCS_ANCHOR));
+    // If Pi changes the heading or prompt layout, fail away from the request shape
+    // known to trigger billing rejection: carry the complete host prompt in the
+    // first user message until the new shape can be classified precisely.
+    if (docs.length === 0)
+        return { messageText: sanitized };
+    const keep = paragraphs.filter((paragraph) => !paragraph.includes(PI_DOCS_ANCHOR));
+    return {
+        ...(keep.length ? { systemText: keep.join('\n\n') } : {}),
+        messageText: docs.join('\n\n'),
+    };
+}
+function prependCachedPromptBlock(messages, text) {
+    const firstUser = messages.find((message) => message.role === 'user');
+    if (!firstUser)
+        return;
+    const promptBlock = {
+        type: 'text',
+        text,
+        cache_control: { type: 'ephemeral' },
+    };
+    if (typeof firstUser.content === 'string') {
+        firstUser.content = [promptBlock, { type: 'text', text: firstUser.content }];
+        return;
+    }
+    if (Array.isArray(firstUser.content)) {
+        firstUser.content.unshift(promptBlock);
+    }
+}
 function applyCacheMode(body, enabled, mode) {
     if (!enabled)
         return;
@@ -282,7 +352,7 @@ function applyCacheMode(body, enabled, mode) {
     addTtl(body);
 }
 export async function buildAnthropicRequest(modelId, context, options, cache, fastModeEnabled = false, identity) {
-    const messages = convertMessages(context.messages);
+    const messages = convertMessages(context.messages, modelId);
     // Strip trailing assistant messages — Anthropic rejects prefill on some models
     while (messages.length &&
         messages[messages.length - 1]?.role === 'assistant') {
@@ -296,7 +366,35 @@ export async function buildAnthropicRequest(modelId, context, options, cache, fa
         { type: 'text', text: CLAUDE_CODE_IDENTITY },
     ];
     if (context.systemPrompt?.trim()) {
-        system.push({ type: 'text', text: sanitize(context.systemPrompt) });
+        // Pi's prompt cannot sit whole in the top-level system[] array: two lines of
+        // its documentation paragraph (the docs/*.md enumeration and the "follow .md
+        // cross-references" instruction) are each independently sufficient to make
+        // Anthropic reject the request with 400 "You're out of extra usage". Entry
+        // count and payload size are ruled out — 2697 bytes of neutral filler in the
+        // same position is accepted, and the same text is accepted inside messages[].
+        //
+        // For the recognized Pi prompt, keep the identity, tool contract, and
+        // guidelines in system[], where they carry system weight and survive context
+        // compaction, and carry only the documentation paragraph in messages[]. An
+        // unknown future prompt shape is moved whole rather than risking this 400.
+        //
+        // It goes in as its own content block ahead of the user's text, not merged
+        // into it and not as a separate message. A cache prefix matches contiguously
+        // from the start of the request, so a block boundary here lets the prefix end
+        // before the user's words: a new conversation with a different first message
+        // still reads the paragraph from cache instead of re-writing ~1.1k tokens.
+        // A role: "system" message cannot be used at messages[0] — Anthropic rejects
+        // that — and placing one after the first user message puts it behind content
+        // that varies, which defeats the caching.
+        //
+        // cache_control is set explicitly because addEphemeralCacheControl's
+        // message-level breakpoint only fires for array content on the *last* user
+        // message, which is not this one after the first turn.
+        const prompt = splitPiSystemPrompt(context.systemPrompt);
+        if (prompt.systemText) {
+            system.push({ type: 'text', text: prompt.systemText });
+        }
+        prependCachedPromptBlock(messages, prompt.messageText);
     }
     const body = {
         model: modelId,

package/dist/index.js

@@ -1,6 +1,6 @@
 import { authorize, CLAUDE_FABLE_MYTHOS_5_CONTEXT_WINDOW, CLAUDE_FABLE_MYTHOS_5_MAX_OUTPUT_TOKENS, CLAUDE_FABLE_MYTHOS_5_MODEL_SPECS, CLAUDE_FABLE_MYTHOS_5_PRICING, exchange, refreshClaudeOAuthToken, } from '@cortexkit/anthropic-auth-core';
-import { registerCommands } from "./commands.js";
-import { streamCortexKitAnthropic } from "./stream.js";
+import { registerCommands } from './commands.js';
+import { streamCortexKitAnthropic } from './stream.js';
 async function loginAnthropic(callbacks) {
     const auth = await authorize('max');
     callbacks.onAuth({ url: auth.url });
@@ -51,6 +51,15 @@ export default function cortexKitPiAnthropicAuth(pi) {
                 contextWindow: CLAUDE_FABLE_MYTHOS_5_CONTEXT_WINDOW,
                 maxTokens: CLAUDE_FABLE_MYTHOS_5_MAX_OUTPUT_TOKENS,
             })),
+            {
+                id: 'claude-opus-5',
+                name: 'Claude Opus 5',
+                reasoning: true,
+                input: textImageInput(),
+                cost: { input: 5, output: 25, cacheRead: 0.5, cacheWrite: 6.25 },
+                contextWindow: 1_000_000,
+                maxTokens: 128_000,
+            },
             {
                 id: 'claude-opus-4-8',
                 name: 'Claude Opus 4.8',

package/dist/stream.js

@@ -1,7 +1,7 @@
-import { applyClaudeCodeHeaders, CACHE_KEEP_EXTENDED_TTL_BETA, CacheKeepManager, CacheKeepSessionRegistry, createStickyNoRouteResponse, decideStickyQuotaFailure, dumpDirectRequest, FAST_MODE_BETA, FallbackAccountManager, getCache1hPersistentMode, getDefaultCacheKeepRegistryDirectory, getRelayConfig, getRoutingMode, getStickyRoutingStatePath, isApiKeyAccount, isCache1hPersistentlyEnabled, isCacheKeepHybridActive, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, isKillswitchEnabled, isOAuthAccount, isPermanentRefreshError, isValidApiBaseURL, killswitchPassesPolicy, loadAccounts, mergeAnthropicBetas, QuotaManager, quotaSnapshotModelScopeIsExhausted, quotaSnapshotPassesModelScope, quotaSnapshotPassesPolicy, resolveClaudeCodeIdentity, STICKY_ROUTING_MAIN_ACCOUNT_ID, StickySessionRouter, sendViaRelay, setDumpEnabled, shouldFallbackStatus, stickyQuotaSnapshotIsFresh, stickyRetryAfterWithJitter, stickyRouteFamilyForModel, } from '@cortexkit/anthropic-auth-core';
+import { applyClaudeCodeHeaders, CACHE_KEEP_EXTENDED_TTL_BETA, CacheKeepManager, CacheKeepSessionRegistry, createStickyNoRouteResponse, decideStickyQuotaFailure, dumpDirectRequest, FAST_MODE_BETA, FallbackAccountManager, getCache1hPersistentMode, getDefaultCacheKeepRegistryDirectory, getFallbackReauthLabels, getOrCreateMainAccountId, getRelayConfig, getRoutingMode, getStickyRoutingStatePath, isApiKeyAccount, isCache1hPersistentlyEnabled, isCacheKeepHybridActive, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, isKillswitchEnabled, isOAuthAccount, isPermanentRefreshError, isValidApiBaseURL, killswitchPassesPolicy, loadAccounts, mergeAnthropicBetas, QuotaManager, quotaSnapshotHasStandardWindows, quotaSnapshotModelScopeIsExhausted, quotaSnapshotPassesModelScope, quotaSnapshotPassesPolicy, refreshBackoffActive, resolveClaudeCodeIdentity, STICKY_ROUTING_MAIN_ACCOUNT_ID, StickySessionRouter, sendViaRelay, setDumpEnabled, shouldFallbackStatus, stickyQuotaSnapshotIsFresh, stickyRetryAfterWithJitter, stickyRouteFamilyForModel, } from '@cortexkit/anthropic-auth-core';
 import { calculateCost, createAssistantMessageEventStream, } from '@earendil-works/pi-ai';
-import { buildAnthropicRequest, fromClaudeCodeToolName } from "./convert.js";
-import { getPiAccountStoragePath } from "./paths.js";
+import { buildAnthropicRequest, fromClaudeCodeToolName } from './convert.js';
+import { getPiAccountStoragePath } from './paths.js';
 function errorText(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -10,6 +10,7 @@ let cacheKeepRegistryDirectory;
 const stickyRouters = new Map();
 const quotaManagers = new Map();
 const fallbackManagers = new Map();
+const mainAccountIdInitializations = new Map();
 const PI_SERVICE_CACHE_LIMIT = 16;
 function setBoundedService(map, key, value) {
     map.delete(key);
@@ -21,6 +22,19 @@ function setBoundedService(map, key, value) {
         map.delete(oldest);
     }
 }
+function ensurePiMainAccountId(storagePath) {
+    let initialization = mainAccountIdInitializations.get(storagePath);
+    if (!initialization) {
+        initialization = getOrCreateMainAccountId(storagePath).catch((error) => {
+            if (mainAccountIdInitializations.get(storagePath) === initialization) {
+                mainAccountIdInitializations.delete(storagePath);
+            }
+            throw error;
+        });
+        setBoundedService(mainAccountIdInitializations, storagePath, initialization);
+    }
+    return initialization;
+}
 function getPiRoutingServices(storagePath, storage) {
     let quotaManager = quotaManagers.get(storagePath);
     let fallbackManager = fallbackManagers.get(storagePath);
@@ -71,7 +85,10 @@ const cacheKeepManager = new CacheKeepManager({
             return headers;
         try {
             const body = JSON.parse(target.bodyText);
-            const identity = await resolveClaudeCodeIdentity(accessToken, typeof body.model === 'string' ? body.model : undefined);
+            const storagePath = getPiAccountStoragePath();
+            await ensurePiMainAccountId(storagePath);
+            const storage = await loadAccounts(storagePath);
+            const identity = await resolveClaudeCodeIdentity(accessToken, typeof body.model === 'string' ? body.model : undefined, target.oauthAccountId ?? storage?.mainAccountId);
             headers.delete('anthropic-beta');
             applyClaudeCodeHeaders(headers, accessToken, { body, identity });
             headers.set('anthropic-beta', mergeAnthropicBetas(headers.get('anthropic-beta'), [
@@ -201,10 +218,14 @@ export async function* parseSse(response) {
     }
 }
 async function sendAnthropicRequest(options) {
+    await ensurePiMainAccountId(options.storagePath);
     const storage = await loadAccounts(options.storagePath);
     setDumpEnabled(isDumpPersistentlyEnabled(storage));
+    const accountIdentity = options.oauthAccountId === STICKY_ROUTING_MAIN_ACCOUNT_ID
+        ? storage?.mainAccountId
+        : options.oauthAccountId;
     const identity = options.accessToken
-        ? await resolveClaudeCodeIdentity(options.accessToken, options.model.id)
+        ? await resolveClaudeCodeIdentity(options.accessToken, options.model.id, accountIdentity)
         : undefined;
     const { body, bodyText } = await buildAnthropicRequest(options.model.id, options.context, options.streamOptions, {
         enabled: isCache1hPersistentlyEnabled(storage),
@@ -307,16 +328,18 @@ async function firstStreamingError(response) {
     return response;
 }
 async function executeWithFallback(options) {
+    await ensurePiMainAccountId(options.storagePath);
     const storage = await loadAccounts(options.storagePath);
     const { quotaManager, fallbackManager: manager } = getPiRoutingServices(options.storagePath, storage);
-    quotaManager.seedMainFromStorage(storage, options.primaryAccessToken);
+    const mainAccountId = storage?.mainAccountId;
+    quotaManager.seedMainFromStorage(storage, mainAccountId);
     quotaManager.seedFallbacksFromAccounts((storage?.accounts ?? []).filter(isOAuthAccount));
     async function buildStickyRoutes(modelId) {
-        const mainEntry = quotaManager.getMain(options.primaryAccessToken);
+        const mainEntry = quotaManager.getMain(mainAccountId);
         let mainQuota = mainEntry?.quota;
         if (!stickyQuotaSnapshotIsFresh(mainEntry?.quota, storage, Date.now(), modelId)) {
             try {
-                mainQuota = await quotaManager.refreshMain(options.primaryAccessToken);
+                mainQuota = await quotaManager.refreshMain(mainAccountId, options.primaryAccessToken);
             }
             catch { }
         }
@@ -339,11 +362,10 @@ async function executeWithFallback(options) {
             const account = usableById.get(configured.id) ?? configured;
             if (!account.access || isPermanentRefreshError(account.lastRefreshError))
                 continue;
-            let accountQuota = quotaManager.getFallback(account.id, account.access)?.quota ??
-                account.quota;
+            let accountQuota = quotaManager.getFallback(account.id, account)?.quota ?? account.quota;
             if (!stickyQuotaSnapshotIsFresh(accountQuota, storage, Date.now(), modelId)) {
                 try {
-                    accountQuota = await quotaManager.refreshFallback(account.id, account.access);
+                    accountQuota = await quotaManager.refreshFallback(account.id, account.access, account);
                 }
                 catch { }
             }
@@ -374,19 +396,26 @@ async function executeWithFallback(options) {
         }));
         const usableIds = new Set(usableFallbacks.map((account) => account.id));
         const candidates = allRoutes.flatMap((route) => {
-            if (!route.quota)
-                return [];
+            const quota = quotaSnapshotHasStandardWindows(route.quota)
+                ? route.quota
+                : undefined;
             const accountId = route.id === STICKY_ROUTING_MAIN_ACCOUNT_ID ? undefined : route.id;
-            const passes = quotaSnapshotPassesPolicy(route.quota, storage) &&
-                quotaSnapshotPassesModelScope(route.quota, modelId) &&
-                (!isKillswitchEnabled(storage) ||
-                    killswitchPassesPolicy(route.quota, storage, accountId, modelId)) &&
-                (route.id === STICKY_ROUTING_MAIN_ACCOUNT_ID || usableIds.has(route.id));
+            const quotaState = quota
+                ? { kind: 'known', quota }
+                : { kind: 'unknown' };
+            const passesKillswitch = !isKillswitchEnabled(storage) ||
+                killswitchPassesPolicy(quotaState.kind === 'known' ? quotaState.quota : undefined, storage, accountId, modelId);
+            const passes = passesKillswitch &&
+                (quotaState.kind === 'unknown' ||
+                    (quotaSnapshotPassesPolicy(quotaState.quota, storage) &&
+                        quotaSnapshotPassesModelScope(quotaState.quota, modelId) &&
+                        (route.id === STICKY_ROUTING_MAIN_ACCOUNT_ID ||
+                            usableIds.has(route.id))));
             return passes
                 ? [
                     {
                         accountId: route.id,
-                        quota: route.quota,
+                        quota: quotaState,
                         order: route.order,
                     },
                 ]
@@ -396,8 +425,8 @@ async function executeWithFallback(options) {
     }
     async function primaryQuotaRefreshConfirmsExhausted() {
         try {
-            const quota = await quotaManager.refreshMain(options.primaryAccessToken);
-            const entry = quotaManager.getMain(options.primaryAccessToken);
+            const quota = await quotaManager.refreshMain(mainAccountId, options.primaryAccessToken);
+            const entry = quotaManager.getMain(mainAccountId);
             return Boolean(entry &&
                 entry.refreshAfter > Date.now() &&
                 quotaSnapshotIsExhausted(quota));
@@ -408,8 +437,8 @@ async function executeWithFallback(options) {
     }
     async function primaryQuotaRefreshConfirmsModelScopeExhausted() {
         try {
-            const quota = await quotaManager.refreshMain(options.primaryAccessToken);
-            const entry = quotaManager.getMain(options.primaryAccessToken);
+            const quota = await quotaManager.refreshMain(mainAccountId, options.primaryAccessToken);
+            const entry = quotaManager.getMain(mainAccountId);
             return Boolean(entry &&
                 entry.refreshAfter > Date.now() &&
                 quotaSnapshotModelScopeIsExhausted(quota, options.model.id));
@@ -419,12 +448,12 @@ async function executeWithFallback(options) {
         }
     }
     function primaryCachedModelScopeExhausted() {
-        const entry = quotaManager.getMain(options.primaryAccessToken);
+        const entry = quotaManager.getMain(mainAccountId);
         return Boolean(entry &&
             quotaSnapshotModelScopeIsExhausted(entry.quota, options.model.id));
     }
     function primaryFreshModelScopeExhausted() {
-        const entry = quotaManager.getMain(options.primaryAccessToken);
+        const entry = quotaManager.getMain(mainAccountId);
         return Boolean(entry &&
             !quotaManager.isMainStale(options.model.id) &&
             quotaSnapshotModelScopeIsExhausted(entry.quota, options.model.id));
@@ -436,17 +465,38 @@ async function executeWithFallback(options) {
         const usableOAuthById = new Map(usableOAuth.map((account) => [account.id, account]));
         for (const configured of storage?.accounts ?? []) {
             let response = null;
-            const account = isOAuthAccount(configured)
+            let account = isOAuthAccount(configured)
                 ? usableOAuthById.get(configured.id)
                 : configured;
-            if (!account)
+            if (!account) {
+                if (!isOAuthAccount(configured) ||
+                    !configured.access ||
+                    (configured.expires !== undefined &&
+                        configured.expires <= Date.now()) ||
+                    isPermanentRefreshError(configured.lastRefreshError) ||
+                    refreshBackoffActive(configured.lastRefreshError, configured.id, Date.now()))
+                    continue;
+                account = configured;
+                const quota = quotaManager.getFallback(configured.id, configured)?.quota ??
+                    configured.quota;
+                if (quotaSnapshotHasStandardWindows(quota))
+                    continue;
+                if (isKillswitchEnabled(storage) &&
+                    !killswitchPassesPolicy(quota, storage, configured.id, options.model.id))
+                    continue;
+            }
+            else if (isOAuthAccount(account) &&
+                isKillswitchEnabled(storage) &&
+                !killswitchPassesPolicy(quotaManager.getFallback(account.id, account)?.quota ?? account.quota, storage, account.id, options.model.id)) {
                 continue;
+            }
             if (isOAuthAccount(account)) {
                 if (routeOptions.apiOnly === true || !account.access)
                     continue;
                 response = await sendAnthropicRequest({
                     ...options,
                     accessToken: account.access,
+                    oauthAccountId: account.id,
                 });
             }
             else if (routeOptions.includeApiRoutes === true &&
@@ -504,6 +554,7 @@ async function executeWithFallback(options) {
         if (!resolution) {
             return createStickyNoRouteResponse({
                 mainRefreshError: storage?.refresh?.mainLastRefreshError,
+                fallbackReauthLabels: getFallbackReauthLabels(storage),
                 routeQuotas: routes.allRoutes.flatMap((route) => route.quota ? [route.quota] : []),
                 modelId: options.model.id,
             });
@@ -586,8 +637,8 @@ async function executeWithFallback(options) {
                 try {
                     quota =
                         route.id === STICKY_ROUTING_MAIN_ACCOUNT_ID
-                            ? await quotaManager.refreshMain(route.access)
-                            : await quotaManager.refreshFallback(route.id, route.access);
+                            ? await quotaManager.refreshMain(mainAccountId, route.access)
+                            : await quotaManager.refreshFallback(route.id, route.access, route.account);
                 }
                 catch {
                     // Retain affinity when the quota probe itself is unavailable.
@@ -679,9 +730,39 @@ async function executeWithFallback(options) {
         if (fallback)
             return fallback;
     }
+    if (isKillswitchEnabled(storage)) {
+        let mainQuota = quotaManager.getMain(mainAccountId)?.quota;
+        if (!mainQuota || quotaManager.isMainStale(options.model.id)) {
+            try {
+                mainQuota = await quotaManager.refreshMain(mainAccountId, options.primaryAccessToken);
+            }
+            catch { }
+        }
+        if (!killswitchPassesPolicy(mainQuota, storage, undefined, options.model.id)) {
+            if (!fallbackFirst) {
+                const fallback = await tryFallbackAccounts();
+                if (fallback)
+                    return fallback;
+            }
+            return new Response(JSON.stringify({
+                type: 'error',
+                error: {
+                    type: 'rate_limit_error',
+                    message: 'Killswitch blocked all OAuth routes',
+                },
+            }), {
+                status: 429,
+                headers: {
+                    'content-type': 'application/json',
+                    'retry-after': '60',
+                },
+            });
+        }
+    }
     const primary = await sendAnthropicRequest({
         ...options,
         accessToken: options.primaryAccessToken,
+        oauthAccountId: STICKY_ROUTING_MAIN_ACCOUNT_ID,
     });
     const primaryPreflight = await firstStreamingError(primary);
     if (primaryPreflight instanceof Response) {
@@ -757,6 +838,20 @@ export function streamCortexKitAnthropic(model, context, options) {
                             partial: output,
                         });
                     }
+                    else if (block?.type === 'redacted_thinking') {
+                        output.content.push({
+                            type: 'thinking',
+                            thinking: '[Reasoning redacted]',
+                            thinkingSignature: String(block.data ?? ''),
+                            redacted: true,
+                            index: event.index,
+                        });
+                        stream.push({
+                            type: 'thinking_start',
+                            contentIndex: output.content.length - 1,
+                            partial: output,
+                        });
+                    }
                     else if (block?.type === 'tool_use') {
                         output.content.push({
                             type: 'toolCall',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/pi-anthropic-auth",
-  "version": "1.19.1",
+  "version": "1.21.0",
   "type": "module",
   "repository": {
     "type": "git",
@@ -36,7 +36,7 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@cortexkit/anthropic-auth-core": "1.19.1"
+    "@cortexkit/anthropic-auth-core": "1.21.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "*",