@cortexkit/pi-antigravity-auth 3.0.4 → 3.0.6

package/dist/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAG9B,MAAM,kCAAkC,CAAA;AACzC,OAAO,KAAK,EAEV,kBAAkB,EACnB,MAAM,uDAAuD,CAAA;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAA;AAEnE,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,YAAY,EAIlB,MAAM,kBAAkB,CAAA;AAEzB,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,uBAAuB,CAAA;IACjC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACrC,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACvD;AAED,wBAAgB,4BAA4B,CAC1C,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC,EACzC,OAAO,EAAE,2BAA2B,GACnC,IAAI,CAkBN;AAMD;;;;GAIG;AACH,MAAM,MAAM,4BAA4B,GAAG,uBAAuB,CAAA;AAElE,MAAM,WAAW,mCAAmC;IAClD,KAAK,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAA;IAClC,QAAQ,EAAE,MAAM,mBAAmB,CAAA;CACpC;AA4CD,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,mCAAmC,GAC3C,4BAA4B,CA0G9B"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAG9B,MAAM,kCAAkC,CAAA;AACzC,OAAO,KAAK,EAEV,kBAAkB,EACnB,MAAM,uDAAuD,CAAA;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAA;AAEnE,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,YAAY,EAOlB,MAAM,kBAAkB,CAAA;AAEzB,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,uBAAuB,CAAA;IACjC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACrC,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACvD;AAED,wBAAgB,4BAA4B,CAC1C,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC,EACzC,OAAO,EAAE,2BAA2B,GACnC,IAAI,CAkBN;AAMD;;;;GAIG;AACH,MAAM,MAAM,4BAA4B,GAAG,uBAAuB,CAAA;AAElE,MAAM,WAAW,mCAAmC;IAClD,KAAK,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAA;IAClC,QAAQ,EAAE,MAAM,mBAAmB,CAAA;CACpC;AA4CD,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,mCAAmC,GAC3C,4BAA4B,CA4G9B"}

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/index.ts
-import { join as join2 } from "node:path";
+import { join } from "node:path";
 import {
   ANTIGRAVITY_PROVIDER_ID as ANTIGRAVITY_PROVIDER_ID2,
   authorizeAntigravity,
@@ -26,7 +26,10 @@ import { createHash, randomBytes } from "node:crypto";
 import { readFileSync } from "node:fs";
 import {
   ANTIGRAVITY_PROVIDER_ID,
-  enrollmentAuthority
+  enrollmentAuthority,
+  sharedVaultTokenFolder,
+  sharedVaultTokenFolderOutcome,
+  sharedVaultTokenFolderText
 } from "@cortexkit/antigravity-auth-core";
 import { writeJsonAtomic } from "@cortexkit/antigravity-auth-core/atomic-write";
 var PI_ANTIGRAVITY_PROVIDER_ID = ANTIGRAVITY_PROVIDER_ID;
@@ -62,16 +65,19 @@ function readPiVaultMode(path) {
   } catch (error) {
     if (error?.code === "ENOENT")
       return { ok: true, record: LOCAL_MODE };
-    return { ok: false, reason: "the vault mode file could not be read" };
+    return { ok: false, reason: "its vault settings file could not be read" };
   }
   let raw;
   try {
     raw = JSON.parse(text);
   } catch {
-    return { ok: false, reason: "the vault mode file is not valid JSON" };
+    return { ok: false, reason: "its vault settings file is damaged" };
   }
   const record = parseModeRecord(raw);
-  return record ? { ok: true, record } : { ok: false, reason: "the vault mode file has an unknown shape" };
+  return record ? { ok: true, record } : {
+    ok: false,
+    reason: "its vault settings file holds settings it does not understand"
+  };
 }
 async function writePiVaultMode(path, record) {
   const value = record.routeId === void 0 ? { version: 1, mode: record.mode } : { version: 1, mode: record.mode, routeId: record.routeId };
@@ -177,7 +183,7 @@ var PiVaultSetup = class {
     );
     if (enrollment.state !== "approved")
       throw new PiVaultSetupError(
-        "Pi is not enrolled with the vault yet. Request access and wait for the operator to approve it first."
+        "Pi doesn't have vault access yet. Choose Request vault access and wait for the vault operator to approve it."
       );
     if (routeId !== void 0 && routeId.trim() === "")
       throw new PiVaultSetupError("Choose a vault account to use.");
@@ -194,7 +200,7 @@ var PiVaultSetup = class {
       this.#options.claustrum
     ) !== "local") {
       throw new PiVaultSetupError(
-        "Disconnect vault enrollment before using local accounts."
+        "Disconnect from the vault before switching to Pi's own login."
       );
     }
     await writePiVaultMode(this.#options.modeFile, LOCAL_MODE);
@@ -213,7 +219,7 @@ var PiVaultSetup = class {
     );
     if (result === "busy")
       throw new PiVaultSetupError(
-        "Vault enrollment is busy; disconnect did not change it."
+        "Another vault setup step is running, so Pi is still connected to the vault. Try again in a moment."
       );
     await writePiVaultMode(this.#options.modeFile, LOCAL_MODE);
     await this.#options.onModeChanged?.(LOCAL_MODE);
@@ -222,42 +228,48 @@ var PiVaultSetup = class {
 function describeEnrollment(status) {
   switch (status.state) {
     case "idle":
-      return "not requested";
+      return "Vault access: not requested yet.";
     case "pending":
-      return status.retryCode ? `waiting for operator approval (retrying: ${status.retryCode})` : "waiting for operator approval";
+      return status.retryCode ? `Vault access: the vault can't take Pi's request right now; Pi asks again the next time it checks (reference: ${status.retryCode}).` : "Vault access: waiting for the vault operator to approve this request.";
     case "approved":
-      return `approved as ${status.approvedName ?? status.proposedName}`;
+      return "Vault access: approved by the vault operator.";
     case "denied":
-      return "denied by the operator";
+      return "Vault access: the vault operator denied the request. Choose Request vault access to ask again.";
     case "blocked":
-      return `blocked (${status.code})`;
+      if (status.code === "pending_exists")
+        return "Vault access: the vault turned down a new request because an earlier request from Pi is still waiting.";
+      if (status.code === "missing_token")
+        return "Vault access: approved, but Pi's vault key is missing from this computer. Disconnect from the vault, then request vault access again.";
+      if (status.code === "unreadable-state")
+        return "Vault access: Pi can't read its record of the vault request. Disconnect from the vault, then request vault access again.";
+      return `Vault access: the vault ended this request (reference: ${status.code}). Choose Request vault access to start a new one.`;
     case "unavailable":
-      return `vault unavailable (${status.code})`;
+      return `Vault access: Pi can't reach the vault right now. Try again later (reference: ${status.code}).`;
     case "busy":
-      return "another setup step is running";
+      return "Vault access: another vault setup step is running. Try again in a moment.";
   }
 }
 var PI_VAULT_GRANT_COMMAND = `ck auth grant --principal enrolled:${PI_ANTIGRAVITY_ENROLLMENT_NAME} --selector-kind category --selector antigravity-native --operation read`;
 function piPendingEnrollmentGuidance(requestId) {
   return [
     "Next, the vault operator runs these outside Pi:",
-    requestId === void 0 ? "1. Find the request ID with ck auth enroll list, then approve it: ck auth enroll approve --request-id <id>" : `1. Approve the request: ck auth enroll approve --request-id ${requestId}`,
+    requestId === void 0 ? `1. Find the request from ${PI_ANTIGRAVITY_ENROLLMENT_NAME} with ck auth enroll list, then approve it: ck auth enroll approve --request-id <id>` : `1. Approve the request: ck auth enroll approve --request-id ${requestId}`,
     `2. Grant read access: ${PI_VAULT_GRANT_COMMAND}`,
-    "Both are needed: an approval without the grant serves Pi no accounts.",
-    "3. Pi switches to the vault once it sees the approval; Request vault access checks again."
+    "Both are needed: without the grant, Pi can see no accounts in the vault.",
+    "3. Pi switches to the vault once it sees the approval. Choose Request vault access to check again."
   ];
 }
 function piPendingExistsGuidance() {
   return [
-    `An earlier request for ${PI_ANTIGRAVITY_ENROLLMENT_NAME} is still pending in the vault, possibly from an enrollment forgotten here.`,
+    "The earlier request may come from a vault setup that was disconnected here before the operator answered it.",
     "It expires 15 minutes after it was made; request vault access again after that.",
-    "Or the vault operator clears it now: find its ID with ck auth enroll list, run ck auth enroll deny --request-id <id>, then request vault access again here."
+    `Or the vault operator clears it now: find the request from ${PI_ANTIGRAVITY_ENROLLMENT_NAME} with ck auth enroll list, run ck auth enroll deny --request-id <id>, then request vault access again here.`
   ];
 }
 function piNoVaultAccountsGuidance() {
   return [
-    `Enrollment is approved, but the vault serves ${PI_ANTIGRAVITY_ENROLLMENT_NAME} no Antigravity accounts.`,
-    `The vault operator grants read access with: ${PI_VAULT_GRANT_COMMAND}`
+    "The vault operator approved Pi, but Pi can't see any Antigravity accounts in the vault yet.",
+    `If the operator has not granted Pi read access yet, they run: ${PI_VAULT_GRANT_COMMAND}`
   ];
 }
 function enrollmentGuidance(status) {
@@ -267,28 +279,20 @@ function enrollmentGuidance(status) {
     return piPendingExistsGuidance();
   return [];
 }
-function describeHostSlot(slot) {
-  switch (slot) {
-    case "login":
-      return "signed in with a Pi login";
-    case "placeholder":
-      return "holds the vault placeholder";
-    case "empty":
-      return "empty";
+function describeSource(status) {
+  switch (status.mode) {
+    case "custody":
+      return "Using the vault for Antigravity accounts; Pi's own login is set aside.";
+    case "local":
+      return status.hostSlot === "login" ? "Using Pi's own login (the account you signed in with /login), not the vault." : status.hostSlot === "dormant" ? "Using Pi's own login, not the vault." : "Using Pi's own login, not the vault, but you are not signed in. Run /login to sign in.";
+    case "unreadable":
+      return status.modeProblem === void 0 ? "Pi can't tell whether to use the vault or its own login, so it sends no Antigravity requests." : `Pi can't tell whether to use the vault or its own login (${status.modeProblem}), so it sends no Antigravity requests.`;
   }
 }
 function formatPiVaultSetupStatus(status) {
-  const lines = [
-    `Mode: ${status.mode === "custody" ? "vault (custody)" : status.mode === "local" ? "local Pi login" : `unreadable (${status.modeProblem ?? "unknown problem"})`}`,
-    `Enrollment (${PI_ANTIGRAVITY_ENROLLMENT_NAME}): ${describeEnrollment(status.enrollment)}`,
-    status.hostSlot === "dormant" ? "Pi auth slot: dormant (not read)" : `Pi auth slot: ${describeHostSlot(status.hostSlot)}`
-  ];
-  if (status.selectedRouteId !== void 0)
-    lines.push("Vault account: a specific account is chosen (marked below)");
-  if (status.mode === "local" && status.hostSlot === "placeholder")
-    lines.push(
-      "Conflict: local mode has no login to serve. Run /login or switch to the vault."
-    );
+  const lines = [describeSource(status), describeEnrollment(status.enrollment)];
+  if (status.mode === "custody" && status.selectedRouteId !== void 0)
+    lines.push('Pi uses the vault account marked "in use by Pi" below.');
   lines.push(...enrollmentGuidance(status.enrollment));
   return lines;
 }
@@ -296,6 +300,9 @@ var ITEM_ID_SALT = randomBytes(16);
 function vaultAccountName(listed, account) {
   return `Vault account ${listed.indexOf(account) + 1}`;
 }
+var VAULT_ACCOUNT_IN_USE = "in use by Pi";
+var VAULT_ACCOUNT_AVAILABLE = "available";
+var VAULT_ACCOUNT_TURNED_OFF = "turned off for Pi on this computer";
 function opaqueItemId(routeId) {
   return `vault-${createHash("sha256").update(ITEM_ID_SALT).update(routeId).digest("hex").slice(0, 16)}`;
 }
@@ -307,6 +314,11 @@ function refused(error) {
     return { ok: false, text: error.message, code: "vault-refused" };
   throw error;
 }
+function sharedFolderRefusal(error) {
+  const outcome = sharedVaultTokenFolderOutcome(error);
+  if (outcome) return outcome;
+  throw error;
+}
 async function waitForApproval(setup, wait = {}) {
   const sleep = wait.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
   const interval = wait.pollIntervalMs ?? 2e3;
@@ -333,7 +345,7 @@ function createPiVaultSection(options) {
     }
   };
   const stepText = async (step, suffix = "") => [
-    `Enrollment: ${describeEnrollment(step)}${suffix}`,
+    `${describeEnrollment(step)}${suffix}`,
     ...enrollmentGuidance(step),
     ...step.state === "approved" ? await approvedRosterGuidance() : []
   ].join("\n");
@@ -356,36 +368,36 @@ function createPiVaultSection(options) {
             items.push({
               id: opaqueItemId(account.routeId),
               label: name,
-              detail: account.declined ? "declined on this host" : serving ? "serving Pi" : "available",
+              detail: account.declined ? VAULT_ACCOUNT_TURNED_OFF : serving ? VAULT_ACCOUNT_IN_USE : VAULT_ACCOUNT_AVAILABLE,
               actions: account.declined ? [
                 {
                   id: "accept",
-                  label: "Accept on this host",
+                  label: "Turn back on for Pi",
                   run: async () => {
                     await port.accept(account.routeId);
-                    return `${name} is accepted on this host.`;
+                    return `Pi can use ${name} again.`;
                   }
                 }
               ] : [
                 {
                   id: "use",
-                  label: "Serve Pi from this account",
+                  label: "Use this account",
                   run: async () => {
                     try {
                       await setup.useVault(account.routeId);
                     } catch (error) {
                       return refused(error);
                     }
-                    return `Pi now serves Antigravity from ${name}.`;
+                    return `Pi now uses ${name} for Antigravity.`;
                   }
                 },
                 {
                   id: "decline",
-                  label: "Decline on this host",
-                  description: "It stays in the vault and in this list, and is never sent from this host until accepted again.",
+                  label: "Turn off for Pi",
+                  description: "The account stays in the vault and in this list, but Pi on this computer never uses it until you turn it back on.",
                   run: async () => {
                     await port.decline(account.routeId);
-                    return `${name} is declined on this host.`;
+                    return `Pi on this computer won't use ${name} until you turn it back on.`;
                   }
                 }
               ]
@@ -394,10 +406,12 @@ function createPiVaultSection(options) {
           if (listed.length === 0) lines.push(...piNoVaultAccountsGuidance());
           else if (status.mode !== "custody")
             lines.push(
-              "Next: choose Serve Pi from the vault to serve Pi from these accounts."
+              "Next: choose Use the vault to have Pi use these accounts."
             );
         } catch (error) {
-          lines.push(`Vault accounts unavailable: ${errorText(error)}`);
+          lines.push(
+            `Pi can't load the vault accounts right now: ${errorText(error)}`
+          );
         }
       }
       const actions = [];
@@ -405,9 +419,14 @@ function createPiVaultSection(options) {
         actions.push({
           id: "request-access",
           label: "Request vault access",
-          description: `Asks the vault to enroll Pi as ${PI_ANTIGRAVITY_ENROLLMENT_NAME}; the operator approves it in the vault.`,
+          description: "Asks the vault operator to let Pi use the vault's Antigravity accounts.",
           run: async ({ invocation }) => {
-            const step = await setup.connectStep();
+            let step;
+            try {
+              step = await setup.connectStep();
+            } catch (error) {
+              return sharedFolderRefusal(error);
+            }
             if (step.state !== "pending" && step.state !== "busy")
               return {
                 ok: step.state === "approved",
@@ -422,8 +441,9 @@ function createPiVaultSection(options) {
                   final.state === "approved" ? "info" : "warning"
                 );
               }).catch((error) => {
+                const folder = sharedVaultTokenFolder(error);
                 invocation.notify(
-                  `Requesting vault access failed: ${errorText(error)}`,
+                  folder === void 0 ? `Requesting vault access failed: ${errorText(error)}` : sharedVaultTokenFolderText(folder),
                   "error"
                 );
               }).finally(() => {
@@ -434,7 +454,7 @@ function createPiVaultSection(options) {
               ok: true,
               text: await stepText(
                 step,
-                ". You are told here when the operator decides."
+                " Pi tells you here when the operator decides."
               )
             };
           }
@@ -442,39 +462,39 @@ function createPiVaultSection(options) {
       if (approved && status.mode !== "custody")
         actions.push({
           id: "use-vault",
-          label: "Serve Pi from the vault",
+          label: "Use the vault",
           run: async () => {
             try {
               await setup.useVault(status.selectedRouteId);
             } catch (error) {
               return refused(error);
             }
-            return "Pi now serves Antigravity from the vault.";
+            return "Pi now uses the vault for Antigravity.";
           }
         });
       if (status.mode !== "local" && (status.enrollment.state === "idle" || status.enrollment.state === "pending" || status.enrollment.state === "denied"))
         actions.push({
           id: "use-local",
-          label: "Serve Pi from its own login",
+          label: "Use Pi's own login",
           run: async () => {
             await setup.useLocal();
-            return "Pi now serves Antigravity from its own login. Run /login if it has none.";
+            return "Pi now uses its own login for Antigravity. Run /login if you haven't signed in.";
           }
         });
       if (status.enrollment.state === "pending")
         lines.push(
-          `Forget vault enrollment is offered again once Pi sees the request approved or denied. To drop it, the operator runs ck auth enroll deny --request-id ${status.enrollment.requestId ?? "<id>"}; then choose Request vault access here.`
+          `You can't disconnect while this request waits for the vault operator. To withdraw it, ask the vault operator to run ck auth enroll deny --request-id ${status.enrollment.requestId ?? "<id>"}, then choose Request vault access here so Pi sees the answer.`
         );
       else if (status.enrollment.state !== "idle")
         actions.push({
           id: "forget",
-          label: "Forget vault enrollment",
-          description: "Deletes Pi's enrollment token and returns to the local login. The operator can still revoke the enrollment in the vault.",
+          label: "Disconnect from the vault",
+          description: "Removes Pi's vault key from this computer and goes back to Pi's own login. Using the vault here again needs a new request and a new approval. The earlier approval stays in the vault until the vault operator revokes it.",
           irreversible: true,
-          confirm: `Forget the ${PI_ANTIGRAVITY_ENROLLMENT_NAME} enrollment? Using the vault again needs a new approval.`,
+          confirm: "Disconnect this computer from the vault? Pi goes back to its own login, and using the vault here again needs a new approval from the vault operator.",
           run: async () => {
             await setup.disconnect();
-            return "Vault enrollment forgotten; Pi serves Antigravity from its own login.";
+            return "Disconnected from the vault. Pi now uses its own login for Antigravity.";
           }
         });
       return { lines, items, actions };
@@ -517,18 +537,18 @@ async function custodyAccounts(status, options) {
   } catch (error) {
     return {
       list: [],
-      problem: `Vault accounts unavailable: ${error instanceof Error ? error.message : String(error)}`
+      problem: `Pi can't load the vault accounts right now: ${error instanceof Error ? error.message : String(error)}`
     };
   }
 }
 function localLoginLine(status) {
   switch (status.hostSlot) {
     case "dormant":
-      return "The native Pi login is dormant while vault enrollment controls serving.";
+      return "Pi's own login is set aside while Pi uses the vault.";
     case "login":
       return "Signed in with Pi's own login. Pi's /login replaces it and /logout removes it.";
     case "placeholder":
-      return "Pi holds the vault placeholder, not a login. Run /login, or serve from the vault in the Vault section.";
+      return "Not signed in with Pi's own login. Run /login, or choose Use the vault in the Vault section.";
     case "empty":
       return "Not signed in. Run Pi's /login to sign in.";
   }
@@ -542,7 +562,7 @@ function createPiAntigravityAccountSections(options) {
         if (status.mode === "unreadable")
           return {
             lines: [
-              `The vault mode file is unreadable (${status.modeProblem ?? "unknown problem"}); Pi serves nothing until a mode is chosen in the Vault section.`
+              status.modeProblem === void 0 ? "Pi can't tell whether to use the vault or its own login, so it sends no Antigravity requests. See the Vault section." : `Pi can't tell whether to use the vault or its own login (${status.modeProblem}), so it sends no Antigravity requests. Choose one in the Vault section.`
             ]
           };
         if (status.mode === "local")
@@ -557,13 +577,13 @@ function createPiAntigravityAccountSections(options) {
         const items = list.map((account) => ({
           id: opaqueItemId(account.routeId),
           label: vaultAccountName(list, account),
-          detail: account.declined ? "declined on this host" : account === serving ? "serving Pi" : "available"
+          detail: account.declined ? VAULT_ACCOUNT_TURNED_OFF : account === serving ? VAULT_ACCOUNT_IN_USE : VAULT_ACCOUNT_AVAILABLE
         }));
         return {
           lines: [
-            "Pi serves Antigravity from the vault, one account at a time. Choose, decline or accept accounts in the Vault section.",
+            "Pi uses the vault for Antigravity, one account at a time. Choose an account, or turn accounts off and on, in the Vault section.",
             ...status.hostSlot === "login" ? [
-              "Conflict: Pi also holds its own login. Requests are refused until /logout or a switch back to the local login."
+              "Pi is also signed in with its own login, so requests are refused. Run /logout, or switch back to Pi's own login in the Vault section."
             ] : [],
             ...problem ? [problem] : [],
             // An approved enrollment without a read grant lists nothing;
@@ -589,7 +609,7 @@ function createPiAntigravityAccountSections(options) {
         if (status.mode === "unreadable")
           return {
             lines: [
-              "Vault enrollment authority is unreadable; requests are refused. Recover or Disconnect in the Vault section."
+              "Pi can't read its vault setup, so requests are refused. See the Vault section."
             ]
           };
         if (status.mode !== "custody")
@@ -603,7 +623,7 @@ function createPiAntigravityAccountSections(options) {
         if (!problem && list.length === 0 && status.enrollment.state === "approved")
           return {
             lines: [
-              "The vault serves Pi no accounts, so requests are refused. There is no account rotation.",
+              "The vault gives Pi no accounts, so requests are refused. There is no account rotation.",
               ...piNoVaultAccountsGuidance()
             ]
           };
@@ -643,23 +663,13 @@ function getPackedRefresh(accessToken) {
 }
 
 // src/paths.ts
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-function getPiConfigDir() {
-  return process.env.PI_AGENT_DIR?.trim() || join(homedir(), ".pi", "agent");
-}
-function getPiAntigravityAuthFile() {
-  return process.env.PI_ANTIGRAVITY_AUTH_FILE?.trim() || join(getPiConfigDir(), "antigravity-accounts.json");
-}
-function getPiAntigravityVaultDir() {
-  return join(dirname(getPiAntigravityAuthFile()), "antigravity-auth-vault");
-}
-function getPiAntigravityVaultModeFile() {
-  return join(getPiAntigravityVaultDir(), "pi-mode.json");
-}
-function getPiAntigravityVaultRosterFile() {
-  return join(getPiAntigravityVaultDir(), "pi-roster.json");
-}
+import {
+  getPiAntigravityAuthFile,
+  getPiAntigravityVaultDir,
+  getPiAntigravityVaultModeFile,
+  getPiAntigravityVaultRosterFile,
+  getPiConfigDir
+} from "@cortexkit/antigravity-auth-core";
 
 // src/stream.ts
 import {
@@ -677,7 +687,7 @@ import {
   RETIRED_AGY_MODEL_MESSAGE,
   redactCredentialError,
   redactCredentialText,
-  resolveModelForHeaderStyle
+  resolveAntigravityModel
 } from "@cortexkit/antigravity-auth-core";
 import {
   calculateCost,
@@ -1021,11 +1031,11 @@ function resolvePiAntigravityModel(model, reasoning) {
   const lower = model.id.toLowerCase();
   const supportsAgyTiers = model.reasoning && (isGeminiArgonModel(lower) || lower.includes("gemini-3") || lower.includes("claude") && (lower.includes("thinking") || /claude-(opus|sonnet)-5-5/.test(lower)));
   if (!supportsAgyTiers || !reasoning) {
-    return resolveModelForHeaderStyle(model.id, "antigravity");
+    return resolveAntigravityModel(model.id);
   }
   const tier = reasoning === "minimal" ? "low" : reasoning === "xhigh" ? "high" : reasoning;
   const baseModel = model.id.replace(/-(minimal|low|medium|high|xhigh)$/i, "");
-  return resolveModelForHeaderStyle(`${baseModel}-${tier}`, "antigravity");
+  return resolveAntigravityModel(`${baseModel}-${tier}`);
 }
 function prepareAntigravityRequest(options) {
   const resolved = resolvePiAntigravityModel(
@@ -1783,8 +1793,8 @@ async function registerCortexKitPiAntigravity(pi, seams = {}) {
     const mode = await currentMode();
     const { openPiSlot } = await (seams.loadPiSlot ?? loadCommonAuthPiSlot)();
     const slot = openPiSlot({
-      authPath: seams.nativeAuthPath ?? join2(getAgentDir(), "auth.json"),
-      stashPath: seams.nativeStashPath ?? join2(
+      authPath: seams.nativeAuthPath ?? join(getAgentDir(), "auth.json"),
+      stashPath: seams.nativeStashPath ?? join(
         seams.vaultDir ?? getPiAntigravityVaultDir(),
         "google-login-stash.json"
       ),