@cortexkit/pi-antigravity-auth 3.0.5 → 3.0.7

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/index.ts
-import { join as join2 } from "node:path";
+import { join } from "node:path";
 import {
   ANTIGRAVITY_PROVIDER_ID as ANTIGRAVITY_PROVIDER_ID2,
   authorizeAntigravity,
@@ -26,7 +26,13 @@ import { createHash, randomBytes } from "node:crypto";
 import { readFileSync } from "node:fs";
 import {
   ANTIGRAVITY_PROVIDER_ID,
-  enrollmentAuthority
+  emptyVaultRosterCause,
+  enrollmentAuthority,
+  sharedVaultTokenFolder,
+  sharedVaultTokenFolderOutcome,
+  sharedVaultTokenFolderText,
+  VAULT_RECLASSIFY_COMMAND,
+  VAULT_STATUS_COMMAND
 } from "@cortexkit/antigravity-auth-core";
 import { writeJsonAtomic } from "@cortexkit/antigravity-auth-core/atomic-write";
 var PI_ANTIGRAVITY_PROVIDER_ID = ANTIGRAVITY_PROVIDER_ID;
@@ -62,16 +68,19 @@ function readPiVaultMode(path) {
   } catch (error) {
     if (error?.code === "ENOENT")
       return { ok: true, record: LOCAL_MODE };
-    return { ok: false, reason: "the vault mode file could not be read" };
+    return { ok: false, reason: "its vault settings file could not be read" };
   }
   let raw;
   try {
     raw = JSON.parse(text);
   } catch {
-    return { ok: false, reason: "the vault mode file is not valid JSON" };
+    return { ok: false, reason: "its vault settings file is damaged" };
   }
   const record = parseModeRecord(raw);
-  return record ? { ok: true, record } : { ok: false, reason: "the vault mode file has an unknown shape" };
+  return record ? { ok: true, record } : {
+    ok: false,
+    reason: "its vault settings file holds settings it does not understand"
+  };
 }
 async function writePiVaultMode(path, record) {
   const value = record.routeId === void 0 ? { version: 1, mode: record.mode } : { version: 1, mode: record.mode, routeId: record.routeId };
@@ -177,7 +186,7 @@ var PiVaultSetup = class {
     );
     if (enrollment.state !== "approved")
       throw new PiVaultSetupError(
-        "Pi is not enrolled with the vault yet. Request access and wait for the operator to approve it first."
+        "Pi doesn't have vault access yet. Choose Request vault access and wait for the vault operator to approve it."
       );
     if (routeId !== void 0 && routeId.trim() === "")
       throw new PiVaultSetupError("Choose a vault account to use.");
@@ -194,7 +203,7 @@ var PiVaultSetup = class {
       this.#options.claustrum
     ) !== "local") {
       throw new PiVaultSetupError(
-        "Disconnect vault enrollment before using local accounts."
+        "Disconnect from the vault before switching to Pi's own login."
       );
     }
     await writePiVaultMode(this.#options.modeFile, LOCAL_MODE);
@@ -213,7 +222,7 @@ var PiVaultSetup = class {
     );
     if (result === "busy")
       throw new PiVaultSetupError(
-        "Vault enrollment is busy; disconnect did not change it."
+        "Another vault setup step is running, so Pi is still connected to the vault. Try again in a moment."
       );
     await writePiVaultMode(this.#options.modeFile, LOCAL_MODE);
     await this.#options.onModeChanged?.(LOCAL_MODE);
@@ -222,43 +231,69 @@ var PiVaultSetup = class {
 function describeEnrollment(status) {
   switch (status.state) {
     case "idle":
-      return "not requested";
+      return "Vault access: not requested yet.";
     case "pending":
-      return status.retryCode ? `waiting for operator approval (retrying: ${status.retryCode})` : "waiting for operator approval";
+      return status.retryCode ? `Vault access: the vault can't take Pi's request right now; Pi asks again the next time it checks (reference: ${status.retryCode}).` : "Vault access: waiting for the vault operator to approve this request.";
     case "approved":
-      return `approved as ${status.approvedName ?? status.proposedName}`;
+      return "Vault access: approved by the vault operator.";
     case "denied":
-      return "denied by the operator";
+      return "Vault access: the vault operator denied the request. Choose Request vault access to ask again.";
     case "blocked":
-      return `blocked (${status.code})`;
+      if (status.code === "pending_exists")
+        return "Vault access: the vault turned down a new request because an earlier request from Pi is still waiting.";
+      if (status.code === "missing_token")
+        return "Vault access: approved, but Pi's vault key is missing from this computer. Disconnect from the vault, then request vault access again.";
+      if (status.code === "unreadable-state")
+        return "Vault access: Pi can't read its record of the vault request. Disconnect from the vault, then request vault access again.";
+      return `Vault access: the vault ended this request (reference: ${status.code}). Choose Request vault access to start a new one.`;
     case "unavailable":
-      return `vault unavailable (${status.code})`;
+      return `Vault access: Pi can't reach the vault right now. Try again later (reference: ${status.code}).`;
     case "busy":
-      return "another setup step is running";
+      return "Vault access: another vault setup step is running. Try again in a moment.";
   }
 }
 var PI_VAULT_GRANT_COMMAND = `ck auth grant --principal enrolled:${PI_ANTIGRAVITY_ENROLLMENT_NAME} --selector-kind category --selector antigravity-native --operation read`;
 function piPendingEnrollmentGuidance(requestId) {
   return [
     "Next, the vault operator runs these outside Pi:",
-    requestId === void 0 ? "1. Find the request ID with ck auth enroll list, then approve it: ck auth enroll approve --request-id <id>" : `1. Approve the request: ck auth enroll approve --request-id ${requestId}`,
+    requestId === void 0 ? `1. Find the request from ${PI_ANTIGRAVITY_ENROLLMENT_NAME} with ck auth enroll list, then approve it: ck auth enroll approve --request-id <id>` : `1. Approve the request: ck auth enroll approve --request-id ${requestId}`,
     `2. Grant read access: ${PI_VAULT_GRANT_COMMAND}`,
-    "Both are needed: an approval without the grant serves Pi no accounts.",
-    "3. Pi switches to the vault once it sees the approval; Request vault access checks again."
+    "Both are needed: without the grant, Pi can see no accounts in the vault.",
+    "3. Pi switches to the vault once it sees the approval. Choose Request vault access to check again."
   ];
 }
 function piPendingExistsGuidance() {
   return [
-    `An earlier request for ${PI_ANTIGRAVITY_ENROLLMENT_NAME} is still pending in the vault, possibly from an enrollment forgotten here.`,
+    "The earlier request may come from a vault setup that was disconnected here before the operator answered it.",
     "It expires 15 minutes after it was made; request vault access again after that.",
-    "Or the vault operator clears it now: find its ID with ck auth enroll list, run ck auth enroll deny --request-id <id>, then request vault access again here."
+    `Or the vault operator clears it now: find the request from ${PI_ANTIGRAVITY_ENROLLMENT_NAME} with ck auth enroll list, run ck auth enroll deny --request-id <id>, then request vault access again here.`
   ];
 }
-function piNoVaultAccountsGuidance() {
-  return [
-    `Enrollment is approved, but the vault serves ${PI_ANTIGRAVITY_ENROLLMENT_NAME} no Antigravity accounts.`,
-    `The vault operator grants read access with: ${PI_VAULT_GRANT_COMMAND}`
-  ];
+function piNoVaultAccountsGuidance(reach) {
+  return piEmptyRosterGuidance(emptyVaultRosterCause(reach));
+}
+function piEmptyRosterGuidance(cause) {
+  switch (cause) {
+    case "no-grant":
+      return [
+        "The vault operator approved Pi. The vault has not granted Pi read access.",
+        `The vault operator grants it with: ${PI_VAULT_GRANT_COMMAND}`
+      ];
+    case "grant-reaches-nothing":
+      return [
+        "The vault operator approved Pi. Pi has read access, but it reaches no Antigravity login in the vault.",
+        `The vault operator updates the vault's logins with: ${VAULT_RECLASSIFY_COMMAND}`,
+        `Then they check them with: ${VAULT_STATUS_COMMAND}`
+      ];
+    case "unknown":
+      return [
+        "The vault operator approved Pi, but Pi can't see any Antigravity accounts in the vault yet.",
+        `If the operator has not granted Pi read access yet, they run: ${PI_VAULT_GRANT_COMMAND}`
+      ];
+  }
+}
+function piEmptyVaultRosterRefusal(cause) {
+  return cause === "unknown" ? void 0 : piEmptyRosterGuidance(cause).join("\n");
 }
 function enrollmentGuidance(status) {
   if (status.state === "pending")
@@ -267,28 +302,20 @@ function enrollmentGuidance(status) {
     return piPendingExistsGuidance();
   return [];
 }
-function describeHostSlot(slot) {
-  switch (slot) {
-    case "login":
-      return "signed in with a Pi login";
-    case "placeholder":
-      return "holds the vault placeholder";
-    case "empty":
-      return "empty";
+function describeSource(status) {
+  switch (status.mode) {
+    case "custody":
+      return "Using the vault for Antigravity accounts; Pi's own login is set aside.";
+    case "local":
+      return status.hostSlot === "login" ? "Using Pi's own login (the account you signed in with /login), not the vault." : status.hostSlot === "dormant" ? "Using Pi's own login, not the vault." : "Using Pi's own login, not the vault, but you are not signed in. Run /login to sign in.";
+    case "unreadable":
+      return status.modeProblem === void 0 ? "Pi can't tell whether to use the vault or its own login, so it sends no Antigravity requests." : `Pi can't tell whether to use the vault or its own login (${status.modeProblem}), so it sends no Antigravity requests.`;
   }
 }
 function formatPiVaultSetupStatus(status) {
-  const lines = [
-    `Mode: ${status.mode === "custody" ? "vault (custody)" : status.mode === "local" ? "local Pi login" : `unreadable (${status.modeProblem ?? "unknown problem"})`}`,
-    `Enrollment (${PI_ANTIGRAVITY_ENROLLMENT_NAME}): ${describeEnrollment(status.enrollment)}`,
-    status.hostSlot === "dormant" ? "Pi auth slot: dormant (not read)" : `Pi auth slot: ${describeHostSlot(status.hostSlot)}`
-  ];
-  if (status.selectedRouteId !== void 0)
-    lines.push("Vault account: a specific account is chosen (marked below)");
-  if (status.mode === "local" && status.hostSlot === "placeholder")
-    lines.push(
-      "Conflict: local mode has no login to serve. Run /login or switch to the vault."
-    );
+  const lines = [describeSource(status), describeEnrollment(status.enrollment)];
+  if (status.mode === "custody" && status.selectedRouteId !== void 0)
+    lines.push('Pi uses the vault account marked "in use by Pi" below.');
   lines.push(...enrollmentGuidance(status.enrollment));
   return lines;
 }
@@ -296,6 +323,9 @@ var ITEM_ID_SALT = randomBytes(16);
 function vaultAccountName(listed, account) {
   return `Vault account ${listed.indexOf(account) + 1}`;
 }
+var VAULT_ACCOUNT_IN_USE = "in use by Pi";
+var VAULT_ACCOUNT_AVAILABLE = "available";
+var VAULT_ACCOUNT_TURNED_OFF = "turned off for Pi on this computer";
 function opaqueItemId(routeId) {
   return `vault-${createHash("sha256").update(ITEM_ID_SALT).update(routeId).digest("hex").slice(0, 16)}`;
 }
@@ -307,6 +337,11 @@ function refused(error) {
     return { ok: false, text: error.message, code: "vault-refused" };
   throw error;
 }
+function sharedFolderRefusal(error) {
+  const outcome = sharedVaultTokenFolderOutcome(error);
+  if (outcome) return outcome;
+  throw error;
+}
 async function waitForApproval(setup, wait = {}) {
   const sleep = wait.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
   const interval = wait.pollIntervalMs ?? 2e3;
@@ -327,13 +362,13 @@ function createPiVaultSection(options) {
     const port = options.accounts?.();
     if (!port) return [];
     try {
-      return (await port.list()).length === 0 ? piNoVaultAccountsGuidance() : [];
+      return (await port.list()).length === 0 ? piNoVaultAccountsGuidance(port.grantReach()) : [];
     } catch {
       return [];
     }
   };
   const stepText = async (step, suffix = "") => [
-    `Enrollment: ${describeEnrollment(step)}${suffix}`,
+    `${describeEnrollment(step)}${suffix}`,
     ...enrollmentGuidance(step),
     ...step.state === "approved" ? await approvedRosterGuidance() : []
   ].join("\n");
@@ -356,48 +391,51 @@ function createPiVaultSection(options) {
             items.push({
               id: opaqueItemId(account.routeId),
               label: name,
-              detail: account.declined ? "declined on this host" : serving ? "serving Pi" : "available",
+              detail: account.declined ? VAULT_ACCOUNT_TURNED_OFF : serving ? VAULT_ACCOUNT_IN_USE : VAULT_ACCOUNT_AVAILABLE,
               actions: account.declined ? [
                 {
                   id: "accept",
-                  label: "Accept on this host",
+                  label: "Turn back on for Pi",
                   run: async () => {
                     await port.accept(account.routeId);
-                    return `${name} is accepted on this host.`;
+                    return `Pi can use ${name} again.`;
                   }
                 }
               ] : [
                 {
                   id: "use",
-                  label: "Serve Pi from this account",
+                  label: "Use this account",
                   run: async () => {
                     try {
                       await setup.useVault(account.routeId);
                     } catch (error) {
                       return refused(error);
                     }
-                    return `Pi now serves Antigravity from ${name}.`;
+                    return `Pi now uses ${name} for Antigravity.`;
                   }
                 },
                 {
                   id: "decline",
-                  label: "Decline on this host",
-                  description: "It stays in the vault and in this list, and is never sent from this host until accepted again.",
+                  label: "Turn off for Pi",
+                  description: "The account stays in the vault and in this list, but Pi on this computer never uses it until you turn it back on.",
                   run: async () => {
                     await port.decline(account.routeId);
-                    return `${name} is declined on this host.`;
+                    return `Pi on this computer won't use ${name} until you turn it back on.`;
                   }
                 }
               ]
             });
           }
-          if (listed.length === 0) lines.push(...piNoVaultAccountsGuidance());
+          if (listed.length === 0)
+            lines.push(...piNoVaultAccountsGuidance(port.grantReach()));
           else if (status.mode !== "custody")
             lines.push(
-              "Next: choose Serve Pi from the vault to serve Pi from these accounts."
+              "Next: choose Use the vault to have Pi use these accounts."
             );
         } catch (error) {
-          lines.push(`Vault accounts unavailable: ${errorText(error)}`);
+          lines.push(
+            `Pi can't load the vault accounts right now: ${errorText(error)}`
+          );
         }
       }
       const actions = [];
@@ -405,9 +443,14 @@ function createPiVaultSection(options) {
         actions.push({
           id: "request-access",
           label: "Request vault access",
-          description: `Asks the vault to enroll Pi as ${PI_ANTIGRAVITY_ENROLLMENT_NAME}; the operator approves it in the vault.`,
+          description: "Asks the vault operator to let Pi use the vault's Antigravity accounts.",
           run: async ({ invocation }) => {
-            const step = await setup.connectStep();
+            let step;
+            try {
+              step = await setup.connectStep();
+            } catch (error) {
+              return sharedFolderRefusal(error);
+            }
             if (step.state !== "pending" && step.state !== "busy")
               return {
                 ok: step.state === "approved",
@@ -422,8 +465,9 @@ function createPiVaultSection(options) {
                   final.state === "approved" ? "info" : "warning"
                 );
               }).catch((error) => {
+                const folder = sharedVaultTokenFolder(error);
                 invocation.notify(
-                  `Requesting vault access failed: ${errorText(error)}`,
+                  folder === void 0 ? `Requesting vault access failed: ${errorText(error)}` : sharedVaultTokenFolderText(folder),
                   "error"
                 );
               }).finally(() => {
@@ -434,7 +478,7 @@ function createPiVaultSection(options) {
               ok: true,
               text: await stepText(
                 step,
-                ". You are told here when the operator decides."
+                " Pi tells you here when the operator decides."
               )
             };
           }
@@ -442,39 +486,39 @@ function createPiVaultSection(options) {
       if (approved && status.mode !== "custody")
         actions.push({
           id: "use-vault",
-          label: "Serve Pi from the vault",
+          label: "Use the vault",
           run: async () => {
             try {
               await setup.useVault(status.selectedRouteId);
             } catch (error) {
               return refused(error);
             }
-            return "Pi now serves Antigravity from the vault.";
+            return "Pi now uses the vault for Antigravity.";
           }
         });
       if (status.mode !== "local" && (status.enrollment.state === "idle" || status.enrollment.state === "pending" || status.enrollment.state === "denied"))
         actions.push({
           id: "use-local",
-          label: "Serve Pi from its own login",
+          label: "Use Pi's own login",
           run: async () => {
             await setup.useLocal();
-            return "Pi now serves Antigravity from its own login. Run /login if it has none.";
+            return "Pi now uses its own login for Antigravity. Run /login if you haven't signed in.";
           }
         });
       if (status.enrollment.state === "pending")
         lines.push(
-          `Forget vault enrollment is offered again once Pi sees the request approved or denied. To drop it, the operator runs ck auth enroll deny --request-id ${status.enrollment.requestId ?? "<id>"}; then choose Request vault access here.`
+          `You can't disconnect while this request waits for the vault operator. To withdraw it, ask the vault operator to run ck auth enroll deny --request-id ${status.enrollment.requestId ?? "<id>"}, then choose Request vault access here so Pi sees the answer.`
         );
       else if (status.enrollment.state !== "idle")
         actions.push({
           id: "forget",
-          label: "Forget vault enrollment",
-          description: "Deletes Pi's enrollment token and returns to the local login. The operator can still revoke the enrollment in the vault.",
+          label: "Disconnect from the vault",
+          description: "Removes Pi's vault key from this computer and goes back to Pi's own login. Using the vault here again needs a new request and a new approval. The earlier approval stays in the vault until the vault operator revokes it.",
           irreversible: true,
-          confirm: `Forget the ${PI_ANTIGRAVITY_ENROLLMENT_NAME} enrollment? Using the vault again needs a new approval.`,
+          confirm: "Disconnect this computer from the vault? Pi goes back to its own login, and using the vault here again needs a new approval from the vault operator.",
           run: async () => {
             await setup.disconnect();
-            return "Vault enrollment forgotten; Pi serves Antigravity from its own login.";
+            return "Disconnected from the vault. Pi now uses its own login for Antigravity.";
           }
         });
       return { lines, items, actions };
@@ -513,22 +557,25 @@ async function custodyAccounts(status, options) {
   if (status.mode !== "custody" || status.enrollment.state !== "approved")
     return { list: [] };
   try {
-    return { list: await options.accounts().list() };
+    const port = options.accounts();
+    const list = await port.list();
+    const reach = port.grantReach();
+    return { list, ...reach && { reach } };
   } catch (error) {
     return {
       list: [],
-      problem: `Vault accounts unavailable: ${error instanceof Error ? error.message : String(error)}`
+      problem: `Pi can't load the vault accounts right now: ${error instanceof Error ? error.message : String(error)}`
     };
   }
 }
 function localLoginLine(status) {
   switch (status.hostSlot) {
     case "dormant":
-      return "The native Pi login is dormant while vault enrollment controls serving.";
+      return "Pi's own login is set aside while Pi uses the vault.";
     case "login":
       return "Signed in with Pi's own login. Pi's /login replaces it and /logout removes it.";
     case "placeholder":
-      return "Pi holds the vault placeholder, not a login. Run /login, or serve from the vault in the Vault section.";
+      return "Not signed in with Pi's own login. Run /login, or choose Use the vault in the Vault section.";
     case "empty":
       return "Not signed in. Run Pi's /login to sign in.";
   }
@@ -542,7 +589,7 @@ function createPiAntigravityAccountSections(options) {
         if (status.mode === "unreadable")
           return {
             lines: [
-              `The vault mode file is unreadable (${status.modeProblem ?? "unknown problem"}); Pi serves nothing until a mode is chosen in the Vault section.`
+              status.modeProblem === void 0 ? "Pi can't tell whether to use the vault or its own login, so it sends no Antigravity requests. See the Vault section." : `Pi can't tell whether to use the vault or its own login (${status.modeProblem}), so it sends no Antigravity requests. Choose one in the Vault section.`
             ]
           };
         if (status.mode === "local")
@@ -552,23 +599,23 @@ function createPiAntigravityAccountSections(options) {
               localLoginLine(status)
             ]
           };
-        const { list, problem } = await custodyAccounts(status, options);
+        const { list, reach, problem } = await custodyAccounts(status, options);
         const serving = servingAccount(status, list);
         const items = list.map((account) => ({
           id: opaqueItemId(account.routeId),
           label: vaultAccountName(list, account),
-          detail: account.declined ? "declined on this host" : account === serving ? "serving Pi" : "available"
+          detail: account.declined ? VAULT_ACCOUNT_TURNED_OFF : account === serving ? VAULT_ACCOUNT_IN_USE : VAULT_ACCOUNT_AVAILABLE
         }));
         return {
           lines: [
-            "Pi serves Antigravity from the vault, one account at a time. Choose, decline or accept accounts in the Vault section.",
+            "Pi uses the vault for Antigravity, one account at a time. Choose an account, or turn accounts off and on, in the Vault section.",
             ...status.hostSlot === "login" ? [
-              "Conflict: Pi also holds its own login. Requests are refused until /logout or a switch back to the local login."
+              "Pi is also signed in with its own login, so requests are refused. Run /logout, or switch back to Pi's own login in the Vault section."
             ] : [],
             ...problem ? [problem] : [],
             // An approved enrollment without a read grant lists nothing;
             // say so rather than show an empty account list.
-            ...!problem && list.length === 0 && status.enrollment.state === "approved" ? piNoVaultAccountsGuidance() : []
+            ...!problem && list.length === 0 && status.enrollment.state === "approved" ? piNoVaultAccountsGuidance(reach) : []
           ],
           items
         };
@@ -589,7 +636,7 @@ function createPiAntigravityAccountSections(options) {
         if (status.mode === "unreadable")
           return {
             lines: [
-              "Vault enrollment authority is unreadable; requests are refused. Recover or Disconnect in the Vault section."
+              "Pi can't read its vault setup, so requests are refused. See the Vault section."
             ]
           };
         if (status.mode !== "custody")
@@ -598,13 +645,13 @@ function createPiAntigravityAccountSections(options) {
               "Every request uses Pi's own login. There is no account rotation."
             ]
           };
-        const { list, problem } = await custodyAccounts(status, options);
+        const { list, reach, problem } = await custodyAccounts(status, options);
         const serving = servingAccount(status, list);
         if (!problem && list.length === 0 && status.enrollment.state === "approved")
           return {
             lines: [
-              "The vault serves Pi no accounts, so requests are refused. There is no account rotation.",
-              ...piNoVaultAccountsGuidance()
+              "The vault gives Pi no accounts, so requests are refused. There is no account rotation.",
+              ...piNoVaultAccountsGuidance(reach)
             ]
           };
         return {
@@ -643,23 +690,13 @@ function getPackedRefresh(accessToken) {
 }
 
 // src/paths.ts
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-function getPiConfigDir() {
-  return process.env.PI_AGENT_DIR?.trim() || join(homedir(), ".pi", "agent");
-}
-function getPiAntigravityAuthFile() {
-  return process.env.PI_ANTIGRAVITY_AUTH_FILE?.trim() || join(getPiConfigDir(), "antigravity-accounts.json");
-}
-function getPiAntigravityVaultDir() {
-  return join(dirname(getPiAntigravityAuthFile()), "antigravity-auth-vault");
-}
-function getPiAntigravityVaultModeFile() {
-  return join(getPiAntigravityVaultDir(), "pi-mode.json");
-}
-function getPiAntigravityVaultRosterFile() {
-  return join(getPiAntigravityVaultDir(), "pi-roster.json");
-}
+import {
+  getPiAntigravityAuthFile,
+  getPiAntigravityVaultDir,
+  getPiAntigravityVaultModeFile,
+  getPiAntigravityVaultRosterFile,
+  getPiConfigDir
+} from "@cortexkit/antigravity-auth-core";
 
 // src/stream.ts
 import {
@@ -674,10 +711,12 @@ import {
   isGeminiArgonModel,
   isRetiredAgyModel,
   orderAgyRequestPayloadInPlace,
+  PreResponseDeadline,
+  parseRefreshParts,
   RETIRED_AGY_MODEL_MESSAGE,
   redactCredentialError,
   redactCredentialText,
-  resolveModelForHeaderStyle
+  resolveAntigravityModel
 } from "@cortexkit/antigravity-auth-core";
 import {
   calculateCost,
@@ -1021,11 +1060,11 @@ function resolvePiAntigravityModel(model, reasoning) {
   const lower = model.id.toLowerCase();
   const supportsAgyTiers = model.reasoning && (isGeminiArgonModel(lower) || lower.includes("gemini-3") || lower.includes("claude") && (lower.includes("thinking") || /claude-(opus|sonnet)-5-5/.test(lower)));
   if (!supportsAgyTiers || !reasoning) {
-    return resolveModelForHeaderStyle(model.id, "antigravity");
+    return resolveAntigravityModel(model.id);
   }
   const tier = reasoning === "minimal" ? "low" : reasoning === "xhigh" ? "high" : reasoning;
   const baseModel = model.id.replace(/-(minimal|low|medium|high|xhigh)$/i, "");
-  return resolveModelForHeaderStyle(`${baseModel}-${tier}`, "antigravity");
+  return resolveAntigravityModel(`${baseModel}-${tier}`);
 }
 function prepareAntigravityRequest(options) {
   const resolved = resolvePiAntigravityModel(
@@ -1100,14 +1139,25 @@ async function sendAntigravityRequest(options) {
     throw new Error(RETIRED_AGY_MODEL_MESSAGE);
   }
   const packedRefresh = getPackedRefresh(options.accessToken) ?? "";
-  const projectContext = await ensureProjectContext({
-    type: "oauth",
-    refresh: packedRefresh,
-    access: options.accessToken,
-    expires: Date.now() + 6e4
-  });
+  const packedProject = parseRefreshParts(packedRefresh);
+  for (const projectId of [
+    packedProject.projectId,
+    packedProject.managedProjectId
+  ]) {
+    if (projectId) options.selectedProjectIds.add(projectId);
+  }
+  const projectContext = await options.deadline.wait(
+    () => ensureProjectContext({
+      type: "oauth",
+      refresh: packedRefresh,
+      access: options.accessToken,
+      expires: Date.now() + 6e4
+    })
+  );
+  if (projectContext.effectiveProjectId)
+    options.selectedProjectIds.add(projectContext.effectiveProjectId);
   const prepared = prepareAntigravityRequest(options);
-  await options.assertAdmission?.();
+  await options.deadline.wait(() => options.assertAdmission?.());
   return dispatchAntigravityRequest(
     prepared,
     {
@@ -1117,13 +1167,13 @@ async function sendAntigravityRequest(options) {
     options.signal ?? options.streamOptions?.signal ?? null
   );
 }
-function streamCortexKitAntigravity(model, context, options, assertAdmission) {
+function streamCortexKitAntigravity(model, context, options, assertAdmission, preResponseClock) {
   return runAntigravityStream(
     model,
     context,
     options,
-    async (sessionKey, signal) => {
-      await assertAdmission?.();
+    async (sessionKey, signal, _selectedCredentials, selectedProjectIds, deadline) => {
+      await deadline.wait(() => assertAdmission?.());
       const accessToken = options?.apiKey ?? "";
       if (!accessToken)
         throw new Error("Missing Antigravity OAuth access token");
@@ -1134,17 +1184,20 @@ function streamCortexKitAntigravity(model, context, options, assertAdmission) {
         accessToken,
         sessionKey,
         signal,
-        assertAdmission
+        assertAdmission,
+        selectedProjectIds,
+        deadline
       });
-    }
+    },
+    preResponseClock
   );
 }
-function createCortexKitAntigravityVaultStream(send, placeholderKey) {
+function createCortexKitAntigravityVaultStream(send, placeholderKey, preResponseClock) {
   return (model, context, options) => runAntigravityStream(
     model,
     context,
     options,
-    (sessionKey, signal, selectedCredentials) => {
+    (sessionKey, signal, selectedCredentials, selectedProjectIds, deadline) => {
       if (options?.apiKey !== placeholderKey)
         throw new Error(
           "The native Google credential slot is not synchronized for vault mode. No request was sent."
@@ -1155,28 +1208,37 @@ function createCortexKitAntigravityVaultStream(send, placeholderKey) {
         streamOptions: options,
         sessionKey
       });
-      return send(async (credential, sendSignal) => {
-        selectedCredentials.add(credential.accessToken);
-        try {
-          return await dispatchAntigravityRequest(
-            prepared,
-            credential,
-            sendSignal ?? signal
-          );
-        } catch (error) {
-          throw redactCredentialError(error, [...selectedCredentials]);
-        }
-      }, signal);
-    }
+      return deadline.open(
+        () => send(async (credential, sendSignal) => {
+          selectedCredentials.add(credential.accessToken);
+          selectedProjectIds.add(credential.projectId);
+          try {
+            deadline.follow(sendSignal);
+            return await deadline.open(
+              () => dispatchAntigravityRequest(prepared, credential, signal)
+            );
+          } catch (error) {
+            throw redactCredentialError(
+              error,
+              [...selectedCredentials],
+              [...selectedProjectIds]
+            );
+          }
+        }, signal)
+      );
+    },
+    preResponseClock
   );
 }
-function runAntigravityStream(model, context, options, open) {
+function runAntigravityStream(model, context, options, open, preResponseClock) {
   const stream = createAssistantMessageEventStream();
+  const deadline = new PreResponseDeadline(options?.signal, preResponseClock);
   void (async () => {
     const output = createOutput(model);
     const selectedCredentials = new Set(
       options?.apiKey ? [options.apiKey] : []
     );
+    const selectedProjectIds = /* @__PURE__ */ new Set();
     stream.push({ type: "start", partial: output });
     let response;
     let requestAbort;
@@ -1185,16 +1247,22 @@ function runAntigravityStream(model, context, options, open) {
     };
     try {
       const sessionKey = getRequestSessionKey(context, options);
-      requestAbort = new AbortController();
-      detachCaller = forwardAbort(options?.signal, requestAbort);
-      response = await open(
-        sessionKey,
-        requestAbort.signal,
-        selectedCredentials
+      const openingAbort = new AbortController();
+      requestAbort = openingAbort;
+      detachCaller = forwardAbort(deadline.signal, openingAbort);
+      response = await deadline.open(
+        () => open(
+          sessionKey,
+          openingAbort.signal,
+          selectedCredentials,
+          selectedProjectIds,
+          deadline
+        )
       );
+      if (response.ok) deadline.acceptHeaders();
       if (!response.ok) {
         throw new Error(
-          `Antigravity request failed: HTTP ${response.status} ${await response.text()}`
+          `Antigravity request failed: HTTP ${response.status} ${await deadline.wait(() => response.text())}`
         );
       }
       const content = output.content;
@@ -1390,11 +1458,13 @@ function runAntigravityStream(model, context, options, open) {
       output.stopReason = options?.signal?.aborted ? "aborted" : "error";
       output.errorMessage = redactCredentialText(
         error instanceof Error ? error.message : String(error),
-        [...selectedCredentials]
+        [...selectedCredentials],
+        [...selectedProjectIds]
       );
       stream.push({ type: "error", reason: output.stopReason, error: output });
       stream.end();
     } finally {
+      deadline.dispose();
       detachCaller();
     }
   })();
@@ -1425,7 +1495,7 @@ function requireCustody(read) {
     );
   return read.record;
 }
-function selectRoute(routes, routeId) {
+function selectRoute(routes, routeId, emptyRosterCause) {
   if (routeId !== void 0) {
     const selected = routes.find((route) => route.routeId === routeId);
     if (!selected)
@@ -1437,7 +1507,7 @@ function selectRoute(routes, routeId) {
   const [only, ...rest] = routes;
   if (!only)
     throw new PiVaultSendError(
-      "The vault serves Pi no Antigravity accounts yet."
+      piEmptyVaultRosterRefusal(emptyRosterCause()) ?? "The vault serves Pi no Antigravity accounts yet."
     );
   if (rest.length > 0)
     throw new PiVaultSendError(
@@ -1460,12 +1530,17 @@ function createPiVaultSend(options) {
       signal.throwIfAborted();
       routes = source.routes();
     }
-    const ref = selectRoute(routes, record.routeId);
+    const ref = selectRoute(
+      routes,
+      record.routeId,
+      () => source.emptyRosterCause()
+    );
     return source.send(ref, dispatch, { site: "model", signal });
   };
 }
 function createPiVaultAccountsPort(options) {
   let lastRows = /* @__PURE__ */ new Map();
+  let lastReach;
   const refFor = (routeId) => {
     const ref = lastRows.get(routeId);
     if (!ref)
@@ -1477,7 +1552,9 @@ function createPiVaultAccountsPort(options) {
   return {
     list: async () => {
       const { source } = await openCustody(options);
+      lastReach = void 0;
       const roster = await source.refresh();
+      lastReach = source.grantReach();
       const rows = /* @__PURE__ */ new Map();
       const choices = [];
       for (const row of roster?.rows ?? []) {
@@ -1503,6 +1580,7 @@ function createPiVaultAccountsPort(options) {
       lastRows = rows;
       return choices;
     },
+    grantReach: () => lastReach,
     decline: async (routeId) => {
       const { source } = await openCustody(options);
       await source.decline(refFor(routeId));
@@ -1783,8 +1861,8 @@ async function registerCortexKitPiAntigravity(pi, seams = {}) {
     const mode = await currentMode();
     const { openPiSlot } = await (seams.loadPiSlot ?? loadCommonAuthPiSlot)();
     const slot = openPiSlot({
-      authPath: seams.nativeAuthPath ?? join2(getAgentDir(), "auth.json"),
-      stashPath: seams.nativeStashPath ?? join2(
+      authPath: seams.nativeAuthPath ?? join(getAgentDir(), "auth.json"),
+      stashPath: seams.nativeStashPath ?? join(
         seams.vaultDir ?? getPiAntigravityVaultDir(),
         "google-login-stash.json"
       ),