@bridge4dev/runner 0.66.0 → 0.68.0

package/dist/codex-accounts.js

@@ -0,0 +1,386 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { readAgentAuth, updateAgentAuth } from './agent-auth.js';
+import { codexAccountAuthFile, codexAccountDir, codexAccountsDir, codexHomePath, configuredCodexAuth, hostCodexAuthFile, markedCodexAccount, readCodexCredentialFile, repairCodexAuth, setCodexActiveLogin, } from './adapters/codex-home.js';
+import { AccountError, MACHINE_ACCOUNT_ID, isAccountId, refusalActive } from './login-marks.js';
+import { log } from './log.js';
+/**
+ * Several Codex logins on one machine, as rows (#422 S4, plan §8).
+ *
+ * `adapters/codex-home.ts` moves the files; this module is what the wire and a
+ * session read: the list of cards, switching, forgetting, which account a
+ * session starts under, and the verdict on a saved row. The rows have the SAME
+ * shape as Claude's (`AccountCard`), so the API, the mirror and the window need
+ * nothing new to serve Codex.
+ *
+ * Differences from Claude, each on purpose:
+ *  - identity is read from the login file itself (claims of `id_token`) – there
+ *    is no public `auth status` with an e-mail in it, and reading a local file
+ *    costs no subprocess, so the list may read it every time;
+ *  - the machine row is the host's `~/.codex/auth.json`, which DevBridge never
+ *    wrote and does not start writing: no «Log in again» for it (R13), and a
+ *    missing file is `expired`, not a reason to drop the row (S4 item 6);
+ *  - limits: Codex measures nothing by itself – a session reports its account's
+ *    windows as it works, and the card shows the last ones this daemon saw.
+ */
+// ─── Rows ────────────────────────────────────────────────────────────
+function recordsOf() {
+    return readAgentAuth().codexAccounts ?? [];
+}
+function recordOf(id) {
+    return recordsOf().find((record) => record.id === id);
+}
+function dirExists(id, home) {
+    try {
+        return fs.lstatSync(codexAccountDir(id, home)).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * A saved login whose record went missing (the record file was set aside as
+ * unreadable, say) is still a login on this disk: it gets its record back,
+ * dated by its directory, instead of becoming a file nobody can list or forget.
+ */
+function adoptOrphanDirectories(home) {
+    let names;
+    try {
+        names = fs.readdirSync(codexAccountsDir(home));
+    }
+    catch {
+        return;
+    }
+    const known = new Set(recordsOf().map((record) => record.id));
+    const orphans = names.filter((name) => isAccountId(name) && !known.has(name));
+    if (orphans.length === 0)
+        return;
+    updateAgentAuth((file) => {
+        const records = file.codexAccounts ?? [];
+        for (const id of orphans) {
+            if (records.some((record) => record.id === id))
+                continue;
+            let addedAt = new Date().toISOString();
+            try {
+                addedAt = new Date(Math.floor(fs.statSync(codexAccountDir(id, home)).mtimeMs)).toISOString();
+            }
+            catch {
+                /* dated now */
+            }
+            records.push({ id, addedAt });
+        }
+        file.codexAccounts = records;
+    });
+    log.warn('codex-accounts: saved logins without a record got one back', { count: orphans.length });
+}
+/** Did a refusal persisted on the row outlive the login file? A file written after it wins. */
+function markHolds(markedAt, writtenMs) {
+    if (!markedAt)
+        return false;
+    const marked = Date.parse(markedAt);
+    if (!Number.isFinite(marked))
+        return false;
+    return writtenMs === undefined || writtenMs <= marked;
+}
+function loginOf(credential, refused) {
+    const login = credential.status === 'unknown'
+        ? 'unknown'
+        : credential.status === 'ok' && !refused
+            ? 'ok'
+            : 'expired';
+    return { login, ...(credential.expiresAt ? { loginUntil: credential.expiresAt } : {}) };
+}
+function identityFields(identity) {
+    return {
+        ...(identity?.email ? { email: identity.email } : {}),
+        ...(identity?.orgId ? { orgId: identity.orgId } : {}),
+        ...(identity?.plan ? { plan: identity.plan } : {}),
+    };
+}
+const sameIdentity = (a, b) => (a?.email ?? '') === (b.email ?? '') &&
+    (a?.orgId ?? '') === (b.orgId ?? '') &&
+    (a?.plan ?? '') === (b.plan ?? '');
+/** Which row the home uses: a saved one only while its directory is there. */
+export function activeCodexAccountId(home = codexHomePath()) {
+    const marked = markedCodexAccount(home);
+    return marked && dirExists(marked, home) ? marked : MACHINE_ACCOUNT_ID;
+}
+/**
+ * The list of Codex logins on this machine (§8 `agent_accounts`).
+ *
+ * Repairs the home first, without forcing anything (S4 item 2), so a real file
+ * the CLI left in place of the link is back in its store before the rows are
+ * read. No subprocess anywhere in it.
+ */
+export function listCodexAccounts(homedir = os.homedir()) {
+    const home = codexHomePath();
+    if (fs.existsSync(home))
+        repairCodexAuth({ homedir });
+    adoptOrphanDirectories(home);
+    const active = activeCodexAccountId(home);
+    const host = readCodexCredentialFile(hostCodexAuthFile(homedir));
+    const machineCard = {
+        id: MACHINE_ACCOUNT_ID,
+        kind: 'machine',
+        ...identityFields(host.identity),
+        active: active === MACHINE_ACCOUNT_ID,
+        ...loginOf(host, refusalActive('codex', MACHINE_ACCOUNT_ID)),
+        ...usageOf(host.identity.orgId),
+    };
+    const refreshed = new Map();
+    const saved = recordsOf()
+        .filter((record) => isAccountId(record.id) && dirExists(record.id, home))
+        .sort((a, b) => Date.parse(a.addedAt) - Date.parse(b.addedAt))
+        .map((record) => {
+        const credential = readCodexCredentialFile(codexAccountAuthFile(record.id, home));
+        const readable = Object.keys(credential.identity).length > 0;
+        if (readable && !sameIdentity(record.lastSeenIdentity, credential.identity)) {
+            refreshed.set(record.id, credential.identity);
+        }
+        // What the file says now; what it said last time when it cannot be read
+        // (a row whose login is gone keeps its name, D2).
+        const identity = readable ? credential.identity : record.lastSeenIdentity;
+        const refused = refusalActive('codex', record.id) || markHolds(record.loginExpiredAt, credential.writtenMs);
+        const same = identity?.orgId !== undefined &&
+            host.identity.orgId !== undefined &&
+            identity.orgId === host.identity.orgId;
+        return {
+            id: record.id,
+            kind: 'saved',
+            ...identityFields(identity),
+            addedAt: record.addedAt,
+            active: active === record.id,
+            ...loginOf(credential, refused),
+            ...usageOf(identity?.orgId),
+            ...(same ? { sameAsMachine: true } : {}),
+        };
+    });
+    if (refreshed.size > 0) {
+        try {
+            updateAgentAuth((file) => {
+                const at = new Date().toISOString();
+                for (const record of file.codexAccounts ?? []) {
+                    const identity = refreshed.get(record.id);
+                    if (identity)
+                        record.lastSeenIdentity = { ...identity, at };
+                }
+            });
+        }
+        catch (error) {
+            log.warn('codex-accounts: could not remember who the saved logins are', {
+                error: String(error),
+            });
+        }
+    }
+    return { accounts: [machineCard, ...saved], active };
+}
+function cardOf(id) {
+    const card = listCodexAccounts().accounts.find((row) => row.id === id);
+    if (!card)
+        throw new AccountError('the account is not on this server any more');
+    return card;
+}
+/** The card of a row that just signed in – for the relay's log and the tests. */
+export function codexAccountCard(id) {
+    return cardOf(id);
+}
+// ─── Switching and forgetting ────────────────────────────────────────
+/**
+ * Make a row the login new Codex sessions start under (§8 `agent_account_activate`).
+ *
+ * Running sessions keep the tokens they started with; a refreshed login is
+ * returned to its own store before the link moves (S4 item 7). The machine row is
+ * refused only where the machine's owner wrote `[codex] auth = "own"`: there the
+ * host login is kept away from the runner on purpose, and the next repair would
+ * take the link out again.
+ */
+export function activateCodexAccount(id) {
+    const home = codexHomePath();
+    if (id === MACHINE_ACCOUNT_ID) {
+        if (configuredCodexAuth() === 'own') {
+            throw new AccountError('this server keeps Codex away from the login of the machine ([codex] auth = "own" in the runner config) – switch to a saved login instead');
+        }
+        assertNoLiveSessionsForMachineSwitch();
+    }
+    else {
+        if (!isAccountId(id) || !recordOf(id))
+            throw new AccountError('no such account on this server');
+        if (!dirExists(id, home)) {
+            throw new AccountError('the login of this account is gone from this server – forget it');
+        }
+    }
+    fs.mkdirSync(home, { recursive: true, mode: 0o700 });
+    setCodexActiveLogin(id, home);
+    return activeCodexAccountId(home);
+}
+/**
+ * Forget a saved Codex login: its file goes, its record goes (§8 `agent_account_forget`).
+ *
+ * The machine row cannot be forgotten. A row a live session runs under is
+ * refused – its process refreshes into that file until it ends. The row in use is
+ * switched to the machine login FIRST, so the link never points at nothing.
+ */
+export function forgetCodexAccount(id) {
+    if (id === MACHINE_ACCOUNT_ID) {
+        throw new AccountError('the login of this machine cannot be forgotten');
+    }
+    const record = isAccountId(id) ? recordOf(id) : undefined;
+    if (!record)
+        throw new AccountError('no such account on this server');
+    if (liveCodexAccountIds().has(id)) {
+        throw new AccountError('a running session uses this account – stop it first, then forget it');
+    }
+    const home = codexHomePath();
+    if (markedCodexAccount(home) === id) {
+        assertNoLiveSessionsForMachineSwitch();
+        if (configuredCodexAuth() === 'own') {
+            throw new AccountError('this is the only login Codex may use on this server ([codex] auth = "own") – switch to another saved login first');
+        }
+        setCodexActiveLogin(MACHINE_ACCOUNT_ID, home);
+    }
+    fs.rmSync(codexAccountDir(id, home), { recursive: true, force: true });
+    updateAgentAuth((file) => {
+        file.codexAccounts = (file.codexAccounts ?? []).filter((entry) => entry.id !== id);
+        if (file.codexAccounts.length === 0)
+            delete file.codexAccounts;
+    });
+    if (record.lastSeenIdentity?.orgId)
+        usageByKey.delete(record.lastSeenIdentity.orgId);
+    log.info('codex-accounts: an account was forgotten', { account: id });
+    return { active: activeCodexAccountId(home) };
+}
+// ─── What a session starts under ─────────────────────────────────────
+/**
+ * Moving the link to the MACHINE login while Codex sessions run is refused.
+ *
+ * Codex writes a refreshed token through whatever `auth.json` points at when the
+ * refresh comes back, and it only compares accounts when it RE-READS the file, not
+ * when it writes. A switch in that second would put a session's tokens into the
+ * file the link points at by then – and the host user's own `~/.codex/auth.json`
+ * is the one file DevBridge must never write (R13). Between saved logins the same
+ * second costs a re-login of a saved account and is left open (the plan: a switch
+ * acts on what starts after it); over the host's file it is not ours to risk.
+ */
+function assertNoLiveSessionsForMachineSwitch() {
+    const live = liveCodexAccountIds().size;
+    if (live === 0)
+        return;
+    throw new AccountError(live === 1
+        ? 'a Codex session is running on this server – close or pause it before switching to the login of this machine'
+        : `${live} Codex sessions are running on this server – close or pause them before switching to the login of this machine`);
+}
+/**
+ * Who the home a session is starting with belongs to: the row it is set to, and
+ * the identity of the login the link resolves to right now – read locally.
+ */
+export function codexSessionAccount(home) {
+    const id = home.auth === 'linked' || !home.accountId ? MACHINE_ACCOUNT_ID : home.accountId;
+    if (home.auth === 'missing')
+        return { id };
+    const identity = readCodexCredentialFile(path.join(home.path, 'auth.json')).identity;
+    return { id, ...identity };
+}
+/** sessionId → the Codex row that session's process runs under, and which process said so. */
+const sessionAccounts = new Map();
+/**
+ * `owner` is the session object itself: a session can end twice (the boot catch
+ * calls `stop()`, and the process exit calls it again), and a bare delete by
+ * sessionId then wiped the note of the RELAUNCHED session that had taken the
+ * same id – «forget» stopped refusing the account that session was using (found
+ * by the independent check of S4).
+ */
+export function noteCodexSessionAccount(sessionId, accountId, owner) {
+    sessionAccounts.set(sessionId, { accountId, owner });
+}
+export function releaseCodexSessionAccount(sessionId, owner) {
+    if (sessionAccounts.get(sessionId)?.owner === owner)
+        sessionAccounts.delete(sessionId);
+}
+/** Codex rows some live session process runs under right now. */
+export function liveCodexAccountIds() {
+    return new Set([...sessionAccounts.values()].map((entry) => entry.accountId));
+}
+// ─── The verdict on a saved row ──────────────────────────────────────
+/** Who the active row is, for `auth_status.activeAccount` (§8) – read locally, no CLI. */
+export function codexActiveAccountSummary(id, homedir = os.homedir()) {
+    const file = id === MACHINE_ACCOUNT_ID ? hostCodexAuthFile(homedir) : codexAccountAuthFile(id);
+    const identity = readCodexCredentialFile(file).identity;
+    const known = identity.orgId || identity.email ? identity : recordOf(id)?.lastSeenIdentity;
+    return {
+        id,
+        ...(known?.email ? { email: known.email } : {}),
+        ...(known?.orgId ? { orgId: known.orgId } : {}),
+    };
+}
+/** A refusal persisted on a saved row that still stands against its login file. */
+export function codexRowRefused(id) {
+    if (id === MACHINE_ACCOUNT_ID || !isAccountId(id))
+        return false;
+    const record = recordOf(id);
+    if (!record?.loginExpiredAt)
+        return false;
+    return markHolds(record.loginExpiredAt, readCodexCredentialFile(codexAccountAuthFile(id)).writtenMs);
+}
+/** A session under this saved row was refused (D2): mark it, remove nothing. */
+export function markCodexLoginExpired(id) {
+    if (!isAccountId(id))
+        return;
+    try {
+        updateAgentAuth((file) => {
+            const record = file.codexAccounts?.find((entry) => entry.id === id);
+            if (record)
+                record.loginExpiredAt = new Date().toISOString();
+        });
+    }
+    catch (error) {
+        log.warn('codex-accounts: could not record the refusal', { account: id, error: String(error) });
+    }
+}
+/** The row worked again. Writes only when there was a mark to clear. */
+export function clearCodexLoginExpired(id) {
+    if (!isAccountId(id) || !recordOf(id)?.loginExpiredAt)
+        return;
+    try {
+        updateAgentAuth((file) => {
+            const record = file.codexAccounts?.find((entry) => entry.id === id);
+            if (record)
+                delete record.loginExpiredAt;
+        });
+    }
+    catch (error) {
+        log.warn('codex-accounts: could not clear the refusal', { account: id, error: String(error) });
+    }
+}
+// ─── Limits a session saw ────────────────────────────────────────────
+/** subscription key → the windows a Codex session of it last reported, in this daemon. */
+const usageByKey = new Map();
+/**
+ * A Codex session reported its account's windows. Codex sends these after every
+ * model request, for the account the session runs under – so for a card they
+ * are that subscription's figures, as fresh as its last working session.
+ */
+export function noteCodexUsage(orgId, windows) {
+    if (!orgId)
+        return;
+    // The two windows a card has words for; a window Codex names otherwise stays in
+    // the session's own panel.
+    const rows = windows.flatMap((window) => (window.key === 'five_hour' || window.key === 'seven_day') &&
+        typeof window.usedPercent === 'number'
+        ? [{ key: window.key, label: null, percent: window.usedPercent, resetsAt: window.resetsAt }]
+        : []);
+    if (rows.length === 0)
+        return;
+    usageByKey.set(orgId, { rows, measuredAtMs: Date.now() });
+}
+function usageOf(orgId) {
+    const reading = orgId ? usageByKey.get(orgId) : undefined;
+    if (!reading)
+        return {};
+    return { usage: reading.rows, usageMeasuredAt: new Date(reading.measuredAtMs).toISOString() };
+}
+/** Forget every remembered reading – tests. */
+export function resetCodexUsage() {
+    usageByKey.clear();
+}
+//# sourceMappingURL=codex-accounts.js.map

package/dist/config.d.ts

@@ -34,9 +34,9 @@ declare const ConfigSchema: z.ZodObject<{
         token: string;
     }>>;
     codex: z.ZodOptional<z.ZodObject<{
-        auth: z.ZodDefault<z.ZodEnum<["link", "own"]>>;
+        auth: z.ZodOptional<z.ZodEnum<["link", "own"]>>;
     }, "strip", z.ZodTypeAny, {
-        auth: "link" | "own";
+        auth?: "link" | "own" | undefined;
     }, {
         auth?: "link" | "own" | undefined;
     }>>;
@@ -184,7 +184,7 @@ declare const ConfigSchema: z.ZodObject<{
         token: string;
     };
     codex?: {
-        auth: "link" | "own";
+        auth?: "link" | "own" | undefined;
     } | undefined;
     checkpoints?: {
         enabled: boolean;

package/dist/config.js

@@ -30,9 +30,12 @@ const ConfigSchema = z.object({
     //                    the owner also uses codex interactively on this machine:
     //                    OpenAI rotates refresh tokens, and two processes sharing
     //                    one credential store can invalidate each other.
+    // No schema default (#422 S4 item 2): «absent» and «written as link» are two
+    // different facts. Only a written mode is forced, and neither is forced over a
+    // saved login the dashboard switched to – the home's own mark decides then.
     codex: z
         .object({
-        auth: z.enum(['link', 'own']).default('link'),
+        auth: z.enum(['link', 'own']).optional(),
     })
         .optional(),
     // Layer-1 resource guard (plan §8.6): a ceiling the dashboard cannot raise.

package/dist/index.js

@@ -7,11 +7,11 @@ import path from 'node:path';
 import { promisify } from 'node:util';
 import { ClaudeAdapter } from './adapters/claude.js';
 import { CodexAdapter } from './adapters/codex.js';
-import { ensureCodexHome } from './adapters/codex-home.js';
+import { configureCodexAuth, discardAbandonedCodexStagingHomes, ensureCodexHome, } from './adapters/codex-home.js';
 import { sessionClaudePath } from './agent-binary.js';
 import { claimCageAuthority, runSystemctl } from './cage-authority.js';
 import { acquireDaemonLock, isHeldByAnother } from './daemon-lock.js';
-import { loadConfig, mergeIntoPairedConfig, requireConfig, saveConfig, } from './config.js';
+import { loadConfig, mergeIntoPairedConfig, requireConfig, saveConfig } from './config.js';
 import { log } from './log.js';
 import { installIsWritable, installPrefixFor, isSupervisedProcess, restartCapability, manualUpdateCommand, resolveInstalledPackageDir, } from './self-update.js';
 import { applyStoredClaudeToken } from './agent-auth.js';
@@ -647,15 +647,19 @@ async function cmdPair(args) {
  * per-session: a fresh home clones ~90 MB of plugin marketplace on first use.
  * A failure here disables Codex rather than the whole daemon.
  */
-function bootstrapCodex(config) {
+function bootstrapCodex() {
     try {
-        const home = ensureCodexHome({ auth: config.codex?.auth ?? 'link' });
-        log.info('codex: isolated home ready', { path: home.path, auth: home.auth });
+        const home = ensureCodexHome();
+        log.info('codex: isolated home ready', {
+            path: home.path,
+            auth: home.auth,
+            ...(home.accountId ? { account: home.accountId } : {}),
+        });
         // Deliberately NOT passing `codexHome`: the adapter re-asserts the home on
         // every session. Freezing this snapshot is how a credential that went
         // missing mid-day kept being reported as present while sessions failed.
-        // The mode does travel, so those repairs honour `[codex] auth = "own"`.
-        return new CodexAdapter({ authMode: config.codex?.auth ?? 'link' });
+        // Nor the mode: those repairs read it from `configureCodexAuth`.
+        return new CodexAdapter();
     }
     catch (error) {
         log.error('codex: could not prepare an isolated home — Codex disabled', {
@@ -985,8 +989,10 @@ async function cmdDaemon() {
     }
     try {
         // A sign-in the previous daemon accepted but never adopted (S2): nothing can
-        // be adopting before the supervisor exists.
+        // be adopting before the supervisor exists. Codex sign-ins too (S4) – and
+        // the fixed-path staging home runners before S4 never removed.
         discardAbandonedStagingHomes();
+        discardAbandonedCodexStagingHomes();
     }
     catch (error) {
         log.warn('daemon: could not remove sign-in homes a previous daemon left', {
@@ -994,9 +1000,16 @@ async function cmdDaemon() {
         });
     }
     void refreshAccountIdentity(MACHINE_ACCOUNT_ID).catch(() => undefined);
+    // Only a mode the owner WROTE is ever forced, and never over a saved login
+    // (#422 S4 item 2): the defaults that used to be passed around re-linked the
+    // host login at every start, session and probe. Recorded whatever is on PATH:
+    // Codex may be installed from the dashboard later, and the account commands and
+    // the minute probe read this from the first moment (found by the independent
+    // check of S4).
+    configureCodexAuth(config.codex?.auth);
     const agents = installedAgents();
     const ws = new RunnerWsClient(config.api.ws_url, config.server.token, runnerCapabilities());
-    const codex = agents.includes('codex') ? bootstrapCodex(config) : null;
+    const codex = agents.includes('codex') ? bootstrapCodex() : null;
     const supervisor = new Supervisor(ws, {
         adapters: {
             CLAUDE: new ClaudeAdapter(),
@@ -1015,7 +1028,7 @@ async function cmdDaemon() {
          * `hasExecutable` is asked HERE, at the moment of the question, which is
          * the whole point.
          */
-        makeAdapter: (agent) => agent === 'CODEX' && hasExecutable('codex') ? bootstrapCodex(config) : null,
+        makeAdapter: (agent) => (agent === 'CODEX' && hasExecutable('codex') ? bootstrapCodex() : null),
         ...(config.mcp ? { mcp: { url: config.mcp.url, token: config.mcp.token } } : {}),
         ...(config.limits?.max_sessions ? { maxSessionsLimit: config.limits.max_sessions } : {}),
         /**
@@ -1673,6 +1686,9 @@ async function cmdDoctor(args) {
     // reloads systemd, which is the `install` grade and nothing above it (#403).
     claimCageAuthority(fix ? 'install' : 'probe');
     const config = loadConfig();
+    // The same Codex mode the daemon honours, or doctor's verdict would repair the
+    // home by a rule the daemon does not follow (#422 S4 item 2).
+    configureCodexAuth(config?.codex?.auth);
     print(`devbridge-runner ${RUNNER_VERSION}`);
     print(config ? `Paired with: ${config.server.name} (${config.api.url})` : 'Not paired');
     // Paths given on the command line win; otherwise check what this runner has

package/dist/login-marks.d.ts

@@ -22,6 +22,17 @@ import type { RelayAgentName } from './agent-registry.js';
  */
 /** The machine's own login – the one row every agent has. */
 export declare const MACHINE_ACCOUNT_ID = "machine";
+/**
+ * A saved account's id – twelve lowercase letters and digits, never `machine`.
+ * One format for both agents (#422 S4): the wire, the refusal marks and the
+ * dashboard read the same alphabet whichever agent a row belongs to.
+ */
+export declare function isAccountId(id: unknown): id is string;
+/** A refusal meant for a person: the wire (S2) sends its message as it is, and it names no path. */
+export declare class AccountError extends Error {
+    constructor(message: string);
+}
+export declare function newAccountId(): string;
 /** A session under this agent and account was just refused. */
 export declare function noteRefusal(agent: RelayAgentName, accountId?: string): void;
 /** The sign-in worked again. Answers whether a refusal was being held. */

package/dist/login-marks.js

@@ -1,3 +1,4 @@
+import crypto from 'node:crypto';
 /**
  * What the agent actually experienced with a sign-in — per agent AND per account.
  *
@@ -21,6 +22,28 @@
  */
 /** The machine's own login – the one row every agent has. */
 export const MACHINE_ACCOUNT_ID = 'machine';
+const ACCOUNT_ID = /^[a-z0-9]{12}$/;
+/**
+ * A saved account's id – twelve lowercase letters and digits, never `machine`.
+ * One format for both agents (#422 S4): the wire, the refusal marks and the
+ * dashboard read the same alphabet whichever agent a row belongs to.
+ */
+export function isAccountId(id) {
+    return typeof id === 'string' && ACCOUNT_ID.test(id);
+}
+/** A refusal meant for a person: the wire (S2) sends its message as it is, and it names no path. */
+export class AccountError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'AccountError';
+    }
+}
+export function newAccountId() {
+    // base32-ish from random bytes: 12 characters of [a-z0-9].
+    const alphabet = 'abcdefghijklmnopqrstuvwxyz0123456789';
+    const bytes = crypto.randomBytes(12);
+    return Array.from(bytes, (byte) => alphabet[byte % alphabet.length]).join('');
+}
 const AUTH_FAILURE_TTL_MS = 15 * 60_000;
 const refusals = new Map();
 const keyOf = (agent, accountId) => `${agent}:${accountId}`;

package/dist/supervisor.d.ts

@@ -1144,6 +1144,36 @@ export declare class Supervisor {
      * rewound (ticket #126).
      */
     private park;
+    /**
+     * Move the sessions running right now onto the account just made active (#422 S4.1).
+     *
+     * A process reads its account ONCE, at its start: `CLAUDE_CONFIG_DIR` for
+     * Claude, the link `codex-home/auth.json` resolves to for Codex. Neither can
+     * be changed under a live process, so «apply to the open sessions» is parking
+     * them – the conversation is kept (`--resume` / `thread/resume`) and the next
+     * message starts a process on the account the machine is now set to.
+     *
+     * A session in the middle of a turn is not killed for this: it is marked and
+     * parked at the end of its turn (`applyPendingAccountSwitch`). Which is why
+     * the answer counts the two separately – the window says so in words.
+     */
+    private applyAccountToSessions;
+    /**
+     * Park a session because the account under it changed – its own words.
+     *
+     * `quiet`, then a note of its own: «the runner switched to another session»
+     * is simply untrue here, and this is the one thing the person needs to read
+     * to know why their session is waiting for a message (the same reason #126
+     * gave the rewind its own wording).
+     */
+    private parkForAccount;
+    /**
+     * The turn is over – carry out a switch that arrived while it was running.
+     *
+     * Still not parkable (a card is open, a question is waiting): the mark stays
+     * and the next end of a turn tries again. Nothing here ever kills a turn.
+     */
+    private applyPendingAccountSwitch;
     /**
      * The agent is producing output while this runner still says a human is
      * expected — put `lastReported` back to RUNNING (ticket #185).