@bitkyc08/opencodex 2.43.0 → 2.44.0

package/src/client/hub-client.ts

@@ -1,6 +1,8 @@
 import { MAX_REMOTE_CATALOG_BYTES } from "../server/catalog-download";
 import { readBoundedResponseBytes } from "../lib/bounded-body";
 import { clearableDeadline } from "../lib/abort";
+import type { Desktop3pModelEntry } from "../claude/desktop-3p";
+import { assertDesktop3pModelsValid } from "../claude/desktop-3p-guard";
 
 /**
  * A pairing grant may cross loopback or authenticated HTTPS, and nothing else.
@@ -30,6 +32,8 @@ import {
 const READY_BODY_LIMIT = 64 * 1024;
 const MANAGEMENT_BODY_LIMIT = 128 * 1024;
 const DEFAULT_TIMEOUT_MS = 5_000;
+const DESKTOP_SNAPSHOT_MAX_BYTES = 1024 * 1024;
+const DESKTOP_SNAPSHOT_MAX_ENTRIES = 2000;
 
 export type OneTimeConnectCredential =
   | { kind: "admin"; value: Uint8Array }
@@ -97,6 +101,7 @@ async function fetchBounded(
     });
     headerDeadline?.clear();
     if (response.status >= 300 && response.status < 400 && response.status !== 304) {
+      try { await response.body?.cancel(); } catch { /* best effort */ }
       throw new HubClientError("redirect_refused", "Hub request redirect was refused", response.status);
     }
     return response;
@@ -115,6 +120,7 @@ async function boundedText(
 ): Promise<string> {
   const declared = Number(response.headers.get("content-length") ?? "0");
   if (Number.isFinite(declared) && declared > maxBytes) {
+    try { await response.body?.cancel(); } catch { /* best effort */ }
     throw new HubClientError("body_too_large", "Hub response exceeded the allowed size", response.status);
   }
   const result = await readBoundedResponseBytes(response, {
@@ -465,6 +471,81 @@ export async function downloadClientCatalog(
   return { kind: "fresh", body, ...(keyId ? { keyId } : {}) };
 }
 
+function desktopSnapshotModels(value: unknown): Desktop3pModelEntry[] {
+  const invalid = () => new HubClientError("desktop_snapshot_invalid", "Hub Desktop model snapshot was invalid");
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw invalid();
+  const raw = value as Record<string, unknown>;
+  if (raw.version !== 1) {
+    throw new HubClientError("desktop_snapshot_unsupported", "Hub Desktop model snapshot format is unsupported");
+  }
+  if (!Array.isArray(raw.models) || raw.models.length > DESKTOP_SNAPSHOT_MAX_ENTRIES) throw invalid();
+  const models: Desktop3pModelEntry[] = raw.models.map((row: unknown) => {
+    if (!row || typeof row !== "object" || Array.isArray(row)) throw invalid();
+    const entry = row as Record<string, unknown>;
+    const family = entry.anthropicFamilyTier;
+    if (typeof entry.name !== "string" || typeof entry.labelOverride !== "string"
+      || (family !== "opus" && family !== "fable" && family !== "sonnet" && family !== "haiku")
+      || (Object.hasOwn(entry, "isFamilyDefault") && typeof entry.isFamilyDefault !== "boolean")
+      || (Object.hasOwn(entry, "supports1m") && entry.supports1m !== true)
+      || (Object.hasOwn(entry, "prefer1m") && entry.prefer1m !== true)) throw invalid();
+    return {
+      name: entry.name,
+      labelOverride: entry.labelOverride,
+      anthropicFamilyTier: family,
+      ...(typeof entry.isFamilyDefault === "boolean" ? { isFamilyDefault: entry.isFamilyDefault } : {}),
+      ...(entry.supports1m === true ? { supports1m: true as const } : {}),
+      ...(entry.prefer1m === true ? { prefer1m: true as const } : {}),
+    };
+  });
+  try { assertDesktop3pModelsValid(models); } catch { throw invalid(); }
+  return models;
+}
+
+export async function downloadDesktop3pModels(
+  serverUrl: string,
+  admissionToken: string,
+  options: { timeoutMs?: number; fetchImpl?: typeof fetch } = {},
+): Promise<{ version: 1; models: Desktop3pModelEntry[] }> {
+  const origin = normalizeHubOrigin(serverUrl);
+  if (!isPairingTransportPermitted(origin)) {
+    throw new HubClientError("insecure_http_refused", "Desktop model snapshots require HTTPS or loopback HTTP");
+  }
+  try {
+    // Keep fetchBounded's total request deadline active through body consumption;
+    // continuous progress must not extend a small Desktop snapshot download indefinitely.
+    const response = await fetchBounded(options.fetchImpl ?? fetch, `${origin}/v1/models?ids=desktop&format=desktop-config`, {
+      method: "GET",
+      headers: new Headers({
+        Accept: "application/json",
+        "anthropic-version": "2023-06-01",
+        "x-opencodex-api-key": admissionToken,
+      }),
+    }, options.timeoutMs);
+    if (!response.ok || response.status === 304) {
+      try { await response.body?.cancel(); } catch { /* best effort */ }
+      throw new HubClientError(`desktop_snapshot_http_${response.status}`, "Hub Desktop model snapshot request failed", response.status);
+    }
+    if (!jsonCompatibleContentType(response)) {
+      try { await response.body?.cancel(); } catch { /* best effort */ }
+      throw new HubClientError("desktop_snapshot_invalid", "Hub Desktop model snapshot was invalid");
+    }
+    const body = await boundedText(response, DESKTOP_SNAPSHOT_MAX_BYTES, {
+      inactivityTimeoutMs: safeTimeout(options.timeoutMs),
+    });
+    return { version: 1, models: desktopSnapshotModels(parseJson(body, "desktop_snapshot_invalid")) };
+  } catch (error) {
+    // Existing low-level errors can carry a cause containing remote JSON or fetch details.
+    // Expose only the fixed category/message, never that cause or a remote field value.
+    if (error instanceof HubClientError) {
+      const message = error.code === "desktop_snapshot_invalid" ? "Hub Desktop model snapshot was invalid"
+        : error.code === "desktop_snapshot_unsupported" ? "Hub Desktop model snapshot format is unsupported"
+          : "Hub Desktop model snapshot request failed";
+      throw new HubClientError(error.code, message, error.status);
+    }
+    throw new HubClientError("unreachable", "Hub Desktop model snapshot request did not complete");
+  }
+}
+
 export async function probeClientKeyId(
   serverUrl: string,
   admissionToken: string,

package/src/client/hub-relay.ts

@@ -164,6 +164,7 @@ function boundedRelayResponseStream(
   body: ReadableStream<Uint8Array>,
   limit: number,
   signal: AbortSignal,
+  cleanup: () => void,
 ): ReadableStream<Uint8Array> {
   const reader = body.getReader();
   let bytes = 0;
@@ -172,6 +173,7 @@ function boundedRelayResponseStream(
     if (finished) return;
     finished = true;
     signal.removeEventListener("abort", onAbort);
+    cleanup();
     try { reader.releaseLock(); } catch { /* a pending read may still own it */ }
   };
   const onAbort = () => {
@@ -245,9 +247,19 @@ export async function relayHubManagementRequest(
     ? Math.min(Math.floor(deps.timeoutMs), 120_000)
     : HUB_RELAY_DEFAULT_TIMEOUT_MS;
   const timeoutSignal = AbortSignal.timeout(timeoutMs);
-  const signal = req.signal
-    ? AbortSignal.any([req.signal, timeoutSignal])
-    : timeoutSignal;
+  const relayAbort = new AbortController();
+  const signal = relayAbort.signal;
+  const stopDeadline = () => timeoutSignal.removeEventListener("abort", onTimeout);
+  const cleanup = () => {
+    stopDeadline();
+    req.signal.removeEventListener("abort", onClientAbort);
+  };
+  const onTimeout = () => { relayAbort.abort(timeoutSignal.reason); cleanup(); };
+  const onClientAbort = () => { relayAbort.abort(req.signal.reason); cleanup(); };
+  timeoutSignal.addEventListener("abort", onTimeout, { once: true });
+  req.signal.addEventListener("abort", onClientAbort, { once: true });
+  if (req.signal.aborted) onClientAbort();
+  else if (timeoutSignal.aborted) onTimeout();
   let upstream: Response;
   try {
     upstream = await (deps.fetchImpl ?? fetch)(destination, {
@@ -258,9 +270,16 @@ export async function relayHubManagementRequest(
       signal,
     });
   } catch {
+    cleanup();
+    return relayError(502, "hub relay unavailable");
+  }
+  if (signal.aborted) {
+    cleanup();
+    try { await upstream.body?.cancel(); } catch { /* best effort */ }
     return relayError(502, "hub relay unavailable");
   }
   if (upstream.status >= 300 && upstream.status < 400) {
+    cleanup();
     try { await upstream.body?.cancel(); } catch { /* best effort */ }
     return relayError(502, "hub relay redirect refused");
   }
@@ -268,18 +287,31 @@ export async function relayHubManagementRequest(
   const responseConnectionNamed = new Set((upstream.headers.get("connection") ?? "").split(",").map(value => value.trim().toLowerCase()).filter(Boolean));
   const responseHeaders = filteredHeaders(upstream.headers, RESPONSE_HEADERS, responseConnectionNamed);
   if (!headersWithinLimit(responseHeaders)) {
+    cleanup();
     try { await upstream.body?.cancel(); } catch { /* best effort */ }
     return relayError(502, "hub relay response headers too large");
   }
   const declaredResponseLength = upstream.headers.get("content-length");
   if (declaredResponseLength !== null && (!/^\d+$/.test(declaredResponseLength)
     || Number(declaredResponseLength) > HUB_RELAY_RESPONSE_BODY_MAX_BYTES)) {
+    cleanup();
     try { await upstream.body?.cancel(); } catch { /* best effort */ }
     return relayError(502, "hub relay response body too large");
   }
-  const responseBody = method === "HEAD" || !upstream.body
-    ? null
-    : boundedRelayResponseStream(upstream.body, HUB_RELAY_RESPONSE_BODY_MAX_BYTES, signal);
+  // Only this known, successfully established SSE endpoint outlives the handshake.
+  // Its body remains byte-bounded and connected to the browser's abort signal.
+  if (method === "GET" && destination.pathname === "/api/accounts/events" && !destination.search
+    && upstream.status === 200
+    && responseHeaders.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() === "text/event-stream") {
+    stopDeadline();
+  }
+  let responseBody: ReadableStream<Uint8Array> | null = null;
+  if (method === "HEAD" || !upstream.body) {
+    cleanup();
+    try { await upstream.body?.cancel(); } catch { /* best effort */ }
+  } else {
+    responseBody = boundedRelayResponseStream(upstream.body, HUB_RELAY_RESPONSE_BODY_MAX_BYTES, signal, cleanup);
+  }
   return new Response(responseBody, {
     status: upstream.status,
     statusText: upstream.statusText,

package/src/client/lifecycle-lock.ts

@@ -0,0 +1,129 @@
+/** Client/Desktop lifecycle exclusion. Lock order: N -> L -> C; never acquire N inside L. */
+import { Database } from "bun:sqlite";
+import { chmodSync, closeSync, lstatSync, mkdirSync, openSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { resolveEffectiveUserIdentity, resolveEffectiveUserRuntimeRoot } from "../codex/user-identity";
+import { hardenSecretDir, hardenSecretPath } from "../lib/windows-secret-acl";
+
+declare const lifecycleLease: unique symbol;
+export interface ClientLifecycleHeld { readonly [lifecycleLease]: true }
+export interface ClientLifecycleLockDeps { lockPath?: string }
+
+const activeLeases = new WeakSet<object>();
+
+class ClientLifecycleError extends Error {
+  constructor(readonly code: string, options?: ErrorOptions) {
+    super(code, options);
+    this.name = "ClientLifecycleError";
+  }
+}
+
+/** A type assertion, copied property or expired callback cannot manufacture exclusion. */
+export function assertClientLifecycleHeld(held: ClientLifecycleHeld): void {
+  if (!activeLeases.has(held)) throw new ClientLifecycleError("client_lifecycle_lease_invalid");
+}
+
+function errorCode(error: unknown): unknown {
+  return error !== null && typeof error === "object" && "code" in error ? error.code : undefined;
+}
+
+function assertPath(path: string, directory: boolean): void {
+  const stat = lstatSync(path);
+  if (stat.isSymbolicLink() || (directory ? !stat.isDirectory() : !stat.isFile() || stat.nlink !== 1)) {
+    throw new ClientLifecycleError("client_lifecycle_path_unsafe");
+  }
+  if (process.platform !== "win32" && stat.uid !== process.getuid!()) {
+    throw new ClientLifecycleError("client_lifecycle_path_unsafe");
+  }
+}
+
+function preparePath(lockPath: string): void {
+  const directory = dirname(lockPath);
+  mkdirSync(directory, { recursive: true, mode: 0o700 });
+  assertPath(directory, true);
+  if (process.platform !== "win32") chmodSync(directory, 0o700);
+  hardenSecretDir(directory, { required: true });
+  // Create privately before SQLite opens it; refuse an existing symlink or hardlink
+  // before chmod/ACL operations or the database constructor can follow it.
+  try { closeSync(openSync(lockPath, "wx", 0o600)); }
+  catch (error) { if (errorCode(error) !== "EEXIST") throw error; }
+  assertPath(lockPath, false);
+  if (process.platform !== "win32") chmodSync(lockPath, 0o600);
+  hardenSecretPath(lockPath, { required: true });
+  assertPath(directory, true);
+  assertPath(lockPath, false);
+}
+
+function acquire(deps: ClientLifecycleLockDeps): Database {
+  let database: Database | undefined;
+  try {
+    // The production namespace belongs to the effective OS user, never HOME,
+    // OPENCODEX_HOME, Desktop library overrides or an environment test switch.
+    const path = deps.lockPath === undefined
+      ? join(resolveEffectiveUserRuntimeRoot(resolveEffectiveUserIdentity()), "client-desktop-lifecycle.sqlite")
+      : resolve(deps.lockPath);
+    preparePath(path);
+    database = new Database(path, { create: true });
+    database.exec("PRAGMA locking_mode = NORMAL; PRAGMA busy_timeout = 0; BEGIN IMMEDIATE");
+    return database;
+  } catch (error) {
+    try { database?.close(); } catch { /* preserve acquisition failure */ }
+    const code = errorCode(error);
+    if (code === "SQLITE_BUSY" || code === "SQLITE_LOCKED"
+      || (error instanceof Error && /database (?:is|table is) locked/i.test(error.message))) {
+      throw new ClientLifecycleError("client_lifecycle_busy");
+    }
+    throw new ClientLifecycleError("client_lifecycle_lock_failed", { cause: error });
+  }
+}
+
+type Outcome<T> = { ok: true; value: T } | { ok: false; error: unknown };
+
+function finish<T>(database: Database, outcome: Outcome<T>): T {
+  let release: Outcome<void> = { ok: true, value: undefined };
+  try { database.exec("ROLLBACK"); }
+  catch (error) { release = { ok: false, error }; }
+  // Always close, including when rollback throws. SQLite/OS owns crash release;
+  // never unlink a lock database or infer lock ownership from a stale PID.
+  try { database.close(); }
+  catch (error) { if (release.ok) release = { ok: false, error }; }
+  if (!outcome.ok) throw outcome.error; // Includes a literal `throw undefined`.
+  if (!release.ok) throw new ClientLifecycleError("client_lifecycle_lock_failed", { cause: release.error });
+  return outcome.value;
+}
+
+export async function withClientLifecycle<T>(
+  work: (held: ClientLifecycleHeld) => Promise<T>,
+  deps: ClientLifecycleLockDeps = {},
+): Promise<T> {
+  const database = acquire(deps);
+  const held = Object.freeze({}) as ClientLifecycleHeld;
+  activeLeases.add(held);
+  let outcome: Outcome<T>;
+  try { outcome = { ok: true, value: await work(held) }; }
+  catch (error) { outcome = { ok: false, error }; }
+  finally { activeLeases.delete(held); }
+  return finish(database, outcome);
+}
+
+export function withClientLifecycleSync<T>(
+  work: (held: ClientLifecycleHeld) => T,
+  deps: ClientLifecycleLockDeps = {},
+): T {
+  const database = acquire(deps);
+  const held = Object.freeze({}) as ClientLifecycleHeld;
+  activeLeases.add(held);
+  let outcome: Outcome<T>;
+  try {
+    const value = work(held);
+    if (value !== null && (typeof value === "object" || typeof value === "function")
+      && typeof (value as { then?: unknown }).then === "function") {
+      // Observe native rejected promises without invoking arbitrary thenables.
+      if (value instanceof Promise) void Promise.prototype.then.call(value, undefined, () => undefined);
+      throw new ClientLifecycleError("client_lifecycle_async_callback");
+    }
+    outcome = { ok: true, value };
+  } catch (error) { outcome = { ok: false, error }; }
+  finally { activeLeases.delete(held); }
+  return finish(database, outcome);
+}

package/src/client/state.ts

@@ -6,8 +6,11 @@ import {
   mutatePersistedConfig,
   readConfigDiagnostics,
   saveConfig,
+  withConfigMutationLockSync,
 } from "../config";
 import type { OcxClientConnectionConfig } from "../types";
+import { inspectRemoteDesktopStore, readDesktopDisconnectReceipt } from "../claude/desktop-remote-store";
+import { withClientLifecycleSync, type ClientLifecycleLockDeps } from "./lifecycle-lock";
 import {
   readServiceApiTokenState,
   readTokenBackupState,
@@ -71,62 +74,88 @@ export function readClientConnectionState(): ClientConnectionState {
   return { kind: "connected", value: client };
 }
 
-/**
- * Does the persisted config record a rotation that has not finished?
- *
- * Read fresh rather than taken from a caller-supplied snapshot: the whole point is to see a
- * `pendingOperation` that landed after that snapshot was taken.
- */
-function rotationInFlight(): boolean {
+export function sameClientConnectionOwner(
+  left: Pick<OcxClientConnectionConfig, "serverUrl" | "apiKeyId" | "connectedAt">,
+  right: Pick<OcxClientConnectionConfig, "serverUrl" | "apiKeyId" | "connectedAt">,
+): boolean {
+  return left.serverUrl === right.serverUrl && left.apiKeyId === right.apiKeyId && left.connectedAt === right.connectedAt;
+}
+
+/** Read-only: safe at a Codex N/C commit boundary; never acquires L or removes recovery state. */
+export function assertNoClientDisconnectPending(): void {
+  const receipt = readDesktopDisconnectReceipt();
+  if (receipt.kind === "unsafe") throw new Error("client_disconnect_receipt_unsafe");
+  if (receipt.kind === "valid" && receipt.value.phase !== "complete") {
+    throw new Error("client_disconnect_pending");
+  }
+}
+
+/** Full snapshot CAS for work returning from an await, including selection and rotation state. */
+export function assertClientConnectionUnchanged(expected: OcxClientConnectionConfig): void {
+  assertNoClientDisconnectPending();
   const current = readClientConnectionState();
-  return current.kind === "connected" && current.value.pendingOperation !== undefined;
+  if (current.kind !== "connected" || JSON.stringify(current.value) !== JSON.stringify(expected)) {
+    throw new Error("client_connection_changed");
+  }
 }
 
-export function inspectClientRotationRecoveryGate(
-  state: ClientConnectionState = readClientConnectionState(),
-): ClientRotationRecoveryGate {
+/** Undefined means only "possible orphan": the caller must repeat this read under L/C. */
+function observeClientRotationRecovery(): ClientRotationRecoveryGate | undefined {
+  const state = readClientConnectionState();
   const current = readServiceApiTokenState();
   const backup = readTokenBackupState();
+  const receipt = readDesktopDisconnectReceipt();
+  if (receipt.kind === "unsafe") return { kind: "unsafe", reason: "client_disconnect_receipt_unsafe" };
+  if (receipt.kind === "valid" && receipt.value.phase !== "complete") {
+    return { kind: "recovery-required", reason: "client_disconnect_pending" };
+  }
   if (state.kind === "connected" && state.value.pendingOperation) {
     if (current.kind !== "present" || backup.kind !== "present") {
-      return {
-        kind: "unsafe",
-        reason: "pending key rotation requires owner-only service-api-token and service-api-token.prev files",
-      };
+      return { kind: "unsafe", reason: "pending rotation requires current and backup token files" };
     }
-    return {
-      kind: "recovery-required",
-      reason: "rerun ocx connect rotate with --pairing-code-stdin or --admin-token-stdin",
-    };
+    return { kind: "recovery-required", reason: "rerun ocx connect rotate with transient authority" };
   }
-  if (backup.kind === "unsafe") return { kind: "unsafe", reason: backup.reason };
+  if (backup.kind === "unsafe") return { kind: "unsafe", reason: "service token backup is unsafe" };
   if (backup.kind === "present" && current.kind === "present") {
-    // Only an ORPHAN backup is cleanable, and this branch cannot always tell an orphan from
-    // a backup belonging to a rotation that is mid-flight.
-    //
-    // `rotateConnectedClientKey` writes the .prev backup BEFORE it persists
-    // `pendingOperation`. A concurrent `ocx connect status` landing in that window sees
-    // "backup present, token present, no pending marker" — indistinguishable from a stale
-    // leftover — and deleted the live rollback target. If the rotation then failed, its
-    // restore had nothing to restore from.
-    //
-    // Re-reading the persisted state closes most of the window: the caller's `state` may
-    // have been captured before the marker landed, while a fresh read sees it. The
-    // remaining window is narrow enough that the rotation's own lock is the right owner,
-    // and deleting nothing is the safe side of it.
-    if (rotationInFlight()) {
-      return { kind: "recovery-required", reason: "a key rotation is in flight; leave service-api-token.prev in place" };
+    if (state.kind === "invalid" || state.kind === "mismatched"
+      || (state.kind === "connected" && current.fingerprint !== state.value.tokenFingerprint)) {
+      return { kind: "unsafe", reason: "connected token ownership changed" };
     }
-    try {
-      removeOrphanTokenBackup();
-      return { kind: "orphan-cleaned" };
-    } catch (error) {
-      return { kind: "unsafe", reason: error instanceof Error ? error.message : "token backup cleanup failed" };
+    if (state.kind === "connected") {
+      const desktop = inspectRemoteDesktopStore({ serverUrl: state.value.serverUrl, apiKeyId: state.value.apiKeyId, connectedAt: state.value.connectedAt });
+      if (desktop.kind !== "absent" && desktop.kind !== "restored") {
+        // The inspection DTO deliberately exposes no credential generation. Let
+        // explicit rotation reconcile an active Desktop copy before discarding .prev.
+        return { kind: "recovery-required", reason: "Desktop credential reconciliation requires ocx connect rotate" };
+      }
     }
+    return undefined;
   }
   return { kind: "clean" };
 }
 
+export function inspectClientRotationRecoveryGate(
+  _state: ClientConnectionState = readClientConnectionState(),
+  lockDeps?: ClientLifecycleLockDeps,
+): ClientRotationRecoveryGate {
+  try {
+    // Ordinary status is read-only: even acquiring C creates config-mutation.sqlite.
+    // Only actual orphan cleanup needs L/C; this first observation authorizes no write.
+    const observed = observeClientRotationRecovery();
+    if (observed) return observed;
+    return withClientLifecycleSync(() => withConfigMutationLockSync((): ClientRotationRecoveryGate => {
+      const fresh = observeClientRotationRecovery();
+      if (fresh) return fresh;
+      removeOrphanTokenBackup();
+      return { kind: "orphan-cleaned" };
+    }), lockDeps);
+  } catch (error) {
+    const code = error && typeof error === "object" && "code" in error ? String(error.code) : "";
+    if (code === "client_lifecycle_busy") return { kind: "recovery-required", reason: "client_lifecycle_busy" };
+    return { kind: "unsafe", reason: "client rotation state could not be inspected safely" };
+  }
+}
+
 export function commitClientConnection(
 
   state: OcxClientConnectionConfig,
@@ -157,13 +186,13 @@ export function commitClientConnection(
 }
 
 export function clearClientConnection(
-  expectedApiKeyId: string,
+  expected: string | Pick<OcxClientConnectionConfig, "serverUrl" | "apiKeyId" | "connectedAt">,
 ): "committed" | "absent" | "conflict" {
   const outcome = mutatePersistedConfig(config => {
     if (!config.client && config.runtimeRole !== "client") {
       return { changed: false, value: "absent" as const };
     }
-    if (!config.client || config.runtimeRole !== "client" || config.client.apiKeyId !== expectedApiKeyId) {
+    if (!config.client || config.runtimeRole !== "client" || (typeof expected === "string" ? config.client.apiKeyId !== expected : !sameClientConnectionOwner(config.client, expected))) {
       return { changed: false, value: "conflict" as const };
     }
     deleteConfigTopLevelKey(config, "client");