@bridge4dev/runner 0.66.0 → 0.67.0

package/dist/adapters/codex-home.js

@@ -1,6 +1,8 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { readAgentAuth, updateAgentAuth } from '../agent-auth.js';
+import { AccountError, MACHINE_ACCOUNT_ID, clearRefusal, isAccountId, newAccountId, } from '../login-marks.js';
 import { stateDir } from '../paths.js';
 import { log } from '../log.js';
 // A dedicated CODEX_HOME for the runner. This is a security control, not tidiness.
@@ -15,15 +17,40 @@ import { log } from '../log.js';
 // Verified live: with CODEX_HOME pointed here, `config/read` reports exactly two
 // layers (ours + the always-present system file) and the user's config is not
 // among them.
+//
+// Several Codex logins (#422 S4). The home stays ONE – its `sessions/` (the
+// history every resume reads), its logs and caches are shared by every account –
+// and only the login differs: each saved login is a file of its own,
+// `accounts/<id>/auth.json` (0600), and the account in use is the one the home's
+// `auth.json` LINK points at. Switching is repointing that link. Nothing is ever
+// copied: a login moves into the store by `rename`, and a rename that would have
+// to cross filesystems is refused instead of falling back to a copy – two copies
+// of one refresh token invalidate each other (the Claude side lost 47 agents to
+// exactly that on 08.09.2026, gotcha 460).
+//
+// Measured on codex-cli 0.154.0 (17.09.2026) before a line of this was written:
+//  - the CLI writes `auth.json` THROUGH a symlink (open + truncate), so a token
+//    refresh lands in the store file the link points at and the link survives;
+//  - before it refreshes it re-reads the file, and a file of a different
+//    `account_id` is not written over («Skipping token refresh because auth
+//    changed after guarded reload»). A session still running under A after the
+//    machine was switched to B therefore never spends A's tokens into B's file;
+//    at its next refresh it stops with «signed in to another account» instead.
 const CONFIG_FILENAME = 'config.toml';
 const AUTH_FILENAME = 'auth.json';
 /**
  * Records how this home is meant to be authenticated. Without it a plain
  * auth.json is ambiguous — it could be our own device login, or codex having
- * replaced our symlink. A MISSING marker always reads as `own`: treating an
- * unknown file as a link would let us move somebody's real credential around.
+ * replaced our symlink. Three states since #422 S4:
+ *  - `link` – the machine login: the host user's `~/.codex/auth.json`;
+ *  - `own` – no link on purpose (`[codex] auth = "own"` waiting for a login);
+ *  - `account:<id>` – a saved login, `accounts/<id>/auth.json`.
+ * A runner from before S4 reads `account:<id>` as nothing, i.e. as `link`, and
+ * re-links the host login (К8): the machine login is intact, the switch is lost.
  */
 const MODE_FILENAME = '.devbridge-auth-mode';
+const ACCOUNT_MARK_PREFIX = 'account:';
+const ACCOUNTS_DIRNAME = 'accounts';
 /**
  * Minimal config. Deliberately has NO `[mcp_servers]` section: a per-thread
  * config overlay MERGES with the home config at the map-key level (verified
@@ -41,39 +68,194 @@ const CONFIG_BODY = [
 export function codexHomePath() {
     return path.join(stateDir(), 'codex-home');
 }
+/** Where the saved Codex logins live – inside the one home, beside what they share. */
+export function codexAccountsDir(home = codexHomePath()) {
+    return path.join(home, ACCOUNTS_DIRNAME);
+}
+/** The directory of one saved login. Throws on anything that is not an account id. */
+export function codexAccountDir(id, home = codexHomePath()) {
+    if (!isAccountId(id))
+        throw new AccountError('no such account on this server');
+    return path.join(codexAccountsDir(home), id);
+}
+/** The login file of one saved account. */
+export function codexAccountAuthFile(id, home = codexHomePath()) {
+    return path.join(codexAccountDir(id, home), AUTH_FILENAME);
+}
+/** The machine login of Codex – the host user's own file, never written by DevBridge (R13). */
+export function hostCodexAuthFile(homedir = os.homedir()) {
+    return path.join(homedir, '.codex', AUTH_FILENAME);
+}
 /**
- * Throwaway home for a device-code login. The flow runs here and is promoted
- * into the real home only on success, so an abandoned or timed-out sign-in
- * cannot destroy a credential that was working.
+ * Throwaway homes for device-code logins, one per attempt. The flow runs there
+ * and its login is moved into the store only on success, so an abandoned or
+ * timed-out sign-in cannot destroy a credential that was working.
  */
 export function stagingCodexHomePath() {
     return path.join(stateDir(), 'codex-login');
 }
-function readMode(dir) {
+// ─── The configured mode ─────────────────────────────────────────────
+let configuredAuth;
+/**
+ * `[codex] auth` as the machine's owner WROTE it – `undefined` when the key is
+ * not in `config.toml`. Set once at daemon start.
+ *
+ * Only a mode that is really written may be forced, and even then not over a
+ * saved login (S4 item 2): the runner used to pass `link` by default from three
+ * places – the daemon start, every session start and the minute probe – and each
+ * of them would have undone a switch of account within a minute (К4).
+ */
+export function configureCodexAuth(mode) {
+    configuredAuth = mode;
+}
+export function configuredCodexAuth() {
+    return configuredAuth;
+}
+// ─── The mark ────────────────────────────────────────────────────────
+function readMark(dir) {
+    let value;
     try {
-        const value = fs.readFileSync(path.join(dir, MODE_FILENAME), 'utf8').trim();
-        return value === 'link' || value === 'own' ? value : null;
+        value = fs.readFileSync(path.join(dir, MODE_FILENAME), 'utf8').trim();
     }
     catch {
         return null;
     }
+    if (value === 'link' || value === 'own')
+        return { kind: value };
+    if (value.startsWith(ACCOUNT_MARK_PREFIX)) {
+        const id = value.slice(ACCOUNT_MARK_PREFIX.length);
+        if (isAccountId(id))
+            return { kind: 'account', id };
+    }
+    return null;
+}
+function markText(mark) {
+    return mark.kind === 'account' ? `${ACCOUNT_MARK_PREFIX}${mark.id}` : mark.kind;
 }
-function writeMode(dir, mode) {
+/**
+ * Write-then-rename: a torn mark reads as «no mark», which reads as `link` – a
+ * half-written `account:` would quietly put the machine login back.
+ */
+function writeMark(dir, mark) {
+    const target = path.join(dir, MODE_FILENAME);
     try {
-        fs.writeFileSync(path.join(dir, MODE_FILENAME), mode, { mode: 0o600 });
+        const current = readMark(dir);
+        if (current && markText(current) === markText(mark))
+            return;
+        const tmp = `${target}.${process.pid}.tmp`;
+        fs.writeFileSync(tmp, markText(mark), { mode: 0o600 });
+        fs.renameSync(tmp, target);
     }
     catch (error) {
         log.warn('codex: could not record the auth mode', { error: String(error) });
     }
 }
+/** Which saved login the home is set to, if any – the mark, read only. */
+export function markedCodexAccount(home = codexHomePath()) {
+    const mark = readMark(home);
+    return mark?.kind === 'account' ? mark.id : null;
+}
+const isObject = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+const text = (value, max) => typeof value === 'string' && value.trim().length > 0 && value.trim().length <= max
+    ? value.trim()
+    : undefined;
+function jwtClaims(token) {
+    if (typeof token !== 'string')
+        return null;
+    const payload = token.split('.')[1];
+    if (!payload)
+        return null;
+    try {
+        const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+        return isObject(claims) ? claims : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read a Codex login file without letting a token out of this function.
+ *
+ * The identity comes from the claims of `id_token`, decoded locally (S4 item 8):
+ * `email`, and under `https://api.openai.com/auth` the plan and the ChatGPT
+ * account; `tokens.account_id` first for the key, the claim when it is absent. An
+ * internal file of the CLI (§11): whatever cannot be read is simply not there –
+ * no identity is invented, and a row without a key merges with nothing.
+ *
+ * The verdict is the pre-S4 one (`readCodexCredential`): a refresh token means
+ * the CLI renews the access token on its own, so only a lone access token past
+ * its `exp` is `expired`.
+ */
+export function readCodexCredentialFile(file) {
+    let raw;
+    let writtenMs;
+    try {
+        raw = fs.readFileSync(file, 'utf8');
+        writtenMs = Math.floor(fs.statSync(file).mtimeMs);
+    }
+    catch (error) {
+        const code = error.code;
+        return {
+            status: code === 'ENOENT' || code === 'ENOTDIR' ? 'missing' : 'unknown',
+            identity: {},
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { status: 'unreadable', identity: {}, writtenMs };
+    }
+    if (!isObject(parsed))
+        return { status: 'unreadable', identity: {}, writtenMs };
+    const tokens = isObject(parsed['tokens']) ? parsed['tokens'] : null;
+    const access = text(tokens?.['access_token'], 16_000);
+    const apiKey = text(parsed['OPENAI_API_KEY'], 1_000);
+    if (!access) {
+        return apiKey
+            ? { status: 'ok', kind: 'apikey', identity: {}, writtenMs }
+            : { status: 'unreadable', identity: {}, writtenMs };
+    }
+    const idClaims = jwtClaims(tokens?.['id_token']);
+    const auth = isObject(idClaims?.['https://api.openai.com/auth'])
+        ? idClaims['https://api.openai.com/auth']
+        : null;
+    const orgId = text(tokens?.['account_id'], 100) ?? text(auth?.['chatgpt_account_id'], 100);
+    const email = text(idClaims?.['email'], 320);
+    const plan = text(auth?.['chatgpt_plan_type'], 60);
+    const identity = {
+        ...(email ? { email } : {}),
+        ...(orgId ? { orgId } : {}),
+        ...(plan ? { plan } : {}),
+    };
+    if (text(tokens?.['refresh_token'], 16_000)) {
+        return { status: 'ok', kind: 'chatgpt', identity, writtenMs };
+    }
+    const exp = jwtClaims(access)?.['exp'];
+    if (typeof exp !== 'number' || !Number.isFinite(exp) || Math.abs(exp) > 8.64e12) {
+        return { status: 'ok', kind: 'chatgpt', identity, writtenMs };
+    }
+    const expiresAt = new Date(exp * 1000).toISOString();
+    return {
+        status: exp * 1000 < Date.now() ? 'expired' : 'ok',
+        kind: 'chatgpt',
+        identity,
+        expiresAt,
+        writtenMs,
+    };
+}
+// ─── The home ────────────────────────────────────────────────────────
 /**
  * Create (or refresh) the runner's CODEX_HOME and return it.
  *
- * `auth: 'link'` (default) symlinks the host user's `~/.codex/auth.json` so the
- * runner uses their ChatGPT subscription and — importantly — shares one
- * credential store with their own CLI, so a token refresh on either side keeps
- * both working. `auth: 'own'` leaves the home unauthenticated until a
- * device-code login writes into it, which is the choice for full isolation.
+ * `link` (the default when nothing else is decided) symlinks the host user's
+ * `~/.codex/auth.json` so the runner uses their ChatGPT subscription and —
+ * importantly — shares one credential store with their own CLI, so a token
+ * refresh on either side keeps both working. `own` leaves the home
+ * unauthenticated until a device-code login is stored for it, which is the
+ * choice for full isolation. A saved login (`account:<id>`) is kept whatever
+ * the configured mode says (S4 item 2).
  *
  * A home under the OS temp dir still works, but codex then refuses to install
  * its helper binaries ("Refusing to create helper binaries under temporary
@@ -99,64 +281,136 @@ export function ensureCodexHome(options = {}) {
         // old, possibly wider permissions (QA-100 MINOR-8).
         fs.chmodSync(configFile, 0o600);
     }
-    return { path: dir, auth: ensureAuth(dir, options) };
+    return ensureAuth(dir, options);
+}
+function ensureAccountsRoot(dir) {
+    const root = codexAccountsDir(dir);
+    fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+    fs.chmodSync(root, 0o700);
+    return root;
+}
+function lstatOrNull(file) {
+    try {
+        return fs.lstatSync(file);
+    }
+    catch {
+        return null;
+    }
+}
+function accountDirExists(id, dir) {
+    return lstatOrNull(codexAccountDir(id, dir))?.isDirectory() === true;
+}
+/**
+ * Point `auth.json` at `target`, atomically: a new link is made beside it and
+ * renamed over the old one, so a CLI opening the file never finds it missing.
+ * Never over a real file – the caller has moved that into the store first.
+ */
+function pointLink(dir, target) {
+    const link = path.join(dir, AUTH_FILENAME);
+    const existing = lstatOrNull(link);
+    if (existing?.isSymbolicLink() && fs.readlinkSync(link) === target)
+        return;
+    if (existing && !existing.isSymbolicLink()) {
+        throw new AccountError('a login file stands where the link belongs – try again');
+    }
+    const tmp = `${link}.${process.pid}.link-tmp`;
+    fs.rmSync(tmp, { force: true });
+    fs.symlinkSync(target, tmp);
+    fs.renameSync(tmp, link);
 }
 function ensureAuth(dir, options) {
     const target = path.join(dir, AUTH_FILENAME);
-    const userAuth = path.join(options.homedir ?? os.homedir(), '.codex', AUTH_FILENAME);
-    const recorded = readMode(dir);
-    // The marker is the persisted decision. Callers that do not name a mode —
-    // the per-session repair, the health probe — must inherit it, or an
-    // isolated home would be re-linked to the host credential by the next probe
-    // that happens to run.
-    const mode = options.auth ?? recorded ?? 'link';
-    const existing = lstatOrNull(target);
-    // A real file is a usable credential, full stop. We do NOT try to be clever
-    // and push it back into the host user's ~/.codex: that file is theirs, we
-    // cannot know which copy is newer, and getting it wrong costs them their
-    // login. If codex replaced our symlink with its own atomic write, the
-    // credential it wrote is right here — keep using it, and record that this
-    // home now owns its login so we never overwrite it later.
-    if (existing?.isFile()) {
-        if (recorded === 'link') {
-            log.warn("codex: auth.json is no longer a shared link — keeping it as this runner's own", {
-                path: target,
-            });
+    const userAuth = hostCodexAuthFile(options.homedir);
+    const explicit = options.auth ?? configuredAuth;
+    let mark = readMark(dir);
+    // A real file where our link belongs is a usable credential, full stop. It is
+    // never pushed into the host user's ~/.codex: that file is theirs, and
+    // guessing which copy is newer costs them their login.
+    if (lstatOrNull(target)?.isFile()) {
+        if (mark?.kind === 'account' && accountDirExists(mark.id, dir)) {
+            // S4 item 3: the CLI left its fresh token here instead of in the store –
+            // back into the store it goes, or the store would keep a rotated-out one.
+            returnRealFile(dir, mark.id);
+        }
+        else {
+            // D18, R9: a login this home owned as a file (a dashboard sign-in of an
+            // older runner, or codex replacing our link) becomes the first saved
+            // account – and stays the one in use.
+            const adopted = moveHomeFileIntoStore(dir, mark);
+            if (!adopted) {
+                // The file is still here and is being used where it is; or it moved
+                // under us and the mark on disk – ours or another process's – decides.
+                if (lstatOrNull(target)?.isFile())
+                    return { path: dir, auth: 'own' };
+                mark = readMark(dir);
+                if (mark?.kind !== 'account')
+                    return { path: dir, auth: 'missing' };
+            }
+            else {
+                mark = { kind: 'account', id: adopted };
+            }
         }
-        writeMode(dir, 'own');
-        return 'own';
     }
+    if (mark?.kind === 'account') {
+        if (accountDirExists(mark.id, dir)) {
+            const store = codexAccountAuthFile(mark.id, dir);
+            try {
+                pointLink(dir, store);
+            }
+            catch (error) {
+                log.warn('codex: could not point auth.json at the saved login', {
+                    account: mark.id,
+                    error: String(error),
+                });
+                return { path: dir, auth: 'missing', accountId: mark.id };
+            }
+            return {
+                path: dir,
+                auth: fs.existsSync(store) ? 'account' : 'missing',
+                accountId: mark.id,
+            };
+        }
+        // The login the home was set to is gone from the disk altogether (removed by
+        // hand): sessions and the verdict must agree on SOME login, and the machine's
+        // is the one that is always there. Said once, in the journal.
+        log.warn('codex: the saved login in use is gone from this machine – back to the machine login', {
+            account: mark.id,
+        });
+        mark = null;
+    }
+    const mode = explicit ?? (mark?.kind === 'own' ? 'own' : 'link');
+    const existing = lstatOrNull(target);
     if (mode === 'own') {
         if (existing?.isSymbolicLink())
             fs.rmSync(target, { force: true });
-        writeMode(dir, 'own');
-        return 'missing';
+        writeMark(dir, { kind: 'own' });
+        return { path: dir, auth: 'missing' };
     }
     if (existing?.isSymbolicLink()) {
         // Repoint if the user's file moved or the link went stale.
         const resolved = fs.readlinkSync(target);
         if (resolved === userAuth && fs.existsSync(userAuth)) {
-            writeMode(dir, 'link');
-            return 'linked';
+            writeMark(dir, { kind: 'link' });
+            return { path: dir, auth: 'linked' };
         }
         fs.rmSync(target, { force: true });
     }
+    writeMark(dir, { kind: 'link' });
     if (!fs.existsSync(userAuth))
-        return 'missing';
+        return { path: dir, auth: 'missing' };
     try {
         fs.symlinkSync(userAuth, target);
-        writeMode(dir, 'link');
         // Loud on purpose: the link going missing under a live daemon is exactly
         // the failure that made the panel report "login expired" about a perfectly
         // valid credential, and nothing recorded it. Now it does.
         if (!existing) {
             log.info('codex: linked the host auth.json into the isolated home', { path: target });
         }
-        return 'linked';
+        return { path: dir, auth: 'linked' };
     }
     catch (error) {
         log.warn('codex: could not link the host auth.json', { error: String(error) });
-        return 'missing';
+        return { path: dir, auth: 'missing' };
     }
 }
 /**
@@ -165,12 +419,15 @@ function ensureAuth(dir, options) {
  * it only answers "is the credential still where we left it, and if not, can we
  * put it back". This is what makes a credential disappearing under a running
  * daemon self-healing instead of permanent.
+ *
+ * Forces nothing it was not told to by the machine's owner (S4 item 2): with no
+ * `[codex] auth` in `config.toml` the mark decides, and a saved login stays.
  */
 export function repairCodexAuth(options = {}) {
     const dir = codexHomePath();
     if (!fs.existsSync(dir))
         return ensureCodexHome(options);
-    return { path: dir, auth: ensureAuth(dir, options) };
+    return ensureAuth(dir, options);
 }
 function isUnderTempDir(dir) {
     try {
@@ -181,54 +438,343 @@ function isUnderTempDir(dir) {
         return false;
     }
 }
-function lstatOrNull(file) {
+/**
+ * Drop a linked auth.json so a device-code login writes our own file instead.
+ * Never a real credential: only a symlink is removed.
+ */
+export function detachLinkedAuth(dir = codexHomePath()) {
+    const target = path.join(dir, AUTH_FILENAME);
+    if (lstatOrNull(target)?.isSymbolicLink())
+        fs.rmSync(target, { force: true });
+}
+// ─── The store ───────────────────────────────────────────────────────
+function stampedIdentity(identity) {
+    return { ...identity, at: new Date().toISOString() };
+}
+/** The key a saved row is known by – its file first, what was last read from it second. */
+function storedKeyOf(id, dir) {
+    const fromFile = readCodexCredentialFile(codexAccountAuthFile(id, dir)).identity.orgId;
+    if (fromFile)
+        return fromFile;
+    return readAgentAuth().codexAccounts?.find((record) => record.id === id)?.lastSeenIdentity?.orgId;
+}
+/** A rename that refuses to become a copy (EXDEV), and leaves the file 0600. */
+function moveLogin(source, destination) {
     try {
-        return fs.lstatSync(file);
+        fs.renameSync(source, destination);
     }
-    catch {
+    catch (error) {
+        if (error.code === 'EXDEV') {
+            throw new AccountError('the login is on another filesystem – it is moved, never copied');
+        }
+        throw error;
+    }
+    fs.chmodSync(destination, 0o600);
+}
+/** A file that is not a login is set aside under a dated name – never over a login that works. */
+function setAside(file) {
+    const aside = `${file}.displaced-${Date.now()}`;
+    fs.renameSync(file, aside);
+    log.warn('codex: a file that is not a login stood in place of auth.json – moved aside', {
+        aside,
+    });
+    return aside;
+}
+/**
+ * Move a login file into the store (§8 `agent_account_login_code` for Codex, S4
+ * items 4 and 5) – by rename, and one subscription, one row.
+ *
+ * A known `account_id` that a saved row already has REPLACES that row's login:
+ * the row keeps its id (refusal marks and a live session are keyed by it, R15)
+ * and its `addedAt` becomes now – the date is that of the login the row holds,
+ * and a second sign-in of the same subscription must change something the
+ * window can see (S3 hands this over: `deviceSignInResult`). An unknown key
+ * merges with nothing. The machine row takes no part: it is the host's own file.
+ *
+ * The record is written BEFORE the file moves, so a failure never leaves a login
+ * nobody can list or forget; a move that fails takes its new record back.
+ */
+export function storeCodexLogin(source, options) {
+    const dir = options.home ?? codexHomePath();
+    // A real file standing where the link belongs is settled BEFORE anything is
+    // moved in: otherwise this sign-in lands in the row's store and the file is
+    // then written over it as «the refreshed login of that row» – the new login
+    // would be gone (found by the independent check of S4).
+    if (path.resolve(source) !== path.resolve(dir, AUTH_FILENAME))
+        settleRealFile(dir);
+    const credential = readCodexCredentialFile(source);
+    if (credential.status === 'missing' || credential.status === 'unreadable') {
+        throw new AccountError('the sign-in finished but no usable login was stored – start again');
+    }
+    if (credential.status === 'unknown') {
+        throw new AccountError('the new login could not be read on this server – start again');
+    }
+    ensureAccountsRoot(dir);
+    const key = credential.identity.orgId;
+    const identity = stampedIdentity(credential.identity);
+    const records = readAgentAuth().codexAccounts ?? [];
+    const sameSubscription = key
+        ? records.find((record) => isAccountId(record.id) &&
+            record.lastSeenIdentity?.orgId === key &&
+            accountDirExists(record.id, dir))
+        : undefined;
+    // `replaceActive` is the one-login window's door (D27: with the organization's
+    // option off, a sign-in REPLACES the login in use rather than adding a row).
+    // The subscription still wins when it is already saved elsewhere, or two rows
+    // would share one key and the list could no longer tell them apart.
+    const inUse = options.replaceActive ? markedCodexAccount(dir) : null;
+    const same = sameSubscription ??
+        (inUse && isAccountId(inUse) && accountDirExists(inUse, dir)
+            ? records.find((record) => record.id === inUse)
+            : undefined);
+    let stored;
+    if (same) {
+        moveLogin(source, codexAccountAuthFile(same.id, dir));
+        if (options.activate)
+            markActiveCodexLogin(same.id, dir);
+        updateAgentAuth((file) => {
+            const record = file.codexAccounts?.find((entry) => entry.id === same.id);
+            if (!record)
+                return;
+            record.lastSeenIdentity = identity;
+            record.addedAt = new Date().toISOString();
+            delete record.loginExpiredAt;
+        });
+        // A fresh login outranks anything remembered about the one it replaced.
+        clearRefusal('codex', same.id);
+        stored = { id: same.id, replaced: same.id };
+        log.info('codex: a sign-in replaced the saved login of the same subscription', {
+            account: same.id,
+        });
+    }
+    else {
+        const id = newAccountId();
+        updateAgentAuth((file) => {
+            file.codexAccounts = [
+                ...(file.codexAccounts ?? []),
+                { id, addedAt: new Date().toISOString(), lastSeenIdentity: identity },
+            ];
+        });
+        try {
+            fs.mkdirSync(codexAccountDir(id, dir), { mode: 0o700 });
+            moveLogin(source, codexAccountAuthFile(id, dir));
+            // The mark right after the move, before anything else can throw: a login
+            // already in the store under a mark that still says `own` reads as «not
+            // signed in» on the next repair (found by the independent check of S4).
+            if (options.activate)
+                markActiveCodexLogin(id, dir);
+        }
+        catch (error) {
+            fs.rmSync(codexAccountDir(id, dir), { recursive: true, force: true });
+            updateAgentAuth((file) => {
+                file.codexAccounts = (file.codexAccounts ?? []).filter((entry) => entry.id !== id);
+                if (file.codexAccounts.length === 0)
+                    delete file.codexAccounts;
+            });
+            throw error;
+        }
+        stored = { id };
+        log.info('codex: a login was added to the saved accounts', { account: id });
+    }
+    if (options.activate)
+        setCodexActiveLogin(stored.id, dir);
+    return stored;
+}
+/**
+ * The CLI left a real `auth.json` where the link to `activeId` was (S4 item 3).
+ *
+ * Normally it is the active login, refreshed: it replaces the store file (the
+ * store's copy is the older of the two). But the home is shared by every
+ * session, and the file of a DIFFERENT subscription must never be written over
+ * the active login – that would erase it. Such a file goes where its own key
+ * says (its row, or a new one), and a file that is not a login at all is set
+ * aside. The link is not touched here; the caller points it.
+ */
+function returnRealFile(dir, activeId) {
+    const source = path.join(dir, AUTH_FILENAME);
+    const credential = readCodexCredentialFile(source);
+    if (credential.status === 'unreadable') {
+        setAside(source);
+        return;
+    }
+    if (credential.status === 'missing' || credential.status === 'unknown')
+        return;
+    const key = credential.identity.orgId;
+    const activeKey = storedKeyOf(activeId, dir);
+    if (key && activeKey && key !== activeKey) {
+        log.warn('codex: a login of another subscription stood in place of the link – stored as its own', {
+            account: activeId,
+        });
+        storeCodexLogin(source, { activate: false, home: dir });
+        return;
+    }
+    moveLogin(source, codexAccountAuthFile(activeId, dir));
+    updateAgentAuth((file) => {
+        const record = file.codexAccounts?.find((entry) => entry.id === activeId);
+        if (record && Object.keys(credential.identity).length > 0) {
+            record.lastSeenIdentity = stampedIdentity(credential.identity);
+        }
+    });
+    log.info('codex: the refreshed login was returned to its saved account', { account: activeId });
+}
+/** D18, R9: the home's own login file becomes a saved account, in use. Null – it stays a file. */
+function moveHomeFileIntoStore(dir, mark) {
+    const source = path.join(dir, AUTH_FILENAME);
+    if (readCodexCredentialFile(source).status === 'unreadable') {
+        try {
+            setAside(source);
+        }
+        catch (error) {
+            log.warn('codex: could not set aside an unreadable auth.json', { error: String(error) });
+            return null;
+        }
+        return null;
+    }
+    try {
+        const stored = storeCodexLogin(source, { activate: true, home: dir });
+        log.info("codex: this runner's own login became the first saved account", {
+            account: stored.id,
+            was: mark ? markText(mark) : 'unmarked',
+        });
+        return stored.id;
+    }
+    catch (error) {
+        // Only when the login is still here. It may be gone because the move went
+        // through and something after it failed, or because another process – a
+        // `doctor` beside the daemon – moved it first: writing `own` then would say
+        // «no login here» about a login that is in the store and in use (found by
+        // the independent check of S4). The caller re-reads the mark instead.
+        if (lstatOrNull(source)?.isFile()) {
+            log.warn('codex: could not move the home login into the saved accounts – using it in place', {
+                error: String(error),
+            });
+            writeMark(dir, { kind: 'own' });
+        }
+        else {
+            log.warn('codex: the home login was moved by somebody else while we were storing it', {
+                error: String(error),
+            });
+        }
         return null;
     }
 }
 /**
- * Drop a linked auth.json so a device-code login writes our own file instead.
+ * Make a row the one the home uses: the mark first, then the link.
+ *
+ * In that order on purpose – a daemon that dies between the two leaves a mark
+ * the next repair finishes (it points the link where the mark says), never a
+ * link that the next repair would undo.
  *
- * Only ever called AFTER a login has actually succeeded in the staging home —
- * never as a pre-step. Detaching first meant an abandoned or timed-out sign-in
- * left the server permanently "not signed in", recoverable only by restarting
- * the daemon.
+ * A real file in place of the link is dealt with FIRST (§8 `activate`, S4 item
+ * 7): the CLI may have refreshed the login in use a moment ago, and repointing
+ * over it would throw that token away.
  */
-export function detachLinkedAuth(dir = codexHomePath()) {
+export function markActiveCodexLogin(id, dir = codexHomePath()) {
+    writeMark(dir, id === MACHINE_ACCOUNT_ID ? { kind: 'link' } : { kind: 'account', id });
+}
+export function setCodexActiveLogin(id, dir = codexHomePath()) {
     const target = path.join(dir, AUTH_FILENAME);
-    if (lstatOrNull(target)?.isSymbolicLink())
-        fs.rmSync(target, { force: true });
+    settleRealFile(dir);
+    if (id === MACHINE_ACCOUNT_ID) {
+        writeMark(dir, { kind: 'link' });
+        const existing = lstatOrNull(target);
+        // The link to a saved login goes; `ensureAuth` puts the host's in its place.
+        if (existing?.isSymbolicLink() && fs.readlinkSync(target) !== hostCodexAuthFile()) {
+            fs.rmSync(target, { force: true });
+        }
+    }
+    else {
+        if (!accountDirExists(id, dir)) {
+            throw new AccountError('the login of this account is gone from this server – forget it');
+        }
+        writeMark(dir, { kind: 'account', id });
+    }
+    return ensureAuth(dir, {});
 }
 /**
- * Promote a credential produced by a staging login into the real home, and
- * record that this home now owns its own login.
+ * A real `auth.json` standing where the link belongs goes back where it belongs –
+ * the store of the row it is the login of – and nothing else moves until it has.
+ * Called before a sign-in is stored and before the link is repointed (S4 items 3
+ * and 7).
  */
-export function adoptLoginResult(stagingDir, dir = codexHomePath()) {
-    const source = path.join(stagingDir, AUTH_FILENAME);
-    if (!lstatOrNull(source)?.isFile())
-        return false;
-    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    detachLinkedAuth(dir);
+function settleRealFile(dir) {
     const target = path.join(dir, AUTH_FILENAME);
-    fs.copyFileSync(source, target);
-    fs.chmodSync(target, 0o600);
-    writeMode(dir, 'own');
-    fs.rmSync(stagingDir, { recursive: true, force: true });
-    return true;
+    if (!lstatOrNull(target)?.isFile())
+        return;
+    const current = readMark(dir);
+    if (current?.kind === 'account' && accountDirExists(current.id, dir)) {
+        returnRealFile(dir, current.id);
+        return;
+    }
+    storeCodexLogin(target, { activate: false, home: dir });
 }
-/** Seed a throwaway home for the device-code flow (config only, no credential). */
+// ─── Signing in ──────────────────────────────────────────────────────
+/**
+ * A fresh throwaway home for one device-code sign-in (config only, no credential).
+ *
+ * One directory per attempt, and every other one is removed first: only one
+ * sign-in runs on a machine at a time (the relay cancels the previous one before
+ * it gets here), and the pre-S4 runner kept a single fixed staging home that was
+ * never cleaned up – on this machine it had lain there since 01.08.2026.
+ */
 export function prepareStagingHome() {
-    const dir = stagingCodexHomePath();
-    fs.rmSync(dir, { recursive: true, force: true });
-    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const root = stagingCodexHomePath();
+    discardAbandonedCodexStagingHomes();
+    fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+    fs.chmodSync(root, 0o700);
+    const dir = path.join(root, newAccountId());
+    fs.mkdirSync(dir, { mode: 0o700 });
     fs.writeFileSync(path.join(dir, CONFIG_FILENAME), CONFIG_BODY, { mode: 0o600 });
     return dir;
 }
-/** Remove the staging home whatever the outcome — it may hold a credential. */
-export function discardStagingHome() {
-    fs.rmSync(stagingCodexHomePath(), { recursive: true, force: true });
+function isStagingDir(dir) {
+    return (path.dirname(path.resolve(dir)) === path.resolve(stagingCodexHomePath()) &&
+        isAccountId(path.basename(dir)));
+}
+/** Remove one sign-in's home whatever the outcome — it may hold a credential. */
+export function discardStagingHome(dir) {
+    if (!isStagingDir(dir))
+        throw new AccountError('not a staging home');
+    fs.rmSync(dir, { recursive: true, force: true });
+}
+/**
+ * Remove every sign-in home – at daemon start (nothing can be signing in yet)
+ * and before a new sign-in. Includes the fixed-path staging home of runners
+ * before S4.
+ */
+export function discardAbandonedCodexStagingHomes() {
+    const root = stagingCodexHomePath();
+    let names;
+    try {
+        names = fs.readdirSync(root);
+    }
+    catch {
+        return 0;
+    }
+    for (const name of names)
+        fs.rmSync(path.join(root, name), { recursive: true, force: true });
+    return names.length;
+}
+/**
+ * A device-code sign-in in `stagingDir` finished: its login becomes a saved
+ * account – by rename, deduplicated by subscription – and the one in use (R15).
+ * The staging home is removed either way.
+ *
+ * `replaceActive` – the sign-in came through the one-login window, where it has
+ * always meant «this login from now on»: it takes the place of the login in use
+ * rather than adding a row (D27, for an organization without several logins).
+ */
+export function adoptLoginResult(stagingDir, options = {}) {
+    if (!isStagingDir(stagingDir))
+        throw new AccountError('no sign-in in progress – start again');
+    try {
+        return storeCodexLogin(path.join(stagingDir, AUTH_FILENAME), {
+            activate: true,
+            ...(options.replaceActive ? { replaceActive: true } : {}),
+        });
+    }
+    finally {
+        fs.rmSync(stagingDir, { recursive: true, force: true });
+    }
 }
 //# sourceMappingURL=codex-home.js.map