v2.0.3

What's fixed

• OpenCode 2 requests failing with HTTP 400 when the Claude cache is on. OpenCode 2 marks its last tool definition for its own 5-minute cache. The plugin left that marker in place, so the 1-hour breakpoints it added came after a 5-minute one, and Anthropic rejected every request in hybrid, explicit and automatic mode. Tool markers are now handled with the rest: replaced in hybrid and automatic mode, and upgraded to 1 hour in explicit mode. Requests now stay within Anthropic's limit of four cache breakpoints (#298).
• Cache keepalive on OpenCode 2. The /claude Cache settings for keeping the cache warm were saved on OpenCode 2 but nothing acted on them. OpenCode 2 now tracks hybrid-cache sessions and sends keepalive requests, following the always / window / subagent settings, as OpenCode 1 and Pi do (#314).
• Vault setup with an existing OpenCode login. If OpenCode 1 already holds its own Anthropic login, vault setup used to finish without mentioning it, and every request then refused. Setup now warns before enrolling and again at the end: remove the separate OpenCode Anthropic login, then choose "Claude via credential vault". Setup still leaves that login unchanged (#329).
• Rerunning vault setup when the read grant exists. Some versions of the ck command refuse to create a grant that already exists, and setup reported only permission-refused. The message now explains this and asks you to update the CortexKit tools and run setup again (#330).
• Settings file shown on status screens. The cache, fast mode, logging and request-dump status screens named ~/.config/opencode/anthropic-auth.json, which 2.0 no longer writes. They now show the file your settings are actually saved in: the local pool file, the vault settings file, or the path you set through an environment variable. This applies to OpenCode and Pi (#331).
• Quota floors for vault fallbacks. In vault mode, ordered routing (main-first, fallback-first) used vault fallback accounts without checking your minimumRemaining quota floors. They now get the same checks as local fallbacks. A fallback whose model-specific limit (for example a weekly Fable limit) is used up is now skipped, and the next fallback is tried, instead of ending the request (#332).
• Quota preflight warning. The fallback quota preflight could not obtain a reading log line now includes the kind of error (its name and code), without the error message or any secret (#333).
• Vault fallbacks that need attention stay in the sidebar. A vault fallback that needed signing in again disappeared from the sidebar. Vault accounts that can't serve now stay listed with a reason: "needs sign-in in the vault", "turned off" or "unavailable in the vault". Their last quota reading is marked "dated". Only active accounts that you have turned on are used for requests (#334).
• Stale fallback quota in ordered routing. With main-first or fallback-first in local mode, a fallback was judged on its last saved quota unless the killswitch was on. A recovered account could be skipped, or a drained one used, until the next background check. Routing now refreshes quota that is due before deciding, including the requested model's own limit, whether or not the killswitch is on (#337).
• New vault accounts get a quota reading right away. A Claude account added to the vault while OpenCode was running showed no quota until the next periodic check, about a minute later. It is now checked as soon as it is discovered (#338).
• Plan tier in the sidebar after a failed save. If the main account's profile was fetched but could not be saved, the /claude menu showed the plan tier but the sidebar did not. The sidebar now shows it too, and keeps showing it across later refreshes (#340).
• Leftover cache keepalive files. OpenCode and Pi processes that crashed or were killed left their keepalive record files in the temp folder forever. Records past their 3-minute lease are now removed during normal use (#341).
• Setup failing after vault enrollment. If vault setup failed after a host was already enrolled, setup did not say so, and local setup then refused with only "Disconnect from the vault first." Setup now names each host that stays connected and says how to undo it (/claude → Accounts → Disconnect from the vault in that host) or to run setup again to finish (#342).
• Local setup refusal names the host. "Disconnect from the vault first." is replaced by a message per enrolled host, for example: "Pi is still connected to the vault. Old local settings do not disconnect it. In Pi, run /claude → Accounts → Disconnect from the vault. Then run local setup again." This also covers hosts switched back to local in 1.x that still hold their 1.x enrollment: enrollment alone decides vault or local, and the message explains how to disconnect (#343, #344). The setup help and docs now say that --yes selects every found host, including Pi; run setup without --yes to choose hosts.
• Why disconnect failed. When Disconnect from the vault refused, the menu showed only "Action failed." It now says why and what to do, for example when the enrollment file has unsafe permissions or belongs to another host or plugin, when Pi's stored login conflicts, or when another setup is running. The docs no longer promise that disconnect can always clear a damaged record (#345).
• Routing environment variable docs. The docs now say that OPENCODE_ANTHROPIC_AUTH_ROUTING_STATE_FILE and PI_ANTHROPIC_AUTH_ROUTING_STATE_FILE set the local routing file only. Vault mode keeps its own separate file (#339).
• Pi cache marker on plain-text prompts. When Pi sent the latest prompt as plain text, the plugin could not add its cache marker to it, so the end of the conversation was not cached. It now adds the marker in that case too.
• Relay transport when none is set. A relay without a stored transport sent requests over WebSocket while the docs, setup and sidebar said HTTP. It now follows its URL: wss:// uses WebSocket and anything else, including the https:// relays setup creates, uses HTTP. A stored transport always wins. The sidebar shows a relay only when it has a URL and a token (#336).
• Cancelling during vault re-authorization. If a vault account returned a 401 and you cancelled while the plugin was getting a newer login, the request returned the 401 and the session moved to another account. A cancel now ends the request as cancelled and the session keeps its account. The 401 is still reported to the vault once (#355).
• Changing effort keeps the cache on Opus 5.5 and Sonnet 5.5. Changing the reasoning level mid-session on these models used to reset the prompt cache. The change is now carried the way Claude Code does it, so the cache is kept. Other models are unchanged.
• Pi cache keepalive on Fable 5.1. After a Fable 5.1 session changed its reasoning level, Pi's keepalive requests left out a header that request needed, so they could not keep the cache warm. They now send the same headers as the request itself.
• Quota readings take effect sooner. A fresh quota reading is now used for routing and the sidebar as soon as it arrives, while it is still being saved. A reading that shows the 5-hour or 7-day limit used up counts right away.

What's new

• Setup uses the shared CortexKit runner. bunx @cortexkit/opencode-anthropic-auth setup now runs on the same setup runner as the other CortexKit auth plugins (@cortexkit/common-auth). Host detection, the OpenCode 1 / OpenCode 2 choice, the check for running OpenCode and Pi processes, plugin registration and vault enrollment work the same way across those plugins. Sign-in, migration, Pi's login consent and vault activation stay specific to this plugin. Pressing Escape or Ctrl-C at the vault question now stops setup without changing anything. Setup with no hosts selected exits quietly instead of failing.

• OpenCode 2 can be set up on its own. Choosing OpenCode 2 alone creates an empty local account pool. You then sign in from OpenCode with "Claude Pro / Max (native account pool)". This setup does not read OpenCode 1's login or open any OpenCode database.

• Import OpenCode 1 accounts later. If the pool is still empty, a later OpenCode 1 setup imports your 1.x accounts into it. Your preferences stay, and existing session pins are kept. Once the pool holds accounts, setup skips the import instead of overwriting them.

• OpenCode 1 works beside its own Anthropic login. In local mode, OpenCode 1 now serves from the account pool even when OpenCode also holds its own separate Anthropic login, as long as the pool has a usable sign-in. /claude → Accounts notes that the separate login is not used. Its tokens are never read for requests. Rerunning setup now leaves such a login in place instead of replacing it with a placeholder, and says it is not used. Setup does not import it; add that account through /claude → Accounts (#335).

• Shared quota wording. /claude in OpenCode and Pi and the OpenCode sidebar now show quota the same way as the other CortexKit plugins: the share left ("5h 75% left, resets 1h15m"), with the age of a reading that is not current. The collapsed sidebar shows one line for every account, for example main 5h 38% · 7d 59% · Fa 22% left, with the active account marked.

Compatibility

• Moves to @cortexkit/common-auth 0.18.0.
• Pi 1.x (tested with Pi 1.1) and Pi 0.86 remain supported. The OpenCode sidebar is built for OpenTUI 0.6.

Upgrading

From 2.0.x, update the plugin and restart OpenCode or Pi. No setup step is needed. If you hand-wrote a relay with a wss:// URL, it keeps using WebSocket; to force a transport, set transport to http or websocket.

From 1.x, follow the 2.0.0 upgrade steps: quit every OpenCode, LiteCode and Pi process, then run bunx @cortexkit/opencode-anthropic-auth@2.0.3 setup.