@byokit/openclaw 0.13.0 → 0.14.2

package/dist/accounts.js

@@ -1,17 +1,20 @@
 // The per-member account index (5.15, O14 step S5): `<root>/accounts/<member>.json` (0600, whole-file temp
 // plus rename) is the only kit state: `{ v: 1, accounts: { [id]: { agent, name, route, addedAt, until?, model?,
-// who? } }, defaults, gone? }`, where `gone` names the agent dirs a removal left for the orphan sweep. No credential,
-// token, email or engine line. Listing, rename, defaults, models, room, adding with its identity merge (O14 steps
-// S6, S7), the start-of-run pick (S10), session binding (S11), moving a conversation (S12) and removal with its
-// orphan sweep (S8) live here.
+// who?, priorModel? } }, defaults, gone?, dropped? }`, where `priorModel` is the member agent's primary before a
+// member-agent sign-in pinned it (empty when none), `gone` names account-agent dirs a removal left for the orphan
+// sweep, and `dropped` names providers removed from the member agent so a late refresh cannot restore them. No
+// credential, token, email or engine line. Listing, rename, defaults, models, room, adding with its identity merge
+// (O14 steps S6, S7), the start-of-run pick (S10), session binding (S11), moving a conversation (S12) and removal
+// with its orphan sweep (S8) live here.
 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { randomBytes, randomUUID } from 'node:crypto';
 import { join } from 'node:path';
-import { providerOf, resolveSelection } from "./pick.js";
-import { agentOf, memberOf as baseMemberOf } from "./attribution.js";
-import { KEY_PREFIX, MEMBER_ID, NEW_MEMBER_ID, untilListed } from "./members.js";
-import { routes, routeFor } from "./routes.js";
-import { words } from "./words.js";
+import { DatabaseSync } from 'node:sqlite';
+import { providerOf, resolveSelection } from './pick.js';
+import { agentOf, memberOf as baseMemberOf } from './attribution.js';
+import { KEY_PREFIX, MEMBER_ID, NEW_MEMBER_ID, keyAgentId, untilListed } from './members.js';
+import { routes, routeFor } from './routes.js';
+import { words } from './words.js';
 const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 // `models.list { agentId, view: 'default' }` rows of the account's provider, mapped to `provider/model`. The pin
 // reports no per-plan availability, so `why: 'plan'` only comes from a run ending `plan`, never from here.
@@ -60,19 +63,18 @@ const validEntry = (v) => !!v && typeof v === 'object'
     && typeof v.route === 'string' && Number.isFinite(v.addedAt)
     && (v.until === undefined || Number.isFinite(v.until))
     && (v.model === undefined || typeof v.model === 'string')
-    && (v.who === undefined || typeof v.who === 'string');
+    && (v.who === undefined || typeof v.who === 'string')
+    && (v.priorModel === undefined || typeof v.priorModel === 'string');
+/** The member agent's primary as a durable index string; empty when there was none (or it is not a string primary). */
+const priorOf = (model) => {
+    if (typeof model === 'string')
+        return model;
+    if (model && typeof model === 'object' && typeof model.primary === 'string')
+        return model.primary;
+    return '';
+};
 const indexPath = (root, member) => join(root, 'accounts', `${member}.json`);
-const readIndex = (root, member) => {
-    let text;
-    try {
-        text = readFileSync(indexPath(root, member), 'utf8');
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return empty();
-        throw error;
-    }
-    const file = JSON.parse(text);
+const normalizeIndex = (file) => {
     if (!file || typeof file !== 'object' || file.v !== 1)
         return empty();
     const accounts = {};
@@ -88,8 +90,44 @@ const readIndex = (root, member) => {
     if (typeof raw.auto === 'boolean')
         defaults.auto = raw.auto;
     const gone = Array.isArray(file.gone) ? file.gone.filter((a) => typeof a === 'string' && ACCOUNT_AGENT.test(a)) : [];
-    return { v: 1, accounts, defaults, ...(gone.length ? { gone } : {}) };
+    const dropped = Array.isArray(file.dropped)
+        ? file.dropped.filter((p) => typeof p === 'string' && !!p && !p.includes('.')) : [];
+    return { v: 1, accounts, defaults, ...(gone.length ? { gone } : {}), ...(dropped.length ? { dropped } : {}) };
+};
+/** Load one member's index. `damaged` means the file exists but is not JSON; the bytes are left alone for repair. */
+export function loadIndex(root, member) {
+    let text;
+    try {
+        text = readFileSync(indexPath(root, member), 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { file: empty(), damaged: false };
+        throw error;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return { file: empty(), damaged: true };
+    }
+    return { file: normalizeIndex(parsed), damaged: false };
+}
+const readIndex = (root, member) => {
+    const loaded = loadIndex(root, member);
+    if (loaded.damaged)
+        throw new Error(words('account.indexDamaged', { member }));
+    return loaded.file;
 };
+/** True when `agent` is the member agent or an `<member>--<hex6>` account agent of a damaged index. */
+export function heldBackAgent(agent, damaged) {
+    if (damaged.has(agent))
+        return true;
+    if (!ACCOUNT_AGENT.test(agent))
+        return false;
+    return damaged.has(agent.slice(0, agent.lastIndexOf('--')));
+}
 // Attribution (5.15, O14m): the member an agent id or `agent:<agent>:<tail>` session key belongs to. A member agent is its
 // own, and so is an agent whose workspace the kit created for it (a legacy member id may end in `--<hex6>`); any other
 // agent, an `<member>--<hex6>` account agent included, maps only while the index names it under that member. Account
@@ -110,29 +148,43 @@ export function memberOfAccount(root, ref) {
         return undefined;
     }
 }
-// Every agent any member's index names. An index that cannot be read or parsed throws: its accounts are unknown,
-// so no sweep may run.
+// Every agent any readable member's index names. An unreadable `accounts/<member>.json` quarantines only that
+// member (held back: not restored, not swept, not resealed away); other members keep restoring, starting and
+// persisting. The damaged file is never deleted — re-add rewrites a good index.
 function indexedAgents(root) {
     const named = new Set();
     const gone = new Set();
+    const damaged = new Set();
     let files;
     try {
         files = readdirSync(join(root, 'accounts'));
     }
     catch (error) {
         if (error.code === 'ENOENT')
-            return { named, gone };
+            return { named, gone, damaged };
         throw error;
     }
     for (const file of files) {
         if (!file.endsWith('.json'))
             continue;
+        const member = file.slice(0, -'.json'.length);
+        let text;
+        try {
+            text = readFileSync(join(root, 'accounts', file), 'utf8');
+        }
+        catch {
+            if (MEMBER_ID.test(member))
+                damaged.add(member);
+            continue;
+        }
         let parsed;
         try {
-            parsed = JSON.parse(readFileSync(join(root, 'accounts', file), 'utf8'));
+            parsed = JSON.parse(text);
         }
-        catch (error) {
-            throw new Error(`account index is unreadable: accounts/${file}`, { cause: error });
+        catch {
+            if (MEMBER_ID.test(member))
+                damaged.add(member);
+            continue;
         }
         for (const entry of Object.values(parsed.accounts ?? {}))
             if (typeof entry?.agent === 'string')
@@ -141,36 +193,170 @@ function indexedAgents(root) {
             if (typeof agent === 'string')
                 gone.add(agent);
     }
-    return { named, gone };
+    return { named, gone, damaged };
+}
+/** Members whose `accounts/<member>.json` exists but is not readable JSON. */
+export function damagedAccountMembers(root) {
+    return indexedAgents(root).damaged;
 }
 // Durable removal tombstones, except ids an index now names again. Shared by the live and sealed-store sweeps.
+// A damaged member contributes no tombstones and never expands the blast radius of another member's removal.
 export function removedAccountAgents(root) {
-    const { named, gone } = indexedAgents(root);
-    return new Set([...gone].filter((agent) => ACCOUNT_AGENT.test(agent) && !named.has(agent)));
+    const { named, gone, damaged } = indexedAgents(root);
+    return new Set([...gone].filter((agent) => ACCOUNT_AGENT.test(agent) && !named.has(agent) && !heldBackAgent(agent, damaged)));
 }
-// Removes each `<root>/state/agents/<member>--<hex6>` directory that a removal recorded as gone and no index names.
-// Only recorded directories go: a legacy member's own directory is never recorded, so it stays. The directories are
-// listed before the index is read: each listed one was created after its entry was written.
-export function sweepOrphans(root) {
-    let dirs;
+// Providers a removal recorded as dropped from the member agent, except ones an index entry on that member agent names
+// again. Parallel to `gone` for account-agent directories: only an intentional removeAccount tombstone is swept, so a
+// live subscription that listing synthesizes from the store is never cleared just because the index omitted it.
+// Damaged members contribute no tombstones.
+function droppedMemberProviders(root) {
+    const out = new Map();
+    const { damaged } = indexedAgents(root);
+    let files;
     try {
-        dirs = readdirSync(join(root, 'state', 'agents'));
+        files = readdirSync(join(root, 'accounts'));
     }
     catch (error) {
         if (error.code === 'ENOENT')
-            return;
+            return out;
         throw error;
     }
+    for (const file of files) {
+        if (!file.endsWith('.json'))
+            continue;
+        const member = file.slice(0, -'.json'.length);
+        if (damaged.has(member))
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(join(root, 'accounts', file), 'utf8'));
+        }
+        catch {
+            continue;
+        }
+        const named = new Set();
+        for (const [id, entry] of Object.entries(parsed.accounts ?? {})) {
+            if (typeof entry?.agent !== 'string' || entry.agent !== member || !id)
+                continue;
+            named.add(id.split('.')[0]);
+        }
+        const drop = new Set();
+        for (const provider of Array.isArray(parsed.dropped) ? parsed.dropped : []) {
+            if (typeof provider !== 'string' || !provider || provider.includes('.') || named.has(provider))
+                continue;
+            drop.add(provider);
+        }
+        if (drop.size)
+            out.set(member, drop);
+    }
+    return out;
+}
+function dropProviders(store, drop) {
+    let changed = false;
+    const profiles = store.profiles && typeof store.profiles === 'object' ? store.profiles : {};
+    for (const [profileId, profile] of Object.entries(profiles)) {
+        if (typeof profile?.provider === 'string' && !drop.has(profile.provider))
+            continue;
+        delete profiles[profileId];
+        changed = true;
+    }
+    store.profiles = profiles;
+    if (store.order && typeof store.order === 'object') {
+        for (const provider of Object.keys(store.order)) {
+            if (!drop.has(provider))
+                continue;
+            delete store.order[provider];
+            changed = true;
+        }
+    }
+    if (store.lastGood && typeof store.lastGood === 'object') {
+        for (const provider of Object.keys(store.lastGood)) {
+            if (!drop.has(provider))
+                continue;
+            delete store.lastGood[provider];
+            changed = true;
+        }
+    }
+    return changed;
+}
+function putAuthProfilesJson(path, store) {
+    const staging = `${path}.staging-${process.pid}`;
+    writeFileSync(staging, JSON.stringify(store), { mode: 0o600 });
+    renameSync(staging, path);
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch { /* best-effort mode */ }
+}
+function sweepMemberAuthProfiles(root) {
+    for (const [member, drop] of droppedMemberProviders(root)) {
+        const agentDir = join(root, 'state', 'agents', member, 'agent');
+        const jsonPath = join(agentDir, 'auth-profiles.json');
+        if (existsSync(jsonPath)) {
+            try {
+                const store = JSON.parse(readFileSync(jsonPath, 'utf8'));
+                if (store && typeof store === 'object' && dropProviders(store, drop))
+                    putAuthProfilesJson(jsonPath, store);
+            }
+            catch { /* leave an unreadable store alone; prepare must still finish */ }
+        }
+        const dbPath = join(agentDir, 'openclaw-agent.sqlite');
+        if (!existsSync(dbPath))
+            continue;
+        try {
+            const db = new DatabaseSync(dbPath);
+            try {
+                const row = db.prepare('SELECT store_json FROM auth_profile_store').get();
+                if (typeof row?.store_json !== 'string')
+                    continue;
+                const store = JSON.parse(row.store_json);
+                if (!store || typeof store !== 'object' || !dropProviders(store, drop))
+                    continue;
+                db.prepare('UPDATE auth_profile_store SET store_json = ?').run(JSON.stringify(store));
+            }
+            finally {
+                db.close();
+            }
+        }
+        catch { /* leave an unreadable native store alone */ }
+    }
+}
+// Removes each `<root>/state/agents/<member>--<hex6>` directory that a removal recorded as gone and no index names,
+// and drops member-agent auth profiles a removal recorded as `dropped`. Only recorded directories go: a legacy member's
+// own directory is never recorded, so it stays. The directories are listed before the index is read: each listed one was
+// created after its entry was written. Damaged members' agents are never swept (their gone/dropped lists are unknown);
+// `log` reports each damaged index once.
+export function sweepOrphans(root, log) {
+    const { damaged } = indexedAgents(root);
+    for (const member of damaged)
+        log?.(words('account.indexDamaged', { member }));
+    let dirs = [];
+    try {
+        dirs = readdirSync(join(root, 'state', 'agents'));
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
     const gone = removedAccountAgents(root);
     for (const dir of dirs) {
         if (!gone.has(dir))
             continue;
         rmSync(join(root, 'state', 'agents', dir), { recursive: true, force: true });
     }
+    sweepMemberAuthProfiles(root);
 }
 export function createAccounts(ctx) {
     const path = (member) => indexPath(ctx.root, member);
-    const read = (member) => readIndex(ctx.root, member);
+    const read = (member) => {
+        const loaded = loadIndex(ctx.root, member);
+        if (loaded.damaged) {
+            const message = words('account.indexDamaged', { member });
+            ctx.log?.(message);
+            throw new Error(message);
+        }
+        return loaded.file;
+    };
     // Accounts whose sign-in is running, as `<member>\n<id>`, counted per add: listed `signing` until the last one ends.
     const signing = new Map();
     // The index file's own lock, apart from any agent's: a run's shared hold on the member agent never blocks an edit.
@@ -186,6 +372,17 @@ export function createAccounts(ctx) {
     };
     const markGone = (file, agent) => { if (!file.gone?.includes(agent))
         file.gone = [...(file.gone ?? []), agent]; };
+    const markDropped = (file, provider) => {
+        if (!file.dropped?.includes(provider))
+            file.dropped = [...(file.dropped ?? []), provider];
+    };
+    const clearDropped = (file, provider) => {
+        if (!file.dropped?.includes(provider))
+            return;
+        file.dropped = file.dropped.filter((p) => p !== provider);
+        if (!file.dropped.length)
+            delete file.dropped;
+    };
     const write = (member, file) => {
         mkdirSync(join(ctx.root, 'accounts'), { recursive: true, mode: 0o700 });
         const tmp = `${path(member)}.${randomUUID()}.tmp`;
@@ -234,6 +431,9 @@ export function createAccounts(ctx) {
         const memberRows = [];
         const seen = new Set();
         for (const [provider, profiles] of [...byProvider.entries()].sort(([a], [b]) => a < b ? -1 : 1)) {
+            // A removeAccount tombstone wins until the person signs in again: do not synthesize the removed row back.
+            if (file.dropped?.includes(provider))
+                continue;
             let entry = file.accounts[provider];
             if (!entry || entry.agent !== agentId) {
                 const route = entry?.agent === agentId && typeof entry.route === 'string' ? entry.route : synthesizedRoute(provider);
@@ -283,7 +483,26 @@ export function createAccounts(ctx) {
         }
         memberRows.sort((a, b) => a.addedAt - b.addedAt || (a.id < b.id ? -1 : 1));
         agentRows.sort((a, b) => a.addedAt - b.addedAt);
-        const rows = [...memberRows, ...agentRows];
+        // The API-key lane: the member's single key agent, indexed once as `<provider>.key`. Only what the index
+        // names is listed; a key agent the index does not name holds no account.
+        const keyRows = [];
+        for (const [id, entry] of Object.entries(file.accounts)) {
+            if (entry.agent !== keyAgentId(member) || !roster.has(entry.agent))
+                continue;
+            const provider = id.split('.')[0];
+            const meta = metaOf(entry.route);
+            const profiles = await profilesOf(entry.agent);
+            const who = profiles.find((p) => p.provider === provider)?.who;
+            if (!entry.who && typeof who === 'string' && !signing.has(`${member}\n${id}`)) {
+                entry.who = who;
+                dirty = true;
+            }
+            keyRows.push({ id, provider, route: entry.route, name: entry.name, label: meta.label,
+                billing: meta.billing, state: stateOf(entry.route, profiles[0]?.status, entry.until),
+                ...(entry.until !== undefined ? { until: entry.until } : {}), addedAt: entry.addedAt });
+        }
+        keyRows.sort((a, b) => a.addedAt - b.addedAt);
+        const rows = [...memberRows, ...agentRows, ...keyRows];
         for (const row of rows)
             if (signing.has(`${member}\n${row.id}`))
                 row.state = 'signing';
@@ -441,7 +660,7 @@ export function createAccounts(ctx) {
             return roomOf(row.provider, answer);
         });
     // Runs step 2 reads the index alone: the index-only refusal makes no request, and a cold index adds one account
-    // listing (the pick's late check after `list`; `keyRefusal` lists when the held account is not API-billed). This
+    // listing (the pick's late check after `list`; `keyRefusal` lists unless the binding is the key lane). This
     // gives the accounts a binding holds, in list order, and the name a refusal shows (`account.another` when it holds none).
     const boundOf = (file, binding) => binding.id !== undefined ? [binding.id]
         : Object.entries(file.accounts).filter(([, e]) => e.agent === binding.agentId)
@@ -464,23 +683,27 @@ export function createAccounts(ctx) {
             return { code: 'bound', name: nameOf(file, ids) };
         return undefined;
     };
-    // An API-key run (Runs step 2): its key continues only an API-billed binding; any other binding is refused.
+    // An API-key run (Runs step 2): its key continues its own lane's conversation whatever the key bills (a
+    // plan key bills subscription), and any other binding is refused.
     const keyRefusal = async (member, binding) => {
-        const held = binding.id === undefined ? undefined : read(member).accounts[binding.id];
-        if (held && metaOf(held.route).billing === 'api')
+        if (binding.agentId === keyAgentId(member))
             return undefined;
         await list(member);
         const file = read(member);
         return words('account.bound', { name: nameOf(file, boundOf(file, binding)) });
     };
-    // Runs step 1 (5.15): a key `agent:<member>--<hex6>:<tail>` of an indexed account agent is bound to that account; a
-    // key `agent:<member>:<tail>` to whichever of the member's agents holds `agent:<that agent>:<tail>` (member agent
-    // first), else unbound. Any other key is not the member's. With no account agent, the member agent and an unbound
-    // key run alike, so nothing is asked.
+    // Runs step 1 (5.15): a key `agent:<member>--<hex6>:<tail>` of an indexed account agent is bound to that account. A key
+    // `agent:<member>:<tail>` is bound to whichever of the member's agents holds `agent:<that agent>:<tail>` (member agent
+    // first, then the key lane, whose account is its `<provider>.key`, then the account agents), else unbound. Any other key
+    // is not the member's. With no account agent and no indexed lane, the member agent and an unbound key run alike, so
+    // nothing is asked.
     async function bind(member, sessionKey) {
         check(member);
-        const agents = new Map(Object.entries(read(member).accounts)
+        const file = read(member);
+        const agents = new Map(Object.entries(file.accounts)
             .filter(([, e]) => ACCOUNT_AGENT.test(e.agent) && e.agent.startsWith(`${member}--`)).map(([id, e]) => [e.agent, id]));
+        const lane = keyAgentId(member);
+        const laneId = Object.entries(file.accounts).find(([, e]) => e.agent === lane)?.[0];
         if (!sessionKey.startsWith(`agent:${member}:`)) {
             const agent = /^agent:([^:]+):/.exec(sessionKey)?.[1];
             const id = agent === undefined ? undefined : agents.get(agent);
@@ -488,12 +711,13 @@ export function createAccounts(ctx) {
                 throw new Error(`refused: "${sessionKey}" is not a session of member "${member}"`);
             return { agentId: agent, id };
         }
-        if (!agents.size)
+        if (!agents.size && laneId === undefined)
             return undefined;
         const tail = sessionKey.slice(`agent:${member}:`.length);
         const { agentId } = await ctx.ensure(member);
         const roster = new Set((await ctx.request('agents.list')).agents.map((a) => a.id));
-        for (const [agent, id] of [[agentId, undefined], ...agents]) {
+        const laneProbe = laneId === undefined ? [] : [[lane, laneId]];
+        for (const [agent, id] of [[agentId, undefined], ...laneProbe, ...agents]) {
             if (agent !== agentId && !roster.has(agent))
                 continue;
             // The pin answers a found session with its canonical `key` and a missing one with `{ ok: false }`.
@@ -503,10 +727,11 @@ export function createAccounts(ctx) {
         }
         return undefined;
     }
-    // Choosing (5.15): every listed account's room and models are read live once, then the pure `resolveSelection`
-    // decides. A binding narrows it (Runs step 2): a key bound to an account agent resolves 'auto', 'default' and no id to
-    // that account; a key bound to the member agent chooses only among its own accounts. A refusal (`bound`, `paid`) is
-    // decided from the index, after the account listing when the index is cold, and so has no `considered` rows.
+    // Choosing (5.15): every pick input's room and models are read live once (unnamed key lanes are excluded),
+    // then the pure `resolveSelection` decides. A binding narrows it (Runs step 2): a key bound to an account agent resolves 'auto', 'default' and no id to
+    // that account; a key bound to the key lane resolves to its `<provider>.key` account; a key bound to the member agent
+    // chooses only among its own accounts. A refusal (`bound`, `paid`) is decided from the index, after the account
+    // listing when the index is cold, and so has no `considered` rows.
     // An unknown id stays the caller bug it always was. `agent` is the picked account's engine agent. A model unavailable
     // only because the account is signed out or resting is still in its plan: the account's state and the run's ready
     // check judge that.
@@ -524,18 +749,25 @@ export function createAccounts(ctx) {
         const late = binding && refusalOf(file, binding, sel);
         if (late)
             return refused(late);
+        if (binding?.id !== undefined && !listed.some((r) => r.id === binding.id))
+            return { pick: { ok: false, code: 'none', reason: words('auto.noneBound'), considered: [] } };
         const rows = listed.filter((r) => !skip.includes(r.id));
         const named = sel.account === 'auto' || sel.account === 'default' ? undefined : sel.account;
         const known = named === undefined || listed.some((r) => r.id === named);
         if (binding?.id !== undefined && known)
             sel = { ...sel, account: binding.id };
         const bound = binding && known ? boundOf(file, binding) : undefined;
-        const reads = new Map(await Promise.all(rows.map(async (row) => {
+        // The key lane is reached only by naming it (or the saved default): an unnamed lane row is not a pick input, so
+        // Auto and a default fallback see exactly the accounts they saw before the lane was indexed.
+        const lanes = new Set(Object.entries(file.accounts).filter(([, e]) => e.agent === keyAgentId(member)).map(([id]) => id));
+        const pickRows = rows.filter((r) => !lanes.has(r.id) || sel.account === r.id ||
+            (sel.account === 'default' && file.defaults.account === r.id));
+        const reads = new Map(await Promise.all(pickRows.map(async (row) => {
             const entry = file.accounts[row.id];
             const models = await readModels(row, entry).then((ms) => ms.map((m) => (m.why ? { ...m, available: true } : m)), () => undefined);
             return [row.id, { room: await readRoom(row, entry), models }];
         })));
-        const chosen = resolveSelection(rows, file.defaults, sel, (a) => reads.get(a.id).room, Date.now(), (a) => reads.get(a.id).models, bound);
+        const chosen = resolveSelection(pickRows, file.defaults, sel, (a) => reads.get(a.id).room, Date.now(), (a) => reads.get(a.id).models, bound);
         return { pick: chosen, ...(chosen.ok ? { agent: file.accounts[chosen.account.id].agent } : {}) };
     }
     // Moving a conversation (5.15, O14 step S12): the key binds as a run's does (with no account agent binding asks
@@ -607,10 +839,127 @@ export function createAccounts(ctx) {
     const rest = (member, id, until) => edit(member, (file) => { const entry = file.accounts[id]; if (entry)
         entry.until = until; });
     const agentDir = (agent) => join(ctx.root, 'state', 'agents', agent);
-    // Removing (5.15): a member-agent account goes through `models.authLogout` with its sealed profileIds, then its
-    // entry is dropped. An account agent goes through `clear`, an empty `list`, `agents.delete` with
-    // `deleteFiles: false`, removal of its state dir, then the entry is dropped. Refused `busy` while a run holds
-    // the agent; the member agent stays ready (only the named provider is logged out or cleared).
+    const laneEntry = (member, route, addedAt) => ({ agent: keyAgentId(member), name: route.label, route: route.choice, addedAt });
+    // The API-key lane's index entry (5.15): one per member, `<provider>.key` on the `byokit-key-<member>` agent.
+    // A new key replaces the old one: whatever lane entry the member holds is dropped first, keeping its `addedAt`.
+    // The key itself is never stored: only the agent, the route choice and the name.
+    async function key(member, route) {
+        check(member);
+        const lane = keyAgentId(member);
+        return ctx.locks.exclusive([indexLock(member)], async () => {
+            const loaded = loadIndex(ctx.root, member);
+            if (loaded.damaged) {
+                ctx.log?.(words('account.indexDamaged', { member }));
+                return;
+            }
+            const file = loaded.file;
+            const kept = Object.values(file.accounts).find((e) => e.agent === lane)?.addedAt;
+            for (const [other, e] of Object.entries(file.accounts))
+                if (e.agent === lane)
+                    delete file.accounts[other];
+            file.accounts[`${route.provider}.key`] = laneEntry(member, route, kept ?? Date.now());
+            write(member, file);
+        });
+    }
+    // The removal's counterpart to `key`: drop the lane's index entry, so `list` stops naming the removed key.
+    // `provider` scopes it to that provider's entry (a scoped removal that kept another provider's key keeps its
+    // entry too); without one every lane entry goes. A damaged index is left alone, like `key` leaves it.
+    async function unkey(member, provider) {
+        check(member);
+        const lane = keyAgentId(member);
+        return ctx.locks.exclusive([indexLock(member)], async () => {
+            const loaded = loadIndex(ctx.root, member);
+            if (loaded.damaged) {
+                ctx.log?.(words('account.indexDamaged', { member }));
+                return;
+            }
+            const file = loaded.file;
+            for (const [id, e] of Object.entries(file.accounts)) {
+                if (e.agent !== lane || (provider !== undefined && id.split('.')[0] !== provider))
+                    continue;
+                dropEntry(file, id);
+            }
+            write(member, file);
+        });
+    }
+    // The connect sweep's backfill: a lane that holds no entry is indexed under the one route its model's provider has;
+    // any other count is logged and left unindexed. A lane that holds an entry is never touched, nor a damaged index.
+    async function backfill(member, found) {
+        check(member);
+        const lane = keyAgentId(member);
+        return ctx.locks.exclusive([indexLock(member)], async () => {
+            const loaded = loadIndex(ctx.root, member);
+            if (loaded.damaged) {
+                ctx.log?.(words('account.indexDamaged', { member }));
+                return;
+            }
+            if (Object.values(loaded.file.accounts).some((e) => e.agent === lane))
+                return;
+            if (found.length !== 1) {
+                ctx.log?.(`key lane ${member}: its provider has no single key route, so it is not indexed; add the key again to index it`);
+                return;
+            }
+            loaded.file.accounts[`${found[0].provider}.key`] = laneEntry(member, found[0], Date.now());
+            write(member, loaded.file);
+        });
+    }
+    // Index edits take the index lock, as listing's own write does. A damaged index starts empty and is rewritten
+    // (re-add's repair path); the bad bytes are replaced, never left as the live index after a successful write.
+    const edit = (member, fn) => ctx.locks.exclusive([indexLock(member)], async () => {
+        const loaded = loadIndex(ctx.root, member);
+        if (loaded.damaged)
+            ctx.log?.(words('account.indexDamaged', { member }));
+        const file = loaded.damaged ? empty() : loaded.file;
+        fn(file);
+        write(member, file);
+    });
+    const identityOf = async (agentId) => {
+        const { file } = await ctx.request('agents.files.get', { agentId, name: IDENTITY });
+        return file.missing ? undefined : file.content;
+    };
+    const restoreIdentity = async (memberAgent, before) => {
+        if (before !== undefined && await identityOf(memberAgent) !== before)
+            await ctx.request('agents.files.set', { agentId: memberAgent, name: IDENTITY, content: before });
+    };
+    const readModel = async (agentId) => {
+        const got = await ctx.request('config.get');
+        return got.config?.agents?.entries?.[agentId]?.model;
+    };
+    // A merge patch cannot delete a key: with no prior primary, `agents.update { model: null }` clears the pin so the
+    // engine default applies. A write that lands between the read and the patch moves the hash: try once more.
+    const restoreModel = async (memberAgent, model) => {
+        const clear = async () => {
+            await ctx.request('agents.update', { agentId: memberAgent, model: null });
+        };
+        const patch = async () => {
+            const { hash } = await ctx.request('config.get');
+            await ctx.request('config.patch', { raw: JSON.stringify({ agents: { entries: { [memberAgent]: { model } } } }), baseHash: hash });
+        };
+        try {
+            if (model === undefined || model === null) {
+                await clear().catch(() => clear());
+                return;
+            }
+            await patch().catch(() => patch());
+        }
+        catch (error) {
+            // A damaged prior must not leave the removed provider's pin: fall back to clearing.
+            if (model !== undefined && model !== null) {
+                try {
+                    await clear().catch(() => clear());
+                }
+                catch (clearError) {
+                    ctx.log?.(`addAccount: ${memberAgent} model pin is not cleared: ${clearError instanceof Error ? clearError.message : String(clearError)}`);
+                }
+            }
+            ctx.log?.(`addAccount: ${memberAgent} model is not restored: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    };
+    // Removing (5.15): a member-agent account goes through `models.authLogout` with its sealed profileIds, restores or
+    // clears the member primary from `priorModel`, then drops its entry. An account agent goes through `clear`, an
+    // empty `list`, `agents.delete` with `deleteFiles: false`, removal of its state dir, then the entry is dropped.
+    // Refused `busy` while a run holds the agent; the member agent stays ready (only the named provider is logged out
+    // or cleared).
     const providerProfileIds = async (agentId, provider) => {
         const listed = await ctx.request('byokit.accounts', { action: 'list', agentId });
         if (listed.ok !== true || !Array.isArray(listed.profiles))
@@ -621,6 +970,8 @@ export function createAccounts(ctx) {
         check(member);
         const { agentId: memberAgent } = await ctx.ensure(member);
         const entry = read(member).accounts[id];
+        if (entry?.agent === keyAgentId(member))
+            throw new Error(`removeAccount: ${id} is a key lane; use removeKey`);
         if (!entry || (entry.agent !== memberAgent && !(ACCOUNT_AGENT.test(entry.agent) && entry.agent.startsWith(`${member}--`))))
             throw new Error(`unknown account: ${id}`);
         const agent = entry.agent;
@@ -635,7 +986,11 @@ export function createAccounts(ctx) {
                 if ((await providerProfileIds(agent, provider)).length)
                     throw new Error('removeAccount: the account is still signing in');
                 const file = read(member);
+                const prior = file.accounts[id]?.priorModel;
+                // Restore the pre-sign-in primary (or clear the pin) before dropping the entry; failure must not block removal.
+                await restoreModel(memberAgent, typeof prior === 'string' && prior ? prior : undefined);
                 dropEntry(file, id);
+                markDropped(file, provider);
                 write(member, file);
                 // The live store changed: re-seal at once so the sealed copy stops holding the removed profile.
                 await ctx.reseal?.();
@@ -663,38 +1018,6 @@ export function createAccounts(ctx) {
             await ctx.reseal?.();
         });
     }
-    // Index edits take the index lock, as listing's own write does.
-    const edit = (member, fn) => ctx.locks.exclusive([indexLock(member)], async () => { const file = read(member); fn(file); write(member, file); });
-    const identityOf = async (agentId) => {
-        const { file } = await ctx.request('agents.files.get', { agentId, name: IDENTITY });
-        return file.missing ? undefined : file.content;
-    };
-    const restoreIdentity = async (memberAgent, before) => {
-        if (before !== undefined && await identityOf(memberAgent) !== before)
-            await ctx.request('agents.files.set', { agentId: memberAgent, name: IDENTITY, content: before });
-    };
-    const readModel = async (agentId) => {
-        const got = await ctx.request('config.get');
-        return got.config?.agents?.entries?.[agentId]?.model;
-    };
-    // ponytail: a merge patch cannot delete a key, so a member with no model entry before its sign-in keeps the pinned one.
-    const restoreModel = async (memberAgent, model) => {
-        if (model === undefined) {
-            ctx.log?.(`addAccount: ${memberAgent} had no model entry to restore`);
-            return;
-        }
-        // A config write that lands between the read and the patch moves the hash: read and patch once more.
-        const patch = async () => {
-            const { hash } = await ctx.request('config.get');
-            await ctx.request('config.patch', { raw: JSON.stringify({ agents: { entries: { [memberAgent]: { model } } } }), baseHash: hash });
-        };
-        try {
-            await patch().catch(() => patch());
-        }
-        catch (error) {
-            ctx.log?.(`addAccount: ${memberAgent} model is not restored: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    };
     const onGateway = (agent) => untilListed(ctx.request, agent)
         .then(() => true, () => ctx.request('agents.list')
         .then((r) => r.agents.some((a) => a.id === agent)));
@@ -746,18 +1069,27 @@ export function createAccounts(ctx) {
                 if (fresh)
                     releaseAdd();
             }
-            // The member agent's primary model before this sign-in or any merge on it: restored when its profile moves away.
+            // The member agent's primary before this sign-in or any merge on it: restored when its profile moves away or
+            // the member-agent account is removed. Durable on the member entry as `priorModel` (empty when none).
             const memberModel = await readModel(memberAgent);
-            const entryOf = (file, agent) => ({ agent, route: route.choice, addedAt: Date.now(),
-                name: name ?? `${route.label} ${Object.values(file.accounts).filter((e) => e.route === route.choice).length + 1}` });
+            const entryOf = (file, agent, prior) => ({ agent, route: route.choice, addedAt: Date.now(),
+                name: name ?? `${route.label} ${Object.values(file.accounts).filter((e) => e.route === route.choice).length + 1}`,
+                ...(prior !== undefined ? { priorModel: prior } : {}) });
             let id = provider;
             let agent = memberAgent;
             let added = false;
             if (!fresh) {
-                await edit(member, (file) => { if (!file.accounts[id]) {
-                    file.accounts[id] = entryOf(file, agent);
-                    added = true;
-                } });
+                const prior = priorOf(memberModel);
+                await edit(member, (file) => {
+                    if (!file.accounts[id]) {
+                        file.accounts[id] = entryOf(file, agent, prior);
+                        added = true;
+                    }
+                    // Keep the first pre-sign-in primary across a later re-sign-in of the same member row.
+                    else if (file.accounts[id].priorModel === undefined)
+                        file.accounts[id].priorModel = prior;
+                    clearDropped(file, provider);
+                });
             }
             else {
                 // `<member>--<hex6>`, drawn again while that agent exists; its entry is written before the agent.
@@ -948,5 +1280,5 @@ export function createAccounts(ctx) {
             throw error;
         }
     }
-    return { list, add, rename, defaults, setDefaults, models, room, bind, keyRefusal, pick, rest, move, remove };
+    return { list, add, rename, defaults, setDefaults, models, room, bind, keyRefusal, key, unkey, backfill, pick, rest, move, remove };
 }