@bridge4dev/runner 0.65.1 → 0.67.0

package/dist/index.js

@@ -7,14 +7,17 @@ import path from 'node:path';
 import { promisify } from 'node:util';
 import { ClaudeAdapter } from './adapters/claude.js';
 import { CodexAdapter } from './adapters/codex.js';
-import { ensureCodexHome } from './adapters/codex-home.js';
+import { configureCodexAuth, discardAbandonedCodexStagingHomes, ensureCodexHome, } from './adapters/codex-home.js';
 import { sessionClaudePath } from './agent-binary.js';
 import { claimCageAuthority, runSystemctl } from './cage-authority.js';
 import { acquireDaemonLock, isHeldByAnother } from './daemon-lock.js';
-import { loadConfig, mergeIntoPairedConfig, requireConfig, saveConfig, } from './config.js';
+import { loadConfig, mergeIntoPairedConfig, requireConfig, saveConfig } from './config.js';
 import { log } from './log.js';
 import { installIsWritable, installPrefixFor, isSupervisedProcess, restartCapability, manualUpdateCommand, resolveInstalledPackageDir, } from './self-update.js';
 import { applyStoredClaudeToken } from './agent-auth.js';
+import { discardAbandonedStagingHomes, recoverInterruptedSwaps, refreshAccountIdentity, } from './claude-homes.js';
+import { ACCOUNT_AGENTS, ACCOUNT_COMMANDS } from './account-commands.js';
+import { MACHINE_ACCOUNT_ID } from './login-marks.js';
 import { Supervisor } from './supervisor.js';
 import { readStatusFile, isPidAlive, writeStatusFile, STATUS_FRESH_MS } from './status-file.js';
 import { RunnerWsClient } from './ws-client.js';
@@ -515,6 +518,13 @@ function runnerCapabilities(apiUrlOverride) {
          * `kind: 'oom'` is inferred from the cgroup counter — see `crash-note.ts`.
          */
         ...(LAST_EXIT ? { lastExit: LAST_EXIT } : {}),
+        /**
+         * #422 (R11): the agents this runner keeps several logins for. Static per
+         * version – the LIST of accounts is always asked with `agent_accounts`,
+         * never read from here (a snapshot taken at start, #395). The dashboard
+         * shows the account window only to an agent named here.
+         */
+        accounts: [...ACCOUNT_AGENTS],
         /** Commands beyond the stage-A/B set. */
         commands: [
             'purge_session',
@@ -578,6 +588,10 @@ function runnerCapabilities(apiUrlOverride) {
             // ANSWERS the command, with a sentence saying why — which is a better
             // outcome than a frame nobody replies to.
             'runner_restart',
+            // #422: list, sign in to, switch and forget agent logins (plan §8).
+            // Unconditional: they read and write only the runner's own state, and an
+            // agent they do not serve yet is answered with a sentence.
+            ...ACCOUNT_COMMANDS,
         ],
     };
 }
@@ -633,15 +647,19 @@ async function cmdPair(args) {
  * per-session: a fresh home clones ~90 MB of plugin marketplace on first use.
  * A failure here disables Codex rather than the whole daemon.
  */
-function bootstrapCodex(config) {
+function bootstrapCodex() {
     try {
-        const home = ensureCodexHome({ auth: config.codex?.auth ?? 'link' });
-        log.info('codex: isolated home ready', { path: home.path, auth: home.auth });
+        const home = ensureCodexHome();
+        log.info('codex: isolated home ready', {
+            path: home.path,
+            auth: home.auth,
+            ...(home.accountId ? { account: home.accountId } : {}),
+        });
         // Deliberately NOT passing `codexHome`: the adapter re-asserts the home on
         // every session. Freezing this snapshot is how a credential that went
         // missing mid-day kept being reported as present while sessions failed.
-        // The mode does travel, so those repairs honour `[codex] auth = "own"`.
-        return new CodexAdapter({ authMode: config.codex?.auth ?? 'link' });
+        // Nor the mode: those repairs read it from `configureCodexAuth`.
+        return new CodexAdapter();
     }
     catch (error) {
         log.error('codex: could not prepare an isolated home — Codex disabled', {
@@ -955,9 +973,43 @@ async function cmdDaemon() {
     if (applyStoredClaudeToken()) {
         log.info('daemon: using the Claude token stored on this server');
     }
+    /**
+     * #422: a swap of Claude homes the previous daemon died inside is finished or
+     * undone before anything can run under an account; and who the machine login
+     * is gets asked once, in the background (R14 c) – the verdict and the list read
+     * the answer, the minute poll never asks.
+     */
+    try {
+        recoverInterruptedSwaps();
+    }
+    catch (error) {
+        log.warn('daemon: could not finish an interrupted swap of Claude homes', {
+            error: String(error),
+        });
+    }
+    try {
+        // A sign-in the previous daemon accepted but never adopted (S2): nothing can
+        // be adopting before the supervisor exists. Codex sign-ins too (S4) – and
+        // the fixed-path staging home runners before S4 never removed.
+        discardAbandonedStagingHomes();
+        discardAbandonedCodexStagingHomes();
+    }
+    catch (error) {
+        log.warn('daemon: could not remove sign-in homes a previous daemon left', {
+            error: String(error),
+        });
+    }
+    void refreshAccountIdentity(MACHINE_ACCOUNT_ID).catch(() => undefined);
+    // Only a mode the owner WROTE is ever forced, and never over a saved login
+    // (#422 S4 item 2): the defaults that used to be passed around re-linked the
+    // host login at every start, session and probe. Recorded whatever is on PATH:
+    // Codex may be installed from the dashboard later, and the account commands and
+    // the minute probe read this from the first moment (found by the independent
+    // check of S4).
+    configureCodexAuth(config.codex?.auth);
     const agents = installedAgents();
     const ws = new RunnerWsClient(config.api.ws_url, config.server.token, runnerCapabilities());
-    const codex = agents.includes('codex') ? bootstrapCodex(config) : null;
+    const codex = agents.includes('codex') ? bootstrapCodex() : null;
     const supervisor = new Supervisor(ws, {
         adapters: {
             CLAUDE: new ClaudeAdapter(),
@@ -976,7 +1028,7 @@ async function cmdDaemon() {
          * `hasExecutable` is asked HERE, at the moment of the question, which is
          * the whole point.
          */
-        makeAdapter: (agent) => agent === 'CODEX' && hasExecutable('codex') ? bootstrapCodex(config) : null,
+        makeAdapter: (agent) => (agent === 'CODEX' && hasExecutable('codex') ? bootstrapCodex() : null),
         ...(config.mcp ? { mcp: { url: config.mcp.url, token: config.mcp.token } } : {}),
         ...(config.limits?.max_sessions ? { maxSessionsLimit: config.limits.max_sessions } : {}),
         /**
@@ -1379,6 +1431,15 @@ async function runnerChecks() {
     });
     return checks;
 }
+/** « · account <email> (saved)» – nothing for the machine login nobody named. */
+function accountLine(account) {
+    if (!account)
+        return '';
+    if (account.id === MACHINE_ACCOUNT_ID) {
+        return account.email ? ` · machine login ${account.email}` : '';
+    }
+    return ` · saved account ${account.email ?? account.id}`;
+}
 async function agentChecks() {
     const me = runnerIdentity();
     // The probes log a verdict line each, which belongs in the journal, not in
@@ -1440,8 +1501,12 @@ async function agentChecks() {
         checks.push({
             ok: signedIn,
             name: `${agent} login`,
+            // Which account the verdict is about (#422): the same rule as the panel,
+            // read from the same file, so doctor and the dashboard cannot answer about
+            // two different logins on one machine.
             detail: (info.detail ?? info.status) +
-                (info.expiresAt ? ` · until ${formatLocalDay(info.expiresAt)}` : ''),
+                (info.expiresAt ? ` · until ${formatLocalDay(info.expiresAt)}` : '') +
+                accountLine(info.activeAccount),
             ...(signedIn
                 ? {}
                 : {
@@ -1621,6 +1686,9 @@ async function cmdDoctor(args) {
     // reloads systemd, which is the `install` grade and nothing above it (#403).
     claimCageAuthority(fix ? 'install' : 'probe');
     const config = loadConfig();
+    // The same Codex mode the daemon honours, or doctor's verdict would repair the
+    // home by a rule the daemon does not follow (#422 S4 item 2).
+    configureCodexAuth(config?.codex?.auth);
     print(`devbridge-runner ${RUNNER_VERSION}`);
     print(config ? `Paired with: ${config.server.name} (${config.api.url})` : 'Not paired');
     // Paths given on the command line win; otherwise check what this runner has

package/dist/login-marks.d.ts

@@ -0,0 +1,42 @@
+import type { RelayAgentName } from './agent-registry.js';
+/**
+ * What the agent actually experienced with a sign-in — per agent AND per account.
+ *
+ * The credentials file cannot tell us the provider revoked a login: the refresh
+ * token still sits there, dated. The one authority on that is a real refusal
+ * from a real run — so a session that failed to authenticate demotes the file's
+ * verdict for a while, and any successful turn clears it again.
+ *
+ * Moved out of `auth-relay.ts` for #422 and keyed by account as well as agent.
+ * With several Claude logins on one machine «Claude was refused» stopped being
+ * a statement about anything: the session that was refused ran under ONE
+ * account, and the machine may have been switched to another since. The mark
+ * belongs to the account the session started under (R14) – which is why both
+ * the account list (`claude-homes.ts`) and the panel verdict (`auth-relay.ts`)
+ * read it from here rather than each keeping a copy.
+ *
+ * Process memory on purpose: no protocol, no disk. The consequence is worth
+ * naming — restarting the daemon forgets the refusal and the panel goes back
+ * to trusting the file until the next session tries. (A saved account also
+ * carries a mark on disk, D2 – see `markLoginExpired` in `claude-homes.ts`.)
+ */
+/** The machine's own login – the one row every agent has. */
+export declare const MACHINE_ACCOUNT_ID = "machine";
+/**
+ * A saved account's id – twelve lowercase letters and digits, never `machine`.
+ * One format for both agents (#422 S4): the wire, the refusal marks and the
+ * dashboard read the same alphabet whichever agent a row belongs to.
+ */
+export declare function isAccountId(id: unknown): id is string;
+/** A refusal meant for a person: the wire (S2) sends its message as it is, and it names no path. */
+export declare class AccountError extends Error {
+    constructor(message: string);
+}
+export declare function newAccountId(): string;
+/** A session under this agent and account was just refused. */
+export declare function noteRefusal(agent: RelayAgentName, accountId?: string): void;
+/** The sign-in worked again. Answers whether a refusal was being held. */
+export declare function clearRefusal(agent: RelayAgentName, accountId?: string): boolean;
+/** Is a refusal still being held against this agent and account? */
+export declare function refusalActive(agent: RelayAgentName, accountId?: string): boolean;
+//# sourceMappingURL=login-marks.d.ts.map

package/dist/login-marks.js

@@ -0,0 +1,70 @@
+import crypto from 'node:crypto';
+/**
+ * What the agent actually experienced with a sign-in — per agent AND per account.
+ *
+ * The credentials file cannot tell us the provider revoked a login: the refresh
+ * token still sits there, dated. The one authority on that is a real refusal
+ * from a real run — so a session that failed to authenticate demotes the file's
+ * verdict for a while, and any successful turn clears it again.
+ *
+ * Moved out of `auth-relay.ts` for #422 and keyed by account as well as agent.
+ * With several Claude logins on one machine «Claude was refused» stopped being
+ * a statement about anything: the session that was refused ran under ONE
+ * account, and the machine may have been switched to another since. The mark
+ * belongs to the account the session started under (R14) – which is why both
+ * the account list (`claude-homes.ts`) and the panel verdict (`auth-relay.ts`)
+ * read it from here rather than each keeping a copy.
+ *
+ * Process memory on purpose: no protocol, no disk. The consequence is worth
+ * naming — restarting the daemon forgets the refusal and the panel goes back
+ * to trusting the file until the next session tries. (A saved account also
+ * carries a mark on disk, D2 – see `markLoginExpired` in `claude-homes.ts`.)
+ */
+/** The machine's own login – the one row every agent has. */
+export const MACHINE_ACCOUNT_ID = 'machine';
+const ACCOUNT_ID = /^[a-z0-9]{12}$/;
+/**
+ * A saved account's id – twelve lowercase letters and digits, never `machine`.
+ * One format for both agents (#422 S4): the wire, the refusal marks and the
+ * dashboard read the same alphabet whichever agent a row belongs to.
+ */
+export function isAccountId(id) {
+    return typeof id === 'string' && ACCOUNT_ID.test(id);
+}
+/** A refusal meant for a person: the wire (S2) sends its message as it is, and it names no path. */
+export class AccountError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'AccountError';
+    }
+}
+export function newAccountId() {
+    // base32-ish from random bytes: 12 characters of [a-z0-9].
+    const alphabet = 'abcdefghijklmnopqrstuvwxyz0123456789';
+    const bytes = crypto.randomBytes(12);
+    return Array.from(bytes, (byte) => alphabet[byte % alphabet.length]).join('');
+}
+const AUTH_FAILURE_TTL_MS = 15 * 60_000;
+const refusals = new Map();
+const keyOf = (agent, accountId) => `${agent}:${accountId}`;
+/** A session under this agent and account was just refused. */
+export function noteRefusal(agent, accountId = MACHINE_ACCOUNT_ID) {
+    refusals.set(keyOf(agent, accountId), Date.now());
+}
+/** The sign-in worked again. Answers whether a refusal was being held. */
+export function clearRefusal(agent, accountId = MACHINE_ACCOUNT_ID) {
+    return refusals.delete(keyOf(agent, accountId));
+}
+/** Is a refusal still being held against this agent and account? */
+export function refusalActive(agent, accountId = MACHINE_ACCOUNT_ID) {
+    const key = keyOf(agent, accountId);
+    const at = refusals.get(key);
+    if (at === undefined)
+        return false;
+    if (Date.now() - at > AUTH_FAILURE_TTL_MS) {
+        refusals.delete(key);
+        return false;
+    }
+    return true;
+}
+//# sourceMappingURL=login-marks.js.map

package/dist/protocol.d.ts

@@ -235,11 +235,11 @@ export declare const SessionDescriptorSchema: z.ZodObject<{
         token: string;
     }>>;
 }, "strip", z.ZodTypeAny, {
-    mode: "ask" | "plan" | "auto" | "full";
-    agent: "CLAUDE" | "CODEX";
-    status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
+    mode: "plan" | "ask" | "auto" | "full";
     id: string;
+    status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
     kind: "TICKET" | "CHAT";
+    agent: "CLAUDE" | "CODEX";
     model: string | null;
     effort: string | null;
     prompt: string;
@@ -286,10 +286,10 @@ export declare const SessionDescriptorSchema: z.ZodObject<{
         baseSha?: string | undefined;
     } | undefined;
 }, {
-    agent: "CLAUDE" | "CODEX";
-    status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
     id: string;
+    status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
     kind: "TICKET" | "CHAT";
+    agent: "CLAUDE" | "CODEX";
     prompt: string;
     providerSessionId: string | null;
     workspace: {
@@ -316,7 +316,7 @@ export declare const SessionDescriptorSchema: z.ZodObject<{
         url: string;
         token: string;
     } | undefined;
-    mode?: "ask" | "plan" | "auto" | "full" | undefined;
+    mode?: "plan" | "ask" | "auto" | "full" | undefined;
     workMode?: unknown;
     model?: string | null | undefined;
     effort?: string | null | undefined;
@@ -385,8 +385,8 @@ export declare const QuestionAnswerArgsSchema: z.ZodObject<{
     }>, "many">>;
     readonly text: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    askId: string;
     action: "answer" | "discuss";
+    askId: string;
     text?: string | undefined;
     answers?: {
         values: string[];
@@ -395,8 +395,8 @@ export declare const QuestionAnswerArgsSchema: z.ZodObject<{
         notes?: string | undefined;
     }[] | undefined;
 }, {
-    askId: string;
     action: "answer" | "discuss";
+    askId: string;
     text?: string | undefined;
     answers?: {
         values: string[];
@@ -685,11 +685,11 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             token: string;
         }>>;
     }, "strip", z.ZodTypeAny, {
-        mode: "ask" | "plan" | "auto" | "full";
-        agent: "CLAUDE" | "CODEX";
-        status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
+        mode: "plan" | "ask" | "auto" | "full";
         id: string;
+        status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
         kind: "TICKET" | "CHAT";
+        agent: "CLAUDE" | "CODEX";
         model: string | null;
         effort: string | null;
         prompt: string;
@@ -736,10 +736,10 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             baseSha?: string | undefined;
         } | undefined;
     }, {
-        agent: "CLAUDE" | "CODEX";
-        status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
         id: string;
+        status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
         kind: "TICKET" | "CHAT";
+        agent: "CLAUDE" | "CODEX";
         prompt: string;
         providerSessionId: string | null;
         workspace: {
@@ -766,7 +766,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             url: string;
             token: string;
         } | undefined;
-        mode?: "ask" | "plan" | "auto" | "full" | undefined;
+        mode?: "plan" | "ask" | "auto" | "full" | undefined;
         workMode?: unknown;
         model?: string | null | undefined;
         effort?: string | null | undefined;
@@ -785,11 +785,11 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
 }, "strip", z.ZodTypeAny, {
     type: "hello_ack";
     sessions: {
-        mode: "ask" | "plan" | "auto" | "full";
-        agent: "CLAUDE" | "CODEX";
-        status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
+        mode: "plan" | "ask" | "auto" | "full";
         id: string;
+        status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
         kind: "TICKET" | "CHAT";
+        agent: "CLAUDE" | "CODEX";
         model: string | null;
         effort: string | null;
         prompt: string;
@@ -842,10 +842,10 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
 }, {
     type: "hello_ack";
     sessions: {
-        agent: "CLAUDE" | "CODEX";
-        status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
         id: string;
+        status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
         kind: "TICKET" | "CHAT";
+        agent: "CLAUDE" | "CODEX";
         prompt: string;
         providerSessionId: string | null;
         workspace: {
@@ -872,7 +872,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             url: string;
             token: string;
         } | undefined;
-        mode?: "ask" | "plan" | "auto" | "full" | undefined;
+        mode?: "plan" | "ask" | "auto" | "full" | undefined;
         workMode?: unknown;
         model?: string | null | undefined;
         effort?: string | null | undefined;
@@ -1154,11 +1154,11 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             token: string;
         }>>;
     }, "strip", z.ZodTypeAny, {
-        mode: "ask" | "plan" | "auto" | "full";
-        agent: "CLAUDE" | "CODEX";
-        status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
+        mode: "plan" | "ask" | "auto" | "full";
         id: string;
+        status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
         kind: "TICKET" | "CHAT";
+        agent: "CLAUDE" | "CODEX";
         model: string | null;
         effort: string | null;
         prompt: string;
@@ -1205,10 +1205,10 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             baseSha?: string | undefined;
         } | undefined;
     }, {
-        agent: "CLAUDE" | "CODEX";
-        status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
         id: string;
+        status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
         kind: "TICKET" | "CHAT";
+        agent: "CLAUDE" | "CODEX";
         prompt: string;
         providerSessionId: string | null;
         workspace: {
@@ -1235,7 +1235,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             url: string;
             token: string;
         } | undefined;
-        mode?: "ask" | "plan" | "auto" | "full" | undefined;
+        mode?: "plan" | "ask" | "auto" | "full" | undefined;
         workMode?: unknown;
         model?: string | null | undefined;
         effort?: string | null | undefined;
@@ -1253,11 +1253,11 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
     }>;
 }, "strip", z.ZodTypeAny, {
     session: {
-        mode: "ask" | "plan" | "auto" | "full";
-        agent: "CLAUDE" | "CODEX";
-        status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
+        mode: "plan" | "ask" | "auto" | "full";
         id: string;
+        status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
         kind: "TICKET" | "CHAT";
+        agent: "CLAUDE" | "CODEX";
         model: string | null;
         effort: string | null;
         prompt: string;
@@ -1307,10 +1307,10 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
     type: "session_start";
 }, {
     session: {
-        agent: "CLAUDE" | "CODEX";
-        status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
         id: string;
+        status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
         kind: "TICKET" | "CHAT";
+        agent: "CLAUDE" | "CODEX";
         prompt: string;
         providerSessionId: string | null;
         workspace: {
@@ -1337,7 +1337,7 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             url: string;
             token: string;
         } | undefined;
-        mode?: "ask" | "plan" | "auto" | "full" | undefined;
+        mode?: "plan" | "ask" | "auto" | "full" | undefined;
         workMode?: unknown;
         model?: string | null | undefined;
         effort?: string | null | undefined;
@@ -1440,8 +1440,8 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
 }, "strip", z.ZodTypeAny, {
     sessionId: string;
     type: "question_answer";
-    askId: string;
     action: "answer" | "discuss";
+    askId: string;
     text?: string | undefined;
     answers?: {
         values: string[];
@@ -1452,8 +1452,8 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
 }, {
     sessionId: string;
     type: "question_answer";
-    askId: string;
     action: "answer" | "discuss";
+    askId: string;
     text?: string | undefined;
     answers?: {
         values: string[];
@@ -1513,8 +1513,8 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
 }, "strip", z.ZodTypeAny, {
     type: "workspace_settings";
     workspaceId: string;
-    agentAutoCommit?: boolean | undefined;
     trustMode?: "STRICT" | "NORMAL" | "AUTO" | undefined;
+    agentAutoCommit?: boolean | undefined;
     agentPushBan?: boolean | undefined;
     agentProtectedBranches?: string[] | undefined;
     agentAllowForcePush?: boolean | undefined;
@@ -1523,8 +1523,8 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
 }, {
     type: "workspace_settings";
     workspaceId: string;
-    agentAutoCommit?: boolean | undefined;
     trustMode?: "STRICT" | "NORMAL" | "AUTO" | undefined;
+    agentAutoCommit?: boolean | undefined;
     agentPushBan?: boolean | undefined;
     agentProtectedBranches?: string[] | undefined;
     agentAllowForcePush?: boolean | undefined;
@@ -1539,13 +1539,13 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
 }, "strip", z.ZodTypeAny, {
     sessionId: string;
     type: "session_settings";
-    mode?: "ask" | "plan" | "auto" | "full" | undefined;
+    mode?: "plan" | "ask" | "auto" | "full" | undefined;
     model?: string | undefined;
     effort?: string | null | undefined;
 }, {
     sessionId: string;
     type: "session_settings";
-    mode?: "ask" | "plan" | "auto" | "full" | undefined;
+    mode?: "plan" | "ask" | "auto" | "full" | undefined;
     model?: string | undefined;
     effort?: string | null | undefined;
 }>, z.ZodObject<{

package/dist/protocol.js

@@ -430,7 +430,9 @@ export const GatewayFrameSchema = z.discriminatedUnion('type', [
         // git_branches, update_from_base, git_push, git_refs, workspace_state,
         // recipe_state, verify_start, verify_status, verify_cancel,
         // preview_checkout, preview_stop, propose_commit_message, git_stage,
-        // git_unstage, git_discard, git_pull, git_merge_abort, fs_publish.
+        // git_unstage, git_discard, git_pull, git_merge_abort, fs_publish,
+        // agent_accounts, agent_account_login_start, agent_account_login_code,
+        // agent_account_activate, agent_account_forget (#422).
         name: z.string().min(1).max(64),
         workspaceId: z.string().optional(),
         sessionId: z.string().optional(),

package/dist/supervisor.js

@@ -19,6 +19,7 @@ import { applySession, gitBranches, gitCommit, gitDiff, gitLog, gitPush, gitRefs
 import { fsView } from './fsview.js';
 import { publishFile } from './file-publish.js';
 import { agentAuthStatuses, AuthRelay, clearAgentAuthFailure, noteAgentAuthFailure, } from './auth-relay.js';
+import { isAccountCommand, runAccountCommand } from './account-commands.js';
 import { isSupervisedProcess, selfUpdate } from './self-update.js';
 import { installAgent } from './agent-install.js';
 import { autoUpdateRefusal, claimAgentAutoUpdate } from './agent-auto-update.js';
@@ -2702,7 +2703,7 @@ export class Supervisor {
         const { descriptor } = running;
         try {
             for await (const event of session.events) {
-                this.forwardEvent(running, event);
+                this.forwardEvent(running, event, session);
             }
         }
         catch (error) {
@@ -3618,7 +3619,14 @@ export class Supervisor {
         this.syncBudgetClock(running);
         this.reportStatus(running.descriptor.id, 'RUNNING', {});
     }
-    forwardEvent(running, event) {
+    forwardEvent(running, event, 
+    /**
+     * The process this event came from (#422). A refusal and a working turn are
+     * attributed to the account THAT process started under – read off the
+     * session that produced the event, not off whatever holds the slot by the
+     * time the event is handled.
+     */
+    source = running.session) {
         const { descriptor } = running;
         // Ticket #225: ANY event is the process proving it came up — its own
         // capabilities probe answers within about two seconds of a healthy launch,
@@ -3812,7 +3820,7 @@ export class Supervisor {
                 if (event.code === 'auth_expired') {
                     const refused = relayAgent(String(descriptor.agent).toLowerCase());
                     if (refused)
-                        noteAgentAuthFailure(refused);
+                        noteAgentAuthFailure(refused, source?.accountId);
                 }
                 // Only `auth_missing` is worth a relaunch, and the distinction is the
                 // adapter's own (`probeAuth`), not a guess from prose.
@@ -3917,7 +3925,7 @@ export class Supervisor {
                 if (event.role === 'assistant') {
                     const working = relayAgent(String(descriptor.agent).toLowerCase());
                     if (working)
-                        clearAgentAuthFailure(working);
+                        clearAgentAuthFailure(working, source?.accountId);
                 }
                 this.sendEvent(running, 'message', { role: event.role, text: event.text });
                 return;
@@ -7483,6 +7491,11 @@ export class Supervisor {
                     });
                 }
                 default:
+                    // #422: the five account commands – their own module, one door each
+                    // over `claude-homes.ts` (plan §8).
+                    if (isAccountCommand(frame.name)) {
+                        return void reply(await runAccountCommand(frame.name, frame.args ?? {}, this.authRelay));
+                    }
                     return void reply({ ok: false, error: `Unknown command` });
             }
         }

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const RUNNER_VERSION = "0.65.1";
+export declare const RUNNER_VERSION = "0.67.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in sync with package.json by the release script (manual for now).
-export const RUNNER_VERSION = '0.65.1';
+export const RUNNER_VERSION = '0.67.0';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge4dev/runner",
-  "version": "0.65.1",
+  "version": "0.67.0",
   "description": "DevBridge dev runner — connects a dev server to DevBridge and runs agent sessions (Claude Code / Codex)",
   "homepage": "https://bridge4.dev",
   "license": "MIT",