@byokit/openclaw 0.13.0 → 0.14.2

package/dist/keys.js

@@ -1,9 +1,10 @@
 import { join } from 'node:path';
-import { activate } from "./activation.js";
-import { keyAgentId, MEMBER_ID, KEY_PREFIX, untilListed } from "./members.js";
-import { routes } from "./routes.js";
-import { modelsOf } from "./accounts.js";
-import { LIVE_CATALOGS } from "./constants.js";
+import { activate } from './activation.js';
+import { keyAgentId, MEMBER_ID, KEY_PREFIX, untilListed } from './members.js';
+import { providerOf } from './pick.js';
+import { routes } from './routes.js';
+import { modelsOf } from './accounts.js';
+import { LIVE_CATALOGS } from './constants.js';
 export function createKeys(ctx) {
     // Serialize key replacement and key runs, so an in-flight run never sees a half-installed replacement.
     const tails = new Map();
@@ -73,62 +74,96 @@ export function createKeys(ctx) {
     return {
         models,
         exclusive,
-        async add(member, o) {
-            if (!check(member))
-                throw new Error('Choose your own member.');
-            if (!o.apiKey.trim())
-                return failure('invalid', 'empty');
-            const route = routes().find((r) => r.choice === o.authChoice && r.keyEntry && r.readiness === 'ready');
-            if (!route || (o.model !== undefined && !LIVE_CATALOGS.includes(route.provider)))
-                return failure('not_included', 'model');
-            return exclusive(member, async () => {
-                let sent = false;
-                // A key the engine may have taken but not sealed is cleared (prepare already emptied the agent); if the clear
-                // does not reach the engine, the key stays unsealed and unusable until the next key add or kit start, so runs
-                // fail closed.
-                const abandon = async (result) => {
-                    await control(member, 'clear').catch(() => undefined);
-                    return result;
-                };
-                try {
-                    await ctx.ensure(member);
-                    const agentId = keyAgentId(member);
-                    const list = await ctx.request('agents.list');
-                    if (!list.agents.some((a) => a.id === agentId))
-                        await ctx.request('agents.create', { name: agentId, workspace: join(ctx.root, 'key-workspaces', member) });
-                    // Creation answers before the runtime roster/owners publish, just as for ordinary members.
-                    await untilListed(ctx.request, agentId);
-                    if (!(await control(member, 'prepare', route.provider)).ok)
-                        return failure('retry', 'engine');
-                    // The public pin's typed API-key path, never a CLI-login import. Discard the engine's lines/errors.
-                    sent = true;
-                    const result = await activate(ctx, { kind: 'api-key', agentId, authChoice: o.authChoice, apiKey: o.apiKey }, { timeoutMs: 180_000 });
-                    if (!result.ok && !result.late)
-                        return abandon(probeResult(result.status));
-                    if (result.late)
-                        return abandon(failure('retry', 'busy'));
-                    if (o.model !== undefined && !(await models(member, o)).some((m) => m.id === o.model && m.available))
-                        return abandon(failure('not_included', 'model'));
-                    // Prepare before publishing the ready marker: failed preparation remains unusable even if clear fails.
+        add(member, o) {
+            const ac = new AbortController();
+            const cancel = () => { if (!ac.signal.aborted)
+                ac.abort(); };
+            const done = (async () => {
+                if (!check(member))
+                    throw new Error('Choose your own member.');
+                if (!o.apiKey.trim())
+                    return failure('invalid', 'empty');
+                const route = routes().find((r) => r.choice === o.authChoice && r.keyEntry && r.readiness === 'ready');
+                if (!route || (o.model !== undefined && !LIVE_CATALOGS.includes(route.provider)))
+                    return failure('not_included', 'model');
+                // A workspace names a live-catalog login's own workspace only; another route takes no header, and a
+                // refusal here leaves the member's lanes untouched (it lands before any prepare or activation).
+                const orgId = typeof o.orgId === 'string' ? o.orgId.trim() : '';
+                if (orgId) {
+                    if (orgId.length > 256)
+                        return failure('invalid', 'auth');
+                    if (!LIVE_CATALOGS.includes(route.provider))
+                        return failure('not_included', 'model');
+                }
+                if (ac.signal.aborted)
+                    return failure('retry', 'busy');
+                return exclusive(member, async () => {
+                    let sent = false;
+                    // A key the engine may have taken but not sealed is cleared (prepare already emptied the agent); if the clear
+                    // does not reach the engine, the key stays unsealed and unusable until the next key add or kit start, so runs
+                    // fail closed.
+                    const abandon = async (result) => {
+                        await control(member, 'clear').catch(() => undefined);
+                        return result;
+                    };
+                    const cancelled = () => failure('retry', 'busy');
                     try {
-                        await ctx.prepareOwner(agentId);
+                        if (ac.signal.aborted)
+                            return cancelled();
+                        await ctx.ensure(member);
+                        const agentId = keyAgentId(member);
+                        const list = await ctx.request('agents.list');
+                        if (!list.agents.some((a) => a.id === agentId))
+                            await ctx.request('agents.create', { name: agentId, workspace: join(ctx.root, 'key-workspaces', member) });
+                        // Creation answers before the runtime roster/owners publish, just as for ordinary members.
+                        await untilListed(ctx.request, agentId);
+                        if (ac.signal.aborted)
+                            return cancelled();
+                        if (!(await control(member, 'prepare', route.provider)).ok)
+                            return failure('retry', 'engine');
+                        // The workspace rides the provider's probe and every run from its config; it is written before the
+                        // activation, so the probe itself carries it. The slot is provider-wide (shared by every member's
+                        // key on this engine), so a replacement with no `orgId` keeps the standing one and `removeKey` drops it.
+                        if (orgId)
+                            await ctx.setProviderHeaders(route.provider, { 'x-opencode-org-id': orgId });
+                        // The public pin's typed API-key path, never a CLI-login import. Discard the engine's lines/errors.
+                        sent = true;
+                        if (ac.signal.aborted)
+                            return abandon(cancelled());
+                        const result = await activate(ctx, { kind: 'api-key', agentId, authChoice: o.authChoice, apiKey: o.apiKey }, { timeoutMs: 180_000, signal: ac.signal });
+                        if (ac.signal.aborted)
+                            return abandon(cancelled());
+                        if (!result.ok && !result.late)
+                            return abandon(probeResult(result.status));
+                        if (result.late)
+                            return abandon(failure('retry', 'busy'));
+                        if (o.model !== undefined && !(await models(member, o)).some((m) => m.id === o.model && m.available))
+                            return abandon(failure('not_included', 'model'));
+                        // Prepare before publishing the ready marker: failed preparation remains unusable even if clear fails.
+                        try {
+                            await ctx.prepareOwner(agentId);
+                        }
+                        catch {
+                            return abandon(failure('retry', 'engine'));
+                        }
+                        if (ac.signal.aborted)
+                            return abandon(cancelled());
+                        if (o.model !== undefined && LIVE_CATALOGS.includes(route.provider) && !(await registered(route.provider, o.model)))
+                            return abandon(failure('retry', 'model'));
+                        if (!(await control(member, 'seal', undefined, o.model)).ok)
+                            return abandon(failure('retry', 'engine'));
+                        await ctx.indexLane(member, route);
+                        return { status: 'ok' };
                     }
-                    catch {
-                        return abandon(failure('retry', 'engine'));
+                    catch (error) {
+                        const reason = errorReason(error, sent);
+                        if (sent)
+                            return abandon(failure('retry', reason));
+                        return failure('retry', reason);
                     }
-                    if (o.model !== undefined && LIVE_CATALOGS.includes(route.provider) && !(await registered(route.provider, o.model)))
-                        return abandon(failure('retry', 'model'));
-                    if ((await control(member, 'seal', undefined, o.model)).ok)
-                        return { status: 'ok' };
-                    return abandon(failure('retry', 'engine'));
-                }
-                catch (error) {
-                    const reason = errorReason(error, sent);
-                    if (sent)
-                        return abandon(failure('retry', reason));
-                    return failure('retry', reason);
-                }
-            });
+                });
+            })();
+            return Object.assign(done, { cancel });
         },
         async ready(member, o = {}) {
             if (!check(member))
@@ -147,11 +182,41 @@ export function createKeys(ctx) {
                 }
             }
         },
-        // Kit start calls this once the gateway is ready: a failed add whose abandon clear never reached the engine
-        // leaves an unsealed key with no ready marker, so drop it. A single ready read per key agent, no retries; an add
-        // in flight for that member is waited for. Only an absent marker is cleared; a refused read or clear (the gateway
-        // left ready) makes the sweep incomplete. Resolves true once every key agent was read.
-        async sweep() {
+        // Remove this member's saved key: the key agent's store and its ready marker, so the lane reads signed out and
+        // stays signed out, plus its `<provider>.key` index entry, so the accounts list stops naming the removed key.
+        // `provider` scopes it to the key actually saved for that provider (the member agent's own
+        // sign-out never reaches this lane), so signing out of one provider never drops another's key. A lane that reads
+        // not ready has nothing saved to remove; a refused read or clear is a typed refusal, never raw engine text.
+        // Serialized with adds and key runs like every other key change.
+        async remove(member, o = {}) {
+            if (!check(member))
+                throw new Error('Choose your own member.');
+            await exclusive(member, async () => {
+                const refused = () => { throw new Error('The key could not be removed.'); };
+                if (o.provider !== undefined) {
+                    // An unreadable lane cannot name its provider, so removal never guesses and risks another provider's key.
+                    const ready = await control(member, 'ready').catch(() => undefined);
+                    if (!ready)
+                        refused();
+                    else if (ready.ok !== true || providerOf(ready.model ?? '') !== o.provider)
+                        return;
+                }
+                // The lane's own provider, when the removal can name it: the header clear below is scoped like the removal.
+                const cleared = await control(member, 'clear').catch(() => undefined);
+                if (cleared?.ok !== true && cleared?.absent !== true)
+                    refused();
+                // A workspace header the removed key named must not outlive it; the next add names its own (or none).
+                if (o.provider !== undefined && LIVE_CATALOGS.includes(o.provider))
+                    await ctx.setProviderHeaders(o.provider, null).catch(() => { throw new Error('The key could not be removed.'); });
+                await ctx.dropLane(member, o.provider);
+            });
+        },
+        // Kit connect calls this once the gateway is ready: a failed add whose abandon clear never reached the engine
+        // leaves an unsealed key with no ready marker, so drop it (`clear`, until a sweep completes). A single ready read
+        // per key agent, no retries; an add in flight for that member is waited for. Only an absent marker is cleared; a
+        // refused read or clear (the gateway left ready) makes the sweep incomplete. A sealed lane is backfilled on every
+        // call. Resolves true once every key agent was read.
+        async sweep(clear) {
             let agents;
             try {
                 agents = (await ctx.request('agents.list')).agents;
@@ -168,7 +233,11 @@ export function createKeys(ctx) {
                     continue;
                 await exclusive(member, async () => {
                     const ready = await control(member, 'ready').catch(() => undefined);
-                    if (ready?.ok === true)
+                    if (ready?.ok === true) {
+                        await ctx.backfillLane(member, ready.model);
+                        return;
+                    }
+                    if (!clear)
                         return;
                     if (ready?.absent !== true) {
                         complete = false;

package/dist/kit.d.ts

@@ -1,5 +1,5 @@
 import type { SealingAdapter } from '@byokit/secrets';
-import { type AddKeyResult } from './keys.ts';
+import { type AddKeyHandle } from './keys.ts';
 import { type RouteView } from './routes.ts';
 import type { BrowserHost, BrowserOptions } from './browser.ts';
 import type { Account, AccountId, AccountPick, Approval, CallOptions, Decision, Defaults, GatewayMethod, GatewayParams, GatewayResult, GatewayTransport, Hello, KitState, KitEventName, KitEventPayload, LearningCapture, LearningMode, Member, ModelInfo, MoveResult, Room, RunEnd, RunEvent, RunRef, RunSelection, RunSpec, OutputSchema, SchemaOutput, SignInOptions, SignInView, ToolHost, ToolSpec } from './types.ts';
@@ -153,12 +153,24 @@ export declare class OpenClawKit {
     removeAccount(member: Member, id: AccountId): Promise<void>;
     defaults(member: Member): Promise<Defaults>;
     setDefaults(member: Member, d: Defaults): Promise<void>;
-    /** Save an explicitly supplied API key (billed per use) in this member's separate key agent. */
+    /** Save an explicitly supplied API key (billed per use) in this member's separate key agent.
+     * `orgId` names the workspace a Go plan login acts for (the pick the app captured at connect);
+     * it rides every probe and run as `x-opencode-org-id`, and replacing the key rewrites it. */
     addKey(agentId: Member, o: {
         authChoice: string;
         apiKey: string;
         model?: string;
-    }): Promise<AddKeyResult>;
+        orgId?: string;
+    }): AddKeyHandle;
+    private indexKeyLane;
+    /** Remove this member's saved key (the `byokit-key-<member>` lane: its credential store and ready marker), so
+     * `signedIn` is false for it and a restart cannot revive it. `provider` removes only that provider's saved key;
+     * with no saved key the call resolves without doing anything. */
+    removeKey(member: Member, o?: {
+        provider?: string;
+    }): Promise<void>;
+    private dropKeyLane;
+    private backfillKeyLane;
     private prepareKeyOwner;
     private syncCatalogs;
     migrateRetainedLogin(member: Member, source: RetainedLogin): Promise<'staged' | 'nothing' | 'failed'>;

package/dist/kit.js

@@ -3,29 +3,29 @@ import { join } from 'node:path';
 import { setTimeout as delay } from 'node:timers/promises';
 import { isDeepStrictEqual } from 'node:util';
 import { fileURLToPath } from 'node:url';
-import { PROTOCOL_VERSION, LIVE_CATALOGS } from "./constants.js";
-import { atomic } from "./engine-patches.js";
-import { Approvals } from "./approvals.js";
-import { Bridge } from "./bridge.js";
-import { Engine, refusedOnly } from "./engine.js";
-import { AuthStoreSealSizeError } from "./auth-store.js";
-import { gatewayTransport } from "./transport.js";
-import { createMembers } from "./members.js";
-import { createAccounts, memberOfAccount } from "./accounts.js";
-import { createLocks } from "./locks.js";
-import { keyAgentId, KEY_PREFIX, MEMBER_ID } from "./members.js";
-import { confirmRetainedLogin as confirmLogin, migrateRetainedLogin as migrateLogin } from "./migrate.js";
-import { createRuns, signedInProviders } from "./runs.js";
-import { authStatus, createAuthStatus } from "./auth-status.js";
-import { outputSchema } from "./output.js";
-import { createKeys } from "./keys.js";
-import { routes as routeTable } from "./routes.js";
-import { providerOf } from "./pick.js";
-import { signIn as startSignIn, signOut as engineSignOut } from "./signin.js";
-import { reconcileConfig, browserToolPolicySafe, browserProfileAcknowledged, browserSessionMayRun, memoryLimited as configMemoryLimited, configKeyPath, readConfigKey, writeConfigKey } from "./config.js";
-import { createBrowserHost } from "./browser/host.js";
-import { fileSignInStore } from "./browser/store.js";
-import { launchBroker } from "./browser/broker.js";
+import { PROTOCOL_VERSION, LIVE_CATALOGS } from './constants.js';
+import { atomic } from './engine-patches.js';
+import { Approvals } from './approvals.js';
+import { Bridge } from './bridge.js';
+import { Engine, canonicalStateDir, refusedOnly } from './engine.js';
+import { AuthStoreSealSizeError } from './auth-store.js';
+import { gatewayTransport } from './transport.js';
+import { createMembers } from './members.js';
+import { createAccounts, memberOfAccount } from './accounts.js';
+import { createLocks } from './locks.js';
+import { keyAgentId, KEY_PREFIX, MEMBER_ID } from './members.js';
+import { confirmRetainedLogin as confirmLogin, migrateRetainedLogin as migrateLogin } from './migrate.js';
+import { createRuns, signedInProviders } from './runs.js';
+import { authStatus, createAuthStatus } from './auth-status.js';
+import { outputSchema } from './output.js';
+import { createKeys } from './keys.js';
+import { routes as routeTable } from './routes.js';
+import { providerOf } from './pick.js';
+import { signIn as startSignIn, signOut as engineSignOut } from './signin.js';
+import { reconcileConfig, browserToolPolicySafe, browserProfileAcknowledged, browserSessionMayRun, memoryLimited as configMemoryLimited, configKeyPath, readConfigKey, writeConfigKey } from './config.js';
+import { createBrowserHost } from './browser/host.js';
+import { fileSignInStore } from './browser/store.js';
+import { launchBroker } from './browser/broker.js';
 /** The engine's learning-mode config key (5.6 "Engine learning state"). */
 const LEARNING_KEY = 'skills.workshop.autonomous.mode';
 const RESTART_MS = 60_000;
@@ -651,7 +651,7 @@ export class OpenClawKit {
                 || (o.browser && ['browser', 'request_sign_in', 'exec', 'process', 'code_execution', 'terminal', 'read', 'write', 'edit', 'apply_patch', 'gateway'].includes(t.name)))
                 throw new Error(`invalid tool name: ${t.name}`);
         }
-        this.o = o;
+        this.o = { ...o, stateDir: canonicalStateDir(o.stateDir) };
         this.engine = new Engine({ ...o, pluginId: o.plugin?.id ?? 'byokit', tools: [...o.tools ?? [], ...(o.browser ? [{
                         name: 'request_sign_in', description: 'Ask the person to sign in to the current browser site.',
                         parameters: { type: 'object', additionalProperties: false, properties: {
@@ -664,11 +664,15 @@ export class OpenClawKit {
         this.admission = createAuthStatus(this.engine.root, (method, params, options) => this.request()(method, params, options));
         this.keys = createKeys({ root: this.engine.root,
             prepareOwner: (agentId) => this.prepareKeyOwner(agentId),
+            indexLane: (member, route) => this.indexKeyLane(member, route),
+            dropLane: (member, provider) => this.dropKeyLane(member, provider),
+            backfillLane: (member, model) => this.backfillKeyLane(member, model),
             restarting: () => this.engineRestarting(),
             request: (method, params, options) => this.request()(method, params, options),
             ensure: (member) => this.ensureMember(member),
             authConfig: () => this.authSnapshot(),
-            restarted: (authBefore, signal) => this.restarted(authBefore, signal) });
+            restarted: (authBefore, signal) => this.restarted(authBefore, signal),
+            setProviderHeaders: (provider, headers) => this.patchConfig({ models: { providers: { [provider]: { headers: headers ?? null } } } }) });
         const slot = {};
         this.approvalsCtl = new Approvals({
             request: (method, params, co) => this.request()(method, params, co),
@@ -771,10 +775,11 @@ export class OpenClawKit {
             this.setState({ phase: 'ready' });
             this.syncCatalogs();
             // A failed key add whose abandon clear never reached the engine leaves an unsealed key with no ready marker;
-            // runs stay closed, so drop it now that the gateway is ready. Ready keys keep their marker and survive.
-            if (!this.swept)
-                void this.keys.sweep().then((done) => { if (done)
-                    this.swept = true; }).catch(() => undefined);
+            // runs stay closed, so drop it now that the gateway is ready. Ready keys keep their marker and survive. Every
+            // connect backfills the key lanes' index entries; only the clear stops once a sweep completes.
+            const clear = !this.swept;
+            void this.keys.sweep(clear).then((done) => { if (clear && done)
+                this.swept = true; }).catch(() => undefined);
             if (this.o.browser)
                 await this.checkBrowserTools();
             // Replays the engine's native approval lists over the now-live transport (N9).
@@ -951,7 +956,10 @@ export class OpenClawKit {
             // Public readiness/sign-in reads stay live; their fresh result can prepare the next run's admission.
             authStatus: (agentId, refresh, native) => this.admission.read(agentId, refresh, native, false),
             ensure: (member) => this.ensureMember(member), callbackPort: this.o.callbackPort ?? 1455,
+            nativeClaudeLogin: () => this.engine.nativeClaudeLogin(),
+            resetNativeClaudeLogin: () => this.engine.resetNativeClaudeLogin(),
             onDisconnect: (fn) => { this.signInDisconnects.add(fn); return () => { this.signInDisconnects.delete(fn); }; },
+            stopSignal: this.engine.stopSignal,
             authConfig: () => this.authSnapshot(),
             restarted: (authBefore, signal) => this.restarted(authBefore, signal) };
     }
@@ -966,15 +974,31 @@ export class OpenClawKit {
         return this.providerStatus(member).then((names) => names ?? []);
     }
     /** A member sign-in to `provider`, or a ready key (5.8) whose saved model is that provider's. */
-    signedIn(member, provider) {
-        return this.providers(member).then(async (names) => names.includes(provider)
-            || providerOf((await this.keys.ready(member, { once: true }))?.model ?? '') === provider).catch(() => false);
+    async signedIn(member, provider) {
+        // The key probe stands alone: a member-agent admission failure after an engine restart must not hide a sealed key.
+        const keyReady = async () => {
+            try {
+                return providerOf((await this.keys.ready(member, { once: true }))?.model ?? '') === provider;
+            }
+            catch {
+                return false;
+            }
+        };
+        try {
+            if ((await this.providers(member)).includes(provider))
+                return true;
+        }
+        catch { /* key probe below */ }
+        return keyReady();
     }
     signIn(member, o, on) {
         return startSignIn(this.signInCtx(), member, o, on);
     }
-    signOut(member, provider) {
-        return engineSignOut(this.signInCtx(), member, provider);
+    async signOut(member, provider) {
+        await engineSignOut(this.signInCtx(), member, provider);
+        // The saved key lives on its own `byokit-key-<member>` agent, which the member-agent logout never reaches: without
+        // this, a key of that provider stays sealed and ready and the member reads signed in again after a restart.
+        await this.keys.remove(member, { provider });
     }
     // The member an agent id or session key belongs to, through the account index (5.15, O14m). Reads the index file, so it
     // needs no live gateway.
@@ -1045,10 +1069,38 @@ export class OpenClawKit {
             return Promise.reject(new Error('gateway not ready'));
         return this.accountsCtl.setDefaults(member, d);
     }
-    /** Save an explicitly supplied API key (billed per use) in this member's separate key agent. */
+    /** Save an explicitly supplied API key (billed per use) in this member's separate key agent.
+     * `orgId` names the workspace a Go plan login acts for (the pick the app captured at connect);
+     * it rides every probe and run as `x-opencode-org-id`, and replacing the key rewrites it. */
     addKey(agentId, o) {
         return this.keys.add(agentId, o);
     }
+    // The lane's index entry follows its sealed key. A failed write is logged and never fails the add; the start sweep repairs it.
+    async indexKeyLane(member, route) {
+        if (!this.accountsCtl) {
+            this.o.log?.('addKey: the account index is not ready, so the key lane is indexed at the next connect');
+            return;
+        }
+        await this.accountsCtl.key(member, route).catch((error) => this.o.log?.(`addKey: the key lane is not indexed yet: ${error instanceof Error ? error.message : String(error)}`));
+    }
+    /** Remove this member's saved key (the `byokit-key-<member>` lane: its credential store and ready marker), so
+     * `signedIn` is false for it and a restart cannot revive it. `provider` removes only that provider's saved key;
+     * with no saved key the call resolves without doing anything. */
+    removeKey(member, o) {
+        return this.keys.remove(member, o);
+    }
+    // The lane's index entry follows its sealed key down. A failed drop is logged and never fails the removal.
+    async dropKeyLane(member, provider) {
+        if (!this.accountsCtl) {
+            this.o.log?.('removeKey: the account index is not ready, so the key lane entry stays until the next removal');
+            return;
+        }
+        await this.accountsCtl.unkey(member, provider).catch((error) => this.o.log?.(`removeKey: the key lane entry is not dropped yet: ${error instanceof Error ? error.message : String(error)}`));
+    }
+    async backfillKeyLane(member, model) {
+        const found = model === undefined ? [] : routeTable().filter((r) => r.keyEntry && r.readiness === 'ready' && r.provider === providerOf(model));
+        await this.accountsCtl?.backfill(member, found).catch((error) => this.o.log?.(`key lane ${member}: not indexed yet: ${error instanceof Error ? error.message : String(error)}`));
+    }
     async prepareKeyOwner(agentId) {
         this.syncCatalogs();
         await this.catalogs;
@@ -1144,6 +1196,7 @@ export class OpenClawKit {
             });
         return this.runs().run(spec, on, undefined, output);
     }
+    // An API-key run's session is on the key lane (Runs step 2).
     runKey(sessionKey, o) {
         if (o?.auth !== 'apiKey')
             return sessionKey;
@@ -1152,7 +1205,7 @@ export class OpenClawKit {
             throw new Error('Choose your own conversation.');
         return `agent:${keyAgentId(member)}:${tail}`;
     }
-    steer(sessionKey, text, o) {
+    async steer(sessionKey, text, o) {
         return this.runs().steer(this.runKey(sessionKey, o), text);
     }
     async abort(sessionKey, o) {

package/dist/link.js

@@ -7,11 +7,11 @@ import { createServer } from 'node:http';
 import { WebSocketServer } from 'ws';
 import { PublicLinkError, } from '@byokit/pair';
 import { reach } from '@byokit/discover';
-import { ENGINE_VERSION } from "./constants.js";
-import { b64urlDecode, b64urlEncode, sealNotice } from "./notices.js";
-import { routeFor } from "./routes.js";
-import { outputSchema } from "./output.js";
-import { stateWords, words } from "./words.js";
+import { ENGINE_VERSION } from './constants.js';
+import { b64urlDecode, b64urlEncode, sealNotice } from './notices.js';
+import { routeFor } from './routes.js';
+import { outputSchema } from './output.js';
+import { stateWords, words } from './words.js';
 const VIEW_OPS = new Set(['oc.state', 'oc.routes', 'oc.signin.view', 'oc.sessions', 'oc.approvals', 'oc.events',
     'oc.browser.state', 'oc.browser.signins', 'oc.browser.thumb']);
 // This kit's own version, read once from its package.json (beside src/ and dist/ alike).
@@ -322,12 +322,16 @@ export function openclawLink(kit, o) {
                 drives.get(key)?.cancel();
                 const view = { state: 'waiting', via: args.via };
                 latest.set(key, view);
-                const drive = kit.signIn(member, { authChoice: route.choice, via: args.via }, (next) => {
-                    latest.set(key, next);
-                });
+                // A superseded attempt (still activating past its commit point) never writes over the newer one's view.
+                let drive;
+                const current = () => drive !== undefined && drives.get(key) === drive;
+                drive = kit.signIn(member, { authChoice: route.choice, via: args.via }, (next) => { if (current())
+                    latest.set(key, next); });
                 drives.set(key, drive);
-                void drive.done.then((done) => { latest.set(key, done); if (drives.get(key) === drive)
-                    drives.delete(key); }, () => { if (drives.get(key) === drive)
+                void drive.done.then((done) => { if (current()) {
+                    latest.set(key, done);
+                    drives.delete(key);
+                } }, () => { if (current())
                     drives.delete(key); });
                 return latest.get(key);
             }
@@ -336,7 +340,9 @@ export function openclawLink(kit, o) {
                     throw new Error('oc.signin.view needs { provider }');
                 // `ready` is the member's account (signed in to this provider), not the engine: `phaseOf` reads it as done.
                 const key = `${member}:${args.provider}`;
-                const ready = kit.state.phase === 'ready' && await kit.signedIn(member, args.provider);
+                // Native Claude is ready only once this attempt's live activation settles.
+                const native = args.provider === 'claude-cli';
+                const ready = kit.state.phase === 'ready' && await kit.signedIn(member, args.provider) && (!native || (!drives.has(key) && latest.get(key)?.state !== 'failed'));
                 // A finished sign-in whose account is gone since (signed out anywhere, or dropped by the engine) is no
                 // sign-in to show: without this the view says done while `ready` says no, which phaseOf reads as opening.
                 if (!ready && !drives.has(key) && latest.get(key)?.state === 'done')

package/dist/migrate.js

@@ -2,9 +2,9 @@
 // only when the Gateway itself reports every provider signed in.
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { retireArchive } from "./auth-store.js";
-import { MEMBER_ID } from "./members.js";
-import { providers } from "./signin.js";
+import { retireArchive } from './auth-store.js';
+import { MEMBER_ID } from './members.js';
+import { providers } from './signin.js';
 const MOVED = '.moved-to-engine';
 const MARKER = '.canonicalized';
 const TRY_MS = 1_500;

package/dist/pick.js

@@ -1,4 +1,4 @@
-import { words } from "./words.js";
+import { words } from './words.js';
 const DAY_MS = 24 * 60 * 60 * 1000;
 const finite = (n) => typeof n === 'number' && Number.isFinite(n);
 /** The lowercased provider of a well-formed `provider/model` reference; undefined when the reference is malformed. */
@@ -154,6 +154,10 @@ export function resolveSelection(accounts, defaults, sel, room, nowMs, models, b
     const rests = eligible.filter((c) => c.row.out === 'resting');
     if (rests.length)
         return restingPick(rests.reduce((a, b) => ((b.row.until ?? Infinity) < (a.row.until ?? Infinity) ? b : a)));
+    // An empty `bound` (a member-agent conversation holding no indexed account) names no provider: every account is
+    // signed in somewhere else, so the provider-specific sentence would mislead.
+    if (bound !== undefined && !bound.length)
+        return { ok: false, code: 'none', reason: words('auto.noneBound'), considered };
     return { ok: false, code: 'none', reason: words('auto.none', { provider: provider ?? '' }), considered };
     function finish(account, row, how, why) {
         const listed = models?.(account);