@bitkyc08/opencodex 2.83.0 → 2.86.0

package/src/oauth/index.ts

@@ -5,6 +5,7 @@ import { getDefaultConfig, initializePersistedConfigIfMissing, loadConfig, mutat
 import { resolveProviderApiKey } from "../providers/key-store";
 import { projectEmail } from "../lib/privacy";
 import { KiroTokenRefreshError, environmentKiroRoutingMetadata, loginKiro, refreshKiroToken, settleKiroLoginTransaction } from "./kiro";
+import { KiroUserIdentityUnavailableError, kiroReauthIdentityMatches } from "./kiro-account-identity";
 import {
   OAuthMutationBusyError,
   OAuthRefreshIntentIOError,
@@ -48,7 +49,7 @@ import { loginGithubCopilot, refreshGithubCopilotToken, validateCopilotApiBaseUr
 import { loginCommandCode, refreshCommandCodeToken } from "./command-code";
 import { loginMetaMuse, refreshMetaMuseToken } from "./meta-muse";
 import { loginOrcaRouter, orcaRouterInferenceBaseUrl, refreshOrcaRouterKey } from "./orcarouter";
-import { ANTIGRAVITY_REQUEST_UA } from "../adapters/google-antigravity-wire";
+import { ANTIGRAVITY_DISCOVERY_UA } from "../adapters/google-antigravity-wire";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
 import { apiKeyPoolEntryId, sanitizeApiKeyValue } from "../providers/api-keys";
 import { effectiveGoogleMode, getProviderRegistryEntry, mergeRegistryStaticHeaders, providerMatchesRegistryTransport } from "../providers/registry";
@@ -86,6 +87,7 @@ import { codexAccountNamespaceProviderCollisionError } from "../codex/account-na
 
 import { REFRESH_SKEW_MS } from "./refresh-policy";
 import { newerClaudeCredentialForInstance, captureAnthropicCredentialOwnerForInstance } from "./anthropic-continuity";
+import { normalizeOAuthPlan, mergeOAuthPlan } from "./plan";
 import { mergeAnthropicIdentity, type AnthropicIdentityResolver } from "./anthropic-identity";
 import { AnthropicCrossInstanceDuplicateError, AnthropicLocalCliImportError, assertAnthropicCredentialSource } from "./store-anthropic-instance";
 export interface OAuthAccessSnapshot {
@@ -491,6 +493,9 @@ export function publicOAuthAuthenticationErrorMessage(error: unknown): string {
     || error instanceof AnthropicInstanceCollisionError
     || error instanceof AnthropicCrossInstanceDuplicateError
     || error instanceof AnthropicLocalCliImportError
+    // Fixed, account-free text: a Kiro login that could not name its user left the existing
+    // organization account in place, and the user must confirm the signed-in CLI user (#6641).
+    || error instanceof KiroUserIdentityUnavailableError
   ) return error.message;
   return "OAuth authentication failed. Check the OpenCodex account status and retry.";
 }
@@ -749,6 +754,7 @@ function merged(fresh: OAuthCredentials, previous: OAuthCredentials): OAuthCrede
   return {
     ...fresh,
     ...mergeAnthropicIdentity(fresh, previous),
+    plan: mergeOAuthPlan(fresh, previous),
     // Shared: a refresh function returns "local-cli" only when the credential it hands back
     // still is the local CLI's (Devin re-reading the CLI file, Meta Muse echoing its durable
     // CLI key). Relabelling that "oauth" would stop the next forced refresh from re-reading it.
@@ -1155,7 +1161,9 @@ export function buildModelsRequest(
   if (effectiveGoogleMode(providerName, effectiveProvider) === "cloud-code-assist") {
     headers.Accept = "application/json";
     headers["Content-Type"] = "application/json";
-    headers["User-Agent"] = ANTIGRAVITY_REQUEST_UA;
+    // CLI UA: CCA lists Gemini 4 Argon's wire ids only to the CLI client family. Inference keeps
+    // choosing per wire model (antigravityUserAgentForWireModel).
+    headers["User-Agent"] = ANTIGRAVITY_DISCOVERY_UA;
     if (apiKey) headers.Authorization = `Bearer ${apiKey}`;
     return guarded({
       method: "POST" as const,
@@ -1617,15 +1625,22 @@ export async function runLogin(
       if (!existing.accountId && !existing.email) {
         throw new OAuthReauthIdentityUnverifiedError();
       }
-      const identityMatches = existing.accountId && cred.accountId
-        ? existing.accountId === cred.accountId
-        : existing.email && cred.email
-          ? existing.email.toLowerCase() === cred.email.toLowerCase()
-          : false;
+      // A Kiro organization profile ARN is shared by its users, so it alone is not the account.
+      const identityMatches = provider === "kiro"
+        ? kiroReauthIdentityMatches(existing, cred, getAccountSet("kiro")?.accounts
+          .filter(account => account.id !== opts.reauthAccountId).map(account => account.credential))
+        : existing.accountId && cred.accountId
+          ? existing.accountId === cred.accountId
+          : existing.email && cred.email
+            ? existing.email.toLowerCase() === cred.email.toLowerCase()
+            : false;
       if (!identityMatches) {
         throw new OAuthReauthIdentityMismatchError();
       }
-      await (deps.saveAccountCredential ?? saveAccountCredential)(provider, opts.reauthAccountId, cred, {
+      // Proven same account: a reauth whose tier read failed keeps the stored label.
+      const reauthPlan = mergeOAuthPlan(cred, existing);
+      const reauthCred = reauthPlan === undefined ? cred : { ...cred, plan: reauthPlan };
+      await (deps.saveAccountCredential ?? saveAccountCredential)(provider, opts.reauthAccountId, reauthCred, {
         assertBeforePersist: deps.assertCurrentOwner,
         rotateLoginId: true,
       });
@@ -1736,10 +1751,9 @@ export interface OAuthAccountSummary {
    * version looked and upstream did not say. Omitting it would make those indistinguishable and
    * invite a consumer to assume a tier.
    *
-   * Every OAuth provider reports `null` today. Anthropic's `/api/oauth/usage` returns quota
-   * buckets only — `five_hour`, `seven_day`, the model-scoped weekly windows and `limits[]` —
-   * and carries no subscription/tier field, and its token response carries none either. See
-   * `fetchAnthropicUsageQuota` in `src/providers/quota.ts`.
+   * Reports the validated upstream tier stored with the credential. Anthropic profile reads
+   * supply the organization tier; Antigravity loadCodeAssist reads prefer paidTier to currentTier.
+   * Missing or invalid labels remain null; quota percentages never establish a subscription.
    */
   plan: string | null;
 }
@@ -1764,11 +1778,8 @@ export function getLoginStatus(provider: string, maskEmails = true): { loggedIn:
     ...(accountNeedsReauthForStatus(provider, a) ? { needsReauth: true } : {}),
     ...(a.needsReauth && a.needsReauthReason === "verify_account" ? { needsReauthReason: a.needsReauthReason } : {}),
     expiresAt: a.credential.expires,
-    // Explicitly null rather than omitted — see OAuthAccountSummary.plan. No OAuth provider
-    // exposes a subscription tier today, so there is nothing truthful to put here; deriving one
-    // from quota percentages is not possible, because they are normalized per account and a
-    // half-consumed small seat is indistinguishable from a half-consumed large one.
-    plan: null,
+    // Explicitly null rather than omitted when upstream tier metadata is unknown.
+    plan: normalizeOAuthPlan(a.credential.plan) ?? null,
   }));
 
   // A stored credential counts as "logged in" when it exists and is not marked for

package/src/oauth/kiro-account-identity.ts

@@ -0,0 +1,106 @@
+/**
+ * Kiro account identity (#6641).
+ *
+ * A Kiro profile ARN names an organization (IAM Identity Center) profile, and every user of
+ * that profile shares it, so it cannot tell two users apart. The user-level identifier OCX can
+ * observe is the email that same-session `kiro-cli whoami --format json` reports. Account
+ * identity is therefore the ARN together with that email; `accountId` keeps the ARN because
+ * request routing, rotated-session recovery and persisted evidence read it as the profile.
+ *
+ * Stored rows are never rewritten to a new key. A legacy row keeps matching the shape it was
+ * saved with, and a row that predates the email is only claimed by a login proven to be the
+ * same CLI session (identical refresh token). A login that cannot name its user keeps the legacy
+ * profile identity, but is refused rather than overwrite an identified user of that profile.
+ */
+import type { OAuthCredentials, ProviderAccount } from "./types";
+
+type KiroIdentityFields = Pick<OAuthCredentials, "accountId" | "email">;
+
+export class KiroUserIdentityUnavailableError extends Error {
+  constructor() {
+    super(
+      "Kiro CLI did not report which user is signed in, so OpenCodex cannot tell this login apart "
+        + "from the identified users of the same Kiro profile. No existing account was replaced. "
+        + "Confirm that `kiro-cli whoami` reports the signed-in user, then retry; to renew one "
+        + "account, use its Reauthenticate action.",
+    );
+    this.name = "KiroUserIdentityUnavailableError";
+  }
+}
+
+export function kiroUserEmail(credential: Pick<OAuthCredentials, "email">): string | undefined {
+  const email = credential.email?.trim().toLowerCase();
+  return email ? email : undefined;
+}
+
+/** ARN + user email when both are known; otherwise whichever one the credential carries. */
+export function kiroIdentityKey(credential: KiroIdentityFields): string | undefined {
+  const email = kiroUserEmail(credential);
+  if (credential.accountId && email) return `${credential.accountId}\n${email}`;
+  return credential.accountId ?? email;
+}
+
+function sameCliSession(account: ProviderAccount, incoming: OAuthCredentials): boolean {
+  return Boolean(incoming.refresh) && account.credential.refresh === incoming.refresh;
+}
+
+/**
+ * Pick the stored row an identity-bearing Kiro login updates, or undefined to append a new row.
+ * Throws KiroUserIdentityUnavailableError instead of guessing between identified users.
+ */
+export function findKiroAccountForLogin(
+  accounts: readonly ProviderAccount[],
+  incoming: OAuthCredentials,
+): ProviderAccount | undefined {
+  const key = kiroIdentityKey(incoming);
+  if (!key) return undefined;
+  const profileArn = incoming.accountId;
+  const sameProfile = profileArn
+    ? accounts.filter(account => account.credential.accountId === profileArn)
+    : [];
+  if (profileArn && !kiroUserEmail(incoming)) {
+    // whoami named no user. Without any identified user the profile ARN stays the identity, as it
+    // always was. Once the profile has an identified user, a profile-only match could be anyone
+    // in the organization: only the same CLI session may update a row; otherwise refuse.
+    if (sameProfile.some(account => kiroUserEmail(account.credential))) {
+      const proven = sameProfile.find(account => sameCliSession(account, incoming));
+      if (proven) return proven;
+      throw new KiroUserIdentityUnavailableError();
+    }
+  }
+  const exact = accounts.find(account => kiroIdentityKey(account.credential) === key);
+  if (exact) return exact;
+  if (profileArn && kiroUserEmail(incoming)) {
+    // A row saved before whoami named its user: only the same CLI session proves it is this user.
+    return sameProfile.find(account => !kiroUserEmail(account.credential) && sameCliSession(account, incoming));
+  }
+  return undefined;
+}
+
+/** A proven same-session update without whoami keeps the user email the row already has. */
+export function withRetainedKiroUser(incoming: OAuthCredentials, existing: OAuthCredentials): OAuthCredentials {
+  if (incoming.email || !existing.email || incoming.accountId !== existing.accountId) return incoming;
+  return { ...incoming, email: existing.email };
+}
+
+/**
+ * Reauth may refresh a slot only with the same profile AND, once known, the same user. A slot
+ * saved before its user was known is renewable only by this explicit reauth, unless the incoming
+ * user already owns another slot of the profile (then it is provably someone else).
+ */
+export function kiroReauthIdentityMatches(
+  existing: KiroIdentityFields,
+  incoming: KiroIdentityFields,
+  otherAccounts: readonly KiroIdentityFields[] = [],
+): boolean {
+  const existingEmail = kiroUserEmail(existing);
+  const incomingEmail = kiroUserEmail(incoming);
+  if (existing.accountId && incoming.accountId) {
+    if (existing.accountId !== incoming.accountId) return false;
+    if (existingEmail !== undefined) return existingEmail === incomingEmail;
+    return incomingEmail === undefined || !otherAccounts.some(other =>
+      other.accountId === incoming.accountId && kiroUserEmail(other) === incomingEmail);
+  }
+  return Boolean(existingEmail && incomingEmail && existingEmail === incomingEmail);
+}
+

package/src/oauth/kiro-device-login.ts

@@ -250,9 +250,10 @@ async function poll(flow: Flow, principal: KiroDevicePrincipal): Promise<KiroDev
       if (data.status === "authorization_pending") return publicView(flow);
       if (data.status === "expired_token" || data.status === "expired") return terminal(flow, "expired");
     }
+    // The social poll reports a completed grant as status "authorized"; "approved" is kept as an alias.
     if (result.status !== 200 || Object.hasOwn(data, "error") || error || (builder && (data.status !== undefined || !positive(data.expiresIn) || !isStorableKiroClientPart(flow.clientId)
       || !isStorableKiroClientPart(flow.clientSecret)))
-      || (!builder && (data.status !== undefined && data.status !== "approved"))) return terminal(flow, "failed");
+      || (!builder && (data.status !== undefined && data.status !== "authorized" && data.status !== "approved"))) return terminal(flow, "failed");
     if (!code(data.accessToken) || !code(data.refreshToken)
       || (!builder && (typeof data.profileArn !== "string" || !PROFILE_ARN.test(data.profileArn)))) return terminal(flow, "failed");
     const credential: OAuthCredentials = {

package/src/oauth/kiro.ts

@@ -27,8 +27,9 @@ import {
   type KiroImportDiagnostic,
 } from "./kiro-credentials";
 import { homedir } from "node:os";
-import { getAccountSet, saveAccountCredential } from "./store";
+import { bindKiroAccountUserEmail, getAccountSet, saveAccountCredential } from "./store";
 import { KIRO_BUILDER_ID_SERVICE_PROFILE_ARN } from "../adapters/kiro-constants";
+import { kiroUserEmail } from "./kiro-account-identity";
 
 const DEFAULT_REGION = "us-east-1";
 const REFRESH_URL = "https://prod.{region}.auth.desktop.kiro.dev/refreshToken";
@@ -44,6 +45,10 @@ const KIRO_TERMINAL_REFRESH_ERRORS = new Set([
   "access_denied",
   "expired_token",
 ]);
+// The desktop refresh endpoint rejects a dead refresh token with HTTP 401 and a bare
+// `{"message":"Bad credentials"}` body, without an OAuth `error` code. Only that exact
+// pair is a terminal verdict; it is surfaced under this fixed code, never the raw text.
+const KIRO_DESKTOP_BAD_CREDENTIALS = "bad_credentials";
 
 interface ImportedKiroToken {
   access: string;
@@ -246,8 +251,10 @@ export function environmentKiroRoutingMetadata(): Pick<KiroOAuthMetadata, "profi
 }
 
 /**
- * Before Add-account switches the external CLI identity, bind any matching legacy identity-less
- * OCX row to the current CLI session. Unmatched identity-less rows are left alone here so a
+ * Before Add-account switches the external CLI identity, bind any matching legacy OCX row to the
+ * current CLI session: identity-less rows gain their identity, and rows keyed only by a profile
+ * ARN gain the same-session whoami user, so the user being added next is told apart from them
+ * when both share an organization profile (#6641). Unmatched rows are left alone here so a
  * cancelled browser login cannot destroy the only stored credential; after a successful add they
  * remain selectable but cannot borrow the new CLI identity (and reauth refuses identity-less slots).
  */
@@ -258,7 +265,7 @@ async function bindMatchingLegacyIdentitylessKiroAccounts(
   const set = getAccountSet("kiro");
   if (!set) return;
   const legacyAccounts = set.accounts.filter(
-    account => account.credential.accountId === undefined && account.credential.email === undefined,
+    account => account.credential.email === undefined,
   );
   if (legacyAccounts.length === 0) return;
 
@@ -275,7 +282,14 @@ async function bindMatchingLegacyIdentitylessKiroAccounts(
     if (!refresh || imported.refresh !== refresh) continue;
     const bound = await oauthCredentialFromImported(imported, runner, signal);
     if (!bound.accountId && !bound.email) continue;
-    await saveAccountCredential("kiro", account.id, bound);
+    const storedArn = account.credential.accountId;
+    if (storedArn === undefined) {
+      await saveAccountCredential("kiro", account.id, bound);
+      continue;
+    }
+    // An ARN-keyed row only gains its user; tokens, routing, plan and health stay as stored.
+    if (bound.accountId !== storedArn || !bound.email) continue;
+    await bindKiroAccountUserEmail(account.id, { profileArn: storedArn, refresh, email: bound.email });
   }
 }
 
@@ -535,12 +549,14 @@ async function kiroTokenRefreshError(response: Response, awsSsoRefresh = false):
   let oauthError: string | undefined;
   let refreshAttention = false;
   try {
-    const payload = await response.json() as { error?: unknown };
+    const payload = await response.json() as { error?: unknown; message?: unknown };
     // This input-error code is attention evidence only for our AWS SSO refresh request,
     // never a terminal grant verdict. Do not surface arbitrary upstream descriptions.
     refreshAttention = awsSsoRefresh && response.status === 400 && payload.error === "invalid_request";
     if (typeof payload.error === "string" && KIRO_TERMINAL_REFRESH_ERRORS.has(payload.error)) {
       oauthError = payload.error;
+    } else if (!awsSsoRefresh && response.status === 401 && payload.message === "Bad credentials") {
+      oauthError = KIRO_DESKTOP_BAD_CREDENTIALS;
     }
   } catch {
     // Error bodies are untrusted and intentionally excluded from the surfaced message.
@@ -659,10 +675,40 @@ function metadataForRotatedKiroCliCredential(
   };
 }
 
+/**
+ * Users of one organization share its profile ARN (#6641). A row that names its user adopts the
+ * local CLI session only when same-session whoami reports that user and the CLI still holds the
+ * matched session. A row without a user keeps the profile match only while no other stored Kiro
+ * row shares the profile. Cancellation propagates as cancellation, never as the refresh refusal.
+ */
+async function localKiroCliSessionBelongsToUser(
+  credential: OAuthCredentials,
+  local: ImportedKiroCredential,
+  runner: KiroCliRunner,
+  signal?: AbortSignal,
+): Promise<boolean> {
+  const email = kiroUserEmail(credential);
+  if (!email) {
+    return !(getAccountSet("kiro")?.accounts ?? []).some(account =>
+      account.credential.refresh !== credential.refresh && account.credential.accountId === local.profileArn);
+  }
+  const identity = await readKiroCliIdentity(runner, signal);
+  signal?.throwIfAborted();
+  if (identity.email !== email) return false;
+  let current: ImportedKiroCredential | null;
+  try {
+    current = readKiroCliSqliteCredential();
+  } catch {
+    return false;
+  }
+  return current !== null && (current.refresh || current.access) === (local.refresh || local.access);
+}
+
 export async function refreshKiroToken(
   refresh: string,
   signal?: AbortSignal,
   credential?: OAuthCredentials,
+  options: { cliRunner?: KiroCliRunner } = {},
 ): Promise<OAuthCredentials> {
   if (!refresh) throw new Error("Kiro: no refresh token available (re-run `kiro-cli login`).");
   try {
@@ -672,6 +718,9 @@ export async function refreshKiroToken(
     if (!credential) throw error;
     const local = matchingRotatedKiroCliCredential(refresh, credential);
     if (!local) throw error;
+    if (!await localKiroCliSessionBelongsToUser(credential, local, options.cliRunner ?? defaultKiroCliRunner, signal)) {
+      throw error;
+    }
     const retryMetadata = metadataForRotatedKiroCliCredential(credential, local);
     try {
       const fresh = await refreshAwsSsoOidcToken(local.refresh, signal, {

package/src/oauth/plan.ts

@@ -0,0 +1,29 @@
+import type { OAuthCredentials } from "./types";
+
+/** Display-only upstream tier; never infer a plan from normalized quota percentages. */
+export function normalizeOAuthPlan(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const plan = value.trim();
+  return plan.length <= 64 && /^[a-z0-9_.-]+$/.test(plan) ? plan : undefined;
+}
+
+/**
+ * Same account by the strongest identifier both credentials carry, compared kind for kind
+ * (Anthropic UUID, then accountId, then case-insensitive email); undefined when none overlap.
+ */
+function sameAccount(a: OAuthCredentials, b: OAuthCredentials): boolean | undefined {
+  const pairs: Array<[string | undefined, string | undefined]> = [
+    [a.anthropicIdentity?.accountUuid, b.anthropicIdentity?.accountUuid],
+    [a.accountId, b.accountId],
+    [a.email?.toLowerCase(), b.email?.toLowerCase()],
+  ];
+  for (const [left, right] of pairs) if (left !== undefined && right !== undefined) return left === right;
+  return undefined;
+}
+
+/** An observed unknown clears old metadata; an account replacement cannot inherit a plan. */
+export function mergeOAuthPlan(fresh: OAuthCredentials, previous: OAuthCredentials): string | null | undefined {
+  if (fresh.plan !== undefined) return normalizeOAuthPlan(fresh.plan) ?? null;
+  if (sameAccount(fresh, previous) === false) return undefined;
+  return previous.plan === null ? null : normalizeOAuthPlan(previous.plan);
+}

package/src/oauth/store.ts

@@ -19,7 +19,9 @@
  *   distinct one. Kimi extracts JWT `user_id`/`sub` as accountId; Cursor extracts JWT `sub` —
  *   both append distinct identified accounts under multiauth.
  */
+import { normalizeOAuthPlan, mergeOAuthPlan } from "./plan";
 import { normalizeAnthropicIdentity, matchesAnthropicImport, mergeAnthropicIdentity } from "./anthropic-identity";
+import { findKiroAccountForLogin, withRetainedKiroUser } from "./kiro-account-identity";
 import { isAnthropicInstanceId, type AnthropicInstanceId } from "../providers/anthropic-instance-id";
 import { assertNoCrossAnthropicRegistration, assertAnthropicCredentialSource, assertAnthropicInstanceLoginConfig } from "./store-anthropic-instance";
 import { createHash, randomUUID } from "node:crypto";
@@ -537,6 +539,7 @@ function normalizeCredential(cred: unknown): OAuthCredentials | null {
   if (typeof candidate.accountId === "string" && candidate.accountId.length > 0) normalized.accountId = candidate.accountId;
   const identity = normalizeAnthropicIdentity(candidate.anthropicIdentity, candidate.access);
   if (identity) normalized.anthropicIdentity = identity;
+  if (candidate.plan !== undefined) normalized.plan = normalizeOAuthPlan(candidate.plan) ?? null;
   if (isCredentialSource(candidate.source)) normalized.source = candidate.source;
   if (typeof candidate.projectId === "string" && candidate.projectId.length > 0) normalized.projectId = candidate.projectId;
   if (typeof candidate.apiBaseUrl === "string" && candidate.apiBaseUrl.length > 0) {
@@ -905,6 +908,7 @@ export async function saveCredentialWithReceipt(
       const existing = set.accounts.find(a => matchesAnthropicImport(a.credential, safe));
       if (existing) {
         existing.credential = { ...safe, ...mergeAnthropicIdentity(safe, existing.credential),
+          plan: mergeOAuthPlan(safe, existing.credential),
           accountId: safe.accountId ?? existing.credential.accountId, email: safe.email ?? existing.credential.email };
         set.selectionRevision = previousSelectionRevision;
         delete existing.needsReauth;
@@ -918,9 +922,17 @@ export async function saveCredentialWithReceipt(
         accountId = id;
       }
     } else if (identity) {
-      const existing = set.accounts.find(a => (a.credential.accountId ?? a.credential.email) === identity);
+      // Kiro: a shared organization profile ARN is not a user, so its identity also carries the
+      // same-session whoami email (#6641); the helper never guesses between identified users.
+      const existing = provider === "kiro"
+        ? findKiroAccountForLogin(set.accounts, safe)
+        : set.accounts.find(a => (a.credential.accountId ?? a.credential.email) === identity);
       if (existing) {
-        existing.credential = safe;
+        const incoming = provider === "kiro" ? withRetainedKiroUser(safe, existing.credential) : safe;
+        // Same identity: a login whose tier read failed keeps the stored label (plan absent),
+        // while an observed unknown (plan null) still clears it.
+        const plan = mergeOAuthPlan(incoming, existing.credential);
+        existing.credential = plan === undefined ? incoming : { ...incoming, plan };
         delete existing.needsReauth;
         delete existing.needsReauthReason;
         delete existing.refreshAttentionGeneration;
@@ -932,7 +944,13 @@ export async function saveCredentialWithReceipt(
         // active identity-less row in place prevents a stale duplicate that stays selectable
         // and would re-refresh into a second row with the same identity.
         const active = set.accounts.find(a => a.id === set.activeAccountId);
-        if (!opts.preserveIdentityless && active && active.credential.accountId === undefined && active.credential.email === undefined) {
+        // Kiro rows of one organization differ only by user: while another row shares the profile,
+        // an unmatched Kiro login claims an identity-less slot only as the same CLI session (#6641).
+        const legacyUpgrade = active !== undefined && active.credential.accountId === undefined
+          && active.credential.email === undefined
+          && (provider !== "kiro" || (Boolean(safe.refresh) && active.credential.refresh === safe.refresh)
+            || !set.accounts.some(a => safe.accountId !== undefined && a.credential.accountId === safe.accountId));
+        if (!opts.preserveIdentityless && active && legacyUpgrade) {
           active.credential = safe;
           delete active.needsReauth;
           delete active.needsReauthReason;
@@ -1014,6 +1032,25 @@ export async function saveCredential(
   await saveCredentialWithReceipt(provider, cred, opts);
 }
 
+/**
+ * Record the same-session whoami user on a Kiro row saved before whoami named it (#6641).
+ * Applies only while the row still holds the proven session's refresh token and profile ARN
+ * and has no user yet; tokens, routing, plan and health are left exactly as stored.
+ */
+export async function bindKiroAccountUserEmail(
+  accountId: string,
+  proof: { profileArn: string; refresh: string; email: string },
+): Promise<boolean> {
+  return await mutateStore(store => {
+    const account = store.kiro?.accounts.find(candidate => candidate.id === accountId);
+    const credential = account?.credential;
+    if (!credential || credential.email !== undefined) return false;
+    if (credential.accountId !== proof.profileArn || credential.refresh !== proof.refresh) return false;
+    credential.email = proof.email;
+    return true;
+  }, [accountId, proof]);
+}
+
 /** Native device approval always gets a new slot; no unverified identity can replace one. */
 export async function appendKiroAccountFromDeviceLogin(
   cred: OAuthCredentials,

package/src/oauth/types.ts

@@ -62,6 +62,8 @@ export type OAuthCredentials = {
   email?: string;
   accountId?: string;
   source?: OAuthCredentialSource;
+  /** Validated upstream subscription label; null is an observed unknown, absent is not read. */
+  plan?: string | null;
   /** Private authenticated account proof; never projected into account summaries. */
   anthropicIdentity?: { v: 1; accountUuid: string; bearerSha256: string };
   /** Google Antigravity (Cloud Code Assist) discovered project id; injected into the CCA envelope. */

package/src/plugins/loader.ts

@@ -121,8 +121,19 @@ export function macAclProbeTrustError(probe: () => MacAclProbeResult): string |
   }
 }
 
+let pluginAclInspectorForTests: ((path: string) => string | null) | undefined;
+
+/**
+ * Shipped mutable seam, test-only by intent: no config or env path reaches it.
+ * Passing undefined restores the real ACL inspector.
+ */
+export function setPluginAclInspectorForTests(inspector?: (path: string) => string | null): void {
+  pluginAclInspectorForTests = inspector;
+}
+
 /** Refuse extended ACLs: mode bits alone cannot prove who can rewrite a plugin path. */
 function aclTrustError(path: string): string | null {
+  if (pluginAclInspectorForTests) return pluginAclInspectorForTests(path);
   if (process.platform !== "darwin" && process.platform !== "linux") return null;
   const mac = process.platform === "darwin";
   // CI and operator PATHs may put GNU coreutils ahead of the macOS tool.