@bridge4dev/runner 0.65.1 → 0.67.0

package/dist/auth-relay.js

@@ -6,9 +6,12 @@ import { promisify } from 'node:util';
 import { log } from './log.js';
 import { maskString } from './policy.js';
 import { runnerIdentity, whichExecutable } from './environment.js';
-import { applyStoredClaudeToken, clearStoredClaudeToken, extractOauthToken, storeClaudeToken, storedClaudeToken, } from './agent-auth.js';
+import { applyStoredClaudeToken, environmentCarriesStoredToken, extractOauthToken, readAgentAuth, storeClaudeToken, } from './agent-auth.js';
 import { invalidateUsageCache } from './adapters/claude-usage.js';
-import { adoptLoginResult, discardStagingHome, prepareStagingHome, repairCodexAuth, stagingCodexHomePath, } from './adapters/codex-home.js';
+import { AccountError, activeAccountId, adoptLoginResult as adoptClaudeLogin, buildAccountList, clearLoginExpired, discardStagingHome as discardClaudeStagingHome, identityProbeEnv, machineLoginStatus, markLoginExpired, prepareStagingHome as prepareClaudeStagingHome, readActiveAccountSummary, refreshAccountIdentity, savedLoginStatus, setActiveAccount, } from './claude-homes.js';
+import { MACHINE_ACCOUNT_ID, clearRefusal, noteRefusal, refusalActive } from './login-marks.js';
+import { adoptLoginResult as adoptCodexLogin, discardStagingHome as discardCodexStagingHome, prepareStagingHome as prepareCodexStagingHome, readCodexCredentialFile, repairCodexAuth, } from './adapters/codex-home.js';
+import { activeCodexAccountId, clearCodexLoginExpired, codexActiveAccountSummary, codexRowRefused, markCodexLoginExpired, } from './codex-accounts.js';
 const execFileAsync = promisify(execFile);
 /* eslint-disable no-control-regex -- this module parses raw pty output, so
    matching ANSI/OSC escape bytes (\x1b, \x07) is exactly the point. */
@@ -19,7 +22,13 @@ const CODE_EXCHANGE_TIMEOUT_MS = 60_000;
 const RELAY_MAX_LIFETIME_MS = 16 * 60_000;
 const URL_PATTERNS = {
     claude: /https:\/\/(?:claude\.com|claude\.ai)\/[^\s\x07\x1b"']+/,
-    codex: /https:\/\/[^\s\x07\x1b"']+/,
+    // A page a person opens, never an endpoint of the provider's API (D26, S4 item
+    // 5a). When codex fails to get a device code it prints «Error logging in with
+    // device code: error sending request for url
+    // (https://auth.openai.com/api/accounts/deviceauth/usercode)», and the old
+    // any-https pattern handed that address to the window as the sign-in link –
+    // without a code, onto a page that answers «Authentication Error».
+    codex: /https:\/\/(?![^\s\x07\x1b"']*\/api\/)[^\s\x07\x1b"']+/,
 };
 /**
  * Rejoin a secret the pty split across lines, so the masker can see it.
@@ -63,7 +72,16 @@ export function extractLoginUrl(agent, raw) {
  * outside DevBridge) — that one corrects itself within the cache interval.
  */
 function forgetClaudeUsage() {
-    invalidateUsageCache();
+    // The machine's slots only (#422 R16): the slot of the subscription the
+    // machine WAS, and the one of a machine nobody has identified yet. A saved
+    // account's figures are not touched by a sign-in to the machine.
+    // The identity ON FILE, not the checked one: by now the new login has
+    // rewritten the home, so the checked identity is already «contradicted» and
+    // would name nothing – and the slot to drop is the one of the login replaced.
+    const known = readAgentAuth().claudeMachine?.lastSeenIdentity?.orgId;
+    if (known)
+        invalidateUsageCache({ id: MACHINE_ACCOUNT_ID, orgId: known });
+    invalidateUsageCache({ id: MACHINE_ACCOUNT_ID });
 }
 export function extractDeviceCode(raw) {
     // Device-auth user codes look like XXXX-XXXX (letters/digits).
@@ -172,6 +190,75 @@ export class AuthRelay {
     /** Start (or restart) a login flow and wait until the sign-in URL appears. */
     async start(agent) {
         this.cancel();
+        this.assertCanRun(agent);
+        try {
+            return await this.startWith(agent, this.commands[agent] ?? '', false, {
+                flow: 'legacy',
+                target: 'machine',
+            });
+        }
+        catch (error) {
+            // Only the one recoverable shape: a `claude` too old to have `auth
+            // login`. Everything else is the answer, not a reason to try again.
+            if (agent !== 'claude' || !looksLikeUnsupportedSubcommand(String(error)))
+                throw error;
+            log.warn('auth-relay: this claude has no `auth login` — falling back to setup-token');
+            return this.startWith(agent, CLAUDE_LEGACY_LOGIN, true, {
+                flow: 'legacy',
+                target: 'machine',
+            });
+        }
+    }
+    /**
+     * `agent_account_login_start` for Claude (#422 §8, R2).
+     *
+     * `saved` signs in inside a fresh staging home (`CLAUDE_CONFIG_DIR`), which
+     * becomes a saved account only when the code is accepted – the machine's own
+     * login is not touched by it at all. `machine` is today's sign-in into
+     * `~/.claude`, the one legitimate way to write that file, pressed by a person.
+     *
+     * Either way the CLI runs WITHOUT the operator's `CLAUDE_CODE_OAUTH_TOKEN`
+     * (and API keys): the CLI puts that variable above every login file, so a
+     * sign-in started with it could report the token's blind identity instead of
+     * the account that just signed in.
+     *
+     * No `setup-token` fallback for `saved`: that command stores nothing in a home
+     * (it prints an inference-only token, D1), so a «saved account» made from it
+     * would be a row with no login. `machine` keeps the fallback it always had.
+     */
+    async startAccountLogin(target, agent = 'claude') {
+        if (agent === 'codex') {
+            // R13: the machine row of Codex is the host user's own `~/.codex/auth.json`,
+            // which DevBridge has never written and does not start writing. A sign-in
+            // from the window always adds (or renews) a saved login.
+            if (target === 'machine') {
+                throw new AccountError('the login of this machine is the Codex login of its own user – sign in again in the terminal on the machine (`codex login`)');
+            }
+            this.cancel();
+            this.assertCanRun('codex');
+            return this.startWith('codex', this.commands.codex ?? '', false, {
+                flow: 'account',
+                target: 'saved',
+            });
+        }
+        this.cancel();
+        this.assertCanRun('claude');
+        const command = this.commands.claude ?? '';
+        try {
+            return await this.startWith('claude', command, false, { flow: 'account', target });
+        }
+        catch (error) {
+            if (!looksLikeUnsupportedSubcommand(String(error)))
+                throw error;
+            if (target === 'saved') {
+                throw new Error('the Claude CLI on this server is too old to sign in to a saved account – update Claude Code and try again', { cause: error });
+            }
+            log.warn('auth-relay: this claude has no `auth login` — falling back to setup-token');
+            return this.startWith('claude', CLAUDE_LEGACY_LOGIN, true, { flow: 'account', target });
+        }
+    }
+    /** The CLI and the pty helper are both there – or a sentence saying which is not. */
+    assertCanRun(agent) {
         const command = this.commands[agent] ?? '';
         if (!commandExists(command)) {
             const binary = command.trim().split(/\s+/)[0] ?? agent;
@@ -184,30 +271,34 @@ export class AuthRelay {
             // util-linux, and the only reason a pty exists here at all.
             throw new Error('the `script` command (util-linux) is missing on this server — the sign-in needs it to run the agent CLI on a terminal');
         }
-        try {
-            return await this.startWith(agent, this.commands[agent] ?? '', false);
-        }
-        catch (error) {
-            // Only the one recoverable shape: a `claude` too old to have `auth
-            // login`. Everything else is the answer, not a reason to try again.
-            if (agent !== 'claude' || !looksLikeUnsupportedSubcommand(String(error)))
-                throw error;
-            log.warn('auth-relay: this claude has no `auth login` — falling back to setup-token');
-            return this.startWith(agent, CLAUDE_LEGACY_LOGIN, true);
-        }
     }
-    async startWith(agent, command, captureToken) {
+    async startWith(agent, command, captureToken, door) {
         this.cancel();
         // Codex logs into a THROWAWAY home and is promoted only on success. The
         // old flow deleted the shared credential link up front, so abandoning the
         // sign-in (or letting it time out) left the server permanently signed out
         // with no way back except restarting the daemon — and writing through the
         // link would have overwritten the host user's own account (QA-100 MINOR-5).
-        const stagingHome = agent === 'codex' ? prepareStagingHome() : null;
+        // Whichever door started it, the result is a saved login (#422 S4): Codex
+        // has no «machine login» DevBridge may write.
+        const stagingHome = agent === 'codex' ? prepareCodexStagingHome() : null;
+        // A saved Claude account signs in inside its own staging home (#422 R2).
+        // `captureToken` never reaches here with `saved` – see `startAccountLogin`.
+        const claudeStaging = agent === 'claude' && door.flow === 'account' && door.target === 'saved'
+            ? prepareClaudeStagingHome()
+            : null;
         const proc = spawn('script', ['-qec', command, '/dev/null'], {
             stdio: ['pipe', 'pipe', 'pipe'],
-            // Codex must log in to a home WE control, never the host user's ~/.codex.
-            env: relayEnv(stagingHome ? { CODEX_HOME: stagingHome } : {}),
+            env: stagingHome
+                ? // Codex must log in to a home WE control, never the host user's ~/.codex –
+                    // whichever door started it (the account door once ran it without this
+                    // variable, and the CLI wrote its login into the user's own home).
+                    relayEnv({ CODEX_HOME: stagingHome })
+                : door.flow === 'account'
+                    ? // The staging home, or the machine's own `~/.claude` (no variable);
+                        // and in both, no operator token and no API key (§8).
+                        identityProbeEnv(claudeStaging, relayEnv())
+                    : relayEnv(),
         });
         const relay = {
             agent,
@@ -217,7 +308,15 @@ export class AuthRelay {
             exitCode: null,
             command,
             captureToken,
-            killTimer: setTimeout(() => this.cancel(), RELAY_MAX_LIFETIME_MS),
+            flow: door.flow,
+            target: door.target,
+            claudeStaging,
+            codexStaging: stagingHome,
+            exchanging: false,
+            killTimer: setTimeout(() => {
+                if (this.active === relay)
+                    this.cancel();
+            }, RELAY_MAX_LIFETIME_MS),
         };
         relay.killTimer.unref();
         this.active = relay;
@@ -233,28 +332,41 @@ export class AuthRelay {
             // exits once the browser side is confirmed. That exit IS the completion
             // signal — promote the staging credential, or throw it away.
             //
-            // Only when this relay is still the current one: the staging home is a
-            // single fixed path, so a cancelled login's exit handler firing late
-            // would otherwise delete the home a NEW login is already writing into.
-            if (relay.agent !== 'codex' || this.active !== relay)
+            // Only when this relay is still the current one: a cancelled login was
+            // abandoned (its home removed) by whoever took the slot, and its late exit
+            // must not store anything in its name.
+            if (relay.agent !== 'codex' || this.active !== relay || !relay.codexStaging)
                 return;
+            if (code !== 0) {
+                this.discardStaging(relay);
+                return;
+            }
+            const staging = relay.codexStaging;
+            relay.codexStaging = null;
             try {
-                if (code === 0 && adoptLoginResult(stagingCodexHomePath())) {
-                    log.info('codex: device login completed — credential adopted');
-                    // The ONLY place a Codex sign-in can be reported as finished. Its
-                    // flow never sends `login_code` (device auth needs no paste-back),
-                    // so without this line a refusal we recorded earlier would keep the
-                    // panel demanding a re-login the user has just done — #121's own
-                    // complaint, reproduced on the other half of the panel (QA-117 H1).
-                    clearAgentAuthFailure('codex');
-                }
-                else {
-                    discardStagingHome();
-                }
+                // By rename, one subscription – one row, and the signed-in row is the one
+                // new sessions start under (S4 item 5, R15). The window learns it from the
+                // list (§8: device sign-in finishes without `login_code`).
+                // The one-login window's door (`flow: 'legacy'`) replaces the login in
+                // use instead of adding a row beside it: with the organization's option
+                // off, «a token overwrites the token» is what a sign-in has always meant
+                // (D27), and DevBridge writes no machine login for Codex to overwrite.
+                const stored = adoptCodexLogin(staging, { replaceActive: relay.flow === 'legacy' });
+                log.info('codex: device login completed — credential stored', {
+                    account: stored.id,
+                    replaced: Boolean(stored.replaced),
+                });
+                // The ONLY place a Codex sign-in can be reported as finished. Its
+                // flow never sends `login_code` (device auth needs no paste-back),
+                // so without this line a refusal we recorded earlier would keep the
+                // panel demanding a re-login the user has just done — #121's own
+                // complaint, reproduced on the other half of the panel (QA-117 H1).
+                clearAgentAuthFailure('codex', stored.id);
             }
             catch (error) {
-                log.warn('codex: could not finish the device login', { error: String(error) });
-                discardStagingHome();
+                log.warn('codex: could not finish the device login', {
+                    error: maskString(String(error)).slice(0, 300),
+                });
             }
         });
         proc.on('error', (error) => {
@@ -265,18 +377,32 @@ export class AuthRelay {
         const deadline = Date.now() + URL_START_TIMEOUT_MS;
         for (;;) {
             const url = extractLoginUrl(agent, relay.buffer);
-            if (url) {
-                const code = agent === 'codex' ? extractDeviceCode(relay.buffer) : null;
+            // Codex: a link is half of the sign-in, the one-time code the other half,
+            // and the CLI prints them on two lines that can arrive in two reads. A link
+            // without its code sends the person to a page that asks for something the
+            // window never showed (D26) – so both, or the CLI's own words about why not.
+            const code = agent === 'codex' ? extractDeviceCode(relay.buffer) : null;
+            const ready = url !== null && (agent !== 'codex' || code !== null);
+            if (ready && this.active !== relay) {
+                // A newer start took the slot while this one waited: its CLI is killed,
+                // and a link to it would lead nowhere – a code pasted for it would reach
+                // the newer CLI (found by the tests of the S2 check).
+                this.abandon(relay);
+                throw new Error('a newer sign-in was started on this server – use its link');
+            }
+            if (ready && url) {
                 return { url, ...(code ? { code } : {}), expectsCode: agent === 'claude' };
             }
             if (relay.exited) {
                 const tail = maskString(rejoinWrappedSecrets(stripControl(relay.buffer))).slice(-400);
-                this.cancel();
+                this.abandon(relay);
                 throw new Error(`${agent} login exited before printing a sign-in URL: ${tail}`);
             }
             if (Date.now() > deadline) {
-                this.cancel();
-                throw new Error(`${agent} login did not print a sign-in URL in time`);
+                this.abandon(relay);
+                throw new Error(url
+                    ? `${agent} login printed a link but no one-time code in time – start again`
+                    : `${agent} login did not print a sign-in URL in time`);
             }
             await sleep(200);
         }
@@ -284,41 +410,137 @@ export class AuthRelay {
     /** Paste the confirmation code back into the waiting CLI (Claude flow). */
     async submitCode(agent, code) {
         const relay = this.active;
-        if (!relay || relay.agent !== agent) {
+        // A sign-in started through the account commands is finished only by them.
+        if (!relay || relay.agent !== agent || relay.flow !== 'legacy') {
             return { ok: false, detail: 'No login in progress — start again' };
         }
+        const exchanged = await this.exchangeCode(relay, code);
+        if (!('raw' in exchanged))
+            return exchanged;
+        // Exit 0 is the CLI's opinion. Ours has to be «is this machine signed
+        // in now», because those two came apart before and nobody noticed for
+        // weeks: `setup-token` exits 0 over a credential it never stored.
+        return this.confirmSignedIn(relay, exchanged.raw);
+    }
+    /**
+     * `agent_account_login_code` – finish a sign-in the account commands started.
+     *
+     * `saved`: the staging home is adopted by rename – one subscription, one row,
+     * the signed-in row active (`adoptLoginResult`, R15). `machine`: the same
+     * check the old door makes, then the machine login becomes active and its
+     * identity is asked once, so the answer names who ACTUALLY signed in (§2:
+     * «Signed in as B, not A») rather than who the machine was before.
+     */
+    async submitAccountCode(code) {
+        const relay = this.active;
+        if (!relay || relay.agent !== 'claude' || relay.flow !== 'account') {
+            return { ok: false, detail: 'No login in progress – start again' };
+        }
+        const exchanged = await this.exchangeCode(relay, code);
+        if (!('raw' in exchanged)) {
+            return { ok: false, detail: exchanged.detail ?? 'Login failed' };
+        }
+        // The door and the target that STARTED the sign-in decide how it ends (§8,
+        // R2): a saved sign-in is never finished as the machine's, even when its
+        // staging home was removed in the moment between the CLI's exit and this
+        // line (found by the independent check of S2).
+        if (relay.target === 'saved') {
+            if (!relay.claudeStaging) {
+                return {
+                    ok: false,
+                    detail: 'the sign-in was abandoned before it could be saved – start again',
+                };
+            }
+            try {
+                const adopted = await adoptClaudeLogin(relay.claudeStaging);
+                // Adopted: the staging path no longer exists, nothing left to remove.
+                relay.claudeStaging = null;
+                clearAgentAuthFailure('claude', adopted.account.id);
+                return {
+                    ok: true,
+                    account: adopted.account,
+                    active: adopted.active,
+                    ...(adopted.replaced ? { replaced: adopted.replaced } : {}),
+                };
+            }
+            catch (error) {
+                this.discardStaging(relay);
+                return {
+                    ok: false,
+                    detail: error instanceof AccountError
+                        ? error.message
+                        : maskString(String(error instanceof Error ? error.message : error)).slice(0, 400),
+                };
+            }
+        }
+        const confirmed = await this.confirmSignedIn(relay, exchanged.raw);
+        if (!confirmed.ok)
+            return { ok: false, detail: confirmed.detail ?? 'Login failed' };
+        // R14 (b): one ask, at the adoption of a sign-in – the login file was just
+        // rewritten, and the list must not name the previous subscription.
+        await refreshAccountIdentity(MACHINE_ACCOUNT_ID, { force: true }).catch(() => null);
+        const list = buildAccountList();
+        const account = list.accounts.find((row) => row.id === MACHINE_ACCOUNT_ID);
+        if (!account)
+            return { ok: false, detail: 'the machine login is missing from the list' };
+        return { ok: true, account, active: list.active };
+    }
+    /**
+     * Write the code, wait for the CLI's answer.
+     *
+     * `{ raw }` – the CLI exited 0 and the relay is released (its staging home, if
+     * any, is kept for the caller to adopt). Anything else is the answer to hand
+     * back: a non-zero exit or a timeout ends the sign-in; a line saying «invalid»
+     * keeps it alive, because the CLI usually asks again.
+     */
+    async exchangeCode(relay, code) {
+        // Checked before «exited», and in the same tick as the flag is set below: a
+        // second code arriving in the up to 300 ms between the CLI's exit and the
+        // running loop's next look used to take that exit as ITS cue to abandon the
+        // sign-in – and removed the staging home with the login the CLI had just
+        // written (found by the second independent check of S2).
+        if (relay.exchanging) {
+            return {
+                ok: false,
+                detail: 'A code for this sign-in is already being checked – wait for its answer',
+            };
+        }
         if (relay.exited) {
-            this.cancel();
+            this.abandon(relay);
             return { ok: false, detail: 'The login process has already exited — start again' };
         }
-        relay.proc.stdin?.write(`${code.trim()}\n`);
-        const deadline = Date.now() + CODE_EXCHANGE_TIMEOUT_MS;
-        const bufferMark = relay.buffer.length;
-        while (Date.now() < deadline) {
-            const fresh = stripControl(relay.buffer.slice(bufferMark));
-            if (relay.exited) {
-                const raw = relay.buffer;
-                this.cancel();
-                if (relay.exitCode !== 0) {
-                    return {
-                        ok: false,
-                        detail: maskString(rejoinWrappedSecrets(fresh)).slice(-400) || 'Login failed',
-                    };
+        relay.exchanging = true;
+        try {
+            relay.proc.stdin?.write(`${code.trim()}\n`);
+            const deadline = Date.now() + CODE_EXCHANGE_TIMEOUT_MS;
+            const bufferMark = relay.buffer.length;
+            while (Date.now() < deadline) {
+                const fresh = stripControl(relay.buffer.slice(bufferMark));
+                if (relay.exited) {
+                    const raw = relay.buffer;
+                    if (relay.exitCode !== 0) {
+                        this.abandon(relay);
+                        return {
+                            ok: false,
+                            detail: maskString(rejoinWrappedSecrets(fresh)).slice(-400) || 'Login failed',
+                        };
+                    }
+                    this.release(relay);
+                    return { raw };
                 }
-                // Exit 0 is the CLI's opinion. Ours has to be «is this machine signed
-                // in now», because those two came apart before and nobody noticed for
-                // weeks: `setup-token` exits 0 over a credential it never stored.
-                return this.confirmSignedIn(relay, raw);
-            }
-            if (/invalid|error|failed|expired/i.test(fresh)) {
-                // The CLI usually re-prompts after a bad code; surface it and keep
-                // the relay alive so the user can retry with a corrected code.
-                return { ok: false, detail: maskString(rejoinWrappedSecrets(fresh)).trim().slice(-400) };
+                if (/invalid|error|failed|expired/i.test(fresh)) {
+                    // The CLI usually re-prompts after a bad code; surface it and keep
+                    // the relay alive so the user can retry with a corrected code.
+                    return { ok: false, detail: maskString(rejoinWrappedSecrets(fresh)).trim().slice(-400) };
+                }
+                await sleep(300);
             }
-            await sleep(300);
+            this.abandon(relay);
+            return { ok: false, detail: 'Timed out waiting for the login to complete' };
+        }
+        finally {
+            relay.exchanging = false;
         }
-        this.cancel();
-        return { ok: false, detail: 'Timed out waiting for the login to complete' };
     }
     /**
      * The CLI exited 0 — but is the machine actually signed in?
@@ -352,16 +574,21 @@ export class AuthRelay {
             log.info('auth-relay: stored a long-lived Claude token for this runner');
             clearAgentAuthFailure('claude');
             forgetClaudeUsage();
+            activateMachineLogin();
             return { ok: true, detail: 'signed in with a long-lived token stored on this server' };
         }
         // `claude auth login` writes the credential just before it exits; give the
         // filesystem a couple of beats rather than racing it.
-        const probe = this.deps.claudeStatus ?? claudeAuthStatus;
+        // The MACHINE login, explicitly: this relay signs in to `~/.claude`, and with
+        // a saved account active «the active verdict» would be about a different
+        // home than the one this sign-in just wrote (#422).
+        const probe = this.deps.claudeStatus ?? (() => claudeAuthStatus(undefined, { account: 'machine' }));
         for (let attempt = 0; attempt < 4; attempt++) {
             const status = await probe();
             if (status.status === 'ok') {
                 clearAgentAuthFailure('claude');
                 forgetClaudeUsage();
+                activateMachineLogin();
                 return { ok: true };
             }
             await sleep(300);
@@ -374,9 +601,24 @@ export class AuthRelay {
     }
     cancel() {
         const relay = this.active;
-        if (!relay)
-            return;
-        this.active = null;
+        if (relay)
+            this.abandon(relay);
+    }
+    /**
+     * End THIS sign-in: its process, its slot if it still holds it, its staging
+     * home. A loop driving an older sign-in must never end a newer one that took
+     * the slot meanwhile – with `cancel()` in its place, two starts close together
+     * killed each other, and a stale code exchange killed the newer start (found by
+     * the independent check of S2).
+     */
+    abandon(relay) {
+        this.release(relay);
+        this.discardStaging(relay);
+    }
+    /** Stop driving a relay: its process, its timer, its slot. Its staging home stays. */
+    release(relay) {
+        if (this.active === relay)
+            this.active = null;
         clearTimeout(relay.killTimer);
         try {
             relay.proc.kill('SIGKILL');
@@ -385,207 +627,137 @@ export class AuthRelay {
             // already gone
         }
     }
+    /** A sign-in that will not be adopted leaves nothing behind (§8, S2 item 2). */
+    discardStaging(relay) {
+        const claude = relay.claudeStaging;
+        const codex = relay.codexStaging;
+        relay.claudeStaging = null;
+        relay.codexStaging = null;
+        try {
+            if (claude)
+                discardClaudeStagingHome(claude);
+            if (codex)
+                discardCodexStagingHome(codex);
+        }
+        catch (error) {
+            log.warn('auth-relay: could not remove an abandoned sign-in home', {
+                error: String(error),
+            });
+        }
+    }
+}
+/**
+ * A sign-in into the machine's own login makes that login active (#422 R15).
+ *
+ * The old window's sign-in means «this login from now on» – with several logins
+ * switched off for the organization, «a token replaces the token» (D27). A saved
+ * account left active over it would keep every new session on the previous
+ * subscription while the window said the machine was signed in again.
+ */
+function activateMachineLogin() {
+    try {
+        setActiveAccount(MACHINE_ACCOUNT_ID);
+    }
+    catch (error) {
+        log.warn('auth-relay: could not make the machine login active', { error: String(error) });
+    }
 }
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function isNonEmptyString(value) {
-    return typeof value === 'string' && value.length > 0;
-}
+// ─── Auth health probe ───────────────────────────────────────────────
 /**
- * A millisecond timestamp we are willing to hand to `new Date(...)`.
+ * Claude: the verdict on the account the next session starts under (#422 R14).
+ *
+ * The machine login – the pre-#422 rule word for word: the operator's variable,
+ * then `~/.claude/.credentials.json`, then a token this runner captured. A
+ * saved account – ONLY its own credentials file: a session under it has the
+ * operator's token taken out of its environment, so letting the variable or the
+ * captured token answer here would paint a green verdict over a switch that
+ * does not work (#121, К14). Nothing here runs a CLI; the file judge and its
+ * reasons live in `claude-homes.ts` so the account list reads the same lines.
  *
- * The bound is not decoration: `new Date(1e21).toISOString()` throws
- * `RangeError`, and thrown out of here it takes BOTH agents' verdicts down
- * with it (they share one `Promise.all`) on every poll, forever, because only
- * successes are cached (QA-117 M1).
+ * The RUNNER reads these files (its own host user's) — the agent itself is still
+ * denied these paths by layer-1 policy.
+ *
+ * `account: 'machine'` asks about the machine login whatever is active – what the
+ * sign-in relay needs after writing `~/.claude`.
  */
-const MAX_TIMESTAMP_MS = 8.64e15;
-function asTimestamp(value) {
-    if (typeof value !== 'number' || !Number.isFinite(value))
-        return undefined;
-    return Math.abs(value) <= MAX_TIMESTAMP_MS ? value : undefined;
+export async function claudeAuthStatus(homedir = os.homedir(), options = {}) {
+    const id = options.account === 'machine' ? MACHINE_ACCOUNT_ID : activeAccountId();
+    const status = id === MACHINE_ACCOUNT_ID ? machineLoginStatus(homedir) : savedLoginStatus(id);
+    return { ...status, activeAccount: readActiveAccountSummary(id) };
 }
+// ─── What the agent actually experienced ─────────────────────────────
+//
+// The memory itself lives in `login-marks.ts` since #422 – keyed by agent AND
+// account, because the list of accounts and this verdict must agree on it.
 /**
- * Claude: the subscription login is recorded in the CLI's own credentials file.
- * The RUNNER reads it (its own host user's file) — the agent itself is still
- * denied this path by layer-1 policy.
- *
- * `expiresAt` is NOT the login. It is the expiry of a short-lived access token
- * (~8 hours on a live file), and next to it sits `refreshToken` with
- * `refreshTokenExpiresAt` ~26 days out, which the CLI spends silently on its
- * next run. Judging the login by `expiresAt` alone is why every server nobody
- * had touched since the morning reported "login expired — re-login needed"
- * over a login that was good for another three weeks (#121). Codex has carried
- * exactly this guard since day one (`readCodexCredential`); Claude did not.
+ * A session just failed to authenticate as this agent – under this account.
  *
- * Deliberately NOT asking the CLI. `claude auth status --json` looks like an
- * arbiter and is not one: measured live (SDK binary 2.1.218), it answers
- * `loggedIn: true` for a credential whose access token has expired AND which
- * carries no refresh token at all — i.e. for a genuinely dead login. It never
- * leaves the machine, so it cannot see a server-side revocation either. It
- * would have cost a ~800 ms / ~300 MB subprocess per poll under `MemoryMax=2G`
- * (gotcha #100) and echoed the account's e-mail and org name to every member of
- * the organization, in exchange for no truth at all. A revoked login is caught
- * instead by `noteAgentAuthFailure` below — from a real refusal, not a guess.
+ * `accountId` is the account the SESSION started under (R14), not whatever the
+ * machine has active now. Nothing is deleted any more (#422 S1 item 3, D2): the
+ * old code threw a captured Claude token away on the spot, and that meant
+ * erasing the file the saved accounts are listed in. A Claude refusal is kept as
+ * a mark on the row instead – it outlives a daemon restart, and a login written
+ * after it (a refresh, a new sign-in) outranks it.
  */
-export async function claudeAuthStatus(homedir = os.homedir()) {
-    if (process.env['CLAUDE_CODE_OAUTH_TOKEN']) {
-        return { status: 'ok', detail: 'CLAUDE_CODE_OAUTH_TOKEN is configured' };
-    }
-    /**
-     * A token this runner captured itself (the `setup-token` fallback) is the
-     * LAST word, never the first.
-     *
-     * It used to short-circuit ahead of the credentials file, and that was three
-     * bugs in one line: a real `/login` afterwards could never show through, the
-     * post-exchange re-probe could not fail (so `confirmSignedIn` always agreed
-     * with itself), and there was no way to get back to «signed out» short of
-     * deleting a file nobody documents. Read below, after the file has had its
-     * say — and read from disk rather than from the environment, so `doctor` (a
-     * different process, which never applied it) gives the same verdict as the
-     * daemon.
-     */
-    const fallbackToken = () => storedClaudeToken()
-        ? {
-            status: 'ok',
-            detail: 'signed in with a long-lived token stored on this server',
-        }
-        : null;
-    const file = path.join(homedir, '.claude', '.credentials.json');
-    let raw;
-    try {
-        raw = fs.readFileSync(file, 'utf8');
-    }
-    catch (error) {
-        const code = error.code;
-        // Never signed in here is a different answer from "we could not look".
-        // EACCES on somebody else's HOME used to read as "not signed in", which
-        // sends the user re-authenticating a credential that is sitting right
-        // there (the same mistake #121 is about, one layer down).
-        if (code === 'ENOENT' || code === 'ENOTDIR') {
-            return fallbackToken() ?? { status: 'missing', detail: 'No Claude login on this server' };
+export function noteAgentAuthFailure(agent, accountId = MACHINE_ACCOUNT_ID) {
+    noteRefusal(agent, accountId);
+    log.warn('auth-relay: agent sign-in refused during a session', { agent, account: accountId });
+    if (agent === 'codex') {
+        // A saved Codex login keeps the mark on disk, as a Claude one does (D2) –
+        // but only while it is the login in use. Codex refuses to refresh a session
+        // whose account is no longer the one `auth.json` points at («you have since
+        // signed in to another account»), and that refusal says nothing about the
+        // login of the account the session started under: marking it would put
+        // «sign in again» on a login that is perfectly good (found by the
+        // independent check of S4).
+        if (accountId !== MACHINE_ACCOUNT_ID && accountId === activeCodexAccountId()) {
+            markCodexLoginExpired(accountId);
         }
-        // No `log.warn` here: this probe is on a 60-second timer since #121, and a
-        // machine with EACCES on that file would write the same line forever.
-        // `logVerdictChange` already reports the `unknown`, once, when it starts
-        // (QA-117 L5).
-        return {
-            status: 'unknown',
-            detail: `could not read the login on this server (${code ?? 'unknown error'})`,
-        };
-    }
-    let oauth;
-    try {
-        oauth = JSON.parse(raw).claudeAiOauth;
-    }
-    catch {
-        // Truncated or hand-edited file: the CLI cannot use it either, and signing
-        // in again is the fix — so say `missing` (which offers that button) rather
-        // than `unknown` (which offers nothing).
-        return { status: 'missing', detail: 'the stored login could not be read — sign in again' };
-    }
-    // A parseable file is not a credential. `{"claudeAiOauth":{}}` is what a
-    // partial write and a hand-edit both leave behind, and reading it as a
-    // healthy login puts a green dot and NO way out on the panel — «I cannot
-    // tell» turned into «all good», which is the rule this ticket exists to
-    // uphold, upside down (QA-117 M2).
-    if (!oauth || typeof oauth !== 'object' || Array.isArray(oauth)) {
-        return { status: 'missing', detail: 'the stored login could not be read — sign in again' };
+        return;
     }
-    const hasAccess = isNonEmptyString(oauth.accessToken);
-    const hasRefresh = isNonEmptyString(oauth.refreshToken);
-    const now = Date.now();
-    const accessExpiry = asTimestamp(oauth.expiresAt);
-    const refreshExpiry = asTimestamp(oauth.refreshTokenExpiresAt);
-    // Nothing recognisable in the blob at all — no token, not even a date. That
-    // is «never signed in here», and it must offer the button that fixes it.
-    if (!hasAccess && !hasRefresh && accessExpiry === undefined) {
-        return fallbackToken() ?? { status: 'missing', detail: 'No subscription login found' };
+    if (accountId !== MACHINE_ACCOUNT_ID) {
+        markLoginExpired(accountId);
+        return;
     }
-    // A date we can read outranks the token beside it (the pre-#121 contract, and
-    // the reason a dated-but-token-less fixture still reads as expired); with no
-    // readable date, the presence of the token is all we have.
-    const accessLive = accessExpiry === undefined ? hasAccess : accessExpiry > now;
-    // No `refreshTokenExpiresAt` next to a refresh token means the CLI did not
-    // record one — that is not evidence of death, so we do not read it as death.
-    const refreshLive = hasRefresh && (refreshExpiry === undefined || refreshExpiry > now);
-    // Report the date this login actually dies on, not the one that moves every
-    // eight hours: a panel reading "token until <today>" is alarming and wrong.
-    // Only while the refresh token is the operative one, though — a live access
-    // token beside a dead refresh token dies on its OWN date. And when the CLI
-    // recorded no date for a live refresh token we say NOTHING: printing the
-    // access token's lapsed date beside the word «signed in» is the very screen
-    // this function's docblock promises not to draw (QA-117 M3).
-    const effectiveExpiry = refreshLive ? refreshExpiry : accessExpiry;
-    const expiresAt = effectiveExpiry === undefined ? undefined : new Date(effectiveExpiry).toISOString();
-    if (!accessLive && !refreshLive) {
-        return (fallbackToken() ?? {
-            status: 'expired',
-            ...(expiresAt ? { expiresAt } : {}),
-            detail: 'the stored login has expired',
-        });
+    // The machine row carries a mark on disk only about the token this runner
+    // captured, and only when the refused session ran WITH it. The token then
+    // leaves this daemon's environment, so the next machine session falls back to
+    // the credentials file instead of presenting the same dead token – and a
+    // restart does not put it back (`applyStoredClaudeToken` reads the mark).
+    if (environmentCarriesStoredToken()) {
+        markLoginExpired(MACHINE_ACCOUNT_ID);
+        delete process.env['CLAUDE_CODE_OAUTH_TOKEN'];
+        log.warn('auth-relay: the stored Claude token was refused – no longer used by new sessions');
     }
-    return {
-        status: 'ok',
-        ...(expiresAt ? { expiresAt } : {}),
-        // Only a plain string, and only a short one: this value is read off disk
-        // and printed in every member's panel.
-        ...(isNonEmptyString(oauth.subscriptionType)
-            ? { detail: `subscription ${oauth.subscriptionType.slice(0, 40)}` }
-            : {}),
-    };
 }
-// ─── What the agent actually experienced ─────────────────────────────
-//
-// The credentials file cannot tell us the provider revoked this login: the
-// refresh token still sits there, dated. The one authority on that is a real
-// refusal from a real run — so a session that failed to authenticate demotes
-// the file's verdict for a while, and any successful turn clears it again.
-//
-// Process memory on purpose: no protocol, no disk. The consequence is worth
-// naming — restarting the daemon forgets the refusal and the panel goes back
-// to trusting the file until the next session tries.
-const AUTH_FAILURE_TTL_MS = 15 * 60_000;
-const authFailures = new Map();
-/** A session just failed to authenticate as this agent. */
-export function noteAgentAuthFailure(agent) {
-    authFailures.set(agent, Date.now());
-    log.warn('auth-relay: agent sign-in refused during a session', { agent });
-    // A refusal is the only authority on a revoked credential, and a token we
-    // captured ourselves has no other expiry we can see. Keeping it would let a
-    // dead login outlive the evidence: the failure marker times out after 15
-    // minutes and the panel would go green again over the same dead token.
-    if (agent === 'claude' && storedClaudeToken()) {
-        clearStoredClaudeToken();
-        log.warn('auth-relay: discarded the stored Claude token after a refusal');
+/** The agent just worked under this account — whatever was wrong with its sign-in is not. */
+export function clearAgentAuthFailure(agent, accountId = MACHINE_ACCOUNT_ID) {
+    if (clearRefusal(agent, accountId)) {
+        log.info('auth-relay: agent sign-in is working again', { agent, account: accountId });
     }
-}
-/** The agent just worked — whatever was wrong with the sign-in is not. */
-export function clearAgentAuthFailure(agent) {
-    if (authFailures.delete(agent)) {
-        log.info('auth-relay: agent sign-in is working again', { agent });
+    if (agent === 'codex') {
+        if (accountId !== MACHINE_ACCOUNT_ID)
+            clearCodexLoginExpired(accountId);
+        return;
+    }
+    // A machine session that worked on the credentials FILE says nothing about the
+    // captured token: its mark is lifted only by a session that ran with it.
+    if (accountId !== MACHINE_ACCOUNT_ID || environmentCarriesStoredToken()) {
+        clearLoginExpired(accountId);
     }
 }
 /**
- * Is a refusal still being held against this agent?
+ * Is a refusal still being held against this agent (and account)?
  *
  * Exported so the wiring in `supervisor.ts` can be pinned by a test without
  * shelling out to the agent CLIs: this predicate IS the mechanism the panel's
  * demotion reads, and three unguarded lines were carrying it (QA-117 M6).
  */
-export function agentAuthFailureActive(agent) {
-    return hasRecentAuthFailure(agent);
-}
-function hasRecentAuthFailure(agent) {
-    const at = authFailures.get(agent);
-    if (at === undefined)
-        return false;
-    if (Date.now() - at > AUTH_FAILURE_TTL_MS) {
-        authFailures.delete(agent);
-        return false;
-    }
-    return true;
+export function agentAuthFailureActive(agent, accountId = MACHINE_ACCOUNT_ID) {
+    return refusalActive(agent, accountId);
 }
 /** Last verdict we published per agent — logged only when it changes. */
 const lastVerdict = new Map();
@@ -607,14 +779,35 @@ function logVerdictChange(agent, status) {
  * Codex reports its own login state via an exit code (0 signed in / 1 not).
  * Probed against the RUNNER's home: the host user can be signed in while our
  * isolated home is not, and it is ours that sessions use.
+ *
+ * About the login new sessions start under (#422 S4): the machine login through
+ * the link, or the saved login the link points at – named in `activeAccount`,
+ * read locally from the file, no CLI for it (R14).
  */
 export async function codexAuthStatus() {
     // Re-assert the credential before judging it. The link into the shared store
     // can disappear under a live daemon (codex has its own auth.json removal
     // path), and reporting "login expired" about a credential that is merely
     // unlinked — while the user's own file is valid for another week — is the
-    // exact complaint this fixes.
+    // exact complaint this fixes. Forcing nothing (S4 item 2): a saved login in
+    // use stays in use.
     const home = repairCodexAuth();
+    const accountId = home.accountId ?? MACHINE_ACCOUNT_ID;
+    const activeAccount = codexActiveAccountSummary(accountId);
+    const verdict = await codexHomeVerdict(home);
+    // A saved login a session was refused with stays refused until its file is
+    // written again (D2) – the same rule as a saved Claude login.
+    if (verdict.status === 'ok' && codexRowRefused(accountId)) {
+        return {
+            ...verdict,
+            status: 'expired',
+            detail: 'the agent was refused with this account – sign in again',
+            activeAccount,
+        };
+    }
+    return { ...verdict, activeAccount };
+}
+async function codexHomeVerdict(home) {
     const local = readCodexCredential(home.path);
     if (home.auth === 'missing' && !local) {
         return { status: 'missing', detail: 'not signed in on this server' };
@@ -626,7 +819,11 @@ export async function codexAuthStatus() {
         });
         return {
             status: 'ok',
-            detail: home.auth === 'linked' ? 'signed in with ChatGPT (shared login)' : 'signed in with ChatGPT',
+            detail: home.auth === 'linked'
+                ? 'signed in with ChatGPT (shared login)'
+                : home.auth === 'account'
+                    ? 'signed in with ChatGPT (saved login)'
+                    : 'signed in with ChatGPT',
             ...(local?.expiresAt ? { expiresAt: local.expiresAt } : {}),
         };
     }
@@ -656,30 +853,19 @@ export async function codexAuthStatus() {
 /**
  * Read what the runner's own auth.json says, without ever logging a token.
  * Used only to tell "no credential" apart from "credential past its date" —
- * the CLI probe is local and cannot detect a server-side revocation.
+ * the CLI probe is local and cannot detect a server-side revocation. The
+ * reading itself lives in `codex-home.ts`, where the saved logins are judged by
+ * the same lines.
  */
 function readCodexCredential(homePath) {
-    try {
-        const raw = JSON.parse(fs.readFileSync(path.join(homePath, 'auth.json'), 'utf8'));
-        const access = raw.tokens?.access_token;
-        if (!access)
-            return null;
-        // A refresh token means the access token's own expiry is not the whole
-        // story — codex renews it on its own.
-        if (raw.tokens?.refresh_token)
-            return { expired: false };
-        const payload = access.split('.')[1];
-        if (!payload)
-            return { expired: false };
-        const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
-        if (typeof claims.exp !== 'number')
-            return { expired: false };
-        const expiresAt = new Date(claims.exp * 1000).toISOString();
-        return { expiresAt, expired: claims.exp * 1000 < Date.now() };
-    }
-    catch {
+    const credential = readCodexCredentialFile(path.join(homePath, 'auth.json'));
+    // Only a ChatGPT login has tokens to date; an API key is left to `codex login status`.
+    if (credential.kind !== 'chatgpt')
         return null;
-    }
+    return {
+        ...(credential.expiresAt ? { expiresAt: credential.expiresAt } : {}),
+        expired: credential.status === 'expired',
+    };
 }
 /**
  * A verdict read off disk, overruled by what a real session experienced.
@@ -688,19 +874,19 @@ function readCodexCredential(homePath) {
  * and never the other way round — a file saying `expired` is not made `ok` by
  * the absence of failures.
  */
-function withObservedFailures(agent, status) {
-    if (status.status !== 'ok' || !hasRecentAuthFailure(agent))
+function withObservedFailures(agent, status, accountId = MACHINE_ACCOUNT_ID) {
+    if (status.status !== 'ok' || !refusalActive(agent, accountId))
         return status;
     return {
+        ...status,
         status: 'expired',
-        ...(status.expiresAt ? { expiresAt: status.expiresAt } : {}),
         detail: 'the agent was refused with this sign-in — re-login needed',
     };
 }
 export async function agentAuthStatuses() {
     const [claudeRaw, codexRaw] = await Promise.all([claudeAuthStatus(), codexAuthStatus()]);
-    const claude = withObservedFailures('claude', claudeRaw);
-    const codex = withObservedFailures('codex', codexRaw);
+    const claude = withObservedFailures('claude', claudeRaw, claudeRaw.activeAccount?.id ?? MACHINE_ACCOUNT_ID);
+    const codex = withObservedFailures('codex', codexRaw, codexRaw.activeAccount?.id ?? MACHINE_ACCOUNT_ID);
     logVerdictChange('claude', claude);
     logVerdictChange('codex', codex);
     return { claude, codex };