Borrowing it
Nothing to install: this file belongs to gotgenes/pi-anthropic-auth. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/gotgenes/pi-anthropic-auth/main/.pi/skills/upstream-watch/SKILL.mdgit clone --depth 1 https://github.com/gotgenes/pi-anthropic-authWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gotgenes/pi-anthropic-auth/upstream-watch)<a href="https://agentmods.dev/skills/gotgenes/pi-anthropic-auth/upstream-watch"><img src="https://agentmods.dev/badge/skills/gotgenes/pi-anthropic-auth/upstream-watch/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gotgenes/pi-anthropic-auth/upstream-watch"><img src="https://agentmods.dev/badge/skills/gotgenes/pi-anthropic-auth/upstream-watch.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.02325 |
| Opus 5.5 | $0.00027 | $0.00930 |
| Sonnet 5.5 | $0.00014 | $0.00465 |
| Haiku 4.5 | $0.00007 | $0.00232 |
Grade A, and why
upstream-watch scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 28d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Upstream Watch
This extension is a thin wrapper around upstream internals. Every wrapper has assumptions, and upstream does not know it is holding them. This skill lists those assumptions, names the file that would break each one, and classifies how the breakage shows up.
Impact classes
Triage every candidate finding into one of three classes. The classes differ in what detects them, and two of the three are not detected by the changelog.
| Class | Shows up as | Detected by |
|---|---|---|
| Compile-time | tsc error against the new types |
Scratch-tree typecheck. Free and deterministic. |
| Behavioral-silent | Shaping still runs but emits wrong output; requests still succeed | A canary test, or nothing |
| Coverage-gap | New upstream code path routes around our seam entirely | Reading the watchlist diff. Nothing else. |
Behavioral-silent is the most dangerous class for this package. An OAuth request that is shaped incorrectly still returns 200, so no user reports it and no test fails unless a canary exists for that specific assumption.
Coverage-gap findings are invisible to both the changelog and the test suite, because from our side nothing changed. This is the reason the watchlist below is diffed unconditionally rather than only when a changelog entry points at it.
The watchlist
Diff each of these between the installed tag and the new tag, regardless of what the changelogs say.
Paths are relative to ~/development/pi/pi.
| Our assumption | Upstream file | Breaks as |
|---|---|---|
anthropicMessagesApi().streamSimple is exported from the compat entrypoint |
packages/ai/src/compat.ts, packages/ai/src/api/anthropic-messages.lazy.ts |
Coverage-gap (our resolver throws at load) |
registerProvider merges over prior registrations, including over another extension's registration of a config-named provider; unregisterProvider exists |
packages/coding-agent/src/core/model-runtime.ts, core/extensions/runner.ts |
Compile-time or coverage-gap (a named provider loses its owner's oauth/models, or our wrapper) |
An extension-only provider without its own streamSimple falls through to getApiProvider(model.api), the same bare transport our wrapper delegates to |
packages/coding-agent/src/core/provider-composer.ts (streamWith) |
Behavioral-silent (wrapping a config-named provider stops being pass-through for non-OAuth requests) |
getAgentDir() is exported from the @earendil-works/pi-coding-agent root and honors PI_CODING_AGENT_DIR |
packages/coding-agent/src/config.ts, src/index.ts |
Compile-time, or the global config silently not read |
session_start is awaited before the first request, and its ctx carries cwd and isProjectTrusted() |
packages/coding-agent/src/core/agent-session.ts (bindExtensions), core/extensions/types.ts |
Coverage-gap (the first request on a project-named provider goes out unshaped) |
provider-composer routes the main loop and compaction through our wrapper |
packages/coding-agent/src/core/provider-composer.ts (streamWith) |
Coverage-gap |
ModelRegistry.streamSimple delegates to ModelRuntime.streamSimple, the supported path docs/architecture.md recommends for background agents (Issue #53) |
packages/coding-agent/src/core/model-registry.ts, core/model-runtime.ts |
Coverage-gap (background agents on the supported path go unshaped) |
The agent-core default-stream fallback stays legacy-only: getDefaultStreamFn unexported, streamFn required in the types (Issue #53) |
packages/agent/src/index.ts, src/types.ts, src/agent-loop.ts |
Coverage-gap (if it becomes a first-class path, re-evaluate the rejected provider-aware setDefaultStreamFn override) |
OAuth params.system is [identity, prompt] text blocks |
packages/ai/src/api/anthropic-messages.ts (params.system) |
Behavioral-silent |
messages[] carries role: "system" entries only for section updates and per-message effort, both handled by shapeSystemRoleMessages |
packages/ai/src/api/anthropic-messages.ts (convertMessages, insertThinkingLevelMessages) |
Coverage-gap (a new system-message kind reaches Anthropic unshaped, or is dropped when shaping empties it) |
Managed-effort models (compat.supportsMidConvoEffort) pin top-level output_config.effort to "high" and carry the requested effort in content-less role: "system" messages with output_config (PR #79) |
packages/ai/src/api/anthropic-messages.ts (insertThinkingLevelMessages) |
Behavioral-silent (the keep rule goes dead, or effort is lost); test/managed-effort-drift.test.ts alarms |
Pi's default prompt is an untagged preamble plus <name> sections matching PI_OWNED_SECTIONS and our anchors |
packages/coding-agent/src/core/system-prompt.ts (buildSystemPromptSections), packages/ai/src/utils/text.ts (getSystemMessageText) |
Behavioral-silent |
Mid-conversation section updates keep the Updated/Removed system prompt section "<name>" framing |
packages/ai/src/utils/text.ts (renderSystemMessageUpdate) |
Behavioral-silent |
Requests without an sk-ant-oat token pass through untouched, including Anthropic workload identity federation (pi 0.99.2), which reaches our wrapper with no apiKey and its ids in options.env |
packages/ai/src/api/anthropic-messages.ts (getAnthropicFederation), packages/ai/src/providers/anthropic.ts |
Behavioral-silent (a non-OAuth path gets shaped, or loses the caller's fetch) |
Built-in extension sections such as mcp_servers (pi 0.99.2) carry neutral text, so shaping keeps them byte-identical, including their mid-conversation re-sends |
packages/coding-agent/src/extensions/mcp/index.ts (renderServersSection) |
Behavioral-silent (Pi identity text in such a section reaches Anthropic unshaped) |
Login and refresh stay delegated to the built-in anthropicOAuth |
packages/ai/src/oauth*, coding-agent auth wiring |
Compile-time or runtime throw |
claudeCodeVersion in pi's user-agent vs. our cc_version pin |
packages/ai/src/api/anthropic-messages.ts (claudeCodeVersion) |
One rejected round trip, then recovered at the named floor (Issue #75); a hard failure only when the override is set or the floor is unnamed |
Anthropic names the floor as version X.Y.Z or newer is required in a claude_code_version_too_old 400 |
Anthropic API (no upstream file); src/version-rejection.ts |
Behavioral-silent (recovery degrades to a hint) |
New auxiliary request paths still reach ModelRuntime |
any new caller (cache warmer, background agents, extension model APIs) | Coverage-gap (unshaped OAuth request) |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 28d ago Changed · +2 lines c2d8aff3f9a6
- 1mo ago Changed · +6 lines 048c6ebdf8b3
- 1mo ago Changed · +1 lines 13f6d467caee
- 1mo ago First seen · 112 lines · 68 tokens per session scan A 94680c38b82b
upstream-watch is a skill published in the GitHub repository gotgenes/pi-anthropic-auth (426 stars, last pushed 13d ago), licensed MIT. It adds 68 tokens to every session and 2,325 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-21.
Other skills, from other repositories
api-integration-architect
Design, implement, debug, and optimize API integrations with expert-level patterns for REST, GraphQL, webhooks, and authentication flows.
configuration-logging
Configure AuthCrunch diagnostic skip rules, Caddy credential redaction, and logger boundaries. Use for component/message filtering and safe credential diagnostics; authorization outcomes remain unchanged.
break-fix-troubleshooting
Diagnose caddy-security deployment and runtime failures from configs, logs, versions, and HTTP evidence. Use for focused fixes, unresolved support handoffs, or preparing break-fix issue reports.
provider-setup
Reports which delegation CLIs are installed and authenticated, installs missing ones, and stores the result. Use before delegating or when a provider errors.
prose-review
Review prose written for others (e.g., user-facing documentation, prompts for other LLMs, reports, plans, inline comments, docstrings) for local jargon leakage, orphaned references, missing grounding, and audience or genre mismatch. Always run on prose you produce or materially edit, except for routine conversational…
text-search
Search indexed text corpora with qmd. For indexed content, prefer qmd over grep.