@cortexkit/pi-anthropic-auth 1.21.0 → 1.23.0

package/README.md

@@ -2,10 +2,20 @@
 
 Pi package for CortexKit Anthropic OAuth support. It overrides Pi's built-in `anthropic` provider with a CortexKit provider extension backed by the shared `@cortexkit/anthropic-auth-core` package.
 
-The Pi provider catalog includes Claude Fable 5 (`claude-fable-5`), limited-access Claude Mythos 5 (`claude-mythos-5`), Claude Opus 5 (`claude-opus-5`), Claude Opus 4.8, Claude Opus 4.5, Claude Sonnet 4.5, and Claude Sonnet 5 (`claude-sonnet-5`). Fable/Mythos reasoning uses Anthropic adaptive thinking with `thinking.display: "summarized"` and `output_config.effort`; the package does not send rejected manual `thinking.budget_tokens` for those models.
+The Pi provider catalog includes Claude Fable 5 (`claude-fable-5`) and 5.1 (`claude-fable-5-1`), limited-access Claude Mythos 5 (`claude-mythos-5`) and 5.1 (`claude-mythos-5-1`), Claude Opus 5 (`claude-opus-5`), Claude Opus 5.5 (`claude-opus-5-5`), Claude Opus 4.8, Claude Opus 4.5, Claude Sonnet 4.5, and Claude Sonnet 5 (`claude-sonnet-5`). Fable/Mythos reasoning uses Anthropic adaptive thinking with `thinking.display: "summarized"` and `output_config.effort`; the package does not send rejected manual `thinking.budget_tokens` for those models. Opus 5.5 features always-on adaptive thinking with summarized display. OAuth Fable 5.1 sessions preserve Pi thinking-level changes as mid-conversation effort markers, so switching effort does not rewrite the cached prefix. Replayed signed/redacted thinking follows the configured prefix-mismatch behavior.
 
 This package is part of the CortexKit Anthropic Auth monorepo, which supports both OpenCode (`@cortexkit/opencode-anthropic-auth`) and Pi (`@cortexkit/pi-anthropic-auth`) through the same shared core logic.
 
+## Setup wizard (recommended)
+
+Use the unified setup wizard to install the extension and optionally configure Claustrum custody:
+
+```bash
+bunx @cortexkit/opencode-anthropic-auth setup
+```
+
+---
+
 ## Install
 
 Install with Pi's package manager:
@@ -42,7 +52,7 @@ Pi state is stored separately from OpenCode at:
 
 Override the path with `PI_ANTHROPIC_AUTH_FILE`. The package also respects `PI_AGENT_DIR` when deriving the default sidecar path.
 
-The sidecar uses the same JSON shape as the OpenCode package, including `routing`, `claudeCache`, `cacheKeep`, `prime`, `claudeFast`, `dump`, `relay`, and fallback `accounts` blocks. Runtime OAuth/quota state is stored in `anthropic-auth-state.json`; sticky session assignments are stored separately in `anthropic-auth-routing-state.json` with SHA-256-hashed session IDs.
+The sidecar uses the same JSON shape as the OpenCode package, including `routing`, `claudeCache`, `cacheKeep`, `prime`, `claudeFast`, `thinkingBinding`, `dump`, `relay`, and fallback `accounts` blocks. `thinkingBinding.prefixMismatchBehavior` accepts `account-default` (default), `error`, or `drop_block` for OAuth Fable 5.1 replay. Runtime OAuth/quota state is stored in `anthropic-auth-state.json`; sticky session assignments are stored separately in `anthropic-auth-routing-state.json` with SHA-256-hashed session IDs.
 
 ## Commands
 
@@ -77,10 +87,13 @@ The sidecar uses the same JSON shape as the OpenCode package, including `routing
 /claude-routing sticky-balanced
 /claude-routing reset
 
+/claude-account
+/claude-account reset-backoff
+
 /claude-quota
 ```
 
-`/claude-quota` reports sidecar OAuth fallback quota state from `~/.pi/agent/anthropic-auth.json`. `/claude-routing fallback-first` prefers usable OAuth fallback accounts before the main account; `/claude-routing main-first` restores the default. `/claude-routing sticky-balanced` assigns each Pi session to an OAuth account according to current 5-hour, 7-day, and matching model-scoped quota headroom, then persists that assignment across transient failures and process restarts. `/claude-routing reset` clears the current Pi session's assignment. Direct Opus sessions prefer usable accounts whose Fable quota is exhausted. API-key routes use the same sidecar shape as OpenCode and are sent directly to their configured Anthropic-compatible base URL, such as Kie's `https://api.kie.ai/claude`, but Pi only uses them after the main OAuth model response reports HTTP 429 or a streaming rate-limit error and a live quota check confirms 0% remaining. `/claude-cachekeep always` keeps active hybrid caches warm while Pi remains open; `/claude-cachekeep HH-HH` limits prewarms to a local time window. Both send `max_tokens: 0` pre-warm requests about five minutes before the 1-hour TTL expires. Running `/claude-cachekeep` without arguments lists live tracked sessions across Pi processes through a temporary lease registry that stores only session IDs and cache timing. `/claude-fast on` adds Anthropic `speed: "fast"` plus the `fast-mode-2026-02-01` beta header for supported Opus models (`claude-opus-4-6`, `claude-opus-4-7`, `claude-opus-4-8`, and `claude-opus-5`).
+`/claude-account reset-backoff` clears the main OAuth refresh backoff and its matching quota backoff. Persisted refresh backoffs are bound to the refresh token that produced them, so replacing a rejected credential immediately escapes its stale latch. `/claude-quota` reports sidecar OAuth fallback quota state from `~/.pi/agent/anthropic-auth.json`. `/claude-routing fallback-first` prefers usable OAuth fallback accounts before the main account; `/claude-routing main-first` restores the default. `/claude-routing sticky-balanced` assigns each Pi session to an OAuth account according to current 5-hour, 7-day, and matching model-scoped quota headroom, then persists that assignment across transient failures and process restarts. Changing the session model discards the old assignment before quota-based reselection. `/claude-routing reset` clears the current Pi session's assignment. Direct Opus sessions prefer usable accounts whose Fable quota is exhausted. API-key routes use the same sidecar shape as OpenCode and are sent directly to their configured Anthropic-compatible base URL, such as Kie's `https://api.kie.ai/claude`, but Pi only uses them after the main OAuth model response reports HTTP 429 or a streaming rate-limit error and a live quota check confirms 0% remaining. `/claude-cachekeep always` keeps active hybrid caches warm while Pi remains open; `/claude-cachekeep HH-HH` limits prewarms to a local time window. Both send `max_tokens: 0` pre-warm requests about five minutes before the 1-hour TTL expires. Running `/claude-cachekeep` without arguments lists live tracked sessions across Pi processes through a temporary lease registry that stores only session IDs and cache timing. `/claude-fast on` adds Anthropic `speed: "fast"` plus the `fast-mode-2026-02-01` beta header for supported Opus models (`claude-opus-4-6`, `claude-opus-4-7`, `claude-opus-4-8`, `claude-opus-5`, and `claude-opus-5-5`).
 
 ### Claude quota window priming
 
@@ -92,6 +105,10 @@ Prime marker identities live in `anthropic-auth-state.json`. Plugin-owned refres
 
 Pi's `/claude-prime` command displays status only. The `on` and `off` arguments are ignored; toggling priming requires OpenCode.
 
+## Anthropic-compatible proxy overrides
+
+API-key fallback routes honor `ANTHROPIC_CUSTOM_HEADERS`, `ANTHROPIC_MODEL`, and `ANTHROPIC_DEFAULT_{SONNET,OPUS,HAIKU,FABLE}_MODEL`. These variables never alter OAuth requests. Custom headers may add proxy metadata but cannot replace route authentication, Anthropic protocol headers, body framing, or internal correlation headers; a configuration containing an invalid or protected header is ignored as a whole. Versioned provider base paths are preserved without duplicating `/v1`.
+
 ## Relay
 
 The Pi package can use the same user-owned Cloudflare relay config as the OpenCode package. The relay setup helper currently lives in the OpenCode package CLI:

package/dist/commands.d.ts

@@ -1,2 +1,3 @@
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
-export declare function registerCommands(pi: ExtensionAPI): void;
+import type { PiCustodyCommands } from './custody.ts';
+export declare function registerCommands(pi: ExtensionAPI, custody?: PiCustodyCommands): void;

package/dist/commands.js

@@ -1,10 +1,10 @@
-import { buildClaudeQuotaSummary, buildFallbackQuotaSummaries, buildPrimeAccountStatuses, CLAUDE_ACCOUNT_COMMAND_NAME, CLAUDE_CACHE_KEEP_COMMAND_NAME, CLAUDE_PRIME_COMMAND_NAME, CLAUDE_ROUTING_COMMAND_NAME, createEmptyStorage, executeAccountCommand, executeCache1hCommand, executeCacheKeepCommand, executeDumpCommand, executeFastModeCommand, executeLoggingCommand, executePrimeCommand, executeRoutingCommand, getCache1hPersistentMode, getCacheKeepWindow, getPersistedLogLevel, getRoutingMode, isCache1hPersistentlyEnabled, isCacheKeepAlways, isCacheKeepHybridActive, isCacheKeepPersistentlyEnabled, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, isPrimePersistentlyEnabled, loadAccounts, parseCache1hCommandAction, parseCacheKeepCommandAction, parseDumpCommandAction, parseFastModeCommandAction, parseLoggingCommandAction, parseRoutingCommandAction, removeAccountPersistent, reorderAccountsPersistent, setAccountEnabledPersistent, setCache1hPersistentEnabled, setCache1hPersistentMode, setCacheKeepPersistentAlways, setCacheKeepPersistentEnabled, setCacheKeepPersistentWindow, setCacheKeepSubagentsEnabled, setDumpEnabled, setDumpPersistentEnabled, setFastModePersistentEnabled, setLogLevelPersistent, setRoutingMode, } from '@cortexkit/anthropic-auth-core';
+import { buildClaudeQuotaSummary, buildFallbackQuotaSummaries, buildPrimeAccountStatuses, CLAUDE_ACCOUNT_COMMAND_NAME, CLAUDE_CACHE_KEEP_COMMAND_NAME, CLAUDE_PRIME_COMMAND_NAME, CLAUDE_ROUTING_COMMAND_NAME, createEmptyStorage, detectClaustrumConnection, executeAccountCommand, executeCache1hCommand, executeCacheKeepCommand, executeDumpCommand, executeFastModeCommand, executeLoggingCommand, executePrimeCommand, executeRoutingCommand, formatEnrollmentStatus, getCache1hPersistentMode, getCacheKeepWindow, getClaustrumMode, getPersistedLogLevel, getRoutingMode, isCache1hPersistentlyEnabled, isCacheKeepAlways, isCacheKeepHybridActive, isCacheKeepPersistentlyEnabled, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, isPrimePersistentlyEnabled, loadAccounts, mergeMainQuotaErrorClearedAt, mergeMainRefreshErrorClearedAt, parseAccountCommandAction, parseCache1hCommandAction, parseCacheKeepCommandAction, parseDumpCommandAction, parseFastModeCommandAction, parseLoggingCommandAction, parseRoutingCommandAction, removeAccountPersistent, reorderAccountsPersistent, saveAccountState, setAccountEnabledPersistent, setCache1hPersistentEnabled, setCache1hPersistentMode, setCacheKeepPersistentAlways, setCacheKeepPersistentEnabled, setCacheKeepPersistentWindow, setCacheKeepSubagentsEnabled, setDumpEnabled, setDumpPersistentEnabled, setFastModePersistentEnabled, setLogLevelPersistent, setRoutingMode, } from '@cortexkit/anthropic-auth-core';
 import { getPiAccountStoragePath } from './paths.js';
 import { clearPiStickyRoutingSession, getPiTrackedCacheKeepSessions, } from './stream.js';
 function notify(ctx, message, kind = 'info') {
     ctx.ui.notify(message, kind);
 }
-export function registerCommands(pi) {
+export function registerCommands(pi, custody) {
     pi.registerCommand('claude-cache', {
         description: 'Show or configure Claude 1-hour prompt cache mode',
         handler: async (args, ctx) => {
@@ -152,12 +152,30 @@ export function registerCommands(pi) {
         handler: async (args, ctx) => {
             const path = getPiAccountStoragePath();
             const storage = await loadAccounts(path);
-            const result = executeAccountCommand({
+            const action = parseAccountCommandAction(args ?? '');
+            const result = await executeAccountCommand({
                 argumentsText: args ?? '',
                 storage: storage ?? createEmptyStorage(),
+                path,
+                transition: custody?.transition ??
+                    (async () => ({
+                        text: 'Refused: Pi custody controller is unavailable.',
+                    })),
+                resetEnrollment: custody?.reset,
+                claustrum: action.type === 'status'
+                    ? await detectClaustrumConnection()
+                    : undefined,
             });
+            if (action.type === 'status' && custody) {
+                try {
+                    result.text += `\n${formatEnrollmentStatus(await custody.status(), getClaustrumMode(storage) === 'claustrum').join('\n')}`;
+                }
+                catch {
+                    result.text += '\n- Enrollment: unavailable';
+                }
+            }
             if (!result.updated) {
-                notify(ctx, result.text);
+                notify(ctx, result.text, result.text.startsWith('Refused:') ? 'error' : 'info');
                 return;
             }
             // Wire persistent mutations via core helpers
@@ -181,6 +199,29 @@ export function registerCommands(pi) {
                     await reorderAccountsPersistent(newOrder, path);
                 }
             }
+            else if (mutationAction === 'reset-backoff') {
+                const nextStorage = storage ?? createEmptyStorage();
+                nextStorage.refresh = nextStorage.refresh ?? {};
+                nextStorage.refresh.mainLastRefreshError = undefined;
+                nextStorage.refresh.mainRefreshErrorClearedAt =
+                    mergeMainRefreshErrorClearedAt(nextStorage.refresh.mainRefreshErrorClearedAt, Date.now());
+                const mainIdentity = nextStorage.mainAccountId;
+                const quotaError = nextStorage.quota?.mainLastQuotaApiError;
+                if (!quotaError?.accountIdentity ||
+                    !mainIdentity ||
+                    quotaError.accountIdentity === mainIdentity) {
+                    nextStorage.quota = nextStorage.quota ?? {};
+                    nextStorage.quota.mainLastQuotaApiError = undefined;
+                    const nextQuotaErrorGeneration = (nextStorage.quota.mainQuotaErrorGeneration ?? 0) + 1;
+                    nextStorage.quota.mainQuotaErrorGeneration = Math.max(nextStorage.quota.mainQuotaErrorGeneration ?? 0, nextQuotaErrorGeneration);
+                    nextStorage.quota.mainQuotaErrorClearedAt =
+                        mergeMainQuotaErrorClearedAt(nextStorage.quota.mainQuotaErrorClearedAt, Date.now());
+                }
+                await saveAccountState(nextStorage, path, {
+                    mainRefresh: true,
+                    mainQuota: true,
+                });
+            }
             notify(ctx, result.text);
         },
     });

package/dist/convert.d.ts

@@ -1,4 +1,4 @@
-import { type Cache1hMode, type ClaudeCodeIdentity } from '@cortexkit/anthropic-auth-core';
+import { type Cache1hMode, type ClaudeCodeIdentity, type MidConversationEffortTransition, type ThinkingPrefixMismatchBehavior } from '@cortexkit/anthropic-auth-core';
 import type { Context, SimpleStreamOptions, Tool } from '@earendil-works/pi-ai';
 export type AnthropicRequestBody = {
     model: string;
@@ -19,6 +19,7 @@ export type AnthropicRequestBody = {
     };
     cache_control?: {
         type: 'ephemeral';
+        ttl?: '1h';
     };
     speed?: 'fast';
 };
@@ -26,7 +27,10 @@ export declare function fromClaudeCodeToolName(name: string, tools?: Tool[]): st
 export declare function buildAnthropicRequest(modelId: string, context: Context, options: SimpleStreamOptions | undefined, cache: {
     enabled: boolean;
     mode: Cache1hMode;
-}, fastModeEnabled?: boolean, identity?: ClaudeCodeIdentity): Promise<{
+}, fastModeEnabled?: boolean, identity?: ClaudeCodeIdentity, controls?: {
+    effortTransitions?: readonly MidConversationEffortTransition[];
+    thinkingPrefixMismatchBehavior?: ThinkingPrefixMismatchBehavior;
+}): Promise<{
     body: AnthropicRequestBody;
     bodyText: string;
 }>;

package/dist/convert.js

@@ -1,8 +1,10 @@
-import { applyClaudeCodeMetadata, buildBillingHeaderValue, CLAUDE_CODE_ENTRYPOINT, CLAUDE_CODE_IDENTITY, CLAUDE_FABLE_MYTHOS_5_SUMMARIZED_THINKING, CLAUDE_OPUS_5_ADAPTIVE_THINKING, CLAUDE_SONNET_5_ADAPTIVE_THINKING, isClaudeFableOrMythos5Model, isClaudeOpus5Model, isClaudeSonnet5Model, isFastModeSupportedModel, isOpenAIReasoningSignature, orderClaudeCodeBody, signRequestBody, } from '@cortexkit/anthropic-auth-core';
+import { applyClaudeCodeMetadata, applyMidConversationOutputConfig, applyThinkingBindingControls, buildBillingHeaderValue, CLAUDE_CODE_ENTRYPOINT, CLAUDE_CODE_IDENTITY, CLAUDE_FABLE_MYTHOS_5_SUMMARIZED_THINKING, CLAUDE_OPUS_5_5_ADAPTIVE_THINKING, CLAUDE_OPUS_5_ADAPTIVE_THINKING, CLAUDE_SONNET_5_ADAPTIVE_THINKING, ClaudeCodeFirstUserTextTracker, isClaudeFableOrMythos5Model, isClaudeOpus5Model, isClaudeOpus55Model, isClaudeSonnet5Model, isFastModeSupportedModel, isOpenAIReasoningSignature, orderClaudeCodeBody, signRequestBody, } from '@cortexkit/anthropic-auth-core';
+import { collapseSystemMessages, getCurrentSystemPrompt, getCurrentTools, normalizeContext, } from '@earendil-works/pi-ai';
 // Anchor identifying Pi's documentation paragraph — the only part of the prompt
 // that Anthropic currently rejects in system[]. Unknown prompt shapes take the
 // service-preserving fallback below instead of returning the full prompt there.
 const PI_DOCS_ANCHOR = 'Pi documentation';
+const firstUserTextTracker = new ClaudeCodeFirstUserTextTracker();
 const ANTHROPIC_REPLAY_APIS = new Set([
     'anthropic-messages',
     'cortexkit-anthropic-messages',
@@ -291,6 +293,49 @@ function addEphemeralCacheControl(body) {
         break;
     }
 }
+/**
+ * Flatten a host system prompt to text.
+ *
+ * Pi types `Context.systemPrompt` as `string`, but Oh My Pi 18.x types it as
+ * `string[]` — "ordered system prompt blocks" — and hands that array to the
+ * provider unflattened, where `.trim()` is not a function and no request was
+ * ever built (issue #201).
+ *
+ * Blocks join on a blank line, which is how the host's own providers flatten
+ * them (`normalizeSystemPrompts(prompt).join('\n\n')`), so the paragraph split
+ * below classifies the same text on either host. The host asks providers to
+ * preserve its entries as distinct blocks, and that is deliberately not done
+ * here: an unrecognized prompt shape is carried in messages[] precisely because
+ * placing the host prompt in top-level system[] is the request shape Anthropic
+ * rejects with 400 "You're out of extra usage" (see splitPiSystemPrompt).
+ * Joining loses no text and no paragraph boundary; re-emitting the entries as
+ * system[] blocks would reintroduce that rejection.
+ *
+ * Only a `{ type: 'text', text }` block is read. The host declares strings, so
+ * that branch is for the next drift in this same field: returning '' there
+ * would silently ship requests with no host prompt at all, which is worse than
+ * the crash this replaces. `type` is checked rather than reading any object's
+ * `text` field, so a tool, image, or other structured block never has its
+ * metadata flattened into the prompt.
+ */
+function systemPromptText(prompt) {
+    if (typeof prompt === 'string')
+        return prompt;
+    if (!Array.isArray(prompt))
+        return '';
+    const parts = [];
+    for (const block of prompt) {
+        if (typeof block === 'string') {
+            parts.push(block);
+            continue;
+        }
+        const record = block;
+        if (record?.type === 'text' && typeof record.text === 'string') {
+            parts.push(record.text);
+        }
+    }
+    return parts.join('\n\n');
+}
 function splitPiSystemPrompt(prompt) {
     const sanitized = sanitize(prompt);
     const paragraphs = sanitized.split(/\n\n+/);
@@ -323,35 +368,83 @@ function prependCachedPromptBlock(messages, text) {
         firstUser.content.unshift(promptBlock);
     }
 }
+/**
+ * Visit every object that can legitimately hold an Anthropic cache breakpoint:
+ * the request root, each `system[]` block, each tool, and each message with its
+ * content blocks — exactly where addEphemeralCacheControl and
+ * prependCachedPromptBlock place them.
+ *
+ * Deliberately not a deep walk. A tool's `input_schema` and a replayed
+ * `tool_use.input` are arbitrary caller data, so a nested field named
+ * `cache_control` there is a tool parameter or argument, not a breakpoint:
+ * deleting it or writing `ttl` into it would corrupt the tool contract.
+ */
+function walkCacheControlHolders(body, visit) {
+    const holders = [body];
+    if (body.system)
+        holders.push(...body.system);
+    if (body.tools)
+        holders.push(...body.tools);
+    for (const message of body.messages) {
+        holders.push(message);
+        if (Array.isArray(message.content))
+            holders.push(...message.content);
+    }
+    for (const holder of holders) {
+        if (!holder || typeof holder !== 'object')
+            continue;
+        const record = holder;
+        const cacheControl = record.cache_control;
+        if (cacheControl && typeof cacheControl === 'object')
+            visit(record);
+    }
+}
+/**
+ * Anthropic accepts at most four cache breakpoints per request. This provider
+ * composes its own body and has already placed exactly four
+ * (addEphemeralCacheControl's last tool, last system block and last user block,
+ * plus the cached prompt block on the first user message), so the top-level
+ * control this used to add on top of them made five cache_control sites in one
+ * body — the shape behind "A maximum of 4 blocks with cache_control may be
+ * provided. Found 5." on a request that never reached the model (issue #201).
+ *
+ * Each mode now places its own breakpoints and nothing else, as the OpenCode
+ * rewrite path does (`applyAutomaticCache1h` / `applyHybridCache1h` both clear
+ * every breakpoint first):
+ * - `automatic`: the top-level control alone, at 1h.
+ * - `hybrid`: the four block breakpoints extended to 1h, no top-level control.
+ *   That is the placement OpenCode's hybrid anchors reconstruct by hand and
+ *   this converter emits natively.
+ * - `explicit`: the same four breakpoints, TTL only.
+ */
 function applyCacheMode(body, enabled, mode) {
     if (!enabled)
         return;
     if (mode === 'automatic') {
-        body.cache_control = { type: 'ephemeral' };
+        walkCacheControlHolders(body, (holder) => {
+            delete holder.cache_control;
+        });
+        body.cache_control = { type: 'ephemeral', ttl: '1h' };
         return;
     }
-    const addTtl = (value) => {
-        if (!value || typeof value !== 'object')
-            return;
-        if (Array.isArray(value)) {
-            for (const item of value)
-                addTtl(item);
-            return;
-        }
-        const record = value;
-        const cacheControl = record.cache_control;
-        if (cacheControl && typeof cacheControl === 'object') {
-            ;
-            cacheControl.ttl = '1h';
-        }
-        for (const child of Object.values(record))
-            addTtl(child);
-    };
-    if (mode === 'hybrid')
-        body.cache_control = { type: 'ephemeral' };
-    addTtl(body);
+    walkCacheControlHolders(body, (holder) => {
+        ;
+        holder.cache_control.ttl = '1h';
+    });
 }
-export async function buildAnthropicRequest(modelId, context, options, cache, fastModeEnabled = false, identity) {
+export async function buildAnthropicRequest(modelId, context, options, cache, fastModeEnabled = false, identity, controls = {}) {
+    // Pi 0.86 passes a normalized transcript to providers. Resolve instructions,
+    // named sections and tool changes through its own replay helpers; raw host
+    // prompts (including ordered OMP blocks) still enter through normalization.
+    const transcript = collapseSystemMessages(normalizeContext({
+        ...context,
+        systemPrompt: systemPromptText(context.systemPrompt),
+    }));
+    context = {
+        messages: transcript.messages,
+        systemPrompt: getCurrentSystemPrompt(transcript.messages),
+        tools: getCurrentTools(transcript.messages),
+    };
     const messages = convertMessages(context.messages, modelId);
     // Strip trailing assistant messages — Anthropic rejects prefill on some models
     while (messages.length &&
@@ -361,11 +454,14 @@ export async function buildAnthropicRequest(modelId, context, options, cache, fa
     const system = [
         {
             type: 'text',
-            text: buildBillingHeaderValue(messages, undefined, CLAUDE_CODE_ENTRYPOINT),
+            text: buildBillingHeaderValue(messages, undefined, CLAUDE_CODE_ENTRYPOINT, options?.sessionId
+                ? firstUserTextTracker.resolve(options.sessionId, messages)
+                : undefined),
         },
         { type: 'text', text: CLAUDE_CODE_IDENTITY },
     ];
-    if (context.systemPrompt?.trim()) {
+    const systemPrompt = systemPromptText(context.systemPrompt);
+    if (systemPrompt.trim()) {
         // Pi's prompt cannot sit whole in the top-level system[] array: two lines of
         // its documentation paragraph (the docs/*.md enumeration and the "follow .md
         // cross-references" instruction) are each independently sufficient to make
@@ -390,7 +486,7 @@ export async function buildAnthropicRequest(modelId, context, options, cache, fa
         // cache_control is set explicitly because addEphemeralCacheControl's
         // message-level breakpoint only fires for array content on the *last* user
         // message, which is not this one after the first turn.
-        const prompt = splitPiSystemPrompt(context.systemPrompt);
+        const prompt = splitPiSystemPrompt(systemPrompt);
         if (prompt.systemText) {
             system.push({ type: 'text', text: prompt.systemText });
         }
@@ -412,7 +508,8 @@ export async function buildAnthropicRequest(modelId, context, options, cache, fa
     const isFableOrMythos5 = isClaudeFableOrMythos5Model(modelId);
     const isSonnet5 = isClaudeSonnet5Model(modelId);
     const isOpus5 = isClaudeOpus5Model(modelId);
-    // Sonnet 5 and Opus 5 share Fable/Mythos's adaptive-summarized contract: make
+    const isOpus55 = isClaudeOpus55Model(modelId);
+    // Sonnet 5, Opus 5, and Opus 5.5 share Fable/Mythos's adaptive-summarized contract: make
     // adaptive thinking visible (display defaults to "omitted") and map reasoning
     // to output_config effort. Pi's typed options cannot express
     // thinking-disabled, so there is no disable case here (see transform.ts for
@@ -425,11 +522,14 @@ export async function buildAnthropicRequest(modelId, context, options, cache, fa
     else if (isSonnet5) {
         body.thinking = { ...CLAUDE_SONNET_5_ADAPTIVE_THINKING };
     }
+    else if (isOpus55) {
+        body.thinking = { ...CLAUDE_OPUS_5_5_ADAPTIVE_THINKING };
+    }
     else if (isOpus5) {
         body.thinking = { ...CLAUDE_OPUS_5_ADAPTIVE_THINKING };
     }
     if (options?.reasoning) {
-        if (isFableOrMythos5 || isSonnet5 || isOpus5) {
+        if (isFableOrMythos5 || isSonnet5 || isOpus5 || isOpus55) {
             body.output_config = { effort: options.reasoning };
         }
         else {
@@ -448,10 +548,13 @@ export async function buildAnthropicRequest(modelId, context, options, cache, fa
             };
         }
     }
+    applyMidConversationOutputConfig(body, controls.effortTransitions ?? []);
     addEphemeralCacheControl(body);
     applyCacheMode(body, cache.enabled, cache.mode);
-    if (identity)
+    if (identity) {
+        applyThinkingBindingControls(body, controls.thinkingPrefixMismatchBehavior ?? 'account-default');
         applyClaudeCodeMetadata(body, identity);
+    }
     const unsigned = JSON.stringify(orderClaudeCodeBody(body));
     const bodyText = await signRequestBody(unsigned);
     return { body, bodyText };

package/dist/custody.d.ts

@@ -0,0 +1,17 @@
+import { type AccountCommandResult, type ClaustrumEnrollmentStatus, type ClaustrumMode, type ClaustrumScopedClient } from '@cortexkit/anthropic-auth-core';
+export declare function requirePiEnrollment(): Promise<{
+    state: 'approved';
+    proposedName: string;
+    approvedName?: string;
+    tokenGeneration: number;
+}>;
+export interface PiCustodyCommands {
+    transition(mode: ClaustrumMode): Promise<AccountCommandResult>;
+    status(): Promise<ClaustrumEnrollmentStatus>;
+    reset(): Promise<AccountCommandResult>;
+}
+export declare function createPiCustodyCommands(options: {
+    reconfigure: () => Promise<void>;
+    storagePath?: string;
+    connect?: () => Promise<ClaustrumScopedClient>;
+}): PiCustodyCommands;

package/dist/custody.js

@@ -0,0 +1,66 @@
+import { CLAUSTRUM_PI_ENROLLMENT_NAME, ClaustrumScopedCustody, connectClaustrumScopedClient, getHostClaustrumEnrollmentPaths, readClaustrumEnrollmentStatus, resetClaustrumEnrollmentState, setClaustrumModePersistent, } from '@cortexkit/anthropic-auth-core';
+import { getPiAccountStoragePath, getPiClaustrumConnectionOptions, hasPiLocalAnthropicOAuth, } from './paths.js';
+export async function requirePiEnrollment() {
+    const status = await readClaustrumEnrollmentStatus(getHostClaustrumEnrollmentPaths('pi'), CLAUSTRUM_PI_ENROLLMENT_NAME);
+    if (status.state !== 'approved' ||
+        status.proposedName !== CLAUSTRUM_PI_ENROLLMENT_NAME) {
+        throw new Error('Pi requires its own approved Claustrum enrollment; run setup');
+    }
+    return status;
+}
+export function createPiCustodyCommands(options) {
+    const storagePath = options.storagePath ?? getPiAccountStoragePath();
+    const paths = () => getHostClaustrumEnrollmentPaths('pi');
+    return {
+        status: () => readClaustrumEnrollmentStatus(paths(), CLAUSTRUM_PI_ENROLLMENT_NAME),
+        async reset() {
+            const result = await resetClaustrumEnrollmentState(paths(), CLAUSTRUM_PI_ENROLLMENT_NAME);
+            const messages = {
+                reset: 'Terminal enrollment state cleared. Run setup to enroll Pi again.',
+                idle: 'Pi has no enrollment state to reset.',
+                'refused-pending': 'Refused: Pi enrollment is still pending.',
+                'refused-approved': 'Refused: Pi already has an approved enrollment token.',
+                busy: 'Pi enrollment is busy in another process.',
+            };
+            return { text: messages[result] };
+        },
+        async transition(mode) {
+            if (mode === 'claustrum') {
+                if (await hasPiLocalAnthropicOAuth()) {
+                    return {
+                        text: 'Refused: Pi still has a local Anthropic OAuth credential. Run `bunx @cortexkit/opencode-anthropic-auth setup` to approve its removal and enable Claustrum.',
+                    };
+                }
+                // A slash command never invokes the administrative CLI or approves itself.
+                // Existing enrollment and grants must be verified before committing mode.
+                await requirePiEnrollment();
+                const client = await (options.connect?.() ??
+                    connectClaustrumScopedClient(getPiClaustrumConnectionOptions(storagePath)));
+                const custody = new ClaustrumScopedCustody({
+                    client,
+                    tokenPath: paths().tokenPath,
+                });
+                try {
+                    const inventory = await custody.discover();
+                    const active = inventory.accounts.filter((account) => account.state === 'active');
+                    if (!active.length)
+                        return {
+                            text: 'Refused: Claustrum has no accessible active Anthropic accounts.',
+                        };
+                    for (const account of active)
+                        await custody.authorize(account);
+                }
+                finally {
+                    custody.close();
+                }
+            }
+            await setClaustrumModePersistent(mode, storagePath);
+            await options.reconfigure();
+            return {
+                text: mode === 'claustrum'
+                    ? 'Pi now uses Claustrum for Anthropic authentication.'
+                    : 'Pi now uses local Anthropic authentication. Use /login anthropic if needed.',
+            };
+        },
+    };
+}

package/dist/effort-history.d.ts

@@ -0,0 +1,27 @@
+import { type MidConversationEffortTransition } from '@cortexkit/anthropic-auth-core';
+type SessionEntryLike = {
+    id?: unknown;
+    type?: unknown;
+    thinkingLevel?: unknown;
+    firstKeptEntryId?: unknown;
+    message?: {
+        role?: unknown;
+    };
+};
+/**
+ * Reproduce the host's context-entry view — the entries the next request will
+ * actually carry — from the branch path, ordered root to leaf.
+ *
+ * `SessionManager.buildContextEntries()` computes this on Pi hosts but does not
+ * exist on Oh My Pi 18.x, where calling it threw on every turn (issue #200).
+ * `getBranch()` is present on both hosts and is the same path that method walks,
+ * so the compaction trim is applied here instead of asking the host for it.
+ *
+ * A branch without compaction is already the context. After a compaction the
+ * context is the compaction entry, then the tail retained from
+ * `firstKeptEntryId`, then everything appended after the compaction.
+ */
+export declare function deriveContextEntries<Entry extends SessionEntryLike>(branch: readonly Entry[]): Entry[];
+/** Build Pi's active, compaction-aware Fable 5.1 effort timeline. */
+export declare function collectPiEffortHistory(contextEntries: readonly SessionEntryLike[], fullBranch: readonly SessionEntryLike[]): MidConversationEffortTransition[];
+export {};

package/dist/effort-history.js

@@ -0,0 +1,103 @@
+import { normalizeAdaptiveEffort, } from '@cortexkit/anthropic-auth-core';
+/**
+ * Reproduce the host's context-entry view — the entries the next request will
+ * actually carry — from the branch path, ordered root to leaf.
+ *
+ * `SessionManager.buildContextEntries()` computes this on Pi hosts but does not
+ * exist on Oh My Pi 18.x, where calling it threw on every turn (issue #200).
+ * `getBranch()` is present on both hosts and is the same path that method walks,
+ * so the compaction trim is applied here instead of asking the host for it.
+ *
+ * A branch without compaction is already the context. After a compaction the
+ * context is the compaction entry, then the tail retained from
+ * `firstKeptEntryId`, then everything appended after the compaction.
+ */
+export function deriveContextEntries(branch) {
+    let compactionIndex = -1;
+    for (let index = 0; index < branch.length; index++) {
+        if (branch[index]?.type === 'compaction')
+            compactionIndex = index;
+    }
+    const compaction = branch[compactionIndex];
+    if (!compaction)
+        return branch.slice();
+    const contextEntries = [compaction];
+    let retaining = false;
+    for (let index = 0; index < compactionIndex; index++) {
+        const entry = branch[index];
+        if (!entry)
+            continue;
+        if (entry.id === compaction.firstKeptEntryId)
+            retaining = true;
+        if (retaining)
+            contextEntries.push(entry);
+    }
+    for (let index = compactionIndex + 1; index < branch.length; index++) {
+        const entry = branch[index];
+        if (entry)
+            contextEntries.push(entry);
+    }
+    return contextEntries;
+}
+function entryRole(entry) {
+    if (entry.type === 'compaction' || entry.type === 'branch_summary') {
+        return 'user';
+    }
+    if (entry.type === 'custom_message')
+        return 'user';
+    return entry.type === 'message' ? entry.message?.role : undefined;
+}
+function appendTransition(transitions, afterAssistantMessages, effort) {
+    const previous = transitions.at(-1);
+    if (previous?.effort === effort)
+        return;
+    if (previous?.afterAssistantMessages === afterAssistantMessages) {
+        previous.effort = effort;
+        return;
+    }
+    transitions.push({ afterAssistantMessages, effort });
+}
+/** Build Pi's active, compaction-aware Fable 5.1 effort timeline. */
+export function collectPiEffortHistory(contextEntries, fullBranch) {
+    let activeEffort = 'high';
+    let assistantMessages = 0;
+    const transitions = [];
+    const first = contextEntries[0];
+    const compactionIndex = first?.type === 'compaction'
+        ? fullBranch.findIndex((entry) => entry.id === first.id)
+        : -1;
+    if (compactionIndex >= 0) {
+        for (let index = 0; index <= compactionIndex; index++) {
+            const entry = fullBranch[index];
+            if (entry?.type !== 'thinking_level_change')
+                continue;
+            activeEffort = normalizeAdaptiveEffort(entry.thinkingLevel) ?? 'high';
+        }
+        appendTransition(transitions, 0, activeEffort);
+    }
+    const branchIndexById = new Map(fullBranch.map((entry, index) => [entry.id, index]));
+    for (const entry of contextEntries) {
+        if (entry === first && entry.type === 'compaction')
+            continue;
+        const branchIndex = branchIndexById.get(entry.id);
+        const retainedBeforeCompaction = compactionIndex >= 0 &&
+            typeof branchIndex === 'number' &&
+            branchIndex < compactionIndex;
+        if (entry.type === 'thinking_level_change') {
+            if (!retainedBeforeCompaction) {
+                activeEffort = normalizeAdaptiveEffort(entry.thinkingLevel) ?? 'high';
+            }
+            continue;
+        }
+        const role = entryRole(entry);
+        if (role === 'assistant') {
+            assistantMessages++;
+        }
+        else if (role === 'user' ||
+            role === 'toolResult' ||
+            role === 'tool_result') {
+            appendTransition(transitions, assistantMessages, activeEffort);
+        }
+    }
+    return transitions;
+}

package/dist/index.d.ts

@@ -1,2 +1,6 @@
+import { type ClaustrumScopedClient } from '@cortexkit/anthropic-auth-core';
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
-export default function cortexKitPiAnthropicAuth(pi: ExtensionAPI): void;
+export default function cortexKitPiAnthropicAuth(pi: ExtensionAPI, options?: {
+    connectScoped?: () => Promise<ClaustrumScopedClient>;
+    pollIntervalMs?: number;
+}): Promise<void>;