@cortexkit/pi-anthropic-auth 2.4.2 → 2.4.4

package/dist/native.d.ts

@@ -67,7 +67,7 @@ export declare class PiNativeRuntime {
     view(signal?: AbortSignal): Promise<NativeAccountSnapshot>;
     /** Admit a model request without rediscovering a healthy roster. */
     requestView(signal?: AbortSignal): Promise<NativeAccountSnapshot>;
-    authorize(routeId: string, signal?: AbortSignal, modelId?: string): Promise<PiNativeAttempt>;
+    authorize(routeId: string, signal?: AbortSignal, modelId?: string, intent?: 'serve' | 'cachekeep'): Promise<PiNativeAttempt>;
     retry(routeId: string, served: PiNativeAttempt, signal?: AbortSignal, modelId?: string): Promise<PiNativeAttempt | undefined>;
     report(served: PiNativeAttempt, status: number, source: NativeCustodyReporterSource): Promise<void>;
     markUsed(served: PiNativeAttempt, servingRuntime?: NativeAccountRuntime): Promise<void>;

package/dist/native.js

@@ -1,5 +1,5 @@
 import { resolve } from 'node:path';
-import { acquireNativeAccountRuntime, createNativeUsagePublisher, decidePiStateLayout, getAccountStatePath, getHostClaustrumEnrollmentPaths, isKillswitchEnabled, killswitchPassesPolicy, LEGACY_STATE_LAYOUT, logger, nativeAccountCanServe, nativeMigrationAuthorityPhase, nativeRuntimeOptionIdentity, quotaSnapshotHasStandardWindows, quotaSnapshotPassesModelScope, quotaSnapshotPassesPolicy, readNativeAccountsForRequest, readNativeMigrationJournal, resolveClaustrumConnectionPath, resolveLocalRoutingDestination, resolveNativePoolPaths, } from '@cortexkit/anthropic-auth-core';
+import { acquireNativeAccountRuntime, createNativeUsagePublisher, decidePiStateLayout, getAccountStatePath, getHostClaustrumEnrollmentPaths, getPersistedLogLevel, isKillswitchEnabled, killswitchPassesPolicy, LEGACY_STATE_LAYOUT, logger, NativeAccountRefusal, nativeAccountCanServe, nativeAccountRefusal, nativeLocalAccountRefusal, nativeMigrationAuthorityPhase, nativeRuntimeOptionIdentity, quotaSnapshotHasStandardWindows, quotaSnapshotPassesModelScope, quotaSnapshotPassesPolicy, readNativeAccountsForRequest, readNativeMigrationJournal, resolveClaustrumConnectionPath, resolveLocalRoutingDestination, resolveNativePoolPaths, setLogLevel, } from '@cortexkit/anthropic-auth-core';
 import { getPiAccountStoragePath, getPiClaustrumConnectionOptions, getPiConfigDir, requirePiNativeHostAuth, } from './paths.js';
 export function piAttemptAccessToken(attempt) {
     return attempt.source === 'vault'
@@ -125,6 +125,14 @@ export class PiNativeRuntime {
                     identity,
                 },
             });
+            // Apply local or vault preferences before the watcher can log. Match
+            // OpenCode's startup precedence without blocking migration refusals.
+            try {
+                const initial = await runtime.read();
+                if (!env.OPENCODE_ANTHROPIC_AUTH_LOG_LEVEL)
+                    setLogLevel(getPersistedLogLevel(initial.policyStorage) ?? 'info');
+            }
+            catch { }
             if (this.closed)
                 runtime.close();
             // Refresh returns at once while this host uses local accounts, so the
@@ -206,19 +214,31 @@ export class PiNativeRuntime {
         const runtime = await this.service();
         return readNativeAccountsForRequest(runtime, signal);
     }
-    async authorize(routeId, signal, modelId) {
+    async authorize(routeId, signal, modelId, intent = 'serve') {
+        const background = intent === 'cachekeep';
         const runtime = await this.service();
         const snapshot = await runtime.read();
         const account = snapshot.accounts.find((candidate) => candidate.id === routeId);
         if (!nativeAccountCanServe(account) || account?.type !== 'oauth')
-            throw new Error('Pi native OAuth route is unavailable');
+            throw background
+                ? new NativeAccountRefusal('account-unavailable')
+                : new Error('Pi native OAuth route is unavailable');
         const policy = requestPolicy(routeId, modelId);
         if (policy(account, snapshot).status === 'blocked')
-            throw new Error('Pi native quota policy refused the OAuth route');
+            throw background
+                ? new NativeAccountRefusal('account-policy')
+                : new Error('Pi native quota policy refused the OAuth route');
         if (snapshot.mode === 'claustrum') {
-            const receipt = await runtime.authorizeVault(routeId, signal);
+            const receipt = await runtime
+                .authorizeVault(routeId, signal)
+                .catch((error) => {
+                const refusal = background && nativeAccountRefusal(error);
+                throw refusal || error;
+            });
             if (!receipt.assertedAccountIdentity)
-                throw new Error('Pi native OAuth identity is unasserted');
+                throw background
+                    ? new NativeAccountRefusal('account-unavailable')
+                    : new Error('Pi native OAuth identity is unasserted');
             const current = await runtime.read();
             const admitted = current.accounts.find((candidate) => candidate.id === routeId);
             // After the vault lookup, recheck quota limits for this request’s model.
@@ -227,7 +247,13 @@ export class PiNativeRuntime {
                 current.mode !== 'claustrum' ||
                 admitted.accountIdentity !== receipt.assertedAccountIdentity ||
                 requestPolicy(routeId, modelId)(admitted, current).status === 'blocked')
-                throw new Error('Pi native quota policy refused the OAuth route');
+                throw background
+                    ? new NativeAccountRefusal(!admitted || current.mode !== 'claustrum'
+                        ? 'account-unavailable'
+                        : admitted.accountIdentity !== receipt.assertedAccountIdentity
+                            ? 'credential-changed'
+                            : 'account-policy')
+                    : new Error('Pi native quota policy refused the OAuth route');
             return {
                 source: 'vault',
                 accountIdentity: receipt.assertedAccountIdentity,
@@ -235,8 +261,16 @@ export class PiNativeRuntime {
             };
         }
         const admission = await runtime.authorizeLocal(routeId, { signal, policy });
-        if (admission.status !== 'usable' || !admission.binding.identity)
+        if (admission.status !== 'usable') {
+            const refusal = background && nativeLocalAccountRefusal(admission);
+            if (refusal)
+                throw refusal;
             throw new Error('Pi native OAuth admission refused');
+        }
+        if (!admission.binding.identity)
+            throw background
+                ? new NativeAccountRefusal('account-unavailable')
+                : new Error('Pi native OAuth admission refused');
         return {
             source: 'local',
             accountIdentity: admission.binding.identity,

package/dist/stream.js

@@ -1,4 +1,4 @@
-import { applyClaudeCodeHeaders, applyCustomHeaders, CACHE_KEEP_EXTENDED_TTL_BETA, CacheKeepManager, CacheKeepSessionRegistry, createProviderErrorResponseScope, createSseFramer, createStickyNoRouteResponse, decideStickyQuotaFailure, decodeSseFrame, dumpDirectRequest, FAST_MODE_BETA, getCache1hPersistentMode, getClaudeCodeIdentityForVerifiedAccount, getDefaultCacheKeepRegistryDirectory, getFallbackReauthLabels, getQuotaCheckIntervalMs, getRequestGzipLatch, getRequestGzipLatchPath, getRoutingMode, getScopedQuotaWindowForModel, getThinkingPrefixMismatchBehavior, isCache1hPersistentlyEnabled, isCacheKeepHybridActive, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, isKillswitchEnabled, isNativeTransientAccountError, isOAuthAccount, isPermanentRefreshError, isValidApiBaseURL, killswitchPassesPolicy, logger, mergeAnthropicBetas, NativeVaultNoAccountError, nativeAccountCanServe, parseSseFrame, QuotaManager, quotaBackoffActive, quotaSnapshotHasStandardWindows, quotaSnapshotModelScopeIsExhausted, quotaSnapshotPassesModelScope, quotaSnapshotPassesPolicy, STICKY_ROUTING_MAIN_ACCOUNT_ID, StickySessionRouter, sendViaRelay, sendWithRequestGzip, setDumpEnabled, shouldFallbackStatus, stickyQuotaSnapshotIsFresh, stickyRetryAfterWithJitter, stickyRouteFamilyForModel, } from '@cortexkit/anthropic-auth-core';
+import { applyClaudeCodeHeaders, applyCustomHeaders, CACHE_KEEP_EXTENDED_TTL_BETA, CacheKeepManager, CacheKeepSessionRegistry, createProviderErrorResponseScope, createSseFramer, createStickyNoRouteResponse, decideStickyQuotaFailure, decodeSseFrame, dumpDirectRequest, FAST_MODE_BETA, getCache1hPersistentMode, getClaudeCodeIdentityForVerifiedAccount, getDefaultCacheKeepRegistryDirectory, getFallbackReauthLabels, getQuotaCheckIntervalMs, getRequestGzipLatch, getRequestGzipLatchPath, getRoutingMode, getScopedQuotaWindowForModel, getThinkingPrefixMismatchBehavior, isCache1hPersistentlyEnabled, isCacheKeepHybridActive, isDumpPersistentlyEnabled, isFastModePersistentlyEnabled, isKillswitchEnabled, isNativeTransientAccountError, isOAuthAccount, isPermanentRefreshError, isValidApiBaseURL, killswitchPassesPolicy, logger, mergeAnthropicBetas, NativeAccountRefusal, NativeVaultNoAccountError, nativeAccountCanServe, parseSseFrame, QuotaManager, quotaBackoffActive, quotaSnapshotHasStandardWindows, quotaSnapshotModelScopeIsExhausted, quotaSnapshotPassesModelScope, quotaSnapshotPassesPolicy, STICKY_ROUTING_MAIN_ACCOUNT_ID, StickySessionRouter, sendViaRelay, sendWithRequestGzip, setDumpEnabled, shouldFallbackStatus, stickyQuotaSnapshotIsFresh, stickyRetryAfterWithJitter, stickyRouteFamilyForModel, } from '@cortexkit/anthropic-auth-core';
 import { calculateCost, createAssistantMessageEventStream, } from '@earendil-works/pi-ai';
 import { buildAnthropicRequest, fromClaudeCodeToolName } from './convert.js';
 import { getPiNativeRuntime, piAttemptAccessToken, } from './native.js';
@@ -164,10 +164,10 @@ const cacheKeepManager = new CacheKeepManager({
         const id = target.oauthAccountId ?? STICKY_ROUTING_MAIN_ACCOUNT_ID;
         const current = await runtime.view();
         const body = JSON.parse(target.bodyText);
-        const served = await runtime.authorize(id, attempt.signal, typeof body.model === 'string' ? body.model : undefined);
+        const served = await runtime.authorize(id, attempt.signal, typeof body.model === 'string' ? body.model : undefined, 'cachekeep');
         if (!target.oauthAccountIdentity ||
             served.accountIdentity !== target.oauthAccountIdentity)
-            throw new Error('CacheKeep account identity changed');
+            throw new NativeAccountRefusal('credential-changed');
         const identity = getClaudeCodeIdentityForVerifiedAccount(id === STICKY_ROUTING_MAIN_ACCOUNT_ID
             ? (current.policyStorage.mainAccountId ?? id)
             : id, served.accountIdentity);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/pi-anthropic-auth",
-  "version": "2.4.2",
+  "version": "2.4.4",
   "type": "module",
   "repository": {
     "type": "git",
@@ -36,7 +36,7 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@cortexkit/anthropic-auth-core": "2.4.2"
+    "@cortexkit/anthropic-auth-core": "2.4.4"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": ">=0.86.1 <2",