@bitkyc08/opencodex 2.27.0 → 2.28.0

package/src/generated/compatibility-version.json

@@ -10,7 +10,7 @@
     },
     {
       "path": "package.json",
-      "sha256": "f51abeea3f3868735b479d9b97b58e7cbdc452e9e5cc4937dfa794a40d9e10c7"
+      "sha256": "7a24163416c4a91b5c086551f354ad721b4dd57b8e92216aab025231446d69ac"
     },
     {
       "path": "scripts/model-metadata.source.json",
@@ -34,7 +34,7 @@
     },
     {
       "path": "src/adapters/anthropic.ts",
-      "sha256": "1d332a1ca8a265bd1e2f534fafed109c5fffc0b60fabd721b52e374c36482230"
+      "sha256": "cdbc3a5d6867fb7b93538177e2e670f5bc770406c09dbc6eb9a891f757eb24b8"
     },
     {
       "path": "src/adapters/azure.ts",
@@ -42,7 +42,7 @@
     },
     {
       "path": "src/adapters/base.ts",
-      "sha256": "e3371fb84f8af57cc772bb3b79b1b5af08a6158cb7bdb815b4c8fafb5eaf91e5"
+      "sha256": "11736116daa190c3cdfbbf9fc71ddae6c35f37e11a55b4863ec6fe5423e57b70"
     },
     {
       "path": "src/adapters/client-fingerprint.ts",
@@ -194,7 +194,7 @@
     },
     {
       "path": "src/adapters/google-antigravity-replay.ts",
-      "sha256": "52704bcd65eab346025e6faffe70d0c1d07e39651e4139f34bc67759fbaa4f08"
+      "sha256": "95fe3bb064585eec1a0d9ffb411548b7a0410d94ab92054f1d4ea5e105d2d8f2"
     },
     {
       "path": "src/adapters/google-antigravity-wire.ts",
@@ -222,7 +222,7 @@
     },
     {
       "path": "src/adapters/google.ts",
-      "sha256": "e773b9fc6481ad14b075ceebf4fa950405fe9d775454408d8df37044b17a5aaf"
+      "sha256": "96b3ced298609ba34f1022150813f3cc2525917fbc579689cfe7631642a9ada6"
     },
     {
       "path": "src/adapters/identity.ts",
@@ -286,7 +286,7 @@
     },
     {
       "path": "src/adapters/openai-chat.ts",
-      "sha256": "da14137945b5df7764ef9c40e24b0ebce284bf2d91acf620921041eeff61e7cb"
+      "sha256": "39007bc71a8c52318808c2c22c7796a7e5c40cfe765ace8882e1b125da91a47a"
     },
     {
       "path": "src/adapters/openai-responses-url.ts",
@@ -294,7 +294,7 @@
     },
     {
       "path": "src/adapters/openai-responses.ts",
-      "sha256": "182f672a29b05c3f062bfabc74bed99fadd2b915ec8e8d187887b6fedad7d25d"
+      "sha256": "fdf3093779304cb6b12195f5170c1e90072bb8104eef6856f676a277b877ca27"
     },
     {
       "path": "src/adapters/registry.ts",
@@ -490,7 +490,7 @@
     },
     {
       "path": "src/cli/index.ts",
-      "sha256": "8dbbddb81c22001ba41fcd9239767754593ea110052ceb8507656f83cbe1d3e0"
+      "sha256": "b83e3b8d02ef0fd52eab24b105e044a62b9091938e92b17726b7c707cdbfda0b"
     },
     {
       "path": "src/cli/init.ts",
@@ -630,7 +630,7 @@
     },
     {
       "path": "src/codex/account-usability.ts",
-      "sha256": "3f377034f5bbc74a25d431cf9a02f137089dc39cf696dfe42342086f60148b75"
+      "sha256": "b01f00c83be2d815eecea92e9fee54d968f6e861c7d262dfbb76db2e23d1c898"
     },
     {
       "path": "src/codex/admission.ts",
@@ -646,7 +646,7 @@
     },
     {
       "path": "src/codex/auth-api.ts",
-      "sha256": "026a563ba1e4049c5ba79083f1eb183e3f9ab7d078f28b7c6e9d9cc556be8b02"
+      "sha256": "e9e1dcd8c0ac39c93a1ed7977398bd5ce518669f5cc04b9f1331d2d1f54d9ed1"
     },
     {
       "path": "src/codex/auth-collision.ts",
@@ -654,7 +654,7 @@
     },
     {
       "path": "src/codex/auth-context.ts",
-      "sha256": "4ee0af8ad36c280e74055ed0b6a4652e3f56f1aa76b97d95d97ddd67e9f91465"
+      "sha256": "c7bc48d325399fd22a5140d0c9b3a47746bacfff8a3d6d6192f717aa0dfd4535"
     },
     {
       "path": "src/codex/autostart-health.ts",
@@ -702,11 +702,11 @@
     },
     {
       "path": "src/codex/catalog/metadata.ts",
-      "sha256": "fc1cce8854a517f6c80ce137a02fb183c6710899f2a1d7536707c00ad56b4de6"
+      "sha256": "e1c798b07f69a0c6130581096a1bc99ecad597e835895df58d1d76ab8f855f3e"
     },
     {
       "path": "src/codex/catalog/native-models.ts",
-      "sha256": "d0d8764f7d9b1d102350527f8b196beac0db5ed492ae2b2147158d57981494f7"
+      "sha256": "60004cd7ee40ddf892dfd793608a1a35c9f6d3e19b25a1690482ded275432e08"
     },
     {
       "path": "src/codex/catalog/parsing.ts",
@@ -718,7 +718,7 @@
     },
     {
       "path": "src/codex/catalog/sync.ts",
-      "sha256": "c0fa454b88d4efa4109039a33510cbdc0e547499d6d521debb2f7f2f614c0dfe"
+      "sha256": "b92ba2e7caba143497e9f1289c2e4235a50adf03e09529cd6d4402d1905b3497"
     },
     {
       "path": "src/codex/codex-write-lock.ts",
@@ -730,7 +730,7 @@
     },
     {
       "path": "src/codex/convergence.ts",
-      "sha256": "ffe1a891c51b33ace33d99bb11ca36015544189f8c4bb1966c2bb08469a163fb"
+      "sha256": "4ab2e8828a32a1b6235528d0b9be18b24c7457c485972a00492a4a1675bb9c0a"
     },
     {
       "path": "src/codex/custom-model-catalog-migration.ts",
@@ -860,6 +860,10 @@
       "path": "src/codex/model-cache.ts",
       "sha256": "f49cb78b3af7487d1da6f9bbb578615a75644f1a176e5ca89096186219456e94"
     },
+    {
+      "path": "src/codex/model-entitlements.ts",
+      "sha256": "3f3a688f47877faf43f3ec59c2ecf8fce7afd039f7cca7725c1ffd57189c1829"
+    },
     {
       "path": "src/codex/native-main-admission.ts",
       "sha256": "1f4956299bf243980bb06c7ddcfdadf71497cd874d3c1c49cb28465f27f6c85f"
@@ -958,7 +962,7 @@
     },
     {
       "path": "src/codex/quota.ts",
-      "sha256": "5adb6824a01a928c37effa5b0cd745e2efb25baf1033079d5a81ff33b4cf0549"
+      "sha256": "5be1ce7479ecfb77bdbd1fce2a3f2f0236e93c4ab17e415a1711269359cd44ca"
     },
     {
       "path": "src/codex/refresh.ts",
@@ -970,7 +974,7 @@
     },
     {
       "path": "src/codex/routing.ts",
-      "sha256": "741aeeb7c6939a859500e6424c6676fe7c247472392108b2616a2dc4a2349374"
+      "sha256": "2e3af0b15bd8b147bbf2b9e5c4117e1d6e2b051fa20b4ee028c94a1b721f0647"
     },
     {
       "path": "src/codex/runtime.ts",
@@ -1702,7 +1706,7 @@
     },
     {
       "path": "src/lib/destination-policy.ts",
-      "sha256": "7558278af108a066982b06fc9550dce7460c2dd22fb1a31f6f2edc8878bca7a2"
+      "sha256": "68c92a0c4748d0d086e48c1019ef9c4e72a835524dd4c16047f5f099389f35b8"
     },
     {
       "path": "src/lib/errors.ts",
@@ -1818,7 +1822,7 @@
     },
     {
       "path": "src/lib/shadow-call.ts",
-      "sha256": "2e55cf6e560b18337ac1911b38f20a27c1bd985a65e9496783f2a7cf85014bc6"
+      "sha256": "d5fe5af453ef4699403809358d587b43dd57fc1ccaa5972863e9ebc68787119c"
     },
     {
       "path": "src/lib/sidecar-tracker.ts",
@@ -1966,7 +1970,7 @@
     },
     {
       "path": "src/oauth/index.ts",
-      "sha256": "7209f64fa8552dbf7253f1d9fac61bb24577ff05d17617328bc82dadd18f83d5"
+      "sha256": "4b6603e57e1b5b13a37c27876ba1d85066e145b06507d40923ede0f6c0892625"
     },
     {
       "path": "src/oauth/key-providers.ts",
@@ -2006,7 +2010,7 @@
     },
     {
       "path": "src/oauth/store.ts",
-      "sha256": "61c14ad05498f0146aec503f8618a4249d8064967377c6c782437276c9ab0ac5"
+      "sha256": "d68c60975ba91aadda30d5a75bcabdad7f265115b280b32cd046aaffaac256a2"
     },
     {
       "path": "src/oauth/token-guardian.ts",
@@ -2062,7 +2066,7 @@
     },
     {
       "path": "src/providers/fastwire.ts",
-      "sha256": "c6ad24cedb9cf0a039603552fc17c639332ecf28231ccdccb46e16f11dd775f6"
+      "sha256": "00450dcc15d43905900dbf0623db69e09365731ace576f42fef66bee5ca2752d"
     },
     {
       "path": "src/providers/free-directory.ts",
@@ -2134,11 +2138,11 @@
     },
     {
       "path": "src/providers/quota.ts",
-      "sha256": "6d101988931c219b5d96f2f0f7d8ea84591ec8445585020f74b847b33149ca76"
+      "sha256": "d74e47b5106a03d447532f283bdbfe96f632dee1ef662014bbfb049ddb857c8d"
     },
     {
       "path": "src/providers/registry.ts",
-      "sha256": "336fd0d6d81354a69b8c577e162dd73dd69e196b13ef82d51720897fc16d9fa5"
+      "sha256": "a884fc088434fbb5d45ed6ef8f56435c730e8701334c475ac6251a37322a514e"
     },
     {
       "path": "src/providers/request-pacing.ts",
@@ -2146,7 +2150,7 @@
     },
     {
       "path": "src/providers/service-tier.ts",
-      "sha256": "ebfb65e1e4983d60504a91ed4c97bb5df541b6307bbec1436f9999e2ff524545"
+      "sha256": "56198ef6740a3b7dbd59c605669383dc52d4004032818c54b1a0289bf34e2c3f"
     },
     {
       "path": "src/providers/slug-codec.ts",
@@ -2178,7 +2182,7 @@
     },
     {
       "path": "src/responses/parser.ts",
-      "sha256": "ad950568ee4f921b33a94acfaf214ddabe31c9701f6e7d4d73923f34a1b466e3"
+      "sha256": "9fc33a85338232e63d2bfee50edd859319720b11911f0d2497b3831a7af103ca"
     },
     {
       "path": "src/responses/provider-opaque-metadata.ts",
@@ -2212,13 +2216,17 @@
       "path": "src/responses/tool-groups.ts",
       "sha256": "b2750b33ec7bb5a7f76f27584bf99372fac4f253dd287849b2f3f9821db574cd"
     },
+    {
+      "path": "src/responses/tool-search-compat.ts",
+      "sha256": "25ddbc4dd8f04ce43804aab64fdf5dcc402703529b8252d2c64bbb5749ece4a6"
+    },
     {
       "path": "src/responses/truncated-stop-reason.ts",
       "sha256": "44a1876c045a63f9275410fb9169d2c47ce0c1de309e9cc00a0f51c72698a6dd"
     },
     {
       "path": "src/router.ts",
-      "sha256": "9eb5c0ea04fcb51150d91308138d3fab25dd19a85bc7bb273295c7924e1b128e"
+      "sha256": "6cca7c4d7b1b18b0d7acc2d132c1b2b456b091f90cbcf7556dfbfb98e43e16b9"
     },
     {
       "path": "src/routing/analytics.ts",
@@ -2226,7 +2234,7 @@
     },
     {
       "path": "src/routing/capability.ts",
-      "sha256": "e4c7da723d461ac41b18cdf5d80085887a0b0e46917bcb4e012f52fc431475d0"
+      "sha256": "119b4002bb7cfd25763b9afe37b6099bd3d332968f23fb7f504bccbb5a605b31"
     },
     {
       "path": "src/routing/compatibility/assemble.ts",
@@ -2234,7 +2242,7 @@
     },
     {
       "path": "src/routing/compatibility/behavior.ts",
-      "sha256": "e7006c3aebe1d36b6d7a9cd97f287599fc231ba0ddb7163c7a502ac67ad6d84f"
+      "sha256": "8b7a15e57a15312ebd0caf9baadd0e2438373aa0434edf336766efed1eff13ea"
     },
     {
       "path": "src/routing/compatibility/catalog.ts",
@@ -2338,7 +2346,7 @@
     },
     {
       "path": "src/server/chat-native.ts",
-      "sha256": "18ba244fd5ebd4a1b4a78a4b0aead236a4968a347d91e3130f73e2fc1c7f01f6"
+      "sha256": "73f1c79e390998bb6e3be373c27b43921c05a79e61ebe63a6a782255da3e777b"
     },
     {
       "path": "src/server/claude-messages.ts",
@@ -2370,7 +2378,7 @@
     },
     {
       "path": "src/server/index.ts",
-      "sha256": "a7276cdfd8dd11936c52c5235378d2ea7bc8d47ee64ba8ef07a5738cb34bcb28"
+      "sha256": "2d07435626dcfea1f6d1013ff9c299b1af4cde07ed4fafd1fda318483ec42418"
     },
     {
       "path": "src/server/lifecycle.ts",
@@ -2398,7 +2406,7 @@
     },
     {
       "path": "src/server/management/agent-settings-routes.ts",
-      "sha256": "97487f7dadf5abae969085b6058f430fce0d309e8882eaeeedae078ccc6cafc9"
+      "sha256": "9833b1d65c894fb43b66757a6e6063868b1e57a140fa0f8a7004f88dac9551ea"
     },
     {
       "path": "src/server/management/api-access.ts",
@@ -2550,7 +2558,7 @@
     },
     {
       "path": "src/server/request-log.ts",
-      "sha256": "e94e8d62f2993d64361f0eaf9dd767488e8e0586390e3d1683e9774bee94f355"
+      "sha256": "e325fcb803850ee8e6426a1f7ecd18d014240b77ff40ea492e36e70fa9bee055"
     },
     {
       "path": "src/server/responses-custom-tool-repair.ts",
@@ -2584,6 +2592,10 @@
       "path": "src/server/responses-terminal-repair.ts",
       "sha256": "d7467f1c5e0c93236c27fd3b9edab289f14cca6d15d07dfe00b3fb6f1f04e0ae"
     },
+    {
+      "path": "src/server/responses-tool-search-repair.ts",
+      "sha256": "a59a7cdbd734b2695f273419f615bc3478118c8b54fff85fc712f2f259f83718"
+    },
     {
       "path": "src/server/responses-undeclared-tool-guard.ts",
       "sha256": "1846475786b9009d6d2c4620aa3fc8abcfd39fb07531f14e65182437848168bb"
@@ -2606,11 +2618,11 @@
     },
     {
       "path": "src/server/responses/compact.ts",
-      "sha256": "28bf7c356d9b7290adbb04411b89790ee8040ed798a088a98e6c0d499e4f030b"
+      "sha256": "26ce4c5c090d7de26f62384aa4bee31b7a8feca7737fd49a57dcd3528eae7331"
     },
     {
       "path": "src/server/responses/core.ts",
-      "sha256": "1d3e6811caa5bd45bc89673102a53663308f9dea7d8054ff1f7aaa65428e5840"
+      "sha256": "0b0d9ad6d5364b663c5135a7fd620de4bc0b728f9a7331c3babbedce1522d866"
     },
     {
       "path": "src/server/responses/empty-completion-guard.ts",
@@ -2642,11 +2654,11 @@
     },
     {
       "path": "src/server/responses/responses-field-backfill.ts",
-      "sha256": "728497e1b8ebc7b65ac22156f210f3714871b162c8ab8867b9c9709acf3fdef6"
+      "sha256": "b12433c439602b074949cadeeb5dc490babf83a6bf2a01ba9f2e38bae54c2cf3"
     },
     {
       "path": "src/server/responses/terminal-guard.ts",
-      "sha256": "83803848122bf976d148b90d0b145cd1478fe92ba2b5bda6604232e8ff508ba7"
+      "sha256": "4c74112c8cf6fde636ef477a2f4decdd5ca3f5c9fc3757dc951e812c161d9520"
     },
     {
       "path": "src/server/responses/upstream-error.ts",
@@ -2678,7 +2690,7 @@
     },
     {
       "path": "src/server/system-env.ts",
-      "sha256": "b068365c21dbc6c92de920f9ebb3c771b9f82ecff0dfa315618923d748a93025"
+      "sha256": "e83b17223b42325c562be8925bfe573d4c342c68b0c9195b39657cfb64d3f0ea"
     },
     {
       "path": "src/server/windows-tcp-drop.ts",
@@ -2862,7 +2874,7 @@
     },
     {
       "path": "src/usage/log.ts",
-      "sha256": "ffaf10b5cdd15e728c45bca706cfe7fd73589043c1e66d36fd13225370be99bb"
+      "sha256": "828fc644e10306f77ad6d371f3e042554dc4f65e9cfee721aa9df2c5a294b9a1"
     },
     {
       "path": "src/usage/summary.ts",

package/src/lib/destination-policy.ts

@@ -130,6 +130,50 @@ function registryAllowsPrivateNetwork(name: string): boolean {
   return getProviderRegistryEntry(name)?.allowPrivateNetworkByDefault === true;
 }
 
+/**
+ * OAuth registry entries that opt into `allowBaseUrlOverride` send bearer credentials to a
+ * user-configured endpoint (review findings, PR #2109 / PR #2110): a cleartext `http:`
+ * override would expose the OAuth token on the wire. `https:` is therefore required for
+ * every non-local destination. Loopback/localhost/private relays keep working over
+ * `http:` because they already sit behind the explicit `allowPrivateNetwork` opt-in
+ * enforced by {@link providerDestinationConfigError}. Keyed/local providers (Ollama,
+ * vLLM, LM Studio, LiteLLM, Moonshot, Qwen, Alibaba) are untouched: they are not
+ * `authKind: "oauth"`, so this check never fires for them.
+ */
+function registrySendsOAuthToOverriddenBaseUrl(name: string): boolean {
+  const entry = getProviderRegistryEntry(name);
+  return entry?.authKind === "oauth" && entry.allowBaseUrlOverride === true;
+}
+
+export function providerSecureTransportConfigError(
+  name: string,
+  provider: Pick<OcxProviderConfig, "baseUrl" | "allowPrivateNetwork">,
+): string | null {
+  if (!registrySendsOAuthToOverriddenBaseUrl(name)) return null;
+  let parsed: URL;
+  try {
+    parsed = new URL(provider.baseUrl.trim());
+  } catch {
+    return null; // invalid URLs are providerBaseUrlConfigError's concern
+  }
+  if (parsed.protocol !== "http:") return null;
+  const assessment = assessDestination(provider.baseUrl);
+  // Classify FIRST, then consult the opt-in. `allowPrivateNetwork` says "this destination is
+  // intentionally local", which is a statement about the address, not a waiver of transport
+  // security — reading it before classification let `http://attacker.example` with the opt-in
+  // set carry an OAuth bearer in cleartext to a public host.
+  if (!assessment) return null;
+  const local = assessment.kind === "localhost"
+    || assessment.kind === "loopback"
+    || assessment.kind === "private";
+  if (local && providerAllowsPrivateNetwork(name, provider)) {
+    // A genuinely local relay over http stays reachable through the explicit opt-in; the
+    // private-network gate still governs whether it may be reached at all.
+    return null;
+  }
+  return "baseUrl must use https: this provider sends OAuth credentials to its endpoint, and http is allowed only for loopback/private relays";
+}
+
 /**
  * Whether a provider may reach loopback/private addresses.
  *
@@ -150,6 +194,8 @@ export function providerAllowsPrivateNetwork(
 }
 
 export function providerDestinationConfigError(name: string, provider: Pick<OcxProviderConfig, "baseUrl" | "allowPrivateNetwork">): string | null {
+  const secureTransportError = providerSecureTransportConfigError(name, provider);
+  if (secureTransportError) return secureTransportError;
   const assessment = assessDestination(provider.baseUrl);
   if (!assessment) return null;
   if (assessment.kind === "public" || assessment.kind === "hostname") return null;
@@ -331,3 +377,4 @@ export async function resolvePublicAddresses(
 export async function assertUrlResolvesPublic(url: string): Promise<void> {
   await resolvePublicAddresses(url);
 }
+

package/src/lib/shadow-call.ts

@@ -29,6 +29,21 @@ export function isShadowSourceModel(modelId: string, configured?: unknown): bool
   return shadowSourceModels(configured).some(prefix => modelId.startsWith(prefix));
 }
 
+/**
+ * The configured source prefix this model matched, or undefined.
+ *
+ * Callers that RECORD the intercepted model must record this rather than the caller's raw
+ * `modelId`. Matching is by prefix, so `gpt-5.6-luna` plus arbitrary trailing text still
+ * intercepts — and the raw string is caller-controlled, reaches `usage.jsonl` and `/api/logs`,
+ * and only passes a pattern-based redactor on the way. A credential family that redactor does
+ * not recognize survives verbatim. Returning the operator-configured prefix keeps the log
+ * field inside a set the operator chose, so no caller string is ever persisted.
+ */
+export function shadowSourceModelPrefix(modelId: string, configured?: unknown): string | undefined {
+  if (modelId.includes("/")) return undefined;
+  return shadowSourceModels(configured).find(prefix => modelId.startsWith(prefix));
+}
+
 /**
  * Decide whether a matching source model should use the opt-in intercept.
  *

package/src/oauth/index.ts

@@ -17,7 +17,7 @@ import { loginCommandCode, refreshCommandCodeToken } from "./command-code";
 import { ANTIGRAVITY_REQUEST_UA } from "../adapters/google-antigravity-wire";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
 import { apiKeyPoolEntryId, sanitizeApiKeyValue } from "../providers/api-keys";
-import { effectiveGoogleMode, getProviderRegistryEntry, providerMatchesRegistryTransport } from "../providers/registry";
+import { effectiveGoogleMode, getProviderRegistryEntry, mergeRegistryStaticHeaders, providerMatchesRegistryTransport } from "../providers/registry";
 import { resolveProviderModelDiscoveryUrl } from "../providers/model-discovery";
 import { resolveProviderTransport } from "../providers/xai-transport";
 import { detectClaudeCodeToken, detectGrokCliToken, hasComparableGrokIdentity, isSameGrokIdentity, shouldAdoptGrokGeneration } from "./local-token-detect";
@@ -322,6 +322,13 @@ export class OAuthReauthIdentityUnverifiedError extends Error {
   }
 }
 
+class OAuthLoginSupersededError extends Error {
+  constructor() {
+    super("OAuth login was superseded before credential persistence");
+    this.name = "OAuthLoginSupersededError";
+  }
+}
+
 /** Project arbitrary OAuth failures onto the small, stable public error vocabulary. */
 export function publicOAuthAuthenticationErrorMessage(error: unknown): string {
   if (error instanceof OAuthMutationBusyError) {
@@ -828,7 +835,16 @@ export function buildModelsRequest(
     undefined,
     copilotApiBaseUrl,
   );
-  const headers: Record<string, string> = { ...(effectiveProvider.headers ?? {}) };
+  // Model discovery is an upstream request like any other, so it carries the same registry
+  // static headers the inference path does. Without this a provider is identified correctly
+  // when it answers a completion but anonymously when it lists its own models, which is the
+  // kind of split fingerprint an upstream rate limiter reads as two different clients.
+  const registryStaticHeaders = providerMatchesRegistryTransport(providerName, effectiveProvider)
+    ? getProviderRegistryEntry(providerName)?.staticHeaders
+    : undefined;
+  const headers: Record<string, string> = {
+    ...(mergeRegistryStaticHeaders(registryStaticHeaders, effectiveProvider.headers) ?? {}),
+  };
   const discoveryUrl = (defaultUrl: string): string => resolveProviderModelDiscoveryUrl(
     providerName,
     prov,
@@ -1096,6 +1112,7 @@ interface RunLoginDeps {
   settleKiroLoginTransaction?: typeof settleKiroLoginTransaction;
   removeAccount?: typeof removeAccount;
   setActiveAccount?: typeof setActiveAccount;
+  assertCurrentOwner?: () => void;
 }
 
 /** Roll back only accounts created by this forced login, preserving concurrent refreshes of others. */
@@ -1145,6 +1162,7 @@ export async function runLogin(
   const cred: OAuthCredentials = rawCred.source ? rawCred : { ...rawCred, source: "oauth" };
   const settleKiroTransaction = deps.settleKiroLoginTransaction ?? settleKiroLoginTransaction;
   try {
+    deps.assertCurrentOwner?.();
     // Validate the provider row before credential persistence. A namespace claimed during the
     // credential write is handled again below before the latest row is re-upserted.
     if (provider !== "chatgpt") {
@@ -1165,10 +1183,13 @@ export async function runLogin(
       if (!identityMatches) {
         throw new OAuthReauthIdentityMismatchError();
       }
-      await (deps.saveAccountCredential ?? saveAccountCredential)(provider, opts.reauthAccountId, cred);
+      await (deps.saveAccountCredential ?? saveAccountCredential)(provider, opts.reauthAccountId, cred, {
+        assertBeforePersist: deps.assertCurrentOwner,
+      });
     } else {
       await (deps.saveCredential ?? saveCredential)(provider, cred, {
         preserveIdentityless: opts?.forceLogin === true,
+        assertBeforePersist: deps.assertCurrentOwner,
       });
     }
     if (provider !== "chatgpt") {
@@ -1235,6 +1256,7 @@ export async function runLogin(
  */
 const loginState = new Map<string, { error?: string; done: boolean }>();
 const loginAbort = new Map<string, AbortController>();
+const kiroLoginSettling = new Set<string>();
 
 /** Pending paste for a login in progress: either a waiter or a stashed early submission. */
 interface ManualCodeSlot {
@@ -1403,13 +1425,14 @@ export async function startLoginFlow(
   const def = OAUTH_PROVIDERS[provider];
   if (!def) throw new UnsupportedOAuthProviderError(provider);
   const existing = loginState.get(provider);
-  if (existing && !existing.done) {
+  if ((existing && !existing.done) || (provider === "kiro" && kiroLoginSettling.has(provider))) {
     throw new Error(`A login for ${provider} is already in progress`);
   }
   clearManualCodeSlot(provider);
   loginState.set(provider, { done: false });
   const abort = new AbortController();
   loginAbort.set(provider, abort);
+  if (provider === "kiro") kiroLoginSettling.add(provider);
   return new Promise((resolve, reject) => {
     let urlResolved = false;
     const ctrl: OAuthController = {
@@ -1460,7 +1483,10 @@ export async function startLoginFlow(
     };
     // Background: runLogin persists the credential + provider entry to disk. The lifecycle hook
     // lets a long-lived server config adopt that settled state before clients observe done=true.
-    void runLogin(provider, ctrl, opts).then(
+    const assertCurrentOwner = (): void => {
+      if (loginAbort.get(provider) !== abort) throw new OAuthLoginSupersededError();
+    };
+    void runLogin(provider, ctrl, opts, { assertCurrentOwner }).then(
       () => settle(),
       (e: unknown) => settle(e),
     ).catch((e: unknown) => {
@@ -1471,6 +1497,8 @@ export async function startLoginFlow(
       const msg = publicOAuthAuthenticationErrorMessage(e);
       loginState.set(provider, { done: true, error: msg });
       if (!urlResolved) reject(e);
+    }).finally(() => {
+      if (provider === "kiro") kiroLoginSettling.delete(provider);
     });
   });
 }

package/src/oauth/store.ts

@@ -465,10 +465,11 @@ function serializeMutation<T>(work: () => Promise<T>, retainedValues: readonly u
   drainOAuthMutations();
   return result;
 }
-export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValues: readonly unknown[] = [], options?: { waitMs?: number }):Promise<T>{return serializeMutation(async()=>{const guard=await createOAuthFileLock({path:getAuthStoreLockPath(),staleAfterMs:30000}).acquire();try{
+export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValues: readonly unknown[] = [], options?: { waitMs?: number; assertBeforePersist?: () => void }):Promise<T>{return serializeMutation(async()=>{const guard=await createOAuthFileLock({path:getAuthStoreLockPath(),staleAfterMs:30000}).acquire();try{
     const { store, hadLegacy } = loadAuthStoreInternal();
     if (hadLegacy) backupLegacyOnce();
     const result = await fn(store);
+    options?.assertBeforePersist?.();
     persist(store);
     return result;
   }finally{guard.release();}}, retainedValues, options?.waitMs);
@@ -491,7 +492,7 @@ export function getCredential(provider: string): OAuthCredentials | null {
 export async function saveCredential(
   provider: string,
   cred: OAuthCredentials,
-  opts: { preserveIdentityless?: boolean } = {},
+  opts: { preserveIdentityless?: boolean; assertBeforePersist?: () => void } = {},
 ): Promise<void> {
   const safe = normalizeCredential(cred);
   if (!safe) return;
@@ -542,7 +543,7 @@ export async function saveCredential(
       set.accounts.push({ id, credential: safe, addedAt: Date.now() });
       set.activeAccountId = id;
     }
-  }, [provider, safe]);
+  }, [provider, safe], { assertBeforePersist: opts.assertBeforePersist });
 }
 
 /**
@@ -632,7 +633,12 @@ export function getAccountCredential(provider: string, accountId: string): OAuth
 }
 
 /** Persist a refreshed credential for a SPECIFIC account without touching activeAccountId. */
-export async function saveAccountCredential(provider: string, accountId: string, cred: OAuthCredentials): Promise<void> {
+export async function saveAccountCredential(
+  provider: string,
+  accountId: string,
+  cred: OAuthCredentials,
+  opts: { assertBeforePersist?: () => void } = {},
+): Promise<void> {
   const safe = normalizeCredential(cred);
   if (!safe) return;
   await mutateStore(store => {
@@ -640,7 +646,7 @@ export async function saveAccountCredential(provider: string, accountId: string,
     if (!account) return;
     account.credential = safe;
     delete account.needsReauth;
-  }, [provider, accountId, safe]);
+  }, [provider, accountId, safe], { assertBeforePersist: opts.assertBeforePersist });
 }
 
 export async function setActiveAccount(provider: string, accountId: string): Promise<boolean> {