@bitkyc08/opencodex 2.66.0-preview.20260925 → 2.67.0-preview.20260926

package/src/lab/fabric/producer-isolate.ts

@@ -15,6 +15,25 @@ import { FabricTaskError } from "./types";
 
 const CHILD_ENTRY = join(dirname(fileURLToPath(import.meta.url)), "producer-child.ts");
 
+/**
+ * Bounded drain window between a child's `exit` and our decision. `close` also
+ * waits for the child's stdio to end, and a descendant holding an inherited pipe
+ * can delay it forever — so a missing `close` must not keep the run pending.
+ * The bound only has to cover an ordinary stdio flush after process death: the
+ * kernel releases a dead child's pipe ends immediately, so a `close` slower
+ * than this almost always means a descendant still holds a pipe. A slow-but-
+ * normal pipe that outlives the bound costs an inconclusive verdict plus
+ * deferred scratch cleanup — a bounded price that does not grow with the wait.
+ */
+const EXIT_DRAIN_MS = 250;
+
+/**
+ * Bounded wait for exit/close after a parent-owned SIGKILL. Neither event is
+ * guaranteed — a child in uninterruptible sleep, or a kill() that failed, produces
+ * neither — and a latched killReason must not leave the run pending forever.
+ */
+const KILL_CONFIRM_MS = 2_000;
+
 type FabricProducerIsolationLimits = {
   totalTimeoutMs: number;
   inactivityTimeoutMs: number;
@@ -80,6 +99,24 @@ function killChild(child: ChildProcess): void {
   }
 }
 
+/** Whether the producer rejected while its child might still be running. */
+export function isUnconfirmedProducerTermination(error: unknown): boolean {
+  return error instanceof FabricTaskError
+    && (error as FabricTaskError & { unconfirmedTermination?: boolean }).unconfirmedTermination === true;
+}
+
+/**
+ * The release signal attached to an unconfirmed-termination rejection: resolves
+ * once every monitored inherited stdio pipe reports its natural close. This is
+ * observation only: closing a pipe does not prove a descendant exited and must
+ * not authorize deletion. Undefined when nothing monitorable remained.
+ */
+export function producerTerminationSignal(error: unknown): Promise<void> | undefined {
+  if (!error || typeof error !== "object") return undefined;
+  const signal = (error as { stdioRelease?: unknown }).stdioRelease;
+  return signal instanceof Promise ? signal : undefined;
+}
+
 /** Run a fabric patch producer in an isolated child process with parent-owned timeouts. */
 export async function runIsolatedFabricProducer(request: IsolateRequest): Promise<IsolatedProducerResult> {
   const now = request.now ?? (() => Date.now());
@@ -110,8 +147,37 @@ export async function runIsolatedFabricProducer(request: IsolateRequest): Promis
     let stderrBytes = 0;
     let settled = false;
     let childClosed = false;
+    let childExitedAt: number | undefined;
     let receivedResult: SyntheticPatchV1 | undefined;
     let killReason: FabricTaskError | undefined;
+    let reapTimer: ReturnType<typeof setTimeout> | undefined;
+    let killWatchdog: ReturnType<typeof setTimeout> | undefined;
+    // Resolves once every still-open inherited stdio pipe reports its natural
+    // close. This is not a writer-termination proof or scratch deletion lease.
+    // Undefined when no open pipe can be monitored.
+    let stdioReleaseSignal: Promise<void> | undefined;
+
+    // Keep monitorable pipes open but unref'd so they never extend process
+    // lifetime; a stream without unref() is destroyed instead, and its
+    // self-inflicted close must not count toward the release signal.
+    const armStdioRelease = (): void => {
+      const waiters: Promise<void>[] = [];
+      let unmonitorable = false;
+      for (const stream of [child.stdout, child.stderr]) {
+        if (!stream || stream.destroyed) continue;
+        const unref = (stream as unknown as { unref?: unknown }).unref;
+        if (typeof unref === "function") {
+          waiters.push(new Promise<void>((resolve) => stream.once("close", resolve)));
+          unref.call(stream);
+        } else {
+          unmonitorable = true;
+          try { stream.destroy(); } catch { /* already closed */ }
+        }
+      }
+      if (waiters.length > 0 && !unmonitorable) {
+        stdioReleaseSignal = Promise.all(waiters).then(() => undefined);
+      }
+    };
 
     const finish = (fn: () => void) => {
       // A latched failure owns settlement, but scratch cleanup must wait for close.
@@ -119,6 +185,8 @@ export async function runIsolatedFabricProducer(request: IsolateRequest): Promis
       settled = true;
       clearTimeout(totalTimer);
       clearTimeout(inactivityTimer);
+      if (reapTimer) clearTimeout(reapTimer);
+      if (killWatchdog) clearTimeout(killWatchdog);
       if (killReason) reject(killReason);
       else fn();
     };
@@ -127,7 +195,31 @@ export async function runIsolatedFabricProducer(request: IsolateRequest): Promis
       if (settled || killReason) return;
       killReason = error;
       if (childClosed) finish(() => reject(error));
-      else killChild(child);
+      else {
+        killChild(child);
+        // SIGKILL does not guarantee exit/close: an uninterruptible child, or a
+        // kill() that failed, emits neither, and the latched killReason would
+        // otherwise keep this run pending forever. Bound the wait; on expiry
+        // reject with the original reason flagged unconfirmed so the caller
+        // defers scratch cleanup instead of racing a child that may live.
+        killWatchdog = setTimeout(() => {
+          if (childClosed || settled) return;
+          settled = true;
+          clearTimeout(totalTimer);
+          clearTimeout(inactivityTimer);
+          if (reapTimer) clearTimeout(reapTimer);
+          if (killWatchdog) {
+            clearTimeout(killWatchdog);
+            killWatchdog = undefined;
+          }
+          armStdioRelease();
+          try { child.unref(); } catch { /* fake children may lack unref */ }
+          const reason = killReason! as FabricTaskError & { unconfirmedTermination?: boolean; stdioRelease?: Promise<void> };
+          reason.unconfirmedTermination = true;
+          reason.stdioRelease = stdioReleaseSignal;
+          reject(killReason);
+        }, KILL_CONFIRM_MS);
+      }
     };
 
     const expiredDeadline = (at: number): FabricTaskError | undefined => {
@@ -163,7 +255,10 @@ export async function runIsolatedFabricProducer(request: IsolateRequest): Promis
       try {
         const message = parseProducerProtocolLine(line);
         if (message.type === "activity" || message.type === "result") {
-          const at = budgetNow();
+          // Bytes drained after `exit` are judged at the exit timestamp: the
+          // process met its budgets when it died, so the drain must not
+          // condemn data it wrote while still inside them.
+          const at = childExitedAt ?? budgetNow();
           const expired = expiredDeadline(at);
           if (expired) {
             settleTimeout(expired);
@@ -172,13 +267,12 @@ export async function runIsolatedFabricProducer(request: IsolateRequest): Promis
           if (message.type === "activity") {
             lastActivityAt = request.now ? at : now();
             inactivityDeadline = at + request.inactivityTimeoutMs;
-            armInactivity();
+            if (childExitedAt === undefined) armInactivity();
             return;
           }
         }
         if (message.type === "result") {
           receivedResult = message.patch;
-          finish(() => resolve({ patch: message.patch, lastActivityAt }));
           return;
         }
         if (message.type === "error") {
@@ -193,8 +287,7 @@ export async function runIsolatedFabricProducer(request: IsolateRequest): Promis
                   : "harness_failure";
           const attribution = message.attribution === "environment" ? "environment" : "harness";
           const fabricError = new FabricTaskError(message.message, fabricCode, attribution);
-          finish(() => reject(fabricError));
-          killChild(child);
+          settleTimeout(fabricError);
           return;
         }
       } catch (error) {
@@ -228,8 +321,7 @@ export async function runIsolatedFabricProducer(request: IsolateRequest): Promis
     });
 
     child.stdout?.on("error", (error) => {
-      if (settled) return;
-      finish(() => reject(new FabricTaskError(error.message, "harness_failure", "harness")));
+      settleTimeout(new FabricTaskError(error.message, "harness_failure", "harness"));
     });
 
     child.stderr?.on("data", (chunk: Buffer | string) => {
@@ -244,24 +336,32 @@ export async function runIsolatedFabricProducer(request: IsolateRequest): Promis
     });
 
     child.on("error", (error) => {
-      finish(() => reject(new FabricTaskError(error.message, "harness_failure", "harness")));
+      if (child.pid === undefined) {
+        // A spawn failure has no process to supervise and may never emit close.
+        childClosed = true;
+        finish(() => reject(new FabricTaskError(error.message, "harness_failure", "harness")));
+        return;
+      }
+      settleTimeout(new FabricTaskError(error.message, "harness_failure", "harness"));
     });
 
     child.stdin?.on("error", (error: NodeJS.ErrnoException) => {
-      if (settled || killReason || error.code === "EPIPE") return;
-      killChild(child);
-      finish(() => reject(new FabricTaskError(error.message, "harness_failure", "harness")));
+      if (error.code === "EPIPE") return;
+      settleTimeout(new FabricTaskError(error.message, "harness_failure", "harness"));
     });
 
-    child.on("close", (code, signal) => {
-      childClosed = true;
+    const decide = (code: number | null, signal: NodeJS.Signals | null, reaped = false) => {
       if (settled) return;
       if (killReason) {
-        finish(() => reject(killReason!));
-        return;
-      }
-      if (receivedResult) {
-        finish(() => resolve({ patch: receivedResult!, lastActivityAt }));
+        const reason = killReason as FabricTaskError & { unconfirmedTermination?: boolean; stdioRelease?: Promise<void> };
+        if (reaped) {
+          // The kill was answered by exit but the pipes stayed open: a
+          // descendant can still hold them, so scratch cleanup must defer to
+          // the same release contract as an unconfirmed kill.
+          reason.unconfirmedTermination = true;
+          reason.stdioRelease = stdioReleaseSignal;
+        }
+        finish(() => reject(reason));
         return;
       }
       if (stdoutBuffer.trim()) {
@@ -272,15 +372,85 @@ export async function runIsolatedFabricProducer(request: IsolateRequest): Promis
           /* fall through */
         }
       }
-      if (signal === "SIGKILL") {
-        finish(() => reject(new FabricTaskError("total timeout exceeded", "timeout", "environment")));
+      if (reaped) {
+        // `close` never followed `exit`: the pipes outlived the producer, which
+        // may mean a descendant escaped supervision — but the drain also cannot
+        // rule out a stalled event loop or a slow pipe, so this is reported as
+        // an inconclusive harness failure rather than a sandbox escape. Either
+        // way the result is rejected: it must never resolve while a descendant
+        // might still be alive to mutate scratch after cleanup. The recorded
+        // exit status only narrows the message; the deferral contract is the
+        // same for a clean exit and a nonzero or signaled one.
+        const failure = new FabricTaskError(
+          code !== 0 || signal
+            ? `isolated producer exited (${code ?? signal ?? "unknown"}); its stdio never closed`
+            : "isolated producer exited but its stdio never closed",
+          "harness_failure",
+          "harness",
+        ) as FabricTaskError & { unconfirmedTermination?: boolean; stdioRelease?: Promise<void> };
+        // A descendant holding an inherited pipe can still use scratch after
+        // the direct child exited, so the caller must retain scratch for manual
+        // review — pipe closure alone cannot prove a descendant terminated.
+        failure.unconfirmedTermination = true;
+        failure.stdioRelease = stdioReleaseSignal;
+        finish(() => reject(failure));
         return;
       }
-      finish(() => reject(new FabricTaskError(
-        code === 0 ? "isolated producer returned no result" : `isolated producer exited (${code ?? signal ?? "unknown"})`,
-        "harness_failure",
-        "harness",
-      )));
+      // A stored result is accepted only when the child exited normally. A
+      // signaled or nonzero exit without a latched reason is a harness failure —
+      // parent-owned kills always carry a killReason, so this is never a timeout.
+      if (code !== 0 || signal) {
+        finish(() => reject(new FabricTaskError(
+          `isolated producer exited (${code ?? signal ?? "unknown"})`,
+          "harness_failure",
+          "harness",
+        )));
+        return;
+      }
+      if (receivedResult) {
+        finish(() => resolve({ patch: receivedResult!, lastActivityAt }));
+        return;
+      }
+      finish(() => reject(new FabricTaskError("isolated producer returned no result", "harness_failure", "harness")));
+    };
+
+    child.on("exit", (code, signal) => {
+      if (childClosed || settled) return;
+      // `exit` ends the budget window even while `close` is still pending on
+      // stdio: an already-met deadline still applies, and no producer code can
+      // breach one after this point, so both budget timers are disarmed now.
+      childExitedAt = budgetNow();
+      if (!killReason) {
+        const expired = expiredDeadline(childExitedAt);
+        if (expired) killReason = expired;
+      }
+      clearTimeout(totalTimer);
+      clearTimeout(inactivityTimer);
+      // The direct child is confirmed dead, so the kill-confirmation watchdog
+      // is moot; only the stdio drain still needs its bound.
+      if (killWatchdog) {
+        clearTimeout(killWatchdog);
+        killWatchdog = undefined;
+      }
+      // The direct child is dead, but `close` also waits for its stdio to end.
+      // Bound the drain so a descendant holding an inherited pipe cannot keep
+      // the run pending, then settle from the recorded exit status.
+      reapTimer = setTimeout(() => {
+        if (reapTimer) {
+          clearTimeout(reapTimer);
+          reapTimer = undefined;
+        }
+        if (childClosed || settled) return;
+        childClosed = true;
+        armStdioRelease();
+        decide(code, signal, true);
+      }, EXIT_DRAIN_MS);
+    });
+
+    child.on("close", (code, signal) => {
+      if (childClosed) return;
+      childClosed = true;
+      decide(code, signal);
     });
 
     const payload = JSON.stringify({
@@ -299,8 +469,7 @@ export async function runIsolatedFabricProducer(request: IsolateRequest): Promis
         : undefined,
     });
     if (Buffer.byteLength(payload, "utf8") > FABRIC_PRODUCER_REQUEST_MAX_BYTES) {
-      killChild(child);
-      finish(() => reject(new FabricTaskError("producer request exceeds protocol limit", "budget_exhausted", "environment")));
+      settleTimeout(new FabricTaskError("producer request exceeds protocol limit", "budget_exhausted", "environment"));
       return;
     }
 
@@ -308,13 +477,11 @@ export async function runIsolatedFabricProducer(request: IsolateRequest): Promis
       child.stdin?.write(payload);
       child.stdin?.end();
     } catch (error) {
-      if (killReason) return;
-      killChild(child);
-      finish(() => reject(new FabricTaskError(
+      settleTimeout(new FabricTaskError(
         error instanceof Error ? error.message : String(error),
         "harness_failure",
         "harness",
-      )));
+      ));
       return;
     }
   });

package/src/lab/fabric/scratch.ts

@@ -9,6 +9,7 @@ import {
   readdirSync,
   readSync,
   rmSync,
+  statSync,
   writeSync,
   type Stats,
 } from "node:fs";
@@ -30,6 +31,9 @@ interface TrustedScratchDir {
   identity: string;
 }
 
+// Unconfirmed producer trees are retained for manual review. Neither a marker
+// inside producer-writable scratch nor its age grants later deletion authority.
+
 /** Require stats to describe a regular file, not a symlink or special node. */
 function assertRegularFile(stats: Stats, label: string): void {
   if (!stats.isFile() || stats.isSymbolicLink() || stats.isDirectory() || stats.isFIFO() || stats.isSocket() || stats.isCharacterDevice() || stats.isBlockDevice()) {
@@ -299,11 +303,14 @@ export function createSyntheticScratch(configDir?: string): ScratchTree {
     } finally {
       closeSync(fd);
     }
-    const trustedForCleanup = trusted;
+    // The pinned root is only needed to write the fixture; every later access
+    // opens its own trusted handle. Close it now so deferred cleanup — which
+    // may wait on a descendant-held pipe or never observe a release signal —
+    // cannot leak the descriptor (or hold the directory open on Windows).
+    closeTrustedScratchRoot(trusted);
     return {
       root,
       cleanup: () => {
-        closeTrustedScratchRoot(trustedForCleanup);
         try {
           rmSync(root, { recursive: true, force: true, maxRetries: 3 });
         } catch {

package/src/lib/shadow-call.ts

@@ -1,13 +1,16 @@
 /**
  * Shadow-call intercept source models.
  *
- * Codex 0.145.0+ uses `gpt-5.6-luna` for helper calls. Older clients through
- * 0.144.x used `gpt-5.4-mini`; operators supporting them can restore that
- * prefix with the `sourceModels` override. Every surface that names the
+ * Codex 0.154.0+ sends `gpt-6-luna` for helper calls. Clients from 0.145.0
+ * through 0.153.x sent `gpt-5.6-luna`, which stays a default prefix so those
+ * clients keep their interception. Clients through 0.144.x used `gpt-5.4-mini`;
+ * operators supporting them can restore that prefix with the `sourceModels`
+ * override. The GPT-6 slug comes first because surfaces show the list in order.
+ * Every surface that names the
  * intercepted model (management API, GUI badges/tooltips, CLI) reads it from
  * here instead of hard-coding a slug that goes stale on the next client bump.
  */
-export const DEFAULT_SHADOW_SOURCE_MODELS = ["gpt-5.6-luna"] as const;
+export const DEFAULT_SHADOW_SOURCE_MODELS = ["gpt-6-luna", "gpt-5.6-luna"] as const;
 
 /**
  * Optional blocked model redirects at the shared routing layer.
@@ -84,6 +87,10 @@ export function shadowCallTargetsIntersect(
  * intercept every configured shadow source model regardless of request kind.
  * A replacement intersecting the same provider+model source set remains a
  * no-op because rewriting it would only create self-interception (#2706).
+ *
+ * Callers skip this check entirely for spawned sub-agent turns
+ * (`isThreadSpawnRequest`): `gpt-6-luna` is both the helper slug and a default
+ * sub-agent model, and an explicitly spawned child must keep the model it chose.
  */
 export function shouldInterceptShadowCall(
   modelId: string,

package/src/lib/worker-embed.ts

@@ -0,0 +1,33 @@
+/**
+ * Worker spawning that survives `bun build --compile`.
+ *
+ * Bun standalone executables fail to resolve nested worker entrypoints
+ * (oven-sh/bun#29124): the main bundle is flattened into /$bunfs/root while
+ * additional entrypoints keep their nested paths, so `new Worker(new URL(...))`
+ * dies with ModuleNotFound in compiled binaries. Standalone builds therefore
+ * embed each worker as a pre-bundled source string (generated by
+ * scripts/build-standalone.ts into src/generated/worker-bundles.gen.ts) and
+ * spawn it from a Blob URL, which works in both compiled binaries and source
+ * checkouts. Source checkouts without generated bundles fall back to the
+ * dev-mode URL form.
+ */
+import { WORKER_BUNDLES } from "../generated/worker-bundles.gen";
+
+export function spawnWorker(devUrl: string, key: string): Worker {
+  const src = WORKER_BUNDLES[key];
+  if (src) {
+    const blobUrl = URL.createObjectURL(new Blob([src], { type: "text/javascript" }));
+    let worker: Worker;
+    try {
+      worker = new Worker(blobUrl);
+    } catch (error) {
+      URL.revokeObjectURL(blobUrl);
+      throw error;
+    }
+    // Long-lived servers schedule workers repeatedly; release the blob URL
+    // once the thread exits instead of leaking one per run.
+    worker.addEventListener("close", () => URL.revokeObjectURL(blobUrl));
+    return worker;
+  }
+  return new Worker(devUrl);
+}

package/src/oauth/generic-account-failover.ts

@@ -41,7 +41,6 @@ import type { OcxConfig, OcxProviderConfig } from "../types";
 export const GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST = 3;
 
 const DEFAULT_COOLDOWN_MS = 60_000;
-const MAX_COOLDOWN_MS = 15 * 60_000;
 
 /**
  * How long a presence answer may be reused before the store is consulted again.
@@ -349,12 +348,15 @@ export function rotateGenericOAuthAccountOn429(
   // A single stored account has nowhere to go; rotating to itself would just replay the 429.
   if (!set || set.accounts.length < 2) return null;
 
-  const parsed = parseRetryAfterMs(retryAfterHeader, now, { preserveImmediate: true });
+  // `preserveServerDelay` keeps the delay the server actually stated, bounded by the parser's
+  // one-day ceiling, exactly as the combo path does. Truncating it locally only guarantees a
+  // second 429 on an account we were told to leave alone.
+  const parsed = parseRetryAfterMs(retryAfterHeader, now, { preserveImmediate: true, preserveServerDelay: true });
   // An account whose allowance is provably spent gets a reset-aligned cooldown instead of
   // the default minute: retrying it every 60s until the window rolls over is pure waste.
   // A Retry-After from upstream still wins — it is the server's own instruction.
   const exhausted = parsed === undefined ? exhaustedCooldownMs(providerName, failedAccountId, now) : null;
-  const cooldownMs = exhausted ?? Math.min(parsed ?? DEFAULT_COOLDOWN_MS, MAX_COOLDOWN_MS);
+  const cooldownMs = exhausted ?? parsed ?? DEFAULT_COOLDOWN_MS;
   const family = classifyModelFamilyForQuota(providerName, requestedModelId);
   health.set(healthKey(providerName, failedAccountId, family), {
     cooldownUntil: now + cooldownMs,

package/src/oauth/index.ts

@@ -22,11 +22,12 @@ import {
   mergeAccountCredential,
   normalizeAuthStoreBuffer,
   readOAuthRefreshIntent,
-  removeAccount,
+  rollbackCredentialWriteIfMatch,
   saveAccountCredential,
   saveCredential,
-  setActiveAccount,
+  saveCredentialWithReceipt,
   writeOAuthRefreshIntent,
+  type OAuthCredentialWriteReceipt,
   type OAuthRefreshIntent,
   type OAuthRefreshIntentCleanupPending,
 } from "./store";
@@ -1590,33 +1591,15 @@ export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
 
 interface RunLoginDeps {
   saveCredential?: typeof saveCredential;
+  saveCredentialWithReceipt?: typeof saveCredentialWithReceipt;
   saveAccountCredential?: typeof saveAccountCredential;
   loadConfig?: typeof loadConfig;
   saveConfig?: typeof saveConfig;
   settleKiroLoginTransaction?: typeof settleKiroLoginTransaction;
-  removeAccount?: typeof removeAccount;
-  setActiveAccount?: typeof setActiveAccount;
+  rollbackCredentialWrite?: typeof rollbackCredentialWriteIfMatch;
   assertCurrentOwner?: () => void;
 }
 
-/** Roll back only accounts created by this forced login, preserving concurrent refreshes of others. */
-async function rollbackForcedKiroAccountWrite(
-  provider: string,
-  previousActiveId: string | undefined,
-  previousAccountIds: ReadonlySet<string>,
-  deps: Pick<RunLoginDeps, "removeAccount" | "setActiveAccount">,
-): Promise<void> {
-  const set = getAccountSet(provider);
-  if (!set) return;
-  for (const account of [...set.accounts]) {
-    if (previousAccountIds.has(account.id)) continue;
-    await (deps.removeAccount ?? removeAccount)(provider, account.id);
-  }
-  if (previousActiveId && getAccountCredential(provider, previousActiveId)) {
-    await (deps.setActiveAccount ?? setActiveAccount)(provider, previousActiveId);
-  }
-}
-
 /** Run the login flow, persist the credential + upsert the provider entry to disk, return cred. */
 export async function runLogin(
   provider: string,
@@ -1639,9 +1622,7 @@ export async function runLogin(
   // loginKiro keys its pending CLI-session transaction by object identity. Keep this exact object
   // for settlement even when source normalization below creates a derived credential object.
   const shouldRollbackKiroAccounts = provider === "kiro" && opts?.forceLogin === true;
-  const previousKiroAccounts = shouldRollbackKiroAccounts ? getAccountSet(provider) : undefined;
-  const previousKiroActiveId = previousKiroAccounts?.activeAccountId;
-  const previousKiroAccountIds = new Set(previousKiroAccounts?.accounts.map(account => account.id) ?? []);
+  let kiroCredentialWrite: OAuthCredentialWriteReceipt | null = null;
   const loginProviderConfig = preflightConfig
     ? (def.resolveProviderConfig?.(preflightConfig) ?? preflightConfig.providers[provider] ?? def.providerConfig)
     : def.providerConfig;
@@ -1674,10 +1655,19 @@ export async function runLogin(
         assertBeforePersist: deps.assertCurrentOwner,
       });
     } else {
-      await (deps.saveCredential ?? saveCredential)(provider, cred, {
+      const saveOptions = {
         preserveIdentityless: opts?.forceLogin === true,
         assertBeforePersist: deps.assertCurrentOwner,
-      });
+      };
+      if (shouldRollbackKiroAccounts && !deps.saveCredential) {
+        kiroCredentialWrite = await (deps.saveCredentialWithReceipt ?? saveCredentialWithReceipt)(
+          provider,
+          cred,
+          saveOptions,
+        );
+      } else {
+        await (deps.saveCredential ?? saveCredential)(provider, cred, saveOptions);
+      }
     }
     if (provider !== "chatgpt") {
       // Re-run against post-credential state so same-provider API-key additions, removals,
@@ -1695,9 +1685,9 @@ export async function runLogin(
     }
   } catch (error) {
     const errors: unknown[] = [error];
-    if (shouldRollbackKiroAccounts) {
+    if (kiroCredentialWrite) {
       try {
-        await rollbackForcedKiroAccountWrite(provider, previousKiroActiveId, previousKiroAccountIds, deps);
+        await (deps.rollbackCredentialWrite ?? rollbackCredentialWriteIfMatch)(kiroCredentialWrite);
       } catch (rollbackError) {
         errors.push(rollbackError);
       }