@bridge4dev/runner 0.67.0 → 0.68.0

package/dist/account-commands.d.ts

@@ -33,11 +33,31 @@ export type AccountCommandReply = {
     error: string;
     result?: unknown;
 };
+/**
+ * What became of the sessions running when an account was switched (#422 S4.1).
+ *
+ * `switched` – parked right now, so their next message starts them on the new
+ * account with their conversation kept; `pending` – in the middle of a turn,
+ * marked and parked the moment that turn ends. A turn is never killed for a
+ * switch.
+ */
+export interface AccountApplyReport {
+    switched: number;
+    pending: number;
+}
+/**
+ * The supervisor's side of «apply to the open sessions» – it is the one that
+ * holds them. Absent in the tests that drive the commands alone; then the
+ * answer carries no `applied` and nothing was moved.
+ */
+export type AccountApply = (agent: RelayAgent, accountId: string, label?: string) => AccountApplyReport;
 /** The two sign-in steps the commands drive – `AuthRelay`, or a test double. */
 export interface AccountSignIn {
-    startAccountLogin(target: AccountLoginTarget, agent?: RelayAgent): Promise<LoginStartResult>;
+    startAccountLogin(target: AccountLoginTarget, agent?: RelayAgent, options?: {
+        activate?: boolean;
+    }): Promise<LoginStartResult>;
     submitAccountCode(code: string): Promise<AccountLoginCodeResult>;
 }
 export declare function isAccountCommand(name: string): name is AccountCommand;
-export declare function runAccountCommand(name: AccountCommand, args: Record<string, unknown>, signIn: AccountSignIn): Promise<AccountCommandReply>;
+export declare function runAccountCommand(name: AccountCommand, args: Record<string, unknown>, signIn: AccountSignIn, apply?: AccountApply): Promise<AccountCommandReply>;
 //# sourceMappingURL=account-commands.d.ts.map

package/dist/account-commands.js

@@ -1,5 +1,5 @@
-import { forgetAccount, listAccounts, setActiveAccount } from './claude-homes.js';
-import { activateCodexAccount, forgetCodexAccount, listCodexAccounts } from './codex-accounts.js';
+import { forgetAccount, listAccounts, readActiveAccountSummary, setActiveAccount, } from './claude-homes.js';
+import { activateCodexAccount, codexActiveAccountSummary, forgetCodexAccount, listCodexAccounts, } from './codex-accounts.js';
 import { AccountError, MACHINE_ACCOUNT_ID, isAccountId } from './login-marks.js';
 import { maskString } from './policy.js';
 /**
@@ -32,6 +32,15 @@ export const ACCOUNT_COMMANDS = [
  * R11). Codex joined in S4 – the same five commands and the same card.
  */
 export const ACCOUNT_AGENTS = ['claude', 'codex'];
+/**
+ * «And make it the one new sessions start on», the window's tick (S4.1).
+ *
+ * Absent – true: that is what every sign-in did before the tick existed, and an
+ * older API sends no such argument.
+ */
+function activateArg(args) {
+    return args['activate'] === false ? { activate: false } : {};
+}
 export function isAccountCommand(name) {
     return ACCOUNT_COMMANDS.includes(name);
 }
@@ -46,10 +55,40 @@ function refusal(error) {
 function accountIdArg(value) {
     return value === MACHINE_ACCOUNT_ID || isAccountId(value) ? value : null;
 }
-export async function runAccountCommand(name, args, signIn) {
+/**
+ * Who the account now active is, for the note the parked sessions are given.
+ *
+ * Read locally and never allowed to fail the switch itself: a label is a
+ * courtesy, the switch is the work.
+ */
+function labelOf(agent, id) {
+    try {
+        const summary = agent === 'codex' ? codexActiveAccountSummary(id) : readActiveAccountSummary(id);
+        return summary.email;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * «Apply to the sessions already running», when the caller asked for it (S4.1).
+ *
+ * An ARGUMENT of an existing command rather than a name of its own, which §8
+ * otherwise forbids – and safe here for one reason: a runner that does not know
+ * it still switches the account, it simply leaves the open sessions where they
+ * are. The API tells the two apart by this very field: an answer without
+ * `applied` to a request that asked for it IS «that machine is older», and the
+ * window says so instead of claiming sessions were moved.
+ */
+function appliedTo(agent, active, args, apply) {
+    if (args['applySessions'] !== true || !apply)
+        return {};
+    return { applied: apply(agent, active, labelOf(agent, active)) };
+}
+export async function runAccountCommand(name, args, signIn, apply) {
     const agent = args['agent'];
     if (agent === 'codex')
-        return runCodexAccountCommand(name, args, signIn);
+        return runCodexAccountCommand(name, args, signIn, apply);
     if (agent !== 'claude')
         return { ok: false, error: 'agent must be claude or codex' };
     try {
@@ -63,7 +102,10 @@ export async function runAccountCommand(name, args, signIn) {
                 if (target !== 'machine' && target !== 'saved') {
                     return { ok: false, error: 'target must be machine or saved' };
                 }
-                return { ok: true, result: await signIn.startAccountLogin(target) };
+                return {
+                    ok: true,
+                    result: await signIn.startAccountLogin(target, 'claude', activateArg(args)),
+                };
             }
             case 'agent_account_login_code': {
                 const code = args['code'];
@@ -79,7 +121,8 @@ export async function runAccountCommand(name, args, signIn) {
                     return { ok: false, error: 'no such account on this server' };
                 // The usage cache is keyed by subscription, so a switch leaves it alone:
                 // the new row's figures are already its own (R16, §8).
-                return { ok: true, result: { active: setActiveAccount(id) } };
+                const active = setActiveAccount(id);
+                return { ok: true, result: { active, ...appliedTo('claude', active, args, apply) } };
             }
             case 'agent_account_forget': {
                 const id = accountIdArg(args['id']);
@@ -101,7 +144,7 @@ export async function runAccountCommand(name, args, signIn) {
  * device sign-in finishes on the provider's page – there is no code to send; the
  * window learns the result from the list (§8).
  */
-async function runCodexAccountCommand(name, args, signIn) {
+async function runCodexAccountCommand(name, args, signIn, apply) {
     try {
         switch (name) {
             case 'agent_accounts':
@@ -111,7 +154,10 @@ async function runCodexAccountCommand(name, args, signIn) {
                 if (target !== 'machine' && target !== 'saved') {
                     return { ok: false, error: 'target must be machine or saved' };
                 }
-                return { ok: true, result: await signIn.startAccountLogin(target, 'codex') };
+                return {
+                    ok: true,
+                    result: await signIn.startAccountLogin(target, 'codex', activateArg(args)),
+                };
             }
             case 'agent_account_login_code': {
                 const result = {
@@ -124,7 +170,8 @@ async function runCodexAccountCommand(name, args, signIn) {
                 const id = accountIdArg(args['id']);
                 if (!id)
                     return { ok: false, error: 'no such account on this server' };
-                return { ok: true, result: { active: activateCodexAccount(id) } };
+                const active = activateCodexAccount(id);
+                return { ok: true, result: { active, ...appliedTo('codex', active, args, apply) } };
             }
             case 'agent_account_forget': {
                 const id = accountIdArg(args['id']);

package/dist/adapters/codex-home.d.ts

@@ -179,5 +179,6 @@ export declare function discardAbandonedCodexStagingHomes(): number;
  */
 export declare function adoptLoginResult(stagingDir: string, options?: {
     replaceActive?: boolean;
+    activate?: boolean;
 }): StoredCodexLogin;
 //# sourceMappingURL=codex-home.d.ts.map

package/dist/adapters/codex-home.js

@@ -769,7 +769,10 @@ export function adoptLoginResult(stagingDir, options = {}) {
         throw new AccountError('no sign-in in progress – start again');
     try {
         return storeCodexLogin(path.join(stagingDir, AUTH_FILENAME), {
-            activate: true,
+            // `activate` is the window's «and make it the one in use», on unless the
+            // person turned it off (S4.1); `replaceActive` is the one-login door,
+            // where a sign-in has always taken the place of the login in use (D27).
+            activate: options.activate !== false,
             ...(options.replaceActive ? { replaceActive: true } : {}),
         });
     }

package/dist/auth-relay.d.ts

@@ -105,7 +105,9 @@ export declare class AuthRelay {
      * (it prints an inference-only token, D1), so a «saved account» made from it
      * would be a row with no login. `machine` keeps the fallback it always had.
      */
-    startAccountLogin(target: AccountLoginTarget, agent?: RelayAgent): Promise<LoginStartResult>;
+    startAccountLogin(target: AccountLoginTarget, agent?: RelayAgent, options?: {
+        activate?: boolean;
+    }): Promise<LoginStartResult>;
     /** The CLI and the pty helper are both there – or a sentence saying which is not. */
     private assertCanRun;
     private startWith;

package/dist/auth-relay.js

@@ -226,7 +226,10 @@ export class AuthRelay {
      * (it prints an inference-only token, D1), so a «saved account» made from it
      * would be a row with no login. `machine` keeps the fallback it always had.
      */
-    async startAccountLogin(target, agent = 'claude') {
+    async startAccountLogin(target, agent = 'claude', options = {}) {
+        // Default true: that is what a sign-in has always done, and it is what an
+        // older API – which sends no such argument – must keep getting.
+        const activate = options.activate !== false;
         if (agent === 'codex') {
             // R13: the machine row of Codex is the host user's own `~/.codex/auth.json`,
             // which DevBridge has never written and does not start writing. A sign-in
@@ -239,13 +242,14 @@ export class AuthRelay {
             return this.startWith('codex', this.commands.codex ?? '', false, {
                 flow: 'account',
                 target: 'saved',
+                activate,
             });
         }
         this.cancel();
         this.assertCanRun('claude');
         const command = this.commands.claude ?? '';
         try {
-            return await this.startWith('claude', command, false, { flow: 'account', target });
+            return await this.startWith('claude', command, false, { flow: 'account', target, activate });
         }
         catch (error) {
             if (!looksLikeUnsupportedSubcommand(String(error)))
@@ -254,7 +258,11 @@ export class AuthRelay {
                 throw new Error('the Claude CLI on this server is too old to sign in to a saved account – update Claude Code and try again', { cause: error });
             }
             log.warn('auth-relay: this claude has no `auth login` — falling back to setup-token');
-            return this.startWith('claude', CLAUDE_LEGACY_LOGIN, true, { flow: 'account', target });
+            return this.startWith('claude', CLAUDE_LEGACY_LOGIN, true, {
+                flow: 'account',
+                target,
+                activate,
+            });
         }
     }
     /** The CLI and the pty helper are both there – or a sentence saying which is not. */
@@ -310,6 +318,7 @@ export class AuthRelay {
             captureToken,
             flow: door.flow,
             target: door.target,
+            activate: door.activate !== false,
             claudeStaging,
             codexStaging: stagingHome,
             exchanging: false,
@@ -351,7 +360,12 @@ export class AuthRelay {
                 // use instead of adding a row beside it: with the organization's option
                 // off, «a token overwrites the token» is what a sign-in has always meant
                 // (D27), and DevBridge writes no machine login for Codex to overwrite.
-                const stored = adoptCodexLogin(staging, { replaceActive: relay.flow === 'legacy' });
+                const stored = adoptCodexLogin(staging, {
+                    replaceActive: relay.flow === 'legacy',
+                    // «Log in, but do not switch to it» (S4.1): the row is stored and
+                    // listed, the link the sessions start from stays where it is.
+                    activate: relay.activate,
+                });
                 log.info('codex: device login completed — credential stored', {
                     account: stored.id,
                     replaced: Boolean(stored.replaced),
@@ -452,7 +466,7 @@ export class AuthRelay {
                 };
             }
             try {
-                const adopted = await adoptClaudeLogin(relay.claudeStaging);
+                const adopted = await adoptClaudeLogin(relay.claudeStaging, { activate: relay.activate });
                 // Adopted: the staging path no longer exists, nothing left to remove.
                 relay.claudeStaging = null;
                 clearAgentAuthFailure('claude', adopted.account.id);
@@ -574,7 +588,8 @@ export class AuthRelay {
             log.info('auth-relay: stored a long-lived Claude token for this runner');
             clearAgentAuthFailure('claude');
             forgetClaudeUsage();
-            activateMachineLogin();
+            if (relay.activate)
+                activateMachineLogin();
             return { ok: true, detail: 'signed in with a long-lived token stored on this server' };
         }
         // `claude auth login` writes the credential just before it exits; give the
@@ -588,7 +603,8 @@ export class AuthRelay {
             if (status.status === 'ok') {
                 clearAgentAuthFailure('claude');
                 forgetClaudeUsage();
-                activateMachineLogin();
+                if (relay.activate)
+                    activateMachineLogin();
                 return { ok: true };
             }
             await sleep(300);

package/dist/claude-homes.d.ts

@@ -407,7 +407,9 @@ export interface AdoptResult {
  * BEFORE a new home is moved into place, so a failed write never leaves a login
  * nobody can list or forget. The signed-in row becomes active (R15).
  */
-export declare function adoptLoginResult(stagingDir: string): Promise<AdoptResult>;
+export declare function adoptLoginResult(stagingDir: string, options?: {
+    activate?: boolean;
+}): Promise<AdoptResult>;
 /**
  * Bring a home that already holds a login into the store – by rename (D17, R7).
  *

package/dist/claude-homes.js

@@ -1347,7 +1347,12 @@ export function discardStagingHome(dir) {
  * BEFORE a new home is moved into place, so a failed write never leaves a login
  * nobody can list or forget. The signed-in row becomes active (R15).
  */
-export async function adoptLoginResult(stagingDir) {
+export async function adoptLoginResult(stagingDir, options = {}) {
+    // «And make it the one new sessions start on» – the window's own tick, on
+    // unless the person turned it off (S4.1). Off: the row is stored and listed,
+    // and the active account does not move. Default true, because that is what a
+    // sign-in has always done and what an older API still asks for.
+    const activate = options.activate !== false;
     if (!isStagingDir(stagingDir) || !lstatOrNull(stagingDir)?.isDirectory()) {
         throw new AccountError('no sign-in in progress – start again');
     }
@@ -1395,10 +1400,12 @@ export async function adoptLoginResult(stagingDir) {
             });
             throw error;
         }
-        updateAgentAuth((file) => {
-            file.claudeActiveAccount = id;
-        });
-        log.info('claude-homes: a new account was added', { account: id });
+        if (activate) {
+            updateAgentAuth((file) => {
+                file.claudeActiveAccount = id;
+            });
+        }
+        log.info('claude-homes: a new account was added', { account: id, active: activate });
         return { account: cardOf(id), active: activeAccountId() };
     }
     const home = accountHome(same.id);
@@ -1425,7 +1432,11 @@ export async function adoptLoginResult(stagingDir) {
                 record.lastSeenIdentity = stamped;
             delete record.loginExpiredAt;
         }
-        file.claudeActiveAccount = same.id;
+        // The row that signed in again is the SAME row: leaving the pointer alone
+        // when the tick is off keeps whatever was active active – including this
+        // row, when it already was.
+        if (activate)
+            file.claudeActiveAccount = same.id;
     });
     // A fresh login outranks anything remembered about the one it replaced – on
     // disk above, and in this process's memory of refusals here.

package/dist/supervisor.d.ts

@@ -1144,6 +1144,36 @@ export declare class Supervisor {
      * rewound (ticket #126).
      */
     private park;
+    /**
+     * Move the sessions running right now onto the account just made active (#422 S4.1).
+     *
+     * A process reads its account ONCE, at its start: `CLAUDE_CONFIG_DIR` for
+     * Claude, the link `codex-home/auth.json` resolves to for Codex. Neither can
+     * be changed under a live process, so «apply to the open sessions» is parking
+     * them – the conversation is kept (`--resume` / `thread/resume`) and the next
+     * message starts a process on the account the machine is now set to.
+     *
+     * A session in the middle of a turn is not killed for this: it is marked and
+     * parked at the end of its turn (`applyPendingAccountSwitch`). Which is why
+     * the answer counts the two separately – the window says so in words.
+     */
+    private applyAccountToSessions;
+    /**
+     * Park a session because the account under it changed – its own words.
+     *
+     * `quiet`, then a note of its own: «the runner switched to another session»
+     * is simply untrue here, and this is the one thing the person needs to read
+     * to know why their session is waiting for a message (the same reason #126
+     * gave the rewind its own wording).
+     */
+    private parkForAccount;
+    /**
+     * The turn is over – carry out a switch that arrived while it was running.
+     *
+     * Still not parkable (a card is open, a question is waiting): the mark stays
+     * and the next end of a turn tries again. Nothing here ever kills a turn.
+     */
+    private applyPendingAccountSwitch;
     /**
      * The agent is producing output while this runner still says a human is
      * expected — put `lastReported` back to RUNNING (ticket #185).

package/dist/supervisor.js

@@ -19,7 +19,7 @@ import { applySession, gitBranches, gitCommit, gitDiff, gitLog, gitPush, gitRefs
 import { fsView } from './fsview.js';
 import { publishFile } from './file-publish.js';
 import { agentAuthStatuses, AuthRelay, clearAgentAuthFailure, noteAgentAuthFailure, } from './auth-relay.js';
-import { isAccountCommand, runAccountCommand } from './account-commands.js';
+import { isAccountCommand, runAccountCommand, } from './account-commands.js';
 import { isSupervisedProcess, selfUpdate } from './self-update.js';
 import { installAgent } from './agent-install.js';
 import { autoUpdateRefusal, claimAgentAutoUpdate } from './agent-auto-update.js';
@@ -3337,7 +3337,11 @@ export class Supervisor {
                 activeMs: Supervisor.spentMs(running),
                 errorMessage: event.errorMessage ?? 'Agent turn failed',
             });
+            return;
         }
+        // The turn is over – so an account switch that arrived while it was running
+        // can be carried out now, without costing that turn (#422 S4.1).
+        this.applyPendingAccountSwitch(running);
     }
     /**
      * Hold a turn that produced nothing, in case it was never a turn (#300).
@@ -3578,6 +3582,93 @@ export class Supervisor {
         }
         running.session.stop('session_parked');
     }
+    /**
+     * Move the sessions running right now onto the account just made active (#422 S4.1).
+     *
+     * A process reads its account ONCE, at its start: `CLAUDE_CONFIG_DIR` for
+     * Claude, the link `codex-home/auth.json` resolves to for Codex. Neither can
+     * be changed under a live process, so «apply to the open sessions» is parking
+     * them – the conversation is kept (`--resume` / `thread/resume`) and the next
+     * message starts a process on the account the machine is now set to.
+     *
+     * A session in the middle of a turn is not killed for this: it is marked and
+     * parked at the end of its turn (`applyPendingAccountSwitch`). Which is why
+     * the answer counts the two separately – the window says so in words.
+     */
+    applyAccountToSessions(agent, accountId, label) {
+        let switched = 0;
+        let pending = 0;
+        for (const running of this.sessions.values()) {
+            if (agentByDbValue(running.descriptor.agent)?.wireKey !== agent)
+                continue;
+            const session = running.session;
+            // Parked already: whatever starts it next reads the active account then.
+            if (!session)
+                continue;
+            // Already there, or an adapter that does not name an account at all – a
+            // switch has nothing to do to it, and a stale mark must not outlive it.
+            if (!session.accountId || session.accountId === accountId) {
+                delete running.accountSwitchPending;
+                continue;
+            }
+            if (this.isParkable(running)) {
+                delete running.accountSwitchPending;
+                this.parkForAccount(running, label);
+                switched += 1;
+            }
+            else {
+                running.accountSwitchPending = { id: accountId, ...(label ? { label } : {}) };
+                pending += 1;
+            }
+        }
+        if (switched || pending) {
+            log.info('supervisor: the account switch reached the open sessions', {
+                agent,
+                account: accountId,
+                switched,
+                pending,
+            });
+        }
+        return { switched, pending };
+    }
+    /**
+     * Park a session because the account under it changed – its own words.
+     *
+     * `quiet`, then a note of its own: «the runner switched to another session»
+     * is simply untrue here, and this is the one thing the person needs to read
+     * to know why their session is waiting for a message (the same reason #126
+     * gave the rewind its own wording).
+     */
+    parkForAccount(running, label) {
+        this.sendEvent(running, 'system_note', {
+            // The word the dashboard reads to tell «parked» from «your turn» (#124) –
+            // the state IS parked; only the reason differs.
+            code: 'session_parked',
+            text: label
+                ? `The agent account on this server was switched to ${label} — send a message and this session carries on under it, with everything above kept.`
+                : 'The agent account on this server was switched — send a message and this session carries on under the new one, with everything above kept.',
+        });
+        this.park(running, { quiet: true });
+    }
+    /**
+     * The turn is over – carry out a switch that arrived while it was running.
+     *
+     * Still not parkable (a card is open, a question is waiting): the mark stays
+     * and the next end of a turn tries again. Nothing here ever kills a turn.
+     */
+    applyPendingAccountSwitch(running) {
+        const wanted = running.accountSwitchPending;
+        if (!wanted)
+            return;
+        if (!running.session || running.session.accountId === wanted.id) {
+            delete running.accountSwitchPending;
+            return;
+        }
+        if (!this.isParkable(running))
+            return;
+        delete running.accountSwitchPending;
+        this.parkForAccount(running, wanted.label);
+    }
     /**
      * The agent is producing output while this runner still says a human is
      * expected — put `lastReported` back to RUNNING (ticket #185).
@@ -7494,7 +7585,11 @@ export class Supervisor {
                     // #422: the five account commands – their own module, one door each
                     // over `claude-homes.ts` (plan §8).
                     if (isAccountCommand(frame.name)) {
-                        return void reply(await runAccountCommand(frame.name, frame.args ?? {}, this.authRelay));
+                        return void reply(
+                        // The fourth argument is «apply to the sessions already running»
+                        // (#422 S4.1): the commands know the accounts, this class knows
+                        // the sessions, so the switch reaches them from here.
+                        await runAccountCommand(frame.name, frame.args ?? {}, this.authRelay, (...args) => this.applyAccountToSessions(...args)));
                     }
                     return void reply({ ok: false, error: `Unknown command` });
             }

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const RUNNER_VERSION = "0.67.0";
+export declare const RUNNER_VERSION = "0.68.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in sync with package.json by the release script (manual for now).
-export const RUNNER_VERSION = '0.67.0';
+export const RUNNER_VERSION = '0.68.0';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge4dev/runner",
-  "version": "0.67.0",
+  "version": "0.68.0",
   "description": "DevBridge dev runner — connects a dev server to DevBridge and runs agent sessions (Claude Code / Codex)",
   "homepage": "https://bridge4.dev",
   "license": "MIT",