@cortexkit/pi-anthropic-auth 1.21.0 → 1.23.0

package/dist/index.js

@@ -1,7 +1,17 @@
-import { authorize, CLAUDE_FABLE_MYTHOS_5_CONTEXT_WINDOW, CLAUDE_FABLE_MYTHOS_5_MAX_OUTPUT_TOKENS, CLAUDE_FABLE_MYTHOS_5_MODEL_SPECS, CLAUDE_FABLE_MYTHOS_5_PRICING, exchange, refreshClaudeOAuthToken, } from '@cortexkit/anthropic-auth-core';
+import { authorize, CLAUDE_FABLE_MYTHOS_5_1_PRICING, CLAUDE_FABLE_MYTHOS_5_CONTEXT_WINDOW, CLAUDE_FABLE_MYTHOS_5_MAX_OUTPUT_TOKENS, CLAUDE_FABLE_MYTHOS_5_MODEL_SPECS, CLAUDE_FABLE_MYTHOS_5_PRICING, exchange, getClaustrumMode, isClaudeFableOrMythos51Model, loadAccounts, refreshClaudeOAuthToken, } from '@cortexkit/anthropic-auth-core';
 import { registerCommands } from './commands.js';
-import { streamCortexKitAnthropic } from './stream.js';
+import { createPiCustodyCommands, requirePiEnrollment } from './custody.js';
+import { collectPiEffortHistory, deriveContextEntries, } from './effort-history.js';
+import { getPiAccountStoragePath } from './paths.js';
+import { closePiScopedRuntime, getPiScopedRuntime, streamCortexKitAnthropic, } from './stream.js';
+async function assertLocalAuthentication() {
+    if (getClaustrumMode(await loadAccounts(getPiAccountStoragePath())) ===
+        'claustrum') {
+        throw new Error('Local Anthropic login and refresh are disabled while Claustrum custody is active');
+    }
+}
 async function loginAnthropic(callbacks) {
+    await assertLocalAuthentication();
     const auth = await authorize('max');
     callbacks.onAuth({ url: auth.url });
     const callback = await callbacks.onPrompt({
@@ -11,6 +21,7 @@ async function loginAnthropic(callbacks) {
     if (result.type !== 'success') {
         throw new Error('Anthropic OAuth exchange failed');
     }
+    await assertLocalAuthentication();
     return {
         refresh: result.refresh,
         access: result.access,
@@ -21,6 +32,7 @@ function textImageInput() {
     return ['text', 'image'];
 }
 async function refreshAnthropicToken(credentials) {
+    await assertLocalAuthentication();
     const refreshed = await refreshClaudeOAuthToken({
         refreshToken: credentials.refresh,
     });
@@ -30,27 +42,85 @@ async function refreshAnthropicToken(credentials) {
         expires: refreshed.expires,
     };
 }
-export default function cortexKitPiAnthropicAuth(pi) {
-    registerCommands(pi);
-    pi.registerProvider('anthropic', {
+export default async function cortexKitPiAnthropicAuth(pi, options = {}) {
+    const storagePath = getPiAccountStoragePath();
+    registerCommands(pi, createPiCustodyCommands({
+        storagePath,
+        reconfigure: configureProvider,
+        connect: options.connectScoped,
+    }));
+    const effortHistoryBySession = new Map();
+    pi.on('turn_start', async (_event, ctx) => {
+        const sessionId = ctx.sessionManager.getSessionId();
+        if (!sessionId)
+            return;
+        // This hook only adds mid-conversation effort markers to Fable/Mythos 5.1
+        // requests. A host whose session entries do not match what this reads must
+        // cost the session its transitions and nothing else: the handler runs
+        // before every turn, and an exception here surfaced as a per-turn extension
+        // error while collecting no effort history at all (issue #200).
+        //
+        // The catch stays quiet: `ExtensionAPI` carries no log surface on either
+        // host, and writing to stdout from a per-turn hook corrupts the host's
+        // rendering — which is the same per-turn noise this fix removes. The
+        // degraded state is observable in the request: no effort markers.
+        let transitions;
+        try {
+            const branch = ctx.sessionManager.getBranch();
+            transitions = collectPiEffortHistory(deriveContextEntries(branch), branch);
+        }
+        catch {
+            transitions = [];
+        }
+        effortHistoryBySession.delete(sessionId);
+        effortHistoryBySession.set(sessionId, transitions);
+        while (effortHistoryBySession.size > 128) {
+            const oldest = effortHistoryBySession.keys().next().value;
+            if (oldest)
+                effortHistoryBySession.delete(oldest);
+            else
+                break;
+        }
+    });
+    pi.on('session_shutdown', async (_event, ctx) => {
+        const sessionId = ctx.sessionManager.getSessionId();
+        if (sessionId)
+            effortHistoryBySession.delete(sessionId);
+        closePiScopedRuntime(storagePath);
+    });
+    const configuration = {
         name: 'Anthropic (CortexKit OAuth)',
         baseUrl: 'https://api.anthropic.com',
         api: 'cortexkit-anthropic-messages',
         models: [
-            ...Object.values(CLAUDE_FABLE_MYTHOS_5_MODEL_SPECS).map((model) => ({
-                id: model.id,
-                name: model.name,
+            ...Object.values(CLAUDE_FABLE_MYTHOS_5_MODEL_SPECS).map((model) => {
+                const pricing = isClaudeFableOrMythos51Model(model.id)
+                    ? CLAUDE_FABLE_MYTHOS_5_1_PRICING
+                    : CLAUDE_FABLE_MYTHOS_5_PRICING;
+                return {
+                    id: model.id,
+                    name: model.name,
+                    reasoning: true,
+                    input: textImageInput(),
+                    cost: {
+                        input: pricing.input,
+                        output: pricing.output,
+                        cacheRead: pricing.cacheRead,
+                        cacheWrite: pricing.cacheWrite5m,
+                    },
+                    contextWindow: CLAUDE_FABLE_MYTHOS_5_CONTEXT_WINDOW,
+                    maxTokens: CLAUDE_FABLE_MYTHOS_5_MAX_OUTPUT_TOKENS,
+                };
+            }),
+            {
+                id: 'claude-opus-5-5',
+                name: 'Claude Opus 5.5',
                 reasoning: true,
                 input: textImageInput(),
-                cost: {
-                    input: CLAUDE_FABLE_MYTHOS_5_PRICING.input,
-                    output: CLAUDE_FABLE_MYTHOS_5_PRICING.output,
-                    cacheRead: CLAUDE_FABLE_MYTHOS_5_PRICING.cacheRead,
-                    cacheWrite: CLAUDE_FABLE_MYTHOS_5_PRICING.cacheWrite5m,
-                },
-                contextWindow: CLAUDE_FABLE_MYTHOS_5_CONTEXT_WINDOW,
-                maxTokens: CLAUDE_FABLE_MYTHOS_5_MAX_OUTPUT_TOKENS,
-            })),
+                cost: { input: 4, output: 20, cacheRead: 0.2, cacheWrite: 8 },
+                contextWindow: 1_000_000,
+                maxTokens: 128_000,
+            },
             {
                 id: 'claude-opus-5',
                 name: 'Claude Opus 5',
@@ -103,6 +173,60 @@ export default function cortexKitPiAnthropicAuth(pi) {
             refreshToken: refreshAnthropicToken,
             getApiKey: (credentials) => credentials.access,
         },
-        streamSimple: streamCortexKitAnthropic,
-    });
+        streamSimple: (model, context, options) => streamCortexKitAnthropic(model, context, options, options?.sessionId
+            ? effortHistoryBySession.get(options.sessionId)
+            : undefined),
+    };
+    async function configureProvider() {
+        if (getClaustrumMode(await loadAccounts(storagePath)) !== 'claustrum') {
+            closePiScopedRuntime(storagePath);
+            pi.registerProvider('anthropic', configuration);
+            return;
+        }
+        const streamSimple = configuration.streamSimple;
+        if (!streamSimple)
+            throw new Error('Anthropic stream implementation is unavailable');
+        const configured = async () => {
+            if (getClaustrumMode(await loadAccounts(storagePath)) !== 'claustrum')
+                return false;
+            await requirePiEnrollment();
+            return true;
+        };
+        const provider = {
+            id: 'anthropic',
+            name: 'Anthropic (Claustrum)',
+            baseUrl: 'https://api.anthropic.com',
+            auth: {
+                // Native ambient auth avoids fake keys and local OAuth refresh. Pi refuses
+                // a leftover stored OAuth credential because this provider has no OAuth
+                // handler; setup must obtain consent before removing that local entry.
+                apiKey: {
+                    name: 'Claustrum',
+                    check: async () => (await configured())
+                        ? { type: 'api_key', source: 'Claustrum' }
+                        : undefined,
+                    resolve: async () => (await configured())
+                        ? { auth: {}, source: 'Claustrum' }
+                        : undefined,
+                },
+            },
+            getModels: () => (configuration.models ?? []).map((model) => ({
+                ...model,
+                provider: 'anthropic',
+                api: model.api ?? 'cortexkit-anthropic-messages',
+                baseUrl: model.baseUrl ?? 'https://api.anthropic.com',
+            })),
+            // Preserve the legacy provider's simplified option surface for raw calls.
+            stream: (model, context, options) => streamSimple(model, context, options),
+            streamSimple,
+        };
+        pi.registerProvider(provider);
+        getPiScopedRuntime(storagePath, {
+            ...(options.connectScoped && { connect: options.connectScoped }),
+            ...(options.pollIntervalMs !== undefined && {
+                pollIntervalMs: options.pollIntervalMs,
+            }),
+        }).start();
+    }
+    await configureProvider();
 }

package/dist/paths.d.ts

@@ -1,2 +1,13 @@
 export declare function getPiConfigDir(): string;
 export declare function getPiAccountStoragePath(): string;
+export declare function getPiClaustrumConnectionOptions(storagePath?: string): {
+    storagePath: string;
+    identity: {
+        project_root: string;
+        harness: string;
+        session: string;
+    };
+    connectionFile: string | undefined;
+};
+/** Read-only metadata inspection; never create or rewrite Pi's credential store. */
+export declare function hasPiLocalAnthropicOAuth(): Promise<boolean>;

package/dist/paths.js

@@ -1,10 +1,50 @@
+import { readFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { ACCOUNT_FILE_NAME } from '@cortexkit/anthropic-auth-core';
+import { ACCOUNT_FILE_NAME, parseJsonRedacted, primeStorageFingerprint, } from '@cortexkit/anthropic-auth-core';
 export function getPiConfigDir() {
-    return process.env.PI_AGENT_DIR?.trim() || join(homedir(), '.pi', 'agent');
+    return (process.env.PI_CODING_AGENT_DIR?.trim() ||
+        process.env.PI_AGENT_DIR?.trim() ||
+        join(homedir(), '.pi', 'agent'));
 }
 export function getPiAccountStoragePath() {
     return (process.env.PI_ANTHROPIC_AUTH_FILE?.trim() ||
         join(getPiConfigDir(), ACCOUNT_FILE_NAME));
 }
+export function getPiClaustrumConnectionOptions(storagePath = getPiAccountStoragePath()) {
+    return {
+        storagePath,
+        identity: {
+            project_root: process.cwd(),
+            harness: 'pi',
+            session: `store-${primeStorageFingerprint(storagePath)}`,
+        },
+        connectionFile: process.env.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE?.trim() ||
+            process.env.CLAUSTRUM_SUBC_CONNECTION?.trim() ||
+            undefined,
+    };
+}
+/** Read-only metadata inspection; never create or rewrite Pi's credential store. */
+export async function hasPiLocalAnthropicOAuth() {
+    try {
+        const value = parseJsonRedacted(await readFile(join(getPiConfigDir(), 'auth.json'), 'utf8'));
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw new Error('Invalid authentication store');
+        const credential = value.anthropic;
+        if (credential === undefined)
+            return false;
+        if (!credential ||
+            typeof credential !== 'object' ||
+            Array.isArray(credential))
+            throw new Error('Invalid Anthropic authentication entry');
+        const type = credential.type;
+        if (type !== 'oauth' && type !== 'api_key')
+            throw new Error('Unknown Anthropic authentication entry');
+        return type === 'oauth';
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw new Error('Cannot safely inspect Pi authentication metadata');
+    }
+}

package/dist/stream.d.ts

@@ -1,5 +1,7 @@
-import { type ApiKeyAccount } from '@cortexkit/anthropic-auth-core';
+import { type ApiKeyAccount, ClaustrumScopedRuntime, type ClaustrumScopedRuntimeOptions, type MidConversationEffortTransition } from '@cortexkit/anthropic-auth-core';
 import { type Api, type AssistantMessageEventStream, type Context, type Model, type SimpleStreamOptions } from '@earendil-works/pi-ai';
+export declare function getPiScopedRuntime(storagePath?: string, overrides?: Partial<Pick<ClaustrumScopedRuntimeOptions, 'connect' | 'pollIntervalMs' | 'setTimeoutImpl' | 'clearTimeoutImpl'>>): ClaustrumScopedRuntime;
+export declare function closePiScopedRuntime(storagePath?: string): void;
 export declare function clearPiStickyRoutingSession(storagePath: string, sessionId: string): Promise<void>;
 export declare function getPiTrackedCacheKeepSessions(): Promise<import("@cortexkit/anthropic-auth-core").CacheKeepTrackedSession[]>;
 type AnthropicEvent = {
@@ -16,5 +18,5 @@ export declare function buildExplicitBaseMessagesUrl(baseURL: string): URL;
 export declare function configureApiRouteHeaders(account: ApiKeyAccount, fastMode: boolean): Headers;
 export declare function parseSse(response: Response): AsyncGenerator<AnthropicEvent>;
 export declare function primaryResponseAllowsApiFallback(preflight: Response | string): boolean;
-export declare function streamCortexKitAnthropic(model: Model<Api>, context: Context, options?: SimpleStreamOptions): AssistantMessageEventStream;
+export declare function streamCortexKitAnthropic(model: Model<Api>, context: Context, options?: SimpleStreamOptions, effortTransitions?: readonly MidConversationEffortTransition[]): AssistantMessageEventStream;
 export {};