Hosted vault mode through Thalamus (common-auth 0.40.0)
Merged
OA
5d ago+726+726+012345678901234567890123456789-83-83-01234567890123456789
Adopts common-auth 0.40.0's hosted vault mode on OpenCode 1, OpenCode 2 and Pi: with CORTEXKIT_VAULT_HOST=thalamus the plugin gets vault rows only through the host relay, never its own enrollment; menus show 'Served by Thalamus'; setup refuses. Unowned user-key requests still pass through untouched. Includes a real Pi hosted test with the relay in the host process.
Summary by cubic
Adopts common-auth 0.40.0's hosted vault mode on OpenCode 1, OpenCode 2, and Pi. With CORTEXKIT_VAULT_HOST=thalamus, the plugin reads vault rows only through the host relay, never its own enrollment; setup refuses, and menus show "Served by Thalamus". Unowned user-key requests still pass through untouched.
- Hosts without the marker keep their existing enrollment-based behavior.
- Adds a real Pi hosted e2e test with a shipped-client relay in the host process.
- Isolates the test runner and child processes from the new env var, including the discovery fixture.