@byokit/openclaw 0.12.0 → 0.14.0

package/dist/accounts.js

@@ -1,14 +1,18 @@
 // The per-member account index (5.15, O14 step S5): `<root>/accounts/<member>.json` (0600, whole-file temp
 // plus rename) is the only kit state: `{ v: 1, accounts: { [id]: { agent, name, route, addedAt, until?, model?,
-// who? } }, defaults }`. No credential, token, email or engine line. Listing, rename, defaults, models, room,
-// adding with its identity merge (O14 steps S6, S7), the start-of-run pick (S10), session binding (S11) and moving a
-// conversation (S12) live here; remove arrives in a later step.
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+// who?, priorModel? } }, defaults, gone?, dropped? }`, where `priorModel` is the member agent's primary before a
+// member-agent sign-in pinned it (empty when none), `gone` names account-agent dirs a removal left for the orphan
+// sweep, and `dropped` names providers removed from the member agent so a late refresh cannot restore them. No
+// credential, token, email or engine line. Listing, rename, defaults, models, room, adding with its identity merge
+// (O14 steps S6, S7), the start-of-run pick (S10), session binding (S11), moving a conversation (S12) and removal
+// with its orphan sweep (S8) live here.
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { randomBytes, randomUUID } from 'node:crypto';
 import { join } from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
 import { providerOf, resolveSelection } from "./pick.js";
 import { agentOf, memberOf as baseMemberOf } from "./attribution.js";
-import { KEY_PREFIX, MEMBER_ID, NEW_MEMBER_ID, untilListed } from "./members.js";
+import { KEY_PREFIX, MEMBER_ID, NEW_MEMBER_ID, keyAgentId, untilListed } from "./members.js";
 import { routes, routeFor } from "./routes.js";
 import { words } from "./words.js";
 const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
@@ -59,19 +63,18 @@ const validEntry = (v) => !!v && typeof v === 'object'
     && typeof v.route === 'string' && Number.isFinite(v.addedAt)
     && (v.until === undefined || Number.isFinite(v.until))
     && (v.model === undefined || typeof v.model === 'string')
-    && (v.who === undefined || typeof v.who === 'string');
+    && (v.who === undefined || typeof v.who === 'string')
+    && (v.priorModel === undefined || typeof v.priorModel === 'string');
+/** The member agent's primary as a durable index string; empty when there was none (or it is not a string primary). */
+const priorOf = (model) => {
+    if (typeof model === 'string')
+        return model;
+    if (model && typeof model === 'object' && typeof model.primary === 'string')
+        return model.primary;
+    return '';
+};
 const indexPath = (root, member) => join(root, 'accounts', `${member}.json`);
-const readIndex = (root, member) => {
-    let text;
-    try {
-        text = readFileSync(indexPath(root, member), 'utf8');
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return empty();
-        throw error;
-    }
-    const file = JSON.parse(text);
+const normalizeIndex = (file) => {
     if (!file || typeof file !== 'object' || file.v !== 1)
         return empty();
     const accounts = {};
@@ -86,8 +89,45 @@ const readIndex = (root, member) => {
         defaults.model = raw.model;
     if (typeof raw.auto === 'boolean')
         defaults.auto = raw.auto;
-    return { v: 1, accounts, defaults };
+    const gone = Array.isArray(file.gone) ? file.gone.filter((a) => typeof a === 'string' && ACCOUNT_AGENT.test(a)) : [];
+    const dropped = Array.isArray(file.dropped)
+        ? file.dropped.filter((p) => typeof p === 'string' && !!p && !p.includes('.')) : [];
+    return { v: 1, accounts, defaults, ...(gone.length ? { gone } : {}), ...(dropped.length ? { dropped } : {}) };
 };
+/** Load one member's index. `damaged` means the file exists but is not JSON; the bytes are left alone for repair. */
+export function loadIndex(root, member) {
+    let text;
+    try {
+        text = readFileSync(indexPath(root, member), 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { file: empty(), damaged: false };
+        throw error;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return { file: empty(), damaged: true };
+    }
+    return { file: normalizeIndex(parsed), damaged: false };
+}
+const readIndex = (root, member) => {
+    const loaded = loadIndex(root, member);
+    if (loaded.damaged)
+        throw new Error(words('account.indexDamaged', { member }));
+    return loaded.file;
+};
+/** True when `agent` is the member agent or an `<member>--<hex6>` account agent of a damaged index. */
+export function heldBackAgent(agent, damaged) {
+    if (damaged.has(agent))
+        return true;
+    if (!ACCOUNT_AGENT.test(agent))
+        return false;
+    return damaged.has(agent.slice(0, agent.lastIndexOf('--')));
+}
 // Attribution (5.15, O14m): the member an agent id or `agent:<agent>:<tail>` session key belongs to. A member agent is its
 // own, and so is an agent whose workspace the kit created for it (a legacy member id may end in `--<hex6>`); any other
 // agent, an `<member>--<hex6>` account agent included, maps only while the index names it under that member. Account
@@ -108,9 +148,215 @@ export function memberOfAccount(root, ref) {
         return undefined;
     }
 }
+// Every agent any readable member's index names. An unreadable `accounts/<member>.json` quarantines only that
+// member (held back: not restored, not swept, not resealed away); other members keep restoring, starting and
+// persisting. The damaged file is never deleted — re-add rewrites a good index.
+function indexedAgents(root) {
+    const named = new Set();
+    const gone = new Set();
+    const damaged = new Set();
+    let files;
+    try {
+        files = readdirSync(join(root, 'accounts'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { named, gone, damaged };
+        throw error;
+    }
+    for (const file of files) {
+        if (!file.endsWith('.json'))
+            continue;
+        const member = file.slice(0, -'.json'.length);
+        let text;
+        try {
+            text = readFileSync(join(root, 'accounts', file), 'utf8');
+        }
+        catch {
+            if (MEMBER_ID.test(member))
+                damaged.add(member);
+            continue;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            if (MEMBER_ID.test(member))
+                damaged.add(member);
+            continue;
+        }
+        for (const entry of Object.values(parsed.accounts ?? {}))
+            if (typeof entry?.agent === 'string')
+                named.add(entry.agent);
+        for (const agent of Array.isArray(parsed.gone) ? parsed.gone : [])
+            if (typeof agent === 'string')
+                gone.add(agent);
+    }
+    return { named, gone, damaged };
+}
+/** Members whose `accounts/<member>.json` exists but is not readable JSON. */
+export function damagedAccountMembers(root) {
+    return indexedAgents(root).damaged;
+}
+// Durable removal tombstones, except ids an index now names again. Shared by the live and sealed-store sweeps.
+// A damaged member contributes no tombstones and never expands the blast radius of another member's removal.
+export function removedAccountAgents(root) {
+    const { named, gone, damaged } = indexedAgents(root);
+    return new Set([...gone].filter((agent) => ACCOUNT_AGENT.test(agent) && !named.has(agent) && !heldBackAgent(agent, damaged)));
+}
+// Providers a removal recorded as dropped from the member agent, except ones an index entry on that member agent names
+// again. Parallel to `gone` for account-agent directories: only an intentional removeAccount tombstone is swept, so a
+// live subscription that listing synthesizes from the store is never cleared just because the index omitted it.
+// Damaged members contribute no tombstones.
+function droppedMemberProviders(root) {
+    const out = new Map();
+    const { damaged } = indexedAgents(root);
+    let files;
+    try {
+        files = readdirSync(join(root, 'accounts'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return out;
+        throw error;
+    }
+    for (const file of files) {
+        if (!file.endsWith('.json'))
+            continue;
+        const member = file.slice(0, -'.json'.length);
+        if (damaged.has(member))
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(join(root, 'accounts', file), 'utf8'));
+        }
+        catch {
+            continue;
+        }
+        const named = new Set();
+        for (const [id, entry] of Object.entries(parsed.accounts ?? {})) {
+            if (typeof entry?.agent !== 'string' || entry.agent !== member || !id)
+                continue;
+            named.add(id.split('.')[0]);
+        }
+        const drop = new Set();
+        for (const provider of Array.isArray(parsed.dropped) ? parsed.dropped : []) {
+            if (typeof provider !== 'string' || !provider || provider.includes('.') || named.has(provider))
+                continue;
+            drop.add(provider);
+        }
+        if (drop.size)
+            out.set(member, drop);
+    }
+    return out;
+}
+function dropProviders(store, drop) {
+    let changed = false;
+    const profiles = store.profiles && typeof store.profiles === 'object' ? store.profiles : {};
+    for (const [profileId, profile] of Object.entries(profiles)) {
+        if (typeof profile?.provider === 'string' && !drop.has(profile.provider))
+            continue;
+        delete profiles[profileId];
+        changed = true;
+    }
+    store.profiles = profiles;
+    if (store.order && typeof store.order === 'object') {
+        for (const provider of Object.keys(store.order)) {
+            if (!drop.has(provider))
+                continue;
+            delete store.order[provider];
+            changed = true;
+        }
+    }
+    if (store.lastGood && typeof store.lastGood === 'object') {
+        for (const provider of Object.keys(store.lastGood)) {
+            if (!drop.has(provider))
+                continue;
+            delete store.lastGood[provider];
+            changed = true;
+        }
+    }
+    return changed;
+}
+function putAuthProfilesJson(path, store) {
+    const staging = `${path}.staging-${process.pid}`;
+    writeFileSync(staging, JSON.stringify(store), { mode: 0o600 });
+    renameSync(staging, path);
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch { /* best-effort mode */ }
+}
+function sweepMemberAuthProfiles(root) {
+    for (const [member, drop] of droppedMemberProviders(root)) {
+        const agentDir = join(root, 'state', 'agents', member, 'agent');
+        const jsonPath = join(agentDir, 'auth-profiles.json');
+        if (existsSync(jsonPath)) {
+            try {
+                const store = JSON.parse(readFileSync(jsonPath, 'utf8'));
+                if (store && typeof store === 'object' && dropProviders(store, drop))
+                    putAuthProfilesJson(jsonPath, store);
+            }
+            catch { /* leave an unreadable store alone; prepare must still finish */ }
+        }
+        const dbPath = join(agentDir, 'openclaw-agent.sqlite');
+        if (!existsSync(dbPath))
+            continue;
+        try {
+            const db = new DatabaseSync(dbPath);
+            try {
+                const row = db.prepare('SELECT store_json FROM auth_profile_store').get();
+                if (typeof row?.store_json !== 'string')
+                    continue;
+                const store = JSON.parse(row.store_json);
+                if (!store || typeof store !== 'object' || !dropProviders(store, drop))
+                    continue;
+                db.prepare('UPDATE auth_profile_store SET store_json = ?').run(JSON.stringify(store));
+            }
+            finally {
+                db.close();
+            }
+        }
+        catch { /* leave an unreadable native store alone */ }
+    }
+}
+// Removes each `<root>/state/agents/<member>--<hex6>` directory that a removal recorded as gone and no index names,
+// and drops member-agent auth profiles a removal recorded as `dropped`. Only recorded directories go: a legacy member's
+// own directory is never recorded, so it stays. The directories are listed before the index is read: each listed one was
+// created after its entry was written. Damaged members' agents are never swept (their gone/dropped lists are unknown);
+// `log` reports each damaged index once.
+export function sweepOrphans(root, log) {
+    const { damaged } = indexedAgents(root);
+    for (const member of damaged)
+        log?.(words('account.indexDamaged', { member }));
+    let dirs = [];
+    try {
+        dirs = readdirSync(join(root, 'state', 'agents'));
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    const gone = removedAccountAgents(root);
+    for (const dir of dirs) {
+        if (!gone.has(dir))
+            continue;
+        rmSync(join(root, 'state', 'agents', dir), { recursive: true, force: true });
+    }
+    sweepMemberAuthProfiles(root);
+}
 export function createAccounts(ctx) {
     const path = (member) => indexPath(ctx.root, member);
-    const read = (member) => readIndex(ctx.root, member);
+    const read = (member) => {
+        const loaded = loadIndex(ctx.root, member);
+        if (loaded.damaged) {
+            const message = words('account.indexDamaged', { member });
+            ctx.log?.(message);
+            throw new Error(message);
+        }
+        return loaded.file;
+    };
     // Accounts whose sign-in is running, as `<member>\n<id>`, counted per add: listed `signing` until the last one ends.
     const signing = new Map();
     // The index file's own lock, apart from any agent's: a run's shared hold on the member agent never blocks an edit.
@@ -119,6 +365,24 @@ export function createAccounts(ctx) {
         if (!MEMBER_ID.test(member) || member.startsWith(KEY_PREFIX))
             throw new Error(`invalid member id: ${member}`);
     };
+    const dropEntry = (file, id) => {
+        delete file.accounts[id];
+        if (file.defaults.account === id)
+            delete file.defaults.account;
+    };
+    const markGone = (file, agent) => { if (!file.gone?.includes(agent))
+        file.gone = [...(file.gone ?? []), agent]; };
+    const markDropped = (file, provider) => {
+        if (!file.dropped?.includes(provider))
+            file.dropped = [...(file.dropped ?? []), provider];
+    };
+    const clearDropped = (file, provider) => {
+        if (!file.dropped?.includes(provider))
+            return;
+        file.dropped = file.dropped.filter((p) => p !== provider);
+        if (!file.dropped.length)
+            delete file.dropped;
+    };
     const write = (member, file) => {
         mkdirSync(join(ctx.root, 'accounts'), { recursive: true, mode: 0o700 });
         const tmp = `${path(member)}.${randomUUID()}.tmp`;
@@ -141,8 +405,8 @@ export function createAccounts(ctx) {
     const synthesizedRoute = (provider) => routeFor(provider, 'browser')?.choice
         ?? routes().find((r) => r.provider === provider && r.billing === 'subscription')?.choice
         ?? provider;
-    const rosterOf = () => ctx.request('agents.list')
-        .then((r) => new Set(r.agents.map((a) => a.id)), () => new Set());
+    const agentRoster = () => ctx.request('agents.list').then((r) => new Set(r.agents.map((a) => a.id)));
+    const rosterOf = () => agentRoster().catch(() => new Set());
     const profilesOf = (agentId) => ctx.request('byokit.accounts', { action: 'list', agentId })
         .then((r) => Array.isArray(r.profiles) ? r.profiles : [], () => []);
     const stateOf = (route, status, until) => {
@@ -167,6 +431,9 @@ export function createAccounts(ctx) {
         const memberRows = [];
         const seen = new Set();
         for (const [provider, profiles] of [...byProvider.entries()].sort(([a], [b]) => a < b ? -1 : 1)) {
+            // A removeAccount tombstone wins until the person signs in again: do not synthesize the removed row back.
+            if (file.dropped?.includes(provider))
+                continue;
             let entry = file.accounts[provider];
             if (!entry || entry.agent !== agentId) {
                 const route = entry?.agent === agentId && typeof entry.route === 'string' ? entry.route : synthesizedRoute(provider);
@@ -216,7 +483,26 @@ export function createAccounts(ctx) {
         }
         memberRows.sort((a, b) => a.addedAt - b.addedAt || (a.id < b.id ? -1 : 1));
         agentRows.sort((a, b) => a.addedAt - b.addedAt);
-        const rows = [...memberRows, ...agentRows];
+        // The API-key lane: the member's single key agent, indexed once as `<provider>.key`. Only what the index
+        // names is listed; a key agent the index does not name holds no account.
+        const keyRows = [];
+        for (const [id, entry] of Object.entries(file.accounts)) {
+            if (entry.agent !== keyAgentId(member) || !roster.has(entry.agent))
+                continue;
+            const provider = id.split('.')[0];
+            const meta = metaOf(entry.route);
+            const profiles = await profilesOf(entry.agent);
+            const who = profiles.find((p) => p.provider === provider)?.who;
+            if (!entry.who && typeof who === 'string' && !signing.has(`${member}\n${id}`)) {
+                entry.who = who;
+                dirty = true;
+            }
+            keyRows.push({ id, provider, route: entry.route, name: entry.name, label: meta.label,
+                billing: meta.billing, state: stateOf(entry.route, profiles[0]?.status, entry.until),
+                ...(entry.until !== undefined ? { until: entry.until } : {}), addedAt: entry.addedAt });
+        }
+        keyRows.sort((a, b) => a.addedAt - b.addedAt);
+        const rows = [...memberRows, ...agentRows, ...keyRows];
         for (const row of rows)
             if (signing.has(`${member}\n${row.id}`))
                 row.state = 'signing';
@@ -374,7 +660,7 @@ export function createAccounts(ctx) {
             return roomOf(row.provider, answer);
         });
     // Runs step 2 reads the index alone: the index-only refusal makes no request, and a cold index adds one account
-    // listing (the pick's late check after `list`; `keyRefusal` lists when the held account is not API-billed). This
+    // listing (the pick's late check after `list`; `keyRefusal` lists unless the binding is the key lane). This
     // gives the accounts a binding holds, in list order, and the name a refusal shows (`account.another` when it holds none).
     const boundOf = (file, binding) => binding.id !== undefined ? [binding.id]
         : Object.entries(file.accounts).filter(([, e]) => e.agent === binding.agentId)
@@ -397,23 +683,27 @@ export function createAccounts(ctx) {
             return { code: 'bound', name: nameOf(file, ids) };
         return undefined;
     };
-    // An API-key run (Runs step 2): its key continues only an API-billed binding; any other binding is refused.
+    // An API-key run (Runs step 2): its key continues its own lane's conversation whatever the key bills (a
+    // plan key bills subscription), and any other binding is refused.
     const keyRefusal = async (member, binding) => {
-        const held = binding.id === undefined ? undefined : read(member).accounts[binding.id];
-        if (held && metaOf(held.route).billing === 'api')
+        if (binding.agentId === keyAgentId(member))
             return undefined;
         await list(member);
         const file = read(member);
         return words('account.bound', { name: nameOf(file, boundOf(file, binding)) });
     };
-    // Runs step 1 (5.15): a key `agent:<member>--<hex6>:<tail>` of an indexed account agent is bound to that account; a
-    // key `agent:<member>:<tail>` to whichever of the member's agents holds `agent:<that agent>:<tail>` (member agent
-    // first), else unbound. Any other key is not the member's. With no account agent, the member agent and an unbound
-    // key run alike, so nothing is asked.
+    // Runs step 1 (5.15): a key `agent:<member>--<hex6>:<tail>` of an indexed account agent is bound to that account. A key
+    // `agent:<member>:<tail>` is bound to whichever of the member's agents holds `agent:<that agent>:<tail>` (member agent
+    // first, then the key lane, whose account is its `<provider>.key`, then the account agents), else unbound. Any other key
+    // is not the member's. With no account agent and no indexed lane, the member agent and an unbound key run alike, so
+    // nothing is asked.
     async function bind(member, sessionKey) {
         check(member);
-        const agents = new Map(Object.entries(read(member).accounts)
+        const file = read(member);
+        const agents = new Map(Object.entries(file.accounts)
             .filter(([, e]) => ACCOUNT_AGENT.test(e.agent) && e.agent.startsWith(`${member}--`)).map(([id, e]) => [e.agent, id]));
+        const lane = keyAgentId(member);
+        const laneId = Object.entries(file.accounts).find(([, e]) => e.agent === lane)?.[0];
         if (!sessionKey.startsWith(`agent:${member}:`)) {
             const agent = /^agent:([^:]+):/.exec(sessionKey)?.[1];
             const id = agent === undefined ? undefined : agents.get(agent);
@@ -421,12 +711,13 @@ export function createAccounts(ctx) {
                 throw new Error(`refused: "${sessionKey}" is not a session of member "${member}"`);
             return { agentId: agent, id };
         }
-        if (!agents.size)
+        if (!agents.size && laneId === undefined)
             return undefined;
         const tail = sessionKey.slice(`agent:${member}:`.length);
         const { agentId } = await ctx.ensure(member);
         const roster = new Set((await ctx.request('agents.list')).agents.map((a) => a.id));
-        for (const [agent, id] of [[agentId, undefined], ...agents]) {
+        const laneProbe = laneId === undefined ? [] : [[lane, laneId]];
+        for (const [agent, id] of [[agentId, undefined], ...laneProbe, ...agents]) {
             if (agent !== agentId && !roster.has(agent))
                 continue;
             // The pin answers a found session with its canonical `key` and a missing one with `{ ok: false }`.
@@ -436,10 +727,11 @@ export function createAccounts(ctx) {
         }
         return undefined;
     }
-    // Choosing (5.15): every listed account's room and models are read live once, then the pure `resolveSelection`
-    // decides. A binding narrows it (Runs step 2): a key bound to an account agent resolves 'auto', 'default' and no id to
-    // that account; a key bound to the member agent chooses only among its own accounts. A refusal (`bound`, `paid`) is
-    // decided from the index, after the account listing when the index is cold, and so has no `considered` rows.
+    // Choosing (5.15): every pick input's room and models are read live once (unnamed key lanes are excluded),
+    // then the pure `resolveSelection` decides. A binding narrows it (Runs step 2): a key bound to an account agent resolves 'auto', 'default' and no id to
+    // that account; a key bound to the key lane resolves to its `<provider>.key` account; a key bound to the member agent
+    // chooses only among its own accounts. A refusal (`bound`, `paid`) is decided from the index, after the account
+    // listing when the index is cold, and so has no `considered` rows.
     // An unknown id stays the caller bug it always was. `agent` is the picked account's engine agent. A model unavailable
     // only because the account is signed out or resting is still in its plan: the account's state and the run's ready
     // check judge that.
@@ -457,18 +749,25 @@ export function createAccounts(ctx) {
         const late = binding && refusalOf(file, binding, sel);
         if (late)
             return refused(late);
+        if (binding?.id !== undefined && !listed.some((r) => r.id === binding.id))
+            return { pick: { ok: false, code: 'none', reason: words('auto.noneBound'), considered: [] } };
         const rows = listed.filter((r) => !skip.includes(r.id));
         const named = sel.account === 'auto' || sel.account === 'default' ? undefined : sel.account;
         const known = named === undefined || listed.some((r) => r.id === named);
         if (binding?.id !== undefined && known)
             sel = { ...sel, account: binding.id };
         const bound = binding && known ? boundOf(file, binding) : undefined;
-        const reads = new Map(await Promise.all(rows.map(async (row) => {
+        // The key lane is reached only by naming it (or the saved default): an unnamed lane row is not a pick input, so
+        // Auto and a default fallback see exactly the accounts they saw before the lane was indexed.
+        const lanes = new Set(Object.entries(file.accounts).filter(([, e]) => e.agent === keyAgentId(member)).map(([id]) => id));
+        const pickRows = rows.filter((r) => !lanes.has(r.id) || sel.account === r.id ||
+            (sel.account === 'default' && file.defaults.account === r.id));
+        const reads = new Map(await Promise.all(pickRows.map(async (row) => {
             const entry = file.accounts[row.id];
             const models = await readModels(row, entry).then((ms) => ms.map((m) => (m.why ? { ...m, available: true } : m)), () => undefined);
             return [row.id, { room: await readRoom(row, entry), models }];
         })));
-        const chosen = resolveSelection(rows, file.defaults, sel, (a) => reads.get(a.id).room, Date.now(), (a) => reads.get(a.id).models, bound);
+        const chosen = resolveSelection(pickRows, file.defaults, sel, (a) => reads.get(a.id).room, Date.now(), (a) => reads.get(a.id).models, bound);
         return { pick: chosen, ...(chosen.ok ? { agent: file.accounts[chosen.account.id].agent } : {}) };
     }
     // Moving a conversation (5.15, O14 step S12): the key binds as a run's does (with no account agent binding asks
@@ -539,8 +838,81 @@ export function createAccounts(ctx) {
     // A run on the account ended resting: Auto skips it until `until` (its state reads `resting` until then).
     const rest = (member, id, until) => edit(member, (file) => { const entry = file.accounts[id]; if (entry)
         entry.until = until; });
-    // Index edits take the index lock, as listing's own write does.
-    const edit = (member, fn) => ctx.locks.exclusive([indexLock(member)], async () => { const file = read(member); fn(file); write(member, file); });
+    const agentDir = (agent) => join(ctx.root, 'state', 'agents', agent);
+    const laneEntry = (member, route, addedAt) => ({ agent: keyAgentId(member), name: route.label, route: route.choice, addedAt });
+    // The API-key lane's index entry (5.15): one per member, `<provider>.key` on the `byokit-key-<member>` agent.
+    // A new key replaces the old one: whatever lane entry the member holds is dropped first, keeping its `addedAt`.
+    // The key itself is never stored: only the agent, the route choice and the name.
+    async function key(member, route) {
+        check(member);
+        const lane = keyAgentId(member);
+        return ctx.locks.exclusive([indexLock(member)], async () => {
+            const loaded = loadIndex(ctx.root, member);
+            if (loaded.damaged) {
+                ctx.log?.(words('account.indexDamaged', { member }));
+                return;
+            }
+            const file = loaded.file;
+            const kept = Object.values(file.accounts).find((e) => e.agent === lane)?.addedAt;
+            for (const [other, e] of Object.entries(file.accounts))
+                if (e.agent === lane)
+                    delete file.accounts[other];
+            file.accounts[`${route.provider}.key`] = laneEntry(member, route, kept ?? Date.now());
+            write(member, file);
+        });
+    }
+    // The removal's counterpart to `key`: drop the lane's index entry, so `list` stops naming the removed key.
+    // `provider` scopes it to that provider's entry (a scoped removal that kept another provider's key keeps its
+    // entry too); without one every lane entry goes. A damaged index is left alone, like `key` leaves it.
+    async function unkey(member, provider) {
+        check(member);
+        const lane = keyAgentId(member);
+        return ctx.locks.exclusive([indexLock(member)], async () => {
+            const loaded = loadIndex(ctx.root, member);
+            if (loaded.damaged) {
+                ctx.log?.(words('account.indexDamaged', { member }));
+                return;
+            }
+            const file = loaded.file;
+            for (const [id, e] of Object.entries(file.accounts)) {
+                if (e.agent !== lane || (provider !== undefined && id.split('.')[0] !== provider))
+                    continue;
+                dropEntry(file, id);
+            }
+            write(member, file);
+        });
+    }
+    // The connect sweep's backfill: a lane that holds no entry is indexed under the one route its model's provider has;
+    // any other count is logged and left unindexed. A lane that holds an entry is never touched, nor a damaged index.
+    async function backfill(member, found) {
+        check(member);
+        const lane = keyAgentId(member);
+        return ctx.locks.exclusive([indexLock(member)], async () => {
+            const loaded = loadIndex(ctx.root, member);
+            if (loaded.damaged) {
+                ctx.log?.(words('account.indexDamaged', { member }));
+                return;
+            }
+            if (Object.values(loaded.file.accounts).some((e) => e.agent === lane))
+                return;
+            if (found.length !== 1) {
+                ctx.log?.(`key lane ${member}: its provider has no single key route, so it is not indexed; add the key again to index it`);
+                return;
+            }
+            loaded.file.accounts[`${found[0].provider}.key`] = laneEntry(member, found[0], Date.now());
+            write(member, loaded.file);
+        });
+    }
+    // Index edits take the index lock, as listing's own write does. A damaged index starts empty and is rewritten
+    // (re-add's repair path); the bad bytes are replaced, never left as the live index after a successful write.
+    const edit = (member, fn) => ctx.locks.exclusive([indexLock(member)], async () => {
+        const loaded = loadIndex(ctx.root, member);
+        if (loaded.damaged)
+            ctx.log?.(words('account.indexDamaged', { member }));
+        const file = loaded.damaged ? empty() : loaded.file;
+        fn(file);
+        write(member, file);
+    });
     const identityOf = async (agentId) => {
         const { file } = await ctx.request('agents.files.get', { agentId, name: IDENTITY });
         return file.missing ? undefined : file.content;
@@ -553,24 +925,99 @@ export function createAccounts(ctx) {
         const got = await ctx.request('config.get');
         return got.config?.agents?.entries?.[agentId]?.model;
     };
-    // ponytail: a merge patch cannot delete a key, so a member with no model entry before its sign-in keeps the pinned one.
+    // A merge patch cannot delete a key: with no prior primary, `agents.update { model: null }` clears the pin so the
+    // engine default applies. A write that lands between the read and the patch moves the hash: try once more.
     const restoreModel = async (memberAgent, model) => {
-        if (model === undefined) {
-            ctx.log?.(`addAccount: ${memberAgent} had no model entry to restore`);
-            return;
-        }
-        // A config write that lands between the read and the patch moves the hash: read and patch once more.
+        const clear = async () => {
+            await ctx.request('agents.update', { agentId: memberAgent, model: null });
+        };
         const patch = async () => {
             const { hash } = await ctx.request('config.get');
             await ctx.request('config.patch', { raw: JSON.stringify({ agents: { entries: { [memberAgent]: { model } } } }), baseHash: hash });
         };
         try {
+            if (model === undefined || model === null) {
+                await clear().catch(() => clear());
+                return;
+            }
             await patch().catch(() => patch());
         }
         catch (error) {
+            // A damaged prior must not leave the removed provider's pin: fall back to clearing.
+            if (model !== undefined && model !== null) {
+                try {
+                    await clear().catch(() => clear());
+                }
+                catch (clearError) {
+                    ctx.log?.(`addAccount: ${memberAgent} model pin is not cleared: ${clearError instanceof Error ? clearError.message : String(clearError)}`);
+                }
+            }
             ctx.log?.(`addAccount: ${memberAgent} model is not restored: ${error instanceof Error ? error.message : String(error)}`);
         }
     };
+    // Removing (5.15): a member-agent account goes through `models.authLogout` with its sealed profileIds, restores or
+    // clears the member primary from `priorModel`, then drops its entry. An account agent goes through `clear`, an
+    // empty `list`, `agents.delete` with `deleteFiles: false`, removal of its state dir, then the entry is dropped.
+    // Refused `busy` while a run holds the agent; the member agent stays ready (only the named provider is logged out
+    // or cleared).
+    const providerProfileIds = async (agentId, provider) => {
+        const listed = await ctx.request('byokit.accounts', { action: 'list', agentId });
+        if (listed.ok !== true || !Array.isArray(listed.profiles))
+            throw new Error('removeAccount: the sign-ins could not be read');
+        return listed.profiles.filter((p) => p.provider === provider && typeof p.profileId === 'string' && p.profileId).map((p) => p.profileId);
+    };
+    async function remove(member, id) {
+        check(member);
+        const { agentId: memberAgent } = await ctx.ensure(member);
+        const entry = read(member).accounts[id];
+        if (entry?.agent === keyAgentId(member))
+            throw new Error(`removeAccount: ${id} is a key lane; use removeKey`);
+        if (!entry || (entry.agent !== memberAgent && !(ACCOUNT_AGENT.test(entry.agent) && entry.agent.startsWith(`${member}--`))))
+            throw new Error(`unknown account: ${id}`);
+        const agent = entry.agent;
+        const provider = id.split('.')[0];
+        if (ctx.locks.live(agent) || signing.has(`${member}\n${id}`))
+            throw new Error('removeAccount: busy');
+        if (agent === memberAgent) {
+            await ctx.locks.exclusive([agent, indexLock(member)], async () => {
+                const profileIds = await providerProfileIds(agent, provider);
+                if (profileIds.length)
+                    await ctx.request('models.authLogout', { provider, agentId: agent, profileIds });
+                if ((await providerProfileIds(agent, provider)).length)
+                    throw new Error('removeAccount: the account is still signing in');
+                const file = read(member);
+                const prior = file.accounts[id]?.priorModel;
+                // Restore the pre-sign-in primary (or clear the pin) before dropping the entry; failure must not block removal.
+                await restoreModel(memberAgent, typeof prior === 'string' && prior ? prior : undefined);
+                dropEntry(file, id);
+                markDropped(file, provider);
+                write(member, file);
+                // The live store changed: re-seal at once so the sealed copy stops holding the removed profile.
+                await ctx.reseal?.();
+            });
+            return;
+        }
+        await ctx.locks.exclusive([agent, indexLock(member)], async () => {
+            const roster = await agentRoster();
+            if (roster.has(agent)) {
+                await ctx.request('byokit.accounts', { action: 'clear', agentId: agent });
+                const listed = await ctx.request('byokit.accounts', { action: 'list', agentId: agent });
+                if (listed.ok !== true || !Array.isArray(listed.profiles))
+                    throw new Error('removeAccount: the sign-ins could not be read');
+                if (listed.profiles.length)
+                    throw new Error('removeAccount: the account is still signing in');
+                await ctx.request('agents.delete', { agentId: agent, deleteFiles: false });
+            }
+            rmSync(agentDir(agent), { recursive: true, force: true });
+            // Already holding the index lock: write directly instead of `edit`, which would wait on itself.
+            const file = read(member);
+            dropEntry(file, id);
+            markGone(file, agent);
+            write(member, file);
+            // The live store changed: re-seal at once so the sealed copy stops holding the removed profile.
+            await ctx.reseal?.();
+        });
+    }
     const onGateway = (agent) => untilListed(ctx.request, agent)
         .then(() => true, () => ctx.request('agents.list')
         .then((r) => r.agents.some((a) => a.id === agent)));
@@ -581,7 +1028,7 @@ export function createAccounts(ctx) {
             await ctx.request('byokit.accounts', { action: 'clear', agentId: agent });
             await ctx.request('agents.delete', { agentId: agent, deleteFiles: false });
         }
-        rmSync(join(ctx.root, 'state', 'agents', agent), { recursive: true, force: true });
+        rmSync(agentDir(agent), { recursive: true, force: true });
         await edit(member, (file) => { delete file.accounts[id]; });
     })().catch((error) => ctx.log?.(`addAccount: ${agent} is not removed yet: ${error instanceof Error ? error.message : String(error)}`));
     // Member-agent adds of one provider take turns from the sign-in's start to its settle, so a cleanup clears only the
@@ -622,18 +1069,27 @@ export function createAccounts(ctx) {
                 if (fresh)
                     releaseAdd();
             }
-            // The member agent's primary model before this sign-in or any merge on it: restored when its profile moves away.
+            // The member agent's primary before this sign-in or any merge on it: restored when its profile moves away or
+            // the member-agent account is removed. Durable on the member entry as `priorModel` (empty when none).
             const memberModel = await readModel(memberAgent);
-            const entryOf = (file, agent) => ({ agent, route: route.choice, addedAt: Date.now(),
-                name: name ?? `${route.label} ${Object.values(file.accounts).filter((e) => e.route === route.choice).length + 1}` });
+            const entryOf = (file, agent, prior) => ({ agent, route: route.choice, addedAt: Date.now(),
+                name: name ?? `${route.label} ${Object.values(file.accounts).filter((e) => e.route === route.choice).length + 1}`,
+                ...(prior !== undefined ? { priorModel: prior } : {}) });
             let id = provider;
             let agent = memberAgent;
             let added = false;
             if (!fresh) {
-                await edit(member, (file) => { if (!file.accounts[id]) {
-                    file.accounts[id] = entryOf(file, agent);
-                    added = true;
-                } });
+                const prior = priorOf(memberModel);
+                await edit(member, (file) => {
+                    if (!file.accounts[id]) {
+                        file.accounts[id] = entryOf(file, agent, prior);
+                        added = true;
+                    }
+                    // Keep the first pre-sign-in primary across a later re-sign-in of the same member row.
+                    else if (file.accounts[id].priorModel === undefined)
+                        file.accounts[id].priorModel = prior;
+                    clearDropped(file, provider);
+                });
             }
             else {
                 // `<member>--<hex6>`, drawn again while that agent exists; its entry is written before the agent.
@@ -776,17 +1232,28 @@ export function createAccounts(ctx) {
                         return { ...(answer.who ? { who: answer.who } : {}), ...(keep ? { keep } : {}), dups };
                     }).catch((error) => route.keyEntry ? 'Sign-in could not be saved. Try again.'
                         : (error instanceof Error ? error.message : String(error)).slice(0, 200));
-                    if (typeof sealed === 'string')
-                        view = { state: 'failed', via: view.via, why: 'failed', error: sealed };
-                    else {
-                        for (const dup of sealed.dups)
-                            await collapse(dup, sealed.keep, sealed.who);
-                        const into = sealed.keep?.[0] !== id ? sealed.keep : undefined;
-                        if (!into || !await adopt(sealed.who, into[1].agent))
-                            return { view, id };
-                        await removeEntry();
-                        return { view, id: into[0] };
+                    if (typeof sealed === 'string') {
+                        let error = sealed;
+                        // A seal failure on the member agent (the non-fresh path) leaves its new credential with no index entry,
+                        // so listing hides it but runs could use it. Clear only this provider: the bare clear wipes every profile.
+                        if (agent === memberAgent) {
+                            const cleared = await ctx.request('byokit.accounts', { action: 'clear', agentId: memberAgent, provider })
+                                .then((answer) => answer?.ok === true, () => false);
+                            if (!cleared) {
+                                ctx.log?.(`addAccount: ${memberAgent} ${provider} is not cleared`);
+                                error = `${sealed} Its credential is still on the member agent: remove this account.`;
+                            }
+                        }
+                        await drop();
+                        return { view: { state: 'failed', via: view.via, why: 'failed', error }, id };
                     }
+                    for (const dup of sealed.dups)
+                        await collapse(dup, sealed.keep, sealed.who);
+                    const into = sealed.keep?.[0] !== id ? sealed.keep : undefined;
+                    if (!into || !await adopt(sealed.who, into[1].agent))
+                        return { view, id };
+                    await removeEntry();
+                    return { view, id: into[0] };
                 }
                 // A member agent held no profile of this provider before a non-fresh add, so clearing the provider removes only this one.
                 if (agent === memberAgent)
@@ -813,5 +1280,5 @@ export function createAccounts(ctx) {
             throw error;
         }
     }
-    return { list, add, rename, defaults, setDefaults, models, room, bind, keyRefusal, pick, rest, move };
+    return { list, add, rename, defaults, setDefaults, models, room, bind, keyRefusal, key, unkey, backfill, pick, rest, move, remove };
 }