Adopt common-auth 0.43.0 and propose vault display names

docs/setup.md

@@ -38,7 +38,9 @@ Vault mode is always on. `--claustrum` is accepted for compatibility;
 
 ## Approve enrollment and grant access
 
-Approve each host's separate enrollment in `ck auth`. Setup prints the exact
+Approve each host's separate enrollment in `ck auth`. The apps show
+"Model API keys for OpenCode" or "Model API keys for Pi" when you approve the
+connection. Setup prints the exact
 approval and grant commands and the resolved state paths. Enrollment alone
 does not grant credential access: follow the printed grant command for the
 `llm-provider` category before activating a provider.

packages/core/package.json

@@ -12,8 +12,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@cortexkit/claustrum-client": "^0.16.0",
-    "@cortexkit/common-auth": "^0.41.1",
+    "@cortexkit/claustrum-client": "^0.17.0",
+    "@cortexkit/common-auth": "^0.43.0",
     "@cortexkit/private-files": "^0.2.2",
     "@cortexkit/subc-client": "^0.24.0"
   }

packages/opencode/package.json

@@ -33,8 +33,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@cortexkit/claustrum-client": "^0.16.0",
-    "@cortexkit/common-auth": "^0.41.1",
+    "@cortexkit/claustrum-client": "^0.17.0",
+    "@cortexkit/common-auth": "^0.43.0",
     "@cortexkit/private-files": "^0.2.2",
     "@cortexkit/subc-client": "^0.24.0"
   },

packages/opencode/src/setup.ts

@@ -103,9 +103,14 @@ export async function runClaustrumSetup(
       hosts: {
         opencode: {
           name: opencodeEnrollment,
+          displayName: 'Model API keys for OpenCode',
           paths: { stateDir: states.opencode, host: 'opencode' },
         },
-        pi: { name: piEnrollment, paths: { stateDir: '', host: 'pi' } },
+        pi: {
+          name: piEnrollment,
+          displayName: 'Model API keys for Pi',
+          paths: { stateDir: '', host: 'pi' },
+        },
       },
     },
     beforeSignIn: async (host, context) => {

packages/opencode/test/setup-harness.ts

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs'
 import path from 'node:path'
 import { Readable, Writable } from 'node:stream'
+import type { ClaustrumEnrollmentClient } from '@cortexkit/common-auth/claustrum'
 import type { SetupIO } from '@cortexkit/common-auth/setup'
 import { bundleOptions } from '../../../scripts/build-options.ts'
 import type { runFixtureSetup } from '../setup-test-entry.ts'
@@ -67,6 +68,9 @@ export function setupIO(
     PATH: bin,
   }
   const proposals: string[] = []
+  const proposalInputs: Parameters<
+    ClaustrumEnrollmentClient['enrollPropose']
+  >[0][] = []
   const commands: { file: string; args: readonly string[] }[] = []
   let output = ''
   const isLauncher = (file: string) =>
@@ -120,7 +124,9 @@ export function setupIO(
       },
     },
     connect: async () => ({
-      async enrollPropose({ name }) {
+      async enrollPropose(input) {
+        proposalInputs.push(input)
+        const { name } = input
         proposals.push(name)
         return { requestId: name }
       },
@@ -135,5 +141,5 @@ export function setupIO(
       close() {},
     }),
   }
-  return { io, env, proposals, commands, output: () => output }
+  return { io, env, proposals, proposalInputs, commands, output: () => output }
 }

packages/opencode/test/setup.test.ts

@@ -298,6 +298,27 @@ test('test setup build enrolls once per host, discovers rows, prints provider ac
   )
 })
 
+test('setup proposes a person-facing display name for each vault host', async () => {
+  const root = await profile()
+  const h = setupIO(root)
+  await runClaustrumSetup(
+    ['setup', '--yes', '--enroll-only', '--host=opencode', '--host=pi'],
+    h.io,
+  )
+  expect(h.proposalInputs).toEqual([
+    {
+      name: 'claustrum-auth-opencode',
+      displayName: 'Model API keys for OpenCode',
+      requestSecretHash: expect.stringMatching(/^[a-f0-9]{64}$/u),
+    },
+    {
+      name: 'claustrum-auth-pi',
+      displayName: 'Model API keys for Pi',
+      requestSecretHash: expect.stringMatching(/^[a-f0-9]{64}$/u),
+    },
+  ])
+})
+
 test('setup refuses local sign-in and delegates enroll-only without host registration or credential reads', async () => {
   const root = await profile()
   const h = setupIO(root)

packages/pi/package.json

@@ -31,8 +31,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@cortexkit/claustrum-client": "^0.16.0",
-    "@cortexkit/common-auth": "^0.41.1",
+    "@cortexkit/claustrum-client": "^0.17.0",
+    "@cortexkit/common-auth": "^0.43.0",
     "@cortexkit/private-files": "^0.2.2",
     "@cortexkit/subc-client": "^0.24.0"
   },