@cortexkit/pi-anthropic-auth 1.22.0 → 2.0.0

package/dist/convert.js

@@ -1,4 +1,5 @@
-import { applyClaudeCodeMetadata, applyMidConversationOutputConfig, applyThinkingBindingControls, buildBillingHeaderValue, CLAUDE_CODE_ENTRYPOINT, CLAUDE_CODE_IDENTITY, CLAUDE_FABLE_MYTHOS_5_SUMMARIZED_THINKING, CLAUDE_OPUS_5_ADAPTIVE_THINKING, CLAUDE_SONNET_5_ADAPTIVE_THINKING, ClaudeCodeFirstUserTextTracker, isClaudeFableOrMythos5Model, isClaudeOpus5Model, isClaudeSonnet5Model, isFastModeSupportedModel, isOpenAIReasoningSignature, orderClaudeCodeBody, signRequestBody, } from '@cortexkit/anthropic-auth-core';
+import { applyClaudeCodeMetadata, applyMidConversationOutputConfig, applyThinkingBindingControls, assertNoMeaningfulTrailingAssistant, buildBillingHeaderValue, CLAUDE_CODE_ENTRYPOINT, CLAUDE_CODE_IDENTITY, CLAUDE_FABLE_MYTHOS_5_SUMMARIZED_THINKING, CLAUDE_HAIKU_5_5_ADAPTIVE_THINKING, CLAUDE_OPUS_5_5_ADAPTIVE_THINKING, CLAUDE_OPUS_5_ADAPTIVE_THINKING, CLAUDE_SONNET_5_5_ADAPTIVE_THINKING, CLAUDE_SONNET_5_ADAPTIVE_THINKING, ClaudeCodeFirstUserTextTracker, isClaudeFableOrMythos5Model, isClaudeHaiku55Model, isClaudeOpus5Model, isClaudeOpus55Model, isClaudeSonnet5Model, isClaudeSonnet55Model, isFastModeSupportedModel, isOpenAIReasoningSignature, orderClaudeCodeBody, signRequestBody, stripEmptyTrailingAssistantMessages, } from '@cortexkit/anthropic-auth-core';
+import { collapseSystemMessages, getCurrentSystemPrompt, getCurrentTools, normalizeContext, } from './transcript.js';
 // Anchor identifying Pi's documentation paragraph — the only part of the prompt
 // that Anthropic currently rejects in system[]. Unknown prompt shapes take the
 // service-preserving fallback below instead of returning the full prompt there.
@@ -292,6 +293,49 @@ function addEphemeralCacheControl(body) {
         break;
     }
 }
+/**
+ * Flatten a host system prompt to text.
+ *
+ * Pi types `Context.systemPrompt` as `string`, but Oh My Pi 18.x types it as
+ * `string[]` — "ordered system prompt blocks" — and hands that array to the
+ * provider unflattened, where `.trim()` is not a function and no request was
+ * ever built (issue #201).
+ *
+ * Blocks join on a blank line, which is how the host's own providers flatten
+ * them (`normalizeSystemPrompts(prompt).join('\n\n')`), so the paragraph split
+ * below classifies the same text on either host. The host asks providers to
+ * preserve its entries as distinct blocks, and that is deliberately not done
+ * here: an unrecognized prompt shape is carried in messages[] precisely because
+ * placing the host prompt in top-level system[] is the request shape Anthropic
+ * rejects with 400 "You're out of extra usage" (see splitPiSystemPrompt).
+ * Joining loses no text and no paragraph boundary; re-emitting the entries as
+ * system[] blocks would reintroduce that rejection.
+ *
+ * Only a `{ type: 'text', text }` block is read. The host declares strings, so
+ * that branch is for the next drift in this same field: returning '' there
+ * would silently ship requests with no host prompt at all, which is worse than
+ * the crash this replaces. `type` is checked rather than reading any object's
+ * `text` field, so a tool, image, or other structured block never has its
+ * metadata flattened into the prompt.
+ */
+function systemPromptText(prompt) {
+    if (typeof prompt === 'string')
+        return prompt;
+    if (!Array.isArray(prompt))
+        return '';
+    const parts = [];
+    for (const block of prompt) {
+        if (typeof block === 'string') {
+            parts.push(block);
+            continue;
+        }
+        const record = block;
+        if (record?.type === 'text' && typeof record.text === 'string') {
+            parts.push(record.text);
+        }
+    }
+    return parts.join('\n\n');
+}
 function splitPiSystemPrompt(prompt) {
     const sanitized = sanitize(prompt);
     const paragraphs = sanitized.split(/\n\n+/);
@@ -324,41 +368,90 @@ function prependCachedPromptBlock(messages, text) {
         firstUser.content.unshift(promptBlock);
     }
 }
+/**
+ * Visit every object that can legitimately hold an Anthropic cache breakpoint:
+ * the request root, each `system[]` block, each tool, and each message with its
+ * content blocks — exactly where addEphemeralCacheControl and
+ * prependCachedPromptBlock place them.
+ *
+ * Deliberately not a deep walk. A tool's `input_schema` and a replayed
+ * `tool_use.input` are arbitrary caller data, so a nested field named
+ * `cache_control` there is a tool parameter or argument, not a breakpoint:
+ * deleting it or writing `ttl` into it would corrupt the tool contract.
+ */
+function walkCacheControlHolders(body, visit) {
+    const holders = [body];
+    if (body.system)
+        holders.push(...body.system);
+    if (body.tools)
+        holders.push(...body.tools);
+    for (const message of body.messages) {
+        holders.push(message);
+        if (Array.isArray(message.content))
+            holders.push(...message.content);
+    }
+    for (const holder of holders) {
+        if (!holder || typeof holder !== 'object')
+            continue;
+        const record = holder;
+        const cacheControl = record.cache_control;
+        if (cacheControl && typeof cacheControl === 'object')
+            visit(record);
+    }
+}
+/**
+ * Anthropic accepts at most four cache breakpoints per request. This provider
+ * composes its own body and has already placed exactly four
+ * (addEphemeralCacheControl's last tool, last system block and last user block,
+ * plus the cached prompt block on the first user message), so the top-level
+ * control this used to add on top of them made five cache_control sites in one
+ * body — the shape behind "A maximum of 4 blocks with cache_control may be
+ * provided. Found 5." on a request that never reached the model (issue #201).
+ *
+ * Each mode now places its own breakpoints and nothing else, as the OpenCode
+ * rewrite path does (`applyAutomaticCache1h` / `applyHybridCache1h` both clear
+ * every breakpoint first):
+ * - `automatic`: the top-level control alone, at 1h.
+ * - `hybrid`: the four block breakpoints extended to 1h, no top-level control.
+ *   That is the placement OpenCode's hybrid anchors reconstruct by hand and
+ *   this converter emits natively.
+ * - `explicit`: the same four breakpoints, TTL only.
+ */
 function applyCacheMode(body, enabled, mode) {
     if (!enabled)
         return;
     if (mode === 'automatic') {
-        body.cache_control = { type: 'ephemeral' };
+        walkCacheControlHolders(body, (holder) => {
+            delete holder.cache_control;
+        });
+        body.cache_control = { type: 'ephemeral', ttl: '1h' };
         return;
     }
-    const addTtl = (value) => {
-        if (!value || typeof value !== 'object')
-            return;
-        if (Array.isArray(value)) {
-            for (const item of value)
-                addTtl(item);
-            return;
-        }
-        const record = value;
-        const cacheControl = record.cache_control;
-        if (cacheControl && typeof cacheControl === 'object') {
-            ;
-            cacheControl.ttl = '1h';
-        }
-        for (const child of Object.values(record))
-            addTtl(child);
-    };
-    if (mode === 'hybrid')
-        body.cache_control = { type: 'ephemeral' };
-    addTtl(body);
+    walkCacheControlHolders(body, (holder) => {
+        ;
+        holder.cache_control.ttl = '1h';
+    });
 }
 export async function buildAnthropicRequest(modelId, context, options, cache, fastModeEnabled = false, identity, controls = {}) {
+    // Pi 0.86 passes a normalized transcript to providers, and later system
+    // messages can change the prompt, its named sections and the tool set. Resolve
+    // them through the local replay port; raw host prompts (including ordered OMP
+    // blocks) still enter through normalization.
+    const transcript = collapseSystemMessages(normalizeContext({
+        ...context,
+        systemPrompt: systemPromptText(context.systemPrompt),
+    }));
+    context = {
+        messages: transcript.messages,
+        systemPrompt: getCurrentSystemPrompt(transcript.messages),
+        tools: getCurrentTools(transcript.messages),
+    };
+    // Conversion can discard opaque or incomplete blocks. Check context.messages
+    // first so those losses cannot hide a meaningful final assistant turn. Check
+    // the Anthropic messages again after conversion removes empty user messages.
+    assertNoMeaningfulTrailingAssistant(context.messages);
     const messages = convertMessages(context.messages, modelId);
-    // Strip trailing assistant messages — Anthropic rejects prefill on some models
-    while (messages.length &&
-        messages[messages.length - 1]?.role === 'assistant') {
-        messages.pop();
-    }
+    stripEmptyTrailingAssistantMessages(messages);
     const system = [
         {
             type: 'text',
@@ -368,7 +461,8 @@ export async function buildAnthropicRequest(modelId, context, options, cache, fa
         },
         { type: 'text', text: CLAUDE_CODE_IDENTITY },
     ];
-    if (context.systemPrompt?.trim()) {
+    const systemPrompt = systemPromptText(context.systemPrompt);
+    if (systemPrompt.trim()) {
         // Pi's prompt cannot sit whole in the top-level system[] array: two lines of
         // its documentation paragraph (the docs/*.md enumeration and the "follow .md
         // cross-references" instruction) are each independently sufficient to make
@@ -393,7 +487,7 @@ export async function buildAnthropicRequest(modelId, context, options, cache, fa
         // cache_control is set explicitly because addEphemeralCacheControl's
         // message-level breakpoint only fires for array content on the *last* user
         // message, which is not this one after the first turn.
-        const prompt = splitPiSystemPrompt(context.systemPrompt);
+        const prompt = splitPiSystemPrompt(systemPrompt);
         if (prompt.systemText) {
             system.push({ type: 'text', text: prompt.systemText });
         }
@@ -414,25 +508,42 @@ export async function buildAnthropicRequest(modelId, context, options, cache, fa
     }
     const isFableOrMythos5 = isClaudeFableOrMythos5Model(modelId);
     const isSonnet5 = isClaudeSonnet5Model(modelId);
+    const isSonnet55 = isClaudeSonnet55Model(modelId);
+    const isHaiku55 = isClaudeHaiku55Model(modelId);
     const isOpus5 = isClaudeOpus5Model(modelId);
-    // Sonnet 5 and Opus 5 share Fable/Mythos's adaptive-summarized contract: make
-    // adaptive thinking visible (display defaults to "omitted") and map reasoning
-    // to output_config effort. Pi's typed options cannot express
-    // thinking-disabled, so there is no disable case here (see transform.ts for
-    // the raw-body path). Each model refs its own per-family constant —
-    // families can diverge, so the constant rather than a shared alias keeps
-    // the call sites explicit.
+    const isOpus55 = isClaudeOpus55Model(modelId);
+    // Request summaries so the host can display adaptive reasoning.
+    // Pi's typed options cannot express the disabled-thinking setting;
+    // OpenCode handles it by transforming the raw request body. Separate model
+    // constants let each model's thinking configuration change independently.
     if (isFableOrMythos5) {
         body.thinking = { ...CLAUDE_FABLE_MYTHOS_5_SUMMARIZED_THINKING };
     }
+    else if (isHaiku55) {
+        body.thinking = { ...CLAUDE_HAIKU_5_5_ADAPTIVE_THINKING };
+    }
+    else if (isSonnet55) {
+        body.thinking = { ...CLAUDE_SONNET_5_5_ADAPTIVE_THINKING };
+    }
     else if (isSonnet5) {
         body.thinking = { ...CLAUDE_SONNET_5_ADAPTIVE_THINKING };
     }
+    else if (isOpus55) {
+        body.thinking = { ...CLAUDE_OPUS_5_5_ADAPTIVE_THINKING };
+    }
     else if (isOpus5) {
         body.thinking = { ...CLAUDE_OPUS_5_ADAPTIVE_THINKING };
     }
     if (options?.reasoning) {
-        if (isFableOrMythos5 || isSonnet5 || isOpus5) {
+        if ((isSonnet55 || isHaiku55) && options.reasoning === 'minimal') {
+            throw new Error(`${isHaiku55 ? 'Claude Haiku 5.5' : 'Claude Sonnet 5.5'} does not support minimal effort`);
+        }
+        if (isFableOrMythos5 ||
+            isSonnet5 ||
+            isSonnet55 ||
+            isHaiku55 ||
+            isOpus5 ||
+            isOpus55) {
             body.output_config = { effort: options.reasoning };
         }
         else {
@@ -460,5 +571,8 @@ export async function buildAnthropicRequest(modelId, context, options, cache, fa
     }
     const unsigned = JSON.stringify(orderClaudeCodeBody(body));
     const bodyText = await signRequestBody(unsigned);
-    return { body, bodyText };
+    // The stream decoder must use the exact tool set that produced this body.
+    // Pi 0.86's transcript has no top-level context.tools, and normalizing it
+    // again after dispatch would duplicate work and risk a different mapping.
+    return { body, bodyText, hostTools: context.tools ?? [] };
 }

package/dist/custody.d.ts

@@ -0,0 +1,13 @@
+import { type AccountCommandResult, type ClaustrumEnrollmentStatus, type ClaustrumMode } from '@cortexkit/anthropic-auth-core';
+export declare function requirePiEnrollment(): Promise<{
+    state: 'approved';
+    proposedName: string;
+    approvedName?: string;
+    tokenGeneration: number;
+}>;
+export interface PiCustodyCommands {
+    transition(mode: ClaustrumMode): Promise<AccountCommandResult>;
+    status(): Promise<ClaustrumEnrollmentStatus>;
+    reset(): Promise<AccountCommandResult>;
+}
+export declare function createPiCustodyCommands(): PiCustodyCommands;

package/dist/custody.js

@@ -0,0 +1,33 @@
+import { CLAUSTRUM_PI_ENROLLMENT_NAME, getHostClaustrumEnrollmentPaths, readClaustrumEnrollmentStatus, resetClaustrumEnrollmentState, } from '@cortexkit/anthropic-auth-core';
+export async function requirePiEnrollment() {
+    const status = await readClaustrumEnrollmentStatus(getHostClaustrumEnrollmentPaths('pi'), CLAUSTRUM_PI_ENROLLMENT_NAME);
+    if (status.state !== 'approved' ||
+        status.proposedName !== CLAUSTRUM_PI_ENROLLMENT_NAME) {
+        throw new Error('Pi requires its own approved Claustrum enrollment; run setup');
+    }
+    return status;
+}
+export function createPiCustodyCommands() {
+    const paths = () => getHostClaustrumEnrollmentPaths('pi');
+    return {
+        status: () => readClaustrumEnrollmentStatus(paths(), CLAUSTRUM_PI_ENROLLMENT_NAME),
+        async reset() {
+            const result = await resetClaustrumEnrollmentState(paths(), CLAUSTRUM_PI_ENROLLMENT_NAME);
+            const messages = {
+                reset: 'Terminal enrollment state cleared. Run setup to enroll Pi again.',
+                idle: 'Pi has no enrollment state to reset.',
+                'refused-pending': 'Refused: Pi enrollment is still pending.',
+                'refused-approved': 'Refused: Pi already has an approved enrollment token.',
+                busy: 'Pi enrollment is busy in another process.',
+            };
+            return { text: messages[result] };
+        },
+        async transition(mode) {
+            // Mode changes can remove host credentials and require offline consent.
+            // A menu never enrolls, grants custody or writes the authority journal.
+            return {
+                text: `Refused: Changing Pi authentication to ${mode} requires offline setup. Run \`bunx @cortexkit/opencode-anthropic-auth setup\` and review the migration and host OAuth removal consent.`,
+            };
+        },
+    };
+}

package/dist/effort-history.d.ts

@@ -3,10 +3,25 @@ type SessionEntryLike = {
     id?: unknown;
     type?: unknown;
     thinkingLevel?: unknown;
+    firstKeptEntryId?: unknown;
     message?: {
         role?: unknown;
     };
 };
+/**
+ * Reproduce the host's context-entry view — the entries the next request will
+ * actually carry — from the branch path, ordered root to leaf.
+ *
+ * `SessionManager.buildContextEntries()` computes this on Pi hosts but does not
+ * exist on Oh My Pi 18.x, where calling it threw on every turn (issue #200).
+ * `getBranch()` is present on both hosts and is the same path that method walks,
+ * so the compaction trim is applied here instead of asking the host for it.
+ *
+ * A branch without compaction is already the context. After a compaction the
+ * context is the compaction entry, then the tail retained from
+ * `firstKeptEntryId`, then everything appended after the compaction.
+ */
+export declare function deriveContextEntries<Entry extends SessionEntryLike>(branch: readonly Entry[]): Entry[];
 /** Build Pi's active, compaction-aware Fable 5.1 effort timeline. */
 export declare function collectPiEffortHistory(contextEntries: readonly SessionEntryLike[], fullBranch: readonly SessionEntryLike[]): MidConversationEffortTransition[];
 export {};

package/dist/effort-history.js

@@ -1,4 +1,44 @@
 import { normalizeAdaptiveEffort, } from '@cortexkit/anthropic-auth-core';
+/**
+ * Reproduce the host's context-entry view — the entries the next request will
+ * actually carry — from the branch path, ordered root to leaf.
+ *
+ * `SessionManager.buildContextEntries()` computes this on Pi hosts but does not
+ * exist on Oh My Pi 18.x, where calling it threw on every turn (issue #200).
+ * `getBranch()` is present on both hosts and is the same path that method walks,
+ * so the compaction trim is applied here instead of asking the host for it.
+ *
+ * A branch without compaction is already the context. After a compaction the
+ * context is the compaction entry, then the tail retained from
+ * `firstKeptEntryId`, then everything appended after the compaction.
+ */
+export function deriveContextEntries(branch) {
+    let compactionIndex = -1;
+    for (let index = 0; index < branch.length; index++) {
+        if (branch[index]?.type === 'compaction')
+            compactionIndex = index;
+    }
+    const compaction = branch[compactionIndex];
+    if (!compaction)
+        return branch.slice();
+    const contextEntries = [compaction];
+    let retaining = false;
+    for (let index = 0; index < compactionIndex; index++) {
+        const entry = branch[index];
+        if (!entry)
+            continue;
+        if (entry.id === compaction.firstKeptEntryId)
+            retaining = true;
+        if (retaining)
+            contextEntries.push(entry);
+    }
+    for (let index = compactionIndex + 1; index < branch.length; index++) {
+        const entry = branch[index];
+        if (entry)
+            contextEntries.push(entry);
+    }
+    return contextEntries;
+}
 function entryRole(entry) {
     if (entry.type === 'compaction' || entry.type === 'branch_summary') {
         return 'user';

package/dist/index.d.ts

@@ -1,2 +1,5 @@
+import { type NativeCustodyClient } from '@cortexkit/anthropic-auth-core';
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
-export default function cortexKitPiAnthropicAuth(pi: ExtensionAPI): void;
+export default function cortexKitPiAnthropicAuth(pi: ExtensionAPI, options?: {
+    connectScoped?: () => Promise<NativeCustodyClient>;
+}): Promise<void>;

package/dist/index.js

@@ -1,44 +1,66 @@
-import { authorize, CLAUDE_FABLE_MYTHOS_5_1_PRICING, CLAUDE_FABLE_MYTHOS_5_CONTEXT_WINDOW, CLAUDE_FABLE_MYTHOS_5_MAX_OUTPUT_TOKENS, CLAUDE_FABLE_MYTHOS_5_MODEL_SPECS, CLAUDE_FABLE_MYTHOS_5_PRICING, exchange, isClaudeFableOrMythos51Model, refreshClaudeOAuthToken, } from '@cortexkit/anthropic-auth-core';
+import { CLAUDE_FABLE_MYTHOS_5_1_PRICING, CLAUDE_FABLE_MYTHOS_5_CONTEXT_WINDOW, CLAUDE_FABLE_MYTHOS_5_MAX_OUTPUT_TOKENS, CLAUDE_FABLE_MYTHOS_5_MODEL_SPECS, CLAUDE_FABLE_MYTHOS_5_PRICING, CLAUDE_HAIKU_5_5_CONTEXT_WINDOW, CLAUDE_HAIKU_5_5_LONG_CONTEXT_PRICING, CLAUDE_HAIKU_5_5_LONG_CONTEXT_THRESHOLD, CLAUDE_HAIKU_5_5_MAX_OUTPUT_TOKENS, CLAUDE_HAIKU_5_5_MODEL_ID, CLAUDE_HAIKU_5_5_PRICING, CLAUDE_SONNET_5_5_CONTEXT_WINDOW, CLAUDE_SONNET_5_5_MAX_OUTPUT_TOKENS, CLAUDE_SONNET_5_5_MODEL_ID, CLAUDE_SONNET_5_5_PRICING, isClaudeFableOrMythos51Model, readNativeEnrollmentMode, } from '@cortexkit/anthropic-auth-core';
 import { registerCommands } from './commands.js';
-import { collectPiEffortHistory } from './effort-history.js';
+import { collectPiEffortHistory, deriveContextEntries, } from './effort-history.js';
+import { closePiNativeRuntime, getPiNativeRuntime, isNativeMigrationRequired, } from './native.js';
+import { createPiNativeCommands } from './native-commands.js';
+import { getPiAccountStoragePath, requirePiNativeHostAuth } from './paths.js';
 import { streamCortexKitAnthropic } from './stream.js';
-async function loginAnthropic(callbacks) {
-    const auth = await authorize('max');
-    callbacks.onAuth({ url: auth.url });
-    const callback = await callbacks.onPrompt({
-        message: 'Paste the Claude OAuth callback URL or code:',
-    });
-    const result = await exchange(callback, auth.verifier, auth.redirectUri, auth.state);
-    if (result.type !== 'success') {
-        throw new Error('Anthropic OAuth exchange failed');
-    }
-    return {
-        refresh: result.refresh,
-        access: result.access,
-        expires: result.expires,
-    };
-}
 function textImageInput() {
     return ['text', 'image'];
 }
-async function refreshAnthropicToken(credentials) {
-    const refreshed = await refreshClaudeOAuthToken({
-        refreshToken: credentials.refresh,
+/**
+ * Refuses every Anthropic prompt with Core's migration message. Registered
+ * only when startup found an install that offline setup has never migrated.
+ * Pi checks a prompt's credentials after its input handlers run. Handling the
+ * input here stops it before that check, which would otherwise answer with
+ * Pi's generic missing-key text for a 1.x install whose Pi login is still
+ * stored. Extension commands such as /claude run before input handlers, so
+ * they stay reachable.
+ */
+function refuseUnmigratedPrompts(pi, storagePath) {
+    pi.on('input', async (_event, ctx) => {
+        // Prompts for other providers do not use this install's accounts.
+        if (ctx.model?.provider !== 'anthropic')
+            return { action: 'continue' };
+        const refusal = await getPiNativeRuntime(storagePath).migrationRefusal();
+        if (!refusal)
+            return { action: 'continue' };
+        if (ctx.hasUI)
+            ctx.ui.notify(refusal.message, 'error');
+        else
+            process.stderr.write(`${refusal.message}\n`);
+        return { action: 'handled' };
     });
-    return {
-        refresh: refreshed.refresh,
-        access: refreshed.access,
-        expires: refreshed.expires,
-    };
 }
-export default function cortexKitPiAnthropicAuth(pi) {
-    registerCommands(pi);
+export default async function cortexKitPiAnthropicAuth(pi, options = {}) {
+    const storagePath = getPiAccountStoragePath();
+    getPiNativeRuntime(storagePath, {
+        ...(options.connectScoped && { connect: options.connectScoped }),
+    });
+    registerCommands(pi, createPiNativeCommands(storagePath));
     const effortHistoryBySession = new Map();
     pi.on('turn_start', async (_event, ctx) => {
         const sessionId = ctx.sessionManager.getSessionId();
         if (!sessionId)
             return;
-        const transitions = collectPiEffortHistory(ctx.sessionManager.buildContextEntries(), ctx.sessionManager.getBranch());
+        // This hook only adds mid-conversation effort markers to Fable/Mythos 5.1
+        // requests. A host whose session entries do not match what this reads must
+        // cost the session its transitions and nothing else: the handler runs
+        // before every turn, and an exception here surfaced as a per-turn extension
+        // error while collecting no effort history at all (issue #200).
+        //
+        // The catch stays quiet: `ExtensionAPI` carries no log surface on either
+        // host, and writing to stdout from a per-turn hook corrupts the host's
+        // rendering — which is the same per-turn noise this fix removes. The
+        // degraded state is observable in the request: no effort markers.
+        let transitions;
+        try {
+            const branch = ctx.sessionManager.getBranch();
+            transitions = collectPiEffortHistory(deriveContextEntries(branch), branch);
+        }
+        catch {
+            transitions = [];
+        }
         effortHistoryBySession.delete(sessionId);
         effortHistoryBySession.set(sessionId, transitions);
         while (effortHistoryBySession.size > 128) {
@@ -53,8 +75,9 @@ export default function cortexKitPiAnthropicAuth(pi) {
         const sessionId = ctx.sessionManager.getSessionId();
         if (sessionId)
             effortHistoryBySession.delete(sessionId);
+        await closePiNativeRuntime(storagePath);
     });
-    pi.registerProvider('anthropic', {
+    const configuration = {
         name: 'Anthropic (CortexKit OAuth)',
         baseUrl: 'https://api.anthropic.com',
         api: 'cortexkit-anthropic-messages',
@@ -78,6 +101,15 @@ export default function cortexKitPiAnthropicAuth(pi) {
                     maxTokens: CLAUDE_FABLE_MYTHOS_5_MAX_OUTPUT_TOKENS,
                 };
             }),
+            {
+                id: 'claude-opus-5-5',
+                name: 'Claude Opus 5.5',
+                reasoning: true,
+                input: textImageInput(),
+                cost: { input: 4, output: 20, cacheRead: 0.2, cacheWrite: 8 },
+                contextWindow: 1_000_000,
+                maxTokens: 128_000,
+            },
             {
                 id: 'claude-opus-5',
                 name: 'Claude Opus 5',
@@ -123,15 +155,134 @@ export default function cortexKitPiAnthropicAuth(pi) {
                 contextWindow: 1_000_000,
                 maxTokens: 128_000,
             },
+            {
+                id: CLAUDE_HAIKU_5_5_MODEL_ID,
+                name: 'Claude Haiku 5.5',
+                reasoning: true,
+                thinkingLevelMap: {
+                    off: null,
+                    minimal: null,
+                    xhigh: 'xhigh',
+                    max: 'max',
+                },
+                input: textImageInput(),
+                cost: {
+                    input: CLAUDE_HAIKU_5_5_PRICING.input,
+                    output: CLAUDE_HAIKU_5_5_PRICING.output,
+                    cacheRead: CLAUDE_HAIKU_5_5_PRICING.cacheRead,
+                    cacheWrite: CLAUDE_HAIKU_5_5_PRICING.cacheWrite5m,
+                    tiers: [
+                        {
+                            inputTokensAbove: CLAUDE_HAIKU_5_5_LONG_CONTEXT_THRESHOLD,
+                            input: CLAUDE_HAIKU_5_5_LONG_CONTEXT_PRICING.input,
+                            output: CLAUDE_HAIKU_5_5_LONG_CONTEXT_PRICING.output,
+                            cacheRead: CLAUDE_HAIKU_5_5_LONG_CONTEXT_PRICING.cacheRead,
+                            cacheWrite: CLAUDE_HAIKU_5_5_LONG_CONTEXT_PRICING.cacheWrite5m,
+                        },
+                    ],
+                },
+                contextWindow: CLAUDE_HAIKU_5_5_CONTEXT_WINDOW,
+                maxTokens: CLAUDE_HAIKU_5_5_MAX_OUTPUT_TOKENS,
+            },
+            {
+                id: CLAUDE_SONNET_5_5_MODEL_ID,
+                name: 'Claude Sonnet 5.5',
+                reasoning: true,
+                thinkingLevelMap: {
+                    off: null,
+                    minimal: null,
+                    xhigh: 'xhigh',
+                    max: 'max',
+                },
+                input: textImageInput(),
+                cost: {
+                    input: CLAUDE_SONNET_5_5_PRICING.input,
+                    output: CLAUDE_SONNET_5_5_PRICING.output,
+                    cacheRead: CLAUDE_SONNET_5_5_PRICING.cacheRead,
+                    cacheWrite: CLAUDE_SONNET_5_5_PRICING.cacheWrite5m,
+                },
+                contextWindow: CLAUDE_SONNET_5_5_CONTEXT_WINDOW,
+                maxTokens: CLAUDE_SONNET_5_5_MAX_OUTPUT_TOKENS,
+            },
         ],
-        oauth: {
-            name: 'Anthropic Claude Pro/Max (CortexKit)',
-            login: loginAnthropic,
-            refreshToken: refreshAnthropicToken,
-            getApiKey: (credentials) => credentials.access,
-        },
         streamSimple: (model, context, options) => streamCortexKitAnthropic(model, context, options, options?.sessionId
             ? effortHistoryBySession.get(options.sessionId)
             : undefined),
-    });
+    };
+    async function configureProvider() {
+        const streamSimple = configuration.streamSimple;
+        if (!streamSimple)
+            throw new Error('Anthropic stream implementation is unavailable');
+        // Register vault-backed models even if no account can serve yet, so a
+        // repaired enrollment or re-login takes effect on the next request. Local
+        // credentials still require completed offline migration before serving.
+        const startupMode = await readNativeEnrollmentMode('pi').catch(() => undefined);
+        try {
+            if (startupMode === 'local')
+                await getPiNativeRuntime(storagePath).view();
+        }
+        catch (error) {
+            // An install that offline setup has never migrated, such as a 1.x
+            // install upgraded in place, must still load: a failed load drops the
+            // /claude menu and Pi exits at startup. Its prompts are refused instead.
+            // Any other failure stops the load as before.
+            const refusal = await getPiNativeRuntime(storagePath).migrationRefusal();
+            if (!refusal)
+                throw error;
+            refuseUnmigratedPrompts(pi, storagePath);
+        }
+        const configured = async () => {
+            const mode = await readNativeEnrollmentMode('pi').catch(() => undefined);
+            if (mode !== 'local')
+                return true;
+            await requirePiNativeHostAuth();
+            let snapshot;
+            try {
+                snapshot = await (await getPiNativeRuntime(storagePath).service()).read();
+            }
+            catch (error) {
+                // An unmigrated install still reports the provider as configured, so
+                // Pi keeps its Anthropic models selectable and its prompts reach the
+                // refusal above (or, from any other caller, the stream, which refuses
+                // with the same Core message). If this check threw instead, Pi would
+                // record the refusal as a startup availability error.
+                if (isNativeMigrationRequired(error))
+                    return true;
+                throw error;
+            }
+            return snapshot.accounts.some((account) => account.type === 'oauth' &&
+                account.enabled &&
+                (account.source !== 'vault' || account.state === 'active'));
+        };
+        const provider = {
+            id: 'anthropic',
+            name: 'Anthropic (CortexKit Native)',
+            baseUrl: 'https://api.anthropic.com',
+            auth: {
+                // Native ambient auth avoids fake keys and local OAuth refresh. Pi refuses
+                // a leftover stored OAuth credential because this provider has no OAuth
+                // handler; setup must obtain consent before removing that local entry.
+                apiKey: {
+                    name: 'CortexKit Native',
+                    check: async () => (await configured())
+                        ? { type: 'api_key', source: 'CortexKit Native' }
+                        : undefined,
+                    resolve: async () => (await configured())
+                        ? { auth: {}, source: 'CortexKit Native' }
+                        : undefined,
+                },
+            },
+            getModels: () => (configuration.models ?? []).map((model) => ({
+                ...model,
+                provider: 'anthropic',
+                api: model.api ?? 'cortexkit-anthropic-messages',
+                baseUrl: model.baseUrl ?? 'https://api.anthropic.com',
+            })),
+            // Preserve the legacy provider's simplified option surface for raw calls.
+            stream: (model, context, options) => streamSimple(model, context, options),
+            streamSimple,
+        };
+        pi.registerProvider(provider);
+    }
+    await configureProvider();
 }

package/dist/native-commands.d.ts

@@ -0,0 +1,2 @@
+import type { PiNativeCommands } from './commands.ts';
+export declare function createPiNativeCommands(storagePath?: string): PiNativeCommands;