@byokit/openclaw 0.12.0 → 0.13.0

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+## 0.13.0 (2026-10-14)
+
+- FEAT: OpenClaw kit S8 `kit.removeAccount(member, id)`: a member-agent account goes through `models.authLogout` with its sealed profileIds, then an empty provider `list` (still listed stops with nothing dropped and says the account is still signing in), then its entry is dropped; an account agent goes through `byokit.accounts clear`, an empty `list` (a profile still listed after clear stops with nothing deleted and says the account is still signing in), `agents.delete` with `deleteFiles: false`, removal of its `<root>/state/agents/<agent>` dir, then the entry. Removal is refused `busy` while a run holds the agent and the member stays ready. On every `prepare` and after the sealed auth store restores, the kit removes each `<member>--<hex6>` state dir that a removal recorded as gone and no index names; a legacy member's own dir is never recorded and stays. `byokit.accounts clear` takes an optional `provider` that clears only that provider; a seal failure on a member-agent sign-in clears only that provider, and when that clear is refused the add reports failed with its credential still on the member agent.
+- SECURITY: `kit.removeAccount` re-seals the live credential store at once while the engine runs, so `auth-store.sealed` and `auth-store.objects/` stop holding the removed profile immediately instead of keeping it until the next stop; a late engine write of the removed agent is swept on the next `prepare` or sealed restore. Durable removal tombstones also exclude late refreshes from stop-time sealing and prune removed-agent entries and objects from older sealed stores before restore.
+- FIX: Changing the wrap mode (for example turning on dual wrapping) now reseals every engine store under the new mode on the next stop, including unchanged ones, so a later restore with the OS keyring locked opens them. Since 0.12.0 unchanged stores kept their old keyring-only wrap and that restore failed with `AuthStoreUnreadableError` (`invalid-snapshot`).
+
 ## 0.12.0 (2026-10-13)
 
 - FIX: an unsealed API key that a failed `addKey` could not clear (the gateway refused the clear after a restart ran late) is now dropped at the kit's first ready after start, so it no longer stays in the member's `byokit-key-<member>` store until the next add. A key whose ready marker exists is never cleared, and a sweep the gateway interrupts runs again on the next ready.

package/dist/accounts.d.ts

@@ -27,6 +27,8 @@ type StartSignIn = (agentId: string, o: SignInOptions, on: (v: SignInView) => vo
     done: Promise<SignInView>;
 };
 export declare function memberOfAccount(root: string, ref: string): Member | undefined;
+export declare function removedAccountAgents(root: string): Set<string>;
+export declare function sweepOrphans(root: string): void;
 export declare function createAccounts(ctx: {
     request: GatewayTransport['request'];
     root: string;
@@ -40,6 +42,7 @@ export declare function createAccounts(ctx: {
         session: string;
     }>;
     log?: (line: string) => void;
+    reseal?: () => Promise<void>;
 }): {
     list(member: Member): Promise<Account[]>;
     add(member: Member, o: AddOptions, on: (v: SignInView) => void): Promise<AccountSignIn>;
@@ -56,5 +59,6 @@ export declare function createAccounts(ctx: {
     }>;
     rest(member: Member, id: AccountId, until: number): Promise<void>;
     move(member: Member, sessionKey: string, to: AccountId): Promise<MoveResult>;
+    remove(member: Member, id: AccountId): Promise<void>;
 };
 export {};

package/dist/accounts.js

@@ -1,9 +1,10 @@
 // The per-member account index (5.15, O14 step S5): `<root>/accounts/<member>.json` (0600, whole-file temp
 // plus rename) is the only kit state: `{ v: 1, accounts: { [id]: { agent, name, route, addedAt, until?, model?,
-// who? } }, defaults }`. No credential, token, email or engine line. Listing, rename, defaults, models, room,
-// adding with its identity merge (O14 steps S6, S7), the start-of-run pick (S10), session binding (S11) and moving a
-// conversation (S12) live here; remove arrives in a later step.
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+// who? } }, defaults, gone? }`, where `gone` names the agent dirs a removal left for the orphan sweep. No credential,
+// token, email or engine line. Listing, rename, defaults, models, room, adding with its identity merge (O14 steps
+// S6, S7), the start-of-run pick (S10), session binding (S11), moving a conversation (S12) and removal with its
+// orphan sweep (S8) live here.
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { randomBytes, randomUUID } from 'node:crypto';
 import { join } from 'node:path';
 import { providerOf, resolveSelection } from "./pick.js";
@@ -86,7 +87,8 @@ const readIndex = (root, member) => {
         defaults.model = raw.model;
     if (typeof raw.auto === 'boolean')
         defaults.auto = raw.auto;
-    return { v: 1, accounts, defaults };
+    const gone = Array.isArray(file.gone) ? file.gone.filter((a) => typeof a === 'string' && ACCOUNT_AGENT.test(a)) : [];
+    return { v: 1, accounts, defaults, ...(gone.length ? { gone } : {}) };
 };
 // Attribution (5.15, O14m): the member an agent id or `agent:<agent>:<tail>` session key belongs to. A member agent is its
 // own, and so is an agent whose workspace the kit created for it (a legacy member id may end in `--<hex6>`); any other
@@ -108,6 +110,64 @@ export function memberOfAccount(root, ref) {
         return undefined;
     }
 }
+// Every agent any member's index names. An index that cannot be read or parsed throws: its accounts are unknown,
+// so no sweep may run.
+function indexedAgents(root) {
+    const named = new Set();
+    const gone = new Set();
+    let files;
+    try {
+        files = readdirSync(join(root, 'accounts'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { named, gone };
+        throw error;
+    }
+    for (const file of files) {
+        if (!file.endsWith('.json'))
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(join(root, 'accounts', file), 'utf8'));
+        }
+        catch (error) {
+            throw new Error(`account index is unreadable: accounts/${file}`, { cause: error });
+        }
+        for (const entry of Object.values(parsed.accounts ?? {}))
+            if (typeof entry?.agent === 'string')
+                named.add(entry.agent);
+        for (const agent of Array.isArray(parsed.gone) ? parsed.gone : [])
+            if (typeof agent === 'string')
+                gone.add(agent);
+    }
+    return { named, gone };
+}
+// Durable removal tombstones, except ids an index now names again. Shared by the live and sealed-store sweeps.
+export function removedAccountAgents(root) {
+    const { named, gone } = indexedAgents(root);
+    return new Set([...gone].filter((agent) => ACCOUNT_AGENT.test(agent) && !named.has(agent)));
+}
+// Removes each `<root>/state/agents/<member>--<hex6>` directory that a removal recorded as gone and no index names.
+// Only recorded directories go: a legacy member's own directory is never recorded, so it stays. The directories are
+// listed before the index is read: each listed one was created after its entry was written.
+export function sweepOrphans(root) {
+    let dirs;
+    try {
+        dirs = readdirSync(join(root, 'state', 'agents'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    const gone = removedAccountAgents(root);
+    for (const dir of dirs) {
+        if (!gone.has(dir))
+            continue;
+        rmSync(join(root, 'state', 'agents', dir), { recursive: true, force: true });
+    }
+}
 export function createAccounts(ctx) {
     const path = (member) => indexPath(ctx.root, member);
     const read = (member) => readIndex(ctx.root, member);
@@ -119,6 +179,13 @@ export function createAccounts(ctx) {
         if (!MEMBER_ID.test(member) || member.startsWith(KEY_PREFIX))
             throw new Error(`invalid member id: ${member}`);
     };
+    const dropEntry = (file, id) => {
+        delete file.accounts[id];
+        if (file.defaults.account === id)
+            delete file.defaults.account;
+    };
+    const markGone = (file, agent) => { if (!file.gone?.includes(agent))
+        file.gone = [...(file.gone ?? []), agent]; };
     const write = (member, file) => {
         mkdirSync(join(ctx.root, 'accounts'), { recursive: true, mode: 0o700 });
         const tmp = `${path(member)}.${randomUUID()}.tmp`;
@@ -141,8 +208,8 @@ export function createAccounts(ctx) {
     const synthesizedRoute = (provider) => routeFor(provider, 'browser')?.choice
         ?? routes().find((r) => r.provider === provider && r.billing === 'subscription')?.choice
         ?? provider;
-    const rosterOf = () => ctx.request('agents.list')
-        .then((r) => new Set(r.agents.map((a) => a.id)), () => new Set());
+    const agentRoster = () => ctx.request('agents.list').then((r) => new Set(r.agents.map((a) => a.id)));
+    const rosterOf = () => agentRoster().catch(() => new Set());
     const profilesOf = (agentId) => ctx.request('byokit.accounts', { action: 'list', agentId })
         .then((r) => Array.isArray(r.profiles) ? r.profiles : [], () => []);
     const stateOf = (route, status, until) => {
@@ -539,6 +606,63 @@ export function createAccounts(ctx) {
     // A run on the account ended resting: Auto skips it until `until` (its state reads `resting` until then).
     const rest = (member, id, until) => edit(member, (file) => { const entry = file.accounts[id]; if (entry)
         entry.until = until; });
+    const agentDir = (agent) => join(ctx.root, 'state', 'agents', agent);
+    // Removing (5.15): a member-agent account goes through `models.authLogout` with its sealed profileIds, then its
+    // entry is dropped. An account agent goes through `clear`, an empty `list`, `agents.delete` with
+    // `deleteFiles: false`, removal of its state dir, then the entry is dropped. Refused `busy` while a run holds
+    // the agent; the member agent stays ready (only the named provider is logged out or cleared).
+    const providerProfileIds = async (agentId, provider) => {
+        const listed = await ctx.request('byokit.accounts', { action: 'list', agentId });
+        if (listed.ok !== true || !Array.isArray(listed.profiles))
+            throw new Error('removeAccount: the sign-ins could not be read');
+        return listed.profiles.filter((p) => p.provider === provider && typeof p.profileId === 'string' && p.profileId).map((p) => p.profileId);
+    };
+    async function remove(member, id) {
+        check(member);
+        const { agentId: memberAgent } = await ctx.ensure(member);
+        const entry = read(member).accounts[id];
+        if (!entry || (entry.agent !== memberAgent && !(ACCOUNT_AGENT.test(entry.agent) && entry.agent.startsWith(`${member}--`))))
+            throw new Error(`unknown account: ${id}`);
+        const agent = entry.agent;
+        const provider = id.split('.')[0];
+        if (ctx.locks.live(agent) || signing.has(`${member}\n${id}`))
+            throw new Error('removeAccount: busy');
+        if (agent === memberAgent) {
+            await ctx.locks.exclusive([agent, indexLock(member)], async () => {
+                const profileIds = await providerProfileIds(agent, provider);
+                if (profileIds.length)
+                    await ctx.request('models.authLogout', { provider, agentId: agent, profileIds });
+                if ((await providerProfileIds(agent, provider)).length)
+                    throw new Error('removeAccount: the account is still signing in');
+                const file = read(member);
+                dropEntry(file, id);
+                write(member, file);
+                // The live store changed: re-seal at once so the sealed copy stops holding the removed profile.
+                await ctx.reseal?.();
+            });
+            return;
+        }
+        await ctx.locks.exclusive([agent, indexLock(member)], async () => {
+            const roster = await agentRoster();
+            if (roster.has(agent)) {
+                await ctx.request('byokit.accounts', { action: 'clear', agentId: agent });
+                const listed = await ctx.request('byokit.accounts', { action: 'list', agentId: agent });
+                if (listed.ok !== true || !Array.isArray(listed.profiles))
+                    throw new Error('removeAccount: the sign-ins could not be read');
+                if (listed.profiles.length)
+                    throw new Error('removeAccount: the account is still signing in');
+                await ctx.request('agents.delete', { agentId: agent, deleteFiles: false });
+            }
+            rmSync(agentDir(agent), { recursive: true, force: true });
+            // Already holding the index lock: write directly instead of `edit`, which would wait on itself.
+            const file = read(member);
+            dropEntry(file, id);
+            markGone(file, agent);
+            write(member, file);
+            // The live store changed: re-seal at once so the sealed copy stops holding the removed profile.
+            await ctx.reseal?.();
+        });
+    }
     // Index edits take the index lock, as listing's own write does.
     const edit = (member, fn) => ctx.locks.exclusive([indexLock(member)], async () => { const file = read(member); fn(file); write(member, file); });
     const identityOf = async (agentId) => {
@@ -581,7 +705,7 @@ export function createAccounts(ctx) {
             await ctx.request('byokit.accounts', { action: 'clear', agentId: agent });
             await ctx.request('agents.delete', { agentId: agent, deleteFiles: false });
         }
-        rmSync(join(ctx.root, 'state', 'agents', agent), { recursive: true, force: true });
+        rmSync(agentDir(agent), { recursive: true, force: true });
         await edit(member, (file) => { delete file.accounts[id]; });
     })().catch((error) => ctx.log?.(`addAccount: ${agent} is not removed yet: ${error instanceof Error ? error.message : String(error)}`));
     // Member-agent adds of one provider take turns from the sign-in's start to its settle, so a cleanup clears only the
@@ -776,17 +900,28 @@ export function createAccounts(ctx) {
                         return { ...(answer.who ? { who: answer.who } : {}), ...(keep ? { keep } : {}), dups };
                     }).catch((error) => route.keyEntry ? 'Sign-in could not be saved. Try again.'
                         : (error instanceof Error ? error.message : String(error)).slice(0, 200));
-                    if (typeof sealed === 'string')
-                        view = { state: 'failed', via: view.via, why: 'failed', error: sealed };
-                    else {
-                        for (const dup of sealed.dups)
-                            await collapse(dup, sealed.keep, sealed.who);
-                        const into = sealed.keep?.[0] !== id ? sealed.keep : undefined;
-                        if (!into || !await adopt(sealed.who, into[1].agent))
-                            return { view, id };
-                        await removeEntry();
-                        return { view, id: into[0] };
+                    if (typeof sealed === 'string') {
+                        let error = sealed;
+                        // A seal failure on the member agent (the non-fresh path) leaves its new credential with no index entry,
+                        // so listing hides it but runs could use it. Clear only this provider: the bare clear wipes every profile.
+                        if (agent === memberAgent) {
+                            const cleared = await ctx.request('byokit.accounts', { action: 'clear', agentId: memberAgent, provider })
+                                .then((answer) => answer?.ok === true, () => false);
+                            if (!cleared) {
+                                ctx.log?.(`addAccount: ${memberAgent} ${provider} is not cleared`);
+                                error = `${sealed} Its credential is still on the member agent: remove this account.`;
+                            }
+                        }
+                        await drop();
+                        return { view: { state: 'failed', via: view.via, why: 'failed', error }, id };
                     }
+                    for (const dup of sealed.dups)
+                        await collapse(dup, sealed.keep, sealed.who);
+                    const into = sealed.keep?.[0] !== id ? sealed.keep : undefined;
+                    if (!into || !await adopt(sealed.who, into[1].agent))
+                        return { view, id };
+                    await removeEntry();
+                    return { view, id: into[0] };
                 }
                 // A member agent held no profile of this provider before a non-fresh add, so clearing the provider removes only this one.
                 if (agent === memberAgent)
@@ -813,5 +948,5 @@ export function createAccounts(ctx) {
             throw error;
         }
     }
-    return { list, add, rename, defaults, setDefaults, models, room, bind, keyRefusal, pick, rest, move };
+    return { list, add, rename, defaults, setDefaults, models, room, bind, keyRefusal, pick, rest, move, remove };
 }

package/dist/auth-store.d.ts

@@ -61,6 +61,12 @@ export declare class AuthStore {
     private restore;
     archives(): Promise<void>;
     prepare(): Promise<void>;
+    /** Re-seal the credential snapshot while the engine runs (removeAccount): it drops the removed profile at once
+     *  instead of waiting for stop, and read() drops the removed agent's sealed objects. Database objects are never
+     *  read here — each keeps its last sealed copy until stop, when persist() seals the live databases. Live files
+     *  stay in place — unlike persist(), nothing is removed and no crash-transition recovery runs, so this never
+     *  deletes the tree a live engine is running on. No-op without a seal or while the store is not active. */
+    reseal(): Promise<void>;
     start(): Promise<void>;
     stop(): Promise<void>;
     offline<T>(task: () => Promise<T>): Promise<T>;

package/dist/auth-store.js

@@ -8,6 +8,7 @@ import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync,
 import { createHash } from 'node:crypto';
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { EngineAlreadyRunningError, pidAlive as live } from "./engine-status.js";
+import { removedAccountAgents, sweepOrphans } from "./accounts.js";
 const encoder = new TextEncoder();
 const archive = (name) => !name.endsWith('.sealed') && (/^(auth-profiles|auth-state|auth|oauth)\.json\.(migrated-.+|sqlite-import\..+\.bak)$/.test(name)
     || name.endsWith('.moved-to-engine'));
@@ -140,6 +141,11 @@ function safePath(path) {
     return typeof path === 'string' && /^(state|home)(\/[^/]+)*$/.test(path)
         && !path.split('/').some((part) => part === '.' || part === '..' || part.includes('\\') || part.includes('\0'));
 }
+// A file the live engine deletes between the directory listing and the read is simply gone: there is nothing to
+// seal, so callers skip it. Every other failure still throws.
+function vanished(error) {
+    return error.code === 'ENOENT';
+}
 function snapshot(text) {
     const s = JSON.parse(text);
     if ((s?.v !== 1 && s?.v !== 2) || !Array.isArray(s.dirs) || !Array.isArray(s.files))
@@ -206,8 +212,9 @@ export class AuthStore {
     cleanup;
     restoring;
     // Object file name -> sha256 of the plaintext payload currently sealed at that file. Kept only in memory: it
-    // never becomes on-disk metadata. Filled by restore() from what is decrypted, refreshed after each successful
-    // seal. A process that never restored starts with an empty map and reseals every object, as before.
+    // never becomes on-disk metadata. Filled by restore() from what is decrypted (except objects in an older wrap
+    // mode), refreshed after each successful seal. A process that never restored starts with an empty map and
+    // reseals every object, as before.
     objectHashes = new Map();
     constructor(privateOptions) {
         this.o = privateOptions;
@@ -315,19 +322,38 @@ export class AuthStore {
         catch {
             throw new AuthStoreUnreadableError('invalid-snapshot');
         }
-        const upgraded = seal.upgrade?.(bytes);
-        if (upgraded) {
-            if (seal.decryptString(Buffer.from(upgraded)) !== text)
-                throw new Error('credential upgrade verification failed');
-            put(this.file, upgraded);
+        const gone = removedAccountAgents(this.o.root);
+        const keep = (path) => !path.startsWith('state/agents/') || !gone.has(path.split('/')[2]);
+        const kept = { v: 1, dirs: saved.dirs.filter(keep), files: saved.files.filter(([path]) => keep(path)) };
+        if (kept.dirs.length !== saved.dirs.length || kept.files.length !== saved.files.length) {
+            this.seal(this.file, JSON.stringify(kept));
+        }
+        else {
+            const upgraded = seal.upgrade?.(bytes);
+            if (upgraded) {
+                if (seal.decryptString(Buffer.from(upgraded)) !== text)
+                    throw new Error('credential upgrade verification failed');
+                put(this.file, upgraded);
+            }
+        }
+        if (gone.size && existsSync(this.objects)) {
+            for (const entry of readdirSync(this.objects)) {
+                const file = join(this.objects, entry);
+                if (keep(this.readObject(file)[0]))
+                    continue;
+                rmSync(file);
+                this.objectHashes.delete(entry);
+            }
         }
-        return saved;
+        return kept;
     }
     readObject(file) {
+        let bytes = Buffer.alloc(0);
         let text = '';
         let entry = null;
         try {
-            text = this.open(readFileSync(file));
+            bytes = readFileSync(file);
+            text = this.open(bytes);
             entry = JSON.parse(text);
         }
         catch (error) {
@@ -340,7 +366,7 @@ export class AuthStore {
         if (!safePath(path) || !apart(path) || typeof data !== 'string' || Buffer.from(data, 'base64').toString('base64') !== data) {
             throw new AuthStoreUnreadableError('invalid-snapshot');
         }
-        return [path, data, text];
+        return [path, data, text, bytes];
     }
     inventory() {
         const dirs = [];
@@ -348,15 +374,35 @@ export class AuthStore {
         const objects = [];
         let total = 0;
         const root = realpathSync(this.o.root);
+        const gone = removedAccountAgents(this.o.root);
         const walk = (path) => {
             const name = relative(this.o.root, path).split('\\').join('/');
+            if (name.startsWith('state/agents/') && gone.has(name.split('/')[2]))
+                return; // a late refresh never enters a seal
             if (name.startsWith('home/') && nonCredential(name))
                 return; // regenerable home caches stay on disk; skipping a directory skips its subtree
-            const stat = lstatSync(path);
+            let stat;
+            try {
+                stat = lstatSync(path);
+            }
+            catch (error) {
+                if (vanished(error))
+                    return;
+                throw error;
+            }
             if (stat.isDirectory()) {
                 if (!apart(name))
                     dirs.push(name);
-                for (const child of readdirSync(path).sort())
+                let children;
+                try {
+                    children = readdirSync(path).sort();
+                }
+                catch (error) {
+                    if (vanished(error))
+                        return;
+                    throw error;
+                }
+                for (const child of children)
                     walk(join(path, child));
                 return;
             }
@@ -374,7 +420,14 @@ export class AuthStore {
                 const rel = relative(root, file);
                 if (isAbsolute(rel) || rel === '..' || rel.startsWith(`..${sep}`))
                     return;
-                target = lstatSync(file);
+                try {
+                    target = lstatSync(file);
+                }
+                catch (error) {
+                    if (vanished(error))
+                        return;
+                    throw error;
+                }
             }
             if (!target.isFile())
                 return;
@@ -396,15 +449,44 @@ export class AuthStore {
         return { dirs, files, objects };
     }
     collect() {
+        sweepOrphans(this.o.root);
         const { dirs, files, objects } = this.inventory();
-        for (const dir of dirs)
-            chmodSync(join(this.o.root, dir), 0o700);
-        // Read the checked target, but save the link's path: restore materializes a regular file there.
-        for (const { file } of [...files, ...objects])
-            chmodSync(file, 0o600);
+        for (const dir of dirs) {
+            try {
+                chmodSync(join(this.o.root, dir), 0o700);
+            }
+            catch (error) {
+                if (!vanished(error))
+                    throw error;
+            }
+        }
+        // Read the checked target, but save the link's path: restore materializes a regular file there. A file that
+        // vanishes here is skipped by the same rule as in the listing above.
+        const read = ({ name, file }) => {
+            try {
+                chmodSync(file, 0o600);
+                return [name, readFileSync(file).toString('base64')];
+            }
+            catch (error) {
+                if (vanished(error))
+                    return undefined;
+                throw error;
+            }
+        };
+        const kept = objects.filter(({ file }) => {
+            try {
+                chmodSync(file, 0o600);
+                return true;
+            }
+            catch (error) {
+                if (vanished(error))
+                    return false;
+                throw error;
+            }
+        });
         return {
-            saved: { v: 1, dirs, files: files.map(({ name, file }) => [name, readFileSync(file).toString('base64')]) },
-            objects,
+            saved: { v: 1, dirs, files: files.map(read).filter((entry) => entry !== undefined) },
+            objects: kept,
         };
     }
     /** Remove the live sealed trees: all of `state` (every file there is sealed, as a blob entry or an object),
@@ -431,10 +513,19 @@ export class AuthStore {
         mkdirSync(this.objects, { recursive: true, mode: 0o700 });
         const keep = new Set();
         for (const { name, file } of objects) {
+            let data;
+            try {
+                data = readFileSync(file).toString('base64');
+            }
+            catch (error) {
+                if (vanished(error))
+                    continue;
+                throw error;
+            }
             const object = objectName(name);
             keep.add(object);
             const target = join(this.objects, object);
-            const payload = JSON.stringify({ path: name, data: readFileSync(file).toString('base64') });
+            const payload = JSON.stringify({ path: name, data });
             // An object this process already sealed (or restored) unchanged is not resealed: its plaintext hash is
             // the same and its sealed file is still on disk, so the encrypt + verify + fsyncs are skipped. A changed
             // file, a new one, or one whose sealed file vanished falls through to the normal seal.
@@ -502,8 +593,11 @@ export class AuthStore {
         }
         if (existsSync(this.objects)) {
             for (const entry of readdirSync(this.objects)) {
-                const [path, data, payload] = this.readObject(join(this.objects, entry));
-                this.objectHashes.set(entry, objectHash(payload));
+                const [path, data, payload, bytes] = this.readObject(join(this.objects, entry));
+                // An object sealed in an older wrap mode (the adapter would upgrade it, as read() does the main file) gets
+                // no hash, so the next seal reseals it in the current mode even when unchanged.
+                if (!this.o.seal.upgrade?.(bytes))
+                    this.objectHashes.set(entry, objectHash(payload));
                 // An object path can be several directories below an existing one, and those directories are not in
                 // `saved.dirs` (they sit in a non-credential subtree). Create them through ensureRestoreDirs so the
                 // parent of every directory this restore creates — not just each object's own directory — is fsynced
@@ -558,6 +652,24 @@ export class AuthStore {
             }
         });
     }
+    /** Re-seal the credential snapshot while the engine runs (removeAccount): it drops the removed profile at once
+     *  instead of waiting for stop, and read() drops the removed agent's sealed objects. Database objects are never
+     *  read here — each keeps its last sealed copy until stop, when persist() seals the live databases. Live files
+     *  stay in place — unlike persist(), nothing is removed and no crash-transition recovery runs, so this never
+     *  deletes the tree a live engine is running on. No-op without a seal or while the store is not active. */
+    async reseal() {
+        return this.serial(async () => {
+            if (!this.o.seal || !this.active)
+                return;
+            const previous = await this.read();
+            const { saved, objects } = this.collect();
+            // Same debris guard as persist(): a running engine always leaves files behind, so an empty live tree
+            // keeps the sealed credentials instead of replacing them with an empty snapshot.
+            if (!saved.files.length && !objects.length && previous)
+                return;
+            this.seal(this.file, JSON.stringify(saved));
+        });
+    }
     start() {
         return this.serial(async () => {
             if (this.active)

package/dist/engine.d.ts

@@ -54,6 +54,7 @@ export declare class Engine {
     };
     private verifiedOrphan;
     private recoverOrphan;
+    private sweepAccountOrphans;
     start(): Promise<{
         port: number;
         token: string;

package/dist/engine.js

@@ -12,6 +12,7 @@ import { ENGINE_VERSION } from "./constants.js";
 import { appendUsageBoot } from "./usage-boots.js";
 import { reconcileConfig, appRecoveryPrefixes } from "./config.js";
 import { writePlugin, resolveBridge } from "./bridge.js";
+import { sweepOrphans } from "./accounts.js";
 const kitDir = dirname(dirname(fileURLToPath(import.meta.url)));
 const putOnce = (path, data) => { if (!existsSync(path))
     writeFileSync(path, data, { mode: 0o600, flag: 'wx' }); };
@@ -161,6 +162,7 @@ export class Engine {
         await this.recoverOrphan();
         for (const d of [this.root, ...(!this.o.authSeal ? [join(this.root, 'home'), join(this.root, 'state')] : []), join(this.root, 'tmp'), join(this.root, 'usage'), join(this.root, 'install-home'), join(this.root, 'npm-cache'), join(this.o.stateDir, 'logs')])
             mkdirSync(d, { recursive: true, mode: 0o700 });
+        this.sweepAccountOrphans();
         try {
             await this.authStore.prepare();
             this.credentialsLocked = false;
@@ -351,6 +353,18 @@ export class Engine {
             throw occupied();
         // The new store owner now seals crash leftovers under its lock before restoring them.
     }
+    // The account orphan sweep (5.15): a late engine write after a removal cannot be ruled out by a bounded check, so
+    // prepare and the sealed restore remove each `<root>/state/agents/<member>--<hex6>` directory a removal recorded as
+    // gone and no index names. No roster here: the gateway is down, and no add is in flight while preparing (an entry
+    // is written before its agent is created, so an account being added is named).
+    sweepAccountOrphans() {
+        try {
+            sweepOrphans(this.root);
+        }
+        catch (error) {
+            this.o.log?.(`prepare: orphans are not swept: ${String(error.message).slice(0, 200)}`);
+        }
+    }
     start() {
         if (this.starting)
             return this.starting;
@@ -382,6 +396,7 @@ export class Engine {
                 this.state('failed', 'auth-store-unreadable');
             throw error;
         }
+        this.sweepAccountOrphans();
         try {
             return this.launch();
         }

package/dist/kit.d.ts

@@ -148,6 +148,9 @@ export declare class OpenClawKit {
         }>;
     }>;
     renameAccount(member: Member, id: AccountId, name: string): Promise<Account>;
+    /** Remove one account: a member-agent account through `authLogout` with its profileIds, an account agent through
+     * `clear`, an empty `list`, `agents.delete` with `deleteFiles: false`, removal of its state dir, then the entry. */
+    removeAccount(member: Member, id: AccountId): Promise<void>;
     defaults(member: Member): Promise<Defaults>;
     setDefaults(member: Member, d: Defaults): Promise<void>;
     /** Save an explicitly supplied API key (billed per use) in this member's separate key agent. */

package/dist/kit.js

@@ -763,7 +763,7 @@ export class OpenClawKit {
             this.accountsCtl = createAccounts({ request: (method, params, o) => this.request()(method, params, o), root: this.engine.root,
                 ensure: (member) => this.ensureMember(member), locks: this.locks,
                 signIn: (agentId, o, on, fresh) => startSignIn({ ...this.signInCtx(), ensure: async () => ({ agentId }), fresh }, agentId, o, on),
-                routes: this.routeMap, log: this.o.log });
+                routes: this.routeMap, log: this.o.log, reseal: () => this.engine.authStore.reseal() });
             // The fail-closed tool bridge feeds the kit's single Approval surface (5.9, O5).
             await this.bridge.start();
             this.off.push(transport.onEvent((e) => this.approvalsCtl.handleEvent(e)));
@@ -981,9 +981,9 @@ export class OpenClawKit {
     memberOf(ref) {
         return memberOfAccount(this.engine.root, ref);
     }
-    // accounts (5.15, O14 steps S5, S6 and S9-S12): the per-member index with listing, adding, defaults, rename, models
-    // and room; `run({ account })` and `pick` choose among them, held to the account a session is bound to, and `move`
-    // carries a conversation to another account. Removing arrives in a later step.
+    // accounts (5.15, O14 steps S5, S6 and S8-S12): the per-member index with listing, adding, defaults, rename, models
+    // and room; `run({ account })` and `pick` choose among them, held to the account a session is bound to, `move`
+    // carries a conversation to another account, and `removeAccount` deletes one.
     accounts(member) {
         if (!this.accountsCtl)
             return Promise.reject(new Error('gateway not ready'));
@@ -1028,6 +1028,13 @@ export class OpenClawKit {
             return Promise.reject(new Error('gateway not ready'));
         return this.accountsCtl.rename(member, id, name);
     }
+    /** Remove one account: a member-agent account through `authLogout` with its profileIds, an account agent through
+     * `clear`, an empty `list`, `agents.delete` with `deleteFiles: false`, removal of its state dir, then the entry. */
+    removeAccount(member, id) {
+        if (!this.accountsCtl)
+            return Promise.reject(new Error('gateway not ready'));
+        return this.accountsCtl.remove(member, id);
+    }
     defaults(member) {
         if (!this.accountsCtl)
             return Promise.reject(new Error('gateway not ready'));

package/dist/testing/fake-gateway.d.ts

@@ -38,6 +38,13 @@ export type FakeGateway = {
         provider: string;
         type: string;
     } & Record<string, unknown>): void;
+    /** A late engine refresh racing a removal (O14 S8): writes one profile of `provider` onto `agentId` whole, as the
+     * pin would under its store lock. With `order: false` it lands with no order entry; `expires` (default: valid)
+     * may name an expired credential. */
+    refresh(agentId: string, provider: string, o?: {
+        order?: boolean;
+        expires?: number;
+    }): void;
 } & {
     transport: GatewayTransport;
 };

package/dist/testing/fake-gateway.js

@@ -858,6 +858,19 @@ export function fakeGateway(script, o) {
             storeOf(agentId)[profileId] = profile;
             setPrimaryOfId(agentId, `${profile.provider}/default@${profileId}`);
         },
+        refresh: (agentId, provider, o) => {
+            const agent = ensureAgent(agentId);
+            if (!agent.providers.includes(provider))
+                agent.providers.push(provider);
+            const profileId = `${provider}:default`;
+            storeOf(agentId)[profileId] = { provider, type: 'oauth', status: 'ok', access: 'fake-access',
+                refresh: 'fake-refresh', expires: o?.expires ?? Date.now() + 30 * 86_400_000,
+                accountId: `fake-refresh-${agentId}` };
+            if (o?.order !== false)
+                orderOf(agentId)[provider] = [profileId];
+            else if (orderOf(agentId)[provider])
+                delete orderOf(agentId)[provider];
+        },
         transport: factory({ port: 0, token: 'test', identityPath: '', bridgeSock: '' }),
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byokit/openclaw",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "The OpenClaw runtime kit: the pinned engine's full operator surface with plain-words helpers for members, sign-in, runs and approvals.",
   "license": "Apache-2.0",
   "type": "module",