@bridge4dev/runner 0.65.1 → 0.66.0

package/dist/claude-homes.js

@@ -0,0 +1,1567 @@
+import { execFile } from 'node:child_process';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { sessionClaudePath } from './agent-binary.js';
+import { readAgentAuth, storedClaudeToken, storedClaudeTokenRefused, updateAgentAuth, } from './agent-auth.js';
+import { invalidateUsageCache, lastUsageRows, } from './adapters/claude-usage.js';
+import { MACHINE_ACCOUNT_ID, clearRefusal, refusalActive } from './login-marks.js';
+import { log } from './log.js';
+import { stateDir } from './paths.js';
+import { lowerPriority } from './process-priority.js';
+/**
+ * Several Claude logins on one machine – one HOME per account (#422, D1).
+ *
+ * An account is a small directory of its own: its login (`.credentials.json`)
+ * and the CLI's working files (`.claude.json` – where the last measured limits
+ * live – `sessions/`, `backups/`). Everything else is a link into the machine's
+ * `~/.claude`: the transcripts (without them no conversation resumes across
+ * accounts), settings, plugins, agents, commands, hooks, skills. Switching is
+ * choosing which home the NEXT session starts with – `CLAUDE_CONFIG_DIR` in the
+ * session's own environment, never in the daemon's (risk К1 of the plan).
+ *
+ * The login of this machine is the default home, `~/.claude`. It is the first
+ * row, it cannot be forgotten, and while it is active nothing here sets any
+ * variable – the behaviour is exactly the pre-#422 one. No code in this module
+ * writes, moves or deletes the machine's own login file: the one legitimate way
+ * to touch it stays the person's «Log in again» on that row, which is the old
+ * sign-in path in `auth-relay.ts`, not this file.
+ *
+ * NOT ONE COPY of a login file, by construction rather than by agreement. The
+ * CLI's token-refresh lock is taken by the PATH of the file, so a copy in a
+ * second home is a second holder of a one-time refresh token – the copy that
+ * signed out 47 agents and four sessions on 08.09.2026 (gotcha 460). Every
+ * login here exists in exactly one place; a login is only ever moved into its
+ * home by `rename`, and a `rename` that would have to cross filesystems is
+ * refused instead of falling back to a copy.
+ *
+ * Proven live on this machine before a line of it was written (S1 item 1,
+ * 17.09.2026, CLI 2.1.273, SDK 0.3.226): a session started through the Agent
+ * SDK with `CLAUDE_CONFIG_DIR` in `env` ran under that home's subscription, its
+ * transcript landed in the machine's `projects/` through the link, and the
+ * same session resumed under the machine login – a different subscription –
+ * and back again, with its context.
+ */
+/** Where the saved homes live – next to the runner's other private state. */
+export function claudeHomesDir() {
+    return path.join(stateDir(), 'claude-homes');
+}
+/**
+ * The machine's own Claude home. `os.homedir()` rather than anything cleverer:
+ * it is what the CLI itself uses when no `CLAUDE_CONFIG_DIR` is set, which is
+ * exactly the definition of «the machine login».
+ */
+export function machineHome(homedir = os.homedir()) {
+    return path.join(homedir, '.claude');
+}
+/**
+ * The CLI keeps its global config NEXT TO its home, not inside it, when the home
+ * is the default one: `$HOME/.claude.json`, and `~/.claude/.claude.json` is a
+ * 309-byte stub on this machine (R19). Under `CLAUDE_CONFIG_DIR` it is inside.
+ */
+function configFileOf(home, homedir = os.homedir()) {
+    return home === null ? path.join(homedir, '.claude.json') : path.join(home, '.claude.json');
+}
+function credentialsFileOf(home, homedir = os.homedir()) {
+    return path.join(home ?? machineHome(homedir), '.credentials.json');
+}
+const ACCOUNT_ID = /^[a-z0-9]{12}$/;
+/** A saved account's id: twelve lowercase letters and digits, never `machine`. */
+export function isAccountId(id) {
+    return typeof id === 'string' && ACCOUNT_ID.test(id);
+}
+function newAccountId() {
+    // base32-ish from random bytes: 12 characters of [a-z0-9].
+    const alphabet = 'abcdefghijklmnopqrstuvwxyz0123456789';
+    const bytes = crypto.randomBytes(12);
+    return Array.from(bytes, (byte) => alphabet[byte % alphabet.length]).join('');
+}
+/** The home of a saved account. Throws on anything that is not an account id. */
+export function accountHome(id) {
+    if (!isAccountId(id))
+        throw new AccountError(`not an account id: ${String(id).slice(0, 40)}`);
+    return path.join(claudeHomesDir(), id);
+}
+/** A refusal meant for a person: the wire (S2) sends its message as it is. */
+export class AccountError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'AccountError';
+    }
+}
+function lstatOrNull(target) {
+    try {
+        return fs.lstatSync(target);
+    }
+    catch {
+        return null;
+    }
+}
+function realpathOrResolve(target) {
+    try {
+        return fs.realpathSync(target);
+    }
+    catch {
+        return path.resolve(target);
+    }
+}
+function sameDirectory(a, b) {
+    return realpathOrResolve(a) === realpathOrResolve(b);
+}
+/** Is `target` the directory `parent` or anything inside it, links resolved? */
+function isWithin(target, parent) {
+    const resolved = realpathOrResolve(target);
+    const base = realpathOrResolve(parent);
+    return resolved === base || resolved.startsWith(base + path.sep);
+}
+function ensureRoot() {
+    const root = claudeHomesDir();
+    fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+    // It holds logins; an existing directory keeps whatever mode it was made with.
+    fs.chmodSync(root, 0o700);
+    return root;
+}
+// ─── What every home shares with the machine ─────────────────────────
+/**
+ * What a saved home reaches through a link rather than owning (R20).
+ *
+ * `projects` is the one that must never be missing: it is where transcripts
+ * live, and a session resumes only from the home it can see them in. The rest
+ * is parity with the terminal – the machine's settings (hooks, the search
+ * guard, enabled plugins), its plugins, agents, commands, hooks and skills.
+ * Deliberately NOT here: `.credentials.json` and `.claude.json` (they are the
+ * account), and the CLI's per-process scratch (`sessions`, `session-env`,
+ * `shell-snapshots`, `backups`, …), which it recreates on its own.
+ */
+export const SHARED_ENTRIES = [
+    'projects',
+    'settings.json',
+    'settings.local.json',
+    'CLAUDE.md',
+    'plugins',
+    'agents',
+    'commands',
+    'hooks',
+    'skills',
+];
+/**
+ * Create and repair the links of a saved home into the machine's `~/.claude`.
+ *
+ * A link is set only where its target exists; `projects` is the exception and
+ * gets its target created, because a home without it would quietly start a
+ * transcript directory of its own and every later resume across accounts would
+ * fail to find the conversation.
+ *
+ * A link the CLI replaced with a real file or directory (an atomic write of
+ * `settings.json` does exactly that) is NOT silently re-linked: the thing in
+ * its place may be the only copy of what was written through it. It is moved
+ * aside under a dated name and logged, and the link is put back.
+ *
+ * Never follows a link to remove anything, never writes into the machine home
+ * beyond creating its empty `projects/`.
+ */
+export function ensureSharedLinks(home, machine = machineHome()) {
+    // A real directory, and not the machine home by any spelling: a home that is
+    // itself a link resolves `<home>/projects` INTO the machine home, and the
+    // repair below would move the machine's own entries aside.
+    if (!lstatOrNull(home)?.isDirectory() || sameDirectory(home, machine)) {
+        throw new AccountError('the machine home has no links of its own');
+    }
+    const changes = [];
+    for (const name of SHARED_ENTRIES) {
+        const link = path.join(home, name);
+        const target = path.join(machine, name);
+        if (name === 'projects' && !fs.existsSync(target)) {
+            fs.mkdirSync(target, { recursive: true });
+        }
+        const current = lstatOrNull(link);
+        const targetExists = fs.existsSync(target);
+        if (current?.isSymbolicLink()) {
+            const pointsAt = fs.readlinkSync(link);
+            if (pointsAt === target) {
+                if (!targetExists) {
+                    // Ours, and pointing at nothing: the target went away. A dangling link
+                    // is not «the file is missing» to every writer – some open through it
+                    // and would create the target inside the machine home.
+                    fs.unlinkSync(link);
+                    changes.push({ name, action: 'dropped' });
+                }
+                continue;
+            }
+            if (!targetExists)
+                continue;
+            fs.unlinkSync(link);
+            fs.symlinkSync(target, link);
+            changes.push({ name, action: 'relinked' });
+            continue;
+        }
+        if (!targetExists)
+            continue;
+        if (current) {
+            const aside = `${link}.displaced-${Date.now()}`;
+            fs.renameSync(link, aside);
+            log.warn('claude-homes: a shared entry had been replaced by a real one – moved aside', {
+                home,
+                name,
+                aside,
+            });
+            fs.symlinkSync(target, link);
+            changes.push({ name, action: 'displaced', displacedTo: aside });
+            continue;
+        }
+        fs.symlinkSync(target, link);
+        changes.push({ name, action: 'linked' });
+    }
+    return changes;
+}
+/**
+ * Keys of the machine's `$HOME/.claude.json` a new home is seeded with (R20).
+ *
+ * Under `CLAUDE_CONFIG_DIR` the CLI reads a different `.claude.json` altogether,
+ * and that is where the person's own MCP servers and folder trust live – a home
+ * without them is a session without `playwright`. Also carried: onboarding
+ * (a fresh file asks first-run questions), the install method and the
+ * auto-update switch (a home without `autoUpdates: false` may let the CLI update
+ * the machine's binary behind the version the card pins), and the marketplace
+ * flags (without them a new home re-installs plugins into the SHARED plugins
+ * directory).
+ *
+ * Never seeded, and the tests pin it: `oauthAccount` and
+ * `cachedUsageUtilization` – they say whose login and whose limits the file
+ * describes, and a new home is somebody else until its own login says so.
+ */
+const SEED_KEYS = [
+    'mcpServers',
+    'projects',
+    'hasCompletedOnboarding',
+    'lastOnboardingVersion',
+    'installMethod',
+    'autoUpdates',
+    'autoUpdatesProtectedForNative',
+    'officialMarketplaceAutoInstallAttempted',
+    'officialMarketplaceAutoInstalled',
+    'bypassPermissionsModeAccepted',
+];
+/** Per project, only what configures it – not the last session's metrics. */
+const PROJECT_SEED_KEYS = [
+    'allowedTools',
+    'mcpServers',
+    'enabledMcpjsonServers',
+    'disabledMcpjsonServers',
+    'mcpContextUris',
+    'hasTrustDialogAccepted',
+    'hasClaudeMdExternalIncludesApproved',
+    'hasClaudeMdExternalIncludesWarningShown',
+];
+const isObject = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+function readJsonObject(file) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+        return isObject(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function machineSeeds(machineConfig) {
+    const source = readJsonObject(machineConfig);
+    if (!source)
+        return {};
+    const seeds = {};
+    for (const key of SEED_KEYS) {
+        if (!(key in source))
+            continue;
+        if (key === 'projects' && isObject(source[key])) {
+            const projects = {};
+            for (const [dir, entry] of Object.entries(source[key])) {
+                if (!isObject(entry))
+                    continue;
+                const kept = Object.fromEntries(PROJECT_SEED_KEYS.filter((sub) => sub in entry).map((sub) => [sub, entry[sub]]));
+                if (Object.keys(kept).length > 0)
+                    projects[dir] = kept;
+            }
+            seeds[key] = projects;
+            continue;
+        }
+        seeds[key] = source[key];
+    }
+    return seeds;
+}
+function writeJsonAtomic(file, body) {
+    const tmp = `${file}.devbridge-${process.pid}.tmp`;
+    fs.writeFileSync(tmp, `${JSON.stringify(body, null, 2)}\n`, { mode: 0o600 });
+    fs.renameSync(tmp, file);
+    fs.chmodSync(file, 0o600);
+}
+/**
+ * Seed a home's `.claude.json` with the machine's configuration (R20).
+ *
+ * A home without the file gets one. A home WITH one (a login moved in from
+ * elsewhere) gets only the keys it does not have yet, project by project – its
+ * own identity and anything it configured for itself stay as they are.
+ *
+ * Only for a home no CLI is running in: the CLI rewrites this file on its own
+ * schedule, and a write racing it would lose one side. That is why it runs when
+ * a home is created or moved in, and not at every session start.
+ */
+export function ensureHomeConfig(home, machineConfig = configFileOf(null)) {
+    const target = configFileOf(home);
+    const seeds = machineSeeds(machineConfig);
+    if (!fs.existsSync(target)) {
+        writeJsonAtomic(target, seeds);
+        return 'created';
+    }
+    const existing = readJsonObject(target);
+    if (!existing) {
+        // The CLI's own file, unreadable to us – not ours to replace.
+        log.warn('claude-homes: the home config could not be read – left as it is', { home });
+        return 'unchanged';
+    }
+    let changed = false;
+    for (const [key, value] of Object.entries(seeds)) {
+        if (key === 'projects' && isObject(value)) {
+            const projects = isObject(existing[key]) ? { ...existing[key] } : {};
+            for (const [dir, entry] of Object.entries(value)) {
+                if (!isObject(entry))
+                    continue;
+                const own = isObject(projects[dir]) ? projects[dir] : {};
+                const merged = { ...entry, ...own };
+                if (JSON.stringify(merged) !== JSON.stringify(projects[dir])) {
+                    projects[dir] = merged;
+                    changed = true;
+                }
+            }
+            existing[key] = projects;
+            continue;
+        }
+        if (!(key in existing)) {
+            existing[key] = value;
+            changed = true;
+        }
+    }
+    if (!changed)
+        return 'unchanged';
+    writeJsonAtomic(target, existing);
+    return 'merged';
+}
+const IDENTITY_TIMEOUT_MS = 30_000;
+/**
+ * How long a known identity is believed without asking again.
+ *
+ * A new sign-in in a home is caught without waiting for this (see
+ * `identityFreshness`); the bound only covers a plan changed on the provider's
+ * side with nothing on this machine touched.
+ */
+const IDENTITY_MAX_AGE_MS = 6 * 60 * 60 * 1000;
+/**
+ * The environment `claude auth status` runs with (R14) – and, since S2, every
+ * CLI run that works in a home as that home's own account: the sign-in through
+ * `agent_account_login_start` uses it too (§8), for the reason below.
+ *
+ * `CLAUDE_CONFIG_DIR` of the home, or none for the machine, and never the
+ * operator's `CLAUDE_CODE_OAUTH_TOKEN`: the CLI puts that variable above every
+ * login file, so on a machine that has one every home would answer with the
+ * token's blind identity – no e-mail, no plan, the same for all of them.
+ */
+export function identityProbeEnv(home, base = process.env) {
+    const env = { ...base };
+    delete env['CLAUDE_CONFIG_DIR'];
+    delete env['CLAUDE_CODE_OAUTH_TOKEN'];
+    delete env['ANTHROPIC_API_KEY'];
+    delete env['ANTHROPIC_AUTH_TOKEN'];
+    if (home !== null)
+        env['CLAUDE_CONFIG_DIR'] = home;
+    return env;
+}
+const text = (value, max) => typeof value === 'string' && value.trim().length > 0 ? value.trim().slice(0, max) : undefined;
+/** `claude auth status --json` → identity. `loggedIn: false` is no identity at all. */
+export function parseAuthStatus(output) {
+    let parsed;
+    try {
+        parsed = JSON.parse(output);
+    }
+    catch {
+        return null;
+    }
+    if (!isObject(parsed) || parsed['loggedIn'] !== true)
+        return null;
+    const email = text(parsed['email'], 320);
+    const orgId = text(parsed['orgId'], 100);
+    const orgName = text(parsed['orgName'], 200);
+    const plan = text(parsed['subscriptionType'], 60);
+    return {
+        ...(email ? { email } : {}),
+        ...(orgId ? { orgId } : {}),
+        ...(orgName ? { orgName } : {}),
+        ...(plan ? { plan } : {}),
+    };
+}
+const defaultIdentityRunner = (home) => {
+    const binary = sessionClaudePath();
+    if (!binary)
+        return Promise.resolve(null);
+    let cwd;
+    try {
+        // A directory only this runner can write to: for Claude Code the working
+        // directory is the root of a project's settings, hooks included (QA-390
+        // BLOCKER – the same reason the usage probe has one).
+        cwd = ensureRoot();
+    }
+    catch {
+        return Promise.resolve(null);
+    }
+    return new Promise((resolve) => {
+        const child = execFile(binary, ['auth', 'status', '--json'], {
+            cwd,
+            env: identityProbeEnv(home),
+            timeout: IDENTITY_TIMEOUT_MS,
+            maxBuffer: 256 * 1024,
+            killSignal: 'SIGKILL',
+        }, (error, stdout) => {
+            if (error) {
+                log.warn('claude-homes: `claude auth status` gave no identity', {
+                    home: home ?? 'machine',
+                    error: String(error).slice(0, 300),
+                });
+                resolve(null);
+                return;
+            }
+            resolve(parseAuthStatus(stdout));
+        });
+        child.stdin?.end();
+        lowerPriority(child.pid);
+    });
+};
+let identityRunner = defaultIdentityRunner;
+export function setIdentityRunner(run) {
+    identityRunner = run ?? defaultIdentityRunner;
+}
+/**
+ * One `claude auth status` at a time, machine-wide – «sequentially, home by
+ * home» (R14). Each is ~800 ms and ~300 MB; five homes in parallel would be a
+ * gigabyte and a half for a list.
+ */
+let identityQueue = Promise.resolve();
+/** Asks already queued or running, per home – two callers of one home share one CLI run. */
+const identityInFlight = new Map();
+/** Ask a home who it is. Only the four callers R14 names reach this. */
+export function readAccountIdentity(home) {
+    const key = home ?? MACHINE_ACCOUNT_ID;
+    const running = identityInFlight.get(key);
+    if (running)
+        return running;
+    const run = identityQueue
+        .then(() => identityRunner(home))
+        .catch(() => null)
+        .finally(() => {
+        identityInFlight.delete(key);
+    });
+    identityInFlight.set(key, run);
+    identityQueue = run;
+    return run;
+}
+/**
+ * Homes whose last ask came back empty, and what their login file looked like
+ * then. A machine that runs on the operator's token alone has no identity to
+ * give, and without this every session start there would spawn the CLI again
+ * (~800 ms, ~300 MB) and log the same line. Asked again once the login file
+ * changes or the back-off has passed.
+ */
+const identityMisses = new Map();
+const IDENTITY_RETRY_MS = 30 * 60 * 1000;
+/** Forget remembered misses – tests. */
+export function resetIdentityMisses() {
+    identityMisses.clear();
+}
+function recordOf(id) {
+    return readAgentAuth().claudeAccounts?.find((record) => record.id === id);
+}
+function storedIdentity(id) {
+    if (id === MACHINE_ACCOUNT_ID)
+        return readAgentAuth().claudeMachine?.lastSeenIdentity;
+    return recordOf(id)?.lastSeenIdentity;
+}
+/**
+ * When a file was last written, in WHOLE milliseconds – comparable with the ISO
+ * stamps this module writes, which have no fraction. A raw `mtimeMs` of
+ * `…123.4` against a stamp of `…123` read a file written before the stamp as
+ * written after it.
+ */
+function mtimeMsOrNull(file) {
+    try {
+        return Math.floor(fs.statSync(file).mtimeMs);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Is a known identity still the home's identity?
+ *
+ * `contradicted` – the home's own `.claude.json` names a different organization
+ * than the identity does: somebody signed in again (the dashboard's «Log in
+ * again», or `claude auth login` by hand in the terminal). Nothing that identity
+ * says may be used any more – a usage key or a session card built from it would
+ * put one subscription's name over another's numbers (#380).
+ *
+ * `current` – the file agrees, or (file unreadable) the login has not been
+ * written since the identity was read. The file is a HINT here, never the
+ * identity itself (К12): it only decides whether to ask the public command again.
+ */
+function identityFreshness(identity, home) {
+    if (!identity)
+        return 'stale';
+    const organization = readOauthAccount(home).organizationUuid;
+    if (organization && identity.orgId && organization !== identity.orgId)
+        return 'contradicted';
+    const at = Date.parse(identity.at);
+    if (!Number.isFinite(at) || Date.now() - at > IDENTITY_MAX_AGE_MS)
+        return 'stale';
+    if (organization && identity.orgId)
+        return 'current';
+    const loginWritten = mtimeMsOrNull(credentialsFileOf(home));
+    return loginWritten === null || loginWritten <= at ? 'current' : 'stale';
+}
+function homeOfRow(id) {
+    return id === MACHINE_ACCOUNT_ID ? null : accountHome(id);
+}
+/** Persist an identity against a row. A row that has gone meanwhile is left gone. */
+function saveIdentity(id, identity) {
+    const stamped = { ...identity, at: new Date().toISOString() };
+    updateAgentAuth((file) => {
+        if (id === MACHINE_ACCOUNT_ID) {
+            file.claudeMachine = { ...file.claudeMachine, lastSeenIdentity: stamped };
+            return;
+        }
+        const record = file.claudeAccounts?.find((entry) => entry.id === id);
+        if (record)
+            record.lastSeenIdentity = stamped;
+    });
+    return stamped;
+}
+/**
+ * Who a row is, from the cache or – when that is unknown, old, or contradicted by
+ * the home – from `claude auth status` in its home, persisted (R14).
+ *
+ * A probe that answers nothing keeps what was known: a CLI that timed out once
+ * must not turn a named account into «card not filled». And it is remembered for
+ * a while, so a home with no identity to give is not asked at every session start.
+ */
+export async function refreshAccountIdentity(id, options = {}) {
+    const home = homeOfRow(id);
+    if (home !== null && !fs.existsSync(home))
+        return null;
+    const known = storedIdentity(id);
+    if (!options.force && identityFreshness(known, home) === 'current')
+        return known ?? null;
+    const key = home ?? MACHINE_ACCOUNT_ID;
+    const loginWritten = mtimeMsOrNull(credentialsFileOf(home));
+    const miss = identityMisses.get(key);
+    if (!options.force &&
+        miss &&
+        miss.loginWritten === loginWritten &&
+        Date.now() - miss.atMs < IDENTITY_RETRY_MS) {
+        return known ?? null;
+    }
+    const identity = await readAccountIdentity(home);
+    if (!identity) {
+        identityMisses.set(key, { atMs: Date.now(), loginWritten });
+        return known ?? null;
+    }
+    identityMisses.delete(key);
+    return saveIdentity(id, identity);
+}
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+/**
+ * A millisecond timestamp we are willing to hand to `new Date(...)`.
+ *
+ * The bound is not decoration: `new Date(1e21).toISOString()` throws
+ * `RangeError`, and thrown out of here it takes BOTH agents' verdicts down
+ * with it (they share one `Promise.all`) on every poll, forever, because only
+ * successes are cached (QA-117 M1).
+ */
+const MAX_TIMESTAMP_MS = 8.64e15;
+function asTimestamp(value) {
+    if (typeof value !== 'number' || !Number.isFinite(value))
+        return undefined;
+    return Math.abs(value) <= MAX_TIMESTAMP_MS ? value : undefined;
+}
+/**
+ * Judge a Claude credentials file – moved here unchanged from `claudeAuthStatus`
+ * so a saved home and the machine are judged by the same lines (#422 R14).
+ *
+ * `expiresAt` is NOT the login. It is the expiry of a short-lived access token
+ * (~8 hours on a live file), and next to it sits `refreshToken` with
+ * `refreshTokenExpiresAt` ~26 days out, which the CLI spends silently on its
+ * next run. Judging the login by `expiresAt` alone is why every server nobody
+ * had touched since the morning reported "login expired — re-login needed"
+ * over a login that was good for another three weeks (#121). Codex has carried
+ * exactly this guard since day one (`readCodexCredential`); Claude did not.
+ *
+ * Deliberately NOT asking the CLI. `claude auth status --json` looks like an
+ * arbiter and is not one: measured live (SDK binary 2.1.218), it answers
+ * `loggedIn: true` for a credential whose access token has expired AND which
+ * carries no refresh token at all — i.e. for a genuinely dead login. It never
+ * leaves the machine, so it cannot see a server-side revocation either. It
+ * would have cost a ~800 ms / ~300 MB subprocess per poll under `MemoryMax=2G`
+ * (gotcha #100) and echoed the account's e-mail and org name to every member of
+ * the organization, in exchange for no truth at all. A revoked login is caught
+ * instead by the refusal marks — from a real refusal, not a guess.
+ */
+export function judgeCredentialFile(file) {
+    let raw;
+    try {
+        raw = fs.readFileSync(file, 'utf8');
+    }
+    catch (error) {
+        const code = error.code;
+        // Never signed in here is a different answer from "we could not look".
+        // EACCES on somebody else's HOME used to read as "not signed in", which
+        // sends the user re-authenticating a credential that is sitting right
+        // there (the same mistake #121 is about, one layer down).
+        if (code === 'ENOENT' || code === 'ENOTDIR') {
+            return {
+                status: 'missing',
+                detail: 'No Claude login on this server',
+                fallbackEligible: true,
+            };
+        }
+        // No `log.warn` here: this probe is on a 60-second timer since #121, and a
+        // machine with EACCES on that file would write the same line forever.
+        // `logVerdictChange` already reports the `unknown`, once, when it starts
+        // (QA-117 L5).
+        return {
+            status: 'unknown',
+            detail: `could not read the login on this server (${code ?? 'unknown error'})`,
+            fallbackEligible: false,
+        };
+    }
+    let oauth;
+    try {
+        oauth = JSON.parse(raw).claudeAiOauth;
+    }
+    catch {
+        // Truncated or hand-edited file: the CLI cannot use it either, and signing
+        // in again is the fix — so say `missing` (which offers that button) rather
+        // than `unknown` (which offers nothing).
+        return {
+            status: 'missing',
+            detail: 'the stored login could not be read — sign in again',
+            fallbackEligible: false,
+        };
+    }
+    // A parseable file is not a credential. `{"claudeAiOauth":{}}` is what a
+    // partial write and a hand-edit both leave behind, and reading it as a
+    // healthy login puts a green dot and NO way out on the panel — «I cannot
+    // tell» turned into «all good», which is the rule this ticket exists to
+    // uphold, upside down (QA-117 M2).
+    if (!oauth || typeof oauth !== 'object' || Array.isArray(oauth)) {
+        return {
+            status: 'missing',
+            detail: 'the stored login could not be read — sign in again',
+            fallbackEligible: false,
+        };
+    }
+    const hasAccess = isNonEmptyString(oauth.accessToken);
+    const hasRefresh = isNonEmptyString(oauth.refreshToken);
+    const now = Date.now();
+    const accessExpiry = asTimestamp(oauth.expiresAt);
+    const refreshExpiry = asTimestamp(oauth.refreshTokenExpiresAt);
+    // Nothing recognisable in the blob at all — no token, not even a date. That
+    // is «never signed in here», and it must offer the button that fixes it.
+    if (!hasAccess && !hasRefresh && accessExpiry === undefined) {
+        return { status: 'missing', detail: 'No subscription login found', fallbackEligible: true };
+    }
+    // A date we can read outranks the token beside it (the pre-#121 contract, and
+    // the reason a dated-but-token-less fixture still reads as expired); with no
+    // readable date, the presence of the token is all we have.
+    const accessLive = accessExpiry === undefined ? hasAccess : accessExpiry > now;
+    // No `refreshTokenExpiresAt` next to a refresh token means the CLI did not
+    // record one — that is not evidence of death, so we do not read it as death.
+    const refreshLive = hasRefresh && (refreshExpiry === undefined || refreshExpiry > now);
+    // Report the date this login actually dies on, not the one that moves every
+    // eight hours: a panel reading "token until <today>" is alarming and wrong.
+    // Only while the refresh token is the operative one, though — a live access
+    // token beside a dead refresh token dies on its OWN date. And when the CLI
+    // recorded no date for a live refresh token we say NOTHING: printing the
+    // access token's lapsed date beside the word «signed in» is the very screen
+    // this function's docblock promises not to draw (QA-117 M3).
+    const effectiveExpiry = refreshLive ? refreshExpiry : accessExpiry;
+    const expiresAt = effectiveExpiry === undefined ? undefined : new Date(effectiveExpiry).toISOString();
+    if (!accessLive && !refreshLive) {
+        return {
+            status: 'expired',
+            ...(expiresAt ? { expiresAt } : {}),
+            detail: 'the stored login has expired',
+            fallbackEligible: true,
+        };
+    }
+    return {
+        status: 'ok',
+        ...(expiresAt ? { expiresAt } : {}),
+        // Only a plain string, and only a short one: this value is read off disk
+        // and printed in every member's panel.
+        ...(isNonEmptyString(oauth.subscriptionType)
+            ? { detail: `subscription ${oauth.subscriptionType.slice(0, 40)}` }
+            : {}),
+        fallbackEligible: false,
+    };
+}
+const withoutEligibility = ({ fallbackEligible: _, ...rest }) => rest;
+/** Does a refusal mark on disk still stand against a login written at `writtenMs`? */
+function markHolds(markedAt, writtenMs) {
+    if (!markedAt)
+        return false;
+    const marked = Date.parse(markedAt);
+    if (!Number.isFinite(marked))
+        return false;
+    // A login written AFTER the refusal – the CLI refreshed it, somebody signed in
+    // again – is newer evidence than the refusal was.
+    return writtenMs === null || writtenMs <= marked;
+}
+/**
+ * The machine row: the pre-#422 verdict, word for word.
+ *
+ * The operator's variable first, then the credentials file, then a token this
+ * runner captured – the LAST word, never the first. Read from disk rather than
+ * from the environment, so `doctor` (a different process, which never applied
+ * it) gives the same verdict as the daemon.
+ *
+ * One change, from S1 item 3: a refusal no longer DISCARDS the captured token
+ * (the old discard erased the whole file, and with it every saved account). The
+ * refusal is kept as a mark instead, and a token captured after it outranks it.
+ */
+export function machineLoginStatus(homedir = os.homedir()) {
+    const envToken = process.env['CLAUDE_CODE_OAUTH_TOKEN'];
+    const stored = storedClaudeToken();
+    const refused = stored !== null && storedClaudeTokenRefused();
+    // The variable is the operator's unless it is the very token this runner put
+    // there itself – and that one does not answer for the machine once refused.
+    if (envToken && !(refused && envToken === stored)) {
+        return { status: 'ok', detail: 'CLAUDE_CODE_OAUTH_TOKEN is configured' };
+    }
+    const verdict = judgeCredentialFile(credentialsFileOf(null, homedir));
+    if (verdict.fallbackEligible && stored) {
+        if (refused) {
+            return {
+                status: 'expired',
+                detail: 'the agent was refused with the token stored on this server — sign in again',
+            };
+        }
+        return { status: 'ok', detail: 'signed in with a long-lived token stored on this server' };
+    }
+    return withoutEligibility(verdict);
+}
+/** Settings keys that give the CLI a credential of its own, above any login file. */
+const AUTH_ENV_KEYS = ['CLAUDE_CODE_OAUTH_TOKEN', 'ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN'];
+/**
+ * Do the machine's Claude settings – which every saved home reads through its
+ * link – carry a credential that outranks a home's own login?
+ *
+ * `withAccountHome` takes the operator's token out of the PROCESS environment,
+ * but a settings file with `env: { CLAUDE_CODE_OAUTH_TOKEN }`, an API key or an
+ * `apiKeyHelper` puts one back inside the CLI, and a switch of account would
+ * then be a silent no-op under a green verdict – #121 once more (К14, found by
+ * the independent check of S1).
+ */
+export function machineSettingsOverrideLogin(machine = machineHome()) {
+    for (const name of ['settings.json', 'settings.local.json']) {
+        const settings = readJsonObject(path.join(machine, name));
+        if (!settings)
+            continue;
+        if (typeof settings['apiKeyHelper'] === 'string' && settings['apiKeyHelper'].trim())
+            return true;
+        const env = settings['env'];
+        if (isObject(env) && AUTH_ENV_KEYS.some((key) => typeof env[key] === 'string' && env[key])) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * A saved row: its own file and nothing else (R14).
+ *
+ * No operator variable and no captured token – a session under a saved account
+ * has both taken out of its environment, so neither can make this row green.
+ * Anything short of a live login in the file is `expired`: the row stays in the
+ * list with that mark (D2), and «missing» would read as «never added».
+ */
+export function savedLoginStatus(id) {
+    const home = accountHome(id);
+    const file = credentialsFileOf(home);
+    const verdict = judgeCredentialFile(file);
+    if (verdict.status === 'unknown')
+        return withoutEligibility(verdict);
+    if (machineSettingsOverrideLogin()) {
+        return {
+            status: 'unknown',
+            detail: 'the Claude settings of this server set a token or API key that overrides this account – remove it from ~/.claude/settings.json to use saved accounts',
+        };
+    }
+    if (verdict.status !== 'ok') {
+        return {
+            status: 'expired',
+            ...(verdict.expiresAt ? { expiresAt: verdict.expiresAt } : {}),
+            detail: verdict.status === 'missing'
+                ? 'this account has no usable login on this server – sign in again'
+                : 'the stored login of this account has expired',
+        };
+    }
+    if (markHolds(recordOf(id)?.loginExpiredAt, mtimeMsOrNull(file))) {
+        return {
+            status: 'expired',
+            ...(verdict.expiresAt ? { expiresAt: verdict.expiresAt } : {}),
+            detail: 'the agent was refused with this account – sign in again',
+        };
+    }
+    return withoutEligibility(verdict);
+}
+/**
+ * A session under this account was refused (D2): mark the row, remove nothing.
+ *
+ * By the id of the account the SESSION ran under, not «whatever is active now»
+ * (R14): a session started under A and refused after the machine was switched to
+ * B says nothing about B.
+ */
+export function markLoginExpired(id) {
+    const at = new Date().toISOString();
+    try {
+        updateAgentAuth((file) => {
+            if (id === MACHINE_ACCOUNT_ID) {
+                file.claudeMachine = { ...file.claudeMachine, loginExpiredAt: at };
+                return;
+            }
+            const record = file.claudeAccounts?.find((entry) => entry.id === id);
+            if (record)
+                record.loginExpiredAt = at;
+        });
+    }
+    catch (error) {
+        log.warn('claude-homes: could not record the refusal', { account: id, error: String(error) });
+    }
+}
+/** The account worked again. Writes only when there was a mark to clear. */
+export function clearLoginExpired(id) {
+    const file = readAgentAuth();
+    const marked = id === MACHINE_ACCOUNT_ID
+        ? file.claudeMachine?.loginExpiredAt
+        : file.claudeAccounts?.find((entry) => entry.id === id)?.loginExpiredAt;
+    if (!marked)
+        return;
+    try {
+        updateAgentAuth((next) => {
+            if (id === MACHINE_ACCOUNT_ID) {
+                if (next.claudeMachine)
+                    delete next.claudeMachine.loginExpiredAt;
+                return;
+            }
+            const record = next.claudeAccounts?.find((entry) => entry.id === id);
+            if (record)
+                delete record.loginExpiredAt;
+        });
+    }
+    catch (error) {
+        log.warn('claude-homes: could not clear the refusal', { account: id, error: String(error) });
+    }
+}
+// ─── Which account is active ──────────────────────────────────────────
+let warnedMissingActive = null;
+/**
+ * The account the next session starts under. Absent pointer: the machine login,
+ * which is how a pre-#422 file reads.
+ *
+ * A pointer to a row or a home that is gone reads as the machine too, and says
+ * so once – sessions and the verdict then agree on the same login instead of
+ * one of them running under a home the other cannot see.
+ */
+export function activeAccountId() {
+    const file = readAgentAuth();
+    const pointer = file.claudeActiveAccount;
+    if (!pointer || pointer === MACHINE_ACCOUNT_ID)
+        return MACHINE_ACCOUNT_ID;
+    const known = file.claudeAccounts?.some((record) => record.id === pointer) ?? false;
+    if (known && isAccountId(pointer) && fs.existsSync(accountHome(pointer))) {
+        warnedMissingActive = null;
+        return pointer;
+    }
+    if (warnedMissingActive !== pointer) {
+        warnedMissingActive = pointer;
+        log.warn('claude-homes: the active account is gone from this machine – using the machine login', {
+            account: pointer,
+        });
+    }
+    return MACHINE_ACCOUNT_ID;
+}
+/** Make a row active. `activate` leaves the usage cache alone: keys keep accounts apart (R16). */
+export function setActiveAccount(id) {
+    if (id !== MACHINE_ACCOUNT_ID) {
+        if (!isAccountId(id) || !recordOf(id))
+            throw new AccountError('no such account on this server');
+        if (!fs.existsSync(accountHome(id))) {
+            throw new AccountError('the files of this account are gone from this server – forget it');
+        }
+    }
+    updateAgentAuth((file) => {
+        if (id === MACHINE_ACCOUNT_ID)
+            delete file.claudeActiveAccount;
+        else
+            file.claudeActiveAccount = id;
+    });
+    return activeAccountId();
+}
+function sessionAccountOf(id) {
+    const home = homeOfRow(id);
+    const known = storedIdentity(id);
+    // A contradicted identity names somebody the home no longer is: the session
+    // starts unsigned (its limits panel draws as before #422) rather than under
+    // the previous login's name.
+    const identity = identityFreshness(known, home) === 'contradicted' ? undefined : known;
+    return {
+        id,
+        kind: id === MACHINE_ACCOUNT_ID ? 'machine' : 'saved',
+        home,
+        ...(identity?.email ? { email: identity.email } : {}),
+        ...(identity?.orgId ? { orgId: identity.orgId } : {}),
+        ...(identity?.orgName ? { orgName: identity.orgName } : {}),
+        ...(identity?.plan ? { plan: identity.plan } : {}),
+    };
+}
+/** Who a row is, for the verdict's `activeAccount` (§8) – from what is known, no CLI. */
+export function readActiveAccountSummary(id) {
+    const account = sessionAccountOf(id);
+    return {
+        id,
+        ...(account.email ? { email: account.email } : {}),
+        ...(account.orgId ? { orgId: account.orgId } : {}),
+    };
+}
+/**
+ * Which home a one-shot run of the agent should use – the active account, read
+ * only: no link repair, no identity. For the commit-message run, which is
+ * Claude working as the machine's active account too (found by the independent
+ * check of S1: it kept running as the machine login after a switch).
+ */
+export function activeAccountHome() {
+    const id = activeAccountId();
+    return id === MACHINE_ACCOUNT_ID
+        ? { kind: 'machine', home: null }
+        : { kind: 'saved', home: accountHome(id) };
+}
+/**
+ * The active account, ready for a session to start under.
+ *
+ * A saved home has its links re-asserted first: a link the CLI replaced with a
+ * file since the last session is repaired before this session can write through
+ * the gap (it would otherwise resume nothing and share nothing).
+ */
+export function resolveSessionAccount() {
+    const id = activeAccountId();
+    const account = sessionAccountOf(id);
+    if (account.home !== null) {
+        try {
+            ensureSharedLinks(account.home);
+        }
+        catch (error) {
+            log.warn('claude-homes: could not repair the links of the active account', {
+                account: id,
+                error: String(error),
+            });
+        }
+    }
+    return account;
+}
+/**
+ * The environment of a process that works AS this account.
+ *
+ * For a saved account: its home, and nothing that outranks the home. The CLI
+ * puts `CLAUDE_CODE_OAUTH_TOKEN` above every login file, so with the operator's
+ * token left in, switching would be a silent no-op under a green verdict – #121
+ * again (К14). The API keys go for the same reason.
+ *
+ * For the machine login: the input as it was, minus a `CLAUDE_CONFIG_DIR` that
+ * would point it elsewhere – the pre-#422 environment.
+ */
+export function withAccountHome(env, account) {
+    const out = { ...env };
+    delete out['CLAUDE_CONFIG_DIR'];
+    if (account.kind === 'saved' && account.home !== null) {
+        out['CLAUDE_CONFIG_DIR'] = account.home;
+        delete out['CLAUDE_CODE_OAUTH_TOKEN'];
+        delete out['ANTHROPIC_API_KEY'];
+        delete out['ANTHROPIC_AUTH_TOKEN'];
+    }
+    return out;
+}
+function readOauthAccount(home) {
+    const config = readJsonObject(configFileOf(home));
+    const account = isObject(config?.['oauthAccount']) ? config['oauthAccount'] : null;
+    const accountUuid = text(account?.['accountUuid'], 100);
+    const organizationUuid = text(account?.['organizationUuid'], 100);
+    const tier = text(account?.['organizationRateLimitTier'], 80);
+    return {
+        ...(accountUuid ? { accountUuid } : {}),
+        ...(organizationUuid ? { organizationUuid } : {}),
+        ...(tier ? { tier } : {}),
+        config,
+    };
+}
+/**
+ * Who a home's `/usage` reading belongs to, read right after the probe (S1 item 5).
+ *
+ * `accountUuid` is where the CLI itself signs its figures; `organizationUuid` is
+ * the same key `claude auth status` calls `orgId` (checked on both homes of this
+ * machine, 17.09.2026). An internal file, so best-effort: nothing read, nothing
+ * signed.
+ */
+export function usageSignature(account) {
+    const info = readOauthAccount(account.home);
+    return {
+        ...(info.accountUuid ? { accountUuid: info.accountUuid } : {}),
+        ...(info.organizationUuid ? { orgId: info.organizationUuid } : {}),
+    };
+}
+/** Which subscription a home's `.claude.json` names now, re-read only when the file moved. */
+const orgByConfigFile = new Map();
+/**
+ * The subscription a home's own file names at this moment (S2, found by the
+ * independent check): a live session signs its limits with the subscription it
+ * STARTED under, and has to notice when somebody signed the home in to another
+ * one – the CLI moves the running process onto the new login by path (gotcha
+ * 531). Cheap enough for every frame: a `stat`, and a parse only after a write.
+ */
+export function currentHomeOrgId(home) {
+    const file = configFileOf(home);
+    let mtimeMs;
+    try {
+        mtimeMs = fs.statSync(file).mtimeMs;
+    }
+    catch {
+        return undefined;
+    }
+    const cached = orgByConfigFile.get(file);
+    if (cached?.mtimeMs === mtimeMs)
+        return cached.orgId;
+    const orgId = readOauthAccount(home).organizationUuid;
+    orgByConfigFile.set(file, { mtimeMs, orgId });
+    return orgId;
+}
+/**
+ * The limits the CLI last measured in a home, from its own `.claude.json` (R19).
+ *
+ * Only for the line «when measured»: an internal file, rewritten by any update
+ * of the CLI (§11). Accepted only when it is signed by the account the same file
+ * says it belongs to – half-way through a re-login the two can disagree, and a
+ * number under the wrong name is worse than none.
+ */
+export function readLastUsage(home) {
+    const info = readOauthAccount(home);
+    const cached = info.config?.['cachedUsageUtilization'];
+    if (!isObject(cached) || !info.accountUuid)
+        return null;
+    if (cached['accountUuid'] !== info.accountUuid)
+        return null;
+    // Through the same bound as the login verdict: `new Date(1e18).toISOString()`
+    // throws, and thrown out of a card it took the whole list down with it – and
+    // turned a sign-in that had succeeded into a reported failure (found by the
+    // independent check of S2).
+    const fetchedAt = asTimestamp(cached['fetchedAtMs']);
+    const utilization = cached['utilization'];
+    if (fetchedAt === undefined || !isObject(utilization)) {
+        return null;
+    }
+    const rows = [];
+    for (const key of ['five_hour', 'seven_day']) {
+        const window = utilization[key];
+        if (!isObject(window))
+            continue;
+        const percent = window['utilization'];
+        if (typeof percent !== 'number' || !Number.isFinite(percent))
+            continue;
+        const resets = window['resets_at'];
+        const resetsMs = typeof resets === 'string' ? Date.parse(resets) : NaN;
+        rows.push({
+            key,
+            label: null,
+            percent: Math.min(100, Math.max(0, percent)),
+            resetsAt: Number.isFinite(resetsMs) ? new Date(resetsMs).toISOString() : null,
+        });
+    }
+    if (rows.length === 0)
+        return null;
+    return {
+        rows,
+        measuredAtMs: fetchedAt,
+        accountUuid: info.accountUuid,
+        ...(info.organizationUuid ? { orgId: info.organizationUuid } : {}),
+    };
+}
+// ─── Live sessions per account ───────────────────────────────────────
+/** sessionId → the account that session's process runs under. */
+const sessionAccounts = new Map();
+/** A session's process is starting under this account. */
+export function noteSessionAccount(sessionId, accountId) {
+    sessionAccounts.set(sessionId, accountId);
+}
+/** That process is gone. */
+export function releaseSessionAccount(sessionId) {
+    sessionAccounts.delete(sessionId);
+}
+/** Accounts some live session process is running under right now. */
+export function liveAccountIds() {
+    return new Set(sessionAccounts.values());
+}
+const RETIRED = /^([a-z0-9]{12})\.retired-\d+$/;
+const STAGING = /^\.staging-[a-z0-9]{12}$/;
+const STAGING_MAX_AGE_MS = 60 * 60 * 1000;
+/**
+ * Finish a swap of homes the previous daemon did not finish (R15).
+ *
+ * A replacement moves the old home to `<id>.retired-<ts>` for the length of one
+ * call: long enough to put it back if the new login cannot take its place. A
+ * daemon that died inside that call leaves the name behind. If `<id>` is there,
+ * the swap went through and the retired home is the replaced login – removed. If
+ * `<id>` is missing, the swap did not happen – the retired home is put back,
+ * because it is the row's only login. Run at daemon start, when nothing runs.
+ */
+export function recoverInterruptedSwaps() {
+    const root = claudeHomesDir();
+    let names;
+    try {
+        names = fs.readdirSync(root);
+    }
+    catch {
+        return [];
+    }
+    const actions = [];
+    for (const name of names) {
+        const match = RETIRED.exec(name);
+        if (!match?.[1])
+            continue;
+        const retired = path.join(root, name);
+        const home = path.join(root, match[1]);
+        if (lstatOrNull(home)) {
+            fs.rmSync(retired, { recursive: true, force: true });
+            actions.push(`removed ${name}`);
+        }
+        else {
+            fs.renameSync(retired, home);
+            log.warn('claude-homes: put back a home whose replacement had not finished', {
+                account: match[1],
+            });
+            actions.push(`restored ${match[1]}`);
+        }
+    }
+    return actions;
+}
+function loginOf(status, refused) {
+    const login = status.status === 'unknown' ? 'unknown' : status.status === 'ok' && !refused ? 'ok' : 'expired';
+    return { login, ...(status.expiresAt ? { loginUntil: status.expiresAt } : {}) };
+}
+function usageOf(reading) {
+    if (!reading || reading.rows.length === 0)
+        return {};
+    return { usage: reading.rows, usageMeasuredAt: new Date(reading.measuredAtMs).toISOString() };
+}
+function identityFields(identity) {
+    return {
+        ...(identity?.email ? { email: identity.email } : {}),
+        ...(identity?.orgId ? { orgId: identity.orgId } : {}),
+        ...(identity?.orgName ? { orgName: identity.orgName } : {}),
+        ...(identity?.plan ? { plan: identity.plan } : {}),
+    };
+}
+/**
+ * The limits of a row: for the active one, what the machine measured for its
+ * subscription; for the others – and for an active one nobody has measured yet –
+ * the last figures the CLI left in the home.
+ */
+function rowUsage(id, identity, active) {
+    const home = homeOfRow(id);
+    if (active) {
+        const measured = lastUsageRows({ id, ...(identity?.orgId ? { orgId: identity.orgId } : {}) });
+        if (measured)
+            return measured;
+    }
+    const last = readLastUsage(home);
+    // Signed by a different subscription than the row says it is: somebody else's.
+    if (last?.orgId && identity?.orgId && last.orgId !== identity.orgId)
+        return null;
+    return last;
+}
+/**
+ * The list, from what is already known – no subprocess (§8 `agent_accounts`
+ * reads this after `listAccounts` refreshed the identities).
+ */
+export function buildAccountList(homedir = os.homedir()) {
+    const file = readAgentAuth();
+    const active = activeAccountId();
+    const machineIdentity = file.claudeMachine?.lastSeenIdentity;
+    const machineTier = readOauthAccount(null).tier;
+    const machineCard = {
+        id: MACHINE_ACCOUNT_ID,
+        kind: 'machine',
+        ...identityFields(machineIdentity),
+        ...(machineTier ? { tier: machineTier } : {}),
+        active: active === MACHINE_ACCOUNT_ID,
+        ...loginOf(machineLoginStatus(homedir), refusalActive('claude', MACHINE_ACCOUNT_ID)),
+        ...usageOf(rowUsage(MACHINE_ACCOUNT_ID, machineIdentity, active === MACHINE_ACCOUNT_ID)),
+    };
+    const saved = [...(file.claudeAccounts ?? [])]
+        .filter((record) => isAccountId(record.id) && fs.existsSync(accountHome(record.id)))
+        .sort((a, b) => Date.parse(a.addedAt) - Date.parse(b.addedAt))
+        .map((record) => {
+        const identity = record.lastSeenIdentity;
+        const tier = readOauthAccount(accountHome(record.id)).tier;
+        const same = identity?.orgId !== undefined &&
+            machineIdentity?.orgId !== undefined &&
+            identity.orgId === machineIdentity.orgId;
+        return {
+            id: record.id,
+            kind: 'saved',
+            ...identityFields(identity),
+            ...(tier ? { tier } : {}),
+            addedAt: record.addedAt,
+            active: active === record.id,
+            ...loginOf(savedLoginStatus(record.id), refusalActive('claude', record.id)),
+            ...usageOf(rowUsage(record.id, identity, active === record.id)),
+            ...(same ? { sameAsMachine: true } : {}),
+        };
+    });
+    return { accounts: [machineCard, ...saved], active };
+}
+/**
+ * The list of Claude accounts on this machine (§8 `agent_accounts`).
+ *
+ * `probeIdentity` is the one place in the product where `claude auth status`
+ * runs on request (R14 a): home by home, one at a time, and only for a row whose
+ * known identity is older than its login file or than a few hours. Never from
+ * the minute poll – that reads the panel verdict, which asks no CLI.
+ */
+export async function listAccounts(options = {}) {
+    if (options.probeIdentity) {
+        const ids = [
+            MACHINE_ACCOUNT_ID,
+            ...(readAgentAuth().claudeAccounts ?? []).map((record) => record.id).filter(isAccountId),
+        ];
+        for (const id of ids) {
+            await refreshAccountIdentity(id).catch((error) => log.warn('claude-homes: identity refresh failed', { account: id, error: String(error) }));
+        }
+    }
+    return buildAccountList();
+}
+function cardOf(id) {
+    const card = buildAccountList().accounts.find((row) => row.id === id);
+    if (!card)
+        throw new AccountError('the account is not on this server any more');
+    return card;
+}
+// ─── Signing in: a staging home, adopted by rename ───────────────────
+function isStagingDir(dir) {
+    return (path.dirname(path.resolve(dir)) === path.resolve(claudeHomesDir()) &&
+        STAGING.test(path.basename(dir)));
+}
+function sweepStaleStaging(root) {
+    let names;
+    try {
+        names = fs.readdirSync(root);
+    }
+    catch {
+        return;
+    }
+    const now = Date.now();
+    for (const name of names) {
+        if (!STAGING.test(name))
+            continue;
+        const dir = path.join(root, name);
+        const stat = lstatOrNull(dir);
+        if (stat && now - stat.mtimeMs > STAGING_MAX_AGE_MS) {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    }
+}
+/**
+ * A fresh home for a sign-in that has not happened yet (§8 `target: 'saved'`).
+ *
+ * Links and config first, so the CLI that signs in here writes its identity
+ * into a file that already has the machine's configuration. Hidden by its name:
+ * the list never shows a staging home, and an abandoned one older than an hour
+ * is removed the next time somebody starts a sign-in.
+ */
+export function prepareStagingHome() {
+    const root = ensureRoot();
+    sweepStaleStaging(root);
+    const dir = path.join(root, `.staging-${newAccountId()}`);
+    fs.mkdirSync(dir, { mode: 0o700 });
+    ensureSharedLinks(dir);
+    ensureHomeConfig(dir);
+    return dir;
+}
+/**
+ * Remove every staging home, whatever its age – at daemon start, and only there.
+ *
+ * A sign-in whose code was accepted leaves the relay before its home is adopted
+ * (the identity is asked first, and waits in the machine-wide queue). A daemon
+ * that stops in that moment – «Update runner», a restart, an OOM – leaves a live
+ * login in a hidden home nobody lists, forgets or adopts; the hourly sweep in
+ * `prepareStagingHome` reaches it only when somebody next signs in (found by the
+ * independent check of S2). At start nothing can be adopting yet, so all of them go.
+ */
+export function discardAbandonedStagingHomes() {
+    const root = claudeHomesDir();
+    let names;
+    try {
+        names = fs.readdirSync(root);
+    }
+    catch {
+        return [];
+    }
+    const removed = [];
+    for (const name of names) {
+        if (!STAGING.test(name))
+            continue;
+        fs.rmSync(path.join(root, name), { recursive: true, force: true });
+        removed.push(name);
+    }
+    if (removed.length > 0) {
+        log.warn('claude-homes: removed sign-in homes a previous daemon left unadopted', {
+            count: removed.length,
+        });
+    }
+    return removed;
+}
+/** Throw a sign-in away, whatever state it reached – it may hold a login nobody adopted. */
+export function discardStagingHome(dir) {
+    if (!isStagingDir(dir))
+        throw new AccountError('not a staging home');
+    fs.rmSync(dir, { recursive: true, force: true });
+}
+/**
+ * A sign-in in a staging home succeeded: make it a saved account (§8
+ * `agent_account_login_code`).
+ *
+ * One subscription – one row (D19, R1). Identity is asked once, in the staging
+ * home, BEFORE anything moves (R14 b). A known `orgId` that a saved row already
+ * has REPLACES that row: the new login takes the row's id and `addedAt` (marks
+ * and a live session's reading are keyed by the id, R15) and the old login is
+ * deleted. An unknown `orgId` merges with nothing («card not filled»). The
+ * machine row takes no part: it is a different file, and a saved row of the same
+ * subscription is marked `sameAsMachine` instead of merged.
+ *
+ * A session running under the replaced row moves onto the new login at its next
+ * token refresh – the CLI finds its home by PATH, and the path now holds the new
+ * login. The plan (R15) asked to keep the old home renamed while such a session
+ * lives, «because the CLI writes its refreshed token into it»; the independent
+ * check of S1 read the CLI and showed it does not – a renamed home is never
+ * touched again, and keeping it would only keep an unused grant on disk. Both
+ * logins are of ONE subscription (that is what made them the same row), so the
+ * session keeps its account.
+ *
+ * Every move is a `rename`; the login is never in two places. A swap that cannot
+ * finish is undone – the old login goes back where it was. The row is recorded
+ * BEFORE a new home is moved into place, so a failed write never leaves a login
+ * nobody can list or forget. The signed-in row becomes active (R15).
+ */
+export async function adoptLoginResult(stagingDir) {
+    if (!isStagingDir(stagingDir) || !lstatOrNull(stagingDir)?.isDirectory()) {
+        throw new AccountError('no sign-in in progress – start again');
+    }
+    const verdict = judgeCredentialFile(credentialsFileOf(stagingDir));
+    if (verdict.status !== 'ok') {
+        throw new AccountError('the sign-in finished but no usable login was stored – start again');
+    }
+    const identity = await readAccountIdentity(stagingDir);
+    const stamped = identity
+        ? { ...identity, at: new Date().toISOString() }
+        : undefined;
+    // The ask above can wait behind other homes for a while: the sign-in may have
+    // been abandoned meanwhile. Nothing moves unless it is still there.
+    if (!lstatOrNull(stagingDir)?.isDirectory() ||
+        judgeCredentialFile(credentialsFileOf(stagingDir)).status !== 'ok') {
+        throw new AccountError('the sign-in was abandoned before it could be saved – start again');
+    }
+    const root = ensureRoot();
+    const records = readAgentAuth().claudeAccounts ?? [];
+    const same = stamped?.orgId
+        ? records.find((record) => isAccountId(record.id) && record.lastSeenIdentity?.orgId === stamped.orgId)
+        : undefined;
+    if (!same) {
+        const id = newAccountId();
+        updateAgentAuth((file) => {
+            file.claudeAccounts = [
+                ...(file.claudeAccounts ?? []),
+                {
+                    id,
+                    addedAt: new Date().toISOString(),
+                    ...(stamped ? { lastSeenIdentity: stamped } : {}),
+                },
+            ];
+        });
+        try {
+            fs.renameSync(stagingDir, accountHome(id));
+            fs.chmodSync(accountHome(id), 0o700);
+        }
+        catch (error) {
+            // The record without its home would be a row that points at nothing.
+            updateAgentAuth((file) => {
+                file.claudeAccounts = (file.claudeAccounts ?? []).filter((entry) => entry.id !== id);
+                if (file.claudeAccounts.length === 0)
+                    delete file.claudeAccounts;
+            });
+            throw error;
+        }
+        updateAgentAuth((file) => {
+            file.claudeActiveAccount = id;
+        });
+        log.info('claude-homes: a new account was added', { account: id });
+        return { account: cardOf(id), active: activeAccountId() };
+    }
+    const home = accountHome(same.id);
+    let retired = null;
+    if (lstatOrNull(home)) {
+        retired = path.join(root, `${same.id}.retired-${Date.now()}`);
+        fs.renameSync(home, retired);
+    }
+    try {
+        fs.renameSync(stagingDir, home);
+    }
+    catch (error) {
+        if (retired)
+            fs.renameSync(retired, home);
+        throw error;
+    }
+    fs.chmodSync(home, 0o700);
+    if (retired)
+        fs.rmSync(retired, { recursive: true, force: true });
+    updateAgentAuth((file) => {
+        const record = file.claudeAccounts?.find((entry) => entry.id === same.id);
+        if (record) {
+            if (stamped)
+                record.lastSeenIdentity = stamped;
+            delete record.loginExpiredAt;
+        }
+        file.claudeActiveAccount = same.id;
+    });
+    // A fresh login outranks anything remembered about the one it replaced – on
+    // disk above, and in this process's memory of refusals here.
+    clearRefusal('claude', same.id);
+    // The replaced login's figures are not the new login's, even on one subscription.
+    invalidateUsageCache({
+        id: same.id,
+        ...(same.lastSeenIdentity?.orgId ? { orgId: same.lastSeenIdentity.orgId } : {}),
+    });
+    log.info('claude-homes: a sign-in replaced the saved login of the same subscription', {
+        account: same.id,
+        underLiveSession: liveAccountIds().has(same.id),
+    });
+    return { account: cardOf(same.id), active: activeAccountId(), replaced: same.id };
+}
+/**
+ * Bring a home that already holds a login into the store – by rename (D17, R7).
+ *
+ * For the one login this plan names: the probe's `/root/.probe-422/login/home`.
+ * Refused, rather than done by copy, when the rename would cross filesystems.
+ * Refused for the machine home and for anything already in the store, whatever
+ * the spelling of the path. Refused when a saved row of the same subscription
+ * exists (one subscription – one row, and nothing here is allowed to delete a
+ * login to make room). Recorded before it moves; never activates.
+ */
+export async function importLoginHome(source) {
+    const stat = lstatOrNull(source);
+    if (!stat?.isDirectory())
+        throw new AccountError('not a directory');
+    if (isWithin(source, machineHome()) || isWithin(machineHome(), source)) {
+        throw new AccountError('the machine login is never moved');
+    }
+    if (isWithin(source, claudeHomesDir()))
+        throw new AccountError('that home is already stored');
+    if (!lstatOrNull(path.join(source, '.credentials.json'))?.isFile()) {
+        throw new AccountError('there is no login in that directory');
+    }
+    const identity = await readAccountIdentity(source);
+    if (identity?.orgId) {
+        const clash = (readAgentAuth().claudeAccounts ?? []).find((record) => record.lastSeenIdentity?.orgId === identity.orgId);
+        if (clash)
+            throw new AccountError(`this subscription is already saved as ${clash.id}`);
+    }
+    if (!lstatOrNull(source)?.isDirectory())
+        throw new AccountError('not a directory');
+    ensureRoot();
+    const id = newAccountId();
+    const home = accountHome(id);
+    updateAgentAuth((file) => {
+        file.claudeAccounts = [
+            ...(file.claudeAccounts ?? []),
+            {
+                id,
+                addedAt: new Date().toISOString(),
+                ...(identity ? { lastSeenIdentity: { ...identity, at: new Date().toISOString() } } : {}),
+            },
+        ];
+    });
+    try {
+        fs.renameSync(source, home);
+    }
+    catch (error) {
+        updateAgentAuth((file) => {
+            file.claudeAccounts = (file.claudeAccounts ?? []).filter((entry) => entry.id !== id);
+            if (file.claudeAccounts.length === 0)
+                delete file.claudeAccounts;
+        });
+        if (error.code === 'EXDEV') {
+            throw new AccountError('the login is on another filesystem – it is moved, never copied');
+        }
+        throw error;
+    }
+    fs.chmodSync(home, 0o700);
+    // Listed and forgettable from here on; a link or seed that fails is logged and
+    // repaired at the first session under this account, not a reason to lose the row.
+    try {
+        ensureSharedLinks(home);
+        ensureHomeConfig(home);
+    }
+    catch (error) {
+        log.warn('claude-homes: a moved-in home could not be fully prepared', {
+            account: id,
+            error: String(error),
+        });
+    }
+    log.info('claude-homes: a login home was moved into the store', { account: id });
+    return cardOf(id);
+}
+/**
+ * Forget a saved account: its home goes, its record goes (§8 `agent_account_forget`).
+ *
+ * The machine row cannot be forgotten. A row a live session runs under is
+ * refused – its process writes into that home until it ends. `rmSync` removes
+ * the links of the home as links: nothing in `~/.claude` is followed or touched.
+ * Forgetting the active row makes the machine login active.
+ */
+export function forgetAccount(id) {
+    if (id === MACHINE_ACCOUNT_ID) {
+        throw new AccountError('the login of this machine cannot be forgotten');
+    }
+    const record = isAccountId(id) ? recordOf(id) : undefined;
+    if (!record)
+        throw new AccountError('no such account on this server');
+    if (liveAccountIds().has(id)) {
+        throw new AccountError('a running session uses this account – stop it first, then forget it');
+    }
+    fs.rmSync(accountHome(id), { recursive: true, force: true });
+    updateAgentAuth((file) => {
+        file.claudeAccounts = (file.claudeAccounts ?? []).filter((entry) => entry.id !== id);
+        if (file.claudeAccounts.length === 0)
+            delete file.claudeAccounts;
+        if (file.claudeActiveAccount === id)
+            delete file.claudeActiveAccount;
+    });
+    invalidateUsageCache({
+        id,
+        ...(record.lastSeenIdentity?.orgId ? { orgId: record.lastSeenIdentity.orgId } : {}),
+    });
+    log.info('claude-homes: an account was forgotten', { account: id });
+    return { active: activeAccountId() };
+}
+//# sourceMappingURL=claude-homes.js.map