@cortexkit/pi-anthropic-auth 2.0.2 → 2.1.0

package/README.md

@@ -1,116 +1,54 @@
 # @cortexkit/pi-anthropic-auth
 
-Pi package for CortexKit Anthropic OAuth support. It replaces the implementation of Pi's built-in Anthropic provider, keeping the `anthropic` provider ID and model IDs, and is backed by the shared `@cortexkit/anthropic-auth-core` package.
+Use Claude Pro/Max subscriptions in [Pi](https://pi.dev) with `@cortexkit/pi-anthropic-auth`. The companion `@cortexkit/opencode-anthropic-auth` package supports [OpenCode](https://opencode.ai) 1 and 2; both integrations use the shared `@cortexkit/anthropic-auth-core` package.
 
-The Pi provider catalog includes Claude Fable 5 (`claude-fable-5`) and 5.1 (`claude-fable-5-1`), limited-access Claude Mythos 5 (`claude-mythos-5`) and 5.1 (`claude-mythos-5-1`), Claude Opus 5 (`claude-opus-5`), Claude Opus 5.5 (`claude-opus-5-5`), Claude Haiku 5.5 (`claude-haiku-5-5`), Claude Opus 4.8, Claude Opus 4.5, Claude Sonnet 4.5, Claude Sonnet 5 (`claude-sonnet-5`), and Claude Sonnet 5.5 (`claude-sonnet-5-5`). Fable/Mythos reasoning uses Anthropic adaptive thinking with `thinking.display: "summarized"` and `output_config.effort`; the package does not send rejected manual `thinking.budget_tokens` for those models. Opus 5.5 requires adaptive thinking, while Sonnet 5.5 also supports a `between_tools` mode for applications that explicitly turn off up-front thinking. This Pi provider sends adaptive thinking with summarized display for both models. For Sonnet 5.5 it exposes `low` through `max` effort, but not `minimal` (unsupported by the model) or `off` (Pi's simple-provider options cannot request `between_tools`). OAuth Fable 5.1 sessions add effort changes as system messages instead of rewriting earlier history, preserving cached prompt content.
+## Why use it
 
-Replayed thinking signatures refer to the messages, instructions and tools that preceded the thinking block. If those earlier inputs change, `thinkingBinding.prefixMismatchBehavior` controls how OAuth Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5 requests handle that mismatch: `account-default` sends no local override and uses Anthropic's account settings; `error` rejects the request; `drop_block` removes the affected thinking blocks. These controls require adaptive thinking.
+- Multiple Claude accounts with ordered fallbacks, quota-aware routing and per-session account affinity.
+- Prompt-cache controls and optional cache keepalive for active sessions.
+- Optional Claustrum integration: Claustrum is a local credential-vault service that supplies Claude accounts instead of each application's local account pool.
+- An optional user-owned Cloudflare relay to reduce repeated request uploads.
 
-Haiku 5.5 has a 1M context, 128K output and summarized adaptive thinking with `low` through `max` effort. Haiku 5.5 does not support `minimal` effort. The model accepts disabled thinking, but Pi's simple-provider options cannot request it, so Pi does not expose an `off` level. Standard input/output rates are $0.10/$0.50 per million tokens; all rates increase fivefold above 100K total input including cache. Pi's native pricing tiers apply the selected rates to the whole request, including both cache lifetimes.
+## Disclaimer
 
-This package is part of the CortexKit Anthropic Auth monorepo, which supports both OpenCode (`@cortexkit/opencode-anthropic-auth`) and Pi (`@cortexkit/pi-anthropic-auth`) through the same shared core logic.
-
-> [!IMPORTANT]
-> These instructions describe the upcoming native release, which is not yet published.
-
-## Setup (recommended)
-
-Setup is an *offline* step: every OpenCode, LiteCode, and Pi process must be closed while it runs. Offline does not mean without network; setup still uses the network, for example to install packages and to sign in to Claude. Quit those processes, then run the setup command from the OpenCode package:
-
-```bash
-bunx @cortexkit/opencode-anthropic-auth setup
-```
-
-What setup does: it installs this extension with `pi install` and migrates Pi to its local account pool, or, if you choose it, enrolls Pi in the Claustrum vault (Claustrum is a local credential-vault service; `ck` is its command-line tool). Useful flags: `--yes` (no prompts), `--dry-run`, `--login` (sign in to Claude during setup), `--claustrum` / `--no-claustrum`, and `--remove-pi-auth` (consent, with `--yes`, to moving Pi's stored Anthropic login). `--login` and `--claustrum` cannot be combined.
-
----
+This project is not affiliated with or endorsed by Anthropic. Using Claude subscriptions outside Anthropic's official clients may violate Anthropic's terms and can lead to account restrictions or suspension. Use it at your own risk.
 
 ## Install
 
-Install with Pi's package manager:
-
-```bash
-pi install npm:@cortexkit/pi-anthropic-auth
-```
-
-To pin a release, replace `VERSION` with its version number and keep the quotes: `pi install "npm:@cortexkit/pi-anthropic-auth@VERSION"`.
-
-To try it for one run without changing Pi settings:
-
 ```bash
-pi -e npm:@cortexkit/pi-anthropic-auth
+npx @cortexkit/opencode-anthropic-auth setup
 ```
 
-The extension keeps Pi's `anthropic` provider ID and the model IDs listed above. It authenticates from the local account pool or the Claustrum vault, not from Pi's `/login anthropic` credential. Run setup before starting Pi.
-
-## Accounts and custody
-
-Pi takes Claude credentials from one source, selected by Pi's own Claustrum enrollment record (`~/.local/state/cortexkit/anthropic-auth/pi-enrollment.json`, or `PI_ANTHROPIC_AUTH_CLAUSTRUM_ENROLLMENT_FILE`):
-
-- **Local custody** (default): the local account pool at `~/.pi/agent/anthropic-auth-pool.json`, with private credential state in `anthropic-auth-pool-state.json`. The pool holds Pi's Claude OAuth accounts (one main account, tried first by default, plus fallbacks) and API-key fallback routes. Its files are created next to the old sidecar path, so `PI_ANTHROPIC_AUTH_FILE` moves them too. Every Pi process shares this pool; OpenCode keeps a separate one.
-- **Vault custody**: the Claustrum vault, through the `anthropic-auth-pi` enrollment and read access to the `anthropic-native` credential category. Setup grants this with `ck auth grant --principal enrolled:anthropic-auth-pi --selector-kind category --selector anthropic-native --operation read`.
-
-If the enrollment record cannot be read, Pi refuses the requests this extension would serve until the record is repaired or Pi is disconnected. An approved enrollment keeps Pi on the vault even if its token file is missing, so Pi refuses rather than falling back to local accounts. See [the custody contract](https://github.com/cortexkit/anthropic-auth/blob/main/docs/custody-state-machine.md) for details.
-
-### Local custody
-
-Setup imports your fallback Claude OAuth accounts, paid API-key fallback routes, and settings from the old sidecar file (`~/.pi/agent/anthropic-auth.json`, or `PI_ANTHROPIC_AUTH_FILE`) into the pool; the old file is not read afterwards. Pi normally uses its stored login instead of the extension's credentials, so with your consent setup also moves Pi's stored Anthropic OAuth login into the pool as the main account. Until then, Pi refuses to serve with `Pi still has a host Anthropic OAuth credential. Run offline setup to migrate it and approve its removal before using the native pool.`
+After setup:
 
-Before importing a stored main OAuth login, migration checks the Claude account UUID in the legacy main profile. That profile's recorded token fingerprint (a hash) must match the hash of the host login's current access token; migration does not query Anthropic for identity. If it cannot, it changes nothing and asks you to run `bunx @cortexkit/opencode-anthropic-auth setup --login --no-claustrum`. After setup completes, you can add or replace logins from Pi: open `/claude` and use **Start OAuth sign-in** and **Finish OAuth sign-in**. The first account becomes the main account; later sign-ins add fallback accounts.
+OpenCode 1: open `/claude` → **Accounts** to sign in.
 
-### Vault custody
+OpenCode 2: In OpenCode, sign in to Anthropic with "Claude Pro / Max (native account pool)".
 
-Run `bunx @cortexkit/opencode-anthropic-auth setup --claustrum` with the Claustrum daemon running and `ck` installed. Setup writes Pi's enrollment and, with your consent, Pi's auth file. It does not read, import, or change the local pool, its metadata, or routing assignments, and it never copies local OAuth accounts into the vault. If Pi has a stored Anthropic login (OAuth or API key), setup asks for consent, moves it into a private, owner-only stash (`pi-auth-slot/anthropic.json` in the directory of Pi's enrollment record), and leaves an inert placeholder API key in Pi's auth file. The placeholder is a fixed, non-secret value that no provider accepts.
+Pi: open `/claude` and use **Start OAuth sign-in**, then **Finish OAuth sign-in**.
 
-While enrolled, Pi serves only vault accounts; vault accounts added with `ck auth login --provider anthropic` are discovered without a restart. Local accounts are not used, refreshed, quota-polled, kept warm by cache keepalive, or shown, and they return unchanged after disconnect. If the vault has no usable Claude account, requests refuse: add accounts with `ck auth login --provider anthropic`, or disconnect.
-
-**Disconnect from the vault** in `/claude` asks for confirmation, restores the stashed login byte-for-byte, then ends Pi's enrollment. If Pi's auth file already holds a different login, disconnect stops and keeps both logins and the enrollment so you can resolve them with setup. **Disconnect from the vault** is also offered when the enrollment record cannot be read. If the local pool has never been migrated, stop the hosts and run `setup --no-claustrum` before serving local accounts; disconnect does not perform migration.
-
-## Settings
-
-The pool stores the same settings as the OpenCode package: `routing`, `claudeCache`, `cacheKeep`, `prime`, `claudeFast`, `thinkingBinding`, `dump`, `relay`, and the fallback accounts. While Pi is enrolled in the vault, settings are kept separately in `anthropic-auth-vault-settings.json`. `thinkingBinding.prefixMismatchBehavior` accepts `account-default` (default), `error`, or `drop_block` when a Fable 5.1 OAuth request reuses reasoning with an Anthropic signature from an earlier reply after the preceding messages, instructions, or tools change. Sticky session assignments are stored in `anthropic-auth-pool-routing-state.json` (`anthropic-auth-vault-routing-state.json` while enrolled) with SHA-256-hashed session IDs.
-
-## The /claude menu
-
-Pi registers one command, `/claude`. It opens a menu; each action collects its own parameters, and typed arguments are rejected with a pointer to the menu. Without a UI, `/claude` prints the status sections only.
-
-| Group | Status | Actions |
-| --- | --- | --- |
-| Accounts | Account status and usage | Enable account, Disable account, Remove account, Move account up, Move account down, Reset account backoff, Reset host enrollment, Add API-key fallback, Start OAuth sign-in, Finish OAuth sign-in, Custody setup guidance, Disconnect from the vault |
-| Quota | Quota summary | — |
-| Routing | Routing status | Routing mode (`main-first`, `fallback-first`, `sticky-balanced`), Reset routing session |
-| Cache | Cache status, Cache keep status | Enable cache, Disable cache, Cache mode (`explicit`, `automatic`, `hybrid`), Keep cache warm always, Disable cache keep, Cache keep window, Cache keep for subagents (`on`/`off`) |
-| Diagnostics | Dump status, Logging status | Enable request dumps, Disable request dumps, Logging level (`error`, `warn`, `info`, `debug`, `trace`) |
-| Extras | Fast mode status, Prime quota window status | Enable fast mode, Disable fast mode |
-
-In local custody, every Accounts action except **Disconnect from the vault** is offered. While Pi is enrolled, or when its enrollment cannot be read, the Accounts group shows only enable, disable, **Reset account backoff**, and **Disconnect from the vault**. **Remove account**, **Reset host enrollment**, and **Disconnect from the vault** ask for confirmation. Killswitch, quota refresh, Prime on/off, and lane start are OpenCode-only.
-
-**Reset account backoff** clears the main OAuth refresh backoff and its matching quota backoff. Persisted refresh backoffs are bound to the refresh token that produced them, so replacing a rejected credential immediately clears the backoff left by the old refresh token. **Quota summary** reports quota for the accounts of the active custody source. **Routing mode** → `fallback-first` prefers usable OAuth fallback accounts before the main account; `main-first` restores the default. `sticky-balanced` assigns each Pi session to an OAuth account according to current 5-hour, 7-day, and model-specific quota headroom, then keeps the session on that account (session affinity), persisting the assignment across transient failures and process restarts. Changing the session model discards the old assignment before quota-based reselection. **Reset routing session** clears the current Pi session's assignment. Direct Opus sessions prefer usable accounts whose Fable quota (the separate weekly limit for Claude Fable models) is exhausted, saving the other accounts for Fable sessions. API-key routes are sent directly to their configured Anthropic-compatible base URL, such as Kie's `https://api.kie.ai/claude`, but Pi only uses them after the main OAuth model response reports HTTP 429 or a streaming rate-limit error and a live quota check confirms 0% remaining. **Keep cache warm always** keeps active hybrid caches warm while Pi remains open; **Cache keep window** limits prewarms to a local time window. Both send `max_tokens: 0` pre-warm requests about five minutes before the 1-hour TTL expires. **Cache keep status** lists live tracked sessions across Pi processes through a temporary lease registry that stores only session IDs and cache timing. **Enable fast mode** adds Anthropic `speed: "fast"` plus the `fast-mode-2026-02-01` beta header for supported Opus models (`claude-opus-4-8`, `claude-opus-5`, and `claude-opus-5-5`).
-
-### Claude quota window priming
-
-Priming is off by default. When enabled from OpenCode's `/claude` menu with **Enable Prime**, it watches each OAuth account's 5-hour quota reset and sends one minimal `claude-haiku-4-5` request about one minute after a confirmed reset. This starts the next window without waiting for a normal prompt. Usage is measured from response accounting.
-
-For an idle account with no cached reset time, one minimal request starts a usage window; the follow-up quota check learns its reset time. When several processes share an account store, each tries to create a claim file for that account and reset; creating the file is atomic, so exactly one process succeeds and sends the request.
-
-Claim files live in a temporary directory, separated by account store and credential lineage. Cleanup removes files older than six hours. Ordinary token refresh keeps the lineage; a new sign-in starts a new one. Private runtime state stores cumulative priming usage counters, not a history of primed windows. Legacy claim files are not migrated. Without the old claim, the new scheduler can treat an already primed window as unclaimed and send one extra request.
-
-Pi's menu shows **Prime quota window status** only; turn priming on or off with **Enable Prime** or **Disable Prime** in OpenCode's `/claude` menu.
-
-## Anthropic-compatible proxy overrides
-
-API-key fallback routes honor `ANTHROPIC_CUSTOM_HEADERS`, `ANTHROPIC_MODEL`, and `ANTHROPIC_DEFAULT_{SONNET,OPUS,HAIKU,FABLE}_MODEL`. These variables never alter OAuth requests. Custom headers may add proxy metadata but cannot replace route authentication, Anthropic protocol headers, body framing, or internal correlation headers; a configuration containing an invalid or protected header is ignored as a whole. Versioned provider base paths are preserved without duplicating `/v1`.
-
-## Relay
-
-The Pi package can use a user-owned Cloudflare relay over HTTP or WebSocket transport. When setup migrates Pi, it imports an existing `relay` block from Pi's old sidecar file (`~/.pi/agent/anthropic-auth.json`, or `PI_ANTHROPIC_AUTH_FILE`). The relay setup helper in the OpenCode package CLI provisions a Worker and saves its settings in OpenCode's local account pool; it does not configure Pi:
-
-```bash
-CLOUDFLARE_API_TOKEN=... CLOUDFLARE_ACCOUNT_ID=... bunx @cortexkit/opencode-anthropic-auth relay setup
-```
+## Documentation
 
-The `/claude` menu has no relay actions.
+- [Installation, configuration and manual registration](../../docs/installation.md#installation-and-configuration)
+- [Features and host support](../../docs/features.md#features-and-host-support)
+- [Models, thinking and fast mode](../../docs/models.md#models-thinking-and-fast-mode)
+- [Accounts, routing and quota](../../docs/accounts-and-routing.md#accounts-routing-and-quota)
+- [Settings and routing reference](../../docs/configuration.md#settings-and-routing-reference)
+- [Vault custody](../../docs/vault.md#vault-custody)
+- [Credential custody contract](../../docs/custody-state-machine.md#anthropic-credential-custody)
+- [Commands and menus](../../docs/commands.md#commands-and-menus)
+- [Cache, keepalive and quota priming](../../docs/cache.md#cache-keepalive-and-quota-priming)
+- [Cache diagnostics](../../docs/cache-diagnostics.md#cache-diagnostics)
+- [OpenCode 2](../../docs/opencode-2.md#opencode-2)
+- [OpenCode sidebar and TUI preferences](../../docs/sidebar.md#opencode-sidebar-and-tui-preferences)
+- [Environment variables](../../docs/environment.md#environment-variables)
+- [Request rewriting and safety fallback](../../docs/request-rewriting.md#request-rewriting-and-safety-fallback)
+- [Transports and request diagnostics](../../docs/transports.md#transports-and-request-diagnostics)
+- [Troubleshooting](../../docs/troubleshooting.md#troubleshooting)
+- [Development](../../docs/development.md#development)
+- [Build modes](../../docs/build-modes.md#build-modes)
+- [Upgrades, recovery and releases](../../docs/releases.md#upgrades-recovery-and-releases)
 
 ## License
 
-MIT
+[MIT](../../LICENSE)

package/dist/convert.js

@@ -284,8 +284,11 @@ function addEphemeralCacheControl(body) {
         if (message?.role !== 'user')
             continue;
         const content = message.content;
-        if (Array.isArray(content)) {
-            const lastBlock = content.at(-1);
+        if (typeof content === 'string') {
+            message.content = [{ type: 'text', text: content }];
+        }
+        if (Array.isArray(message.content)) {
+            const lastBlock = message.content.at(-1);
             if (lastBlock && typeof lastBlock === 'object') {
                 lastBlock.cache_control = { type: 'ephemeral' };
             }

package/dist/custody.js

@@ -26,7 +26,7 @@ export function createPiCustodyCommands() {
             // Mode changes can remove host credentials and require offline consent.
             // A menu never enrolls, grants custody or writes the authority journal.
             return {
-                text: `Refused: Changing Pi authentication to ${mode} requires offline setup. Run \`bunx @cortexkit/opencode-anthropic-auth setup\` and review the migration and host OAuth removal consent.`,
+                text: `Refused: Changing Pi authentication to ${mode} requires offline setup. Run \`npx @cortexkit/opencode-anthropic-auth setup\` and review the migration and host OAuth removal consent.`,
             };
         },
     };

package/dist/effort-history.d.ts

@@ -1,4 +1,4 @@
-import { type MidConversationEffortTransition } from '@cortexkit/anthropic-auth-core';
+import { type AdaptiveEffort, type MidConversationEffortTransition } from '@cortexkit/anthropic-auth-core';
 type SessionEntryLike = {
     id?: unknown;
     type?: unknown;
@@ -22,6 +22,11 @@ type SessionEntryLike = {
  * `firstKeptEntryId`, then everything appended after the compaction.
  */
 export declare function deriveContextEntries<Entry extends SessionEntryLike>(branch: readonly Entry[]): Entry[];
-/** Build Pi's active, compaction-aware Fable 5.1 effort timeline. */
-export declare function collectPiEffortHistory(contextEntries: readonly SessionEntryLike[], fullBranch: readonly SessionEntryLike[]): MidConversationEffortTransition[];
+/**
+ * Build Pi's active, compaction-aware effort timeline for per-message effort.
+ * A thinking level without an adaptive effort (such as `off`) and a branch
+ * without any level change both count as `defaultEffort`, the effort the
+ * request model applies when no top-level effort is sent.
+ */
+export declare function collectPiEffortHistory(contextEntries: readonly SessionEntryLike[], fullBranch: readonly SessionEntryLike[], defaultEffort?: AdaptiveEffort): MidConversationEffortTransition[];
 export {};

package/dist/effort-history.js

@@ -57,9 +57,14 @@ function appendTransition(transitions, afterAssistantMessages, effort) {
     }
     transitions.push({ afterAssistantMessages, effort });
 }
-/** Build Pi's active, compaction-aware Fable 5.1 effort timeline. */
-export function collectPiEffortHistory(contextEntries, fullBranch) {
-    let activeEffort = 'high';
+/**
+ * Build Pi's active, compaction-aware effort timeline for per-message effort.
+ * A thinking level without an adaptive effort (such as `off`) and a branch
+ * without any level change both count as `defaultEffort`, the effort the
+ * request model applies when no top-level effort is sent.
+ */
+export function collectPiEffortHistory(contextEntries, fullBranch, defaultEffort = 'high') {
+    let activeEffort = defaultEffort;
     let assistantMessages = 0;
     const transitions = [];
     const first = contextEntries[0];
@@ -71,7 +76,8 @@ export function collectPiEffortHistory(contextEntries, fullBranch) {
             const entry = fullBranch[index];
             if (entry?.type !== 'thinking_level_change')
                 continue;
-            activeEffort = normalizeAdaptiveEffort(entry.thinkingLevel) ?? 'high';
+            activeEffort =
+                normalizeAdaptiveEffort(entry.thinkingLevel) ?? defaultEffort;
         }
         appendTransition(transitions, 0, activeEffort);
     }
@@ -85,7 +91,8 @@ export function collectPiEffortHistory(contextEntries, fullBranch) {
             branchIndex < compactionIndex;
         if (entry.type === 'thinking_level_change') {
             if (!retainedBeforeCompaction) {
-                activeEffort = normalizeAdaptiveEffort(entry.thinkingLevel) ?? 'high';
+                activeEffort =
+                    normalizeAdaptiveEffort(entry.thinkingLevel) ?? defaultEffort;
             }
             continue;
         }

package/dist/index.js

@@ -1,4 +1,4 @@
-import { CLAUDE_FABLE_MYTHOS_5_1_PRICING, CLAUDE_FABLE_MYTHOS_5_CONTEXT_WINDOW, CLAUDE_FABLE_MYTHOS_5_MAX_OUTPUT_TOKENS, CLAUDE_FABLE_MYTHOS_5_MODEL_SPECS, CLAUDE_FABLE_MYTHOS_5_PRICING, CLAUDE_HAIKU_5_5_CONTEXT_WINDOW, CLAUDE_HAIKU_5_5_LONG_CONTEXT_PRICING, CLAUDE_HAIKU_5_5_LONG_CONTEXT_THRESHOLD, CLAUDE_HAIKU_5_5_MAX_OUTPUT_TOKENS, CLAUDE_HAIKU_5_5_MODEL_ID, CLAUDE_HAIKU_5_5_PRICING, CLAUDE_SONNET_5_5_CONTEXT_WINDOW, CLAUDE_SONNET_5_5_MAX_OUTPUT_TOKENS, CLAUDE_SONNET_5_5_MODEL_ID, CLAUDE_SONNET_5_5_PRICING, isClaudeFableOrMythos51Model, readNativeEnrollmentMode, } from '@cortexkit/anthropic-auth-core';
+import { CLAUDE_FABLE_MYTHOS_5_1_PRICING, CLAUDE_FABLE_MYTHOS_5_CONTEXT_WINDOW, CLAUDE_FABLE_MYTHOS_5_MAX_OUTPUT_TOKENS, CLAUDE_FABLE_MYTHOS_5_MODEL_SPECS, CLAUDE_FABLE_MYTHOS_5_PRICING, CLAUDE_HAIKU_5_5_CONTEXT_WINDOW, CLAUDE_HAIKU_5_5_LONG_CONTEXT_PRICING, CLAUDE_HAIKU_5_5_LONG_CONTEXT_THRESHOLD, CLAUDE_HAIKU_5_5_MAX_OUTPUT_TOKENS, CLAUDE_HAIKU_5_5_MODEL_ID, CLAUDE_HAIKU_5_5_PRICING, CLAUDE_SONNET_5_5_CONTEXT_WINDOW, CLAUDE_SONNET_5_5_MAX_OUTPUT_TOKENS, CLAUDE_SONNET_5_5_MODEL_ID, CLAUDE_SONNET_5_5_PRICING, defaultAdaptiveEffort, isClaudeFableOrMythos51Model, nativeAccountCanServe, readNativeEnrollmentMode, } from '@cortexkit/anthropic-auth-core';
 import { registerCommands } from './commands.js';
 import { collectPiEffortHistory, deriveContextEntries, } from './effort-history.js';
 import { closePiNativeRuntime, getPiNativeRuntime, isNativeMigrationRequired, } from './native.js';
@@ -43,11 +43,12 @@ export default async function cortexKitPiAnthropicAuth(pi, options = {}) {
         const sessionId = ctx.sessionManager.getSessionId();
         if (!sessionId)
             return;
-        // This hook only adds mid-conversation effort markers to Fable/Mythos 5.1
-        // requests. A host whose session entries do not match what this reads must
-        // cost the session its transitions and nothing else: the handler runs
-        // before every turn, and an exception here surfaced as a per-turn extension
-        // error while collecting no effort history at all (issue #200).
+        // This hook collects effort history for the per-message effort markers
+        // that core adds to Fable 5.1, Opus 5.5 and Sonnet 5.5 requests. A host
+        // whose session entries do not match what this reads must cost the
+        // session its transitions and nothing else: the handler runs before every
+        // turn, and an exception here surfaced as a per-turn extension error while
+        // collecting no effort history at all (issue #200).
         //
         // The catch stays quiet: `ExtensionAPI` carries no log surface on either
         // host, and writing to stdout from a per-turn hook corrupts the host's
@@ -56,7 +57,7 @@ export default async function cortexKitPiAnthropicAuth(pi, options = {}) {
         let transitions;
         try {
             const branch = ctx.sessionManager.getBranch();
-            transitions = collectPiEffortHistory(deriveContextEntries(branch), branch);
+            transitions = collectPiEffortHistory(deriveContextEntries(branch), branch, defaultAdaptiveEffort(ctx.model?.id));
         }
         catch {
             transitions = [];
@@ -251,9 +252,7 @@ export default async function cortexKitPiAnthropicAuth(pi, options = {}) {
                     return true;
                 throw error;
             }
-            return snapshot.accounts.some((account) => account.type === 'oauth' &&
-                account.enabled &&
-                (account.source !== 'vault' || account.state === 'active'));
+            return snapshot.accounts.some((account) => account.type === 'oauth' && nativeAccountCanServe(account));
         };
         const provider = {
             id: 'anthropic',

package/dist/native-commands.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { authorize, buildClaudeQuotaSummary, buildPrimeAccountStatuses, DEFAULT_KILLSWITCH_THRESHOLDS, exchange, executeCacheKeepCommand, executePrimeCommand, formatEnrollmentStatus, formatNativeAccountState, formatOAuthAccountTier, getCache1hPersistentMode, getCacheKeepWindow, getPersistedLogLevel, getRoutingMode, isCache1hPersistentlyEnabled, isCacheKeepAlways, isCacheKeepHybridActive, isCacheKeepPersistentlyEnabled, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, isKillswitchEnabled, isPrimePersistentlyEnabled, setDumpEnabled, } from '@cortexkit/anthropic-auth-core';
+import { authorize, buildClaudeQuotaSummary, buildPrimeAccountStatuses, DEFAULT_KILLSWITCH_THRESHOLDS, exchange, executeCacheKeepCommand, executePrimeCommand, formatEnrollmentStatus, formatNativeAccountState, formatOAuthAccountTier, getCache1hPersistentMode, getCacheKeepWindow, getPersistedLogLevel, getRoutingMode, isCache1hPersistentlyEnabled, isCacheKeepAlways, isCacheKeepHybridActive, isCacheKeepPersistentlyEnabled, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, isKillswitchEnabled, isPrimePersistentlyEnabled, nativeAccountCanServe, setDumpEnabled, } from '@cortexkit/anthropic-auth-core';
 import { createPiCustodyCommands } from './custody.js';
 import { getPiNativeRuntime } from './native.js';
 import { getPiAccountStoragePath } from './paths.js';
@@ -174,7 +174,7 @@ export function createPiNativeCommands(storagePath = getPiAccountStoragePath())
             case 'quota-refresh': {
                 const snapshot = await native.view();
                 for (const account of snapshot.accounts) {
-                    if (!account.enabled || account.type !== 'oauth')
+                    if (!nativeAccountCanServe(account) || account.type !== 'oauth')
                         continue;
                     await runtime.fetchQuota(account.id, fetchPiOAuth, options.signal);
                     await runtime.fetchProfile(account.id, fetchPiOAuth, options.signal);
@@ -299,7 +299,10 @@ export function createPiNativeCommands(storagePath = getPiAccountStoragePath())
                 case 'killswitch':
                     return `Killswitch: ${isKillswitchEnabled(storage) ? 'enabled' : 'disabled'}\n${JSON.stringify(storage.killswitch ?? {})}`;
                 case 'cache':
-                    return `1-hour cache: ${isCache1hPersistentlyEnabled(storage) ? 'enabled' : 'disabled'}; mode: ${getCache1hPersistentMode(storage)}`;
+                    return [
+                        `1-hour cache: ${isCache1hPersistentlyEnabled(storage) ? 'enabled' : 'disabled'}; mode: ${getCache1hPersistentMode(storage)}`,
+                        `- Persisted: ${await runtime.getSettingsPath()}`,
+                    ].join('\n');
                 case 'cachekeep': {
                     const sessions = await getPiTrackedCacheKeepSessions();
                     return executeCacheKeepCommand({
@@ -316,11 +319,20 @@ export function createPiNativeCommands(storagePath = getPiAccountStoragePath())
                     });
                 }
                 case 'dump':
-                    return `Request dumping: ${isDumpPersistentlyEnabled(storage) ? 'enabled' : 'disabled'}`;
+                    return [
+                        `Request dumping: ${isDumpPersistentlyEnabled(storage) ? 'enabled' : 'disabled'}`,
+                        `- Persisted: ${await runtime.getSettingsPath()}`,
+                    ].join('\n');
                 case 'logging':
-                    return `Logging: ${getPersistedLogLevel(storage) ?? 'info'}`;
+                    return [
+                        `Logging: ${getPersistedLogLevel(storage) ?? 'info'}`,
+                        `- Persisted: ${await runtime.getSettingsPath()}`,
+                    ].join('\n');
                 case 'fast':
-                    return `Fast mode: ${isFastModePersistentlyEnabled(storage) ? 'enabled' : 'disabled'}`;
+                    return [
+                        `Fast mode: ${isFastModePersistentlyEnabled(storage) ? 'enabled' : 'disabled'}`,
+                        `- Persisted: ${await runtime.getSettingsPath()}`,
+                    ].join('\n');
                 case 'prime':
                     return executePrimeCommand({
                         argumentsText: 'status',

package/dist/native.d.ts

@@ -29,6 +29,7 @@ export interface PiVaultPollOptions {
 export declare class PiNativeRuntime {
     private readonly paths;
     private readonly initialization;
+    private readonly env;
     private vaultWatch;
     private closed;
     private closing;

package/dist/native.js

@@ -1,5 +1,5 @@
 import { resolve } from 'node:path';
-import { acquireNativeAccountRuntime, createNativeUsagePublisher, getAccountStatePath, getHostClaustrumEnrollmentPaths, isKillswitchEnabled, killswitchPassesPolicy, logger, nativeMigrationAuthorityPhase, nativeRuntimeOptionIdentity, quotaSnapshotHasStandardWindows, quotaSnapshotPassesModelScope, quotaSnapshotPassesPolicy, readNativeAccountsForRequest, readNativeMigrationJournal, resolveClaustrumConnectionPath, resolveNativePoolPaths, } from '@cortexkit/anthropic-auth-core';
+import { acquireNativeAccountRuntime, createNativeUsagePublisher, getAccountStatePath, getHostClaustrumEnrollmentPaths, isKillswitchEnabled, killswitchPassesPolicy, logger, nativeAccountCanServe, nativeMigrationAuthorityPhase, nativeRuntimeOptionIdentity, quotaSnapshotHasStandardWindows, quotaSnapshotPassesModelScope, quotaSnapshotPassesPolicy, readNativeAccountsForRequest, readNativeMigrationJournal, resolveClaustrumConnectionPath, resolveLocalRoutingDestination, resolveNativePoolPaths, } from '@cortexkit/anthropic-auth-core';
 import { getPiAccountStoragePath, getPiClaustrumConnectionOptions, getPiConfigDir, requirePiNativeHostAuth, } from './paths.js';
 export function piAttemptAccessToken(attempt) {
     return attempt.source === 'vault'
@@ -8,7 +8,7 @@ export function piAttemptAccessToken(attempt) {
 }
 function requestPolicy(routeId, modelId) {
     return (account, current) => {
-        if (!account.enabled)
+        if (!nativeAccountCanServe(account))
             return { status: 'blocked', reason: 'account-disabled' };
         if (account.source === 'local' && current.mode !== 'local')
             return { status: 'blocked', reason: 'local-mode-unavailable' };
@@ -61,12 +61,14 @@ export const PI_VAULT_POLL_INTERVAL_MS = 2000;
 export class PiNativeRuntime {
     paths;
     initialization;
+    env;
     vaultWatch;
     closed = false;
     closing;
     usagePublications = createNativeUsagePublisher('native-auth');
     constructor(storagePath, options = {}) {
         const env = { ...process.env };
+        this.env = env;
         const poll = options.vaultPoll ?? { intervalMs: PI_VAULT_POLL_INTERVAL_MS };
         const identity = getPiClaustrumConnectionOptions(storagePath).identity;
         this.paths = resolveNativePoolPaths(storagePath);
@@ -124,10 +126,13 @@ export class PiNativeRuntime {
         }
         // Keep local session-to-account assignments at the exact file destination
         // recorded by migration; guessing a new path would lose those assignments.
-        const journal = await readNativeMigrationJournal(await this.paths);
-        if (!journal ||
-            !nativeMigrationAuthorityPhase(journal) ||
-            !journal.routingPaths.destination)
+        const paths = await this.paths;
+        const journal = await readNativeMigrationJournal(paths);
+        if (!journal || !nativeMigrationAuthorityPhase(journal))
+            throw new Error('Pi native routing requires committed offline migration');
+        if (journal.kind === 'empty-init')
+            return { path: resolveLocalRoutingDestination('pi', paths, this.env) };
+        if (!journal.routingPaths.destination)
             throw new Error('Pi native routing requires committed offline migration');
         return { path: journal.routingPaths.destination };
     }
@@ -164,7 +169,7 @@ export class PiNativeRuntime {
         const runtime = await this.service();
         const snapshot = await runtime.read();
         const account = snapshot.accounts.find((candidate) => candidate.id === routeId);
-        if (!account?.enabled || account.type !== 'oauth')
+        if (!nativeAccountCanServe(account) || account?.type !== 'oauth')
             throw new Error('Pi native OAuth route is unavailable');
         const policy = requestPolicy(routeId, modelId);
         if (policy(account, snapshot).status === 'blocked')
@@ -264,7 +269,10 @@ export class PiNativeRuntime {
         this.vaultWatch?.close();
         this.closing ??= (async () => {
             await this.usagePublications.drain();
-            await this.initialization.then((runtime) => runtime.close(), () => { });
+            await this.initialization.then(async (runtime) => {
+                await runtime.drainQuotaPublications();
+                runtime.close();
+            }, () => { });
         })();
         return this.closing;
     }

package/dist/stream.d.ts

@@ -1,5 +1,7 @@
-import { type ApiKeyAccount, CacheKeepManager, type MidConversationEffortTransition } from '@cortexkit/anthropic-auth-core';
+import { type ApiKeyAccount, CacheKeepManager, type MidConversationEffortTransition, type QuotaManagerOptions } from '@cortexkit/anthropic-auth-core';
 import { type Api, type AssistantMessageEventStream, type Context, type Model, type SimpleStreamOptions } from '@earendil-works/pi-ai';
+/** Set or clear the test replacement for the wait between quota usage polls. */
+export declare function __setPiQuotaCallPauseForTest(pause: QuotaManagerOptions['pauseBetweenQuotaCalls']): void;
 export declare function clearPiStickyRoutingSession(storagePath: string, sessionId: string): Promise<void>;
 export declare function getPiTrackedCacheKeepSessions(): Promise<import("@cortexkit/anthropic-auth-core").CacheKeepTrackedSession[]>;
 /** Call prewarmNow directly to exercise its provider request without clock or timer mocks. */

package/dist/stream.js

@@ -1,4 +1,4 @@
-import { applyClaudeCodeHeaders, applyCustomHeaders, CACHE_KEEP_EXTENDED_TTL_BETA, CacheKeepManager, CacheKeepSessionRegistry, createProviderErrorResponseScope, createSseFramer, createStickyNoRouteResponse, decideStickyQuotaFailure, decodeSseFrame, dumpDirectRequest, FAST_MODE_BETA, getCache1hPersistentMode, getClaudeCodeIdentityForVerifiedAccount, getDefaultCacheKeepRegistryDirectory, getFallbackReauthLabels, getQuotaCheckIntervalMs, getRoutingMode, getScopedQuotaWindowForModel, getThinkingPrefixMismatchBehavior, hasThinkingBindingControls, isCache1hPersistentlyEnabled, isCacheKeepHybridActive, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, isKillswitchEnabled, isNativeTransientAccountError, isOAuthAccount, isPermanentRefreshError, isValidApiBaseURL, killswitchPassesPolicy, logger, MID_CONVERSATION_OUTPUT_CONFIG_BETA, mergeAnthropicBetas, NativeVaultNoAccountError, parseSseFrame, QuotaManager, quotaBackoffActive, quotaSnapshotHasStandardWindows, quotaSnapshotModelScopeIsExhausted, quotaSnapshotPassesModelScope, quotaSnapshotPassesPolicy, STICKY_ROUTING_MAIN_ACCOUNT_ID, StickySessionRouter, sendViaRelay, setDumpEnabled, shouldFallbackStatus, stickyQuotaSnapshotIsFresh, stickyRetryAfterWithJitter, stickyRouteFamilyForModel, THINKING_BINDING_CONTROLS_BETA, usesMidConversationOutputConfig, } from '@cortexkit/anthropic-auth-core';
+import { applyClaudeCodeHeaders, applyCustomHeaders, CACHE_KEEP_EXTENDED_TTL_BETA, CacheKeepManager, CacheKeepSessionRegistry, createProviderErrorResponseScope, createSseFramer, createStickyNoRouteResponse, decideStickyQuotaFailure, decodeSseFrame, dumpDirectRequest, FAST_MODE_BETA, getCache1hPersistentMode, getClaudeCodeIdentityForVerifiedAccount, getDefaultCacheKeepRegistryDirectory, getFallbackReauthLabels, getQuotaCheckIntervalMs, getRequestGzipLatch, getRequestGzipLatchPath, getRoutingMode, getScopedQuotaWindowForModel, getThinkingPrefixMismatchBehavior, isCache1hPersistentlyEnabled, isCacheKeepHybridActive, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, isKillswitchEnabled, isNativeTransientAccountError, isOAuthAccount, isPermanentRefreshError, isValidApiBaseURL, killswitchPassesPolicy, logger, mergeAnthropicBetas, NativeVaultNoAccountError, nativeAccountCanServe, parseSseFrame, QuotaManager, quotaBackoffActive, quotaSnapshotHasStandardWindows, quotaSnapshotModelScopeIsExhausted, quotaSnapshotPassesModelScope, quotaSnapshotPassesPolicy, STICKY_ROUTING_MAIN_ACCOUNT_ID, StickySessionRouter, sendViaRelay, sendWithRequestGzip, setDumpEnabled, shouldFallbackStatus, stickyQuotaSnapshotIsFresh, stickyRetryAfterWithJitter, stickyRouteFamilyForModel, } from '@cortexkit/anthropic-auth-core';
 import { calculateCost, createAssistantMessageEventStream, } from '@earendil-works/pi-ai';
 import { buildAnthropicRequest, fromClaudeCodeToolName } from './convert.js';
 import { getPiNativeRuntime, piAttemptAccessToken, } from './native.js';
@@ -11,6 +11,15 @@ let cacheKeepRegistryDirectory;
 const stickyRouters = new Map();
 const quotaManagers = new Map();
 const PI_SERVICE_CACHE_LIMIT = 16;
+/**
+ * Tests only: replaces the real-time wait between quota usage polls in quota
+ * managers created after it is set. Unset, managers keep Core's real timer.
+ */
+let quotaCallPauseForTest;
+/** Set or clear the test replacement for the wait between quota usage polls. */
+export function __setPiQuotaCallPauseForTest(pause) {
+    quotaCallPauseForTest = pause;
+}
 function setBoundedService(map, key, value) {
     map.delete(key);
     map.set(key, value);
@@ -37,11 +46,12 @@ function getPiRoutingServices(storagePath, snapshot) {
     if (!quotaManager) {
         quotaManager = new QuotaManager({
             storage,
+            pauseBetweenQuotaCalls: quotaCallPauseForTest,
             fetchQuotaSnapshot: async (request, dispatch) => {
                 const id = request.kind === 'main' ? 'main' : request.accountId;
                 if (!id)
                     throw new Error('Native quota request has no account identity');
-                return (await native.service()).fetchQuota(id, fetchPiOAuth, undefined, dispatch);
+                return (await native.service()).fetchQuota(id, fetchPiOAuth, undefined, dispatch, request.purpose);
             },
         });
         setBoundedService(quotaManagers, storagePath, {
@@ -59,9 +69,9 @@ function getPiRoutingServices(storagePath, snapshot) {
         const usable = [];
         for (const account of current.accounts) {
             const view = accounts.get(account.id);
-            if (!isOAuthAccount(account) || !view?.enabled || view.type !== 'oauth')
-                continue;
-            if (view.source === 'vault' && view.state !== 'active')
+            if (!isOAuthAccount(account) ||
+                !nativeAccountCanServe(view) ||
+                view?.type !== 'oauth')
                 continue;
             if (isPermanentRefreshError(view.lastRefreshError) ||
                 (view.source === 'local' &&
@@ -74,7 +84,7 @@ function getPiRoutingServices(storagePath, snapshot) {
                 quotas.isFallbackStale(account.id, undefined, options.modelId, account) &&
                 !quotaBackoffActive(account.lastQuotaRefreshError, Date.now())) {
                 try {
-                    await quotas.refreshFallback(account.id, '', account);
+                    await quotas.refreshFallback(account.id, '', account, 'admission');
                 }
                 catch (error) {
                     // A transient account error means another writer is still saving
@@ -117,6 +127,25 @@ function getPiCacheKeepRegistry() {
     }
     return cacheKeepRegistry;
 }
+/**
+ * Sets the Claude Code headers for a Pi OAuth request to Anthropic, with the
+ * betas this body needs. Model requests and CacheKeep prewarms both call it:
+ * a prewarm replays a model request's body, and Anthropic needs the same
+ * betas to accept it (for example, the effort beta for the empty
+ * `role: "system"` effort markers in a Fable 5.1 body). `leadingBetas` appends
+ * adapter-requested feature betas without changing Core's model-beta selection.
+ */
+function applyPiOAuthRequestHeaders(headers, accessToken, options) {
+    const { body } = options;
+    applyClaudeCodeHeaders(headers, accessToken, {
+        body,
+        identity: options.identity,
+        extraBetas: options.leadingBetas,
+    });
+    if (body.speed === 'fast')
+        headers.set('anthropic-beta', mergeAnthropicBetas(headers.get('anthropic-beta'), [FAST_MODE_BETA]));
+    return headers;
+}
 const nativePrewarmAttempts = new Map();
 const cacheKeepManager = new CacheKeepManager({
     fetchImpl: fetchPiOAuth,
@@ -136,18 +165,11 @@ const cacheKeepManager = new CacheKeepManager({
             ? (current.policyStorage.mainAccountId ?? id)
             : id, served.accountIdentity);
         headers.delete('anthropic-beta');
-        applyClaudeCodeHeaders(headers, piAttemptAccessToken(served), {
+        applyPiOAuthRequestHeaders(headers, piAttemptAccessToken(served), {
             body,
             identity,
-            extraBetas: [
-                CACHE_KEEP_EXTENDED_TTL_BETA,
-                ...(hasThinkingBindingControls(body)
-                    ? [THINKING_BINDING_CONTROLS_BETA]
-                    : []),
-            ],
+            leadingBetas: [CACHE_KEEP_EXTENDED_TTL_BETA],
         });
-        if (body.speed === 'fast')
-            headers.set('anthropic-beta', mergeAnthropicBetas(headers.get('anthropic-beta'), [FAST_MODE_BETA]));
         nativePrewarmAttempts.set(attempt.id, { runtime, served, reported: false });
         return headers;
     },
@@ -343,20 +365,7 @@ async function sendAnthropicRequest(options) {
     const fastMode = body.speed === 'fast';
     const headers = options.apiAccount
         ? new Headers()
-        : applyClaudeCodeHeaders(new Headers(), '', {
-            body,
-            identity,
-            extraBetas: [
-                ...(hasThinkingBindingControls(body)
-                    ? [THINKING_BINDING_CONTROLS_BETA]
-                    : []),
-                ...(usesMidConversationOutputConfig(body)
-                    ? [MID_CONVERSATION_OUTPUT_CONFIG_BETA]
-                    : []),
-            ],
-        });
-    if (!options.apiAccount && fastMode)
-        headers.set('anthropic-beta', mergeAnthropicBetas(headers.get('anthropic-beta'), [FAST_MODE_BETA]));
+        : applyPiOAuthRequestHeaders(new Headers(), '', { body, identity });
     const relayAffinity = options.streamOptions?.sessionId ?? null;
     let input = options.apiAccount
         ? new URL('https://api.anthropic.com/v1/messages')
@@ -435,7 +444,17 @@ async function sendAnthropicRequest(options) {
         const send = async () => {
             const scope = createProviderErrorResponseScope([secret], 'event-stream');
             physical.scope = scope;
-            return scope.redactResponse(await fetch(input, init));
+            // OAuth bodies go gzipped as Claude Code sends them; `bodyText` stays
+            // the signed identity text for dumps and CacheKeep.
+            if (options.apiAccount || typeof init.body !== 'string')
+                return scope.redactResponse(await fetch(input, init));
+            return scope.redactResponse(await sendWithRequestGzip({
+                url: input,
+                body: init.body,
+                headers,
+                latch: getRequestGzipLatch(getRequestGzipLatchPath(options.storagePath)),
+                send: (wireBody, wireHeaders) => fetch(input, { ...init, body: wireBody, headers: wireHeaders }),
+            }));
         };
         let response;
         try {
@@ -471,6 +490,11 @@ async function sendAnthropicRequest(options) {
             }
             if (attempt)
                 await report(attempt, response.status, 'direct');
+            // The vault has been told about the 401 above. If the request was
+            // cancelled after the 401 arrived (before or while the vault was asked
+            // for a newer credential), end it as cancelled here.
+            if (attempt && response.status === 401)
+                await endIfCancelled(response, init.signal);
             await dumpDirectRequest({
                 affinity: relayAffinity,
                 route: options.route ??
@@ -565,10 +589,27 @@ async function sendAnthropicRequest(options) {
             await Promise.all(relayReports);
         }
     }
+    // A relayed 401 is reported to the vault as soon as the relay returns it.
+    // If the request was cancelled since, end it as cancelled here.
+    if (relay401Attempt && response.status === 401)
+        await endIfCancelled(response, init.signal);
     if (response.ok && lastTransport === 'relay' && relayAttempt)
         markServed(relayAttempt);
     return response;
 }
+/**
+ * If the request's signal is aborted, cancels the response body and throws the
+ * signal's abort error; otherwise does nothing. Call it before a rejected
+ * response is handed to account routing. Routing treats a returned 401 as a
+ * failure of the account and may move the session to another account (sticky
+ * migration); a request the user cancelled must end as cancelled instead.
+ */
+async function endIfCancelled(response, signal) {
+    if (!signal?.aborted)
+        return;
+    await response.body?.cancel().catch(() => { });
+    signal.throwIfAborted();
+}
 function quotaSnapshotIsExhausted(quota) {
     return ['five_hour', 'seven_day'].some((key) => (quota?.[key]?.remainingPercent ?? 1) <= 0);
 }
@@ -708,8 +749,7 @@ async function executeWithFallback(options) {
     const nativeReady = (id) => {
         const account = accountView(id);
         return Boolean(account?.type === 'oauth' &&
-            account.enabled &&
-            (account.source !== 'vault' || account.state === 'active') &&
+            nativeAccountCanServe(account) &&
             !isPermanentRefreshError(account.lastRefreshError) &&
             (account.source !== 'local' ||
                 (account.lastRefreshError?.nextRetryAt ?? 0) <= Date.now()));
@@ -750,7 +790,7 @@ async function executeWithFallback(options) {
         if (primaryAvailable() &&
             !stickyQuotaSnapshotIsFresh(mainEntry?.quota, storage, Date.now(), modelId)) {
             try {
-                mainQuota = await quotaManager.refreshMain(mainAccountId, '');
+                mainQuota = await quotaManager.refreshMain(mainAccountId, '', undefined, 'admission');
             }
             catch { }
         }
@@ -767,7 +807,7 @@ async function executeWithFallback(options) {
             });
         }
         for (const [index, configured] of (storage?.accounts ?? []).entries()) {
-            if (configured.enabled === false || !isOAuthAccount(configured))
+            if (!nativeAccountCanServe(configured) || !isOAuthAccount(configured))
                 continue;
             const account = usableById.get(configured.id) ?? configured;
             if (!nativeReady(account.id))
@@ -775,7 +815,7 @@ async function executeWithFallback(options) {
             let accountQuota = quotaManager.getFallback(account.id, account)?.quota ?? account.quota;
             if (!stickyQuotaSnapshotIsFresh(accountQuota, storage, Date.now(), modelId)) {
                 try {
-                    accountQuota = await quotaManager.refreshFallback(account.id, '', account);
+                    accountQuota = await quotaManager.refreshFallback(account.id, '', account, 'admission');
                 }
                 catch { }
             }
@@ -883,7 +923,7 @@ async function executeWithFallback(options) {
         });
         const usableOAuthById = new Map(usableOAuth.map((account) => [account.id, account]));
         for (const configured of storage.accounts) {
-            if (configured.enabled === false)
+            if (!nativeAccountCanServe(configured))
                 continue;
             let response;
             if (isOAuthAccount(configured)) {
@@ -904,8 +944,8 @@ async function executeWithFallback(options) {
             }
             else if (routeOptions.includeApiRoutes) {
                 const account = accountView(configured.id);
-                if (!account?.enabled ||
-                    account.type !== 'api' ||
+                if (!nativeAccountCanServe(account) ||
+                    account?.type !== 'api' ||
                     !isValidApiBaseURL(account.baseURL))
                     continue;
                 response = await sendAnthropicRequest({
@@ -1043,6 +1083,8 @@ async function executeWithFallback(options) {
                 migrate = decision.action === 'migrate';
             }
             if (migrate) {
+                // A cancelled request must not move the session's account.
+                await endIfCancelled(preflight instanceof Response ? preflight : response, options.streamOptions?.signal);
                 const failedRouteId = route.id;
                 routes = await buildStickyRoutes(options.model.id);
                 if (routes.candidates.some((candidate) => candidate.accountId !== failedRouteId)) {
@@ -1120,7 +1162,7 @@ async function executeWithFallback(options) {
         let mainQuota = quotaManager.getMain(mainAccountId)?.quota;
         if (!mainQuota || quotaManager.isMainStale(options.model.id)) {
             try {
-                mainQuota = await quotaManager.refreshMain(mainAccountId, '');
+                mainQuota = await quotaManager.refreshMain(mainAccountId, '', undefined, 'admission');
             }
             catch { }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/pi-anthropic-auth",
-  "version": "2.0.2",
+  "version": "2.1.0",
   "type": "module",
   "repository": {
     "type": "git",
@@ -36,7 +36,7 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@cortexkit/anthropic-auth-core": "2.0.2"
+    "@cortexkit/anthropic-auth-core": "2.1.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": ">=0.86.1 <2",