@byokit/openclaw 0.10.0 → 0.11.1

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 ## Unreleased
 
+## 0.11.1 (2026-10-12)
+
+- Dependency update: pins @byokit/discover 0.8.1.
+- FIX: (from @byokit/discover 0.8.1) `browse()` and `scan()` accept resolved services whose `fullName` carries the service type without a trailing dot (`host._type._tcp`, as Android's react-native-zeroconf delivers) or with a trailing `.local` domain suffix, case-insensitive, instead of only the `host.local._type._tcp.` shape. Android phones now discover computers over mDNS instead of always scanning empty.
+
+- FIX: restoring an engine home no longer rewrites a live file whose bytes already match the sealed object. `restore()` compares each decrypted object against the live file at the restore mode (0600) — size first, then bytes — and skips the temp write, file fsync, atomic rename and directory fsync when they match, so a start over an untouched tree pays no per-object writes. A missing, changed, different-mode or unreadable file restores exactly as before, and a skipped file changes nothing on disk, so the crash-durability contract is unchanged; nothing new is written to disk.
+- FEAT: OpenClaw kit S5 account spine: per-member `accounts/<member>.json` index (0600, atomic, no email/token/engine line) behind `kit.accounts`, `renameAccount` and `defaults`/`setDefaults`; a pre-O14 sign-in synthesizes an `addedAt: 0` entry, a default naming a removed account drops on read, and an unindexed `<member>--<hex6>` agent is never listed. `src/locks.ts` adds the per-agent shared/exclusive/live locks later steps use for runs, removal, moves and sealing.
+- FEAT: OpenClaw kit S6 `kit.addAccount(member, { authChoice, via?, name?, again? }, on)`: a member's first sign-in of a provider stays on its own agent, and each further one (or `again`) gets a new sealed agent `<member>--<hex6>` (drawn again on a collision) with account id `<provider>.<hex6>`, its index entry written before the agent and IDENTITY.md kept byte-identical. The ChatGPT authorize URL carries `prompt=login` so a second account can be chosen; the row reads `signing` until the sign-in ends; `done` comes only after the agent is sealed to that one sign-in and its `who` hash is indexed; a sign-in that fails, ends busy or is cancelled removes the new agent and its entry. `authChoice: 'openai-codex'` (the engine's id for ChatGPT) signs in on the `openai` route.
+- FEAT: OpenClaw kit S9 Auto input: `kit.models(member, id)` maps the account provider's `models.list { agentId, view: 'default' }` rows to `provider/model` (`missing-auth`/`auth-failed` → `why: 'signed_out'`, `cooldown` → `why: 'resting'` with `until = unavailableUntil`), and `kit.room(member, id, demand?)` reads the `models.authStatus { agentId }` row for the provider's tightest applying usage window (`left`, `span`, `resetsAt`; no `at`, no kit cache, unknown for API-key accounts and unanswered reads). Both hold the account agent's shared lock for the read. The fake gateway serves `models.list { agentId }` per agent and a cold per-provider usage cache (`setUsage`; no `usage` on the first answer carrying the provider).
+- FEAT: OpenClaw kit S10 account runs: `kit.run({ member, sessionKey, account: 'auto' | 'default' | id, model?, needs? })` picks one account once, before any request (Choosing, 5.15), checks its own sealed sign-in with `byokit.accounts ready` and runs on its agent; an unbound key that picks an account agent runs as `agent:<account agent>:<tail>`. The first event is `{ type: 'account', account, model, sessionKey, how, why, considered }`, an ok end carries `account` and `model`, a chosen account that fails its ready check ends `signed-out` after its account event, with no agent request (Auto skips such an account for the next one), an empty pick ends `signed-out`, a missing model ends `plan`, and a resting end writes `until` (now + 5 min when the message names none) so the next Auto skips the account. `needs` alone resolves as `account: 'default'`; with `account` absent and `needs` absent or empty a run is unchanged. Account runs hold the agent's shared lock to their end, and index edits now take their own per-member lock, so a live run never blocks a rename or a listing. A model the engine reports unavailable only because its account is signed out or resting still counts as that account's plan. Session binding arrives in the next step.
+
+## 0.11.0 (2026-10-12)
+
+- Dependency update: pins @byokit/ui 0.7.0.
+- Dependency update: pins @byokit/secrets 0.5.1.
+- Dependency update: pins @byokit/discover 0.8.0.
+- Dependency update: pins @byokit/relay 0.6.1.
+- Dependency update: pins @byokit/pair 0.10.0.
+
+- FEAT: `byokit.accounts` seals an agent's own sign-ins (list/seal/ready/adopt/clear), loaded as the `plugin/accounts.js` gateway method; a failed `adopt` rolls the model and both profile stores back so no partial move or dangling pin survives, a self-adopt is refused, and the fake gateway mirrors every branch.
+
 ## 0.10.0 (2026-10-11)
 
 - Dependency update: pins @byokit/discover 0.7.0.

package/README.md

@@ -124,12 +124,18 @@ engine text that could echo the token. It is sent only as this member's wizard a
 results or kit logs. Ordinary browser paste and typed `kit.call('wizard.next', …)` pass-through are unchanged.
 API key (billed per use) entry still requires explicit selection; there is no subscription-to-key fallback.
 
-To choose which of a member's accounts a run uses, pass `model: 'provider/model'` in the run spec (for example
+To choose the model for a run, pass `model: 'provider/model'` in the run spec (for example
 `'openai/gpt-5.1'`, where `provider` is an id `kit.providers(member)` lists). That provider is the one called and billed for this run only, with no fallback to another
 provider or model. If the member isn't signed in to it, the run ends `{ ok: false, kind: 'signed-out' }` and the
 engine is never called. Leave `model` out to keep the engine's own choice. A specific sign-in (`@profile`) can't be
 picked per run: the pinned engine may still switch to another sign-in for the same provider.
 
+To let the kit choose among a member's accounts, pass `account: 'auto'` (the account with the most room left, decided
+once at run start), `'default'` (the saved default) or an id from `kit.accounts(member)`, with `needs: ['provider/model', …]`
+for other models the run may call. The first event is `{ type: 'account', account, model, sessionKey, how, why, considered }`,
+and an ok end carries `account` and `model`. A chosen account that isn't signed in ends `signed-out` with no agent request;
+when every account is resting, the end is `resting` with `until`, and Auto skips a resting account until then.
+
 
 For an owner who explicitly offers keys, `kit.addKey('ana', { authChoice: 'openai-api-key', apiKey })` returns
 `ok`, `invalid` or `not_included`. Label the option **API key (billed per use)**. Select only `routes()` rows with

package/dist/accounts.d.ts

@@ -0,0 +1,47 @@
+import { createLocks } from './locks.ts';
+import type { Account, AccountId, AccountPick, Defaults, GatewayTransport, Member, ModelInfo, Room, RunSelection, SignInOptions, SignInView } from './types.ts';
+type AddOptions = {
+    authChoice: string;
+    via?: 'browser' | 'code';
+    name?: string;
+    again?: AccountId;
+};
+type AccountSignIn = {
+    id: AccountId;
+    paste(text: string): void;
+    cancel(): void;
+    done: Promise<{
+        view: SignInView;
+        id: AccountId;
+    }>;
+};
+type StartSignIn = (agentId: string, o: SignInOptions, on: (v: SignInView) => void, fresh: boolean) => {
+    paste(text: string): void;
+    cancel(): void;
+    done: Promise<SignInView>;
+};
+export declare function createAccounts(ctx: {
+    request: GatewayTransport['request'];
+    root: string;
+    ensure(member: Member): Promise<{
+        agentId: string;
+        workspace: string;
+    }>;
+    locks: ReturnType<typeof createLocks>;
+    signIn: StartSignIn;
+    log?: (line: string) => void;
+}): {
+    list(member: Member): Promise<Account[]>;
+    add(member: Member, o: AddOptions, on: (v: SignInView) => void): Promise<AccountSignIn>;
+    rename(member: Member, id: AccountId, name: string): Promise<Account>;
+    defaults(member: Member): Promise<Defaults>;
+    setDefaults(member: Member, d: Defaults): Promise<void>;
+    models(member: Member, id: AccountId): Promise<ModelInfo[]>;
+    room(member: Member, id: AccountId, demand?: string[]): Promise<Room>;
+    pick(member: Member, sel: RunSelection, skip?: readonly AccountId[]): Promise<{
+        pick: AccountPick;
+        agent?: string;
+    }>;
+    rest(member: Member, id: AccountId, until: number): Promise<void>;
+};
+export {};

package/dist/accounts.js

@@ -0,0 +1,499 @@
+// The per-member account index (5.15, O14 step S5): `<root>/accounts/<member>.json` (0600, whole-file temp
+// plus rename) is the only kit state: `{ v: 1, accounts: { [id]: { agent, name, route, addedAt, until?, model?,
+// who? } }, defaults }`. No credential, token, email or engine line. Listing, rename, defaults, models, room,
+// adding (O14 step S6) and the start-of-run pick (S10) live here; remove and move arrive in later steps.
+import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { randomBytes, randomUUID } from 'node:crypto';
+import { join } from 'node:path';
+import { providerOf, resolveSelection } from "./pick.js";
+import { KEY_PREFIX, MEMBER_ID, NEW_MEMBER_ID, untilListed } from "./members.js";
+import { routes, routeFor } from "./routes.js";
+import { words } from "./words.js";
+const ACCOUNT_AGENT = /^[a-z][a-z0-9-]{0,31}--[0-9a-f]{6}$/;
+const usable = (status) => status === 'ok' || status === 'expiring' || status === 'static';
+const IDENTITY = 'IDENTITY.md';
+const named = (name, op) => {
+    const trimmed = typeof name === 'string' ? name.trim() : '';
+    if (!trimmed || trimmed.length > 100 || /[\u0000-\u001f\u007f]/.test(trimmed))
+        throw new Error(`${op}: name is empty`);
+    return trimmed;
+};
+const empty = () => ({ v: 1, accounts: {}, defaults: {} });
+const validEntry = (v) => !!v && typeof v === 'object'
+    && typeof v.agent === 'string' && typeof v.name === 'string'
+    && typeof v.route === 'string' && Number.isFinite(v.addedAt)
+    && (v.until === undefined || Number.isFinite(v.until))
+    && (v.model === undefined || typeof v.model === 'string')
+    && (v.who === undefined || typeof v.who === 'string');
+export function createAccounts(ctx) {
+    const path = (member) => join(ctx.root, 'accounts', `${member}.json`);
+    // Accounts whose sign-in is running, as `<member>\n<id>`, counted per add: listed `signing` until the last one ends.
+    const signing = new Map();
+    // The index file's own lock, apart from any agent's: a run's shared hold on the member agent never blocks an edit.
+    const indexLock = (member) => `${member}#index`;
+    const check = (member) => {
+        if (!MEMBER_ID.test(member) || member.startsWith(KEY_PREFIX))
+            throw new Error(`invalid member id: ${member}`);
+    };
+    const read = (member) => {
+        let text;
+        try {
+            text = readFileSync(path(member), 'utf8');
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return empty();
+            throw error;
+        }
+        const file = JSON.parse(text);
+        if (!file || typeof file !== 'object' || file.v !== 1)
+            return empty();
+        const accounts = {};
+        for (const [id, entry] of Object.entries(file.accounts ?? {}))
+            if (validEntry(entry))
+                accounts[id] = entry;
+        const raw = file.defaults && typeof file.defaults === 'object' ? file.defaults : {};
+        const defaults = {};
+        if (typeof raw.account === 'string')
+            defaults.account = raw.account;
+        if (typeof raw.model === 'string')
+            defaults.model = raw.model;
+        if (typeof raw.auto === 'boolean')
+            defaults.auto = raw.auto;
+        return { v: 1, accounts, defaults };
+    };
+    const write = (member, file) => {
+        mkdirSync(join(ctx.root, 'accounts'), { recursive: true, mode: 0o700 });
+        const tmp = `${path(member)}.${randomUUID()}.tmp`;
+        writeFileSync(tmp, JSON.stringify(file, null, 2) + '\n');
+        chmodSync(tmp, 0o600);
+        try {
+            renameSync(tmp, path(member));
+            chmodSync(path(member), 0o600);
+        }
+        finally {
+            rmSync(tmp, { force: true });
+        }
+    };
+    const metaOf = (choice) => {
+        const row = routes().find((r) => r.choice === choice);
+        if (row && (row.billing === 'subscription' || row.billing === 'api'))
+            return { label: row.label, billing: row.billing };
+        return { label: choice, billing: 'subscription' };
+    };
+    const synthesizedRoute = (provider) => routeFor(provider, 'browser')?.choice
+        ?? routes().find((r) => r.provider === provider && r.billing === 'subscription')?.choice
+        ?? provider;
+    const rosterOf = () => ctx.request('agents.list')
+        .then((r) => new Set(r.agents.map((a) => a.id)), () => new Set());
+    const profilesOf = (agentId) => ctx.request('byokit.accounts', { action: 'list', agentId })
+        .then((r) => Array.isArray(r.profiles) ? r.profiles : [], () => []);
+    const stateOf = (route, status, until) => {
+        if (!routes().some((r) => r.choice === route))
+            return 'not_included';
+        if (until !== undefined && until > Date.now())
+            return 'resting';
+        if (!status)
+            return 'signed_out';
+        return usable(status) ? 'ready' : status === 'expired' ? 'needs_again' : 'signed_out';
+    };
+    // Lock-free row builder over one snapshot: mutates `file` (synthesized entries, `who` backfill, dropped
+    // dangling default) and reports whether it did. Callers own the locking.
+    const build = async (member, agentId, file, roster, memberProfiles) => {
+        let dirty = false;
+        const byProvider = new Map();
+        for (const p of memberProfiles) {
+            if (typeof p.provider !== 'string' || !p.provider)
+                continue;
+            byProvider.set(p.provider, [...(byProvider.get(p.provider) ?? []), p]);
+        }
+        const memberRows = [];
+        const seen = new Set();
+        for (const [provider, profiles] of [...byProvider.entries()].sort(([a], [b]) => a < b ? -1 : 1)) {
+            let entry = file.accounts[provider];
+            if (!entry || entry.agent !== agentId) {
+                const route = entry?.agent === agentId && typeof entry.route === 'string' ? entry.route : synthesizedRoute(provider);
+                const same = Object.values(file.accounts).filter((e) => e.agent === agentId).length;
+                entry = { agent: agentId, name: `${metaOf(route).label} ${same + 1}`, route, addedAt: 0 };
+                file.accounts[provider] = entry;
+                dirty = true;
+            }
+            if (!entry.who && typeof profiles[0]?.who === 'string') {
+                entry.who = profiles[0].who;
+                dirty = true;
+            }
+            const meta = metaOf(entry.route);
+            memberRows.push({ id: provider, provider, route: entry.route, name: entry.name, label: meta.label,
+                billing: meta.billing, state: stateOf(entry.route, profiles[0]?.status, entry.until),
+                ...(entry.until !== undefined ? { until: entry.until } : {}), addedAt: entry.addedAt });
+            seen.add(provider);
+        }
+        for (const [id, entry] of Object.entries(file.accounts)) {
+            if (entry.agent !== agentId || id.includes('.') || seen.has(id))
+                continue;
+            const stale = metaOf(entry.route);
+            memberRows.push({ id, provider: id, route: entry.route, name: entry.name, label: stale.label,
+                billing: stale.billing, state: stateOf(entry.route, undefined, entry.until),
+                ...(entry.until !== undefined ? { until: entry.until } : {}), addedAt: entry.addedAt });
+        }
+        // Account agents: only what the index names, with exactly `<member>--<hex6>` shape. An unindexed
+        // agent of that shape is never listed, and an entry whose agent is gone is not listed either.
+        const agentRows = [];
+        for (const [id, entry] of Object.entries(file.accounts)) {
+            if (entry.agent === agentId || !ACCOUNT_AGENT.test(entry.agent) || !entry.agent.startsWith(`${member}--`))
+                continue;
+            if (!roster.has(entry.agent))
+                continue;
+            const provider = id.split('.')[0];
+            const meta = metaOf(entry.route);
+            const profiles = await profilesOf(entry.agent);
+            agentRows.push({ id, provider, route: entry.route, name: entry.name, label: meta.label,
+                billing: meta.billing, state: stateOf(entry.route, profiles[0]?.status, entry.until),
+                ...(entry.until !== undefined ? { until: entry.until } : {}), addedAt: entry.addedAt });
+        }
+        memberRows.sort((a, b) => a.addedAt - b.addedAt || (a.id < b.id ? -1 : 1));
+        agentRows.sort((a, b) => a.addedAt - b.addedAt);
+        const rows = [...memberRows, ...agentRows];
+        for (const row of rows)
+            if (signing.has(`${member}\n${row.id}`))
+                row.state = 'signing';
+        if (file.defaults.account !== undefined && !rows.some((r) => r.id === file.defaults.account)) {
+            delete file.defaults.account;
+            dirty = true;
+        }
+        return { rows, dirty };
+    };
+    const gather = (agentId) => Promise.all([rosterOf(), profilesOf(agentId)]);
+    const buildRows = async (member, agentId) => {
+        const file = read(member);
+        const [roster, profiles] = await gather(agentId);
+        return { ...(await build(member, agentId, file, roster, profiles)), file };
+    };
+    // The account's index entry, only when `list` names it: an unindexed agent is never reachable, whatever the
+    // file holds.
+    const entryOf = async (member, id) => {
+        const row = (await list(member)).find((r) => r.id === id);
+        const entry = read(member).accounts[id];
+        if (!row || !entry)
+            throw new Error(`unknown account: ${id}`);
+        return { row, entry };
+    };
+    const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+    // `models.list { agentId, view: 'default' }` rows of the account's provider, mapped to `provider/model`. The pin
+    // reports no per-plan availability, so `why: 'plan'` only comes from a run ending `plan`, never from here.
+    const modelsOf = (provider, answer) => {
+        const rows = record(answer) && Array.isArray(answer.models) ? answer.models : [];
+        const out = [];
+        for (const candidate of rows) {
+            if (!record(candidate) || typeof candidate.provider !== 'string'
+                || candidate.provider.toLowerCase() !== provider.toLowerCase())
+                continue;
+            if (typeof candidate.id !== 'string' || !candidate.id || typeof candidate.name !== 'string')
+                continue;
+            const id = candidate.id.includes('/') ? candidate.id : `${candidate.provider}/${candidate.id}`;
+            if (providerOf(id) !== provider.toLowerCase())
+                continue;
+            const available = candidate.available === undefined
+                ? candidate.unavailableReason === undefined : candidate.available === true;
+            const info = { id, name: candidate.name, available };
+            if ((candidate.tier === 'strong' || candidate.tier === 'fast'))
+                info.tier = candidate.tier;
+            if (!available) {
+                if (candidate.unavailableReason === 'missing-auth' || candidate.unavailableReason === 'auth-failed')
+                    info.why = 'signed_out';
+                else if (candidate.unavailableReason === 'cooldown') {
+                    info.why = 'resting';
+                    if (typeof candidate.unavailableUntil === 'number' && Number.isFinite(candidate.unavailableUntil))
+                        info.until = candidate.unavailableUntil;
+                }
+            }
+            out.push(info);
+        }
+        return out;
+    };
+    const spanOf = (label) => {
+        const lower = label.toLowerCase();
+        if (lower === 'session')
+            return 'session';
+        if (lower === 'weekly')
+            return 'week';
+        if (lower === 'monthly')
+            return 'month';
+        return 'tightest';
+    };
+    // The `models.authStatus { agentId }` row for the account's provider: of its `usage.windows` entries the one
+    // with the highest numeric `usedPercent` gives `left`, `resetsAt` and `span`. A window applies to every model
+    // unless the engine scopes it to models; the pin's rows carry no scope, so the demand never narrows them today
+    // (the tightest known). A window without a numeric `usedPercent` is skipped, never read as unused. `at` is left
+    // out: the pin exposes no reading age, so the kit never stamps receipt time as reading time. The kit adds no
+    // cache: every call reads live.
+    const roomOf = (provider, answer) => {
+        const unknown = { left: 'unknown' };
+        const rows = record(answer) && Array.isArray(answer.providers) ? answer.providers : undefined;
+        if (!rows)
+            return unknown;
+        const row = rows.find((r) => record(r) && typeof r.provider === 'string'
+            && r.provider.toLowerCase() === provider.toLowerCase());
+        if (!row || !record(row))
+            return unknown;
+        const windows = record(row.usage) && Array.isArray(row.usage.windows) ? row.usage.windows : undefined;
+        if (!windows)
+            return unknown;
+        let best;
+        for (const candidate of windows) {
+            if (!record(candidate))
+                continue;
+            if (typeof candidate.usedPercent !== 'number' || !Number.isFinite(candidate.usedPercent))
+                continue;
+            const span = spanOf(typeof candidate.label === 'string' ? candidate.label : '');
+            const resetAt = typeof candidate.resetAt === 'number' && Number.isFinite(candidate.resetAt)
+                ? candidate.resetAt : undefined;
+            if (!best || candidate.usedPercent > best.used)
+                best = { used: candidate.usedPercent, ...(resetAt !== undefined ? { resetAt } : {}), span };
+        }
+        if (!best)
+            return unknown;
+        return { left: 100 - best.used, span: best.span, ...(best.resetAt !== undefined ? { resetsAt: best.resetAt } : {}) };
+    };
+    async function list(member) {
+        check(member);
+        const { agentId } = await ctx.ensure(member);
+        const first = await ctx.locks.shared(indexLock(member), () => buildRows(member, agentId));
+        if (!first.dirty)
+            return first.rows;
+        // A write is needed (synthesized entry, `who` backfill or dropped default): redo it under the
+        // exclusive lock so two first-lists cannot interleave their read-modify-write.
+        return ctx.locks.exclusive([indexLock(member)], async () => {
+            const { rows, dirty, file } = await buildRows(member, agentId);
+            if (dirty)
+                write(member, file);
+            return rows;
+        });
+    }
+    async function rename(member, id, name) {
+        check(member);
+        const trimmed = named(name, 'renameAccount');
+        if (!(await list(member)).some((r) => r.id === id))
+            throw new Error(`unknown account: ${id}`);
+        await ctx.locks.exclusive([indexLock(member)], async () => {
+            const file = read(member);
+            const entry = file.accounts[id];
+            if (!entry)
+                throw new Error(`unknown account: ${id}`);
+            entry.name = trimmed;
+            write(member, file);
+        });
+        const done = (await list(member)).find((r) => r.id === id);
+        if (!done)
+            throw new Error(`unknown account: ${id}`);
+        return done;
+    }
+    async function defaults(member) {
+        await list(member);
+        return read(member).defaults;
+    }
+    async function setDefaults(member, d) {
+        check(member);
+        if (!d || typeof d !== 'object')
+            throw new Error('setDefaults: defaults are invalid');
+        if (d.account !== undefined && typeof d.account !== 'string')
+            throw new Error('setDefaults: defaults are invalid');
+        if (d.model !== undefined && typeof d.model !== 'string')
+            throw new Error('setDefaults: defaults are invalid');
+        if (d.auto !== undefined && typeof d.auto !== 'boolean')
+            throw new Error('setDefaults: defaults are invalid');
+        await ctx.ensure(member);
+        return ctx.locks.exclusive([indexLock(member)], async () => {
+            const file = read(member);
+            const next = {};
+            if (d.account !== undefined)
+                next.account = d.account;
+            if (d.model !== undefined)
+                next.model = d.model;
+            if (d.auto !== undefined)
+                next.auto = d.auto;
+            write(member, { ...file, defaults: next });
+        });
+    }
+    async function models(member, id) {
+        check(member);
+        await ctx.ensure(member);
+        const { row, entry } = await entryOf(member, id);
+        return readModels(row, entry);
+    }
+    // The shared hold covers the read, so no kit read of the agent is in flight while it is removed.
+    const readModels = (row, entry) => ctx.locks.shared(entry.agent, async () => modelsOf(row.provider, await ctx.request('models.list', { agentId: entry.agent, view: 'default' })));
+    async function room(member, id, demand) {
+        check(member);
+        await ctx.ensure(member);
+        const { row, entry } = await entryOf(member, id);
+        return readRoom(row, entry);
+    }
+    // An API-key account is used only when chosen, never by Auto: its room is always unknown, with no read. A demand
+    // never narrows the windows (see `roomOf`), so the read takes none.
+    const readRoom = (row, entry) => row.billing === 'api'
+        ? Promise.resolve({ left: 'unknown' })
+        : ctx.locks.shared(entry.agent, async () => {
+            let answer;
+            try {
+                answer = await ctx.request('models.authStatus', { agentId: entry.agent }, { timeoutMs: 20_000 });
+            }
+            catch {
+                return { left: 'unknown' };
+            }
+            return roomOf(row.provider, answer);
+        });
+    // Choosing (5.15) for an unbound key: every listed account's room and models are read live once, then the pure
+    // `resolveSelection` decides. `agent` is the picked account's engine agent. A model unavailable only because the
+    // account is signed out or resting is still in its plan: the account's state and the run's ready check judge that.
+    // The pinned engine may hold no prepared model catalog for an agent added since it started, and refuses its models; that
+    // row's models are then unknown (`undefined`), and `resolveSelection` host-validates its membership by provider.
+    async function pick(member, sel, skip = []) {
+        const rows = (await list(member)).filter((r) => !skip.includes(r.id));
+        const file = read(member);
+        const reads = new Map(await Promise.all(rows.map(async (row) => {
+            const entry = file.accounts[row.id];
+            const models = await readModels(row, entry).then((ms) => ms.map((m) => (m.why ? { ...m, available: true } : m)), () => undefined);
+            return [row.id, { room: await readRoom(row, entry), models }];
+        })));
+        const chosen = resolveSelection(rows, file.defaults, sel, (a) => reads.get(a.id).room, Date.now(), (a) => reads.get(a.id).models);
+        return { pick: chosen, ...(chosen.ok ? { agent: file.accounts[chosen.account.id].agent } : {}) };
+    }
+    // A run on the account ended resting: Auto skips it until `until` (its state reads `resting` until then).
+    const rest = (member, id, until) => edit(member, (file) => { const entry = file.accounts[id]; if (entry)
+        entry.until = until; });
+    // Index edits take the index lock, as listing's own write does.
+    const edit = (member, fn) => ctx.locks.exclusive([indexLock(member)], async () => { const file = read(member); fn(file); write(member, file); });
+    const identityOf = async (agentId) => {
+        const { file } = await ctx.request('agents.files.get', { agentId, name: IDENTITY });
+        return file.missing ? undefined : file.content;
+    };
+    const restoreIdentity = async (memberAgent, before) => {
+        if (before !== undefined && await identityOf(memberAgent) !== before)
+            await ctx.request('agents.files.set', { agentId: memberAgent, name: IDENTITY, content: before });
+    };
+    const onGateway = (agent) => untilListed(ctx.request, agent)
+        .then(() => true, () => ctx.request('agents.list')
+        .then((r) => r.agents.some((a) => a.id === agent)));
+    // A new agent whose sign-in did not finish goes with its entry (5.15); the shared workspace stays. The entry is
+    // dropped only once the agent's directory is gone, so a later removal can finish what this one could not.
+    const discard = (member, id, agent, created) => (async () => {
+        if (created) {
+            await ctx.request('byokit.accounts', { action: 'clear', agentId: agent });
+            await ctx.request('agents.delete', { agentId: agent, deleteFiles: false });
+        }
+        rmSync(join(ctx.root, 'state', 'agents', agent), { recursive: true, force: true });
+        await edit(member, (file) => { delete file.accounts[id]; });
+    })().catch((error) => ctx.log?.(`addAccount: ${agent} is not removed yet: ${error instanceof Error ? error.message : String(error)}`));
+    async function add(member, o, on) {
+        check(member);
+        if (!NEW_MEMBER_ID.test(member))
+            throw new Error(words('account.legacyMember'));
+        const choice = o?.authChoice === 'openai-codex' ? 'openai' : o?.authChoice;
+        const route = routes().find((r) => r.choice === choice && r.billing === 'subscription');
+        if (!route)
+            throw new Error(`addAccount: ${String(o?.authChoice)} is not a subscription sign-in`);
+        const name = o.name === undefined ? undefined : named(o.name, 'addAccount');
+        const provider = route.provider;
+        const { agentId: memberAgent, workspace } = await ctx.ensure(member);
+        if (o.again !== undefined && (!read(member).accounts[o.again] || o.again.split('.')[0] !== provider))
+            throw new Error(`unknown account: ${o.again}`);
+        // The member agent is the target only while it holds no local profile of the provider (5.15).
+        const own = await ctx.request('byokit.accounts', { action: 'list', agentId: memberAgent });
+        if (!own.ok || !Array.isArray(own.profiles))
+            throw new Error('addAccount: the member\'s sign-ins could not be read');
+        const fresh = o.again !== undefined || own.profiles.some((p) => p.provider === provider);
+        const entryOf = (file, agent) => ({ agent, route: route.choice, addedAt: Date.now(),
+            name: name ?? `${route.label} ${Object.values(file.accounts).filter((e) => e.route === route.choice).length + 1}` });
+        let id = provider;
+        let agent = memberAgent;
+        let added = false;
+        if (!fresh) {
+            await edit(member, (file) => { if (!file.accounts[id]) {
+                file.accounts[id] = entryOf(file, agent);
+                added = true;
+            } });
+        }
+        else {
+            // `<member>--<hex6>`, drawn again while that agent exists; its entry is written before the agent.
+            const roster = new Set((await ctx.request('agents.list')).agents.map((a) => a.id));
+            await edit(member, (file) => {
+                const taken = new Set([...roster, ...Object.values(file.accounts).map((e) => e.agent)]);
+                do {
+                    const hex = randomBytes(3).toString('hex');
+                    id = `${provider}.${hex}`;
+                    agent = `${member}--${hex}`;
+                } while (taken.has(agent) || file.accounts[id]);
+                file.accounts[id] = entryOf(file, agent);
+            });
+            added = true;
+            let created = false;
+            // The pin rewrites the shared workspace's IDENTITY.md Name line on create, so the create window is one lock per member.
+            await ctx.locks.exclusive([`${member}#identity`], async () => {
+                let before;
+                try {
+                    before = await identityOf(memberAgent);
+                    const made = await ctx.request('agents.create', { name: agent, workspace });
+                    created = true;
+                    if (made.agentId !== agent)
+                        throw new Error(`addAccount: agents.create answered ${String(made.agentId)}, not ${agent}`);
+                    await untilListed(ctx.request, agent);
+                    await restoreIdentity(memberAgent, before);
+                }
+                catch (error) {
+                    await restoreIdentity(memberAgent, before)
+                        .catch((restoreError) => ctx.log?.(`addAccount: IDENTITY.md is not restored: ${restoreError instanceof Error ? restoreError.message : String(restoreError)}`));
+                    const exists = created || await onGateway(agent).catch((listError) => {
+                        ctx.log?.(`addAccount: ${agent} is not removed yet: ${listError instanceof Error ? listError.message : String(listError)}`);
+                        return undefined;
+                    });
+                    if (exists !== undefined)
+                        await discard(member, id, agent, exists);
+                    throw error;
+                }
+            });
+        }
+        const key = `${member}\n${id}`;
+        signing.set(key, (signing.get(key) ?? 0) + 1);
+        const handle = ctx.signIn(agent, { authChoice: route.choice, ...(o.via ? { via: o.via } : {}) }, (v) => { if (v.state === 'waiting')
+            on(v); }, fresh);
+        // Sealed before the person sees done: the agent keeps only this sign-in, and its `who` goes to the index.
+        const settle = async (view) => {
+            if (view.state === 'done') {
+                const sealed = await ctx.locks.exclusive([memberAgent, agent, indexLock(member)], async () => {
+                    const answer = await ctx.request('byokit.accounts', { action: 'seal', agentId: agent, provider });
+                    if (!answer.ok)
+                        return 'Sign-in could not be saved. Try again.';
+                    const file = read(member);
+                    const entry = file.accounts[id];
+                    if (entry && answer.who) {
+                        entry.who = answer.who;
+                        write(member, file);
+                    }
+                    return true;
+                }).catch((error) => (error instanceof Error ? error.message : String(error)).slice(0, 200));
+                if (sealed === true)
+                    return view;
+                view = { state: 'failed', via: view.via, why: 'failed', error: sealed };
+            }
+            if (agent !== memberAgent)
+                await discard(member, id, agent, true);
+            else if (added)
+                await edit(member, (file) => { delete file.accounts[id]; })
+                    .catch((error) => ctx.log?.(`addAccount: ${id} entry is kept: ${error instanceof Error ? error.message : String(error)}`));
+            return view;
+        };
+        const done = handle.done.then(settle).finally(() => {
+            const left = signing.get(key) - 1;
+            if (left)
+                signing.set(key, left);
+            else
+                signing.delete(key);
+        }).then((view) => {
+            on(view);
+            return { view, id };
+        });
+        return { id, paste: handle.paste, cancel: handle.cancel, done };
+    }
+    return { list, add, rename, defaults, setDefaults, models, room, pick, rest };
+}

package/dist/auth-store.js

@@ -54,7 +54,27 @@ function put(path, bytes) {
 // containing directory in `changed` instead of fsyncing it now. restore() fsyncs each distinct directory
 // once after every file is written, so a restore still makes each rename durable before it removes the
 // restoring marker, without one directory fsync per object. seal() and the stop path keep put().
+// When the live file already holds the exact bytes at the restore mode, the write (and its file fsync,
+// rename and directory fsync) is skipped: nothing on disk changes, so there is nothing to make durable.
+// Size is compared before reading; any read error (or a missing, changed or different-mode file) writes.
+function sameLiveFile(path, bytes) {
+    try {
+        const stat = lstatSync(path);
+        if (!stat.isFile())
+            return false;
+        if ((stat.mode & 0o777) !== 0o600)
+            return false;
+        if (stat.size !== bytes.length)
+            return false;
+        return readFileSync(path).equals(Buffer.from(bytes));
+    }
+    catch {
+        return false;
+    }
+}
 function putRestore(path, bytes, changed) {
+    if (sameLiveFile(path, bytes))
+        return;
     mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
     const tmp = `${path}.sealing-${process.pid}`;
     try {

package/dist/device.d.ts

@@ -79,6 +79,9 @@ export type SignInNotice = {
 export declare function openSignInNotice(data: Record<string, unknown>, seed: Uint8Array): SignInNotice | null;
 /** Transient streams bypass link's durable request/answer cache: no lease nonce or frame is persisted. */
 export declare function browserDevice(link: DeviceLink): BrowserDevice;
+type DeviceRunEvent = Exclude<RunEvent, {
+    type: 'account';
+}>;
 /** `openclawDevice`'s device surface: every `oc.*` op the computer answers, typed. */
 export type OpenClawDevice = {
     browser: BrowserDevice;
@@ -92,7 +95,7 @@ export type OpenClawDevice = {
     };
     signOut(p: string): Promise<void>;
     sessions(): Promise<SessionRow[]>;
-    run<const S extends OutputSchema | undefined = undefined>(message: string, o?: DeviceRunOptions<S>): AsyncIterable<RunEvent | DeviceEndFrame<SchemaOutput<S>>>;
+    run<const S extends OutputSchema | undefined = undefined>(message: string, o?: DeviceRunOptions<S>): AsyncIterable<DeviceRunEvent | DeviceEndFrame<SchemaOutput<S>>>;
     steer(k: string, t: string, o?: {
         auth?: 'apiKey';
     }): Promise<void>;

package/dist/engine.js

@@ -256,7 +256,7 @@ export class Engine {
         const pluginDir = join(this.root, 'plugin');
         mkdirSync(pluginDir, { recursive: true, mode: 0o700 });
         // The shipped plugin follows the kit on every prepare too: a state dir from an older kit must not keep its gate.
-        for (const f of ['package.json', 'index.js', 'keys.js', 'usage.js']) {
+        for (const f of ['package.json', 'index.js', 'keys.js', 'usage.js', 'accounts.js']) {
             const source = join(kitDir, 'plugin', f);
             putChanged(join(pluginDir, f), readFileSync(source, 'utf8'));
         }