@bitkyc08/opencodex 2.63.0-preview.20260923 → 2.64.0-preview.20260923

package/src/lib/socks5-fetch.ts

@@ -7,6 +7,8 @@ const SOCKS5_CONNECT_TIMEOUT_MS = 30_000;
 const SOCKS5_RESPONSE_TIMEOUT_MS = 200_000;
 const MAX_RESPONSE_HEADER_BYTES = 64 * 1024;
 const MAX_BODY_SLICE_BYTES = 64 * 1024;
+const MAX_DECODED_BODY_BYTES = 32 * 1024 * 1024;
+const MAX_STREAM_DECODE_EXPANSION_RATIO = 128;
 const SOCKS5_VERSION = 0x05;
 const SOCKS5_NO_AUTH = 0x00;
 const SOCKS5_USER_PASS = 0x02;
@@ -526,9 +528,9 @@ function bodylessResponse(method: string, status: number): boolean {
  * response means an upstream ignored that; gzip and deflate are undone here, and any other
  * coding fails closed rather than surfacing bytes no caller can parse.
  *
- * No decompressed-size ceiling is imposed. The identity path has no total-size bound either —
- * it cannot, because a long-lived SSE stream is legitimately unbounded — and a ceiling on only
- * the coded path would fail responses that succeed uncompressed.
+ * Buffered decoded bodies have an absolute cap. Event streams instead have an expansion bound,
+ * so a long stream can continue without allowing a tiny coded response to inflate unchecked.
+ * Identity bodies retain their existing streaming behavior; providers are asked to use that path.
  */
 function contentCodingFormat(headers: Headers): "gzip" | "deflate" | undefined {
   const coding = classifyContentCoding(headers);
@@ -537,6 +539,37 @@ function contentCodingFormat(headers: Headers): "gzip" | "deflate" | undefined {
   throw new Socks5FetchError("SOCKS5 upstream returned an unsupported content-encoding: " + coding.coding);
 }
 
+/** Bound buffered bodies absolutely and event streams relative to consumed coded bytes. */
+function decodedBody(
+  body: ReadableStream<Uint8Array>,
+  format: "gzip" | "deflate",
+  eventStream: boolean,
+): ReadableStream<Uint8Array> {
+  const decompressor = new DecompressionStream(format) as unknown as ReadableWritablePair<Uint8Array, Uint8Array>;
+  let codedBytes = 0;
+  let decodedBytes = 0;
+  const countedBody = eventStream ? body.pipeThrough(new TransformStream<Uint8Array, Uint8Array>({
+    transform(chunk, controller) {
+      codedBytes += chunk.byteLength;
+      controller.enqueue(chunk);
+    },
+  })) : body;
+  return countedBody.pipeThrough(decompressor).pipeThrough(new TransformStream<Uint8Array, Uint8Array>({
+    transform(chunk, controller) {
+      decodedBytes += chunk.byteLength;
+      const limit = eventStream
+        ? Math.max(MAX_DECODED_BODY_BYTES, codedBytes * MAX_STREAM_DECODE_EXPANSION_RATIO)
+        : MAX_DECODED_BODY_BYTES;
+      if (decodedBytes > limit) {
+        throw new Socks5FetchError(eventStream
+          ? "SOCKS5 decoded event stream exceeds expansion limit"
+          : `SOCKS5 decoded response exceeds ${MAX_DECODED_BODY_BYTES} byte cap`);
+      }
+      controller.enqueue(chunk);
+    },
+  }));
+}
+
 /** Read response heads until the final one, consuming the interim informational answers. */
 async function finalResponseHead(
   reader: SocketReader,
@@ -708,19 +741,15 @@ export async function socks5Fetch(
       // The declared length describes the coded bytes, not what the caller now reads.
       responseHeaders.delete("content-length");
     }
-    // `DecompressionStream` declares its writable side as `WritableStream<BufferSource>`, and
-    // TypeScript measures `WritableStream` as invariant in its chunk type, so the pair is not
-    // assignable to `ReadableWritablePair<Uint8Array, Uint8Array>` even though every chunk this
-    // body produces is a valid `BufferSource`. The conversion states that relationship and
-    // nothing else; it does not widen what is actually written.
-    const decompressor = codingFormat === undefined
-      ? undefined
-      : new DecompressionStream(codingFormat) as unknown as ReadableWritablePair<Uint8Array, Uint8Array>;
-    const decodedBody = body !== null && decompressor !== undefined
-      ? body.pipeThrough(decompressor)
+    const responseBodyStream = body !== null && codingFormat !== undefined
+      ? decodedBody(
+        body,
+        codingFormat,
+        responseHead.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() === "text/event-stream",
+      )
       : body;
     request.signal.removeEventListener("abort", onAbort);
-    return new Response(decodedBody, {
+    return new Response(responseBodyStream, {
       status: responseHead.status,
       statusText: responseHead.statusText,
       headers: responseHeaders,

package/src/lib/token-estimate.ts

@@ -142,12 +142,27 @@ export function estimateTokens(text: string, modelId?: string, contextWindow?: n
   if (!text) return 0;
   const len = text.length;
   if (len === 0) return 0;
-  const latinRatio = charsPerToken(modelId);
   const cjk = countCjk(text);
+  return estimateTokensFromCharacterCounts(len - cjk, cjk, modelId, contextWindow);
+}
+
+/**
+ * Estimate tokens from already-counted script buckets without materializing replacement text.
+ * `latin` and `cjk` are non-negative integer character counts, as produced from a string.
+ */
+export function estimateTokensFromCharacterCounts(
+  latin: number,
+  cjk: number,
+  modelId?: string,
+  contextWindow?: number,
+): number {
+  const len = latin + cjk;
+  if (len === 0) return 0;
+  const latinRatio = charsPerToken(modelId);
   // Continuous in the CJK share: no threshold, so one added Korean character moves the estimate
   // by a fraction of a token instead of switching the whole blob to a different divisor.
   const estimate = cjk === 0
     ? Math.ceil(len / latinRatio)
-    : Math.ceil((len - cjk) / latinRatio + cjk / CJK_CHARS_PER_TOKEN);
+    : Math.ceil(latin / latinRatio + cjk / CJK_CHARS_PER_TOKEN);
   return capEstimateAtContextWindow(Math.max(1, estimate), contextWindow);
 }

package/src/oauth/command-code.ts

@@ -172,8 +172,9 @@ function parsePastedCommandCodeInput(input: string, expectedState: string): Comm
   if (!apiKey) return undefined;
   // A URL/query-shaped paste is an authorization response and must carry a matching state,
   // mirroring the shared OAuth callback flow; a stale or attacker-supplied URL from another
-  // session must not be accepted. Raw in-session keys are exempt (no state to compare).
-  if (parsed.kind !== "raw" && parsed.state !== expectedState) return undefined;
+  // session must not be accepted. A raw paste with an explicit #state suffix is state-bearing
+  // too, as in the shared submit gate; only a bare in-session key has no state to compare.
+  if ((parsed.kind !== "raw" || parsed.state !== undefined) && parsed.state !== expectedState) return undefined;
   return { apiKey, state: expectedState, userId: "", userName: "", keyName: "manual" };
 }
 

package/src/oauth/generic-account-failover.ts

@@ -179,13 +179,41 @@ function isProactivePreferenceEnabled(config: OcxConfig, providerName: string, n
 
 /** Accounts that may serve traffic right now: not cooled, not flagged for reauth. */
 export function eligibleFailoverAccounts(providerName: string, now = Date.now(), family?: QuotaModelFamily): string[] {
-  const set = getAccountSet(providerName);
+  return eligibleIdsIn(getAccountSet(providerName), providerName, now, family);
+}
+
+function eligibleIdsIn(
+  set: ReturnType<typeof getAccountSet>,
+  providerName: string,
+  now: number,
+  family?: QuotaModelFamily,
+): string[] {
   if (!set) return [];
   return set.accounts
     .filter(account => account.needsReauth !== true && !isCooled(providerName, account.id, now, family))
     .map(account => account.id);
 }
 
+/**
+ * Whether reactive rotation has an alternate account it could select right now.
+ *
+ * Answers from the same live roster read and the same guards `rotateGenericOAuthAccountOn429`
+ * applies: a roster of fewer than two accounts has nowhere to go, even when a cached quorum
+ * count or a stale failed id would suggest otherwise. It applies no cooldown and advances no
+ * rotation state; like every eligibility read, it may prune an already-expired cooldown entry.
+ */
+export function hasEligibleGenericOAuthFailoverTarget(
+  providerName: string,
+  failedAccountId: string,
+  now = Date.now(),
+  requestedModelId?: string | null,
+): boolean {
+  const set = getAccountSet(providerName);
+  if (!set || set.accounts.length < 2) return false;
+  const family = classifyModelFamilyForQuota(providerName, requestedModelId);
+  return eligibleIdsIn(set, providerName, now, family).some(id => id !== failedAccountId);
+}
+
 /** Generic pool strategies the kernel can actually run. `quota` IS the pre-kernel path. */
 type ActiveGenericStrategy = "round-robin" | "fill-first";
 

package/src/oauth/index.ts

@@ -38,6 +38,7 @@ import { loginChatGPT, refreshChatGPTToken, type ChatGPTLoginFlow } from "./chat
 import { loginAntigravity, refreshAntigravityToken } from "./google-antigravity";
 import { loginCursor, refreshCursorToken } from "./cursor";
 import { loginDevin, refreshDevinToken } from "./devin";
+import { validateDevinApiBaseUrl } from "./devin/api-base";
 import { loginGithubCopilot, refreshGithubCopilotToken, validateCopilotApiBaseUrl } from "./github-copilot";
 import { loginCommandCode, refreshCommandCodeToken } from "./command-code";
 import { loginMetaMuse, refreshMetaMuseToken } from "./meta-muse";
@@ -89,11 +90,12 @@ export interface OAuthAccessSnapshot {
   /** Safe request-routing subset; refresh-only Kiro client secrets never leave the credential store. */
   kiro?: Pick<KiroOAuthMetadata, "profileArn" | "apiRegion" | "ssoRegion" | "authType">;
   /**
-   * Allowlisted GitHub Copilot API origin belonging to THIS account.
+   * Allowlisted API origin belonging to THIS account.
    *
-   * Copilot pins its bearer to an account-scoped regional host. Initial routing, 401 refresh, and
-   * account failover must resolve transport from this same snapshot; rereading the active account
-   * can pair account A's token with account B's origin during a concurrent switch (#2568d).
+   * Copilot and Devin pin credentials to account-scoped regional or tenant hosts. Initial routing,
+   * discovery, refresh, and account failover must resolve transport from this same snapshot;
+   * rereading the active account can pair account A's token with account B's origin during a
+   * concurrent switch (#2568d).
    */
   apiBaseUrl?: string;
 }
@@ -177,6 +179,7 @@ export interface LoginOpts {
 }
 
 export interface LoginFlowLifecycle {
+  flowId?: string;
   /** Runs after background credential/config persistence settles, before status becomes done. */
   onSettled?: () => void | Promise<void>;
 }
@@ -480,16 +483,18 @@ function accessSnapshot(provider: string, accountId: string, cred: OAuthCredenti
   // Validated here, not at the call site: an unvalidated origin from a legacy or crafted
   // credential must never travel with a bearer, and dropping it makes the transport fall back to
   // the canonical host rather than to whatever the previous account was using.
-  const copilotApiBaseUrl = provider === "github-copilot"
+  const accountApiBaseUrl = provider === "github-copilot"
     ? validateCopilotApiBaseUrl(cred.apiBaseUrl)
-    : undefined;
+    : provider === "devin" || provider === "devin-cli"
+      ? validateDevinApiBaseUrl(cred.apiBaseUrl)
+      : undefined;
   return {
     provider,
     accountId,
     generation: credentialGeneration(cred),
     accessToken: cred.access,
     ...(cred.projectId ? { projectId: cred.projectId } : {}),
-    ...(copilotApiBaseUrl ? { apiBaseUrl: copilotApiBaseUrl } : {}),
+    ...(accountApiBaseUrl ? { apiBaseUrl: accountApiBaseUrl } : {}),
     // Stored account metadata remains authoritative. Metadata-less legacy/environment credentials
     // may use explicit environment routing, but never borrow the currently signed-in local CLI account.
     ...(provider === "kiro"
@@ -527,7 +532,9 @@ export function observeActiveOAuthAccessToken(
   if (account.credential.expires <= now) return { kind: "expired" };
   if (account.credential.expires <= now + REFRESH_SKEW_MS) return { kind: "near-expiry" };
 
-  const apiBaseUrl = validateCopilotApiBaseUrl(account.credential.apiBaseUrl);
+  const apiBaseUrl = provider === "github-copilot"
+    ? validateCopilotApiBaseUrl(account.credential.apiBaseUrl)
+    : undefined;
   return {
     kind: "available",
     snapshot: {
@@ -1813,17 +1820,18 @@ export function oauthLoginSummary(maskEmails = true): Array<{ provider: string;
 }
 
 export function clearLoginState(provider: string): void {
-  loginAbort.get(provider)?.abort("cleared");
+  loginAbort.get(provider)?.controller.abort("cleared");
   loginAbort.delete(provider);
   clearManualCodeSlot(provider);
   loginState.delete(provider);
 }
 
-export function cancelLoginFlow(provider: string): boolean {
-  const ctrl = loginAbort.get(provider);
+export function cancelLoginFlow(provider: string, flowId?: string): boolean {
+  const active = loginAbort.get(provider);
   const existing = loginState.get(provider);
-  if (!ctrl && (!existing || existing.done)) return false;
-  ctrl?.abort("cancelled");
+  if (flowId !== undefined && active?.flowId !== flowId) return false;
+  if (!active && (!existing || existing.done)) return false;
+  active?.controller.abort("cancelled");
   loginAbort.delete(provider);
   clearManualCodeSlot(provider);
   loginState.set(provider, { done: true, error: "Login cancelled" });
@@ -1844,7 +1852,7 @@ export async function startLoginFlow(
   clearManualCodeSlot(provider);
   loginState.set(provider, { done: false });
   const abort = new AbortController();
-  loginAbort.set(provider, abort);
+  loginAbort.set(provider, { controller: abort, flowId: lifecycle?.flowId });
   if (provider === "kiro") kiroLoginSettling.add(provider);
   return new Promise((resolve, reject) => {
     let urlResolved = false;
@@ -1859,7 +1867,7 @@ export async function startLoginFlow(
       signal: abort.signal,
     };
     const abandonIfNotOwner = (error?: unknown): boolean => {
-      if (loginAbort.get(provider) === abort) return false;
+      if (loginAbort.get(provider)?.controller === abort) return false;
       if (!urlResolved) reject(error ?? new Error("OAuth login was superseded"));
       return true;
     };
@@ -1897,7 +1905,7 @@ export async function startLoginFlow(
     // Background: runLogin persists the credential + provider entry to disk. The lifecycle hook
     // lets a long-lived server config adopt that settled state before clients observe done=true.
     const assertCurrentOwner = (): void => {
-      if (loginAbort.get(provider) !== abort) throw new OAuthLoginSupersededError();
+      if (loginAbort.get(provider)?.controller !== abort) throw new OAuthLoginSupersededError();
     };
     void runLogin(provider, ctrl, opts, { assertCurrentOwner }).then(
       () => settle(),

package/src/oauth/login-flow-state.ts

@@ -11,7 +11,7 @@ import type { GenerationContext } from "../lib/state-store-sweeper";
  * credential. `index.ts` re-exports the two public names, so existing importers are unaffected.
  */
 export const loginState = new Map<string, { error?: string; done: boolean }>();
-export const loginAbort = new Map<string, AbortController>();
+export const loginAbort = new Map<string, { controller: AbortController; flowId?: string }>();
 export const kiroLoginSettling = new Set<string>();
 
 /** Pending paste for a login in progress: either a waiter or a stashed early submission. */
@@ -97,13 +97,13 @@ export function submitManualLoginCode(provider: string, input: string): { ok: tr
   // stashed and re-validated by the callback loop.
   const parsed = parseCallbackInput(trimmed);
   // Command Code's manual fallback accepts a pasted JSON callback payload
-  // (`{ apiKey, state, ... }`) which has no `code` param. Let it through the
-  // shared gate so the provider-specific parser can validate it.
-  const isCommandCodeJson = provider === "command-code" && trimmed.startsWith("{") && !parsed.code;
+  // (`{ apiKey, state, ... }`). Keep that opaque to the generic raw parser so
+  // hashes in JSON strings do not become a fake state suffix; its provider parser validates state.
+  const isCommandCodeJson = provider === "command-code" && trimmed.startsWith("{");
   if (!parsed.code && !isCommandCodeJson) return { ok: false, error: "no authorization code found in input" };
   // A raw paste carrying an explicit code#state suffix is state-bearing too: it
   // must match the expected state rather than bypass validation.
-  const stateBearing = parsed.kind !== "raw" || parsed.state !== undefined;
+  const stateBearing = !isCommandCodeJson && (parsed.kind !== "raw" || parsed.state !== undefined);
   if (stateBearing && slot.expectedState !== undefined) {
     if (parsed.state === undefined) return { ok: false, error: "redirect URL is missing the state parameter" };
     if (parsed.state !== slot.expectedState) {

package/src/oauth/meta-muse-device.ts

@@ -23,6 +23,7 @@
  */
 import type { OAuthController, OAuthCredentials } from "./types";
 import { sanitizeApiKeyValue } from "../providers/api-keys";
+import { BOUNDED_BODY_MAX_BYTES, readBoundedResponseBytes } from "../lib/bounded-body";
 
 /** Meta's own Muse Code client. Public in its device-approval URL; not a secret. */
 const CLIENT_ID = "1031625952748946";
@@ -173,12 +174,45 @@ function requestSignal(signal: AbortSignal | undefined): AbortSignal {
   return signal ? AbortSignal.any([signal, timeout]) : timeout;
 }
 
+async function readMuseJson(
+  response: Response,
+  signal: AbortSignal,
+  kind: "device-authorization" | "device-token" | "mint-invalid",
+): Promise<Record<string, unknown> | undefined> {
+  const declaredLength = response.headers.get("content-length");
+  if (declaredLength && /^\d+$/.test(declaredLength) && Number(declaredLength) > BOUNDED_BODY_MAX_BYTES) {
+    void response.body?.cancel().catch(() => undefined);
+    throw new MuseDeviceLoginError(
+      kind,
+      `Muse Code response exceeded the ${BOUNDED_BODY_MAX_BYTES}-byte limit`,
+      { status: response.status },
+    );
+  }
+  const { bytes, oversized } = await readBoundedResponseBytes(response, {
+    maxBytes: BOUNDED_BODY_MAX_BYTES,
+    signal,
+  });
+  if (oversized) {
+    throw new MuseDeviceLoginError(
+      kind,
+      `Muse Code response exceeded the ${BOUNDED_BODY_MAX_BYTES}-byte limit`,
+      { status: response.status },
+    );
+  }
+  try {
+    return record(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes)));
+  } catch {
+    return undefined;
+  }
+}
+
 /** Step 1: ask Meta for a user code. */
 export async function requestMuseDeviceAuthorization(
   deps: MuseDeviceDeps = {},
   signal?: AbortSignal,
 ): Promise<MuseDeviceAuthorization> {
   const now = deps.now ?? Date.now;
+  const request = requestSignal(signal);
   const response = await (deps.fetchImpl ?? fetch)(DEVICE_AUTHORIZATION_URL, {
     method: "POST",
     headers: {
@@ -188,16 +222,19 @@ export async function requestMuseDeviceAuthorization(
     },
     body: new URLSearchParams({ client_id: CLIENT_ID }).toString(),
     redirect: "error",
-    signal: requestSignal(signal),
+    signal: request,
   });
   if (!response.ok) {
+    // The error body is never parsed, but it still has to be released: an unread
+    // response body keeps the underlying connection occupied.
+    void response.body?.cancel().catch(() => undefined);
     throw new MuseDeviceLoginError(
       "device-authorization",
       `Muse Code device authorization request failed: HTTP ${response.status}`,
       { status: response.status },
     );
   }
-  const payload = record(await response.json().catch(() => undefined));
+  const payload = await readMuseJson(response, request, "device-authorization");
   const deviceCode = text(payload?.device_code);
   const userCode = text(payload?.user_code);
   if (!deviceCode || !userCode) {
@@ -241,6 +278,7 @@ export async function pollMuseDeviceToken(
     // shape checked the deadline at the top, so a sleep ending exactly at the deadline
     // skipped the final poll and discarded an approval the user had already completed
     // inside that window.
+    const request = requestSignal(signal);
     const response = await (deps.fetchImpl ?? fetch)(DEVICE_TOKEN_URL, {
       method: "POST",
       headers: {
@@ -254,9 +292,9 @@ export async function pollMuseDeviceToken(
         grant_type: DEVICE_GRANT_TYPE,
       }).toString(),
       redirect: "error",
-      signal: requestSignal(signal),
+      signal: request,
     });
-    const payload = record(await response.json().catch(() => undefined));
+    const payload = await readMuseJson(response, request, "device-token");
     if (response.ok) {
       // [W3] No deadline re-check here. If Meta answered 200 with a token, Meta accepted
       // the device code; its clock is authoritative and ours is not. Discarding an issued
@@ -322,6 +360,7 @@ export async function mintMuseApiKey(
   signal?: AbortSignal,
 ): Promise<MuseKeyPayload> {
   const now = deps.now ?? Date.now;
+  const request = requestSignal(signal);
   const response = await (deps.fetchImpl ?? fetch)(MUSE_KEY_URL, {
     method: "POST",
     headers: {
@@ -332,9 +371,10 @@ export async function mintMuseApiKey(
     },
     body: JSON.stringify(options.onboard ? { onboard: true } : {}),
     redirect: "error",
-    signal: requestSignal(signal),
+    signal: request,
   });
   if (response.status === 429) {
+    void response.body?.cancel().catch(() => undefined);
     const wait = retryAfterMs(response.headers.get("retry-after"), now());
     throw new MuseDeviceLoginError(
       "mint-rate-limited",
@@ -345,14 +385,16 @@ export async function mintMuseApiKey(
     );
   }
   if (!response.ok) {
-    // Status only. The body of this endpoint can carry the key itself.
+    // Status only. The body of this endpoint can carry the key itself, so it is
+    // never parsed — but it is still cancelled so the connection is released.
+    void response.body?.cancel().catch(() => undefined);
     throw new MuseDeviceLoginError(
       "mint-http",
       `Muse Code key exchange failed: HTTP ${response.status}`,
       { status: response.status },
     );
   }
-  const payload = record(await response.json().catch(() => undefined));
+  const payload = await readMuseJson(response, request, "mint-invalid");
   if (!payload) {
     throw new MuseDeviceLoginError("mint-invalid", "Muse Code key exchange returned an unreadable response", {
       status: response.status,

package/src/oauth/store.ts

@@ -6,6 +6,9 @@
  * Legacy single-credential values (`{ access, refresh, expires, ... }`) normalize on load,
  * and the first new-shape persist writes a one-time `auth.json.pre-multiauth` backup so a
  * downgraded loader (which silently drops unknown shapes) cannot destroy refresh tokens.
+ * Destructive mutations (logout, account deletion, provider deletion) remove the affected
+ * provider's entry from that backup, and the file once nothing is left, so deleted
+ * credentials are not retained while other providers keep their downgrade recovery.
  *
  * Exceptions:
  * - `chatgpt` stays single-slot (always replaced): codex-auth-api uses it as a scratch slot
@@ -17,9 +20,10 @@
  *   both append distinct identified accounts under multiauth.
  */
 import { createHash, randomUUID } from "node:crypto";
-import { chmodSync, closeSync, copyFileSync, existsSync, fstatSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, constants as fsConstants, copyFileSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { getConfigDir, atomicWriteFile, backupInvalidConfig, hardenConfigDir, hardenExistingSecret, withConfigMutationLockSync } from "../config";
+import { atomicWriteFileNoFollowUnclaimed } from "../config/atomic-write";
 import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
 import { MAX_PENDING_OAUTH_MUTATIONS } from "../lib/translator-budget";
@@ -433,9 +437,11 @@ export function createOAuthRefreshIntentLock(provider:string,accountId:string,ov
 function backupLegacyOnce(): void {
   const path = getAuthStorePath();
   const backup = `${path}.pre-multiauth`;
-  if (!existsSync(path) || existsSync(backup)) return;
+  // Any existing entry, including a dangling symlink existsSync would call absent, is left
+  // alone, and the copy is exclusive, so credentials are never written through a link.
+  if (!existsSync(path) || directoryEntryExists(backup)) return;
   try {
-    copyFileSync(path, backup);
+    copyFileSync(path, backup, fsConstants.COPYFILE_EXCL);
     try { chmodSync(backup, 0o600); } catch { /* best-effort */ }
     try {
       // Register only the copy we just created. An unowned home still needs downgrade recovery.
@@ -448,6 +454,53 @@ function backupLegacyOnce(): void {
   } catch { /* best-effort */ }
 }
 
+/**
+ * Destructive mutations (logout, account deletion, provider deletion) remove the affected
+ * providers from the downgrade backup: it holds a copy of the very credentials the user
+ * removed. Entries for other providers stay, so their downgrade recovery survives; the file
+ * goes once nothing is left. Account deletion drops the provider's whole legacy entry, since
+ * a refreshed token cannot be matched to the account it came from. A backup entry that is
+ * not a regular file is never followed or rewritten; a symlink is removed, while a directory
+ * is left in place with a warning. A regular backup is replaced atomically when providers
+ * remain and removed when none do. Best-effort like the create path: this runs after
+ * persist, so a failure must not report a failed logout for an account that is already
+ * gone; it warns instead. A stale uninstall-manifest entry is harmless:
+ * removeOwnedConfigState skips paths that no longer exist.
+ */
+function scrubLegacyBackup(providers: readonly string[]): void {
+  const backup = `${getAuthStorePath()}.pre-multiauth`;
+  try {
+    const remaining = readLegacyBackupEntries(backup);
+    for (const provider of providers) delete remaining[provider];
+    if (Object.keys(remaining).length > 0) atomicWriteFileNoFollowUnclaimed(backup, `${JSON.stringify(remaining, null, 2)}\n`);
+    else unlinkSync(backup);
+  } catch (error) {
+    if (errorCode(error) !== "ENOENT") {
+      console.warn(`[oauth] could not remove deleted credentials from the legacy credential backup: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+}
+
+/** Provider entries of the backup; empty (so the file is removed) when unreadable or not a regular file. */
+function readLegacyBackupEntries(backup: string): Record<string, unknown> {
+  if (!lstatSync(backup).isFile()) return {};
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(backup, "utf-8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? { ...(parsed as Record<string, unknown>) } : {};
+  } catch {
+    return {};
+  }
+}
+
+function directoryEntryExists(path: string): boolean {
+  try {
+    lstatSync(path);
+    return true;
+  } catch (error) {
+    return errorCode(error) !== "ENOENT";
+  }
+}
+
 function isCredentialSource(value: unknown): value is OAuthCredentialSource {
   return value === "oauth" || value === "local-cli" || value === "credential-file" || value === "environment" || value === "manual";
 }
@@ -712,7 +765,7 @@ function serializeMutation<T>(work: () => Promise<T>, retainedValues: readonly u
   drainOAuthMutations();
   return result;
 }
-export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValues: readonly unknown[] = [], options?: { waitMs?: number; assertBeforePersist?: () => void }):Promise<T>{return serializeMutation(async()=>{const guard=await createOAuthFileLock({path:getAuthStoreLockPath(),staleAfterMs:30000}).acquire();try{
+export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValues: readonly unknown[] = [], options?: { waitMs?: number; assertBeforePersist?: () => void; scrubLegacyBackup?: (result: T) => readonly string[] }):Promise<T>{return serializeMutation(async()=>{const guard=await createOAuthFileLock({path:getAuthStoreLockPath(),staleAfterMs:30000}).acquire();try{
     const { store, hadLegacy } = loadAuthStoreInternal();
     if (hadLegacy) backupLegacyOnce();
     const selections = new Map(Object.entries(store).map(([provider, set]) => [provider, {
@@ -722,6 +775,9 @@ export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValue
       accountIds: set.accounts.map(account => account.id),
     }]));
     const result = await fn(store);
+    // Only providers whose credentials this mutation actually removed leave the downgrade
+    // backup; a no-op removal names none. The result decides, so it is read here.
+    const scrubbedProviders = options?.scrubLegacyBackup?.(result) ?? [];
     options?.assertBeforePersist?.();
     const changedProviders: string[] = [];
     for (const provider of new Set([...selections.keys(), ...Object.keys(store)])) {
@@ -743,6 +799,7 @@ export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValue
       }
     }
     persist(store);
+    if (scrubbedProviders.length > 0) scrubLegacyBackup(scrubbedProviders);
     for (const provider of changedProviders) publishAccountSelection(provider, "oauth");
     return result;
   }finally{guard.release();}}, retainedValues, options?.waitMs);
@@ -886,7 +943,7 @@ export async function removeCredential(provider: string): Promise<"removed" | "n
     }
     set.activeAccountId = set.accounts[0]!.id;
     return "removed" as const;
-  }, [provider]);
+  }, [provider], { scrubLegacyBackup: result => result === "removed" ? [provider] : [] });
 }
 
 // ---------------------------------------------------------------------------
@@ -1029,19 +1086,26 @@ export async function removeAccount(provider: string, accountId: string): Promis
     }
     if (set.activeAccountId === accountId) set.activeAccountId = set.accounts[0]!.id;
     return true;
-  }, [provider, accountId]);
+  }, [provider, accountId], { scrubLegacyBackup: removed => removed ? [provider] : [] });
   return removed;
 }
 
-/** Replace or clear a provider account set (used for transactional Kiro add-account rollback). */
+/**
+ * Replace or clear a provider account set (provider deletion, transactional Kiro add-account
+ * rollback). Clearing a provider that had credentials is a destructive mutation, so it also removes
+ * the provider from the legacy downgrade backup, like logout and account deletion. A non-empty
+ * replacement leaves the backup alone: a future caller that removes accounts through a
+ * replacement needs its own decision here.
+ */
 export async function replaceProviderAccountSet(
   provider: string,
   set: ProviderAccountSet | null,
 ): Promise<void> {
   await mutateStore(store => {
     if (!set || set.accounts.length === 0) {
+      const cleared = store[provider] !== undefined;
       delete store[provider];
-      return;
+      return cleared;
     }
     store[provider] = {
       activeAccountId: set.activeAccountId,
@@ -1053,7 +1117,8 @@ export async function replaceProviderAccountSet(
         ...(account.addedAt !== undefined ? { addedAt: account.addedAt } : {}),
       })),
     };
-  }, [provider, set]);
+    return false;
+  }, [provider, set], { scrubLegacyBackup: cleared => cleared ? [provider] : [] });
 }
 
 export type ProviderCredentialRekeyOutcome = "moved" | "absent" | "conflict";

package/src/providers/alibaba-region-backup.ts

@@ -1,10 +1,12 @@
-import { copyFileSync, existsSync, linkSync, readFileSync, rmSync } from "node:fs";
+import { chmodSync, copyFileSync, existsSync, linkSync, readFileSync, rmSync } from "node:fs";
 import { getConfigPath } from "../config";
+import { hardenSecretPath } from "../lib/windows-secret-acl";
 
 export interface AlibabaBackupIO {
   exists: (path: string) => boolean;
   read: (path: string) => Buffer;
   copy: (source: string, destination: string) => void;
+  harden: (path: string) => void;
   /** Publish with no-replace semantics: fails with EEXIST if the destination exists. */
   publishNoReplace: (temp: string, destination: string) => void;
   remove: (path: string) => void;
@@ -14,6 +16,16 @@ const DEFAULT_IO: AlibabaBackupIO = {
   exists: existsSync,
   read: path => readFileSync(path),
   copy: (source, destination) => copyFileSync(source, destination),
+  harden: path => {
+    // POSIX: a failed chmod must not publish a credential-bearing backup with weak permissions.
+    // Windows keeps its own control via hardenSecretPath below, which is the required check.
+    if (process.platform === "win32") {
+      try { chmodSync(path, 0o600); } catch { /* Windows may not support POSIX chmod */ }
+    } else {
+      chmodSync(path, 0o600);
+    }
+    if (process.platform === "win32") hardenSecretPath(path, { required: true });
+  },
   publishNoReplace: linkSync,
   remove: path => rmSync(path, { force: true }),
 };
@@ -57,6 +69,9 @@ export function backupConfigBeforeAlibabaRegionMigration(
   const temp = `${backup}.${process.pid}.tmp`;
   try {
     io.copy(configPath, temp);
+    // The snapshot contains credentials. Harden it before publication so the
+    // stable backup path is never exposed with inherited permissions or ACLs.
+    io.harden(temp);
     // Verify before publishing: a short copy must never become the snapshot.
     if (!io.read(temp).equals(source)) {
       throw new AlibabaBackupIntegrityError(`failed to write a complete backup to ${temp}`);