@cortexkit/pi-anthropic-auth 1.22.0 → 1.23.0

package/dist/paths.d.ts

@@ -1,2 +1,13 @@
 export declare function getPiConfigDir(): string;
 export declare function getPiAccountStoragePath(): string;
+export declare function getPiClaustrumConnectionOptions(storagePath?: string): {
+    storagePath: string;
+    identity: {
+        project_root: string;
+        harness: string;
+        session: string;
+    };
+    connectionFile: string | undefined;
+};
+/** Read-only metadata inspection; never create or rewrite Pi's credential store. */
+export declare function hasPiLocalAnthropicOAuth(): Promise<boolean>;

package/dist/paths.js

@@ -1,10 +1,50 @@
+import { readFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { ACCOUNT_FILE_NAME } from '@cortexkit/anthropic-auth-core';
+import { ACCOUNT_FILE_NAME, parseJsonRedacted, primeStorageFingerprint, } from '@cortexkit/anthropic-auth-core';
 export function getPiConfigDir() {
-    return process.env.PI_AGENT_DIR?.trim() || join(homedir(), '.pi', 'agent');
+    return (process.env.PI_CODING_AGENT_DIR?.trim() ||
+        process.env.PI_AGENT_DIR?.trim() ||
+        join(homedir(), '.pi', 'agent'));
 }
 export function getPiAccountStoragePath() {
     return (process.env.PI_ANTHROPIC_AUTH_FILE?.trim() ||
         join(getPiConfigDir(), ACCOUNT_FILE_NAME));
 }
+export function getPiClaustrumConnectionOptions(storagePath = getPiAccountStoragePath()) {
+    return {
+        storagePath,
+        identity: {
+            project_root: process.cwd(),
+            harness: 'pi',
+            session: `store-${primeStorageFingerprint(storagePath)}`,
+        },
+        connectionFile: process.env.PI_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE?.trim() ||
+            process.env.CLAUSTRUM_SUBC_CONNECTION?.trim() ||
+            undefined,
+    };
+}
+/** Read-only metadata inspection; never create or rewrite Pi's credential store. */
+export async function hasPiLocalAnthropicOAuth() {
+    try {
+        const value = parseJsonRedacted(await readFile(join(getPiConfigDir(), 'auth.json'), 'utf8'));
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw new Error('Invalid authentication store');
+        const credential = value.anthropic;
+        if (credential === undefined)
+            return false;
+        if (!credential ||
+            typeof credential !== 'object' ||
+            Array.isArray(credential))
+            throw new Error('Invalid Anthropic authentication entry');
+        const type = credential.type;
+        if (type !== 'oauth' && type !== 'api_key')
+            throw new Error('Unknown Anthropic authentication entry');
+        return type === 'oauth';
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw new Error('Cannot safely inspect Pi authentication metadata');
+    }
+}

package/dist/stream.d.ts

@@ -1,5 +1,7 @@
-import { type ApiKeyAccount, type MidConversationEffortTransition } from '@cortexkit/anthropic-auth-core';
+import { type ApiKeyAccount, ClaustrumScopedRuntime, type ClaustrumScopedRuntimeOptions, type MidConversationEffortTransition } from '@cortexkit/anthropic-auth-core';
 import { type Api, type AssistantMessageEventStream, type Context, type Model, type SimpleStreamOptions } from '@earendil-works/pi-ai';
+export declare function getPiScopedRuntime(storagePath?: string, overrides?: Partial<Pick<ClaustrumScopedRuntimeOptions, 'connect' | 'pollIntervalMs' | 'setTimeoutImpl' | 'clearTimeoutImpl'>>): ClaustrumScopedRuntime;
+export declare function closePiScopedRuntime(storagePath?: string): void;
 export declare function clearPiStickyRoutingSession(storagePath: string, sessionId: string): Promise<void>;
 export declare function getPiTrackedCacheKeepSessions(): Promise<import("@cortexkit/anthropic-auth-core").CacheKeepTrackedSession[]>;
 type AnthropicEvent = {

package/dist/stream.js

@@ -1,7 +1,8 @@
-import { applyClaudeCodeHeaders, CACHE_KEEP_EXTENDED_TTL_BETA, CacheKeepManager, CacheKeepSessionRegistry, createStickyNoRouteResponse, decideStickyQuotaFailure, dumpDirectRequest, FAST_MODE_BETA, FallbackAccountManager, getCache1hPersistentMode, getDefaultCacheKeepRegistryDirectory, getFallbackReauthLabels, getOrCreateMainAccountId, getRelayConfig, getRoutingMode, getStickyRoutingStatePath, getThinkingPrefixMismatchBehavior, hasThinkingBindingControls, isApiKeyAccount, isCache1hPersistentlyEnabled, isCacheKeepHybridActive, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, isKillswitchEnabled, isOAuthAccount, isPermanentRefreshError, isValidApiBaseURL, killswitchPassesPolicy, loadAccounts, MID_CONVERSATION_OUTPUT_CONFIG_BETA, mergeAnthropicBetas, QuotaManager, quotaSnapshotHasStandardWindows, quotaSnapshotModelScopeIsExhausted, quotaSnapshotPassesModelScope, quotaSnapshotPassesPolicy, refreshBackoffActive, resolveClaudeCodeIdentity, STICKY_ROUTING_MAIN_ACCOUNT_ID, StickySessionRouter, sendViaRelay, setDumpEnabled, shouldFallbackStatus, stickyQuotaSnapshotIsFresh, stickyRetryAfterWithJitter, stickyRouteFamilyForModel, THINKING_BINDING_CONTROLS_BETA, tokenFingerprint, usesMidConversationOutputConfig, } from '@cortexkit/anthropic-auth-core';
+import { applyClaudeCodeHeaders, applyCustomHeaders, CACHE_KEEP_EXTENDED_TTL_BETA, CacheKeepManager, CacheKeepSessionRegistry, ClaustrumScopedRuntime, connectClaustrumScopedClient, createStickyNoRouteResponse, decideStickyQuotaFailure, dumpDirectRequest, FAST_MODE_BETA, FallbackAccountManager, fetchOAuthQuotaSnapshot, getCache1hPersistentMode, getClaudeCodeIdentityForVerifiedAccount, getClaustrumMode, getDefaultCacheKeepRegistryDirectory, getFallbackReauthLabels, getHostClaustrumEnrollmentPaths, getOrCreateMainAccountId, getQuotaCheckIntervalMs, getRelayConfig, getRoutingMode, getScopedQuotaWindowForModel, getStickyRoutingStatePath, getThinkingPrefixMismatchBehavior, hasThinkingBindingControls, isApiKeyAccount, isCache1hPersistentlyEnabled, isCacheKeepHybridActive, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, isKillswitchEnabled, isOAuthAccount, isPermanentRefreshError, isValidApiBaseURL, killswitchPassesPolicy, loadAccounts, logger, MID_CONVERSATION_OUTPUT_CONFIG_BETA, mergeAnthropicBetas, QuotaManager, quotaSnapshotHasStandardWindows, quotaSnapshotModelScopeIsExhausted, quotaSnapshotPassesModelScope, quotaSnapshotPassesPolicy, refreshBackoffActive, resolveClaudeCodeIdentity, STICKY_ROUTING_MAIN_ACCOUNT_ID, StickySessionRouter, sendViaRelay, setDumpEnabled, shouldFallbackStatus, stickyQuotaSnapshotIsFresh, stickyRetryAfterWithJitter, stickyRouteFamilyForModel, THINKING_BINDING_CONTROLS_BETA, tokenFingerprint, usesMidConversationOutputConfig, } from '@cortexkit/anthropic-auth-core';
 import { calculateCost, createAssistantMessageEventStream, } from '@earendil-works/pi-ai';
 import { buildAnthropicRequest, fromClaudeCodeToolName } from './convert.js';
-import { getPiAccountStoragePath } from './paths.js';
+import { requirePiEnrollment } from './custody.js';
+import { getPiAccountStoragePath, getPiClaustrumConnectionOptions, } from './paths.js';
 function errorText(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -12,6 +13,46 @@ const quotaManagers = new Map();
 const fallbackManagers = new Map();
 const mainAccountIdInitializations = new Map();
 const PI_SERVICE_CACHE_LIMIT = 16;
+const scopedRuntimes = new Map();
+export function getPiScopedRuntime(storagePath = getPiAccountStoragePath(), overrides = {}) {
+    const existing = scopedRuntimes.get(storagePath);
+    if (existing)
+        return existing;
+    let warned = false;
+    const { connect, ...runtimeOverrides } = overrides;
+    const runtime = new ClaustrumScopedRuntime({
+        storagePath,
+        tokenPath: getHostClaustrumEnrollmentPaths('pi').tokenPath,
+        connect: async () => {
+            await requirePiEnrollment();
+            return connect
+                ? connect()
+                : connectClaustrumScopedClient(getPiClaustrumConnectionOptions(storagePath));
+        },
+        onRoster: () => {
+            warned = false;
+        },
+        onError: () => {
+            if (!warned)
+                logger.warn('claustrum', 'Pi scoped credential service unavailable');
+            warned = true;
+        },
+        ...runtimeOverrides,
+    });
+    while (scopedRuntimes.size >= PI_SERVICE_CACHE_LIMIT) {
+        const oldest = scopedRuntimes.keys().next().value;
+        if (oldest === undefined)
+            break;
+        scopedRuntimes.get(oldest)?.close();
+        scopedRuntimes.delete(oldest);
+    }
+    scopedRuntimes.set(storagePath, runtime);
+    return runtime;
+}
+export function closePiScopedRuntime(storagePath = getPiAccountStoragePath()) {
+    scopedRuntimes.get(storagePath)?.close();
+    scopedRuntimes.delete(storagePath);
+}
 function setBoundedService(map, key, value) {
     map.delete(key);
     map.set(key, value);
@@ -39,10 +80,38 @@ function getPiRoutingServices(storagePath, storage) {
     let quotaManager = quotaManagers.get(storagePath);
     let fallbackManager = fallbackManagers.get(storagePath);
     if (!quotaManager || !fallbackManager) {
-        quotaManager = new QuotaManager({ storage });
+        quotaManager = new QuotaManager({
+            storage,
+            fetchQuotaSnapshot: async (request) => {
+                const current = await loadAccounts(storagePath);
+                if (getClaustrumMode(current) === 'claustrum') {
+                    const id = request.kind === 'main' ? 'main' : request.accountId;
+                    if (!id)
+                        throw new Error('Claustrum quota request has no account identity');
+                    return getPiScopedRuntime(storagePath).fetchQuota(id);
+                }
+                if (!request.accessToken)
+                    throw new Error('Missing local OAuth quota credential');
+                return fetchOAuthQuotaSnapshot({ accessToken: request.accessToken });
+            },
+        });
         fallbackManager = new FallbackAccountManager({
             configPath: storagePath,
             quotaManager,
+            isFallbackAccountVaultEnabled: (_id, current) => getClaustrumMode(current) === 'claustrum',
+            isFallbackAccountVaultServed: (id, current) => {
+                const account = current.accounts.find((candidate) => candidate.id === id);
+                return (getClaustrumMode(current) === 'claustrum' &&
+                    Boolean(account &&
+                        isOAuthAccount(account) &&
+                        account.claustrumScopedCredentialId &&
+                        account.claustrumScopedState === 'active'));
+            },
+            resolveFallbackAccessToken: (account, current) => getClaustrumMode(current) === 'claustrum'
+                ? undefined
+                : account.access
+                    ? { token: account.access, source: 'sidecar' }
+                    : undefined,
         });
         setBoundedService(quotaManagers, storagePath, quotaManager);
         setBoundedService(fallbackManagers, storagePath, fallbackManager);
@@ -74,18 +143,50 @@ function getPiCacheKeepRegistry() {
     }
     return cacheKeepRegistry;
 }
+const scopedPrewarmAttempts = new Map();
 const cacheKeepManager = new CacheKeepManager({
     loadStorage: () => loadAccounts(getPiAccountStoragePath()),
     onTrackedSessionsChanged: (sessions) => getPiCacheKeepRegistry().publish(sessions),
-    prepareHeaders: async (headers, target) => {
+    prepareHeaders: async (headers, target, attempt) => {
+        const storagePath = target.accountStoragePath ?? getPiAccountStoragePath();
+        const current = await loadAccounts(storagePath);
+        if (target.accountStoragePath && !current)
+            return undefined;
+        if (getClaustrumMode(current) === 'claustrum') {
+            const runtime = getPiScopedRuntime(storagePath);
+            const id = target.oauthAccountId ?? STICKY_ROUTING_MAIN_ACCOUNT_ID;
+            const receipt = await runtime.authorize(id, attempt.signal);
+            if (!target.oauthAccountIdentity ||
+                receipt.accountId !== target.oauthAccountIdentity) {
+                throw new Error('CacheKeep account identity changed');
+            }
+            const body = JSON.parse(target.bodyText);
+            const identity = getClaudeCodeIdentityForVerifiedAccount(id === STICKY_ROUTING_MAIN_ACCOUNT_ID
+                ? (current?.mainAccountId ?? id)
+                : id, receipt.accountId);
+            headers.delete('anthropic-beta');
+            applyClaudeCodeHeaders(headers, receipt.accessToken, {
+                body,
+                identity,
+                extraBetas: [
+                    CACHE_KEEP_EXTENDED_TTL_BETA,
+                    ...(hasThinkingBindingControls(body)
+                        ? [THINKING_BINDING_CONTROLS_BETA]
+                        : []),
+                ],
+            });
+            if (body.speed === 'fast')
+                headers.set('anthropic-beta', mergeAnthropicBetas(headers.get('anthropic-beta'), [FAST_MODE_BETA]));
+            scopedPrewarmAttempts.set(attempt.id, { runtime, receipt });
+            return headers;
+        }
         const authorization = headers.get('authorization') ?? '';
         const match = /^Bearer\s+(.+)$/i.exec(authorization);
         const accessToken = match?.[1];
         if (!accessToken)
-            return headers;
+            return undefined;
         try {
             const body = JSON.parse(target.bodyText);
-            const storagePath = getPiAccountStoragePath();
             await ensurePiMainAccountId(storagePath);
             const storage = await loadAccounts(storagePath);
             const identity = await resolveClaudeCodeIdentity(accessToken, typeof body.model === 'string' ? body.model : undefined, target.oauthAccountId ?? storage?.mainAccountId);
@@ -109,6 +210,14 @@ const cacheKeepManager = new CacheKeepManager({
         }
         return headers;
     },
+    onResponse: async ({ attempt, status }) => {
+        const entry = scopedPrewarmAttempts.get(attempt.id);
+        if (entry)
+            await entry.runtime.reportFailure(entry.receipt, status, 'direct');
+    },
+    onComplete: ({ attempt }) => {
+        scopedPrewarmAttempts.delete(attempt.id);
+    },
 });
 export async function getPiTrackedCacheKeepSessions() {
     return getPiCacheKeepRegistry().list(cacheKeepManager.trackedSessions());
@@ -164,7 +273,16 @@ function updateUsage(model, output, usage) {
 }
 export function buildExplicitBaseMessagesUrl(baseURL) {
     const url = new URL(baseURL);
-    url.pathname = `${url.pathname.replace(/\/$/, '')}/v1/messages`;
+    const basePath = url.pathname.replace(/\/$/, '');
+    if (/\/v\d[^/]*\/messages$/.test(basePath)) {
+        url.pathname = basePath;
+    }
+    else if (/\/v\d[^/]*$/.test(basePath)) {
+        url.pathname = `${basePath}/messages`;
+    }
+    else {
+        url.pathname = `${basePath}/v1/messages`;
+    }
     url.searchParams.set('beta', 'true');
     return url;
 }
@@ -183,6 +301,7 @@ export function configureApiRouteHeaders(account, fastMode) {
     if (fastMode) {
         headers.set('anthropic-beta', mergeAnthropicBetas(headers.get('anthropic-beta'), [FAST_MODE_BETA]));
     }
+    applyCustomHeaders(headers);
     return headers;
 }
 export async function* parseSse(response) {
@@ -230,9 +349,24 @@ async function sendAnthropicRequest(options) {
     const accountIdentity = options.oauthAccountId === STICKY_ROUTING_MAIN_ACCOUNT_ID
         ? storage?.mainAccountId
         : options.oauthAccountId;
-    const identity = options.accessToken
-        ? await resolveClaudeCodeIdentity(options.accessToken, options.model.id, accountIdentity)
+    const scoped = !options.apiAccount && getClaustrumMode(storage) === 'claustrum'
+        ? getPiScopedRuntime(options.storagePath)
         : undefined;
+    const routeId = options.oauthAccountId ?? STICKY_ROUTING_MAIN_ACCOUNT_ID;
+    const roster = scoped
+        ? (scoped.snapshot() ?? (await scoped.refresh()))
+        : undefined;
+    const verifiedUuid = routeId === STICKY_ROUTING_MAIN_ACCOUNT_ID
+        ? roster?.primary?.accountId
+        : roster?.accounts.find((account) => account.id === routeId)
+            ?.anthropicAccountUuid;
+    if (scoped && !verifiedUuid)
+        throw new Error('Claustrum route has no verified provider identity');
+    const identity = scoped && verifiedUuid
+        ? getClaudeCodeIdentityForVerifiedAccount(accountIdentity ?? routeId, verifiedUuid)
+        : options.accessToken
+            ? await resolveClaudeCodeIdentity(options.accessToken, options.model.id, accountIdentity)
+            : undefined;
     const { body, bodyText } = await buildAnthropicRequest(options.model.id, options.context, options.streamOptions, {
         enabled: isCache1hPersistentlyEnabled(storage),
         mode: getCache1hPersistentMode(storage),
@@ -245,7 +379,7 @@ async function sendAnthropicRequest(options) {
     const fastMode = body.speed === 'fast';
     const headers = options.apiAccount
         ? configureApiRouteHeaders(options.apiAccount, fastMode)
-        : applyClaudeCodeHeaders(new Headers(), options.accessToken ?? '', {
+        : applyClaudeCodeHeaders(new Headers(), scoped ? '' : (options.accessToken ?? ''), {
             body,
             identity,
             extraBetas: [
@@ -276,12 +410,31 @@ async function sendAnthropicRequest(options) {
         headers,
         bodyText,
         storage,
-        cacheMode: isCacheKeepHybridActive(storage) ? 'hybrid' : 'disabled',
+        cacheMode: !options.apiAccount && isCacheKeepHybridActive(storage)
+            ? 'hybrid'
+            : 'disabled',
         oauthAccountId: options.oauthAccountId,
+        oauthAccountIdentity: verifiedUuid ?? identity?.accountUuid,
+        accountStoragePath: options.storagePath,
     });
+    const report = async (attempt, status, source) => {
+        if (!scoped || status !== 401)
+            return;
+        await scoped.reportFailure(attempt, status, source).catch(() => {
+            logger.warn('claustrum', 'Pi scoped auth-failure report unavailable');
+        });
+    };
     const directFetch = async () => {
+        // Every physical attempt, including relay-to-direct fallback, is authorized.
+        const attempt = scoped
+            ? await scoped.authorize(routeId, options.streamOptions?.signal)
+            : undefined;
+        if (attempt)
+            headers.set('authorization', `Bearer ${attempt.accessToken}`);
         try {
             const response = await fetch(input, init);
+            if (attempt)
+                await report(attempt, response.status, 'direct');
             await dumpDirectRequest({
                 affinity: relayAffinity,
                 route: options.route ??
@@ -318,6 +471,19 @@ async function sendAnthropicRequest(options) {
         body: bodyText,
         fallback: directFetch,
         affinity: relayAffinity,
+        authorizeAttempt: scoped
+            ? async () => {
+                const attempt = await scoped.authorize(routeId, options.streamOptions?.signal);
+                const authorizedHeaders = new Headers(headers);
+                authorizedHeaders.set('authorization', `Bearer ${attempt.accessToken}`);
+                return {
+                    headers: authorizedHeaders,
+                    onUpstreamStatus: (status) => {
+                        void report(attempt, status, 'relay_status_field');
+                    },
+                };
+            }
+            : undefined,
     });
 }
 function quotaSnapshotIsExhausted(quota) {
@@ -348,17 +514,62 @@ async function firstStreamingError(response) {
 }
 async function executeWithFallback(options) {
     await ensurePiMainAccountId(options.storagePath);
-    const storage = await loadAccounts(options.storagePath);
+    let storage = await loadAccounts(options.storagePath);
+    const scoped = getClaustrumMode(storage) === 'claustrum'
+        ? getPiScopedRuntime(options.storagePath)
+        : undefined;
+    let roster = scoped ? await scoped.refresh() : undefined;
+    if (scoped && !roster)
+        throw new Error('Claustrum custody changed during request preparation');
+    if (roster)
+        storage = roster.storage;
+    const primaryCredential = scoped ? '' : options.primaryAccessToken;
+    const scopedReady = (account) => Boolean(scoped &&
+        account.enabled !== false &&
+        account.claustrumScopedCredentialId &&
+        account.claustrumScopedState === 'active');
+    const primaryAvailable = () => !scoped ||
+        (roster?.primary?.state === 'active' &&
+            !storage?.claustrum?.disabledAccountIdentities?.includes(roster.primary.accountId));
     const { quotaManager, fallbackManager: manager } = getPiRoutingServices(options.storagePath, storage);
-    const mainAccountId = storage?.mainAccountId;
+    let mainAccountId = scoped
+        ? roster?.primary?.accountId
+        : storage?.mainAccountId;
     quotaManager.seedMainFromStorage(storage, mainAccountId);
     quotaManager.seedFallbacksFromAccounts((storage?.accounts ?? []).filter(isOAuthAccount));
+    function quotaObservationIsFresh(quota, modelId) {
+        if (stickyQuotaSnapshotIsFresh(quota, storage, Date.now(), modelId))
+            return true;
+        // A successful windowless usage response is not the same as a failed
+        // probe. Pi intentionally admits the former as unknown-capacity OAuth.
+        if (!quota ||
+            quota.five_hour ||
+            quota.seven_day ||
+            quota.source !== 'poll' ||
+            quota.checkedAt === undefined)
+            return false;
+        const age = getQuotaCheckIntervalMs(storage);
+        const scopedWindow = getScopedQuotaWindowForModel(quota, modelId);
+        return (Date.now() - quota.checkedAt < age &&
+            (!scopedWindow || Date.now() - scopedWindow.checkedAt < age));
+    }
     async function buildStickyRoutes(modelId) {
+        if (scoped) {
+            roster = await scoped.refresh();
+            if (!roster)
+                throw new Error('Claustrum custody changed during routing');
+            storage = roster.storage;
+            mainAccountId = roster.primary?.accountId;
+            quotaManager.updateStorage(storage);
+            quotaManager.seedMainFromStorage(storage, mainAccountId);
+            quotaManager.seedFallbacksFromAccounts(storage.accounts.filter(isOAuthAccount));
+        }
         const mainEntry = quotaManager.getMain(mainAccountId);
         let mainQuota = mainEntry?.quota;
-        if (!stickyQuotaSnapshotIsFresh(mainEntry?.quota, storage, Date.now(), modelId)) {
+        if (primaryAvailable() &&
+            !stickyQuotaSnapshotIsFresh(mainEntry?.quota, storage, Date.now(), modelId)) {
             try {
-                mainQuota = await quotaManager.refreshMain(mainAccountId, options.primaryAccessToken);
+                mainQuota = await quotaManager.refreshMain(mainAccountId, primaryCredential);
             }
             catch { }
         }
@@ -367,10 +578,12 @@ async function executeWithFallback(options) {
         });
         const usableById = new Map(usableFallbacks.map((account) => [account.id, account]));
         const allRoutes = [];
-        if (!isPermanentRefreshError(storage?.refresh?.mainLastRefreshError)) {
+        if (primaryAvailable() &&
+            (scoped ||
+                !isPermanentRefreshError(storage?.refresh?.mainLastRefreshError))) {
             allRoutes.push({
                 id: STICKY_ROUTING_MAIN_ACCOUNT_ID,
-                access: options.primaryAccessToken,
+                access: primaryCredential,
                 quota: mainQuota,
                 order: 0,
             });
@@ -379,18 +592,20 @@ async function executeWithFallback(options) {
             if (configured.enabled === false || !isOAuthAccount(configured))
                 continue;
             const account = usableById.get(configured.id) ?? configured;
-            if (!account.access || isPermanentRefreshError(account.lastRefreshError))
+            if (scoped
+                ? !scopedReady(account)
+                : !account.access || isPermanentRefreshError(account.lastRefreshError))
                 continue;
             let accountQuota = quotaManager.getFallback(account.id, account)?.quota ?? account.quota;
             if (!stickyQuotaSnapshotIsFresh(accountQuota, storage, Date.now(), modelId)) {
                 try {
-                    accountQuota = await quotaManager.refreshFallback(account.id, account.access, account);
+                    accountQuota = await quotaManager.refreshFallback(account.id, scoped ? '' : (account.access ?? ''), account);
                 }
                 catch { }
             }
             allRoutes.push({
                 id: account.id,
-                access: account.access,
+                access: scoped ? '' : (account.access ?? ''),
                 quota: accountQuota,
                 order: index + 1,
                 account,
@@ -400,7 +615,7 @@ async function executeWithFallback(options) {
             const refreshError = route.id === STICKY_ROUTING_MAIN_ACCOUNT_ID
                 ? storage?.refresh?.mainLastRefreshError
                 : route.account?.lastRefreshError;
-            if (isPermanentRefreshError(refreshError))
+            if (!scoped && isPermanentRefreshError(refreshError))
                 return [];
             if (stickyQuotaSnapshotIsFresh(route.quota, storage, Date.now(), modelId) &&
                 decideStickyQuotaFailure({ quota: route.quota, modelId }).action ===
@@ -443,8 +658,10 @@ async function executeWithFallback(options) {
         return { allRoutes, candidates, retainAccountIds };
     }
     async function primaryQuotaRefreshConfirmsExhausted() {
+        if (!primaryAvailable())
+            return false;
         try {
-            const quota = await quotaManager.refreshMain(mainAccountId, options.primaryAccessToken);
+            const quota = await quotaManager.refreshMain(mainAccountId, primaryCredential);
             const entry = quotaManager.getMain(mainAccountId);
             return Boolean(entry &&
                 entry.refreshAfter > Date.now() &&
@@ -455,8 +672,10 @@ async function executeWithFallback(options) {
         }
     }
     async function primaryQuotaRefreshConfirmsModelScopeExhausted() {
+        if (!primaryAvailable())
+            return false;
         try {
-            const quota = await quotaManager.refreshMain(mainAccountId, options.primaryAccessToken);
+            const quota = await quotaManager.refreshMain(mainAccountId, primaryCredential);
             const entry = quotaManager.getMain(mainAccountId);
             return Boolean(entry &&
                 entry.refreshAfter > Date.now() &&
@@ -467,11 +686,15 @@ async function executeWithFallback(options) {
         }
     }
     function primaryCachedModelScopeExhausted() {
+        if (!primaryAvailable())
+            return false;
         const entry = quotaManager.getMain(mainAccountId);
         return Boolean(entry &&
             quotaSnapshotModelScopeIsExhausted(entry.quota, options.model.id));
     }
     function primaryFreshModelScopeExhausted() {
+        if (!primaryAvailable())
+            return false;
         const entry = quotaManager.getMain(mainAccountId);
         return Boolean(entry &&
             !quotaManager.isMainStale(options.model.id) &&
@@ -483,17 +706,21 @@ async function executeWithFallback(options) {
         });
         const usableOAuthById = new Map(usableOAuth.map((account) => [account.id, account]));
         for (const configured of storage?.accounts ?? []) {
+            if (configured.enabled === false)
+                continue;
             let response = null;
             let account = isOAuthAccount(configured)
                 ? usableOAuthById.get(configured.id)
                 : configured;
             if (!account) {
                 if (!isOAuthAccount(configured) ||
-                    !configured.access ||
-                    (configured.expires !== undefined &&
-                        configured.expires <= Date.now()) ||
-                    isPermanentRefreshError(configured.lastRefreshError) ||
-                    refreshBackoffActive(configured.lastRefreshError, configured.id, Date.now(), tokenFingerprint(configured.refresh)))
+                    (scoped
+                        ? !scopedReady(configured)
+                        : !configured.access ||
+                            (configured.expires !== undefined &&
+                                configured.expires <= Date.now()) ||
+                            isPermanentRefreshError(configured.lastRefreshError) ||
+                            refreshBackoffActive(configured.lastRefreshError, configured.id, Date.now(), tokenFingerprint(configured.refresh))))
                     continue;
                 account = configured;
                 const quota = quotaManager.getFallback(configured.id, configured)?.quota ??
@@ -510,11 +737,12 @@ async function executeWithFallback(options) {
                 continue;
             }
             if (isOAuthAccount(account)) {
-                if (routeOptions.apiOnly === true || !account.access)
+                if (routeOptions.apiOnly === true ||
+                    (scoped ? !scopedReady(account) : !account.access))
                     continue;
                 response = await sendAnthropicRequest({
                     ...options,
-                    accessToken: account.access,
+                    accessToken: scoped ? undefined : account.access,
                     oauthAccountId: account.id,
                 });
             }
@@ -549,15 +777,19 @@ async function executeWithFallback(options) {
         const router = getPiStickyRouter(options.storagePath);
         const initialInputBytes = Math.max(1, Buffer.byteLength(JSON.stringify(options.context)));
         let routes = await buildStickyRoutes(options.model.id);
-        const mainPermanentlyUnavailable = isPermanentRefreshError(storage?.refresh?.mainLastRefreshError);
+        const mainPermanentlyUnavailable = scoped
+            ? !primaryAvailable()
+            : isPermanentRefreshError(storage?.refresh?.mainLastRefreshError);
         const incompleteQuotaPool = (routes.allRoutes.length === 0 && !mainPermanentlyUnavailable) ||
-            routes.allRoutes.some((candidate) => !candidate.quota ||
-                !stickyQuotaSnapshotIsFresh(candidate.quota, storage, Date.now(), options.model.id));
+            routes.allRoutes.some((candidate) => !quotaObservationIsFresh(candidate.quota, options.model.id));
         let resolution = await router.resolve({
             sessionId,
             family: stickyRouteFamilyForModel(options.model.id),
             modelId: options.model.id,
-            candidates: routes.candidates,
+            affinityModelId: options.model.id,
+            // Existing affinity can survive a transient probe failure, but an
+            // incomplete pool cannot create a new balanced assignment.
+            candidates: incompleteQuotaPool ? [] : routes.candidates,
             retainAccountIds: routes.retainAccountIds,
             storage,
             inputBytes: initialInputBytes,
@@ -572,7 +804,9 @@ async function executeWithFallback(options) {
         }
         if (!resolution) {
             return createStickyNoRouteResponse({
-                mainRefreshError: storage?.refresh?.mainLastRefreshError,
+                mainRefreshError: scoped
+                    ? undefined
+                    : storage?.refresh?.mainLastRefreshError,
                 fallbackReauthLabels: getFallbackReauthLabels(storage),
                 routeQuotas: routes.allRoutes.flatMap((route) => route.quota ? [route.quota] : []),
                 modelId: options.model.id,
@@ -619,11 +853,12 @@ async function executeWithFallback(options) {
             }
             let permanentAuthFailure = preflight instanceof Response &&
                 preflight.status === 401 &&
-                route.id === STICKY_ROUTING_MAIN_ACCOUNT_ID;
+                (Boolean(scoped) || route.id === STICKY_ROUTING_MAIN_ACCOUNT_ID);
             if (preflight instanceof Response &&
                 preflight.status === 401 &&
                 route.account &&
-                storage) {
+                storage &&
+                !scoped) {
                 const authRouteId = route.id;
                 try {
                     const refreshed = await manager.refreshAccount(route.account, storage, {
@@ -749,11 +984,24 @@ async function executeWithFallback(options) {
         if (fallback)
             return fallback;
     }
+    if (!primaryAvailable()) {
+        if (!fallbackFirst) {
+            const fallback = await tryFallbackAccounts();
+            if (fallback)
+                return fallback;
+        }
+        return createStickyNoRouteResponse({
+            routeQuotas: (storage?.accounts ?? [])
+                .filter(isOAuthAccount)
+                .flatMap((account) => (account.quota ? [account.quota] : [])),
+            modelId: options.model.id,
+        });
+    }
     if (isKillswitchEnabled(storage)) {
         let mainQuota = quotaManager.getMain(mainAccountId)?.quota;
         if (!mainQuota || quotaManager.isMainStale(options.model.id)) {
             try {
-                mainQuota = await quotaManager.refreshMain(mainAccountId, options.primaryAccessToken);
+                mainQuota = await quotaManager.refreshMain(mainAccountId, primaryCredential);
             }
             catch { }
         }
@@ -780,7 +1028,7 @@ async function executeWithFallback(options) {
     }
     const primary = await sendAnthropicRequest({
         ...options,
-        accessToken: options.primaryAccessToken,
+        accessToken: primaryCredential,
         oauthAccountId: STICKY_ROUTING_MAIN_ACCOUNT_ID,
     });
     const primaryPreflight = await firstStreamingError(primary);
@@ -812,9 +1060,10 @@ export function streamCortexKitAnthropic(model, context, options, effortTransiti
         stream.push({ type: 'start', partial: output });
         try {
             const accessToken = options?.apiKey ?? '';
-            if (!accessToken)
-                throw new Error('Missing Anthropic OAuth access token');
             const storagePath = getPiAccountStoragePath();
+            if (!accessToken &&
+                getClaustrumMode(await loadAccounts(storagePath)) !== 'claustrum')
+                throw new Error('Missing Anthropic OAuth access token');
             const response = await executeWithFallback({
                 model,
                 context,